Release 0.7.3

.env.example

@@ -6,6 +6,7 @@ BODY_SIZE_LIMIT=6M
 
 # Generate this locally and insert it here as described in README.md. Never commit .env.
 SENDEWERK_SETUP_TOKEN=
+# Public production origins must use HTTPS; loopback HTTP remains available locally.
 SENDEWERK_APP_ORIGIN=http://localhost:5173
 
 # "local" writes messages to the outbox and never contacts a mail server.

CloudronManifest.json

@@ -3,7 +3,7 @@
 	"title": "Sendewerk",
 	"description": "Redaktionelle Planung und Durchführung von heinzlive-Sendungen.",
 	"tagline": "Vom Fundstück bis zur Livesendung",
-	"version": "0.6.1",
+	"version": "0.7.3",
 	"healthCheckPath": "/healthz",
 	"httpPort": 3000,
 	"addons": {

README.md

@@ -2,9 +2,9 @@
 
 Sendewerk ist die redaktionelle Webanwendung für den Weg vom vorbereiteten
 Inhalt bis zur moderierten und archivierten Sendung. Der aktuelle Stand umfasst
-Etappe 1 bis 5: technisches Grundgerüst, Anmeldung und Rollen, einen
+Etappe 1 bis 7: technisches Grundgerüst, Anmeldung und Rollen, Fundus,
-persistenten Fundus, den Sendungsbaukasten sowie Live-Steuerung und eine
+Sendungsbau, Live-Steuerung, Präsentationsausgabe, Abschluss, Archiv,
-abgesicherte Präsentationsausgabe. Abschluss und Archivierung folgen in Etappe 6.
+Freigaben, RSS sowie technische REST- und MCP-Zugänge.
 
 ## Voraussetzungen
 
@@ -62,6 +62,9 @@ enthält bewusst kein Konto und kein Standardpasswort.
 Relative Sendewerk-Pfade werden vom Projektverzeichnis aus aufgelöst. In
 Cloudron liegen Datenbank und Uploads unter `/app/data`.
 
+Eine öffentliche Produktions-Origin muss HTTPS verwenden. Nur für lokale
+Loopback-Adressen bleibt HTTP zulässig.
+
 Der Vorgabemodus `local` baut keine Netzwerkverbindung auf. Einladungen und
 Passwort-Resets landen als JSON-Dateien in `.data/mail-outbox`; die enthaltenen
 Links sind Geheimnisse und dürfen nicht veröffentlicht werden. Echter Versand
@@ -151,6 +154,53 @@ DNS-, Redirect-, Zeit- und Größenlimits abgerufen. Private und lokale
 Netzwerkziele sind gesperrt. Eingebettetes HTML oder Skripte einer Quellseite
 werden nicht übernommen.
 
+## MCP und ChatGPT
+
+Der lesende Streamable-HTTP-Endpunkt liegt unter `/mcp`. Seine konkrete
+Adresse ist die konfigurierte Anwendungs-Origin mit angehängtem Pfad:
+
+```text
+https://<Cloudron-App-Domain>/mcp
+```
+
+Beispiel: Bei `SENDEWERK_APP_ORIGIN=https://sendewerk.example.org` lautet die
+MCP-URL `https://sendewerk.example.org/mcp`. Niemals einen technischen
+REST-Token an die URL hängen oder in ChatGPT eintragen. MCP verwendet einen
+eigenen OAuth-2.1-Flow mit Authorization Code, PKCE und kurzlebigen Tokens.
+
+Die Verbindung stellt ausschließlich lesende Werkzeuge bereit:
+
+- `get_profile` identifiziert das verbundene Sendewerk-Konto ohne E-Mail-Adresse.
+- `list_pieces` und `get_piece` lesen Fundus-Pieces.
+- `list_shows` und `get_show_rundown` lesen Sendungen und deren Abläufe.
+
+Die Detailwerkzeuge können private Recherche, Moderationsnotizen, Quellen,
+eigene Notizen und Reserveinhalte liefern. Der angemeldete Nutzer muss diesem
+Umfang ausdrücklich zustimmen. Sperrung oder Passwortwechsel widerrufen
+bestehende OAuth-Tokens; jede MCP-Anfrage prüft Konto, Scope, Ablauf und
+Zielressource erneut. MCP kann keine Inhalte schreiben.
+
+### In ChatGPT einrichten
+
+1. Zuerst Version `0.7.3` unter der endgültigen öffentlichen HTTPS-Origin
+   bereitstellen. Lokalhost ohne öffentliches HTTPS ist für eine direkte
+   ChatGPT-Verbindung nicht erreichbar.
+2. In [ChatGPT Plugins](https://chatgpt.com/plugins) das Plus wählen und
+   **Add custom MCP server** öffnen.
+3. Einen Namen und eine Beschreibung vergeben und unter **Connection** die
+   vollständige URL `https://<Cloudron-App-Domain>/mcp` eintragen.
+4. OAuth als Authentifizierung verwenden, den Risikohinweis prüfen und
+   **Create as a plugin** wählen. ChatGPT entdeckt die OAuth-Endpunkte und
+   registriert einen öffentlichen PKCE-Client dynamisch.
+5. Im geöffneten Sendewerk-Fenster mit dem eigenen Konto anmelden, Clientname
+   und Rücksprung-Domain prüfen und den lesenden Zugriff ausdrücklich erlauben.
+6. Die gefundenen fünf Werkzeuge kontrollieren, das Plugin installieren und in
+   einer neuen Unterhaltung über `@` auswählen.
+
+Eine erfolgreich lokale OAuth- und MCP-Prüfung beweist noch keine reale
+ChatGPT-Verbindung. Diese muss nach dem Cloudron-Update separat in der
+jeweiligen ChatGPT-Workspace-Konfiguration durchgeführt werden.
+
 ## Befehle
 
 | Befehl               | Zweck                                                      |
@@ -210,6 +260,12 @@ Umgebungsvariable gesetzt werden. `CLOUDRON_APP_ORIGIN` liefert dort die feste
 HTTPS-Origin. SMTP-Zugangsdaten werden ebenfalls ausschließlich als
 Laufzeitvariablen gesetzt, nicht in Manifest oder Image geschrieben.
 
+Für MCP sind keine zusätzlichen Geheimnisse erforderlich. Nach einem Update
+auf `0.7.3` führt der bestehende Startprozess Migration `0020_oauth_mcp.sql`
+aus. Anschließend muss die von Cloudron gelieferte HTTPS-Origin mit der in
+ChatGPT eingetragenen MCP-Domain übereinstimmen. Reverse Proxy und öffentliche
+Erreichbarkeit wurden ohne Cloudron-Zugang nicht geprüft.
+
 Das ersetzt keinen Test auf einem echten Cloudron. Insbesondere Addon-Backup,
 Restore, Proxy-Origin und das read-only Laufzeitdateisystem können erst dort
 abschließend geprüft werden.

docs/ACCEPTANCE.md

@@ -1,9 +1,104 @@
 # Abnahme
 
+## Lesender MCP-Zugang 0.7.3
+
+| Bereich                               | Nachweis                                                                                                             | Stand                 |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| OAuth-Discovery und anonymer Schutz   | Reale lokale HTTP-Anfrage erhält 401 mit `resource_metadata`; Discovery-Routen sind im Produktionsbuild enthalten    | erfüllt am 27.10.2026 |
+| DCR, Zustimmung und PKCE              | Isolierter HTTP-Ablauf registriert Client, lädt Zustimmung, erhält Code mit `state`/`iss` und tauscht per S256       | erfüllt am 27.10.2026 |
+| Nutzer-, Scope- und Ressourcenbindung | Ausgestellter Token ist gehasht persistiert und wird bei jedem Aufruf gegen Nutzer, Scope, Ablauf und `/mcp` geprüft | erfüllt am 27.10.2026 |
+| MCP-Kompatibilität                    | Legacy-Initialisierung `2025-11-25` sowie `server/discover` und `tools/list` mit `2026-07-28` über HTTP              | erfüllt am 27.10.2026 |
+| Tatsächliche Leseanfrage              | `tools/call` auf `list_pieces` liefert aus einer temporären Seed-Datenbank reale Pieces                              | erfüllt am 27.10.2026 |
+| Schreibschutz und Datenminimierung    | Nur fünf Lese-Tools; Positivprojektionen ohne E-Mail, Uploadnamen, Dateipfade und Werkzeug-Arbeitsdaten              | erfüllt am 27.10.2026 |
+| ChatGPT- und Cloudron-Verbindung      | Kein Deployment und keine externe Clientumgebung vorhanden                                                           | offen                 |
+
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- Gezielter isolierter HTTP-Ablauf: OAuth Code Flow, PKCE, anonymer Challenge,
+  Legacy-Initialisierung, aktuelle Discovery, Toolliste und echte
+  `list_pieces`-Anfrage erfolgreich.
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`.
+- Keine weitere Verhaltenstest- oder Browsermatrix gemäß Auftrag ausgeführt;
+  die Zustimmungsseite wurde im HTTP-Ablauf geladen, aber nicht visuell geprüft.
+- Echte ChatGPT-Verbindung, öffentliche HTTPS-Erreichbarkeit und Cloudron-
+  Reverse-Proxy-Verhalten bleiben bis zu einem ausdrücklich freigegebenen
+  Deployment offen.
+
+## Wartungsrelease 0.7.2
+
+| Bereich                                        | Nachweis                                                                                                                                | Stand                 |
+| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| RSS-Auswahl im Eingang (#16)                   | Chromium wählt zwei Beiträge über Quellenfilter und zwei Seiten, öffnet den Originallink ohne Umschalten und importiert nur die Auswahl | erfüllt am 26.10.2026 |
+| Live-Menü nach Nutzerabsicht (#18)             | Chromium prüft laufenden, pausierten und beendeten Zustand, direkte Timersteuerung, eingeklappte Ausgabe und erreichbare Navigation     | erfüllt am 26.10.2026 |
+| RSS-/API-Verwaltung im Katalogstil (#21)       | Chromium legt einen Feed an und bearbeitet ihn; API-Zugang, einmaliges Tokenkopieren und Berechtigungsänderung geprüft                  | erfüllt am 26.10.2026 |
+| Responsive Gestaltung und Farbschemata         | RSS-Auswahl und Feed-Dialog mobil/dunkel, Verwaltung desktop/hell, Live-Menü mobil und bei 670 × 450 Pixeln geprüft                     | erfüllt am 26.10.2026 |
+| Erhalt von Daten, Rechten und Sicherheitslogik | 13 gezielte Feed-/Live-/Zugangstests sowie vollständiger Verhaltenstestlauf; keine Schemaänderung                                       | erfüllt am 26.10.2026 |
+
+- `npm test`: 60 von 60 Verhaltenstests erfolgreich.
+- `npm run lint`: erfolgreich.
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`.
+- `npm run test:e2e`: 20 von 20 Chromium-Abläufen erfolgreich.
+- Andere Browser und echte Mobilgeräte: offen.
+
+## Wartungsrelease 0.7.1
+
+| Bereich                                              | Nachweis                                                                                                                  | Stand                                                      |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| Abschnittsdauer und Rückkehr zu früheren Pieces (#1) | Live-Verhaltenstests für geänderte Plandauer, Wiederaufnahme, Abschnittslaufzeit und Gesamtzeit; Chromium-Ablauf          | erfüllt am 26.10.2026                                      |
+| Mobiler Live-Ablauf und Metadaten (#3, #13)          | mobile Live-Regie ohne horizontalen Überlauf; viewportgebundenes Sheet, Safe-Area-/Standalone-Basis und Fokus in Chromium | Chromium erfüllt; Safari und installierte iOS-Webapp offen |
+| Mobile Sendungskarten (#5)                           | responsive Karten im vollständigen Chromium-Lauf bei 390 Pixeln geöffnet                                                  | erfüllt am 26.10.2026                                      |
+| Vorbereitung nach Einplanung (#6, #15)               | Migration und Servertest für konkrete Usage-Snapshots; Chromium öffnet die Usage und entfernt sie nach „sendefertig“      | erfüllt am 26.10.2026                                      |
+| Kontextabhängige Präsentation (#8)                   | vier serverseitig getrennte Modi; Fundus-/Usage-Vorschauen sowie Link-, Video-, Text-/Bildausgabe in Chromium             | erfüllt am 26.10.2026                                      |
+| Gastansicht und Freigaben (#11, #12)                 | gestalteter Einzeldialog, Verwaltungsreihenfolge und Kartenpadding per Chromium; Tokenersatz mit Invalidierungstest       | erfüllt am 26.10.2026                                      |
+| Iconsuche (#14)                                      | Suchfokus innerhalb der öffnenden Bedienaktion; Chromium bei mobilen und breiten Ansichten                                | erfüllt am 26.10.2026                                      |
+
+- `npm test`: 60 von 60 Verhaltenstests erfolgreich.
+- `npm run lint`: erfolgreich.
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`.
+- `npm run test:e2e`: 19 von 19 Chromium-Abläufen erfolgreich.
+- Safari auf echtem iOS-Gerät: offen.
+- Installierte Webapp auf echtem iOS-Gerät: separat offen.
+
+## Etappe 7
+
+| Kriterium                                    | Nachweis                                                                                                                   | Stand                 |
+| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| Feedverwaltung und geplanter/manueller Abruf | Barkeeper-Oberfläche, Prozess-Scheduler und gemeinsame Abruffunktion                                                       | erfüllt am 25.10.2026 |
+| Getrennter Vorschau-Eingang                  | RSS-Beiträge erscheinen separat und werden nur nach Mehrfachauswahl zu Pieces                                              | erfüllt am 25.10.2026 |
+| Kategoriezuordnung und Herkunft              | Auswahlkategorien oder Feed-Standard sowie Original-URL als Piece-Quelle im Verhaltenstest                                 | erfüllt am 25.10.2026 |
+| Dubletten und dauerhaftes Verwerfen          | wiederholter Testabruf erzeugt keinen zweiten Eintrag und stellt Verworfenes nicht wieder her                              | erfüllt am 25.10.2026 |
+| HTML-Bereinigung und Abrufgrenzen            | Testfeed entfernt fremdes HTML; Loopback wird vor Request blockiert; Größe, Zeit, Redirects und Eintragszahl sind begrenzt | erfüllt am 25.10.2026 |
+| Fehlerisolation                              | defekter lokaler Testfeed wird protokolliert, weiterer fälliger Feed trotzdem importiert                                   | erfüllt am 25.10.2026 |
+| Versionierte REST-API und OpenAPI            | `/api/v1` für Pieces, Sendungen und Einplanungen; `/api/v1/openapi.json`                                                   | erfüllt am 25.10.2026 |
+| Begrenzte und widerrufbare Zugänge           | gehashte Tokens; Verhaltenstest für Lesen, verweigertes Schreiben und sofortigen Widerruf                                  | erfüllt am 25.10.2026 |
+| Änderungsnachweis und Idempotenz             | Audit-Ereignisse und persistente Idempotenz; identische Wiederholung liefert dasselbe Ergebnis                             | erfüllt am 25.10.2026 |
+| API-Rundlauf                                 | echter HTTP-Test: lesen, anlegen, ändern, erneut lesen, einplanen und sortieren                                            | erfüllt am 25.10.2026 |
+| Nutzung ohne KI                              | RSS und API sind optional; bestehende Redaktion funktioniert unverändert ohne externen Client                              | erfüllt am 25.10.2026 |
+| Konkrete ChatGPT-/Codex-Anbindung            | keine Clientumgebung oder Zugangsdaten vorhanden                                                                           | offen                 |
+
+- `npm run check`: 0 Fehler und 0 Warnungen.
+- `npm test`: 58 von 58 Verhaltenstests erfolgreich.
+- Gezielte Etappe-7-Tests: 6 von 6 erfolgreich.
+- `npm run build`: erfolgreich mit `@sveltejs/adapter-node`.
+- `npm audit --omit=dev`: 0 gemeldete Schwachstellen.
+- Gezielte Chromium-Prüfung: Desktop-Verwaltung, mobiler Eingang und kompletter
+  HTTP-API-Rundlauf erfolgreich, keine Konsolenfehler.
+- `npm run test:e2e`: auf dem Standardport wegen eines bereits laufenden fremden
+  Prozesses nicht startbar; identische temporäre Konfiguration auf Port 4188 mit
+  16 von 18 erfolgreichen Abläufen. Bekannte Fehler bleiben bei Live-Zeitanzeige
+  und Abschluss/Freigabe bestehen.
+- `npm run lint`: nicht erfolgreich wegen acht bereits vorhandener
+  Prettier-Abweichungen außerhalb der Etappe-7-Dateien; geänderte Dateien wurden
+  separat formatiert.
+- Dokumentationsstatus: **API/MCP getestet, Client-Anbindung offen**. Konkret ist
+  die REST-API getestet; ein zusätzlicher MCP-Adapter wurde nicht benötigt und
+  keine echte ChatGPT-/Codex-Verbindung hergestellt.
+
 ## Wartungsrelease 0.6.1
 
 | Bereich                                              | Stand                                                                                       |
-| --- | --- |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------- |
 | Live-Timer, Kopfzeile, Drawer und Positionsanzeige   | behoben                                                                                     |
 | Mobile Formulare und Iconsuche                       | behoben                                                                                     |
 | Vorbereitungsaufwand und Übersicht                   | behoben                                                                                     |

docs/ARCHITECTURE.md

@@ -3,7 +3,7 @@
 ## Systemgrenze
 
 Sendewerk ist ein einzelner SvelteKit-Prozess. Browserseiten, serverseitige
-Actions, spätere REST-Endpunkte und Hintergrundaufgaben verwenden dieselbe
+Actions, REST-Endpunkte und Hintergrundaufgaben verwenden dieselbe
 Geschäftslogik. SQLite und ein lokales Upload-Verzeichnis sind die einzigen
 persistenten Laufzeitabhängigkeiten. Externe Mail-, RSS- oder KI-Dienste sind
 nicht Voraussetzung für Kernfunktionen.
@@ -11,7 +11,7 @@ nicht Voraussetzung für Kernfunktionen.
 ```text
 Browser -> SvelteKit-Routen -> Anwendungsdienste -> SQLite
                                 |                -> Upload-Verzeichnis
-                                +-> später: Mail/RSS über Adapter
+                                +-> Mail/RSS über begrenzte Adapter
 ```
 
 Servercode lebt unter `src/lib/server` und darf nicht in Browser-Bundles
@@ -33,13 +33,13 @@ spätere API dieselben Regeln verwenden.
 
 ## Gesamtdatenmodell
 
-Die ersten sechs Etappen materialisieren Identität, Inhaltsverwaltung,
+Die ersten sieben Etappen materialisieren Identität, Inhaltsverwaltung,
-Sendungsplanung, Live-Durchführung, Historie und Lesefreigaben. Folgende Grenzen
+Sendungsplanung, Live-Durchführung, Historie, Lesefreigaben, RSS-Import und eine
-gelten für umgesetzte und spätere Bereiche.
+technische API. Folgende Grenzen gelten für umgesetzte und spätere Bereiche.
 
 | Bereich     | Geplante Entitäten und Beziehungen                                                                                                          |
 | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Identität   | `users`, Rollen, Sessions, Einladungen, Reset-Tokens und Sperren sind umgesetzt; technische Zugänge folgen später                           |
+| Identität   | `users`, Rollen, Sessions, Einladungen, Reset-Tokens und Sperren sowie getrennte technische Zugänge                                         |
 | Taxonomie   | getrennte `section_categories`, `formats`, `topics` samt optionalem Themenicon; Pieces und Vorschläge mehrfach verknüpft                    |
 | Inhalt      | `pieces` mit Status, Soft Delete, Favorit, Revision, Texten, Quellen, Werkzeugen und privaten Medien; Vorlagen speichern Snapshots          |
 | Sendungsbau | `shows`, geordnete `show_sections`, `piece_usages` samt Quellen-/Werkzeug-/Themen-/Mediensnapshots, Reservebank und Vorlagen                |
@@ -99,6 +99,43 @@ konfigurierten Outbox-Pfad, `smtp` nutzt Nodemailer nur nach expliziter Auswahl.
 Die feste Anwendungs-Origin erzeugt Links und bestimmt den `Secure`-Status der
 Cookies; sie wird nicht aus ungeprüften Request-Headern übernommen.
 
+Technische Zugänge sind keine Browsersitzungen. Sie besitzen zufällige
+Bearer-Tokens, von denen nur SHA-256-Hashes gespeichert werden, und genau einen
+der Umfänge `read` oder `read_write`. Widerruf wirkt beim nächsten Request.
+`/api/v1` umgeht lediglich den Browser-Loginredirect; jeder Endpunkt prüft Token
+und erforderlichen Umfang selbst. Schreibzugriffe hinterlassen ein
+`audit_event`; Neuanlage und Planungsänderungen verlangen zusätzlich einen je
+Zugang eindeutigen, persistent gespeicherten Idempotenzschlüssel.
+
+## RSS-Import
+
+`src/lib/server/feeds.ts` bildet Abruf, XML-Verarbeitung und Übernahme gemeinsam
+für manuelle Aktionen und den Prozess-Scheduler ab. Der Scheduler startet beim
+ersten Request und prüft minütlich höchstens zehn fällige aktive Feeds. Jeder
+Feed wird getrennt behandelt, sodass ein Fehler weitere Abrufe nicht stoppt.
+HTTP-Abrufe erlauben nur HTTP(S) auf Standardports, prüfen DNS sowie jedes
+Redirectziel gegen interne Adressen und begrenzen Laufzeit, Redirects und
+Antwortgröße. RSS/Atom wird mit deaktivierter Entity-Verarbeitung gelesen;
+höchstens 200 Einträge je Antwort werden berücksichtigt und fremdes HTML wird zu
+reinem Text reduziert.
+
+`feed_entries` ist ein eigener Eingang. `(feed_id, external_id)` verhindert
+Dubletten; Aktualisierungen ändern den redaktionellen Status nicht. `discarded`
+bleibt deshalb auch nach späteren Abrufen erhalten. Erst die bewusste
+Mehrfachauswahl erzeugt innerhalb einer Transaktion normale Inbox-Pieces mit
+Kategorien und Original-URL als Quelle und setzt den Eintrag auf `imported`.
+
+## Technische REST-API
+
+Die Routen unter `/api/v1` bilden keine zweite Fachlogik, sondern rufen
+`content.ts` und `shows.ts` auf. Piece- und Sendungsrevisionen schützen weiterhin
+vor verlorenen Änderungen. `api_idempotency` speichert Request-Hash, Status und
+JSON-Antwort, sodass wiederholte Schreibbefehle dasselbe Ergebnis liefern und
+ein gleicher Schlüssel mit verändertem Inhalt abgewiesen wird. Die OpenAPI-3.1-
+Beschreibung ist unter `/api/v1/openapi.json` erreichbar. Ein MCP-Adapter oder
+produktspezifischer KI-Client gehört nicht zur Laufzeit und ist nicht
+Voraussetzung für die Bedienung.
+
 ## Inhalte, Markdown und Medien
 
 Etappe 3 führt die Inhaltslogik in `src/lib/server/content.ts` zusammen. Listen
@@ -413,3 +450,67 @@ bestehenden SQLite-Check-Constraints als zusätzliches Kennzeichen an Original
 und Usage-Snapshot gespeichert; nach außen bleibt er der eindeutige Modus
 `image`. Öffentlich passiert weiterhin nur das ausdrücklich gewählte
 Präsentationsmedium.
+
+## Wartungskorrekturen 0.7.1
+
+Migration `0019` ergänzt `preparation_status_snapshot` und
+`preparation_effort_snapshot` an `piece_usages` und übernimmt für vorhandene
+Einplanungen einmalig die damaligen Originalwerte. Danach ist ausschließlich die
+konkrete Sendungsfassung maßgeblich. Einplanen, Duplizieren und bewusstes
+Aktualisieren aus dem Fundus kopieren beide Werte; der Usage-Editor ändert sie
+unabhängig. Die Übersicht berücksichtigt vorbereitende Nicht-Reserve-Usages
+aktiver Sendungen, priorisiert zuerst deren Termin und führt direkt zum Editor.
+
+Ein Freigabe-Ersatzlink rotiert ausschließlich den gehashten Token derselben
+Freigabe. Umfang, Passwort-Hash und Ablauf bleiben erhalten, der alte Token und
+alle bisherigen Gastsitzungen werden in derselben Transaktion ungültig. Der neue
+Klartexttoken wird weiterhin nur in der Action-Antwort ausgegeben.
+
+## Bedienkorrekturen 0.7.2
+
+Der RSS-Auswahldialog erhält weiterhin ausschließlich `new`-Einträge aus
+`listFeedEntries`. Quellenfilter, Seiteneinteilung und noch nicht bestätigte
+Auswahl sind flüchtiger Browserzustand. Erst das Formular im erreichbaren
+Dialogfuß übergibt die gewählten IDs an die unveränderte transaktionale
+Übernahme; dadurch bleiben persistenter Dublettenschutz, Herkunft und
+Standardkategorien die einzige fachliche Wahrheit.
+
+Feed- und Zugangsdialoge verwenden dieselben globalen Management-Dialog- und
+Katalogstile wie Werkzeuge. Das Bearbeiten eines technischen Zugangs ändert nur
+Name und Umfang des bestehenden gehashten Tokens und wird auditiert. Die
+Live-Route projiziert zusätzlich nur, ob der feste Ausgabekanal getrennt, mit
+dieser oder mit einer anderen Sendung verbunden ist. Das Öffnen von Menü und
+Ausgabedetails führt selbst keine Mutation aus.
+
+## Lesender MCP-Zugang 0.7.3
+
+`/mcp` ist ein stateless Streamable-HTTP-Adapter über `content.ts` und
+`shows.ts`. Er unterstützt die aktuelle per Request deklarierte MCP-Fassung
+`2026-07-28` einschließlich `server/discover`, Header-/Body-Abgleich und
+`resultType`. Für derzeitige OpenAI-Clients bleiben die Initialisierungsfassungen
+`2025-11-25`, `2025-06-18` und `2025-03-26` verfügbar. Es gibt keine
+MCP-Sitzung und keinen unabhängigen SSE-Strom; jede Anfrage trägt erneut ihre
+Authentifizierung.
+
+Die fünf Werkzeuge sind ausschließlich lesend. Eigene Positivprojektionen
+lassen Mediennamen, interne Speicherpfade und Werkzeug-Arbeitsdaten aus. Die
+Detailprojektionen dürfen nach ausdrücklicher Zustimmung redaktionell private
+Recherche, Moderation, eigene Notizen, Quellen und Reserveinhalte enthalten.
+Keine MCP-Methode ruft Mutationsdienste auf.
+
+Sendewerk ist zugleich OAuth-Autorisierungs- und Ressourcenserver. Geschützte
+Ressourcen- und Authorization-Server-Metadaten verweisen ausschließlich auf die
+konfigurierte Origin. Öffentliche PKCE-Clients werden per begrenztem DCR
+registriert; die Autorisierung verlangt exakte Redirect-URI, `S256`, den Scope
+`sendewerk:read` und den exakten Ressourcenindikator `<Origin>/mcp`. Codes sind
+fünf Minuten, Zugriffstokens eine Stunde gültig. SQLite speichert nur SHA-256-
+Hashes. Tokens sind direkt an Nutzer, Client, Scope und Ressource gebunden;
+Kontosperre und Passwortwechsel widerrufen sie, und jeder MCP-Aufruf verbindet
+erneut den aktuellen Nutzerzustand.
+
+DCR ist für die von OpenAI weiterhin unterstützte Kompatibilität vorhanden,
+aber pro Quelladresse und insgesamt begrenzt. Clientnamen sind nicht verifiziert;
+der Zustimmungsdialog kennzeichnet dies und zeigt die genaue Rücksprung-Domain.
+Öffentliche Produktion verlangt HTTPS, während HTTP nur an Loopback-Adressen
+zulässig bleibt. Der bestehende technische REST-Token wird weder gelesen noch
+weitergereicht.

docs/DECISIONS.md

@@ -459,3 +459,114 @@ Bildmodus verwendet ein separates boolesches Kennzeichen, damit bestehende
 Tabellen und Daten trotz älterer Modus-Check-Constraints ohne riskanten
 Tabellenumbau erhalten bleiben. Freigabeverwaltung bleibt eine gemeinsame
 Komponente und öffnet in allen drei internen Einstiegen als nativer Dialog.
+
+## D-029: RSS als persistenter Eingang mit begrenztem Abruf
+
+Externe Feeds schreiben nie direkt in den Fundus. Quelle und stabiler
+Eintragsschlüssel werden in einem eigenen Eingang gespeichert; dessen Zustand
+`discarded` oder `imported` wird bei einem erneuten Abruf nicht zurückgesetzt.
+Erst eine bewusste Auswahl erzeugt über `content.ts` ein normales Piece samt
+Originalquelle und gewählten Kategorien. Dadurch bleiben redaktionelle
+Entscheidung, Dublettenschutz und Herkunft nachvollziehbar.
+
+Manueller und geplanter Abruf verwenden denselben Adapter. Wie bei
+Linkmetadaten werden private Ziele, Nichtstandardports und ungeprüfte Redirects
+gesperrt; zusätzlich gelten enge Zeit-, Größen- und Mengenlimits. XML-Entities
+bleiben deaktiviert und fremdes HTML wird nicht gespeichert. Ein Fehler wird am
+betroffenen Feed persistiert und unterbricht keine weiteren fälligen Feeds.
+
+## D-030: Technische Tokens, Scopes und persistente Idempotenz
+
+Externe Assistenz erhält keine simulierte Redaktionssitzung und keine
+Sonderrechte. Eigene zufällige Bearer-Tokens liegen nur gehasht vor, sind sofort
+widerrufbar und erlauben entweder Lesen oder Lesen und Schreiben. REST-Routen
+unter `/api/v1` verwenden die bestehenden Inhalts- und Sendungsdienste, damit
+Validierung, Revisionen und Transaktionen identisch bleiben. Jede erfolgreiche
+Mutation wird mit technischem Akteur, Aktion und Ziel protokolliert.
+
+Neuanlage, Einplanung und Sortierung verlangen einen `Idempotency-Key`.
+Zugang, Schlüssel, Hash des Requestinhalts und vollständige Antwort werden in
+derselben SQLite-Transaktion gespeichert. Eine identische Wiederholung erhält
+dieselbe Antwort; ein veränderter Request mit demselben Schlüssel wird
+abgewiesen. OpenAPI 3.1 beschreibt diese Grenze maschinenlesbar. Ein MCP-Adapter
+oder ein bestimmter KI-Client wird nicht vorgetäuscht: Die Anwendung bleibt ohne
+KI vollständig nutzbar und eine konkrete Client-Verbindung muss separat geprüft
+werden.
+
+## D-031: Usage-basierte Vorbereitung und rotierende Freigabelinks
+
+Die Sendungsübersicht erzeugt keinen zusätzlichen Vorbereitungszustand. Sie
+projiziert konkrete Usage-Snapshots aktiver Sendungen, deren Fundus-Original noch
+`preparing` ist. So bleiben bestehende Daten und Snapshots unverändert, während
+ungeplante Fundus-Arbeit aus der Sendungsübersicht verschwindet.
+
+Weil Freigabetokens nur gehasht gespeichert werden, kann ein bestehender Link
+nicht erneut angezeigt werden. Ein Ersatzlink rotiert deshalb den Token derselben
+Freigabe transaktional und löscht alle Gastsitzungen; Sichtumfang, Passwort und
+Ablauf werden nicht stillschweigend verändert.
+
+## D-032: Vorbereitung als Eigenschaft der konkreten Einplanung
+
+Die erste 0.7.1-Umsetzung aus D-031 leitete den Vorbereitungszustand noch vom
+veränderlichen Fundus-Original ab. Das widerspricht der bestehenden Kopierregel
+für Sendungsfassungen und verhindert unterschiedliche Arbeitsstände bei
+Mehrfachverwendung. D-032 ersetzt deshalb diesen Teil von D-031: Status und
+Aufwand werden mit Migration `0019` additiv an `piece_usages` gespeichert.
+
+Vorbereitende und sendefertige Originale dürfen eingeplant werden. Einplanung,
+Duplikation und ausdrückliches Aktualisieren kopieren den Zustand, während der
+Usage-Editor ihn danach unabhängig ändert. `piece_usages.status` bleibt davon
+getrennt und beschreibt weiterhin ausschließlich den Livezustand `open`,
+`current`, `done` oder `skipped`.
+
+## D-033: Auswahlzustand flüchtig, Verwaltungslogik gemeinsam
+
+Quellenfilter, Pagination und Mehrfachauswahl des RSS-Dialogs bleiben lokaler
+UI-Zustand. Persistiert wird erst durch die bestehende transaktionale
+Importaktion, damit Blättern oder Öffnen eines externen Links niemals
+redaktionelle Inhalte erzeugt. Die Verwaltung ruft weiterhin dieselben Feed-
+und Zugangsdienste auf; neue Dialoge ersetzen nur die dauerhaft ausgebreiteten
+Formulare. Ein technischer Zugang darf Name und Umfang ändern, behält dabei aber
+seinen ausschließlich gehasht gespeicherten Token und erzeugt ein Auditereignis.
+
+Das Live-Menü zeigt einen rein gelesenen Verbindungsstatus des Ausgabekanals.
+Nur die bereits vorhandenen expliziten Verbinden-, Rotieren- und Trennenaktionen
+verändern öffentliche Ausgabe. Navigation zur Planung bleibt davon getrennt.
+
+## D-034: Nutzergebundener OAuth-Zugang statt Token-Passthrough
+
+Der bestehende technische REST-Zugang kann und darf nicht für ChatGPT
+weitergereicht werden: Sein Klartexttoken ist nach der Erstellung nicht mehr
+verfügbar, und MCP verbietet Token-Passthrough. Sendewerk stellt deshalb einen
+eigenen OAuth-2.1-Authorization-Code-Flow für öffentliche Clients bereit. PKCE
+`S256`, exakte Redirect-URIs und der auf `<Origin>/mcp` gebundene
+Ressourcenindikator sind verpflichtend. Codes und einstündige Zugriffstokens
+liegen ausschließlich gehasht vor und sind direkt an ein aktives Nutzerkonto
+gebunden.
+
+Die Autorisierungsserver-Metadaten bieten das von OpenAI unterstützte Dynamic
+Client Registration als Kompatibilitätsweg an. Die aktuelle MCP-Fassung stuft
+DCR zugunsten von Client ID Metadata Documents als veraltet ein. Ein allgemeiner
+CIMD-Abruf würde jedoch eine neue SSRF- und Cache-Sicherheitsgrenze eröffnen;
+für diese private Anwendung bleibt DCR deshalb eng mengen- und ratenbegrenzt.
+Der Zustimmungsdialog behandelt den selbst gemeldeten Clientnamen ausdrücklich
+als unverifiziert und zeigt dessen Rücksprung-Domain.
+
+Der MCP-Adapter unterstützt sowohl die aktuelle stateless Fassung `2026-07-28`
+als auch die von OpenAI weiterhin dokumentierten Initialisierungsfassungen bis
+`2025-03-26`. Tooldaten werden aus bestehenden Diensten positiv projiziert.
+Der einzige Scope `sendewerk:read` ist im Dialog ausdrücklich einschließlich
+privater redaktioneller Recherche beschrieben; E-Mail, Uploadnamen,
+Speicherpfade und Werkzeug-Arbeitsdaten werden nicht ausgegeben. Alle Werkzeuge
+sind als lesend markiert und haben keinen Pfad zu Mutationsdiensten.
+
+Quellen, geprüft am 27. Oktober 2026:
+
+- <https://developers.openai.com/apps-sdk/build/auth>
+- <https://developers.openai.com/apps-sdk/deploy/connect-chatgpt>
+- <https://platform.openai.com/docs/mcp>
+- <https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization>
+- <https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http>
+- <https://modelcontextprotocol.io/specification/2026-07-28/basic/versioning>
+- <https://modelcontextprotocol.io/specification/2026-07-28/server/discover>
+- <https://modelcontextprotocol.io/specification/2026-07-28/server/tools>

docs/RELEASE_NOTES.md

@@ -1,5 +1,113 @@
 # Release Notes
 
+## 0.7.3 - Lesender MCP-Zugang mit OAuth 2.1
+
+Veröffentlicht am 27. Oktober 2026
+
+- Der öffentliche Streamable-HTTP-Endpunkt `/mcp` bietet fünf ausschließlich
+  lesende Werkzeuge für Kontoidentität, Pieces, Sendungen und vollständige
+  Abläufe. Er verwendet die bestehenden Inhalts- und Sendungsdienste und keine
+  parallele Datenhaltung.
+- OAuth-2.1-Discovery, begrenzte dynamische Clientregistrierung,
+  Authorization Code, PKCE `S256`, exakte Redirect-URI und Ressourcenbindung
+  ermöglichen die von OpenAI dokumentierte Kontoverknüpfung. Codes und
+  einstündige Tokens werden nur gehasht gespeichert.
+- Nutzerzustand, Sperren und Rollen werden bei jedem MCP-Aufruf erneut gelesen.
+  Passwortwechsel und Kontosperre widerrufen bestehende OAuth-Tokens. Der
+  vorhandene technische REST-Token wird weder offengelegt noch weitergereicht.
+- MCP `2026-07-28` und die weiterhin von OpenAI verwendeten älteren
+  Initialisierungsfassungen werden am selben stateless Endpunkt unterstützt.
+  Private redaktionelle Details sind erst nach ausdrücklicher Zustimmung
+  lesbar; E-Mail, Uploadnamen, interne Pfade und Werkzeug-Arbeitsdaten bleiben
+  ausgeschlossen.
+- Die Produktions-URL lautet `https://<Cloudron-App-Domain>/mcp`. README und
+  Betriebsdokumentation beschreiben die Einrichtung über **Add custom MCP
+  server**. Das Release wurde nicht auf Cloudron ausgerollt und eine reale
+  ChatGPT-Verbindung wird nicht als geprüft ausgegeben.
+- Paket, Lockdatei und Cloudron-Manifest tragen Version `0.7.3`. Migration
+  `0020_oauth_mcp.sql` ergänzt additive OAuth- und Ratenbegrenzungstabellen.
+- Typprüfung und Produktionsbuild sind erfolgreich. Ein isolierter lokaler
+  HTTP-Rundlauf hat OAuth, beide MCP-Protokollgenerationen und eine echte
+  `list_pieces`-Anfrage geprüft; eine reale ChatGPT-/Cloudron-Verbindung bleibt
+  ausdrücklich offen.
+
+## 0.7.2 - RSS-Auswahl, Live-Menü und Schnittstellenverwaltung
+
+Veröffentlicht am 26. Oktober 2026
+
+- Der Eingang zeigt neue RSS-Beiträge in einer kompakten Katalogfläche. Ein
+  großzügiger, mobil vollflächiger Dialog filtert mehrere Quellen vor der
+  Seiteneinteilung, zeigt 20 Beiträge je Seite und behält die barrierefrei
+  erkennbare Auswahl über Quellen- und Seitenwechsel. Erst die ausdrückliche
+  Übernahme erzeugt Eingangspieces; Herkunft, Kategorien, Verwerfen und
+  Dublettenschutz bleiben erhalten (#16).
+- Das Live-Menü folgt der Nutzerabsicht: Sendungssteuerung, kompakte Ansicht,
+  Lesefreigaben, standardmäßig eingeklappte OBS-Ausgabe und getrennte Navigation
+  sind klar geordnet. Pause/Fortsetzen sowie Abschnitts- und Gesamtreset liegen
+  direkt bei den Timern. Laufend, pausiert und beendet werden eindeutig
+  unterschieden; Navigation allein verändert weder Lauf noch Ausgabe (#18).
+- RSS-Feeds und technische API-Zugänge verwenden Panel, Typografie,
+  Eintragskarten, Classic-Regular-Icons und Dialograhmen des Werkzeugkatalogs.
+  Feeds und Zugänge lassen sich in Dialogen anlegen und bearbeiten; Abruf,
+  Löschen beziehungsweise Widerruf bleiben kompakte Iconaktionen. Neue
+  API-Tokens erscheinen unmittelbar einmalig und kopierbar, während weiterhin
+  nur ihr Hash gespeichert wird (#21).
+- Paket, Lockdatei und Cloudron-Manifest tragen Version `0.7.2`. Es ist keine
+  Datenbankmigration erforderlich. 60 Verhaltenstests und 20 Chromium-Abläufe
+  sind erfolgreich; echte Browser-/Geräteprüfungen außerhalb von Chromium
+  bleiben offen.
+
+## 0.7.1 - Bedienung und Live-Korrekturen
+
+Veröffentlicht am 25. Oktober 2026, Korrekturstand 26. Oktober 2026
+
+- Live-Abschnittszeiten übernehmen geänderte Plandauern. Frühere erledigte oder
+  übersprungene Pieces können offiziell wiederaufgenommen werden, ohne ihre
+  Abschnittslaufzeit oder die Gesamtzeit zurückzusetzen (#1).
+- Mobiler Live-Ablauf, lange Metadaten und Sendungskarten halten ihre verfügbare
+  Breite ein. Der Ablauf bleibt als fokussierbares Sheet bedienbar (#3, #5, #13).
+- „Noch vorzubereiten“ speichert Status und Aufwand an der konkreten Einplanung,
+  priorisiert aktive Sendungen nach Termin und verlinkt mit den Themenicons direkt
+  in den Usage-Editor. Vorbereitende Originale können regulär eingeplant werden;
+  Mehrfachverwendungen bleiben unabhängig (#6, #15).
+- Fundus- und Usage-Editor unterscheiden Text, Nur Bild, Linkvorschau und Video
+  durch kontextsensitive Eingaben und passende Vorschauen (#8).
+- Gast- und historische Abschnitte besitzen klar gepolsterte äußere Glaskarten.
+  Die Freigabeverwaltung liegt direkt vor dem Werkzeugkatalog; der gemeinsame
+  Dialog und seine Formfelder folgen ohne nativen Doppelrahmen dem Sendewerk-
+  Design. Einmalige Links lassen sich kopieren und sicher ersetzen (#11, #12).
+- Die Iconsuche ist nach dem Öffnen sofort sichtbar und fokussiert (#14).
+- RSS-Feeds und technische Zugänge verwenden in der Verwaltung kompakte
+  Hinzufügen-Einstiege und dieselbe visuelle Listenlogik wie der Werkzeugkatalog.
+- Mobiles Live-Sheet und Backdrop sind am Viewport verankert. Viewport-Fit,
+  Standalone-Metadaten und Web-App-Manifest aktivieren iOS-Safe-Areas; ein echter
+  Safari-/Home-Bildschirm-Test bleibt mangels Gerät offen (#3, #13).
+- Paket, Lockdatei und Cloudron-Manifest tragen Version `0.7.1`. Migration
+  `0019_usage_preparation.sql` ergänzt additive Usage-Snapshots. 60
+  Verhaltenstests und 19 Chromium-Abläufe sind
+  erfolgreich; echtes Safari und die installierte Webapp auf iOS bleiben offen.
+
+## 0.7.0 - RSS-Import und externe Assistenz
+
+Veröffentlicht am 25. Oktober 2026
+
+- Barkeeper verwalten RSS-/Atom-Feeds mit Intervall und Standardkategorie;
+  sichere manuelle und geplante Abrufe laufen fehlerisoliert.
+- Neue Beiträge landen in einem getrennten Auswahlbereich im Eingang. Erst eine
+  bewusste Übernahme erzeugt Pieces, während dauerhaftes Verwerfen, Herkunft,
+  Kategorien und Dublettenschutz erhalten bleiben.
+- Abrufe sperren interne Ziele und begrenzen Ports, Redirects, Laufzeit,
+  Antwortgröße und Eintragszahl. Fremdes Feed-HTML wird zu Text bereinigt.
+- Die versionierte REST-API `/api/v1` liest und ändert Pieces, Sendungen und
+  Einplanungen über getrennte technische Lese- oder Schreibzugänge.
+- Technische Tokens werden nur einmal gezeigt und gehasht gespeichert. Widerruf,
+  Audit-Ereignisse, Revisionen und persistente Idempotenz schützen Änderungen.
+- `/api/v1/openapi.json` beschreibt die Schnittstelle für externe Clients.
+  Sendewerk bleibt ohne KI nutzbar; eine konkrete ChatGPT-/Codex-Anbindung ist
+  weiterhin offen.
+- Migration `0018_rss_and_api.sql` ergänzt Feed-, Zugangs-, Audit- und
+  Idempotenzdaten. Paket, Lockdatei und Cloudron-Manifest tragen Version `0.7.0`.
+
 ## 0.6.1 - Redaktionelle Wartung
 
 Veröffentlicht am 25. Oktober 2026

docs/STATUS.md

@@ -2,10 +2,122 @@
 
 ## Aktueller Umfang
 
-Etappe 1 bis Etappe 6 sind abgeschlossen. Architektur, Gesamtdatenmodell,
+Etappe 1 bis Etappe 7 sind abgeschlossen. Architektur, Gesamtdatenmodell,
 Anmeldung, Rollen, persistente Inhaltsbearbeitung, Sendungsplanung,
 Live-Steuerung, Präsentationsausgabe, unveränderliche Sendungshistorie,
-Archiv und sichere Lesefreigaben sind dokumentiert.
+Archiv, sichere Lesefreigaben, RSS-Import und technische REST-Zugänge sind
+dokumentiert.
+
+## Lesender MCP-Zugang 0.7.3
+
+- Der öffentliche Streamable-HTTP-Endpunkt `/mcp` liest Pieces, Sendungen und
+  Abläufe über dieselben Dienste wie Browser und REST-API. Fünf deklarierte
+  Werkzeuge besitzen nur Leseannotationen und keine Mutationspfade.
+- OAuth 2.1 verwendet Discovery-Metadaten, begrenzte dynamische
+  Clientregistrierung, Authorization Code, PKCE `S256`, exakte Redirect-URIs
+  und Ressourcenbindung. Codes und einstündige Tokens liegen nur gehasht vor.
+- OAuth-Tokens sind an den zustimmenden Nutzer gebunden. Sperrung und
+  Passwortwechsel widerrufen sie; jeder Zugriff prüft erneut Nutzerstatus,
+  Scope, Ablauf und Zielressource.
+- Aktuelles MCP `2026-07-28` mit `server/discover` und per-Request-Metadaten
+  läuft neben den OpenAI-kompatiblen Initialisierungsfassungen. Ausgaben sind
+  Positivlisten ohne E-Mail, Uploadnamen, interne Pfade oder Werkzeug-Arbeitsdaten.
+- Die konkrete Produktionsadresse ist
+  `https://<Cloudron-App-Domain>/mcp`. Ein Cloudron-Deployment und eine reale
+  ChatGPT-Verbindung wurden nicht durchgeführt.
+
+Geprüft wurden Typen, Produktionsbuild und ein isolierter tatsächlicher
+HTTP-Ablauf über eine temporäre Datenbank: anonymer OAuth-Challenge, DCR,
+Zustimmung, PKCE-Tokenaustausch, Legacy-Initialisierung, aktuelle
+`server/discover`-Abfrage, Toolliste und `list_pieces` mit Seed-Daten waren
+erfolgreich. Eine weitere Verhaltenstest- oder Browsermatrix wurde gemäß
+Auftrag nicht ausgeführt.
+
+## Bedienkorrekturen 0.7.2
+
+- Der RSS-Importeingang ist eine kompakte Katalogfläche. Die eigentliche Auswahl
+  öffnet einen responsiven Dialog mit kombinierbaren Quellenfiltern, 20 Beiträgen
+  pro Seite, tastaturbedienbaren Auswahlkarten und einer festen bewussten
+  Übernahme. Auswahl bleibt beim Filtern und Blättern erhalten; importierte oder
+  verworfene Beiträge verschwinden über den bestehenden persistenten Status.
+- Das Live-Menü trennt Sendungssteuerung, Ansicht, Lesefreigaben,
+  OBS-Ausgabekanal und Navigation. Pause/Fortsetzen und beide Timerresets liegen
+  bei den Zeitflächen. Der Menüstatus unterscheidet Entwurf, Bereit, Läuft,
+  Pausiert, Lauf beendet und historischen Abschluss; der OBS-Bereich bleibt bis
+  zur bewussten Aktion eingeklappt.
+- Feedquellen und technische Zugänge verwenden dieselben Katalogkarten und
+  Dialoggrundlagen wie Werkzeuge. Beide lassen sich anlegen und bearbeiten;
+  Feeds behalten Abruf/Löschen, Zugänge ihren sofortigen Widerruf. Ein neuer
+  API-Token wird im Dialog einmalig angezeigt und kann direkt kopiert werden.
+
+Geprüft wurden 60 von 60 Verhaltenstests, Lint, Typprüfung, Produktionsbuild und
+20 von 20 Chromium-Abläufe. Der neue Ablauf prüft RSS-Auswahl über mehrere
+Quellen und Seiten, Übernahme ohne erneutes Angebot, Feed- und Zugangsanlage
+samt Bearbeitung und Tokenkopie. Das Live-Menü wurde laufend, pausiert und
+beendet sowie bei kleinem Desktopfenster und mobil geprüft. Die betroffenen
+Flächen wurden in hellem und dunklem Farbschema kontrolliert. Andere Browser und
+echte Mobilgeräte bleiben offen.
+
+## Fehlerkorrekturen 0.7.1
+
+- Explizite Abschnittsdauern werden während der Live-Regie nach Änderungen
+  synchronisiert. Erledigte oder übersprungene Pieces lassen sich bewusst
+  wiederaufnehmen; frühere Abschnitts- und Gesamtzeiten bleiben dabei erhalten.
+- Der mobile Ablauf liegt innerhalb eines isolierten Live-Containers, lange
+  Metadaten verbreitern die Regie nicht mehr und das Sheet ist am mobilen
+  Viewport verankert. `viewport-fit=cover`, Standalone-Metadaten und Manifest
+  aktivieren Safe Areas auch beim Start vom Home-Bildschirm. Sendungskarten
+  stapeln ihre Inhalte auf kleinen Bildschirmen eindeutig.
+- Die Vorbereitung liegt als eigener Status- und Aufwandsnapshot an der konkreten
+  Einplanung. Vorbereitende Fundus-Pieces lassen sich planen; Originaländerungen,
+  Duplikation und bewusste Aktualisierung folgen der bestehenden Snapshotregel.
+  Usage-Titel, Sendung, Abschnitt, Termin und Themenicons führen direkt in den
+  Usage-Editor; „sendefertig“ entfernt die Fassung aus der Übersicht.
+- Text, Nur Bild, Linkvorschau und Video besitzen in Fundus- und Usage-Editor
+  kontextsensitive Felder und Vorschauen. Ausgeblendete Werte bleiben beim
+  Moduswechsel erhalten.
+- Die Iconsuche fokussiert innerhalb der öffnenden Klick-/Tastaturaktion das
+  Suchfeld. RSS-Feeds und technische Zugänge verwenden gestaltete Formfelder.
+- Lesefreigaben öffnen nach Serverantworten wieder mit dem einmalig sichtbaren
+  Link, bieten Kopieren und sichere Ersatzlinks. Ersatzlinks invalidieren den
+  alten Token und dessen Gastsitzungen. Die Verwaltung zeigt Freigaben direkt
+  vor dem Werkzeugkatalog; der Dialog besitzt nur eine gestaltete Glasfläche.
+  Gast- und historische Abschnitte besitzen äußere Karten mit Innenabstand.
+
+Geprüft wurden 60 von 60 Verhaltenstests, Lint, Typprüfung, Produktionsbuild und
+19 von 19 Chromium-Abläufe. Die Browsermatrix öffnete beide Piece-Editoren,
+Sendungsübersicht, Verwaltung und Freigabedialoge, Gastansicht sowie Live-Regie
+bei Desktop- und Mobilbreiten. Safari und die installierte Webapp auf einem
+echten iOS-Gerät bleiben mangels Gerät getrennt offen.
+
+## RSS-Import und externe Assistenz 0.7.0
+
+- Barkeeper verwalten RSS-/Atom-Feeds mit Standardkategorie, Aktivierung und
+  Abrufintervall; manueller Abruf und ein begrenzter Prozess-Scheduler verwenden
+  dieselbe Fehler- und Dublettenlogik.
+- Feedabrufe prüfen Protokoll, Port, DNS und Redirects, begrenzen Laufzeit,
+  Antwortgröße und Eintragszahl und lassen Fehler anderer Feeds unberührt.
+- Fremdes HTML wird entfernt. Beiträge bleiben mit stabiler Herkunft im
+  getrennten Importeingang, bis die Redaktion sie auswählt, kategorisiert und
+  als normale Pieces übernimmt oder dauerhaft verwirft.
+- `/api/v1` bietet Pieces und Sendungen über gehashte, widerrufbare technische
+  Bearer-Tokens mit reinen Lese- oder Lese-/Schreibrechten an. Mutationen nutzen
+  bestehende Dienste, Audit-Ereignisse, Revisionen und persistente
+  Idempotenzschlüssel.
+- Die maschinenlesbare Beschreibung liegt unter `/api/v1/openapi.json`; eine
+  ChatGPT-/Codex- oder andere konkrete Client-Anbindung wurde nicht eingerichtet.
+- Migration `0018_rss_and_api.sql` ergänzt ausschließlich additive Tabellen und
+  Indizes. Sendewerk bleibt ohne KI und ohne konfigurierte Feeds vollständig
+  nutzbar.
+
+Geprüft wurden 58 Verhaltenstests, Typprüfung, Produktionsbuild, Dependency-
+Audit, vier RSS- und zwei Zugangssicherheitstests sowie ein echter HTTP-Rundlauf
+lesen → anlegen → idempotent wiederholen → ändern → erneut lesen → einplanen →
+sortieren. Desktop-Verwaltung und mobiler Eingang wurden in Chromium ohne
+Konsolenfehler geprüft. In der bestehenden Gesamtmatrix waren 16 von 18 Abläufen
+erfolgreich; die bereits bekannte Live-Zeitanzeige und der Ablauf
+Abschluss/Freigabe schlugen weiterhin fehl. Der globale Lintlauf bleibt an acht
+vorhandenen Formatierungsabweichungen außerhalb dieser Etappe offen.
 
 ## Wartungsrelease 0.6.1
 

migrations/0018_rss_and_api.sql

@@ -0,0 +1,66 @@
+CREATE TABLE feed_sources (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	url TEXT NOT NULL UNIQUE,
+	is_enabled INTEGER NOT NULL DEFAULT 1 CHECK (is_enabled IN (0, 1)),
+	refresh_interval_minutes INTEGER NOT NULL DEFAULT 60 CHECK (refresh_interval_minutes BETWEEN 15 AND 10080),
+	default_category_id TEXT REFERENCES section_categories(id) ON DELETE SET NULL,
+	etag TEXT NOT NULL DEFAULT '',
+	last_modified TEXT NOT NULL DEFAULT '',
+	last_fetched_at_utc TEXT,
+	next_fetch_at_utc TEXT,
+	last_error TEXT NOT NULL DEFAULT '',
+	created_at_utc TEXT NOT NULL,
+	updated_at_utc TEXT NOT NULL
+);
+
+CREATE TABLE feed_entries (
+	id TEXT PRIMARY KEY,
+	feed_id TEXT NOT NULL REFERENCES feed_sources(id) ON DELETE CASCADE,
+	external_id TEXT NOT NULL,
+	title TEXT NOT NULL,
+	url TEXT NOT NULL,
+	summary TEXT NOT NULL DEFAULT '',
+	published_at_utc TEXT,
+	status TEXT NOT NULL DEFAULT 'new' CHECK (status IN ('new', 'imported', 'discarded')),
+	piece_id TEXT REFERENCES pieces(id) ON DELETE SET NULL,
+	first_seen_at_utc TEXT NOT NULL,
+	updated_at_utc TEXT NOT NULL,
+	UNIQUE (feed_id, external_id)
+);
+
+CREATE INDEX feed_entries_status_idx ON feed_entries(status, first_seen_at_utc DESC);
+CREATE INDEX feed_sources_due_idx ON feed_sources(is_enabled, next_fetch_at_utc);
+
+CREATE TABLE technical_accesses (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	token_hash TEXT NOT NULL UNIQUE,
+	permissions TEXT NOT NULL CHECK (permissions IN ('read', 'read_write')),
+	created_by_user_id TEXT NOT NULL REFERENCES users(id),
+	created_at_utc TEXT NOT NULL,
+	last_used_at_utc TEXT,
+	revoked_at_utc TEXT
+);
+
+CREATE TABLE api_idempotency (
+	access_id TEXT NOT NULL REFERENCES technical_accesses(id) ON DELETE CASCADE,
+	request_key TEXT NOT NULL,
+	request_hash TEXT NOT NULL,
+	status_code INTEGER NOT NULL,
+	response_json TEXT NOT NULL CHECK (json_valid(response_json)),
+	created_at_utc TEXT NOT NULL,
+	PRIMARY KEY (access_id, request_key)
+);
+
+CREATE TABLE audit_events (
+	id TEXT PRIMARY KEY,
+	actor_type TEXT NOT NULL CHECK (actor_type IN ('user', 'technical')),
+	actor_id TEXT NOT NULL,
+	action TEXT NOT NULL,
+	target_type TEXT NOT NULL,
+	target_id TEXT NOT NULL,
+	created_at_utc TEXT NOT NULL
+);
+
+CREATE INDEX audit_events_created_idx ON audit_events(created_at_utc DESC);

migrations/0019_usage_preparation.sql

@@ -0,0 +1,17 @@
+ALTER TABLE piece_usages ADD COLUMN preparation_status_snapshot TEXT NOT NULL DEFAULT 'ready'
+	CHECK (preparation_status_snapshot IN ('preparing', 'ready'));
+
+ALTER TABLE piece_usages ADD COLUMN preparation_effort_snapshot TEXT
+	CHECK (preparation_effort_snapshot IS NULL OR preparation_effort_snapshot IN ('low', 'medium', 'high'));
+
+UPDATE piece_usages
+SET preparation_status_snapshot = CASE
+		WHEN EXISTS (
+			SELECT 1 FROM pieces p
+			WHERE p.id = piece_usages.original_piece_id AND p.status = 'preparing'
+		) THEN 'preparing'
+		ELSE 'ready'
+	END,
+	preparation_effort_snapshot = (
+		SELECT p.preparation_effort FROM pieces p WHERE p.id = piece_usages.original_piece_id
+	);

migrations/0020_oauth_mcp.sql

@@ -0,0 +1,49 @@
+CREATE TABLE oauth_clients (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL,
+	redirect_uris_json TEXT NOT NULL CHECK (json_valid(redirect_uris_json)),
+	created_at_utc TEXT NOT NULL
+);
+
+CREATE TABLE oauth_authorization_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+	user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	redirect_uri TEXT NOT NULL,
+	scope TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	created_at_utc TEXT NOT NULL,
+	expires_at_utc TEXT NOT NULL,
+	consumed_at_utc TEXT
+);
+
+CREATE INDEX oauth_authorization_codes_expiry_idx
+	ON oauth_authorization_codes(expires_at_utc);
+
+CREATE TABLE oauth_access_tokens (
+	token_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+	user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	scope TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	created_at_utc TEXT NOT NULL,
+	expires_at_utc TEXT NOT NULL,
+	last_used_at_utc TEXT,
+	request_window_started_at_utc TEXT NOT NULL,
+	request_count INTEGER NOT NULL DEFAULT 0 CHECK (request_count >= 0),
+	revoked_at_utc TEXT
+);
+
+CREATE INDEX oauth_access_tokens_user_idx ON oauth_access_tokens(user_id);
+CREATE INDEX oauth_access_tokens_expiry_idx ON oauth_access_tokens(expires_at_utc);
+
+CREATE TABLE oauth_rate_limit_attempts (
+	id TEXT PRIMARY KEY,
+	kind TEXT NOT NULL CHECK (kind IN ('registration', 'token')),
+	address_hash TEXT NOT NULL,
+	attempted_at_utc TEXT NOT NULL
+);
+
+CREATE INDEX oauth_rate_limit_attempts_lookup_idx
+	ON oauth_rate_limit_attempts(kind, address_hash, attempted_at_utc);

package-lock.json

@@ -1,15 +1,16 @@
 {
 	"name": "sendewerk",
-	"version": "0.6.1",
+	"version": "0.7.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "sendewerk",
-			"version": "0.6.1",
+			"version": "0.7.3",
 			"dependencies": {
 				"@node-rs/argon2": "^2.2.2",
 				"better-sqlite3": "^13.0.3",
+				"fast-xml-parser": "^5.11.2",
 				"file-type": "^22.2.0",
 				"marked": "^18.1.1",
 				"metascraper": "^5.58.5",
@@ -599,6 +600,18 @@
 				"node": ">= 22.13"
 			}
 		},
+		"node_modules/@nodable/entities": {
+			"version": "3.1.0",
+			"resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-3.1.0.tgz",
+			"integrity": "sha512-LsS/DjHr+uDM647Gru/cA8+J3a3HfhttwCKLyuoyN7yXTFCxKBtSgMQBvrW9yNPa2/zDRUNuGPaH5QUFoa4arQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/nodable"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/@node-rs/argon2": {
 			"version": "2.2.2",
 			"resolved": "https://registry.npmjs.org/@node-rs/argon2/-/argon2-2.2.2.tgz",
@@ -1630,6 +1643,18 @@
 				"url": "https://github.com/sponsors/epoberezkin"
 			}
 		},
+		"node_modules/anynum": {
+			"version": "1.0.1",
+			"resolved": "https://registry.npmjs.org/anynum/-/anynum-1.0.1.tgz",
+			"integrity": "sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/aria-query": {
 			"version": "5.3.1",
 			"resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
@@ -2689,6 +2714,45 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/fast-xml-builder": {
+			"version": "1.3.1",
+			"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.3.1.tgz",
+			"integrity": "sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"path-expression-matcher": "^1.6.2",
+				"xml-naming": "^0.3.0"
+			}
+		},
+		"node_modules/fast-xml-parser": {
+			"version": "5.11.2",
+			"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.11.2.tgz",
+			"integrity": "sha512-R9iDuNrQYeQut46cn2r2wHKn4HYzVDvDm5J1wW+koZewykv0yuO2HChTYeZtrULyHIDM9cj9TUXloCsueCQUog==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"@nodable/entities": "^3.0.1",
+				"fast-xml-builder": "^1.2.0",
+				"is-unsafe": "^2.0.0",
+				"path-expression-matcher": "^1.6.2",
+				"strnum": "^2.4.2",
+				"xml-naming": "^0.3.0"
+			},
+			"bin": {
+				"fxparser": "src/cli/cli.js"
+			}
+		},
 		"node_modules/fdir": {
 			"version": "6.5.0",
 			"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -3055,6 +3119,18 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/is-unsafe": {
+			"version": "2.0.2",
+			"resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.2.tgz",
+			"integrity": "sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/is-uri": {
 			"version": "1.2.14",
 			"resolved": "https://registry.npmjs.org/is-uri/-/is-uri-1.2.14.tgz",
@@ -4052,6 +4128,21 @@
 				"node": ">=8"
 			}
 		},
+		"node_modules/path-expression-matcher": {
+			"version": "1.6.2",
+			"resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.6.2.tgz",
+			"integrity": "sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"engines": {
+				"node": ">=14.0.0"
+			}
+		},
 		"node_modules/path-key": {
 			"version": "3.1.1",
 			"resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -4545,6 +4636,21 @@
 			"dev": true,
 			"license": "MIT"
 		},
+		"node_modules/strnum": {
+			"version": "2.5.1",
+			"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.5.1.tgz",
+			"integrity": "sha512-UM4nTLWzQiDBseVxUGxN0wJzIk0UU89Qi7pKXz9qISo+lhviJikTuikBsK/oFRlpvYHvSdz0TVoLyQ+sEpYwxA==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"dependencies": {
+				"anynum": "^1.0.1"
+			}
+		},
 		"node_modules/strtok3": {
 			"version": "10.6.2",
 			"resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.6.2.tgz",
@@ -5284,6 +5390,21 @@
 				"node": ">=18"
 			}
 		},
+		"node_modules/xml-naming": {
+			"version": "0.3.0",
+			"resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.3.0.tgz",
+			"integrity": "sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==",
+			"funding": [
+				{
+					"type": "github",
+					"url": "https://github.com/sponsors/NaturalIntelligence"
+				}
+			],
+			"license": "MIT",
+			"engines": {
+				"node": ">=16.0.0"
+			}
+		},
 		"node_modules/xmlchars": {
 			"version": "2.2.0",
 			"resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "sendewerk",
 	"private": true,
-	"version": "0.6.1",
+	"version": "0.7.3",
 	"type": "module",
 	"engines": {
 		"node": ">=22.17 <25"
@@ -26,6 +26,7 @@
 	"dependencies": {
 		"@node-rs/argon2": "^2.2.2",
 		"better-sqlite3": "^13.0.3",
+		"fast-xml-parser": "^5.11.2",
 		"file-type": "^22.2.0",
 		"marked": "^18.1.1",
 		"metascraper": "^5.58.5",

src/app.css

@@ -113,10 +113,51 @@
 }
 
 .share-management {
-	margin-bottom: 1.5rem;
+	max-height: min(82dvh, 54rem);
+	padding: clamp(1rem, 2.5vw, 1.4rem);
+	overflow-y: auto;
+}
+
+.share-management-dialog {
+	width: min(64rem, calc(100% - 2rem));
+	max-width: none;
+	max-height: none;
+	margin: auto;
+	padding: 0;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-large);
+	background: color-mix(in srgb, var(--bg-elevated) 94%, transparent);
+	box-shadow: var(--shadow);
+	color: var(--text);
+	overflow: hidden;
+	backdrop-filter: blur(24px) saturate(1.12);
+}
+
+.share-management-dialog::backdrop {
+	background: rgb(3 8 16 / 58%);
+	backdrop-filter: blur(5px);
+}
+
+.share-catalog-panel {
+	display: grid;
+	gap: 0.75rem;
+	margin-bottom: 0.75rem;
 	padding: 1rem;
 }
 
+.share-catalog-panel .panel-heading {
+	margin: 0;
+}
+
+.share-catalog-panel h2 {
+	margin: 0.15rem 0 0;
+	font-size: 1rem;
+}
+
+.share-catalog-panel .catalog-note {
+	margin: 0;
+}
+
 .share-create-form {
 	display: grid;
 	grid-template-columns: repeat(auto-fit, minmax(min(100%, 11rem), 1fr));
@@ -133,6 +174,28 @@
 	font-weight: 700;
 }
 
+.share-create-form :is(input, select),
+.share-edit-form :is(input, select),
+.integration-form :is(input, select) {
+	width: 100%;
+	min-width: 0;
+	min-height: 2.65rem;
+	padding: 0.55rem 0.7rem;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-small);
+	background: var(--field);
+	color: var(--text);
+	font: inherit;
+}
+
+.share-create-form :is(input, select):focus-visible,
+.share-edit-form :is(input, select):focus-visible,
+.integration-form :is(input, select):focus-visible {
+	border-color: var(--accent);
+	outline: 2px solid color-mix(in srgb, var(--accent) 30%, transparent);
+	outline-offset: 1px;
+}
+
 .share-create-form button {
 	align-self: end;
 }
@@ -262,6 +325,13 @@
 	overflow-wrap: anywhere;
 }
 
+.share-result > div {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: 0.75rem;
+}
+
 .guest-shell {
 	min-height: 100dvh;
 }
@@ -294,6 +364,14 @@
 	margin-top: 1.25rem;
 }
 
+.shared-section {
+	padding: clamp(1rem, 2.5vw, 1.35rem);
+}
+
+.historical-section {
+	padding: clamp(1rem, 2.5vw, 1.35rem);
+}
+
 .shared-section > header,
 .historical-section > header,
 .shared-usage-heading,
@@ -1316,6 +1394,7 @@ textarea:focus {
 }
 
 .live-controller-shell {
+	height: 100vh;
 	height: 100dvh;
 	min-height: 0;
 	margin-left: 0 !important;
@@ -1325,7 +1404,10 @@ textarea:focus {
 
 .live-page {
 	display: grid;
+	position: relative;
+	isolation: isolate;
 	width: 100%;
+	height: 100vh;
 	height: 100dvh;
 	grid-template-rows: auto auto minmax(0, 1fr) auto;
 	gap: 0.55rem;
@@ -1493,16 +1575,58 @@ textarea:focus {
 	text-align: center;
 }
 
-.section-timer-control {
+.section-timer-control,
+.total-timer-control {
 	display: flex;
 	align-items: stretch;
 	gap: 0.3rem;
 }
 
-.section-timer-control form {
+.section-timer-control > form,
+.total-timer-control > form {
 	display: flex;
 }
 
+.timer-reset-menu {
+	position: relative;
+}
+
+.timer-reset-menu > summary {
+	display: grid;
+	width: 1.65rem;
+	height: 100%;
+	min-height: 2rem;
+	place-items: center;
+	border: 1px solid var(--line);
+	border-radius: 0.6rem;
+	background: var(--panel-soft);
+	color: var(--text-muted);
+	cursor: pointer;
+	list-style: none;
+}
+
+.timer-reset-menu > summary::-webkit-details-marker {
+	display: none;
+}
+
+.timer-reset-menu > form {
+	position: absolute;
+	z-index: 220;
+	top: calc(100% + 0.35rem);
+	right: 0;
+	width: max-content;
+	padding: 0.4rem;
+	border: 1px solid var(--line-strong);
+	border-radius: 0.65rem;
+	background: var(--glass-strong);
+	box-shadow: var(--shadow);
+	backdrop-filter: blur(18px);
+}
+
+.timer-reset-menu > form button {
+	font-size: 0.65rem;
+}
+
 .live-timer-toggle {
 	display: grid;
 	width: 2.15rem;
@@ -1715,6 +1839,118 @@ textarea:focus {
 	text-transform: uppercase;
 }
 
+.live-menu-show-heading {
+	display: flex;
+	align-items: flex-start;
+	justify-content: space-between;
+	gap: 0.7rem;
+}
+
+.live-menu-show-heading > span:first-child {
+	min-width: 0;
+}
+
+.live-show-state {
+	flex: 0 0 auto;
+	padding: 0.25rem 0.45rem;
+	border-radius: 999px;
+	background: color-mix(in srgb, var(--success) 14%, var(--panel));
+	color: var(--success);
+	font-size: 0.58rem;
+	font-weight: 780;
+}
+
+.live-show-state.paused {
+	background: color-mix(in srgb, var(--warning) 14%, var(--panel));
+	color: var(--warning);
+}
+
+.live-menu-hint {
+	margin: 0;
+	color: var(--text-faint);
+	font-size: 0.65rem;
+}
+
+.live-view-controls {
+	display: flex;
+	flex-wrap: wrap;
+	align-items: center;
+	gap: 0.4rem;
+}
+
+.live-view-controls .text-button,
+.live-view-controls .theme-toggle {
+	min-height: 2.35rem;
+	font-size: 0.65rem;
+}
+
+.live-output-settings > summary {
+	display: grid;
+	grid-template-columns: minmax(0, 1fr) auto auto;
+	align-items: center;
+	gap: 0.45rem;
+	cursor: pointer;
+	list-style: none;
+}
+
+.live-output-settings > summary::-webkit-details-marker {
+	display: none;
+}
+
+.live-output-settings > summary > span {
+	display: flex;
+	align-items: center;
+	gap: 0.4rem;
+	font-size: 0.7rem;
+	font-weight: 750;
+}
+
+.live-output-settings > summary > small {
+	color: var(--text-faint);
+	font-size: 0.58rem;
+}
+
+.live-output-settings > summary > .app-icon {
+	transition: transform 140ms ease;
+}
+
+.live-output-settings[open] > summary > .app-icon {
+	transform: rotate(90deg);
+}
+
+.live-output-settings-body {
+	display: grid;
+	gap: 0.4rem;
+	margin-top: 0.55rem;
+	padding-top: 0.55rem;
+	border-top: 1px solid var(--line);
+}
+
+.live-output-settings-body p {
+	margin: 0 0 0.15rem;
+	color: var(--text-faint);
+	font-size: 0.62rem;
+	line-height: 1.4;
+}
+
+.live-menu-navigation {
+	display: grid;
+	gap: 0.2rem;
+	padding: 0.7rem 0.6rem 0.55rem;
+	border-top: 1px solid var(--line);
+}
+
+.live-menu-navigation a {
+	display: flex;
+	align-items: center;
+	gap: 0.4rem;
+}
+
+.live-menu-navigation small {
+	color: var(--text-faint);
+	font-size: 0.58rem;
+}
+
 .live-menu-popover a {
 	font-size: 0.72rem;
 	font-weight: 700;
@@ -1796,7 +2032,7 @@ textarea:focus {
 
 .live-piece-heading {
 	display: grid;
-	grid-template-columns: auto minmax(0, 1fr) auto;
+	grid-template-columns: minmax(0, 1fr) auto;
 	align-items: baseline;
 	gap: 0.35rem 0.65rem;
 	padding-bottom: 0.5rem;
@@ -1819,6 +2055,7 @@ textarea:focus {
 }
 
 .live-current h1 {
+	min-width: 0;
 	max-width: none;
 	margin: 0;
 	font-size: clamp(1.2rem, 2.2vw, 1.9rem);
@@ -2394,7 +2631,7 @@ textarea:focus {
 		z-index: 80;
 		inset: max(0.4rem, env(safe-area-inset-top)) max(0.4rem, env(safe-area-inset-right))
 			max(0.4rem, env(safe-area-inset-bottom)) auto;
-		width: min(22rem, calc(100vw - 0.8rem - env(safe-area-inset-left)));
+		width: min(22rem, calc(100% - 0.8rem - env(safe-area-inset-left)));
 		transform: translateX(calc(100% + 1rem));
 		visibility: hidden;
 		transition:
@@ -2431,9 +2668,16 @@ textarea:focus {
 	}
 
 	.live-piece-heading {
+		min-width: 0;
 		gap: 0.3rem 0.45rem;
 	}
 
+	.live-piece-time {
+		max-width: 8rem;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+
 	.live-support-actions {
 		display: grid;
 	}
@@ -2761,6 +3005,23 @@ textarea:focus {
 }
 
 @media (max-width: 52rem) {
+	.rss-entry-list {
+		grid-template-columns: 1fr;
+	}
+
+	.rss-selection-actions {
+		align-items: stretch;
+		flex-direction: column-reverse;
+	}
+
+	.rss-selection-actions button {
+		width: 100%;
+	}
+
+	.catalog-setting-row {
+		grid-template-columns: minmax(0, 1fr) auto;
+	}
+
 	.heinzlive-output {
 		padding: 1.2rem;
 	}
@@ -2932,6 +3193,32 @@ textarea:focus {
 	font-size: 0.85rem;
 }
 
+.oauth-consent {
+	margin: clamp(1.25rem, 6vw, 4rem) auto;
+}
+
+.oauth-permission {
+	display: grid;
+	gap: 0.2rem;
+	margin: 1.25rem 0;
+	padding: 0.9rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-medium);
+	background: var(--panel-soft);
+}
+
+.oauth-permission span,
+.oauth-redirect {
+	color: var(--text-muted);
+	font-size: 0.8rem;
+}
+
+.oauth-actions {
+	display: flex;
+	justify-content: flex-end;
+	gap: 0.7rem;
+}
+
 .auth-form,
 .compact-form {
 	display: grid;
@@ -4761,11 +5048,24 @@ textarea:focus {
 	background: var(--panel-soft);
 }
 
-.preparation-list span {
+.preparation-copy,
+.preparation-copy > span:last-child {
 	display: grid;
 	min-width: 0;
 }
 
+.preparation-copy {
+	grid-template-columns: auto minmax(0, 1fr);
+	align-items: center;
+	gap: 0.6rem;
+}
+
+.preparation-topics {
+	display: flex;
+	gap: 0.2rem;
+	color: var(--accent-text);
+}
+
 .preparation-list small {
 	overflow: hidden;
 	color: var(--text-muted);
@@ -6742,6 +7042,10 @@ textarea:focus {
 	.show-card-facts {
 		align-items: flex-start;
 	}
+	.show-card {
+		flex-direction: column;
+		align-items: stretch;
+	}
 	.show-card-facts {
 		flex-direction: row;
 		align-items: center;
@@ -7286,6 +7590,7 @@ body:has(.heinzlive-output.empty),
 }
 
 .management-dialog input:not([type='checkbox'], [type='hidden']),
+.management-dialog select,
 .management-dialog textarea {
 	width: 100%;
 	padding: 0.62rem 0.68rem;
@@ -7417,6 +7722,293 @@ body:has(.heinzlive-output.empty),
 	border-top: 1px solid var(--line);
 }
 
+.catalog-setting-row {
+	display: grid;
+	grid-template-columns: minmax(0, 1fr) auto;
+	align-items: stretch;
+	min-width: 0;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-medium);
+	background: color-mix(in srgb, var(--panel-soft) 82%, transparent);
+	overflow: hidden;
+}
+
+.catalog-setting-row.inactive {
+	opacity: 0.68;
+}
+
+.catalog-entry-main {
+	display: grid;
+	grid-template-columns: auto minmax(0, 1fr) auto;
+	align-items: center;
+	gap: 0.65rem;
+	min-width: 0;
+	padding: 0.65rem;
+	border: 0;
+	background: transparent;
+	color: var(--text);
+	text-align: left;
+}
+
+button.catalog-entry-main {
+	cursor: pointer;
+}
+
+button.catalog-entry-main:hover {
+	background: color-mix(in srgb, var(--gold) 7%, var(--panel-soft));
+}
+
+.catalog-entry-main > .app-icon {
+	color: var(--text-faint);
+}
+
+.catalog-entry-actions {
+	display: flex;
+	align-items: center;
+	padding: 0.35rem;
+	border-left: 1px solid var(--line);
+}
+
+.catalog-entry-actions form {
+	display: flex;
+}
+
+.catalog-entry-actions button {
+	display: grid;
+	width: 2.15rem;
+	height: 2.15rem;
+	place-items: center;
+	padding: 0;
+	border: 0;
+	border-radius: 0.55rem;
+	background: transparent;
+	color: var(--text-muted);
+	cursor: pointer;
+}
+
+.catalog-entry-actions button:hover,
+.catalog-entry-actions button:focus-visible {
+	background: var(--panel);
+	color: var(--text);
+}
+
+.rss-selection-dialog {
+	width: min(66rem, calc(100vw - 2rem));
+}
+
+.rss-selection-form {
+	display: grid;
+	grid-template-rows: minmax(0, 1fr) auto;
+	min-height: 0;
+	overflow: hidden;
+}
+
+.rss-selection-content {
+	display: grid;
+	min-height: 0;
+	align-content: start;
+	gap: 0.85rem;
+	padding: 1rem 1.1rem;
+	overflow-y: auto;
+}
+
+.rss-source-filters {
+	display: flex;
+	gap: 0.4rem;
+	padding-bottom: 0.25rem;
+	overflow-x: auto;
+	scrollbar-width: thin;
+}
+
+.rss-source-filters button {
+	flex: 0 0 auto;
+	padding: 0.48rem 0.72rem;
+	border: 1px solid var(--line);
+	border-radius: 999px;
+	background: var(--panel-soft);
+	color: var(--text-muted);
+	cursor: pointer;
+	font: inherit;
+	font-size: 0.68rem;
+	font-weight: 720;
+}
+
+.rss-source-filters button.active {
+	border-color: color-mix(in srgb, var(--accent) 60%, var(--line));
+	background: color-mix(in srgb, var(--accent) 14%, var(--panel));
+	color: var(--accent-text);
+}
+
+.rss-result-summary,
+.rss-pagination {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: 0.75rem;
+}
+
+.rss-result-summary {
+	color: var(--text-faint);
+	font-size: 0.68rem;
+}
+
+.rss-entry-list {
+	display: grid;
+	grid-template-columns: repeat(2, minmax(0, 1fr));
+	gap: 0.55rem;
+}
+
+.rss-entry {
+	display: grid;
+	position: relative;
+	grid-template-columns: auto minmax(0, 1fr);
+	align-items: start;
+	gap: 0.7rem;
+	min-width: 0;
+	padding: 0.8rem;
+	border: 1px solid var(--line);
+	border-radius: var(--radius-medium);
+	background: color-mix(in srgb, var(--panel-soft) 90%, transparent);
+	cursor: pointer;
+}
+
+.rss-entry:hover {
+	border-color: color-mix(in srgb, var(--accent) 45%, var(--line));
+}
+
+.rss-entry.selected {
+	border-color: color-mix(in srgb, var(--accent) 72%, var(--line));
+	background: color-mix(in srgb, var(--accent) 15%, var(--panel));
+	box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--accent) 28%, transparent);
+}
+
+[data-theme='light'] .rss-entry.selected {
+	background: color-mix(in srgb, var(--accent) 20%, #fff);
+}
+
+.rss-entry:focus-visible {
+	outline: 3px solid var(--focus);
+	outline-offset: 2px;
+}
+
+.rss-entry-state {
+	display: grid;
+	width: 1.8rem;
+	height: 1.8rem;
+	place-items: center;
+	border: 1px solid var(--line);
+	border-radius: 50%;
+	background: var(--panel);
+	color: var(--text-faint);
+}
+
+.rss-entry.selected .rss-entry-state {
+	border-color: var(--accent);
+	background: var(--accent);
+	color: #fff;
+}
+
+.rss-entry-copy,
+.rss-entry-copy > * {
+	min-width: 0;
+}
+
+.rss-entry-copy {
+	display: grid;
+	gap: 0.25rem;
+}
+
+.rss-entry-copy small {
+	color: var(--text-faint);
+	font-size: 0.62rem;
+}
+
+.rss-entry-copy strong {
+	font-size: 0.78rem;
+	overflow-wrap: anywhere;
+}
+
+.rss-entry-copy p {
+	display: -webkit-box;
+	margin: 0;
+	color: var(--text-muted);
+	font-size: 0.68rem;
+	line-height: 1.45;
+	overflow: hidden;
+	-webkit-box-orient: vertical;
+	-webkit-line-clamp: 3;
+}
+
+.rss-entry-copy a {
+	width: fit-content;
+	font-size: 0.65rem;
+	font-weight: 720;
+}
+
+.rss-selected-label {
+	position: absolute;
+	top: 0.55rem;
+	right: 0.6rem;
+	padding: 0.2rem 0.42rem;
+	border-radius: 999px;
+	background: var(--accent);
+	color: #fff;
+	font-size: 0.55rem;
+	font-weight: 780;
+}
+
+.rss-entry.selected .rss-entry-copy small {
+	padding-right: 4.8rem;
+}
+
+.rss-pagination {
+	justify-content: center;
+	font-size: 0.68rem;
+}
+
+.rss-category-selection {
+	display: grid;
+	gap: 0.25rem;
+	padding-top: 0.8rem;
+	border-top: 1px solid var(--line);
+}
+
+.rss-category-selection > small {
+	color: var(--text-faint);
+	font-size: 0.62rem;
+}
+
+.rss-selection-actions {
+	display: flex;
+	justify-content: space-between;
+	gap: 0.7rem;
+}
+
+.technical-token-result {
+	display: grid;
+	align-content: start;
+	gap: 0.8rem;
+	padding: 1rem 1.1rem;
+	overflow-y: auto;
+}
+
+.technical-token-result code {
+	padding: 0.8rem;
+	border: 1px solid var(--line-strong);
+	border-radius: var(--radius-small);
+	background: var(--panel-soft);
+	overflow-wrap: anywhere;
+	user-select: all;
+}
+
+.technical-token-result .primary-button {
+	width: fit-content;
+}
+
+.dialog-form-message {
+	margin: 1rem 1.1rem 0;
+}
+
 @media (max-width: 52rem) {
 	.choice-picker-popover,
 	.icon-picker-popover {

src/app.d.ts

@@ -8,6 +8,7 @@ declare global {
 		interface PageData {
 			user?: AuthUser | null;
 			presentationMode?: boolean;
+			oauthMode?: boolean;
 		}
 	}
 }

src/app.html

@@ -2,8 +2,12 @@
 <html lang="de" data-theme="light" data-theme-preference="system">
 	<head>
 		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
 		<meta name="theme-color" content="#f4f1eb" />
+		<meta name="apple-mobile-web-app-capable" content="yes" />
+		<meta name="apple-mobile-web-app-status-bar-style" content="default" />
+		<meta name="apple-mobile-web-app-title" content="Sendewerk" />
+		<link rel="manifest" href="%sveltekit.assets%/manifest.webmanifest" />
 		<script>
 			(function () {
 				try {

src/hooks.server.ts

@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { redirect } from '@sveltejs/kit';
 import type { Handle } from '@sveltejs/kit/hooks';
 import { deleteSession, getSessionUser, hasUsers, SESSION_COOKIE } from '#lib/server/auth.js';
+import { startFeedScheduler } from '#lib/server/feeds.js';
 
 const publicPaths = new Set([
 	'/',
@@ -14,9 +15,15 @@ const publicPaths = new Set([
 ]);
 
 export const handle: Handle = async ({ event, resolve }) => {
+	startFeedScheduler();
 	const presentationPath = event.url.pathname.startsWith('/heinzlive/');
 	const sharePath = event.url.pathname.startsWith('/freigabe/');
 	const shareMediaPath = /^\/freigabe\/[^/]+\/media\/[^/]+$/.test(event.url.pathname);
+	const apiPath = event.url.pathname.startsWith('/api/v1/');
+	const oauthPath =
+		event.url.pathname.startsWith('/oauth/') ||
+		event.url.pathname.startsWith('/.well-known/oauth-');
+	const mcpPath = event.url.pathname === '/mcp';
 	const presentationTestPath = /^\/fundus\/[^/]+\/praesentation(?:\/|$)/.test(event.url.pathname);
 	const token = event.cookies.get(SESSION_COOKIE);
 	event.locals.user = getSessionUser(token);
@@ -26,6 +33,9 @@ export const handle: Handle = async ({ event, resolve }) => {
 		!presentationPath &&
 		!sharePath &&
 		!publicPaths.has(event.url.pathname) &&
+		!apiPath &&
+		!oauthPath &&
+		!mcpPath &&
 		!event.locals.user
 	) {
 		redirect(303, hasUsers() ? '/login' : '/setup');
@@ -62,7 +72,12 @@ export const handle: Handle = async ({ event, resolve }) => {
 			);
 		}
 	}
-	if (event.url.pathname === '/einladung' || event.url.pathname === '/passwort-zuruecksetzen') {
+	if (
+		event.url.pathname === '/einladung' ||
+		event.url.pathname === '/passwort-zuruecksetzen' ||
+		oauthPath ||
+		mcpPath
+	) {
 		response.headers.set('Cache-Control', 'no-store');
 	}
 	return response;

src/lib/components/FeedEditorDialog.svelte

@@ -0,0 +1,108 @@
+<script lang="ts">
+	import { tick } from 'svelte';
+	import AppIcon from './AppIcon.svelte';
+
+	type Feed = {
+		id: string;
+		name: string;
+		url: string;
+		isEnabled: boolean;
+		refreshIntervalMinutes: number;
+		defaultCategoryId: string | null;
+	};
+
+	let { categories }: { categories: { id: string; name: string }[] } = $props();
+	let dialog: HTMLDialogElement;
+	let nameInput: HTMLInputElement;
+	let feed = $state<Feed | null>(null);
+	let name = $state('');
+	let url = $state('');
+	let refreshIntervalMinutes = $state(60);
+	let defaultCategoryId = $state('');
+	let isEnabled = $state(true);
+
+	export async function showModal(selectedFeed: Feed | null = null) {
+		feed = selectedFeed;
+		name = selectedFeed?.name ?? '';
+		url = selectedFeed?.url ?? '';
+		refreshIntervalMinutes = selectedFeed?.refreshIntervalMinutes ?? 60;
+		defaultCategoryId = selectedFeed?.defaultCategoryId ?? '';
+		isEnabled = selectedFeed?.isEnabled ?? true;
+		dialog.showModal();
+		await tick();
+		nameInput.focus();
+	}
+
+	function close() {
+		dialog.close();
+	}
+</script>
+
+<dialog
+	bind:this={dialog}
+	class="management-dialog feed-editor-dialog"
+	aria-labelledby="feed-dialog-title"
+	onclick={(event) => event.target === dialog && close()}
+>
+	<header>
+		<div class="management-dialog-title">
+			<span class="management-dialog-icon"><AppIcon name="rss" /></span>
+			<div>
+				<p class="eyebrow">RSS-Quelle</p>
+				<h2 id="feed-dialog-title">{feed?.name || 'Feed hinzufügen'}</h2>
+			</div>
+		</div>
+		<button class="dialog-close" type="button" aria-label="Feeddialog schließen" onclick={close}
+			><AppIcon name="xmark" /></button
+		>
+	</header>
+	<form class="management-dialog-form" method="POST" action="?/saveFeed">
+		{#if feed}<input type="hidden" name="feedId" value={feed.id} />{/if}
+		<div class="management-dialog-fields">
+			<label
+				>Name<input
+					bind:this={nameInput}
+					bind:value={name}
+					name="name"
+					required
+					maxlength="120"
+				/></label
+			>
+			<label
+				>Feed-URL<input bind:value={url} name="url" type="url" required maxlength="2000" /></label
+			>
+			<label
+				>Intervall in Minuten<input
+					bind:value={refreshIntervalMinutes}
+					name="refreshIntervalMinutes"
+					type="number"
+					min="15"
+					max="10080"
+					required
+				/></label
+			>
+			<label
+				>Standardkategorie<select bind:value={defaultCategoryId} name="defaultCategoryId"
+					><option value="">Keine</option>{#each categories as category (category.id)}<option
+							value={category.id}>{category.name}</option
+						>{/each}</select
+				></label
+			>
+		</div>
+		<div class="management-dialog-selections">
+			<label class="toggle-row"
+				><input type="checkbox" name="isEnabled" value="1" bind:checked={isEnabled} /><span
+					><strong>Automatischer Abruf</strong><small
+						>Der Feed wird im festgelegten Intervall sicher abgerufen.</small
+					></span
+				></label
+			>
+		</div>
+		<footer>
+			<button class="secondary-button" type="button" onclick={close}>Abbrechen</button>
+			<button class="primary-button" type="submit"
+				>{feed ? 'Änderungen speichern' : 'Feed anlegen'}</button
+			>
+		</footer>
+	</form>
+</dialog>

src/lib/components/IconPicker.svelte

@@ -6,6 +6,7 @@
 		$props();
 	let query = $state('');
 	let menu: HTMLDetailsElement;
+	let searchInput: HTMLInputElement;
 	let filtered = $derived(
 		classicRegularIcons.filter((icon) =>
 			`${icon.name} ${icon.label} ${icon.terms.join(' ')}`
@@ -14,18 +15,31 @@
 		)
 	);
 	let visible = $derived(filtered.slice(0, 120));
+
+	function openAndFocus(event: MouseEvent) {
+		if (menu.open) return;
+		event.preventDefault();
+		menu.open = true;
+		searchInput.focus({ preventScroll: true });
+	}
 </script>
 
 <div class="icon-picker">
 	<input type="hidden" name={inputName} value={name} />
-	<details bind:this={menu}>
+	<details
-		<summary><AppIcon name={name || 'circle'} /> Icon auswählen</summary>
+		bind:this={menu}
+		ontoggle={() => {
+			if (menu.open) queueMicrotask(() => searchInput.focus());
+		}}
+	>
+		<summary onclick={openAndFocus}><AppIcon name={name || 'circle'} /> Icon auswählen</summary>
 		<div class="icon-picker-popover">
 			<label
 				><span class="sr-only">Icons durchsuchen</span><input
 					type="search"
 					placeholder="Icon suchen"
 					bind:value={query}
+					bind:this={searchInput}
 				/></label
 			>
 			<div class="icon-picker-grid">

src/lib/components/PresentationDisplay.svelte

@@ -62,7 +62,6 @@
 	</article>
 {:else if content.mode === 'image'}
 	<article class="output-content output-image-only">
-		{#if content.topics.length}<p class="output-topics">{content.topics.join(' · ')}</p>{/if}
 		{#if imageSrc}<img src={imageSrc} alt={content.images?.[0]?.altText ?? content.title} />{/if}
 	</article>
 {:else if content.mode === 'link'}

src/lib/components/RssSelectionDialog.svelte

@@ -0,0 +1,219 @@
+<script lang="ts">
+	/* eslint-disable svelte/no-navigation-without-resolve -- RSS links are validated external URLs. */
+	import { onMount, tick } from 'svelte';
+	import AppIcon from './AppIcon.svelte';
+	import ChoicePicker from './ChoicePicker.svelte';
+
+	type FeedEntry = {
+		id: string;
+		feedId: string;
+		feedName: string;
+		title: string;
+		url: string;
+		summary: string;
+		publishedAtUtc: string | null;
+	};
+
+	let {
+		entries,
+		categories,
+		form = null
+	}: {
+		entries: FeedEntry[];
+		categories: { id: string; name: string }[];
+		form?: { intent?: string; feedError?: string } | null;
+	} = $props();
+	let dialog: HTMLDialogElement;
+	let closeButton: HTMLButtonElement;
+	let selectedIds = $state<string[]>([]);
+	let selectedFeedIds = $state<string[]>([]);
+	let categoryIds = $state<string[]>([]);
+	let page = $state(1);
+	const pageSize = 20;
+	let feeds = $derived(
+		Array.from(new Map(entries.map((entry) => [entry.feedId, entry.feedName])).entries()).map(
+			([id, name]) => ({ id, name })
+		)
+	);
+	let filteredEntries = $derived(entries.filter((entry) => selectedFeedIds.includes(entry.feedId)));
+	let pageCount = $derived(Math.max(1, Math.ceil(filteredEntries.length / pageSize)));
+	let visibleEntries = $derived(filteredEntries.slice((page - 1) * pageSize, page * pageSize));
+	let allSourcesSelected = $derived(feeds.length > 0 && selectedFeedIds.length === feeds.length);
+
+	onMount(() => {
+		selectedFeedIds = feeds.map((feed) => feed.id);
+		if (form?.intent === 'feedImport' && form.feedError) void showModal();
+	});
+
+	export async function showModal() {
+		if (!selectedFeedIds.length) selectedFeedIds = feeds.map((feed) => feed.id);
+		if (!dialog.open) dialog.showModal();
+		await tick();
+		closeButton.focus();
+	}
+
+	function close() {
+		dialog.close();
+	}
+
+	function selectAllSources() {
+		selectedFeedIds = feeds.map((feed) => feed.id);
+		page = 1;
+	}
+
+	function toggleSource(id: string) {
+		selectedFeedIds = selectedFeedIds.includes(id)
+			? selectedFeedIds.filter((feedId) => feedId !== id)
+			: [...selectedFeedIds, id];
+		page = 1;
+	}
+
+	function toggleEntry(id: string) {
+		selectedIds = selectedIds.includes(id)
+			? selectedIds.filter((entryId) => entryId !== id)
+			: [...selectedIds, id];
+	}
+
+	function handleEntryKeydown(event: KeyboardEvent, id: string) {
+		if (event.key !== 'Enter' && event.key !== ' ') return;
+		event.preventDefault();
+		toggleEntry(id);
+	}
+</script>
+
+<dialog
+	bind:this={dialog}
+	class="management-dialog rss-selection-dialog"
+	aria-labelledby="rss-selection-title"
+	onclick={(event) => event.target === dialog && close()}
+>
+	<header>
+		<div class="management-dialog-title">
+			<span class="management-dialog-icon"><AppIcon name="rss" /></span>
+			<div>
+				<p class="eyebrow">RSS-Importeingang</p>
+				<h2 id="rss-selection-title">RSS-Beiträge auswählen</h2>
+			</div>
+		</div>
+		<button
+			bind:this={closeButton}
+			class="dialog-close"
+			type="button"
+			aria-label="RSS-Auswahl schließen"
+			onclick={close}><AppIcon name="xmark" /></button
+		>
+	</header>
+	<form class="rss-selection-form" method="POST" action="?/importFeeds">
+		{#each selectedIds as id (id)}<input type="hidden" name="entryIds" value={id} />{/each}
+		<div class="rss-selection-content">
+			{#if form?.intent === 'feedImport' && form.feedError}<div
+					class="form-message error"
+					role="alert"
+				>
+					{form.feedError}
+				</div>{/if}
+			<nav class="rss-source-filters" aria-label="RSS-Quellen filtern">
+				<button
+					type="button"
+					class:active={allSourcesSelected}
+					aria-pressed={allSourcesSelected}
+					onclick={selectAllSources}>Alle Quellen</button
+				>
+				{#each feeds as feed (feed.id)}
+					<button
+						type="button"
+						class:active={selectedFeedIds.includes(feed.id)}
+						aria-pressed={selectedFeedIds.includes(feed.id)}
+						onclick={() => toggleSource(feed.id)}>{feed.name}</button
+					>
+				{/each}
+			</nav>
+
+			<div class="rss-result-summary" aria-live="polite">
+				<strong>{filteredEntries.length} verfügbare Beiträge</strong>
+				<span>Seite {page} von {pageCount}</span>
+			</div>
+			<div
+				class="rss-entry-list"
+				role="listbox"
+				aria-label="Verfügbare RSS-Beiträge"
+				aria-multiselectable="true"
+			>
+				{#each visibleEntries as entry (entry.id)}
+					<div
+						class:selected={selectedIds.includes(entry.id)}
+						class="rss-entry"
+						role="option"
+						tabindex="0"
+						aria-selected={selectedIds.includes(entry.id)}
+						onclick={() => toggleEntry(entry.id)}
+						onkeydown={(event) => handleEntryKeydown(event, entry.id)}
+					>
+						<div class="rss-entry-state" aria-hidden="true">
+							<AppIcon name={selectedIds.includes(entry.id) ? 'check' : 'plus'} />
+						</div>
+						<div class="rss-entry-copy">
+							<small
+								>{entry.feedName}{entry.publishedAtUtc
+									? ` · ${new Date(entry.publishedAtUtc).toLocaleDateString('de-DE')}`
+									: ''}</small
+							>
+							<strong>{entry.title}</strong>
+							{#if entry.summary}<p>{entry.summary}</p>{/if}
+							<a
+								href={entry.url}
+								target="_blank"
+								rel="noreferrer"
+								onclick={(event) => event.stopPropagation()}
+								onkeydown={(event) => event.stopPropagation()}>Original öffnen</a
+							>
+						</div>
+						{#if selectedIds.includes(entry.id)}<span class="rss-selected-label">Ausgewählt</span
+							>{/if}
+					</div>
+				{:else}<p class="empty-copy">
+						Für diese Quellenauswahl sind keine Beiträge verfügbar.
+					</p>{/each}
+			</div>
+			{#if pageCount > 1}<nav class="rss-pagination" aria-label="RSS-Beitragsseiten">
+					<button
+						class="secondary-button"
+						type="button"
+						disabled={page === 1}
+						onclick={() => (page -= 1)}>Zurück</button
+					>
+					<span
+						>{(page - 1) * pageSize + 1}–{Math.min(page * pageSize, filteredEntries.length)} von {filteredEntries.length}</span
+					>
+					<button
+						class="secondary-button"
+						type="button"
+						disabled={page === pageCount}
+						onclick={() => (page += 1)}>Weiter</button
+					>
+				</nav>{/if}
+			<div class="rss-category-selection">
+				<span class="field-label">Kategorien für die Auswahl</span>
+				<small>Ohne Auswahl gilt die Standardkategorie der jeweiligen Quelle.</small>
+				<ChoicePicker
+					items={categories}
+					selectedIds={categoryIds}
+					label="Kategorien"
+					fieldName="categoryIds"
+					onselectionchange={(ids) => (categoryIds = ids)}
+				/>
+			</div>
+		</div>
+		<footer class="rss-selection-actions">
+			<button
+				class="text-button danger-text"
+				type="submit"
+				formaction="?/discardFeeds"
+				disabled={!selectedIds.length}>Auswahl verwerfen</button
+			>
+			<button class="primary-button" type="submit" disabled={!selectedIds.length}>
+				Auswahl in den Eingang übernehmen ({selectedIds.length})
+			</button>
+		</footer>
+	</form>
+</dialog>

src/lib/components/ShareManagement.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { resolve } from '$app/paths';
+	import { onMount } from 'svelte';
 	import AppIcon from './AppIcon.svelte';
 
 	type ShareShow = {
@@ -26,12 +27,19 @@
 		shows,
 		shares,
 		fixedShowId = '',
+		catalogPanel = false,
 		form = null
 	}: {
 		shows: ShareShow[];
 		shares: ShareItem[];
 		fixedShowId?: string;
-		form?: { intent?: string; error?: string; success?: string | boolean; shareUrl?: string } | null;
+		catalogPanel?: boolean;
+		form?: {
+			intent?: string;
+			error?: string;
+			success?: string | boolean;
+			shareUrl?: string;
+		} | null;
 	} = $props();
 
 	let visibleShows = $derived(
@@ -40,6 +48,17 @@
 			: shows.filter((show) => shares.some((share) => share.showId === show.id))
 	);
 	let dialog: HTMLDialogElement;
+	let copyMessage = $state('');
+
+	onMount(() => {
+		if (form?.intent?.toLowerCase().includes('share')) dialog.showModal();
+	});
+
+	async function copyShareUrl() {
+		if (!form?.shareUrl) return;
+		await navigator.clipboard.writeText(new URL(form.shareUrl, window.location.origin).href);
+		copyMessage = 'Link kopiert.';
+	}
 
 	function germanDate(value: string | null, fallback = 'Termin offen') {
 		return value
@@ -87,21 +106,49 @@
 	}
 </script>
 
-<button class="secondary-button share-dialog-trigger" type="button" onclick={() => dialog.showModal()}>
+{#if catalogPanel}
+	<section class="quiet-panel share-catalog-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Gastzugänge</p>
+				<h2>Lesefreigaben</h2>
+			</div>
+			<button
+				class="compact-add-button share-dialog-trigger"
+				type="button"
+				aria-label="Lesefreigaben"
+				onclick={() => dialog.showModal()}
+			>
+				<AppIcon name="link" /> Freigaben verwalten
+			</button>
+		</div>
+		<p class="catalog-note">
+			Sendungen gezielt als widerrufbaren Leselink mit wählbarem Informationsumfang teilen.
+		</p>
+	</section>
+{:else}
+	<button
+		class="secondary-button share-dialog-trigger"
+		type="button"
+		onclick={() => dialog.showModal()}
+	>
 		<AppIcon name="link" /> Lesefreigaben
 	</button>
+{/if}
 <dialog bind:this={dialog} class="share-management-dialog">
-<section
+	<section class="share-management" aria-labelledby={`share-title-${fixedShowId || 'all'}`}>
-	class="quiet-panel share-management"
-	aria-labelledby={`share-title-${fixedShowId || 'all'}`}
->
 		<div class="panel-heading">
 			<div>
 				<p class="eyebrow">Gastzugänge</p>
 				<h2 id={`share-title-${fixedShowId || 'all'}`}>Lesefreigaben</h2>
 			</div>
 			<span class="mail-mode">Aktualisiert sich bis zum Abschluss</span>
-		<button class="dialog-close" type="button" aria-label="Lesefreigaben schließen" onclick={() => dialog.close()}>
+			<button
+				class="dialog-close"
+				type="button"
+				aria-label="Lesefreigaben schließen"
+				onclick={() => dialog.close()}
+			>
 				<AppIcon name="xmark" />
 			</button>
 		</div>
@@ -124,8 +171,15 @@
 		{#if form?.shareUrl}<div class="form-message success share-result" role="status">
 				<strong>Neuer Leselink</strong>
 				<!-- The server returns only a same-origin share path created by this action. -->
+				<div>
 					<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -->
-			<a href={form.shareUrl}>{form.shareUrl}</a>
+					<a href={form.shareUrl}>{form.shareUrl}</a><button
+						class="secondary-button"
+						type="button"
+						onclick={copyShareUrl}><AppIcon name="copy" /> Kopieren</button
+					>
+				</div>
+				{#if copyMessage}<small>{copyMessage}</small>{/if}
 			</div>{/if}
 
 		<form class="share-create-form" method="POST" action="?/createShare">
@@ -158,7 +212,8 @@
 				/></label
 			>
 			<label>Optionaler Ablauf<input name="expiresAt" type="datetime-local" /></label>
-		<button class="primary-button" type="submit" disabled={!shows.length}>Leselink anlegen</button>
+			<button class="primary-button" type="submit" disabled={!shows.length}>Leselink anlegen</button
+			>
 		</form>
 
 		{#if visibleShows.length}
@@ -229,6 +284,20 @@
 												<button class="secondary-button" type="submit">Freigabe speichern</button>
 											</form>
 										{/if}
+										{#if !share.revokedAtUtc}<form
+												method="POST"
+												action="?/replaceShare"
+												onsubmit={(event) => {
+													if (
+														!confirm('Ersatzlink anlegen? Der bisherige Link wird sofort ungültig.')
+													)
+														event.preventDefault();
+												}}
+											>
+												<input type="hidden" name="shareId" value={share.id} />
+												<input type="hidden" name="showId" value={show.id} />
+												<button class="text-button" type="submit">Ersatzlink anlegen</button>
+											</form>{/if}
 										<form
 											method="POST"
 											action="?/deleteShare"
@@ -241,7 +310,8 @@
 										>
 											<input type="hidden" name="shareId" value={share.id} />
 											<input type="hidden" name="showId" value={show.id} />
-										<button class="text-button danger-text" type="submit">Freigabe löschen</button>
+											<button class="text-button danger-text" type="submit">Freigabe löschen</button
+											>
 										</form>
 									</div>
 								</details>

src/lib/components/TechnicalAccessDialog.svelte

@@ -0,0 +1,128 @@
+<script lang="ts">
+	import { onMount, tick } from 'svelte';
+	import AppIcon from './AppIcon.svelte';
+	type TechnicalAccess = {
+		id: string;
+		name: string;
+		permissions: 'read' | 'read_write';
+	};
+
+	let {
+		form = null
+	}: {
+		form?: {
+			intent?: string;
+			error?: string;
+			success?: string | boolean;
+			technicalToken?: string;
+		} | null;
+	} = $props();
+	let dialog: HTMLDialogElement;
+	let nameInput = $state<HTMLInputElement>();
+	let copyMessage = $state('');
+	let access = $state<TechnicalAccess | null>(null);
+	let name = $state('');
+	let permissions = $state<'read' | 'read_write'>('read');
+
+	onMount(() => {
+		if (form?.intent === 'technicalAccess' && (form.error || form.technicalToken)) void showModal();
+	});
+
+	export async function showModal(selectedAccess: TechnicalAccess | null = null) {
+		access = selectedAccess;
+		name = selectedAccess?.name ?? '';
+		permissions = selectedAccess?.permissions ?? 'read';
+		if (!dialog.open) dialog.showModal();
+		await tick();
+		(form?.technicalToken && !access
+			? dialog.querySelector<HTMLButtonElement>('.token-copy')
+			: nameInput
+		)?.focus();
+	}
+
+	function close() {
+		dialog.close();
+	}
+
+	async function copyToken() {
+		if (!form?.technicalToken) return;
+		try {
+			await navigator.clipboard.writeText(form.technicalToken);
+			copyMessage = 'Token kopiert.';
+		} catch {
+			copyMessage = 'Kopieren wurde vom Browser blockiert.';
+		}
+	}
+</script>
+
+<dialog
+	bind:this={dialog}
+	class="management-dialog technical-access-dialog"
+	aria-labelledby="technical-access-dialog-title"
+	onclick={(event) => event.target === dialog && close()}
+>
+	<header>
+		<div class="management-dialog-title">
+			<span class="management-dialog-icon"><AppIcon name="key" /></span>
+			<div>
+				<p class="eyebrow">Externe Assistenz</p>
+				<h2 id="technical-access-dialog-title">{access?.name || 'API-Zugang hinzufügen'}</h2>
+			</div>
+		</div>
+		<button class="dialog-close" type="button" aria-label="Zugangsdialog schließen" onclick={close}
+			><AppIcon name="xmark" /></button
+		>
+	</header>
+	{#if form?.technicalToken && !access}
+		<div class="technical-token-result">
+			<div class="form-message success" role="status">
+				<strong>Token, einmalig sichtbar</strong>
+				<p>Jetzt kopieren und sicher hinterlegen. Sendewerk speichert weiterhin nur den Hash.</p>
+			</div>
+			<code>{form.technicalToken}</code>
+			<button class="primary-button token-copy" type="button" onclick={copyToken}
+				><AppIcon name="copy" /> Token kopieren</button
+			>
+			{#if copyMessage}<small role="status">{copyMessage}</small>{/if}
+		</div>
+	{:else}
+		<form
+			class="management-dialog-form"
+			method="POST"
+			action={access ? '?/updateTechnicalAccess' : '?/createTechnicalAccess'}
+		>
+			{#if access}<input type="hidden" name="accessId" value={access.id} />{/if}
+			{#if form?.intent === 'technicalAccess' && form.error}<div
+					class="form-message error dialog-form-message"
+					role="alert"
+				>
+					{form.error}
+				</div>{/if}
+			<div class="management-dialog-fields">
+				<label
+					>Name<input
+						bind:this={nameInput}
+						bind:value={name}
+						name="name"
+						required
+						maxlength="120"
+						placeholder="Redaktionsassistenz"
+					/></label
+				>
+				<label
+					>Berechtigung<select bind:value={permissions} name="permissions"
+						><option value="read">Nur lesen</option><option value="read_write"
+							>Lesen und schreiben</option
+						></select
+					></label
+				>
+			</div>
+			<footer>
+				<button class="secondary-button" type="button" onclick={close}>Abbrechen</button>
+				<button class="primary-button" type="submit"
+					>{access ? 'Änderungen speichern' : 'Zugang anlegen'}</button
+				>
+			</footer>
+		</form>
+	{/if}
+</dialog>

src/lib/components/UsageEditorDialog.svelte

@@ -1,10 +1,11 @@
 <script lang="ts">
 	import { enhance, type SubmitFunction } from '$app/forms';
-	import { untrack } from 'svelte';
+	import { onMount, untrack } from 'svelte';
 	import MarkdownEditorField from './MarkdownEditorField.svelte';
 	import InlineTitleEditor from './InlineTitleEditor.svelte';
 	import NavIcon from './NavIcon.svelte';
 	import PieceEditorDialog from './PieceEditorDialog.svelte';
+	import PresentationDisplay from './PresentationDisplay.svelte';
 	import type { PieceUsage } from '#lib/server/shows.js';
 
 	let {
@@ -13,7 +14,8 @@
 		sectionId,
 		sections,
 		error,
-		enhanceCommand
+		enhanceCommand,
+		open = false
 	}: {
 		usage: PieceUsage;
 		revision: number;
@@ -21,6 +23,7 @@
 		sections: { id: string; name: string }[];
 		error?: string;
 		enhanceCommand: SubmitFunction;
+		open?: boolean;
 	} = $props();
 
 	let formId = $derived(`usage-editor-form-${usage.id}`);
@@ -30,6 +33,14 @@
 		untrack(() => ({ ...usage, tools: usage.tools.map((tool) => ({ ...tool })) }))
 	);
 	let dirty = $state(false);
+	let selectedSourceId = $state(
+		untrack(
+			() => usage.sources.find((source) => source.url === usage.presentationSourceUrl)?.id ?? ''
+		)
+	);
+	onMount(() => {
+		if (open) editor.showModal();
+	});
 	let selectedMedia = $derived(
 		draft.media.find((media) => media.id === draft.presentationMediaId) ?? null
 	);
@@ -38,12 +49,63 @@
 		return Number((seconds / 60).toFixed(2));
 	}
 
+	function previewHtml(value: string) {
+		return value
+			.replaceAll('&', '&amp;')
+			.replaceAll('<', '&lt;')
+			.replaceAll('>', '&gt;')
+			.replaceAll('"', '&quot;')
+			.replaceAll("'", '&#039;')
+			.replaceAll('\n', '<br>');
+	}
+
 	function requestClose() {
 		if (dirty && !confirm('Ungespeicherte Änderungen verwerfen und Editor schließen?')) return;
 		dirty = false;
 		editor.close();
 	}
 
+	function presentationSourceChanged(event: Event) {
+		selectedSourceId = (event.currentTarget as HTMLSelectElement).value;
+		const source = draft.sources.find((item) => item.id === selectedSourceId);
+		if (!source) return;
+		draft.presentationSourceLabel = source.label;
+		draft.presentationSourceUrl = source.url;
+		draft.presentationSourceTimecodeSeconds = source.timecodeSeconds;
+	}
+
+	let previewContent = $derived({
+		mode: draft.presentationMode,
+		topics: draft.topics.map((topic) => topic.name),
+		title: draft.outputTitle || draft.title,
+		html: previewHtml(draft.presentation),
+		source: draft.presentationSourceUrl
+			? {
+					label: draft.presentationSourceLabel,
+					url: draft.presentationSourceUrl,
+					timecodeSeconds: draft.presentationSourceTimecodeSeconds
+				}
+			: null,
+		previewTitle: draft.presentationTitle,
+		description: draft.presentationDescription,
+		imageUrl: draft.presentationMode === 'link' ? draft.presentationImageUrl : '',
+		siteName: draft.presentationSiteName,
+		provider: draft.presentationProvider,
+		providerId: draft.presentationProviderId,
+		embedUrl: '',
+		sources: [],
+		images: selectedMedia
+			? [{ id: selectedMedia.originalMediaId, altText: selectedMedia.altText }]
+			: []
+	});
+	let previewImageSrc = $derived(
+		selectedMedia && draft.presentationMode === 'text'
+			? '/media'
+			: selectedMedia && draft.presentationMode === 'image'
+				? `/media/${selectedMedia.originalMediaId}`
+				: ''
+	);
+
 	const enhanceEditor: SubmitFunction = async (input) => {
 		const finish = await enhanceCommand(input);
 		return async (result) => {
@@ -125,6 +187,26 @@
 			<details class="piece-meta-details">
 				<summary>Dauer und Einplanung</summary>
 				<div class="piece-meta-grid">
+					<label
+						>Vorbereitungsstatus<select
+							name="preparationStatus"
+							bind:value={draft.preparationStatus}
+						>
+							<option value="preparing">In Vorbereitung</option>
+							<option value="ready">Sendefertig</option>
+						</select></label
+					>
+					<label
+						>Vorbereitungsaufwand<select
+							name="preparationEffort"
+							bind:value={draft.preparationEffort}
+						>
+							<option value={null}>Nicht angegeben</option>
+							<option value="low">Gering</option>
+							<option value="medium">Mittel</option>
+							<option value="high">Hoch</option>
+						</select></label
+					>
 					<label
 						>Dauer in Minuten<input
 							name="durationMinutes"
@@ -212,20 +294,7 @@
 			</div>
 			<div class="piece-presentation-layout">
 				<div class="piece-presentation-controls">
-					<label
+					<p class="field-label">Präsentationsart</p>
-						>Präsentationstitel<input
-							name="outputTitle"
-							maxlength="300"
-							placeholder="Optional, sonst interner Titel"
-							bind:value={draft.outputTitle}
-						/></label
-					>
-					<MarkdownEditorField
-						name="presentation"
-						label="Öffentlicher Text"
-						placeholder="Text für die Publikumsausgabe"
-						bind:value={draft.presentation}
-					/>
 					<div class="presentation-mode-picker" role="group" aria-label="Darstellung">
 						{#each [['text', 'Text'], ['image', 'Nur Bild'], ['link', 'Linkvorschau'], ['video', 'Video']] as mode (mode[0])}
 							<label
@@ -238,6 +307,25 @@
 							>
 						{/each}
 					</div>
+					{#if draft.presentationMode === 'text'}
+						<label
+							>Öffentliche Überschrift<input
+								name="outputTitle"
+								maxlength="300"
+								placeholder="Optional, sonst interner Titel"
+								bind:value={draft.outputTitle}
+							/></label
+						>
+						<MarkdownEditorField
+							name="presentation"
+							label="Öffentlicher Vorspann"
+							placeholder="Text für die Publikumsausgabe"
+							bind:value={draft.presentation}
+						/>
+					{:else}
+						<input type="hidden" name="outputTitle" value={draft.outputTitle} />
+						<input type="hidden" name="presentation" value={draft.presentation} />
+					{/if}
 					<input
 						type="hidden"
 						name="presentationSourceLabel"
@@ -253,32 +341,42 @@
 					<input type="hidden" name="presentationMediaId" value={draft.presentationMediaId ?? ''} />
 					{#if draft.presentationMode === 'link' || draft.presentationMode === 'video'}
 						<div class="presentation-settings">
-							<div class="presentation-source-summary wide-field">
+							<label class="wide-field"
-								<span>Ausgewählte Quelle</span>
+								>{draft.presentationMode === 'video' ? 'Video-URL' : 'Quelle/URL'}<select
-								<strong
+									bind:value={selectedSourceId}
-									>{draft.presentationSourceLabel ||
+									onchange={presentationSourceChanged}
-										draft.presentationSourceUrl ||
+								>
-										'Keine Quelle'}</strong
+									<option value="">Quelle auswählen</option>
+									{#each draft.sources as source (source.id)}
+										<option value={source.id}>{source.label || source.url}</option>
+									{/each}
+								</select></label
 							>
-								{#if draft.presentationSourceUrl}<small>{draft.presentationSourceUrl}</small>{/if}
-							</div>
 							<label
-								>Kartentitel<input
+								>{draft.presentationMode === 'video' ? 'Videotitel' : 'Kartentitel'}<input
 									name="presentationTitle"
 									maxlength="300"
 									placeholder="Optionaler Anzeigetitel"
 									bind:value={draft.presentationTitle}
 								/></label
 							>
+							{#if draft.presentationMode === 'link'}
 								<label
-								>Bild-URL<input
+									>Vorschaubild-URL<input
 										name="presentationImageUrl"
 										type="url"
 										maxlength="2000"
-									placeholder="https://…"
+										placeholder="Aus der Linkvorschau"
 										bind:value={draft.presentationImageUrl}
 									/></label
 								>
+							{:else}
+								<input
+									type="hidden"
+									name="presentationImageUrl"
+									value={draft.presentationImageUrl}
+								/>
+							{/if}
 							<label class="wide-field"
 								>Anreißer<textarea
 									name="presentationDescription"
@@ -298,9 +396,11 @@
 						<input type="hidden" name="presentationImageUrl" value={draft.presentationImageUrl} />
 					{/if}
 				</div>
-				{#if draft.media.length}<fieldset class="usage-media-picker">
+				{#if draft.media.length && ['text', 'image'].includes(draft.presentationMode)}<fieldset
+						class="usage-media-picker"
+					>
 						<legend>Hochgeladenes Präsentationsbild</legend>
-						<label
+						{#if draft.presentationMode === 'text'}<label
 								><input
 									type="radio"
 									checked={!draft.presentationMediaId}
@@ -309,7 +409,7 @@
 										dirty = true;
 									}}
 								/> Kein Bild</label
-						>
+							>{/if}
 						<div class="media-grid">
 							{#each draft.media as media (media.id)}<label class="media-presentation-choice"
 									><input
@@ -326,30 +426,7 @@
 						</div>
 					</fieldset>{/if}
 				<aside class="piece-presentation-preview" aria-label="Präsentationsvorschau">
-					<p class="output-kicker">Vorschau · {draft.presentationMode}</p>
+					<PresentationDisplay content={previewContent} imageSrc={previewImageSrc} />
-					<h4>{draft.outputTitle || draft.title}</h4>
-					{#if draft.presentationMode === 'text'}
-						<p class="preview-markdown-source">
-							{draft.presentation || 'Noch kein öffentlicher Text.'}
-						</p>
-						{#if selectedMedia}<img
-								src={`/media/${selectedMedia.originalMediaId}`}
-								alt={selectedMedia.altText}
-							/>{/if}
-					{:else}
-						{#if selectedMedia}<img
-								src={`/media/${selectedMedia.originalMediaId}`}
-								alt={selectedMedia.altText}
-							/>{:else if draft.presentationImageUrl}<img
-								src={draft.presentationImageUrl}
-								alt=""
-							/>{/if}
-						<p>
-							{draft.presentationDescription ||
-								draft.presentationSourceUrl ||
-								'Noch keine Vorschauangaben.'}
-						</p>
-					{/if}
 				</aside>
 			</div>
 		</section>

src/lib/server/api-http.ts

@@ -0,0 +1,47 @@
+import { json } from '@sveltejs/kit';
+
+export async function apiBody(request: Request) {
+	const type = request.headers.get('content-type') ?? '';
+	if (!type.includes('application/json')) throw new Error('API_JSON_REQUIRED');
+	try {
+		return (await request.json()) as Record<string, unknown>;
+	} catch {
+		throw new Error('API_INVALID_JSON');
+	}
+}
+
+export function apiFailure(cause: unknown) {
+	const code = cause instanceof Error ? cause.message : 'API_ERROR';
+	const status =
+		code === 'API_UNAUTHORIZED'
+			? 401
+			: code === 'API_FORBIDDEN'
+				? 403
+				: code === 'NOT_FOUND'
+					? 404
+					: code === 'CONFLICT' || code === 'API_IDEMPOTENCY_CONFLICT'
+						? 409
+						: 400;
+	return json(
+		{
+			error: {
+				code,
+				message:
+					status === 401
+						? 'Authentifizierung erforderlich.'
+						: status === 403
+							? 'Diese Berechtigung fehlt.'
+							: status === 404
+								? 'Nicht gefunden.'
+								: 'Anfrage konnte nicht verarbeitet werden.'
+			}
+		},
+		{ status }
+	);
+}
+
+export function pageInput(url: URL) {
+	const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit') ?? 50) || 50));
+	const offset = Math.max(0, Number(url.searchParams.get('offset') ?? 0) || 0);
+	return { limit, offset };
+}

src/lib/server/auth.ts

@@ -564,7 +564,13 @@ export async function resetPassword(token: string, password: string): Promise<vo
 				'UPDATE password_reset_tokens SET consumed_at_utc = ? WHERE user_id = ? AND consumed_at_utc IS NULL'
 			)
 			.run(timestamp, row.user_id);
+		database.prepare('DELETE FROM oauth_authorization_codes WHERE user_id = ?').run(row.user_id);
 		database.prepare('DELETE FROM sessions WHERE user_id = ?').run(row.user_id);
+		database
+			.prepare(
+				'UPDATE oauth_access_tokens SET revoked_at_utc = ? WHERE user_id = ? AND revoked_at_utc IS NULL'
+			)
+			.run(timestamp, row.user_id);
 	});
 	reset();
 }
@@ -592,7 +598,15 @@ export function setUserLocked(actor: AuthUser, userId: string, locked: boolean):
 		database
 			.prepare('UPDATE users SET locked_at_utc = ?, updated_at_utc = ? WHERE id = ?')
 			.run(locked ? nowUtc() : null, nowUtc(), userId);
-		if (locked) database.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
+		if (locked) {
+			database.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
+			database
+				.prepare(
+					'UPDATE oauth_access_tokens SET revoked_at_utc = ? WHERE user_id = ? AND revoked_at_utc IS NULL'
+				)
+				.run(nowUtc(), userId);
+			database.prepare('DELETE FROM oauth_authorization_codes WHERE user_id = ?').run(userId);
+		}
 	});
 	update();
 }

src/lib/server/config.ts

@@ -18,6 +18,10 @@ export function getAuthConfig() {
 		throw new Error('SENDEWERK_APP_ORIGIN muss im Produktionsbetrieb gesetzt sein.');
 	}
 	const origin = new URL(configuredOrigin || 'http://localhost:5173');
+	const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname);
+	if (process.env.NODE_ENV === 'production' && origin.protocol !== 'https:' && !loopback) {
+		throw new Error('SENDEWERK_APP_ORIGIN muss öffentlich HTTPS verwenden.');
+	}
 	return {
 		origin,
 		setupToken: process.env.SENDEWERK_SETUP_TOKEN || '',

src/lib/server/database.spec.ts

@@ -62,7 +62,7 @@ describe('database setup', () => {
 		database.close();
 
 		expect(counts).toEqual({
-			migrations: 17,
+			migrations: 20,
 			pieces: 6,
 			shows: 2,
 			usages: 5,

src/lib/server/feeds.spec.ts

@@ -0,0 +1,134 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { closeDatabase, getDatabase } from './database.js';
+import {
+	discardFeedEntries,
+	fetchDueFeeds,
+	fetchFeed,
+	importFeedEntries,
+	listFeedEntries,
+	saveFeedSource
+} from './feeds.js';
+import { getPiece } from './content.js';
+
+vi.mock('node:dns/promises', () => ({
+	lookup: vi.fn(async () => [{ address: '93.184.216.34', family: 4 }])
+}));
+
+const validFeed = `<?xml version="1.0"?><rss version="2.0"><channel><title>Test</title><item>
+<guid>entry-1</guid><title>Ein Beitrag</title><link>https://example.org/post</link>
+<description><![CDATA[<p>Kurz <strong>und</strong> gut.</p><script>evil()</script>]]></description>
+<pubDate>Sat, 24 Oct 2026 12:00:00 GMT</pubDate></item></channel></rss>`;
+
+let directory: string;
+
+beforeEach(() => {
+	directory = mkdtempSync(path.join(tmpdir(), 'sendewerk-feed-test-'));
+	process.env.SENDEWERK_DB_PATH = path.join(directory, 'test.sqlite');
+	process.env.SENDEWERK_UPLOAD_DIR = path.join(directory, 'uploads');
+	execFileSync(process.execPath, ['scripts/migrate.mjs'], { cwd: process.cwd(), env: process.env });
+	execFileSync(process.execPath, ['scripts/seed.mjs'], { cwd: process.cwd(), env: process.env });
+});
+
+afterEach(() => {
+	vi.unstubAllGlobals();
+	closeDatabase();
+	delete process.env.SENDEWERK_DB_PATH;
+	delete process.env.SENDEWERK_UPLOAD_DIR;
+	rmSync(directory, { recursive: true, force: true });
+});
+
+describe('RSS import inbox', () => {
+	it('keeps one entry across fetches and preserves a discard decision', async () => {
+		vi.stubGlobal(
+			'fetch',
+			vi.fn(
+				async () => new Response(validFeed, { headers: { 'content-type': 'application/rss+xml' } })
+			)
+		);
+		const feedId = saveFeedSource(null, {
+			name: 'Feed',
+			url: 'https://example.org/feed.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		await fetchFeed(feedId);
+		const [entry] = listFeedEntries();
+		expect(entry.title).toBe('Ein Beitrag');
+		expect(discardFeedEntries([entry.id])).toBe(1);
+		await fetchFeed(feedId);
+		expect(listFeedEntries()).toHaveLength(0);
+		expect(listFeedEntries('discarded')).toHaveLength(1);
+	});
+
+	it('sanitizes foreign HTML and retains the original source on explicit import', async () => {
+		vi.stubGlobal(
+			'fetch',
+			vi.fn(async () => new Response(validFeed))
+		);
+		const feedId = saveFeedSource(null, {
+			name: 'Feed',
+			url: 'https://example.org/feed.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: 'cat-jc'
+		});
+		await fetchFeed(feedId);
+		const [entry] = listFeedEntries();
+		const [pieceId] = importFeedEntries([entry.id], []);
+		const piece = getPiece(pieceId)!;
+		expect(piece.summary).toContain('Kurz und gut.');
+		expect(piece.summary).not.toContain('<script>');
+		expect(piece.sources).toEqual([
+			{ label: 'RSS: Originalbeitrag', url: 'https://example.org/post', timecodeSeconds: null }
+		]);
+		expect(piece.categoryIds).toEqual(['cat-jc']);
+	});
+
+	it('isolates a broken feed while fetching other due feeds', async () => {
+		vi.stubGlobal(
+			'fetch',
+			vi.fn(
+				async (url: URL) => new Response(url.href.includes('broken') ? '<not-feed />' : validFeed)
+			)
+		);
+		saveFeedSource(null, {
+			name: 'A broken',
+			url: 'https://example.org/broken.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		saveFeedSource(null, {
+			name: 'B valid',
+			url: 'https://example.org/valid.xml',
+			isEnabled: true,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		await fetchDueFeeds();
+		expect(listFeedEntries()).toHaveLength(1);
+		const errors = getDatabase()
+			.prepare("SELECT count(*) AS count FROM feed_sources WHERE last_error <> ''")
+			.get() as { count: number };
+		expect(errors.count).toBe(1);
+	});
+
+	it('blocks loopback targets before sending a request', async () => {
+		const request = vi.fn();
+		vi.stubGlobal('fetch', request);
+		const feedId = saveFeedSource(null, {
+			name: 'Local',
+			url: 'http://127.0.0.1/feed.xml',
+			isEnabled: false,
+			refreshIntervalMinutes: 60,
+			defaultCategoryId: null
+		});
+		await expect(fetchFeed(feedId)).rejects.toThrow('FEED_BLOCKED');
+		expect(request).not.toHaveBeenCalled();
+	});
+});

src/lib/server/feeds.ts

@@ -0,0 +1,457 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import sanitizeHtml from 'sanitize-html';
+import { XMLParser } from 'fast-xml-parser';
+import { createPiece, getPiece, savePiece } from './content.js';
+import { getDatabase } from './database.js';
+
+const MAX_FEED_BYTES = 2 * 1024 * 1024;
+const FETCH_TIMEOUT_MS = 8_000;
+const MAX_REDIRECTS = 3;
+
+export type FeedSource = {
+	id: string;
+	name: string;
+	url: string;
+	isEnabled: boolean;
+	refreshIntervalMinutes: number;
+	defaultCategoryId: string | null;
+	lastFetchedAtUtc: string | null;
+	nextFetchAtUtc: string | null;
+	lastError: string;
+};
+
+export type FeedEntry = {
+	id: string;
+	feedId: string;
+	feedName: string;
+	title: string;
+	url: string;
+	summary: string;
+	publishedAtUtc: string | null;
+	status: 'new' | 'imported' | 'discarded';
+	pieceId: string | null;
+	defaultCategoryId: string | null;
+};
+
+function clean(value: unknown, maximum: number) {
+	return String(value ?? '')
+		.trim()
+		.slice(0, maximum);
+}
+
+function validHttpUrl(value: string) {
+	try {
+		const url = new URL(value);
+		return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password;
+	} catch {
+		return false;
+	}
+}
+
+function privateIpv4(address: string) {
+	const p = address.split('.').map(Number);
+	return (
+		p[0] === 0 ||
+		p[0] === 10 ||
+		p[0] === 127 ||
+		(p[0] === 169 && p[1] === 254) ||
+		(p[0] === 172 && p[1] >= 16 && p[1] <= 31) ||
+		(p[0] === 192 && p[1] === 168) ||
+		p[0] >= 224
+	);
+}
+
+function privateAddress(address: string) {
+	if (isIP(address) === 4) return privateIpv4(address);
+	const value = address.toLowerCase().split('%')[0];
+	if (value === '::' || value === '::1' || value.startsWith('fc') || value.startsWith('fd'))
+		return true;
+	if (/^fe[89ab]/.test(value)) return true;
+	const mapped = value.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1];
+	return mapped ? privateIpv4(mapped) : false;
+}
+
+async function assertPublic(url: URL) {
+	if (!validHttpUrl(url.href) || (url.port && !['80', '443'].includes(url.port)))
+		throw new Error('FEED_BLOCKED');
+	const hostname = url.hostname.replace(/^\[|\]$/g, '');
+	if (hostname === 'localhost' || hostname.endsWith('.localhost')) throw new Error('FEED_BLOCKED');
+	const addresses = isIP(hostname)
+		? [{ address: hostname }]
+		: await lookup(hostname, { all: true, verbatim: true });
+	if (!addresses.length || addresses.some((entry) => privateAddress(entry.address)))
+		throw new Error('FEED_BLOCKED');
+}
+
+async function fetchXml(
+	input: string,
+	headers: Record<string, string>,
+	redirects = 0
+): Promise<{ xml: string; etag: string; lastModified: string; unchanged: boolean }> {
+	const url = new URL(input);
+	await assertPublic(url);
+	const response = await fetch(url, {
+		headers: {
+			Accept: 'application/rss+xml, application/atom+xml, application/xml, text/xml',
+			...headers
+		},
+		redirect: 'manual',
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+	});
+	if ([301, 302, 303, 307, 308].includes(response.status)) {
+		if (redirects >= MAX_REDIRECTS) throw new Error('FEED_REDIRECT');
+		const location = response.headers.get('location');
+		if (!location) throw new Error('FEED_FETCH');
+		return fetchXml(new URL(location, url).href, headers, redirects + 1);
+	}
+	if (response.status === 304)
+		return {
+			xml: '',
+			etag: headers['If-None-Match'] ?? '',
+			lastModified: headers['If-Modified-Since'] ?? '',
+			unchanged: true
+		};
+	if (!response.ok) throw new Error(`FEED_HTTP_${response.status}`);
+	const declared = Number(response.headers.get('content-length') ?? 0);
+	if (declared > MAX_FEED_BYTES) throw new Error('FEED_TOO_LARGE');
+	const buffer = Buffer.from(await response.arrayBuffer());
+	if (buffer.length > MAX_FEED_BYTES) throw new Error('FEED_TOO_LARGE');
+	return {
+		xml: buffer.toString('utf8'),
+		etag: response.headers.get('etag') ?? '',
+		lastModified: response.headers.get('last-modified') ?? '',
+		unchanged: false
+	};
+}
+
+function values<T>(value: T | T[] | undefined): T[] {
+	return value === undefined ? [] : Array.isArray(value) ? value : [value];
+}
+
+function textFrom(value: unknown): string {
+	if (typeof value === 'string' || typeof value === 'number') return String(value);
+	if (value && typeof value === 'object') {
+		const record = value as Record<string, unknown>;
+		return textFrom(record['#text'] ?? record.__cdata ?? '');
+	}
+	return '';
+}
+
+function entryLink(value: unknown) {
+	for (const link of values(
+		value as Record<string, unknown> | Record<string, unknown>[] | string | undefined
+	)) {
+		if (typeof link === 'string') return link;
+		if (link && typeof link === 'object') {
+			const href = clean((link as Record<string, unknown>)['@_href'], 2_000);
+			const rel = clean((link as Record<string, unknown>)['@_rel'], 30);
+			if (href && (!rel || rel === 'alternate')) return href;
+		}
+	}
+	return '';
+}
+
+function parseDate(value: unknown) {
+	const raw = textFrom(value);
+	if (!raw) return null;
+	const date = new Date(raw);
+	return Number.isNaN(date.valueOf()) ? null : date.toISOString();
+}
+
+function parseFeed(xml: string) {
+	let document: Record<string, unknown>;
+	try {
+		document = new XMLParser({
+			ignoreAttributes: false,
+			processEntities: false,
+			trimValues: true
+		}).parse(xml) as Record<string, unknown>;
+	} catch {
+		throw new Error('INVALID_FEED');
+	}
+	const rssChannel = (document.rss as Record<string, unknown> | undefined)?.channel as
+		Record<string, unknown> | undefined;
+	const atom = document.feed as Record<string, unknown> | undefined;
+	if (!rssChannel && !atom) throw new Error('INVALID_FEED');
+	const rawEntries = values(
+		(rssChannel?.item ?? atom?.entry) as
+			Record<string, unknown> | Record<string, unknown>[] | undefined
+	);
+	return rawEntries.slice(0, 200).flatMap((entry) => {
+		const title = clean(textFrom(entry.title), 300);
+		const url = clean(entryLink(entry.link) || textFrom(entry.link), 2_000);
+		if (!title || !validHttpUrl(url)) return [];
+		const guid = clean(textFrom(entry.guid ?? entry.id), 2_000);
+		const externalId = guid || createHash('sha256').update(url).digest('hex');
+		const rawSummary = textFrom(entry.description ?? entry.summary ?? entry.content);
+		const summary = clean(
+			sanitizeHtml(rawSummary, { allowedTags: [], allowedAttributes: {} }),
+			5_000
+		);
+		return [
+			{
+				externalId,
+				title,
+				url,
+				summary,
+				publishedAtUtc: parseDate(entry.pubDate ?? entry.published ?? entry.updated)
+			}
+		];
+	});
+}
+
+export function listFeedSources(): FeedSource[] {
+	return (
+		getDatabase()
+			.prepare(
+				`SELECT id, name, url, is_enabled, refresh_interval_minutes,
+		default_category_id, last_fetched_at_utc, next_fetch_at_utc, last_error FROM feed_sources ORDER BY name`
+			)
+			.all() as Array<Record<string, unknown>>
+	).map((row) => ({
+		id: String(row.id),
+		name: String(row.name),
+		url: String(row.url),
+		isEnabled: row.is_enabled === 1,
+		refreshIntervalMinutes: Number(row.refresh_interval_minutes),
+		defaultCategoryId: row.default_category_id ? String(row.default_category_id) : null,
+		lastFetchedAtUtc: row.last_fetched_at_utc ? String(row.last_fetched_at_utc) : null,
+		nextFetchAtUtc: row.next_fetch_at_utc ? String(row.next_fetch_at_utc) : null,
+		lastError: String(row.last_error)
+	}));
+}
+
+export function saveFeedSource(
+	id: string | null,
+	input: {
+		name: string;
+		url: string;
+		isEnabled: boolean;
+		refreshIntervalMinutes: number;
+		defaultCategoryId: string | null;
+	}
+) {
+	const name = clean(input.name, 120);
+	const url = clean(input.url, 2_000);
+	if (
+		!name ||
+		!validHttpUrl(url) ||
+		!Number.isInteger(input.refreshIntervalMinutes) ||
+		input.refreshIntervalMinutes < 15 ||
+		input.refreshIntervalMinutes > 10080
+	)
+		throw new Error('INVALID_FEED');
+	const database = getDatabase();
+	if (
+		input.defaultCategoryId &&
+		!database.prepare('SELECT 1 FROM section_categories WHERE id = ?').get(input.defaultCategoryId)
+	)
+		throw new Error('INVALID_TAXONOMY');
+	const now = new Date().toISOString();
+	if (!id) {
+		id = randomUUID();
+		database
+			.prepare(
+				`INSERT INTO feed_sources (id, name, url, is_enabled, refresh_interval_minutes,
+			default_category_id, next_fetch_at_utc, created_at_utc, updated_at_utc) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				id,
+				name,
+				url,
+				input.isEnabled ? 1 : 0,
+				input.refreshIntervalMinutes,
+				input.defaultCategoryId,
+				input.isEnabled ? now : null,
+				now,
+				now
+			);
+	} else {
+		const result = database
+			.prepare(
+				`UPDATE feed_sources SET name = ?, url = ?, is_enabled = ?, refresh_interval_minutes = ?,
+			default_category_id = ?, next_fetch_at_utc = CASE WHEN ? = 1 THEN COALESCE(next_fetch_at_utc, ?) ELSE NULL END,
+			updated_at_utc = ? WHERE id = ?`
+			)
+			.run(
+				name,
+				url,
+				input.isEnabled ? 1 : 0,
+				input.refreshIntervalMinutes,
+				input.defaultCategoryId,
+				input.isEnabled ? 1 : 0,
+				now,
+				now,
+				id
+			);
+		if (!result.changes) throw new Error('NOT_FOUND');
+	}
+	return id;
+}
+
+export function deleteFeedSource(id: string) {
+	if (!getDatabase().prepare('DELETE FROM feed_sources WHERE id = ?').run(id).changes)
+		throw new Error('NOT_FOUND');
+}
+
+export function listFeedEntries(status: 'new' | 'imported' | 'discarded' = 'new'): FeedEntry[] {
+	return (
+		getDatabase()
+			.prepare(
+				`SELECT e.id, e.feed_id, f.name AS feed_name, e.title, e.url, e.summary,
+		e.published_at_utc, e.status, e.piece_id, f.default_category_id FROM feed_entries e
+		JOIN feed_sources f ON f.id = e.feed_id WHERE e.status = ? ORDER BY COALESCE(e.published_at_utc, e.first_seen_at_utc) DESC`
+			)
+			.all(status) as Array<Record<string, unknown>>
+	).map((row) => ({
+		id: String(row.id),
+		feedId: String(row.feed_id),
+		feedName: String(row.feed_name),
+		title: String(row.title),
+		url: String(row.url),
+		summary: String(row.summary),
+		publishedAtUtc: row.published_at_utc ? String(row.published_at_utc) : null,
+		status: row.status as FeedEntry['status'],
+		pieceId: row.piece_id ? String(row.piece_id) : null,
+		defaultCategoryId: row.default_category_id ? String(row.default_category_id) : null
+	}));
+}
+
+export async function fetchFeed(feedId: string) {
+	const database = getDatabase();
+	const feed = database.prepare('SELECT * FROM feed_sources WHERE id = ?').get(feedId) as
+		Record<string, unknown> | undefined;
+	if (!feed) throw new Error('NOT_FOUND');
+	const now = new Date();
+	try {
+		const response = await fetchXml(String(feed.url), {
+			...(feed.etag ? { 'If-None-Match': String(feed.etag) } : {}),
+			...(feed.last_modified ? { 'If-Modified-Since': String(feed.last_modified) } : {})
+		});
+		let inserted = 0;
+		if (!response.unchanged) {
+			const add =
+				database.prepare(`INSERT INTO feed_entries (id, feed_id, external_id, title, url, summary,
+				published_at_utc, first_seen_at_utc, updated_at_utc) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+				ON CONFLICT(feed_id, external_id) DO UPDATE SET title = excluded.title, url = excluded.url,
+				summary = excluded.summary, published_at_utc = excluded.published_at_utc, updated_at_utc = excluded.updated_at_utc`);
+			for (const entry of parseFeed(response.xml)) {
+				const existed = database
+					.prepare('SELECT 1 FROM feed_entries WHERE feed_id = ? AND external_id = ?')
+					.get(feedId, entry.externalId);
+				add.run(
+					randomUUID(),
+					feedId,
+					entry.externalId,
+					entry.title,
+					entry.url,
+					entry.summary,
+					entry.publishedAtUtc,
+					now.toISOString(),
+					now.toISOString()
+				);
+				if (!existed) inserted += 1;
+			}
+		}
+		const next = new Date(
+			now.getTime() + Number(feed.refresh_interval_minutes) * 60_000
+		).toISOString();
+		database
+			.prepare(
+				`UPDATE feed_sources SET etag = ?, last_modified = ?, last_fetched_at_utc = ?,
+			next_fetch_at_utc = ?, last_error = '', updated_at_utc = ? WHERE id = ?`
+			)
+			.run(
+				response.etag,
+				response.lastModified,
+				now.toISOString(),
+				next,
+				now.toISOString(),
+				feedId
+			);
+		return { inserted, unchanged: response.unchanged };
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message.slice(0, 500) : 'FEED_FETCH';
+		const next = new Date(
+			now.getTime() + Number(feed.refresh_interval_minutes) * 60_000
+		).toISOString();
+		database
+			.prepare(
+				'UPDATE feed_sources SET last_fetched_at_utc = ?, next_fetch_at_utc = ?, last_error = ?, updated_at_utc = ? WHERE id = ?'
+			)
+			.run(now.toISOString(), next, message, now.toISOString(), feedId);
+		throw cause;
+	}
+}
+
+export async function fetchDueFeeds() {
+	const rows = getDatabase()
+		.prepare(
+			`SELECT id FROM feed_sources WHERE is_enabled = 1
+		AND (next_fetch_at_utc IS NULL OR next_fetch_at_utc <= ?) ORDER BY next_fetch_at_utc LIMIT 10`
+		)
+		.all(new Date().toISOString()) as { id: string }[];
+	for (const row of rows) await fetchFeed(row.id).catch(() => undefined);
+}
+
+export function importFeedEntries(entryIds: string[], categoryIds: string[]) {
+	const database = getDatabase();
+	const categories = [...new Set(categoryIds.filter(Boolean))];
+	if (categories.length > 20) throw new Error('INVALID_TAXONOMY');
+	for (const category of categories)
+		if (!database.prepare('SELECT 1 FROM section_categories WHERE id = ?').get(category))
+			throw new Error('INVALID_TAXONOMY');
+	return database.transaction(() =>
+		entryIds.map((entryId) => {
+			const entry = database
+				.prepare(
+					`SELECT e.*, f.default_category_id FROM feed_entries e JOIN feed_sources f ON f.id = e.feed_id
+			WHERE e.id = ? AND e.status = 'new'`
+				)
+				.get(entryId) as Record<string, unknown> | undefined;
+			if (!entry) throw new Error('NOT_FOUND');
+			const pieceId = createPiece('blank');
+			const piece = getPiece(pieceId)!;
+			const assigned = categories.length
+				? categories
+				: entry.default_category_id
+					? [String(entry.default_category_id)]
+					: [];
+			savePiece(pieceId, piece.revision, {
+				...piece,
+				title: String(entry.title),
+				summary: String(entry.summary),
+				status: 'inbox',
+				categoryIds: assigned,
+				sources: [{ label: 'RSS: Originalbeitrag', url: String(entry.url), timecodeSeconds: null }]
+			});
+			database
+				.prepare(
+					"UPDATE feed_entries SET status = 'imported', piece_id = ?, updated_at_utc = ? WHERE id = ?"
+				)
+				.run(pieceId, new Date().toISOString(), entryId);
+			return pieceId;
+		})
+	)();
+}
+
+export function discardFeedEntries(entryIds: string[]) {
+	const database = getDatabase();
+	const update = database.prepare(
+		"UPDATE feed_entries SET status = 'discarded', updated_at_utc = ? WHERE id = ? AND status = 'new'"
+	);
+	const now = new Date().toISOString();
+	return database.transaction(() =>
+		entryIds.reduce((count, id) => count + update.run(now, id).changes, 0)
+	)();
+}
+
+let schedulerStarted = false;
+export function startFeedScheduler() {
+	if (schedulerStarted || process.env.NODE_ENV === 'test') return;
+	schedulerStarted = true;
+	void fetchDueFeeds();
+	setInterval(() => void fetchDueFeeds(), 60_000).unref();
+}

src/lib/server/live.spec.ts

@@ -7,8 +7,9 @@ import { closeDatabase, getDatabase } from './database.js';
 import {
 	completeCurrent,
 	clearPresentationChannel,
-	getPresentationChannelView,
 	getLiveView,
+	getPresentationChannelStatus,
+	getPresentationChannelView,
 	getPresentationMedia,
 	getPresentationView,
 	goBack,
@@ -16,6 +17,7 @@ import {
 	moveOpenUsage,
 	presentationChannelAccess,
 	presentUsage,
+	resumeUsage,
 	rotatePresentationChannelKey,
 	selectUsage,
 	skipCurrent,
@@ -59,6 +61,11 @@ describe('live mode', () => {
 				"UPDATE show_sections SET explicit_duration_seconds = 600 WHERE id = 'section-stories'"
 			)
 			.run();
+		live = getLiveView('show-october', new Date('2026-10-23T18:01:40.000Z'));
+		expect(live.sectionTimer).toMatchObject({
+			plannedDurationSeconds: 600,
+			elapsedSeconds: 100
+		});
 		completeCurrent(
 			'show-october',
 			'timer-next-piece',
@@ -104,15 +111,58 @@ describe('live mode', () => {
 				.find((usage) => usage.id === 'usage-console')?.status
 		).toBe('done');
 
-		selectUsage('show-october', 'usage-console', 'return-to-completed', live.liveRevision);
+		expect(() =>
+			selectUsage('show-october', 'usage-console', 'return-to-completed', live.liveRevision)
+		).toThrow('INVALID_STATUS');
+		resumeUsage('show-october', 'usage-console', 'resume-completed', live.liveRevision);
 		expect(getLiveView('show-october').current).toMatchObject({
 			id: 'usage-console',
 			status: 'current'
 		});
 	});
 
+	it('resumes a completed piece and its earlier section timer without resetting total time', () => {
+		const database = getDatabase();
+		database
+			.prepare(
+				"UPDATE show_sections SET explicit_duration_seconds = 300 WHERE id = 'section-stories'"
+			)
+			.run();
+		database
+			.prepare("UPDATE show_sections SET explicit_duration_seconds = 200 WHERE id = 'section-game'")
+			.run();
+		database
+			.prepare(
+				"UPDATE piece_usages SET show_section_id = 'section-game', position = 0 WHERE id = 'usage-effects'"
+			)
+			.run();
+		const start = new Date('2026-10-23T18:00:00.000Z');
+		startOrResumeLive('show-october', 'resume-start', 0, start);
+		completeCurrent('show-october', 'resume-next', 1, new Date('2026-10-23T18:01:00.000Z'));
+		let live = getLiveView('show-october', new Date('2026-10-23T18:01:30.000Z'));
+		expect(live.current?.id).toBe('usage-effects');
+		resumeUsage(
+			'show-october',
+			'usage-console',
+			'resume-earlier',
+			live.liveRevision,
+			new Date('2026-10-23T18:01:30.000Z')
+		);
+		live = getLiveView('show-october', new Date('2026-10-23T18:02:00.000Z'));
+		expect(live.current).toMatchObject({ id: 'usage-console', status: 'current' });
+		expect(live.completedCount).toBe(0);
+		expect(live.sectionTimer).toMatchObject({
+			sectionId: 'section-stories',
+			plannedDurationSeconds: 300,
+			elapsedSeconds: 90
+		});
+		expect(live.totalTimer.elapsedSeconds).toBe(120);
+	});
+
 	it('keeps one stable output channel until its key is explicitly rotated', () => {
+		expect(getPresentationChannelStatus('show-october')).toBe('disconnected');
 		const key = issuePresentationAccess('show-october');
+		expect(getPresentationChannelStatus('show-october')).toBe('connected');
 		expect(issuePresentationAccess('show-october')).toBe(key);
 		expect(presentationChannelAccess('default', key)).toBe(true);
 		expect(getPresentationChannelView('default')).toEqual({
@@ -128,6 +178,7 @@ describe('live mode', () => {
 		presentUsage('show-october', 'usage-console', 'present-channel', 1);
 		expect(getPresentationChannelView('default')?.content).not.toBeNull();
 		clearPresentationChannel();
+		expect(getPresentationChannelStatus('show-october')).toBe('disconnected');
 		expect(getPresentationChannelView('default')?.content).toBeNull();
 		issuePresentationAccess('show-october');
 		expect(getPresentationChannelView('default')?.content).toBeNull();
@@ -239,6 +290,40 @@ describe('live mode', () => {
 		expect(media).toBeNull();
 		expect(await getPresentationMedia(token, 'unknown-image')).toBeNull();
 
+		getDatabase()
+			.prepare(
+				`INSERT INTO usage_media_snapshots
+				 (id, usage_id, original_media_id, alt_text, position, is_presentation)
+				 VALUES ('presentation-snapshot', 'usage-console', 'presentation-image',
+				 'Konsole auf dem Tisch', 0, 1)`
+			)
+			.run();
+		getDatabase()
+			.prepare(
+				`UPDATE piece_usages SET presentation_mode_snapshot = 'text',
+				 presentation_image_only_snapshot = 1,
+				 presentation_image_url_snapshot = 'https://private.example.test/not-for-image-mode'
+				 WHERE id = 'usage-console'`
+			)
+			.run();
+		presentUsage(
+			'show-october',
+			'usage-console',
+			'present-image-only',
+			getLiveView('show-october').liveRevision
+		);
+		expect(getPresentationView(token)?.content).toMatchObject({
+			mode: 'image',
+			imageUrl: '',
+			images: [{ id: 'presentation-snapshot', altText: 'Konsole auf dem Tisch' }],
+			sources: []
+		});
+		expect(await getPresentationMedia(token, 'presentation-snapshot')).toMatchObject({
+			mimeType: 'image/png',
+			byteSize: 10,
+			altText: 'Konsole auf dem Tisch'
+		});
+
 		const replacementToken = issuePresentationAccess('show-october');
 		expect(replacementToken).toBe(token);
 		expect(getPresentationView(token)?.content?.title).toBe(

src/lib/server/live.ts

@@ -149,12 +149,13 @@ function orderedUsages(database: Database.Database, showId: string): OrderedUsag
 function usageBelongsToShow(database: Database.Database, showId: string, usageId: string) {
 	const row = database
 		.prepare(
-			`SELECT s.is_reserve_bank FROM piece_usages u
+			`SELECT s.is_reserve_bank, u.status FROM piece_usages u
 			 JOIN show_sections s ON s.id = u.show_section_id
 			 WHERE u.id = ? AND s.show_id = ?`
 		)
-		.get(usageId, showId) as { is_reserve_bank: number } | undefined;
+		.get(usageId, showId) as { is_reserve_bank: number; status: string } | undefined;
 	if (!row || row.is_reserve_bank) throw new Error('NOT_FOUND');
+	return row;
 }
 
 function closeActiveRun(database: Database.Database, showId: string, now: string) {
@@ -265,8 +266,7 @@ function syncSectionTimer(
 			 FROM live_section_timers WHERE show_id = ? AND ended_at_utc IS NULL`
 		)
 		.get(showId) as
-		| { id: string; section_id: string; planned_duration_seconds: number }
+		{ id: string; section_id: string; planned_duration_seconds: number } | undefined;
-		| undefined;
 	if (active?.section_id === section.id) {
 		if (!section.explicit_duration_seconds || section.explicit_duration_seconds <= 0) {
 			closeSectionTimer(database, showId, now);
@@ -279,6 +279,29 @@ function syncSectionTimer(
 	}
 	if (active) closeSectionTimer(database, showId, now);
 	if (!section.explicit_duration_seconds || section.explicit_duration_seconds <= 0) return;
+	const previous = database
+		.prepare(
+			`SELECT id FROM live_section_timers WHERE show_id = ? AND section_id = ?
+			 ORDER BY started_at_utc DESC LIMIT 1`
+		)
+		.get(showId, section.id) as { id: string } | undefined;
+	if (previous) {
+		database
+			.prepare(
+				`UPDATE live_section_timers SET planned_duration_seconds = ?, ended_at_utc = NULL
+				 WHERE id = ?`
+			)
+			.run(section.explicit_duration_seconds, previous.id);
+		if (showTimerRunning(database, showId)) {
+			database
+				.prepare(
+					`INSERT INTO live_section_timer_runs (id, timer_id, started_at_utc)
+					 VALUES (?, ?, ?)`
+				)
+				.run(randomUUID(), previous.id, now);
+		}
+		return;
+	}
 	const timerId = randomUUID();
 	database
 		.prepare(
@@ -287,6 +310,7 @@ function syncSectionTimer(
 			 VALUES (?, ?, ?, ?, ?)`
 		)
 		.run(timerId, showId, section.id, section.explicit_duration_seconds, now);
+	if (showTimerRunning(database, showId)) {
 		database
 			.prepare(
 				`INSERT INTO live_section_timer_runs (id, timer_id, started_at_utc)
@@ -294,6 +318,7 @@ function syncSectionTimer(
 			)
 			.run(randomUUID(), timerId, now);
 	}
+}
 
 function activateUsage(database: Database.Database, showId: string, usageId: string, now: string) {
 	usageBelongsToShow(database, showId, usageId);
@@ -412,6 +437,9 @@ export function getLiveView(showId: string, nowValue?: Date): LiveView {
 	const state = ensureLiveState(database, showId, now);
 	const show = getShow(showId);
 	if (!show) throw new Error('NOT_FOUND');
+	if (state.started_at_utc && !state.ended_at_utc && state.current_usage_id) {
+		syncSectionTimer(database, showId, state.current_usage_id, now);
+	}
 	const durations = actualDurations(database, showId, now);
 	const sections = show.sections.map((section) => ({
 		...section,
@@ -941,7 +969,8 @@ export function selectUsage(
 		(database, state, now) => {
 			if (!state.started_at_utc) throw new Error('NOT_STARTED');
 			if (!showTimerRunning(database, showId)) throw new Error('TIMER_PAUSED');
-			usageBelongsToShow(database, showId, usageId);
+			const target = usageBelongsToShow(database, showId, usageId);
+			if (target.status !== 'open') throw new Error('INVALID_STATUS');
 			if (state.current_usage_id === usageId) return;
 			if (state.current_usage_id) {
 				closeActiveRun(database, showId, now);
@@ -955,6 +984,36 @@ export function selectUsage(
 	);
 }
 
+export function resumeUsage(
+	showId: string,
+	usageId: string,
+	commandId: string,
+	expectedRevision: number,
+	nowValue?: Date
+) {
+	return executeCommand(
+		showId,
+		commandId,
+		expectedRevision,
+		'resume-usage',
+		(database, state, now) => {
+			if (!state.started_at_utc || state.ended_at_utc) throw new Error('NOT_LIVE');
+			if (!showTimerRunning(database, showId)) throw new Error('TIMER_PAUSED');
+			const target = usageBelongsToShow(database, showId, usageId);
+			if (target.status !== 'done' && target.status !== 'skipped')
+				throw new Error('INVALID_STATUS');
+			if (state.current_usage_id) {
+				closeActiveRun(database, showId, now);
+				database
+					.prepare("UPDATE piece_usages SET status = 'open' WHERE id = ?")
+					.run(state.current_usage_id);
+			}
+			activateUsage(database, showId, usageId, now);
+		},
+		nowValue
+	);
+}
+
 export function presentUsage(
 	showId: string,
 	usageId: string | null,
@@ -1099,6 +1158,14 @@ export function presentationChannelAccess(channelId: string, accessKey: string)
 	);
 }
 
+export function getPresentationChannelStatus(showId: string) {
+	const channel = getDatabase()
+		.prepare("SELECT show_id FROM presentation_channels WHERE id = 'default'")
+		.get() as { show_id: string | null } | undefined;
+	if (!channel?.show_id) return 'disconnected' as const;
+	return channel.show_id === showId ? ('connected' as const) : ('other_show' as const);
+}
+
 function presentationShowId(database: Database.Database, token: string) {
 	if (!token || token.length > 200) return null;
 	const channel = database
@@ -1165,10 +1232,11 @@ function getPresentationViewForShow(showId: string): PresentationView {
 		  }
 		| undefined;
 	if (!usage) return { revision: state.presentation_revision, content: null };
+	const mode = usage.presentation_mode_snapshot;
 	return {
 		revision: state.presentation_revision,
 		content: {
-			mode: usage.presentation_mode_snapshot,
+			mode,
 			topics: (
 				database
 					.prepare('SELECT name FROM usage_topic_snapshots WHERE usage_id = ? ORDER BY position')
@@ -1185,7 +1253,7 @@ function getPresentationViewForShow(showId: string): PresentationView {
 				: null,
 			previewTitle: usage.presentation_title_meta_snapshot,
 			description: usage.presentation_description_snapshot,
-			imageUrl: usage.presentation_image_url_snapshot,
+			imageUrl: mode === 'link' ? usage.presentation_image_url_snapshot : '',
 			siteName: usage.presentation_site_name_snapshot,
 			provider: usage.presentation_provider_snapshot,
 			providerId: usage.presentation_provider_id_snapshot,
@@ -1195,7 +1263,8 @@ function getPresentationViewForShow(showId: string): PresentationView {
 				usage.presentation_source_timecode_snapshot
 			),
 			sources: [],
-			images: (
+			images: ['text', 'image'].includes(mode)
+				? (
 						database
 							.prepare(
 								`SELECT id, alt_text FROM usage_media_snapshots
@@ -1203,13 +1272,14 @@ function getPresentationViewForShow(showId: string): PresentationView {
 							)
 							.all(state.presentation_usage_id) as { id: string; alt_text: string }[]
 					).map((media) => ({ id: media.id, altText: media.alt_text }))
+				: []
 		}
 	};
 }
 
 export async function getPresentationPreviewImage(token: string) {
 	const view = getPresentationView(token);
-	if (!view?.content?.imageUrl || view.content.mode === 'text') return null;
+	if (!view?.content?.imageUrl || view.content.mode !== 'link') return null;
 	try {
 		return await fetchPresentationImage(view.content.imageUrl);
 	} catch {
@@ -1233,7 +1303,8 @@ export async function getPresentationMedia(
 			 JOIN show_sections s ON s.id = u.show_section_id
 			 JOIN piece_media pm ON pm.id = ums.original_media_id
 			 WHERE state.show_id = ? AND s.show_id = state.show_id
-			 AND s.is_reserve_bank = 0 AND ums.id = ? AND ums.is_presentation = 1`
+			 AND s.is_reserve_bank = 0 AND ums.id = ? AND ums.is_presentation = 1
+			 AND (u.presentation_image_only_snapshot = 1 OR u.presentation_mode_snapshot = 'text')`
 		)
 		.get(showId, snapshotId) as
 		{ storage_name: string; mime_type: string; byte_size: number; alt_text: string } | undefined;

src/lib/server/mcp.ts

@@ -0,0 +1,431 @@
+import type { AuthUser } from './auth.js';
+import { PIECE_STATUSES, getPiece, listPieces, type PieceStatus } from './content.js';
+import { SHOW_STATUSES, getShow, listShows, type ShowStatus } from './shows.js';
+import { MCP_SCOPE } from './oauth.js';
+
+const MAX_PAGE_SIZE = 100;
+
+type JsonRpcId = string | number | null;
+type JsonRpcRequest = {
+	jsonrpc: '2.0';
+	id?: JsonRpcId;
+	method: string;
+	params?: Record<string, unknown>;
+};
+
+const oauthSecurity = [{ type: 'oauth2', scopes: [MCP_SCOPE] }];
+const readOnlyAnnotations = {
+	readOnlyHint: true,
+	destructiveHint: false,
+	idempotentHint: true,
+	openWorldHint: false
+};
+
+const profileOutputSchema = {
+	$schema: 'https://json-schema.org/draft/2020-12/schema',
+	type: 'object',
+	properties: {
+		id: { type: 'string', minLength: 1, pattern: '\\S' },
+		name: { type: 'string' },
+		email: { type: 'string' },
+		nickname: { type: 'string' }
+	},
+	required: ['id'],
+	additionalProperties: false
+};
+
+const paginationSchema = {
+	type: 'object',
+	properties: {
+		limit: { type: 'integer' },
+		offset: { type: 'integer' },
+		total: { type: 'integer' }
+	},
+	required: ['limit', 'offset', 'total'],
+	additionalProperties: false
+};
+
+const tools = [
+	{
+		name: 'get_profile',
+		title: 'Sendewerk-Profil',
+		description: 'Gibt das mit dieser Verbindung verknüpfte Sendewerk-Konto zurück.',
+		inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+		outputSchema: profileOutputSchema,
+		annotations: readOnlyAnnotations,
+		securitySchemes: oauthSecurity,
+		_meta: { 'openai/profile': true, securitySchemes: oauthSecurity }
+	},
+	{
+		name: 'list_pieces',
+		title: 'Pieces durchsuchen',
+		description: 'Listet und durchsucht redaktionelle Pieces im Sendewerk-Fundus.',
+		inputSchema: {
+			type: 'object',
+			properties: {
+				query: { type: 'string', maxLength: 200 },
+				statuses: {
+					type: 'array',
+					items: { type: 'string', enum: PIECE_STATUSES },
+					uniqueItems: true
+				},
+				limit: { type: 'integer', minimum: 1, maximum: MAX_PAGE_SIZE, default: 20 },
+				offset: { type: 'integer', minimum: 0, default: 0 }
+			},
+			additionalProperties: false
+		},
+		outputSchema: {
+			type: 'object',
+			properties: {
+				pieces: { type: 'array', items: { type: 'object' } },
+				pagination: paginationSchema
+			},
+			required: ['pieces', 'pagination'],
+			additionalProperties: false
+		},
+		annotations: readOnlyAnnotations,
+		securitySchemes: oauthSecurity,
+		_meta: { securitySchemes: oauthSecurity }
+	},
+	{
+		name: 'get_piece',
+		title: 'Piece lesen',
+		description: 'Liest die redaktionellen Texte und Quellen eines einzelnen Pieces.',
+		inputSchema: {
+			type: 'object',
+			properties: { id: { type: 'string', minLength: 1, maxLength: 100 } },
+			required: ['id'],
+			additionalProperties: false
+		},
+		outputSchema: {
+			type: 'object',
+			properties: { id: { type: 'string' }, title: { type: 'string' } },
+			required: ['id', 'title']
+		},
+		annotations: readOnlyAnnotations,
+		securitySchemes: oauthSecurity,
+		_meta: { securitySchemes: oauthSecurity }
+	},
+	{
+		name: 'list_shows',
+		title: 'Sendungen auflisten',
+		description: 'Listet Sendungen mit Status, Termin, Dauer und Abschnittszahl.',
+		inputSchema: {
+			type: 'object',
+			properties: {
+				statuses: {
+					type: 'array',
+					items: { type: 'string', enum: SHOW_STATUSES },
+					uniqueItems: true
+				},
+				limit: { type: 'integer', minimum: 1, maximum: MAX_PAGE_SIZE, default: 20 },
+				offset: { type: 'integer', minimum: 0, default: 0 }
+			},
+			additionalProperties: false
+		},
+		outputSchema: {
+			type: 'object',
+			properties: {
+				shows: { type: 'array', items: { type: 'object' } },
+				pagination: paginationSchema
+			},
+			required: ['shows', 'pagination'],
+			additionalProperties: false
+		},
+		annotations: readOnlyAnnotations,
+		securitySchemes: oauthSecurity,
+		_meta: { securitySchemes: oauthSecurity }
+	},
+	{
+		name: 'get_show_rundown',
+		title: 'Sendungsablauf lesen',
+		description: 'Liest Metadaten, Abschnitte, eingeplante Pieces und Reserve einer Sendung.',
+		inputSchema: {
+			type: 'object',
+			properties: { id: { type: 'string', minLength: 1, maxLength: 100 } },
+			required: ['id'],
+			additionalProperties: false
+		},
+		outputSchema: {
+			type: 'object',
+			properties: {
+				id: { type: 'string' },
+				title: { type: 'string' },
+				sections: { type: 'array', items: { type: 'object' } },
+				reserve: { type: 'array', items: { type: 'object' } }
+			},
+			required: ['id', 'title', 'sections', 'reserve']
+		},
+		annotations: readOnlyAnnotations,
+		securitySchemes: oauthSecurity,
+		_meta: { securitySchemes: oauthSecurity }
+	}
+];
+
+function isObject(value: unknown): value is Record<string, unknown> {
+	return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function integer(
+	value: unknown,
+	fallback: number,
+	minimum: number,
+	maximum = Number.MAX_SAFE_INTEGER
+) {
+	if (value === undefined) return fallback;
+	if (!Number.isInteger(value) || Number(value) < minimum || Number(value) > maximum) {
+		throw new Error('INVALID_ARGUMENTS');
+	}
+	return Number(value);
+}
+
+function stringArgument(value: unknown, maximum: number, required = false): string {
+	if (value === undefined && !required) return '';
+	if (typeof value !== 'string' || (required && !value) || value.length > maximum) {
+		throw new Error('INVALID_ARGUMENTS');
+	}
+	return value;
+}
+
+function enumArray<T extends string>(value: unknown, allowed: readonly T[], fallback: T[]): T[] {
+	if (value === undefined) return fallback;
+	if (!Array.isArray(value) || value.some((item) => !allowed.includes(item as T))) {
+		throw new Error('INVALID_ARGUMENTS');
+	}
+	return [...new Set(value as T[])];
+}
+
+function exactKeys(input: Record<string, unknown>, allowed: string[]): void {
+	if (Object.keys(input).some((key) => !allowed.includes(key)))
+		throw new Error('INVALID_ARGUMENTS');
+}
+
+function toolResult(value: unknown) {
+	return {
+		content: [{ type: 'text', text: JSON.stringify(value) }],
+		structuredContent: value,
+		isError: false
+	};
+}
+
+function toolError(message: string) {
+	return { content: [{ type: 'text', text: message }], isError: true };
+}
+
+function projectPieceUsage(
+	usage: NonNullable<ReturnType<typeof getShow>>['sections'][number]['usages'][number]
+) {
+	return {
+		id: usage.id,
+		originalPieceId: usage.originalPieceId,
+		position: usage.position,
+		status: usage.status,
+		preparationStatus: usage.preparationStatus,
+		preparationEffort: usage.preparationEffort,
+		durationSeconds: usage.durationSeconds,
+		title: usage.title,
+		outputTitle: usage.outputTitle,
+		intro: usage.intro,
+		research: usage.research,
+		moderation: usage.moderation,
+		interaction: usage.interaction,
+		transition: usage.transition,
+		presentation: usage.presentation,
+		ownNotes: usage.ownNotes,
+		sources: usage.sources.map(({ label, url, timecodeSeconds }) => ({
+			label,
+			url,
+			timecodeSeconds
+		})),
+		topics: usage.topics.map(({ name }) => name)
+	};
+}
+
+function callTool(name: string, input: unknown, user: AuthUser) {
+	if (!isObject(input)) throw new Error('INVALID_ARGUMENTS');
+	switch (name) {
+		case 'get_profile': {
+			exactKeys(input, []);
+			const profile = { id: user.id, name: user.displayName };
+			return {
+				content: [{ type: 'text', text: JSON.stringify(profile) }],
+				structuredContent: profile,
+				isError: false
+			};
+		}
+		case 'list_pieces': {
+			exactKeys(input, ['query', 'statuses', 'limit', 'offset']);
+			const statuses = enumArray<PieceStatus>(input.statuses, PIECE_STATUSES, [
+				'inbox',
+				'preparing',
+				'ready'
+			]);
+			const query = stringArgument(input.query, 200);
+			const limit = integer(input.limit, 20, 1, MAX_PAGE_SIZE);
+			const offset = integer(input.offset, 0, 0);
+			const all = listPieces({ statuses, query });
+			return toolResult({
+				pieces: all
+					.slice(offset, offset + limit)
+					.map(({ mediaId: _mediaId, formatId: _formatId, ...piece }) => piece),
+				pagination: { limit, offset, total: all.length }
+			});
+		}
+		case 'get_piece': {
+			exactKeys(input, ['id']);
+			const id = stringArgument(input.id, 100, true);
+			const piece = getPiece(id);
+			if (!piece) return toolError('Piece nicht gefunden.');
+			const listEntry = listPieces({ statuses: [...PIECE_STATUSES] }).find(
+				(entry) => entry.id === id
+			);
+			return toolResult({
+				id: piece.id,
+				title: piece.title,
+				outputTitle: piece.outputTitle,
+				summary: piece.summary,
+				status: piece.status,
+				preparationEffort: piece.preparationEffort,
+				durationSeconds: piece.durationSeconds,
+				format: listEntry?.format ?? '',
+				categories: listEntry?.categories.map(({ name }) => name) ?? [],
+				topics: listEntry?.topics.map(({ name }) => name) ?? [],
+				intro: piece.intro,
+				research: piece.researchText,
+				moderation: piece.moderationNotes,
+				interaction: piece.interactionText,
+				transition: piece.transitionText,
+				presentation: piece.presentationText,
+				sources: piece.sources,
+				createdAtUtc: piece.createdAtUtc,
+				updatedAtUtc: piece.updatedAtUtc
+			});
+		}
+		case 'list_shows': {
+			exactKeys(input, ['statuses', 'limit', 'offset']);
+			const statuses = enumArray<ShowStatus>(input.statuses, SHOW_STATUSES, [...SHOW_STATUSES]);
+			const limit = integer(input.limit, 20, 1, MAX_PAGE_SIZE);
+			const offset = integer(input.offset, 0, 0);
+			const all = listShows(statuses);
+			return toolResult({
+				shows: all.slice(offset, offset + limit),
+				pagination: { limit, offset, total: all.length }
+			});
+		}
+		case 'get_show_rundown': {
+			exactKeys(input, ['id']);
+			const show = getShow(stringArgument(input.id, 100, true));
+			if (!show) return toolError('Sendung nicht gefunden.');
+			return toolResult({
+				id: show.id,
+				title: show.title,
+				startsAtUtc: show.startsAtUtc,
+				twitchTitle: show.twitchTitle,
+				announcementText: show.announcementText,
+				status: show.status,
+				totalDurationSeconds: show.totalDurationSeconds,
+				sections: show.sections.map((section) => ({
+					id: section.id,
+					name: section.name,
+					category: section.category,
+					position: section.position,
+					explicitDurationSeconds: section.explicitDurationSeconds,
+					durationSeconds: section.durationSeconds,
+					twitchTags: section.twitchTags,
+					pieces: section.usages.map(projectPieceUsage)
+				})),
+				reserve: show.reserve.map(projectPieceUsage),
+				createdAtUtc: show.createdAtUtc,
+				updatedAtUtc: show.updatedAtUtc,
+				completedAtUtc: show.completedAtUtc
+			});
+		}
+		default:
+			throw new Error('UNKNOWN_TOOL');
+	}
+}
+
+export function validJsonRpcRequest(value: unknown): value is JsonRpcRequest {
+	if (!isObject(value) || value.jsonrpc !== '2.0' || typeof value.method !== 'string') return false;
+	if (
+		'id' in value &&
+		value.id !== null &&
+		typeof value.id !== 'string' &&
+		typeof value.id !== 'number'
+	) {
+		return false;
+	}
+	return value.params === undefined || isObject(value.params);
+}
+
+export function handleMcpRequest(request: JsonRpcRequest, user: AuthUser) {
+	const id = request.id ?? null;
+	try {
+		switch (request.method) {
+			case 'server/discover':
+				return {
+					jsonrpc: '2.0',
+					id,
+					result: {
+						resultType: 'complete',
+						supportedVersions: ['2026-07-28', '2025-11-25', '2025-06-18', '2025-03-26'],
+						capabilities: { tools: { listChanged: false } },
+						_meta: {
+							'io.modelcontextprotocol/serverInfo': { name: 'Sendewerk', version: '0.7.3' }
+						},
+						instructions: 'Lesezugriff auf Pieces, Sendungen und redaktionelle Abläufe.',
+						ttlMs: 3_600_000,
+						cacheScope: 'private'
+					}
+				};
+			case 'initialize': {
+				const requestedVersion = request.params?.protocolVersion;
+				const supported = ['2025-11-25', '2025-06-18', '2025-03-26'];
+				const protocolVersion =
+					typeof requestedVersion === 'string' && supported.includes(requestedVersion)
+						? requestedVersion
+						: supported[0];
+				return {
+					jsonrpc: '2.0',
+					id,
+					result: {
+						protocolVersion,
+						capabilities: { tools: { listChanged: false } },
+						serverInfo: { name: 'Sendewerk', version: '0.7.3' },
+						instructions: 'Lesezugriff auf Pieces, Sendungen und redaktionelle Abläufe.'
+					}
+				};
+			}
+			case 'ping':
+				return { jsonrpc: '2.0', id, result: { resultType: 'complete' } };
+			case 'tools/list':
+				return { jsonrpc: '2.0', id, result: { resultType: 'complete', tools } };
+			case 'tools/call': {
+				const name = request.params?.name;
+				if (typeof name !== 'string') throw new Error('INVALID_ARGUMENTS');
+				return {
+					jsonrpc: '2.0',
+					id,
+					result: {
+						resultType: 'complete',
+						...callTool(name, request.params?.arguments ?? {}, user)
+					}
+				};
+			}
+			default:
+				return { jsonrpc: '2.0', id, error: { code: -32601, message: 'Method not found' } };
+		}
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : '';
+		return {
+			jsonrpc: '2.0',
+			id,
+			error:
+				message === 'INVALID_ARGUMENTS'
+					? { code: -32602, message: 'Invalid params' }
+					: message === 'UNKNOWN_TOOL'
+						? { code: -32602, message: 'Unknown tool' }
+						: { code: -32603, message: 'Internal error' }
+		};
+	}
+}

src/lib/server/oauth.ts

@@ -0,0 +1,425 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import type { AuthUser } from './auth.js';
+import { getAuthConfig } from './config.js';
+import { getDatabase } from './database.js';
+
+export const MCP_SCOPE = 'sendewerk:read';
+const AUTHORIZATION_CODE_DURATION_MS = 5 * 60 * 1000;
+const ACCESS_TOKEN_DURATION_SECONDS = 60 * 60;
+const MAX_REGISTERED_CLIENTS = 1000;
+const MCP_REQUEST_LIMIT_PER_HOUR = 600;
+
+type OAuthClientRow = {
+	id: string;
+	name: string;
+	redirect_uris_json: string;
+};
+
+type AuthorizationCodeRow = {
+	client_id: string;
+	user_id: string;
+	redirect_uri: string;
+	scope: string;
+	resource: string;
+	code_challenge: string;
+	expires_at_utc: string;
+	consumed_at_utc: string | null;
+};
+
+export type OAuthClient = {
+	id: string;
+	name: string;
+	redirectUris: string[];
+};
+
+export type OAuthAuthorizationRequest = {
+	client: OAuthClient;
+	redirectUri: string;
+	state: string;
+	scope: typeof MCP_SCOPE;
+	resource: string;
+	codeChallenge: string;
+};
+
+export class OAuthError extends Error {
+	constructor(
+		public code: string,
+		message: string,
+		public status = 400
+	) {
+		super(message);
+	}
+}
+
+function nowUtc(): string {
+	return new Date().toISOString();
+}
+
+function futureUtc(durationMs: number): string {
+	return new Date(Date.now() + durationMs).toISOString();
+}
+
+function tokenHash(token: string): string {
+	return createHash('sha256').update(token).digest('hex');
+}
+
+function randomToken(): string {
+	return randomBytes(32).toString('base64url');
+}
+
+export function oauthIssuer(): string {
+	return getAuthConfig().origin.origin;
+}
+
+export function mcpResource(): string {
+	return new URL('/mcp', getAuthConfig().origin).toString();
+}
+
+export function protectedResourceMetadataUrl(): string {
+	return new URL('/.well-known/oauth-protected-resource/mcp', getAuthConfig().origin).toString();
+}
+
+function validRedirectUri(value: string): boolean {
+	try {
+		const url = new URL(value);
+		if (url.hash || url.username || url.password) return false;
+		if (url.protocol === 'https:') return true;
+		return (
+			url.protocol === 'http:' &&
+			(url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]')
+		);
+	} catch {
+		return false;
+	}
+}
+
+function clientFromRow(row: OAuthClientRow): OAuthClient {
+	return { id: row.id, name: row.name, redirectUris: JSON.parse(row.redirect_uris_json) };
+}
+
+export function registerOAuthClient(input: unknown): OAuthClient {
+	if (!input || typeof input !== 'object' || Array.isArray(input)) {
+		throw new OAuthError('invalid_client_metadata', 'Client-Metadaten fehlen.');
+	}
+	const metadata = input as Record<string, unknown>;
+	const name = typeof metadata.client_name === 'string' ? metadata.client_name.trim() : '';
+	const redirectUris = Array.isArray(metadata.redirect_uris)
+		? [...new Set(metadata.redirect_uris.filter((uri): uri is string => typeof uri === 'string'))]
+		: [];
+	if (
+		!name ||
+		name.length > 120 ||
+		/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u.test(name) ||
+		!redirectUris.length ||
+		redirectUris.length > 10
+	) {
+		throw new OAuthError('invalid_client_metadata', 'Name und Redirect-URIs sind erforderlich.');
+	}
+	if (redirectUris.some((uri) => uri.length > 1000 || !validRedirectUri(uri))) {
+		throw new OAuthError(
+			'invalid_redirect_uri',
+			'Redirect-URIs müssen HTTPS oder lokale HTTP-Adressen sein.'
+		);
+	}
+	if (
+		metadata.token_endpoint_auth_method !== undefined &&
+		metadata.token_endpoint_auth_method !== 'none'
+	) {
+		throw new OAuthError(
+			'invalid_client_metadata',
+			'Nur öffentliche PKCE-Clients werden unterstützt.'
+		);
+	}
+	if (
+		(Array.isArray(metadata.grant_types) && !metadata.grant_types.includes('authorization_code')) ||
+		(Array.isArray(metadata.response_types) && !metadata.response_types.includes('code'))
+	) {
+		throw new OAuthError('invalid_client_metadata', 'Nur Authorization Code wird unterstützt.');
+	}
+	const client: OAuthClient = { id: randomToken(), name, redirectUris };
+	const database = getDatabase();
+	const timestamp = nowUtc();
+	database
+		.prepare('DELETE FROM oauth_authorization_codes WHERE expires_at_utc <= ?')
+		.run(timestamp);
+	database
+		.prepare(
+			'DELETE FROM oauth_access_tokens WHERE expires_at_utc <= ? OR revoked_at_utc IS NOT NULL'
+		)
+		.run(timestamp);
+	database
+		.prepare(
+			`DELETE FROM oauth_clients WHERE created_at_utc < ?
+			 AND NOT EXISTS (SELECT 1 FROM oauth_authorization_codes c WHERE c.client_id = oauth_clients.id)
+			 AND NOT EXISTS (SELECT 1 FROM oauth_access_tokens t WHERE t.client_id = oauth_clients.id)`
+		)
+		.run(new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString());
+	const count = database.prepare('SELECT count(*) AS count FROM oauth_clients').get() as {
+		count: number;
+	};
+	if (count.count >= MAX_REGISTERED_CLIENTS) {
+		throw new OAuthError(
+			'temporarily_unavailable',
+			'Derzeit sind keine weiteren Registrierungen möglich.',
+			503
+		);
+	}
+	database
+		.prepare(
+			'INSERT INTO oauth_clients (id, name, redirect_uris_json, created_at_utc) VALUES (?, ?, ?, ?)'
+		)
+		.run(client.id, client.name, JSON.stringify(client.redirectUris), timestamp);
+	return client;
+}
+
+export function reserveOAuthAttempt(kind: 'registration' | 'token', address: string): boolean {
+	const database = getDatabase();
+	const since = new Date(Date.now() - 60 * 60 * 1000).toISOString();
+	const limit = kind === 'registration' ? 20 : 120;
+	const addressHash = tokenHash(address || 'unknown');
+	return database.transaction(() => {
+		database.prepare('DELETE FROM oauth_rate_limit_attempts WHERE attempted_at_utc < ?').run(since);
+		const row = database
+			.prepare(
+				`SELECT count(*) AS count FROM oauth_rate_limit_attempts
+				 WHERE kind = ? AND address_hash = ? AND attempted_at_utc >= ?`
+			)
+			.get(kind, addressHash, since) as { count: number };
+		if (row.count >= limit) return false;
+		database
+			.prepare(
+				`INSERT INTO oauth_rate_limit_attempts (id, kind, address_hash, attempted_at_utc)
+				 VALUES (?, ?, ?, ?)`
+			)
+			.run(randomUUID(), kind, addressHash, nowUtc());
+		return true;
+	})();
+}
+
+export function getOAuthClient(clientId: string): OAuthClient | null {
+	if (!clientId || clientId.length > 200) return null;
+	const row = getDatabase()
+		.prepare('SELECT id, name, redirect_uris_json FROM oauth_clients WHERE id = ?')
+		.get(clientId) as OAuthClientRow | undefined;
+	return row ? clientFromRow(row) : null;
+}
+
+export function parseAuthorizationRequest(url: URL): OAuthAuthorizationRequest {
+	const client = getOAuthClient(url.searchParams.get('client_id') ?? '');
+	if (!client) throw new OAuthError('invalid_client', 'Der OAuth-Client ist nicht registriert.');
+	const redirectUri = url.searchParams.get('redirect_uri') ?? '';
+	if (!client.redirectUris.includes(redirectUri)) {
+		throw new OAuthError('invalid_request', 'Die Redirect-URI ist nicht registriert.');
+	}
+	if (url.searchParams.get('response_type') !== 'code') {
+		throw new OAuthError('unsupported_response_type', 'Nur response_type=code wird unterstützt.');
+	}
+	const scope = url.searchParams.get('scope') ?? '';
+	if (scope !== MCP_SCOPE)
+		throw new OAuthError('invalid_scope', 'Der angeforderte Scope ist ungültig.');
+	const resource = url.searchParams.get('resource') ?? '';
+	if (resource !== mcpResource()) {
+		throw new OAuthError('invalid_target', 'Die angeforderte MCP-Ressource ist ungültig.');
+	}
+	const codeChallenge = url.searchParams.get('code_challenge') ?? '';
+	if (
+		url.searchParams.get('code_challenge_method') !== 'S256' ||
+		!/^[A-Za-z0-9_-]{43}$/.test(codeChallenge)
+	) {
+		throw new OAuthError('invalid_request', 'PKCE mit S256 ist erforderlich.');
+	}
+	const state = url.searchParams.get('state') ?? '';
+	if (state.length > 1000) throw new OAuthError('invalid_request', 'Der OAuth-State ist zu lang.');
+	return { client, redirectUri, state, scope: MCP_SCOPE, resource, codeChallenge };
+}
+
+export function authorizationErrorRedirect(url: URL, problem: OAuthError): string | null {
+	const client = getOAuthClient(url.searchParams.get('client_id') ?? '');
+	const redirectUri = url.searchParams.get('redirect_uri') ?? '';
+	if (!client?.redirectUris.includes(redirectUri)) return null;
+	const target = new URL(redirectUri);
+	target.searchParams.set('error', problem.code);
+	target.searchParams.set('error_description', problem.message);
+	const state = url.searchParams.get('state') ?? '';
+	if (state && state.length <= 1000) target.searchParams.set('state', state);
+	target.searchParams.set('iss', oauthIssuer());
+	return target.toString();
+}
+
+export function authorizationRedirect(
+	request: OAuthAuthorizationRequest,
+	values: Record<string, string>
+): string {
+	const target = new URL(request.redirectUri);
+	for (const [key, value] of Object.entries(values)) target.searchParams.set(key, value);
+	if (request.state) target.searchParams.set('state', request.state);
+	target.searchParams.set('iss', oauthIssuer());
+	return target.toString();
+}
+
+export function createAuthorizationCode(
+	request: OAuthAuthorizationRequest,
+	user: AuthUser
+): string {
+	const code = randomToken();
+	const timestamp = nowUtc();
+	const database = getDatabase();
+	const store = database.transaction(() => {
+		database
+			.prepare('DELETE FROM oauth_authorization_codes WHERE expires_at_utc <= ?')
+			.run(timestamp);
+		database
+			.prepare(
+				`INSERT INTO oauth_authorization_codes (
+				 code_hash, client_id, user_id, redirect_uri, scope, resource, code_challenge,
+				 created_at_utc, expires_at_utc
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				tokenHash(code),
+				request.client.id,
+				user.id,
+				request.redirectUri,
+				request.scope,
+				request.resource,
+				request.codeChallenge,
+				timestamp,
+				futureUtc(AUTHORIZATION_CODE_DURATION_MS)
+			);
+	});
+	store();
+	return code;
+}
+
+function pkceChallenge(verifier: string): string {
+	return createHash('sha256').update(verifier).digest('base64url');
+}
+
+export function exchangeAuthorizationCode(input: {
+	code: string;
+	clientId: string;
+	redirectUri: string;
+	codeVerifier: string;
+	resource: string;
+}) {
+	if (!/^[A-Za-z0-9._~-]{43,128}$/.test(input.codeVerifier)) {
+		throw new OAuthError('invalid_grant', 'Der PKCE-Verifier ist ungültig.');
+	}
+	const database = getDatabase();
+	const exchange = database.transaction(() => {
+		const timestamp = nowUtc();
+		const row = database
+			.prepare(
+				`SELECT client_id, user_id, redirect_uri, scope, resource, code_challenge,
+				 expires_at_utc, consumed_at_utc
+				 FROM oauth_authorization_codes WHERE code_hash = ?`
+			)
+			.get(tokenHash(input.code)) as AuthorizationCodeRow | undefined;
+		if (
+			!row ||
+			row.consumed_at_utc ||
+			row.expires_at_utc <= timestamp ||
+			row.client_id !== input.clientId ||
+			row.redirect_uri !== input.redirectUri ||
+			row.resource !== input.resource ||
+			row.code_challenge !== pkceChallenge(input.codeVerifier)
+		) {
+			throw new OAuthError('invalid_grant', 'Der Autorisierungscode ist ungültig oder abgelaufen.');
+		}
+		const user = database
+			.prepare('SELECT 1 FROM users WHERE id = ? AND locked_at_utc IS NULL')
+			.get(row.user_id);
+		if (!user) throw new OAuthError('invalid_grant', 'Das zugehörige Konto ist nicht aktiv.');
+		const token = randomToken();
+		database
+			.prepare('UPDATE oauth_authorization_codes SET consumed_at_utc = ? WHERE code_hash = ?')
+			.run(timestamp, tokenHash(input.code));
+		database
+			.prepare(
+				`INSERT INTO oauth_access_tokens (
+				 token_hash, client_id, user_id, scope, resource, created_at_utc, expires_at_utc,
+				 request_window_started_at_utc
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				tokenHash(token),
+				row.client_id,
+				row.user_id,
+				row.scope,
+				row.resource,
+				timestamp,
+				futureUtc(ACCESS_TOKEN_DURATION_SECONDS * 1000),
+				timestamp
+			);
+		return { accessToken: token, scope: row.scope };
+	});
+	return exchange();
+}
+
+export function authenticateOAuth(request: Request): AuthUser {
+	const authorization = request.headers.get('authorization') ?? '';
+	const token = authorization.startsWith('Bearer ') ? authorization.slice(7).trim() : '';
+	if (!token || token.length > 100)
+		throw new OAuthError('invalid_token', 'OAuth-Token fehlt.', 401);
+	const timestamp = nowUtc();
+	const database = getDatabase();
+	const row = database.transaction(() => {
+		const current = database
+			.prepare(
+				`SELECT u.id, u.email, u.display_name AS displayName, u.role,
+				 u.locked_at_utc AS lockedAtUtc, t.token_hash,
+				 t.request_window_started_at_utc, t.request_count
+				 FROM oauth_access_tokens t JOIN users u ON u.id = t.user_id
+				 WHERE t.token_hash = ? AND t.revoked_at_utc IS NULL AND t.expires_at_utc > ?
+				 AND t.scope = ? AND t.resource = ? AND u.locked_at_utc IS NULL`
+			)
+			.get(tokenHash(token), timestamp, MCP_SCOPE, mcpResource()) as
+			| (AuthUser & {
+					token_hash: string;
+					request_window_started_at_utc: string;
+					request_count: number;
+			  })
+			| undefined;
+		if (!current) {
+			throw new OAuthError('invalid_token', 'OAuth-Token ist ungültig oder abgelaufen.', 401);
+		}
+		const windowExpired =
+			current.request_window_started_at_utc <= new Date(Date.now() - 60 * 60 * 1000).toISOString();
+		if (!windowExpired && current.request_count >= MCP_REQUEST_LIMIT_PER_HOUR) {
+			throw new OAuthError('temporarily_unavailable', 'Zu viele MCP-Anfragen.', 429);
+		}
+		database
+			.prepare(
+				`UPDATE oauth_access_tokens SET last_used_at_utc = ?,
+				 request_window_started_at_utc = ?, request_count = ? WHERE token_hash = ?`
+			)
+			.run(
+				timestamp,
+				windowExpired ? timestamp : current.request_window_started_at_utc,
+				windowExpired ? 1 : current.request_count + 1,
+				current.token_hash
+			);
+		return current;
+	})();
+	return {
+		id: row.id,
+		email: row.email,
+		displayName: row.displayName,
+		role: row.role,
+		lockedAtUtc: row.lockedAtUtc
+	};
+}
+
+export function revokeOAuthToken(token: string, clientId: string): void {
+	if (!token || token.length > 200 || !clientId || clientId.length > 200) return;
+	getDatabase()
+		.prepare(
+			`UPDATE oauth_access_tokens SET revoked_at_utc = ?
+			 WHERE token_hash = ? AND client_id = ? AND revoked_at_utc IS NULL`
+		)
+		.run(nowUtc(), tokenHash(token), clientId);
+}
+
+export function oauthTokenDurationSeconds(): number {
+	return ACCESS_TOKEN_DURATION_SECONDS;
+}

src/lib/server/shares.spec.ts

@@ -13,6 +13,7 @@ import {
 	getSharedMedia,
 	getSharedShow,
 	revokeShare,
+	replaceShareToken,
 	updateShare
 } from './shares.js';
 import { addPieceUsage, addShowSection, createShow } from './shows.js';
@@ -138,8 +139,17 @@ describe('show shares', () => {
 		expect(getSharedShow(shared.token).status).toBe('password');
 		const session = await authenticateShare(shared.token, 'neues-freigabe-passwort', '192.0.2.20');
 		expect(getSharedShow(shared.token, session.token).status).toBe('authorized');
-		deleteShare(actor, shared.id, created.id);
+		const replacementToken = replaceShareToken(actor, shared.id, created.id);
 		expect(getSharedShow(shared.token, session.token).status).toBe('unavailable');
+		expect(getSharedShow(replacementToken).status).toBe('password');
+		const replacementSession = await authenticateShare(
+			replacementToken,
+			'neues-freigabe-passwort',
+			'192.0.2.20'
+		);
+		expect(getSharedShow(replacementToken, replacementSession.token).status).toBe('authorized');
+		deleteShare(actor, shared.id, created.id);
+		expect(getSharedShow(replacementToken, replacementSession.token).status).toBe('unavailable');
 	});
 
 	it('projects exactly the selected information scope', async () => {

src/lib/server/shares.ts

@@ -193,6 +193,27 @@ export async function updateShare(
 	})();
 }
 
+export function replaceShareToken(
+	actor: AuthUser,
+	shareId: string,
+	expectedShowId?: string
+): string {
+	requireBarkeeperActor(actor);
+	const token = createToken();
+	const database = getDatabase();
+	database.transaction(() => {
+		const result = database
+			.prepare(
+				`UPDATE show_shares SET token_hash = ?
+				 WHERE id = ? AND revoked_at_utc IS NULL${expectedShowId ? ' AND show_id = ?' : ''}`
+			)
+			.run(hashToken(token), ...(expectedShowId ? [shareId, expectedShowId] : [shareId]));
+		if (result.changes !== 1) throw new Error('NOT_FOUND');
+		database.prepare('DELETE FROM show_share_sessions WHERE share_id = ?').run(shareId);
+	})();
+	return token;
+}
+
 export function deleteShare(actor: AuthUser, shareId: string, expectedShowId?: string): void {
 	requireBarkeeperActor(actor);
 	const result = getDatabase()

src/lib/server/shows.spec.ts

@@ -13,6 +13,7 @@ import {
 	duplicatePieceUsage,
 	getPieceUsageContexts,
 	getShow,
+	listPreparationUsages,
 	listShowTemplates,
 	movePieceUsage,
 	moveShowSection,
@@ -60,12 +61,57 @@ function editedUsage(usage: PieceUsage, overrides: Partial<PieceUsage> = {}) {
 		presentationImageUrl: edited.presentationImageUrl,
 		presentationSiteName: edited.presentationSiteName,
 		presentationMediaId: edited.presentationMediaId,
+		preparationStatus: edited.preparationStatus,
+		preparationEffort: edited.preparationEffort,
 		ownNotes: edited.ownNotes,
 		durationSeconds: edited.durationSeconds
 	};
 }
 
 describe('show builder data layer', () => {
+	it('tracks preparation on the concrete usage independently from its original', () => {
+		const database = getDatabase();
+		database
+			.prepare(
+				"UPDATE pieces SET status = 'preparing', preparation_effort = 'high' WHERE id = 'piece-console'"
+			)
+			.run();
+		database.prepare("UPDATE pieces SET status = 'preparing' WHERE id = 'piece-sounds'").run();
+		const show = getShow('show-october')!;
+		const planned = addPieceUsage(show.id, show.revision, {
+			pieceId: 'piece-console',
+			sectionId: show.sections[0].id
+		});
+
+		database
+			.prepare(
+				"UPDATE pieces SET status = 'ready', preparation_effort = 'low' WHERE id = 'piece-console'"
+			)
+			.run();
+		const usages = listPreparationUsages();
+		expect(usages.map((usage) => usage.usageId)).toEqual([planned.id]);
+		expect(usages[0]).toMatchObject({
+			showId: 'show-october',
+			showTitle: 'Herbstsendung: Kleine Welten',
+			sectionName: show.sections[0].name,
+			title: 'Die kleine Konsole mit dem großen Dreh',
+			preparationEffort: 'high',
+			topics: [{ name: 'Gaming' }]
+		});
+		expect(usages.some((usage) => usage.title === 'Drei Sounds, ein Spiel')).toBe(false);
+
+		const plannedUsage = getShow(show.id)!.sections[0].usages.find(
+			(usage) => usage.id === planned.id
+		)!;
+		updatePieceUsage(
+			show.id,
+			planned.id,
+			planned.revision,
+			editedUsage(plannedUsage, { preparationStatus: 'ready' })
+		);
+		expect(listPreparationUsages()).toEqual([]);
+	});
+
 	it('creates a fundus original and usage atomically and idempotently', () => {
 		const created = createShow({ title: 'Direkte Planung', startsAtUtc: null, templateId: null });
 		const section = addShowSection(created.id, created.revision, {

src/lib/server/shows.ts

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import type Database from 'better-sqlite3';
 import { createPiece } from './content.js';
 import { getDatabase } from './database.js';
-import { detectVideoProvider, type PresentationMode } from './presentation.js';
+import { detectVideoProvider, type PresentationMode, type VideoProvider } from './presentation.js';
 
 export const SHOW_STATUSES = ['draft', 'ready', 'live', 'completed'] as const;
 export const USAGE_STATUSES = ['open', 'current', 'done', 'skipped'] as const;
@@ -10,6 +10,8 @@ export const USAGE_STATUSES = ['open', 'current', 'done', 'skipped'] as const;
 export type ShowStatus = (typeof SHOW_STATUSES)[number];
 export type EditableShowStatus = Exclude<ShowStatus, 'completed'>;
 export type UsageStatus = (typeof USAGE_STATUSES)[number];
+export type UsagePreparationStatus = 'preparing' | 'ready';
+export type PreparationEffort = 'low' | 'medium' | 'high' | null;
 
 export type ShowListItem = {
 	id: string;
@@ -21,6 +23,17 @@ export type ShowListItem = {
 	sectionCount: number;
 };
 
+export type PreparationUsage = {
+	usageId: string;
+	showId: string;
+	showTitle: string;
+	showStartsAtUtc: string | null;
+	sectionName: string;
+	title: string;
+	preparationEffort: PreparationEffort;
+	topics: UsageTopic[];
+};
+
 export type ShowTemplateSection = {
 	id: string;
 	name: string;
@@ -42,6 +55,8 @@ export type PieceUsage = {
 	originalPieceId: string | null;
 	position: number;
 	status: UsageStatus;
+	preparationStatus: UsagePreparationStatus;
+	preparationEffort: PreparationEffort;
 	durationSeconds: number;
 	title: string;
 	outputTitle: string;
@@ -59,7 +74,7 @@ export type PieceUsage = {
 	presentationDescription: string;
 	presentationImageUrl: string;
 	presentationSiteName: string;
-	presentationProvider: string;
+	presentationProvider: VideoProvider | '';
 	presentationProviderId: string;
 	ownNotes: string;
 	sources: { id: string; label: string; url: string; timecodeSeconds: number | null }[];
@@ -175,6 +190,8 @@ export type PieceUsageUpdate = {
 	presentationSiteName: string;
 	ownNotes: string;
 	durationSeconds: number;
+	preparationStatus?: UsagePreparationStatus;
+	preparationEffort?: PreparationEffort;
 	tools?: { id: string; workUrl: string; note: string }[];
 	presentationMediaId?: string | null;
 };
@@ -220,6 +237,8 @@ type UsageRow = {
 	original_piece_id: string | null;
 	position: number;
 	status: UsageStatus;
+	preparation_status_snapshot: UsagePreparationStatus;
+	preparation_effort_snapshot: PreparationEffort;
 	duration_seconds: number;
 	title_snapshot: string;
 	output_title_snapshot: string;
@@ -238,7 +257,7 @@ type UsageRow = {
 	presentation_description_snapshot: string;
 	presentation_image_url_snapshot: string;
 	presentation_site_name_snapshot: string;
-	presentation_provider_snapshot: string;
+	presentation_provider_snapshot: VideoProvider | '';
 	presentation_provider_id_snapshot: string;
 	own_notes: string;
 };
@@ -459,6 +478,8 @@ function usageFromRow(database: Database.Database, row: UsageRow): PieceUsage {
 		originalPieceId: row.original_piece_id,
 		position: row.position,
 		status: row.status,
+		preparationStatus: row.preparation_status_snapshot,
+		preparationEffort: row.preparation_effort_snapshot,
 		durationSeconds: row.duration_seconds,
 		title: row.title_snapshot,
 		outputTitle: row.output_title_snapshot,
@@ -769,6 +790,50 @@ export function listShows(statuses?: ShowStatus[]): ShowListItem[] {
 	}));
 }
 
+export function listPreparationUsages(): PreparationUsage[] {
+	const database = getDatabase();
+	const rows = database
+		.prepare(
+			`SELECT u.id AS usage_id, sh.id AS show_id, sh.title AS show_title,
+			 sh.starts_at_utc AS show_starts_at_utc, s.name AS section_name,
+			 u.title_snapshot, u.preparation_effort_snapshot
+			 FROM piece_usages u
+			 JOIN show_sections s ON s.id = u.show_section_id
+			 JOIN shows sh ON sh.id = s.show_id
+			 WHERE sh.status IN ('draft', 'ready', 'live')
+			 AND s.is_reserve_bank = 0 AND u.preparation_status_snapshot = 'preparing'
+			 ORDER BY sh.starts_at_utc IS NULL, sh.starts_at_utc,
+			 CASE u.preparation_effort_snapshot
+			  WHEN 'high' THEN 0 WHEN 'medium' THEN 1 WHEN 'low' THEN 2 ELSE 3 END,
+			 s.position, u.position`
+		)
+		.all() as {
+		usage_id: string;
+		show_id: string;
+		show_title: string;
+		show_starts_at_utc: string | null;
+		section_name: string;
+		title_snapshot: string;
+		preparation_effort_snapshot: PreparationUsage['preparationEffort'];
+	}[];
+	const topics = database.prepare(
+		'SELECT name, icon_name FROM usage_topic_snapshots WHERE usage_id = ? ORDER BY position'
+	);
+	return rows.map((row) => ({
+		usageId: row.usage_id,
+		showId: row.show_id,
+		showTitle: row.show_title,
+		showStartsAtUtc: row.show_starts_at_utc,
+		sectionName: row.section_name,
+		title: row.title_snapshot,
+		preparationEffort: row.preparation_effort_snapshot,
+		topics: (topics.all(row.usage_id) as { name: string; icon_name: string }[]).map((topic) => ({
+			name: topic.name,
+			iconName: topic.icon_name
+		}))
+	}));
+}
+
 export function listShowTemplates(): ShowTemplate[] {
 	const database = getDatabase();
 	const templates = database
@@ -821,6 +886,7 @@ export function getShow(id: string): Show | null {
 	const usageRows = database
 		.prepare(
 			`SELECT u.id, u.show_section_id, u.original_piece_id, u.position, u.status,
+			 u.preparation_status_snapshot, u.preparation_effort_snapshot,
 			 u.duration_seconds, u.title_snapshot, u.output_title_snapshot, u.intro_snapshot, u.research_snapshot,
 			 u.moderation_snapshot, u.interaction_snapshot, u.transition_snapshot, u.presentation_snapshot,
 			 CASE WHEN u.presentation_image_only_snapshot = 1 THEN 'image' ELSE u.presentation_mode_snapshot END AS presentation_mode_snapshot,
@@ -1083,8 +1149,9 @@ export function duplicateCompletedShow(
 			 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 			 presentation_title_meta_snapshot, presentation_description_snapshot,
 			 presentation_image_url_snapshot, presentation_site_name_snapshot,
-			 presentation_provider_snapshot, presentation_provider_id_snapshot, presentation_image_only_snapshot, own_notes, is_reserve)
+			 presentation_provider_snapshot, presentation_provider_id_snapshot, presentation_image_only_snapshot,
-			 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			 preparation_status_snapshot, preparation_effort_snapshot, own_notes, is_reserve)
+			 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 		);
 		for (const section of sections) {
 			const sectionId = randomUUID();
@@ -1127,6 +1194,8 @@ export function duplicateCompletedShow(
 					usage.presentation_provider_snapshot,
 					usage.presentation_provider_id_snapshot,
 					usage.presentation_image_only_snapshot,
+					usage.preparation_status_snapshot,
+					usage.preparation_effort_snapshot,
 					usage.own_notes,
 					usage.is_reserve
 				);
@@ -1306,7 +1375,8 @@ export function addPieceUsage(
 				 COALESCE(ps.url, '') AS presentation_source_url,
 				 ps.timecode_seconds AS presentation_source_timecode,
 				 p.presentation_title, p.presentation_description, p.presentation_image_url,
-				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id
+				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id,
+				 p.preparation_effort
 				 FROM pieces p LEFT JOIN piece_sources ps ON ps.piece_id = p.id
 				 AND ps.position = p.presentation_source_position WHERE p.id = ?`
 			)
@@ -1332,6 +1402,7 @@ export function addPieceUsage(
 					presentation_provider: string;
 					presentation_provider_id: string;
 					status: string;
+					preparation_effort: PreparationEffort;
 			  }
 			| undefined;
 		if (!piece) throw new Error('NOT_FOUND');
@@ -1342,7 +1413,7 @@ export function addPieceUsage(
 		) {
 			throw new Error('NOT_FOUND');
 		}
-		if (piece.status !== 'ready') throw new Error('PIECE_NOT_READY');
+		if (!['preparing', 'ready'].includes(piece.status)) throw new Error('PIECE_NOT_READY');
 		const ids = (
 			database
 				.prepare('SELECT id FROM piece_usages WHERE show_section_id = ? ORDER BY position')
@@ -1359,8 +1430,9 @@ export function addPieceUsage(
 				 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 				 presentation_title_meta_snapshot, presentation_description_snapshot,
 				 presentation_image_url_snapshot, presentation_site_name_snapshot,
-				 presentation_provider_snapshot, presentation_provider_id_snapshot, own_notes, is_reserve)
+				 presentation_provider_snapshot, presentation_provider_id_snapshot,
-				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', ?)`
+				 preparation_status_snapshot, preparation_effort_snapshot, own_notes, is_reserve)
+				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', ?)`
 			)
 			.run(
 				id,
@@ -1387,6 +1459,8 @@ export function addPieceUsage(
 				piece.presentation_site_name,
 				piece.presentation_provider,
 				piece.presentation_provider_id,
+				piece.status,
+				piece.preparation_effort,
 				input.sectionId === null ? 1 : 0
 			);
 		snapshotPieceRelations(database, id, input.pieceId);
@@ -1468,6 +1542,7 @@ export function duplicatePieceUsage(
 				 presentation_title_meta_snapshot, presentation_description_snapshot,
 				 presentation_image_url_snapshot, presentation_site_name_snapshot,
 				 presentation_provider_snapshot, presentation_provider_id_snapshot,
+				 preparation_status_snapshot, preparation_effort_snapshot,
 				 own_notes, is_reserve FROM piece_usages WHERE id = ?`
 			)
 			.get(usageId) as Omit<UsageRow, 'id' | 'show_section_id' | 'position'> & {
@@ -1490,8 +1565,9 @@ export function duplicatePieceUsage(
 				 presentation_source_url_snapshot, presentation_source_timecode_snapshot,
 				 presentation_title_meta_snapshot, presentation_description_snapshot,
 				 presentation_image_url_snapshot, presentation_site_name_snapshot,
-				 presentation_provider_snapshot, presentation_provider_id_snapshot, own_notes, is_reserve)
+				 presentation_provider_snapshot, presentation_provider_id_snapshot,
-				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+				 preparation_status_snapshot, preparation_effort_snapshot, own_notes, is_reserve)
+				 VALUES (?, ?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 			)
 			.run(
 				id,
@@ -1518,6 +1594,8 @@ export function duplicatePieceUsage(
 				source.presentation_site_name_snapshot,
 				source.presentation_provider_snapshot,
 				source.presentation_provider_id_snapshot,
+				source.preparation_status_snapshot,
+				source.preparation_effort_snapshot,
 				source.own_notes,
 				source.is_reserve
 			);
@@ -1546,7 +1624,8 @@ export function refreshPieceUsageFromOriginal(
 				 COALESCE(ps.url, '') AS presentation_source_url,
 				 ps.timecode_seconds AS presentation_source_timecode,
 				 p.presentation_title, p.presentation_description, p.presentation_image_url,
-				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id
+				 p.presentation_site_name, p.presentation_provider, p.presentation_provider_id,
+				 p.status, p.preparation_effort
 				 FROM piece_usages u JOIN pieces p ON p.id = u.original_piece_id
 				 LEFT JOIN piece_sources ps ON ps.piece_id = p.id
 				 AND ps.position = p.presentation_source_position
@@ -1573,9 +1652,12 @@ export function refreshPieceUsageFromOriginal(
 					presentation_site_name: string;
 					presentation_provider: string;
 					presentation_provider_id: string;
+					status: string;
+					preparation_effort: PreparationEffort;
 			  }
 			| undefined;
 		if (!source) throw new Error('ORIGINAL_NOT_FOUND');
+		if (!['preparing', 'ready'].includes(source.status)) throw new Error('PIECE_NOT_READY');
 		database
 			.prepare(
 				`UPDATE piece_usages SET title_snapshot = ?, output_title_snapshot = ?, duration_seconds = ?, intro_snapshot = ?,
@@ -1585,7 +1667,8 @@ export function refreshPieceUsageFromOriginal(
 				 presentation_source_timecode_snapshot = ?, presentation_title_meta_snapshot = ?,
 				 presentation_description_snapshot = ?, presentation_image_url_snapshot = ?,
 				 presentation_site_name_snapshot = ?, presentation_provider_snapshot = ?,
-				 presentation_provider_id_snapshot = ? WHERE id = ?`
+				 presentation_provider_id_snapshot = ?, preparation_status_snapshot = ?,
+				 preparation_effort_snapshot = ? WHERE id = ?`
 			)
 			.run(
 				source.title,
@@ -1608,6 +1691,8 @@ export function refreshPieceUsageFromOriginal(
 				source.presentation_site_name,
 				source.presentation_provider,
 				source.presentation_provider_id,
+				source.status,
+				source.preparation_effort,
 				usageId
 			);
 		snapshotPieceRelations(
@@ -1632,6 +1717,18 @@ export function updatePieceUsage(
 	const title = cleanText(input.title, 200, 'title', true);
 	const outputTitle = cleanText(input.outputTitle, 300, 'output_title');
 	const duration = validDuration(input.durationSeconds)!;
+	if (
+		input.preparationStatus !== undefined &&
+		!['preparing', 'ready'].includes(input.preparationStatus)
+	) {
+		throw new Error('INVALID_PREPARATION_STATUS');
+	}
+	if (
+		input.preparationEffort !== undefined &&
+		![null, 'low', 'medium', 'high'].includes(input.preparationEffort)
+	) {
+		throw new Error('INVALID_PREPARATION_EFFORT');
+	}
 	const values = {
 		intro: cleanText(input.intro, 50_000, 'intro'),
 		research: cleanText(input.research, 50_000, 'research'),
@@ -1642,7 +1739,7 @@ export function updatePieceUsage(
 		presentation: cleanText(input.presentation, 50_000, 'presentation'),
 		ownNotes: cleanText(input.ownNotes, 50_000, 'notes')
 	};
-	const presentation = validPresentation(
+	const submittedPresentation = validPresentation(
 		input.presentationMode,
 		input.presentationSourceLabel,
 		input.presentationSourceUrl,
@@ -1656,6 +1753,57 @@ export function updatePieceUsage(
 	return database.transaction(() => {
 		const result = bumpShow(database, showId, expectedRevision);
 		usageSection(database, showId, usageId);
+		const currentPreparation = database
+			.prepare(
+				`SELECT preparation_status_snapshot, preparation_effort_snapshot
+				 FROM piece_usages WHERE id = ?`
+			)
+			.get(usageId) as {
+			preparation_status_snapshot: UsagePreparationStatus;
+			preparation_effort_snapshot: PreparationEffort;
+		};
+		let presentation = submittedPresentation;
+		if (presentation.mode === 'link' || presentation.mode === 'video') {
+			const source = database
+				.prepare(
+					`SELECT label, url, timecode_seconds FROM usage_source_snapshots
+					 WHERE usage_id = ? AND url = ?`
+				)
+				.get(usageId, presentation.sourceUrl) as
+				{ label: string; url: string; timecode_seconds: number | null } | undefined;
+			if (!source) throw new Error('INVALID_PRESENTATION');
+			presentation = validPresentation(
+				presentation.mode,
+				source.label,
+				source.url,
+				source.timecode_seconds,
+				presentation.title,
+				presentation.description,
+				presentation.imageUrl,
+				presentation.siteName
+			);
+		}
+		const selectedMediaId =
+			input.presentationMediaId === undefined
+				? ((
+						database
+							.prepare(
+								'SELECT id FROM usage_media_snapshots WHERE usage_id = ? AND is_presentation = 1'
+							)
+							.get(usageId) as { id: string } | undefined
+					)?.id ?? null)
+				: input.presentationMediaId;
+		if (
+			selectedMediaId !== null &&
+			!database
+				.prepare('SELECT 1 FROM usage_media_snapshots WHERE id = ? AND usage_id = ?')
+				.get(selectedMediaId, usageId)
+		) {
+			throw new Error('INVALID_PRESENTATION_MEDIA');
+		}
+		if (presentation.mode === 'image' && !selectedMediaId) {
+			throw new Error('INVALID_PRESENTATION_MEDIA');
+		}
 		database
 			.prepare(
 				`UPDATE piece_usages SET title_snapshot = ?, output_title_snapshot = ?, intro_snapshot = ?, research_snapshot = ?,
@@ -1665,7 +1813,8 @@ export function updatePieceUsage(
 				 presentation_title_meta_snapshot = ?, presentation_description_snapshot = ?,
 				 presentation_image_url_snapshot = ?, presentation_site_name_snapshot = ?,
 				 presentation_provider_snapshot = ?, presentation_provider_id_snapshot = ?,
-				 own_notes = ?, duration_seconds = ? WHERE id = ?`
+				 own_notes = ?, duration_seconds = ?, preparation_status_snapshot = ?,
+				 preparation_effort_snapshot = ? WHERE id = ?`
 			)
 			.run(
 				title,
@@ -1689,6 +1838,10 @@ export function updatePieceUsage(
 				presentation.providerId,
 				values.ownNotes,
 				duration,
+				input.preparationStatus ?? currentPreparation.preparation_status_snapshot,
+				input.preparationEffort === undefined
+					? currentPreparation.preparation_effort_snapshot
+					: input.preparationEffort,
 				usageId
 			);
 		if (input.tools) {
@@ -1721,23 +1874,15 @@ export function updatePieceUsage(
 			}
 		}
 		if (input.presentationMediaId !== undefined) {
-			if (
-				input.presentationMediaId !== null &&
-				!database
-					.prepare('SELECT 1 FROM usage_media_snapshots WHERE id = ? AND usage_id = ?')
-					.get(input.presentationMediaId, usageId)
-			) {
-				throw new Error('INVALID_PRESENTATION_MEDIA');
-			}
 			database
 				.prepare('UPDATE usage_media_snapshots SET is_presentation = 0 WHERE usage_id = ?')
 				.run(usageId);
-			if (input.presentationMediaId !== null) {
+			if (selectedMediaId !== null) {
 				database
 					.prepare(
 						'UPDATE usage_media_snapshots SET is_presentation = 1 WHERE id = ? AND usage_id = ?'
 					)
-					.run(input.presentationMediaId, usageId);
+					.run(selectedMediaId, usageId);
 			}
 		}
 		return result;

src/lib/server/technical-access.spec.ts

@@ -0,0 +1,103 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import type { AuthUser } from './auth.js';
+import { closeDatabase, getDatabase } from './database.js';
+import {
+	authenticateTechnical,
+	createTechnicalAccess,
+	idempotentResponse,
+	revokeTechnicalAccess,
+	updateTechnicalAccess
+} from './technical-access.js';
+
+let directory: string;
+let actor: AuthUser;
+
+beforeEach(() => {
+	directory = mkdtempSync(path.join(tmpdir(), 'sendewerk-api-test-'));
+	process.env.SENDEWERK_DB_PATH = path.join(directory, 'test.sqlite');
+	process.env.SENDEWERK_UPLOAD_DIR = path.join(directory, 'uploads');
+	execFileSync(process.execPath, ['scripts/migrate.mjs'], { cwd: process.cwd(), env: process.env });
+	execFileSync(process.execPath, ['scripts/seed.mjs'], { cwd: process.cwd(), env: process.env });
+	const now = new Date().toISOString();
+	getDatabase()
+		.prepare(
+			`INSERT INTO users (id, email, email_normalized, display_name, password_hash, role,
+		password_changed_at_utc, created_at_utc, updated_at_utc) VALUES ('test-user', 'test@example.org',
+		'test@example.org', 'Test', 'not-used', 'barkeeper', ?, ?, ?)`
+		)
+		.run(now, now, now);
+	actor = {
+		id: 'test-user',
+		email: 'test@example.org',
+		displayName: 'Test',
+		role: 'barkeeper',
+		lockedAtUtc: null
+	};
+});
+
+afterEach(() => {
+	closeDatabase();
+	delete process.env.SENDEWERK_DB_PATH;
+	delete process.env.SENDEWERK_UPLOAD_DIR;
+	rmSync(directory, { recursive: true, force: true });
+});
+
+function request(token: string, key?: string) {
+	return new Request('https://sendewerk.test/api/v1/pieces', {
+		headers: { Authorization: `Bearer ${token}`, ...(key ? { 'Idempotency-Key': key } : {}) }
+	});
+}
+
+describe('technical API access', () => {
+	it('enforces permissions and revocation without storing the raw token', () => {
+		const created = createTechnicalAccess(actor, 'Leser', 'read');
+		expect(authenticateTechnical(request(created.token))).toMatchObject({
+			name: 'Leser',
+			permissions: 'read'
+		});
+		expect(() => authenticateTechnical(request(created.token), true)).toThrow('API_FORBIDDEN');
+		expect(
+			getDatabase()
+				.prepare('SELECT token_hash FROM technical_accesses WHERE id = ?')
+				.get(created.id)
+		).not.toMatchObject({ token_hash: created.token });
+		updateTechnicalAccess(actor, created.id, 'Leser bearbeitet', 'read_write');
+		expect(authenticateTechnical(request(created.token), true)).toMatchObject({
+			name: 'Leser bearbeitet',
+			permissions: 'read_write'
+		});
+		revokeTechnicalAccess(actor, created.id);
+		expect(() => authenticateTechnical(request(created.token))).toThrow('API_UNAUTHORIZED');
+	});
+
+	it('replays an identical idempotent write and rejects a changed payload', () => {
+		const created = createTechnicalAccess(actor, 'Schreiber', 'read_write');
+		const technical = authenticateTechnical(request(created.token), true);
+		let calls = 0;
+		const first = idempotentResponse(
+			technical,
+			request(created.token, 'command-1'),
+			{ title: 'A' },
+			() => ({ status: 201, body: { calls: ++calls } })
+		);
+		const replay = idempotentResponse(
+			technical,
+			request(created.token, 'command-1'),
+			{ title: 'A' },
+			() => ({ status: 201, body: { calls: ++calls } })
+		);
+		expect(first.duplicate).toBe(false);
+		expect(replay).toMatchObject({ duplicate: true, body: { calls: 1 } });
+		expect(calls).toBe(1);
+		expect(() =>
+			idempotentResponse(technical, request(created.token, 'command-1'), { title: 'B' }, () => ({
+				status: 201,
+				body: {}
+			}))
+		).toThrow('API_IDEMPOTENCY_CONFLICT');
+	});
+});

src/lib/server/technical-access.ts

@@ -0,0 +1,176 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import type { AuthUser } from './auth.js';
+import { getDatabase } from './database.js';
+
+export type TechnicalPermission = 'read' | 'read_write';
+export type TechnicalActor = { id: string; name: string; permissions: TechnicalPermission };
+
+function tokenHash(token: string) {
+	return createHash('sha256').update(token).digest('hex');
+}
+
+export function listTechnicalAccesses() {
+	return getDatabase()
+		.prepare(
+			`SELECT id, name, permissions, created_at_utc AS createdAtUtc,
+		last_used_at_utc AS lastUsedAtUtc, revoked_at_utc AS revokedAtUtc FROM technical_accesses ORDER BY name`
+		)
+		.all() as {
+		id: string;
+		name: string;
+		permissions: TechnicalPermission;
+		createdAtUtc: string;
+		lastUsedAtUtc: string | null;
+		revokedAtUtc: string | null;
+	}[];
+}
+
+export function createTechnicalAccess(actor: AuthUser, nameValue: string, permissions: string) {
+	const name = nameValue.trim();
+	if (!name || name.length > 120 || !['read', 'read_write'].includes(permissions))
+		throw new Error('INVALID_ACCESS');
+	const token = randomBytes(32).toString('base64url');
+	const id = randomUUID();
+	const now = new Date().toISOString();
+	getDatabase()
+		.prepare(
+			`INSERT INTO technical_accesses
+		(id, name, token_hash, permissions, created_by_user_id, created_at_utc) VALUES (?, ?, ?, ?, ?, ?)`
+		)
+		.run(id, name, tokenHash(token), permissions, actor.id, now);
+	auditTechnical(
+		{ id: actor.id, name: actor.displayName, permissions: 'read_write' },
+		'technical_access.create',
+		'technical_access',
+		id,
+		'user'
+	);
+	return { id, token };
+}
+
+export function updateTechnicalAccess(
+	actor: AuthUser,
+	id: string,
+	nameValue: string,
+	permissions: string
+) {
+	const name = nameValue.trim();
+	if (!name || name.length > 120 || !['read', 'read_write'].includes(permissions))
+		throw new Error('INVALID_ACCESS');
+	const result = getDatabase()
+		.prepare(
+			`UPDATE technical_accesses SET name = ?, permissions = ?
+			 WHERE id = ? AND revoked_at_utc IS NULL`
+		)
+		.run(name, permissions, id);
+	if (!result.changes) throw new Error('NOT_FOUND');
+	auditTechnical(
+		{ id: actor.id, name: actor.displayName, permissions: 'read_write' },
+		'technical_access.update',
+		'technical_access',
+		id,
+		'user'
+	);
+}
+
+export function revokeTechnicalAccess(actor: AuthUser, id: string) {
+	const result = getDatabase()
+		.prepare(
+			'UPDATE technical_accesses SET revoked_at_utc = ? WHERE id = ? AND revoked_at_utc IS NULL'
+		)
+		.run(new Date().toISOString(), id);
+	if (!result.changes) throw new Error('NOT_FOUND');
+	auditTechnical(
+		{ id: actor.id, name: actor.displayName, permissions: 'read_write' },
+		'technical_access.revoke',
+		'technical_access',
+		id,
+		'user'
+	);
+}
+
+export function authenticateTechnical(request: Request, write = false): TechnicalActor {
+	const authorization = request.headers.get('authorization') ?? '';
+	const token = authorization.startsWith('Bearer ') ? authorization.slice(7).trim() : '';
+	if (!token) throw new Error('API_UNAUTHORIZED');
+	const row = getDatabase()
+		.prepare(
+			`SELECT id, name, permissions FROM technical_accesses
+		WHERE token_hash = ? AND revoked_at_utc IS NULL`
+		)
+		.get(tokenHash(token)) as TechnicalActor | undefined;
+	if (!row) throw new Error('API_UNAUTHORIZED');
+	if (write && row.permissions !== 'read_write') throw new Error('API_FORBIDDEN');
+	getDatabase()
+		.prepare('UPDATE technical_accesses SET last_used_at_utc = ? WHERE id = ?')
+		.run(new Date().toISOString(), row.id);
+	return row;
+}
+
+export function auditTechnical(
+	actor: TechnicalActor,
+	action: string,
+	targetType: string,
+	targetId: string,
+	actorType: 'technical' | 'user' = 'technical'
+) {
+	getDatabase()
+		.prepare(
+			`INSERT INTO audit_events (id, actor_type, actor_id, action, target_type, target_id, created_at_utc)
+		VALUES (?, ?, ?, ?, ?, ?, ?)`
+		)
+		.run(
+			randomUUID(),
+			actorType,
+			actor.id,
+			action.slice(0, 120),
+			targetType.slice(0, 80),
+			targetId.slice(0, 200),
+			new Date().toISOString()
+		);
+}
+
+export function idempotentResponse(
+	actor: TechnicalActor,
+	request: Request,
+	body: unknown,
+	operation: () => { status: number; body: unknown }
+) {
+	const key = request.headers.get('idempotency-key')?.trim() ?? '';
+	if (!key || key.length > 200) throw new Error('API_IDEMPOTENCY_REQUIRED');
+	const hash = createHash('sha256')
+		.update(`${request.method} ${new URL(request.url).pathname}\n${JSON.stringify(body)}`)
+		.digest('hex');
+	const database = getDatabase();
+	return database.transaction(() => {
+		const existing = database
+			.prepare(
+				'SELECT request_hash, status_code, response_json FROM api_idempotency WHERE access_id = ? AND request_key = ?'
+			)
+			.get(actor.id, key) as
+			{ request_hash: string; status_code: number; response_json: string } | undefined;
+		if (existing) {
+			if (existing.request_hash !== hash) throw new Error('API_IDEMPOTENCY_CONFLICT');
+			return {
+				status: existing.status_code,
+				body: JSON.parse(existing.response_json),
+				duplicate: true
+			};
+		}
+		const result = operation();
+		database
+			.prepare(
+				`INSERT INTO api_idempotency
+			(access_id, request_key, request_hash, status_code, response_json, created_at_utc) VALUES (?, ?, ?, ?, ?, ?)`
+			)
+			.run(
+				actor.id,
+				key,
+				hash,
+				result.status,
+				JSON.stringify(result.body),
+				new Date().toISOString()
+			);
+		return { ...result, duplicate: false };
+	})();
+}

src/routes/+layout.server.ts

@@ -7,5 +7,6 @@ export const load: LayoutServerLoad = ({ locals, url }) => ({
 			: locals.user,
 	presentationMode: url.pathname.startsWith('/heinzlive/'),
 	guestMode: url.pathname.startsWith('/freigabe/'),
+	oauthMode: url.pathname === '/oauth/authorize',
 	liveControllerMode: url.pathname === '/live'
 });

src/routes/+layout.svelte

@@ -34,7 +34,7 @@
 
 {#if data.presentationMode}
 	{@render children()}
-{:else if data.guestMode}
+{:else if data.guestMode || data.oauthMode}
 	<div class="guest-shell">
 		<header class="auth-header">
 			<span class="brand"

src/routes/.well-known/oauth-authorization-server/+server.ts

@@ -0,0 +1,24 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { MCP_SCOPE, oauthIssuer } from '#lib/server/oauth.js';
+
+export const GET: RequestHandler = () => {
+	const issuer = oauthIssuer();
+	return json(
+		{
+			issuer,
+			authorization_endpoint: `${issuer}/oauth/authorize`,
+			token_endpoint: `${issuer}/oauth/token`,
+			registration_endpoint: `${issuer}/oauth/register`,
+			revocation_endpoint: `${issuer}/oauth/revoke`,
+			response_types_supported: ['code'],
+			grant_types_supported: ['authorization_code'],
+			token_endpoint_auth_methods_supported: ['none'],
+			revocation_endpoint_auth_methods_supported: ['none'],
+			code_challenge_methods_supported: ['S256'],
+			scopes_supported: [MCP_SCOPE],
+			authorization_response_iss_parameter_supported: true
+		},
+		{ headers: { 'Cache-Control': 'public, max-age=3600' } }
+	);
+};

src/routes/.well-known/oauth-protected-resource/+server.ts

@@ -0,0 +1 @@
+export { GET } from './mcp/+server.js';

src/routes/.well-known/oauth-protected-resource/mcp/+server.ts

@@ -0,0 +1,14 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { MCP_SCOPE, mcpResource, oauthIssuer } from '#lib/server/oauth.js';
+
+export const GET: RequestHandler = () =>
+	json(
+		{
+			resource: mcpResource(),
+			authorization_servers: [oauthIssuer()],
+			scopes_supported: [MCP_SCOPE],
+			bearer_methods_supported: ['header']
+		},
+		{ headers: { 'Cache-Control': 'public, max-age=3600' } }
+	);

src/routes/api/v1/openapi.json/+server.ts

@@ -0,0 +1,105 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+
+const id = { name: 'id', in: 'path', required: true, schema: { type: 'string' } };
+const usageId = { name: 'usageId', in: 'path', required: true, schema: { type: 'string' } };
+const idempotency = {
+	name: 'Idempotency-Key',
+	in: 'header',
+	required: true,
+	schema: { type: 'string' }
+};
+const ok = { '200': { description: 'Erfolgreich' } };
+const jsonBody = (schema: Record<string, unknown>) => ({
+	required: true,
+	content: { 'application/json': { schema } }
+});
+
+export const GET: RequestHandler = () =>
+	json({
+		openapi: '3.1.0',
+		info: {
+			title: 'Sendewerk API',
+			version: '1.0.0',
+			description:
+				'Versionierte API für technische Redaktionszugänge. Schreibzugriffe benötigen einen Idempotency-Key.'
+		},
+		servers: [{ url: '/api/v1' }],
+		security: [{ bearerAuth: [] }],
+		components: {
+			securitySchemes: {
+				bearerAuth: { type: 'http', scheme: 'bearer', bearerFormat: 'Sendewerk technical token' }
+			},
+			schemas: {
+				PieceWrite: {
+					type: 'object',
+					properties: {
+						title: { type: 'string' },
+						summary: { type: 'string' },
+						status: { enum: ['inbox', 'preparing', 'ready'] },
+						durationSeconds: { type: 'integer', minimum: 0 }
+					}
+				},
+				ShowWrite: {
+					type: 'object',
+					required: ['title'],
+					properties: {
+						title: { type: 'string' },
+						startsAtUtc: { type: ['string', 'null'], format: 'date-time' },
+						templateId: { type: ['string', 'null'] }
+					}
+				}
+			}
+		},
+		paths: {
+			'/pieces': {
+				get: { summary: 'Pieces lesen', responses: ok },
+				post: {
+					summary: 'Piece anlegen',
+					parameters: [idempotency],
+					requestBody: jsonBody({ $ref: '#/components/schemas/PieceWrite' }),
+					responses: { '201': { description: 'Angelegt' } }
+				}
+			},
+			'/pieces/{id}': {
+				get: { summary: 'Piece lesen', parameters: [id], responses: ok },
+				patch: {
+					summary: 'Piece ändern',
+					parameters: [id],
+					requestBody: jsonBody({
+						allOf: [
+							{ $ref: '#/components/schemas/PieceWrite' },
+							{ type: 'object', required: ['revision'] }
+						]
+					}),
+					responses: ok
+				}
+			},
+			'/shows': {
+				get: { summary: 'Sendungen lesen', responses: ok },
+				post: {
+					summary: 'Sendung anlegen',
+					parameters: [idempotency],
+					requestBody: jsonBody({ $ref: '#/components/schemas/ShowWrite' }),
+					responses: { '201': { description: 'Angelegt' } }
+				}
+			},
+			'/shows/{id}': { get: { summary: 'Sendung lesen', parameters: [id], responses: ok } },
+			'/shows/{id}/usages': {
+				post: {
+					summary: 'Piece einplanen',
+					parameters: [id, idempotency],
+					requestBody: jsonBody({ type: 'object', required: ['revision', 'pieceId'] }),
+					responses: { '201': { description: 'Eingeplant' } }
+				}
+			},
+			'/shows/{id}/usages/{usageId}': {
+				patch: {
+					summary: 'Einplanung sortieren',
+					parameters: [id, usageId, idempotency],
+					requestBody: jsonBody({ type: 'object', required: ['revision', 'position'] }),
+					responses: ok
+				}
+			}
+		}
+	});

src/routes/api/v1/pieces/+server.ts

@@ -0,0 +1,69 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure, pageInput } from '#lib/server/api-http.js';
+import {
+	createPiece,
+	getPiece,
+	listPieces,
+	savePiece,
+	type PieceStatus
+} from '#lib/server/content.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, url }) => {
+	try {
+		authenticateTechnical(request);
+		const { limit, offset } = pageInput(url);
+		const status = url.searchParams.get('status') as PieceStatus | null;
+		const statuses = status ? [status] : (['inbox', 'preparing', 'ready'] as PieceStatus[]);
+		const all = listPieces({ statuses, query: url.searchParams.get('q') ?? '' });
+		return json({
+			data: all.slice(offset, offset + limit),
+			pagination: { limit, offset, total: all.length }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};
+
+export const POST: RequestHandler = async ({ request }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			const id = createPiece('blank');
+			const piece = getPiece(id)!;
+			savePiece(id, piece.revision, {
+				...piece,
+				title: String(body.title ?? ''),
+				summary: String(body.summary ?? ''),
+				status: ['inbox', 'preparing', 'ready'].includes(String(body.status))
+					? (body.status as 'inbox' | 'preparing' | 'ready')
+					: 'preparing',
+				durationSeconds: Number(body.durationSeconds ?? 0),
+				sources: Array.isArray(body.sources)
+					? body.sources.map((source) => ({
+							label: String((source as Record<string, unknown>).label ?? ''),
+							url: String((source as Record<string, unknown>).url ?? ''),
+							timecodeSeconds:
+								(source as Record<string, unknown>).timecodeSeconds == null
+									? null
+									: Number((source as Record<string, unknown>).timecodeSeconds)
+						}))
+					: []
+			});
+			auditTechnical(actor, 'piece.create', 'piece', id);
+			return { status: 201, body: { data: getPiece(id) } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/pieces/[id]/+server.ts

@@ -0,0 +1,44 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure } from '#lib/server/api-http.js';
+import { getPiece, savePiece } from '#lib/server/content.js';
+import { auditTechnical, authenticateTechnical } from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, params }) => {
+	try {
+		authenticateTechnical(request);
+		const piece = getPiece(params.id);
+		if (!piece) throw new Error('NOT_FOUND');
+		return json({ data: piece });
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};
+
+export const PATCH: RequestHandler = async ({ request, params }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const piece = getPiece(params.id);
+		if (!piece) throw new Error('NOT_FOUND');
+		if (piece.status === 'archived') throw new Error('INVALID_STATUS');
+		if (Number(body.revision) !== piece.revision) throw new Error('CONFLICT');
+		const status =
+			body.status !== undefined
+				? (String(body.status) as 'inbox' | 'preparing' | 'ready')
+				: piece.status;
+		savePiece(params.id, piece.revision, {
+			...piece,
+			status,
+			...(body.title !== undefined ? { title: String(body.title) } : {}),
+			...(body.summary !== undefined ? { summary: String(body.summary) } : {}),
+			...(body.durationSeconds !== undefined
+				? { durationSeconds: Number(body.durationSeconds) }
+				: {})
+		});
+		auditTechnical(actor, 'piece.update', 'piece', params.id);
+		return json({ data: getPiece(params.id) });
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/+server.ts

@@ -0,0 +1,45 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure, pageInput } from '#lib/server/api-http.js';
+import { createShow, getShow, listShows } from '#lib/server/shows.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, url }) => {
+	try {
+		authenticateTechnical(request);
+		const { limit, offset } = pageInput(url);
+		const all = listShows();
+		return json({
+			data: all.slice(offset, offset + limit),
+			pagination: { limit, offset, total: all.length }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};
+
+export const POST: RequestHandler = async ({ request }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			const created = createShow({
+				title: String(body.title ?? ''),
+				startsAtUtc: body.startsAtUtc ? String(body.startsAtUtc) : null,
+				templateId: body.templateId ? String(body.templateId) : null
+			});
+			auditTechnical(actor, 'show.create', 'show', created.id);
+			return { status: 201, body: { data: getShow(created.id) } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/[id]/+server.ts

@@ -0,0 +1,16 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiFailure } from '#lib/server/api-http.js';
+import { getShow } from '#lib/server/shows.js';
+import { authenticateTechnical } from '#lib/server/technical-access.js';
+
+export const GET: RequestHandler = ({ request, params }) => {
+	try {
+		authenticateTechnical(request);
+		const show = getShow(params.id);
+		if (!show) throw new Error('NOT_FOUND');
+		return json({ data: show });
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/[id]/usages/+server.ts

@@ -0,0 +1,31 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure } from '#lib/server/api-http.js';
+import { addPieceUsage, getShow } from '#lib/server/shows.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const POST: RequestHandler = async ({ request, params }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			const created = addPieceUsage(params.id, Number(body.revision), {
+				pieceId: String(body.pieceId ?? ''),
+				sectionId: body.sectionId ? String(body.sectionId) : null,
+				position: body.position == null ? undefined : Number(body.position)
+			});
+			auditTechnical(actor, 'usage.create', 'usage', created.id);
+			return { status: 201, body: { data: getShow(params.id), usageId: created.id } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/api/v1/shows/[id]/usages/[usageId]/+server.ts

@@ -0,0 +1,30 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { apiBody, apiFailure } from '#lib/server/api-http.js';
+import { getShow, movePieceUsage } from '#lib/server/shows.js';
+import {
+	auditTechnical,
+	authenticateTechnical,
+	idempotentResponse
+} from '#lib/server/technical-access.js';
+
+export const PATCH: RequestHandler = async ({ request, params }) => {
+	try {
+		const actor = authenticateTechnical(request, true);
+		const body = await apiBody(request);
+		const result = idempotentResponse(actor, request, body, () => {
+			movePieceUsage(params.id, params.usageId, Number(body.revision), {
+				sectionId: body.sectionId ? String(body.sectionId) : null,
+				position: Number(body.position)
+			});
+			auditTechnical(actor, 'usage.move', 'usage', params.usageId);
+			return { status: 200, body: { data: getShow(params.id) } };
+		});
+		return json(result.body, {
+			status: result.status,
+			headers: { 'Idempotency-Replayed': result.duplicate ? 'true' : 'false' }
+		});
+	} catch (cause) {
+		return apiFailure(cause);
+	}
+};

src/routes/eingang/+page.server.ts

@@ -1,11 +1,16 @@
 import { fail } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 import { requireUser } from '#lib/server/auth.js';
-import { captureInbox, listPieces, setPieceDeleted } from '#lib/server/content.js';
+import { captureInbox, getTaxonomy, listPieces, setPieceDeleted } from '#lib/server/content.js';
+import { discardFeedEntries, importFeedEntries, listFeedEntries } from '#lib/server/feeds.js';
 
 export const load: PageServerLoad = ({ locals }) => {
 	requireUser(locals.user);
-	return { pieces: listPieces({ statuses: ['inbox'] }) };
+	return {
+		pieces: listPieces({ statuses: ['inbox'] }),
+		feedEntries: listFeedEntries(),
+		taxonomy: getTaxonomy()
+	};
 };
 
 export const actions = {
@@ -36,5 +41,39 @@ export const actions = {
 		} catch {
 			return fail(409, { error: 'Das Piece wurde inzwischen geändert. Bitte neu laden.' });
 		}
+	},
+	importFeeds: async ({ locals, request }) => {
+		requireUser(locals.user);
+		const data = await request.formData();
+		const entryIds = data.getAll('entryIds').map(String);
+		if (!entryIds.length)
+			return fail(400, {
+				intent: 'feedImport',
+				feedError: 'Mindestens einen Beitrag auswählen.'
+			});
+		try {
+			const pieceIds = importFeedEntries(entryIds, data.getAll('categoryIds').map(String));
+			return {
+				intent: 'feedImport',
+				feedSuccess: `${pieceIds.length} ${pieceIds.length === 1 ? 'Beitrag' : 'Beiträge'} in den Eingang übernommen.`
+			};
+		} catch {
+			return fail(400, {
+				intent: 'feedImport',
+				feedError: 'Die Auswahl konnte nicht übernommen werden.'
+			});
+		}
+	},
+	discardFeeds: async ({ locals, request }) => {
+		requireUser(locals.user);
+		const data = await request.formData();
+		const entryIds = data.getAll('entryIds').map(String);
+		if (!entryIds.length)
+			return fail(400, { intent: 'feedDiscard', feedError: 'Mindestens einen Beitrag auswählen.' });
+		const count = discardFeedEntries(entryIds);
+		return {
+			intent: 'feedDiscard',
+			feedSuccess: `${count} ${count === 1 ? 'Beitrag' : 'Beiträge'} verworfen.`
+		};
 	}
 } satisfies Actions;

src/routes/eingang/+page.svelte

@@ -1,8 +1,10 @@
 <script lang="ts">
 	import { resolve } from '$app/paths';
 	import AppIcon from '#lib/components/AppIcon.svelte';
+	import RssSelectionDialog from '#lib/components/RssSelectionDialog.svelte';
 	import type { PageProps } from './$types';
 	let { data, form }: PageProps = $props();
+	let rssDialog: { showModal: () => void };
 </script>
 
 <svelte:head><title>Eingang | Sendewerk</title></svelte:head>
@@ -43,6 +45,39 @@
 			<button class="primary-button" type="submit">Im Eingang ablegen</button>
 		</form>
 	</section>
+	<section class="quiet-panel rss-inbox-panel">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">RSS-Importeingang</p>
+				<h2>RSS-Beiträge</h2>
+			</div>
+			<span class="catalog-entry-icon"><AppIcon name="rss" /></span>
+		</div>
+		<p class="catalog-note">
+			{data.feedEntries.length}
+			{data.feedEntries.length === 1 ? 'Beitrag ist' : 'Beiträge sind'}
+			verfügbar. Erst deine ausdrückliche Auswahl übernimmt sie in den redaktionellen Eingang.
+		</p>
+		{#if form?.feedError}<div class="form-message error" role="alert">{form.feedError}</div>{/if}
+		{#if form?.feedSuccess}<div class="form-message success" role="status">
+				{form.feedSuccess}
+			</div>{/if}
+		<button
+			class="compact-add-button"
+			type="button"
+			disabled={!data.feedEntries.length}
+			onclick={() => rssDialog.showModal()}
+		>
+			<AppIcon name="list" />
+			{data.feedEntries.length ? 'RSS-Beiträge auswählen' : 'Keine neuen RSS-Beiträge'}
+		</button>
+	</section>
+	<RssSelectionDialog
+		bind:this={rssDialog}
+		entries={data.feedEntries}
+		categories={data.taxonomy.categories}
+		{form}
+	/>
 	{#if data.pieces.length}
 		<section class="inbox-list">
 			<h2>{data.pieces.length} {data.pieces.length === 1 ? 'offener Inhalt' : 'offene Inhalte'}</h2>
@@ -81,3 +116,18 @@
 			<p>Neue Gedanken und Links können oben direkt aufgenommen werden.</p>
 		</section>{/if}
 </div>
+
+<style>
+	.rss-inbox-panel {
+		display: grid;
+		gap: 0.75rem;
+		margin-block: 1.5rem;
+		padding: clamp(0.85rem, 2vw, 1.2rem);
+	}
+	.rss-inbox-panel .panel-heading {
+		margin: 0;
+	}
+	.rss-inbox-panel .catalog-note {
+		margin: 0;
+	}
+</style>

src/routes/fundus/[id]/+page.svelte

@@ -77,14 +77,19 @@
 				: draft.presentationProvider === 'tiktok' && draft.presentationProviderId
 					? `https://www.tiktok.com/player/v1/${draft.presentationProviderId}`
 					: '',
-		images: selectedMedia ? [{ id: selectedMedia.id, altText: selectedMedia.altText }] : []
+		images:
+			selectedMedia && ['text', 'image'].includes(draft.presentationMode)
+				? [{ id: selectedMedia.id, altText: selectedMedia.altText }]
+				: []
 	});
 	let presentationPreviewImage = $derived(
-		selectedMedia
+		selectedMedia && ['text', 'image'].includes(draft.presentationMode)
 			? draft.presentationMode === 'text'
 				? '/media'
 				: `/media/${selectedMedia.id}`
-			: sourcePreviewImage
+			: draft.presentationMode === 'link'
+				? sourcePreviewImage
+				: ''
 	);
 	let pendingHref: string | null = null;
 	let allowNavigation = false;
@@ -116,8 +121,8 @@
 		if (
 			control instanceof HTMLInputElement &&
 			control.name === 'presentationMode' &&
-			control.value !== 'text' &&
+			((['link', 'video'].includes(control.value) && draft.presentationSourcePosition === null) ||
-			draft.presentationSourcePosition === null
+				(control.value === 'image' && !draft.presentationMediaId))
 		) {
 			return;
 		}
@@ -348,10 +353,11 @@
 							/></label
 						>
 						<label
-							>Vorbereitungsaufwand<select name="preparationEffort" bind:value={draft.preparationEffort}
+							>Vorbereitungsaufwand<select
-								><option value={null}>Nicht angegeben</option><option value="low">Gering</option><option
+								name="preparationEffort"
-									value="medium">Mittel</option
+								bind:value={draft.preparationEffort}
-								><option value="high">Hoch</option></select
+								><option value={null}>Nicht angegeben</option><option value="low">Gering</option
+								><option value="medium">Mittel</option><option value="high">Hoch</option></select
 							></label
 						>
 						<label
@@ -533,21 +539,7 @@
 				</div>
 				<div class="piece-presentation-layout">
 					<div class="piece-presentation-controls">
-						<label
+						<p class="field-label">Präsentationsart</p>
-							>Präsentationstitel<input
-								name="outputTitle"
-								maxlength="300"
-								placeholder="Optional, sonst interner Titel"
-								bind:value={draft.outputTitle}
-							/></label
-						>
-						<MarkdownEditorField
-							name="presentationText"
-							label="Öffentlicher Text"
-							placeholder="Text für die Publikumsausgabe"
-							rows={8}
-							bind:value={draft.presentationText}
-						/>
 						<div class="presentation-mode-picker" role="group" aria-label="Darstellung">
 							{#each [['text', 'Text'], ['image', 'Nur Bild'], ['link', 'Linkvorschau'], ['video', 'Video']] as mode (mode[0])}<label
 									><input
@@ -558,9 +550,30 @@
 									/>{mode[1]}</label
 								>{/each}
 						</div>
+						{#if draft.presentationMode === 'text'}
+							<label
+								>Öffentliche Überschrift<input
+									name="outputTitle"
+									maxlength="300"
+									placeholder="Optional, sonst interner Titel"
+									bind:value={draft.outputTitle}
+								/></label
+							>
+							<MarkdownEditorField
+								name="presentationText"
+								label="Öffentlicher Vorspann"
+								placeholder="Text für die Publikumsausgabe"
+								rows={8}
+								bind:value={draft.presentationText}
+							/>
+						{:else}
+							<input type="hidden" name="outputTitle" value={draft.outputTitle} />
+							<input type="hidden" name="presentationText" value={draft.presentationText} />
+						{/if}
+						{#if draft.presentationMode === 'link' || draft.presentationMode === 'video'}
 							<div class="presentation-settings">
 								<label
-								>Quelle<select
+									>{draft.presentationMode === 'video' ? 'Video-URL' : 'Quelle/URL'}<select
 										name="presentationSourcePosition"
 										bind:value={draft.presentationSourcePosition}
 										onchange={presentationSourceChanged}
@@ -571,7 +584,7 @@
 									></label
 								>
 								<label
-								>Kartentitel<input
+									>{draft.presentationMode === 'video' ? 'Videotitel' : 'Kartentitel'}<input
 										name="presentationTitle"
 										maxlength="300"
 										placeholder="Optionaler Anzeigetitel"
@@ -579,16 +592,24 @@
 										oninput={() => (draft.presentationTitleManual = true)}
 									/></label
 								>
+								{#if draft.presentationMode === 'link'}
 									<label
-								>Bild-URL<input
+										>Vorschaubild-URL<input
 											name="presentationImageUrl"
 											type="url"
 											maxlength="2000"
-									placeholder="https://…"
+											placeholder="Wird aus der Linkvorschau geladen"
 											bind:value={draft.presentationImageUrl}
 											oninput={() => (draft.presentationImageManual = true)}
 										/></label
 									>
+								{:else}
+									<input
+										type="hidden"
+										name="presentationImageUrl"
+										value={draft.presentationImageUrl}
+									/>
+								{/if}
 								<label class="wide-field"
 									>Anreißer<textarea
 										name="presentationDescription"
@@ -612,6 +633,20 @@
 									>
 								</div>
 							</div>
+						{:else}
+							<input
+								type="hidden"
+								name="presentationSourcePosition"
+								value={draft.presentationSourcePosition ?? ''}
+							/>
+							<input type="hidden" name="presentationTitle" value={draft.presentationTitle} />
+							<input
+								type="hidden"
+								name="presentationDescription"
+								value={draft.presentationDescription}
+							/>
+							<input type="hidden" name="presentationImageUrl" value={draft.presentationImageUrl} />
+						{/if}
 					</div>
 					<aside class="piece-presentation-preview" aria-label="Präsentationsvorschau">
 						<PresentationDisplay
@@ -638,6 +673,7 @@
 				<input type="hidden" name="presentationSiteName" value={draft.presentationSiteName} />
 				<input type="hidden" name="presentationProvider" value={draft.presentationProvider} />
 				<input type="hidden" name="presentationProviderId" value={draft.presentationProviderId} />
+				<input type="hidden" name="presentationMediaId" value={draft.presentationMediaId ?? ''} />
 				<input
 					type="hidden"
 					name="presentationMetadataFetchedAtUtc"
@@ -646,7 +682,11 @@
 			</section>
 		</form>
 
-		<section class="piece-editor-panel piece-media-panel" hidden={activeSection !== 'presentation'}>
+		<section
+			class="piece-editor-panel piece-media-panel"
+			hidden={activeSection !== 'presentation' ||
+				!['text', 'image'].includes(draft.presentationMode)}
+		>
 			<div class="piece-subsection-heading">
 				<div>
 					<p class="eyebrow">Hochgeladene Bilder</p>
@@ -654,12 +694,10 @@
 				</div>
 				<small>JPEG, PNG, WebP oder GIF bis 5 MB</small>
 			</div>
-			{#if data.piece.media.length}<label class="media-none"
+			{#if draft.media.length && draft.presentationMode === 'text'}<label class="media-none"
 					><input
-						form="piece-editor-form"
 						type="radio"
-						name="presentationMediaId"
+						name="presentationMediaChoice"
-						value=""
 						checked={!draft.presentationMediaId}
 						onchange={() => {
 							draft.presentationMediaId = null;
@@ -668,13 +706,11 @@
 					/> Kein hochgeladenes Bild</label
 				>
 				<div class="media-grid">
-					{#each data.piece.media as media (media.id)}<figure>
+					{#each draft.media as media (media.id)}<figure>
 							<label class="media-presentation-choice"
 								><input
-									form="piece-editor-form"
 									type="radio"
-									name="presentationMediaId"
+									name="presentationMediaChoice"
-									value={media.id}
 									checked={draft.presentationMediaId === media.id}
 									onchange={() => {
 										draft.presentationMediaId = media.id;

src/routes/fundus/[id]/praesentation/+page.svelte

@@ -14,10 +14,12 @@
 	<div class="presentation-test-status" role="status">Isolierte Testansicht</div>
 	<PresentationDisplay
 		content={data.content}
-		imageSrc={data.content.images.length
+		imageSrc={data.content.mode === 'text' && data.content.images.length
-			? data.content.mode === 'text'
 			? '/media'
-				: `/media/${data.content.images[0].id}`
+			: data.content.mode === 'image' && data.content.images.length
-			: `/fundus/${data.pieceId}/praesentation/preview-image`}
+				? `/media/${data.content.images[0].id}`
+				: data.content.mode === 'link' && data.content.imageUrl
+					? `/fundus/${data.pieceId}/praesentation/preview-image`
+					: ''}
 	/>
 </main>

src/routes/fundus/[id]/praesentation/preview-image/+server.ts

@@ -7,7 +7,9 @@ import { fetchPresentationImage } from '#lib/server/presentation.js';
 export const GET: RequestHandler = async ({ locals, params }) => {
 	requireUser(locals.user);
 	const piece = getPiece(params.id);
-	if (!piece?.presentationImageUrl) error(404, 'Vorschaubild nicht verfügbar');
+	if (piece?.presentationMode !== 'link' || !piece.presentationImageUrl) {
+		error(404, 'Vorschaubild nicht verfügbar');
+	}
 	try {
 		const image = await fetchPresentationImage(piece.presentationImageUrl);
 		return new Response(new Uint8Array(image.data), {

src/routes/live/+page.server.ts

@@ -8,6 +8,7 @@ import {
 	clearPresentationChannel,
 	endLive,
 	getLiveView,
+	getPresentationChannelStatus,
 	goBack,
 	issuePresentationAccess,
 	moveOpenUsage,
@@ -16,6 +17,7 @@ import {
 	rotatePresentationChannelKey,
 	resetSectionTimer,
 	resetTotalTimer,
+	resumeUsage,
 	resumeEndedLive,
 	resumeLive,
 	selectUsage,
@@ -25,7 +27,13 @@ import {
 	startOrResumeLive
 } from '#lib/server/live.js';
 import { listShows } from '#lib/server/shows.js';
-import { createShare, deleteShare, listShares, updateShare } from '#lib/server/shares.js';
+import {
+	createShare,
+	deleteShare,
+	listShares,
+	replaceShareToken,
+	updateShare
+} from '#lib/server/shares.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 
 function text(data: FormData, name: string) {
@@ -80,6 +88,7 @@ export const load: PageServerLoad = ({ locals, url }) => {
 		const live = getLiveView(showId);
 		return {
 			live,
+			outputStatus: getPresentationChannelStatus(showId),
 			canManageShares: actor.role === 'barkeeper',
 			shares: actor.role === 'barkeeper' ? listShares(actor, showId) : [],
 			commandId: randomUUID(),
@@ -99,10 +108,16 @@ export const actions = {
 		const data = await request.formData();
 		try {
 			const share = await createShare(actor, {
-				showId: text(data, 'showId'), scope: text(data, 'scope'), password: text(data, 'password'),
+				showId: text(data, 'showId'),
+				scope: text(data, 'scope'),
+				password: text(data, 'password'),
 				expiresAtUtc: berlinLocalToUtc(text(data, 'expiresAt'), 'INVALID_EXPIRY')
 			});
-			return { intent: 'createShare', success: 'Leselink angelegt.', shareUrl: `/freigabe/${share.token}` };
+			return {
+				intent: 'createShare',
+				success: 'Leselink angelegt.',
+				shareUrl: `/freigabe/${share.token}`
+			};
 		} catch (cause) {
 			const problem = actionError(cause);
 			return fail(problem.status, { intent: 'createShare', ...problem });
@@ -112,16 +127,38 @@ export const actions = {
 		const actor = requireBarkeeper(locals.user);
 		const data = await request.formData();
 		try {
-			await updateShare(actor, text(data, 'shareId'), {
+			await updateShare(
-				scope: text(data, 'scope'), passwordMode: text(data, 'passwordMode'), password: text(data, 'password'),
+				actor,
+				text(data, 'shareId'),
+				{
+					scope: text(data, 'scope'),
+					passwordMode: text(data, 'passwordMode'),
+					password: text(data, 'password'),
 					expiresAtUtc: berlinLocalToUtc(text(data, 'expiresAt'), 'INVALID_EXPIRY')
-			}, text(data, 'showId'));
+				},
+				text(data, 'showId')
+			);
 			return { intent: 'updateShare', success: 'Freigabe aktualisiert.' };
 		} catch (cause) {
 			const problem = actionError(cause);
 			return fail(problem.status, { intent: 'updateShare', ...problem });
 		}
 	},
+	replaceShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const token = replaceShareToken(actor, text(data, 'shareId'), text(data, 'showId'));
+			return {
+				intent: 'replaceShare',
+				success: 'Ersatzlink angelegt. Der bisherige Link ist ungültig.',
+				shareUrl: `/freigabe/${token}`
+			};
+		} catch (cause) {
+			const problem = actionError(cause);
+			return fail(problem.status, { intent: 'replaceShare', ...problem });
+		}
+	},
 	deleteShare: async ({ locals, request }) => {
 		const actor = requireBarkeeper(locals.user);
 		const data = await request.formData();
@@ -253,6 +290,18 @@ export const actions = {
 			)
 		);
 	},
+	resumeUsage: async ({ locals, request }) => {
+		requireUser(locals.user);
+		const data = await request.formData();
+		return attempt('resumeUsage', () =>
+			resumeUsage(
+				text(data, 'showId'),
+				text(data, 'usageId'),
+				text(data, 'commandId'),
+				Number(data.get('revision'))
+			)
+		);
+	},
 	present: async ({ locals, request }) => {
 		requireUser(locals.user);
 		const data = await request.formData();

src/routes/live/+page.svelte

@@ -300,9 +300,10 @@
 		menuOpen = true;
 		expandedContext = null;
 		await tick();
-		liveMenuPopover
+		(
-			?.querySelector<HTMLElement>('button:not(:disabled), a[href]')
+			liveMenuPopover?.querySelector<HTMLElement>('[data-menu-initial-focus]') ??
-			?.focus({ preventScroll: true });
+			liveMenuPopover?.querySelector<HTMLElement>('button:not(:disabled), a[href]')
+		)?.focus({ preventScroll: true });
 	}
 
 	async function closeLiveMenu(restoreFocus = true) {
@@ -361,6 +362,15 @@
 		return 'Kommend';
 	}
 
+	function showStateLabel() {
+		if (data.live.show.status === 'completed') return 'Historisch abgeschlossen';
+		if (!data.live.startedAtUtc)
+			return data.live.show.status === 'ready' ? 'Bereit zum Start' : 'Entwurf';
+		if (data.live.endedAtUtc) return 'Lauf beendet';
+		if (data.live.isPaused) return 'Pausiert';
+		return 'Läuft';
+	}
+
 	function liveAction(name: string) {
 		return `?show=${encodeURIComponent(data.live.show.id)}&/${name}`;
 	}
@@ -481,6 +491,7 @@
 					</form>{/if}
 			</div>
 
+			<div class="total-timer-control">
 				<button
 					class="total-countdown"
 					type="button"
@@ -503,6 +514,23 @@
 						>
 					{/if}
 				</button>
+				{#if data.live.startedAtUtc && !data.live.endedAtUtc}<details class="timer-reset-menu">
+						<summary aria-label="Aktionen für Gesamtzeit"><AppIcon name="ellipsis" /></summary>
+						<form
+							method="POST"
+							action={liveAction('resetTotalTimer')}
+							use:enhance={enhanceCommand}
+							onsubmit={(event) => {
+								if (!confirm('Gesamtzeit wirklich zurücksetzen?')) event.preventDefault();
+							}}
+						>
+							<input type="hidden" name="showId" value={data.live.show.id} />
+							<input type="hidden" name="revision" value={data.live.liveRevision} />
+							<input type="hidden" name="commandId" value={data.commandId} />
+							<button class="text-button" type="submit">Gesamtzeit zurücksetzen</button>
+						</form>
+					</details>{/if}
+			</div>
 
 			<div class="section-timer-control">
 				<div
@@ -540,6 +568,24 @@
 							<AppIcon name={data.live.isPaused ? 'play' : 'pause'} />
 						</button>
 					</form>{/if}
+				{#if data.live.startedAtUtc && !data.live.endedAtUtc && data.live.sectionTimer && data.live.sectionTimer.plannedDurationSeconds > 0}<details
+						class="timer-reset-menu"
+					>
+						<summary aria-label="Aktionen für Abschnittszeit"><AppIcon name="ellipsis" /></summary>
+						<form
+							method="POST"
+							action={liveAction('resetSectionTimer')}
+							use:enhance={enhanceCommand}
+							onsubmit={(event) => {
+								if (!confirm('Abschnittstimer wirklich zurücksetzen?')) event.preventDefault();
+							}}
+						>
+							<input type="hidden" name="showId" value={data.live.show.id} />
+							<input type="hidden" name="revision" value={data.live.liveRevision} />
+							<input type="hidden" name="commandId" value={data.commandId} />
+							<button class="text-button" type="submit">Abschnittszeit zurücksetzen</button>
+						</form>
+					</details>{/if}
 			</div>
 
 			<button
@@ -567,47 +613,23 @@
 			inert={mobileRailOpen}
 		>
 			<section class="live-menu-show">
+				<strong>Sendung steuern</strong>
+				<div class="live-menu-show-heading">
+					<span>
 						<small>Sendung</small>
 						<strong>{data.live.show.title}</strong>
-			</section>
+					</span>
-			<section>
+					<span class:paused={data.live.isPaused} class="live-show-state">{showStateLabel()}</span>
-				<strong>Ansicht</strong>
-				<div class="font-control" aria-label="Prompter-Schriftgröße">
-					<button
-						type="button"
-						onclick={() => changePromptSize(-0.1)}
-						aria-label="Schrift verkleinern">A−</button
-					>
-					<button
-						type="button"
-						onclick={() => changePromptSize(0.1)}
-						aria-label="Schrift vergrößern">A+</button
-					>
 				</div>
-				<button type="button" class="text-button" aria-pressed={!showTimes} onclick={toggleTimes}>
-					{showTimes ? 'Zeiten ausblenden' : 'Zeiten einblenden'}
-				</button>
-				<ThemeToggle />
-			</section>
-			<section>
-				<strong>Ausgabekanal</strong>
-				{#if data.canManageShares}<ShareManagement shows={[{ ...data.live.show, startsAtUtc: null }]} shares={data.shares} fixedShowId={data.live.show.id} {form} />{/if}
-				<form method="POST" action={liveAction('createOutput')} use:enhance={enhanceOutput}>
-					<input type="hidden" name="showId" value={data.live.show.id} />
-					<button class="secondary-button" type="submit">Ausgabe verbinden und öffnen</button>
-				</form>
-				<form method="POST" action={liveAction('rotateOutput')} use:enhance={enhanceOutput}>
-					<input type="hidden" name="showId" value={data.live.show.id} />
-					<button class="text-button" type="submit">Schlüssel erneuern</button>
-				</form>
-				<form method="POST" action={liveAction('clearOutput')} use:enhance={enhanceCommand}>
-					<button class="text-button danger-text" type="submit">Ausgabekanal trennen</button>
-				</form>
-			</section>
-			<section>
-				<strong>Sendungssteuerung</strong>
-				<small>Status: {data.live.show.status}</small>
 				{#if !data.live.startedAtUtc}
+					<form method="POST" action={liveAction('start')} use:enhance={enhanceCommand}>
+						<input type="hidden" name="showId" value={data.live.show.id} />
+						<input type="hidden" name="revision" value={data.live.liveRevision} />
+						<input type="hidden" name="commandId" value={data.commandId} />
+						<button class="secondary-button" type="submit"
+							><AppIcon name="play" /> Sendung starten</button
+						>
+					</form>
 					<form method="POST" action={liveAction('setStatus')} use:enhance={enhanceCommand}>
 						<input type="hidden" name="showId" value={data.live.show.id} />
 						<input
@@ -622,27 +644,16 @@
 							{data.live.show.status === 'ready' ? 'Als Entwurf markieren' : 'Als bereit markieren'}
 						</button>
 					</form>
-					<form method="POST" action={liveAction('start')} use:enhance={enhanceCommand}>
-						<input type="hidden" name="showId" value={data.live.show.id} />
-						<input type="hidden" name="revision" value={data.live.liveRevision} />
-						<input type="hidden" name="commandId" value={data.commandId} />
-						<button class="secondary-button" type="submit"
-							><AppIcon name="play" /> Sendung starten</button
-						>
-					</form>
 				{:else if data.live.endedAtUtc}
 					{#if data.live.show.status === 'completed'}
-						<p class="quiet-copy">Diese Sendung ist historisch abgeschlossen und unveränderlich.</p>
+						<p class="quiet-copy">Diese Sendung ist historisch abgeschlossen.</p>
-						<a class="secondary-button" href={resolve('/sendungen/[id]', { id: data.live.show.id })}
-							>Historische Sendung öffnen</a
-						>
 					{:else}
 						<form method="POST" action={liveAction('resumeEnded')} use:enhance={enhanceCommand}>
 							<input type="hidden" name="showId" value={data.live.show.id} />
 							<input type="hidden" name="revision" value={data.live.liveRevision} />
 							<input type="hidden" name="commandId" value={data.commandId} />
 							<button class="secondary-button" type="submit"
-								><AppIcon name="play" /> Lauf fortsetzen</button
+								><AppIcon name="play" /> Beendeten Lauf wiederaufnehmen</button
 							>
 						</form>
 						<form
@@ -674,49 +685,19 @@
 						</button>
 					{/if}
 				{:else}
-					<form
+					{#if needsResume}<form
 							method="POST"
-						action={liveAction(data.live.isPaused ? 'resume' : 'pause')}
+							action={liveAction('start')}
 							use:enhance={enhanceCommand}
 						>
 							<input type="hidden" name="showId" value={data.live.show.id} />
 							<input type="hidden" name="revision" value={data.live.liveRevision} />
 							<input type="hidden" name="commandId" value={data.commandId} />
-						<button class="secondary-button" type="submit">
+							<button class="secondary-button" type="submit">Live-Stand wiederaufnehmen</button>
-							<AppIcon name={data.live.isPaused ? 'play' : 'pause'} />
-							{data.live.isPaused ? 'Fortsetzen' : 'Pausieren'}
-						</button>
-					</form>
-					{#if data.live.sectionTimer && data.live.sectionTimer.plannedDurationSeconds > 0}<form
-							method="POST"
-							action={liveAction('resetSectionTimer')}
-							use:enhance={enhanceCommand}
-							onsubmit={(event) => {
-								if (!confirm('Abschnittstimer wirklich zurücksetzen?')) event.preventDefault();
-							}}
-						>
-							<input type="hidden" name="showId" value={data.live.show.id} />
-							<input type="hidden" name="revision" value={data.live.liveRevision} />
-							<input type="hidden" name="commandId" value={data.commandId} />
-							<button class="text-button" type="submit"
-								><AppIcon name="arrow-rotate-left" /> Abschnittszeit zurücksetzen</button
-							>
 						</form>{/if}
-					<form
+					{#if data.live.isPaused}<p class="live-menu-hint">
-						method="POST"
+							Fortsetzen ist direkt bei der Abschnittszeit erreichbar.
-						action={liveAction('resetTotalTimer')}
+						</p>{/if}
-						use:enhance={enhanceCommand}
-						onsubmit={(event) => {
-							if (!confirm('Gesamtzeit wirklich zurücksetzen?')) event.preventDefault();
-						}}
-					>
-						<input type="hidden" name="showId" value={data.live.show.id} />
-						<input type="hidden" name="revision" value={data.live.liveRevision} />
-						<input type="hidden" name="commandId" value={data.commandId} />
-						<button class="text-button" type="submit"
-							><AppIcon name="timer" /> Gesamtzeit zurücksetzen</button
-						>
-					</form>
 					<form
 						method="POST"
 						action={liveAction('end')}
@@ -734,20 +715,103 @@
 						>
 					</form>
 				{/if}
-				{#if needsResume && !data.live.endedAtUtc}<form
+			</section>
+			<section>
+				<strong>Ansicht</strong>
+				<div class="live-view-controls">
+					<div class="font-control" aria-label="Prompter-Schriftgröße">
+						<button
+							data-menu-initial-focus
+							type="button"
+							onclick={() => changePromptSize(-0.1)}
+							aria-label="Schrift verkleinern">A−</button
+						>
+						<button
+							type="button"
+							onclick={() => changePromptSize(0.1)}
+							aria-label="Schrift vergrößern">A+</button
+						>
+					</div>
+					<button type="button" class="text-button" aria-pressed={!showTimes} onclick={toggleTimes}>
+						{showTimes ? 'Zeiten ausblenden' : 'Zeiten einblenden'}
+					</button>
+					<ThemeToggle />
+				</div>
+			</section>
+			{#if data.canManageShares}<section>
+					<strong>Teilen</strong>
+					<ShareManagement
+						shows={[{ ...data.live.show, startsAtUtc: null }]}
+						shares={data.shares}
+						fixedShowId={data.live.show.id}
+						{form}
+					/>
+				</section>{/if}
+			<section class="live-output-section">
+				<details class="live-output-settings">
+					<summary>
+						<span><AppIcon name="display" /> Ausgabe einrichten</span>
+						<small
+							>{data.outputStatus === 'connected'
+								? 'Mit dieser Sendung verbunden'
+								: data.outputStatus === 'other_show'
+									? 'Mit einer anderen Sendung verbunden'
+									: 'Nicht verbunden'}</small
+						>
+						<AppIcon name="chevron-right" />
+					</summary>
+					<div class="live-output-settings-body">
+						<p>Der OBS-Ausgabekanal ändert sich erst durch eine der folgenden Aktionen.</p>
+						<form method="POST" action={liveAction('createOutput')} use:enhance={enhanceOutput}>
+							<input type="hidden" name="showId" value={data.live.show.id} />
+							<button class="secondary-button" type="submit">
+								{data.outputStatus === 'connected'
+									? 'Ausgabe öffnen'
+									: 'Mit dieser Sendung verbinden und öffnen'}
+							</button>
+						</form>
+						{#if data.outputStatus === 'connected'}
+							<form
 								method="POST"
-						action={liveAction('start')}
+								action={liveAction('rotateOutput')}
-						use:enhance={enhanceCommand}
+								use:enhance={enhanceOutput}
+								onsubmit={(event) => {
+									if (
+										!confirm(
+											'Schlüssel erneuern? Bereits eingerichtete OBS-Quellen verlieren den Zugriff.'
+										)
+									)
+										event.preventDefault();
+								}}
 							>
 								<input type="hidden" name="showId" value={data.live.show.id} />
-						<input type="hidden" name="revision" value={data.live.liveRevision} />
+								<button class="text-button" type="submit">Schlüssel erneuern</button>
-						<input type="hidden" name="commandId" value={data.commandId} />
+							</form>
-						<button class="text-button" type="submit">Live-Stand wiederaufnehmen</button>
+							<form
-					</form>{/if}
+								method="POST"
-				<a href={resolve('/sendungen/[id]', { id: data.live.show.id })}
+								action={liveAction('clearOutput')}
-					>Liveansicht verlassen · Zur Planung</a
+								use:enhance={enhanceCommand}
+								onsubmit={(event) => {
+									if (
+										!confirm(
+											'Ausgabekanal trennen? Verbundene Browserquellen zeigen anschließend keine Sendung.'
+										)
+									)
+										event.preventDefault();
+								}}
 							>
+								<button class="text-button danger-text" type="submit">Kanal trennen</button>
+							</form>
+						{/if}
+					</div>
+				</details>
 			</section>
+			<nav class="live-menu-navigation" aria-label="Liveansicht verlassen">
+				<a href={resolve('/sendungen/[id]', { id: data.live.show.id })}
+					><AppIcon name="arrow-left" /> Zur Planung</a
+				>
+				<small>Die Sendung und öffentliche Ausgabe laufen unverändert weiter.</small>
+			</nav>
 		</div>{/if}
 
 	<div class="live-messages">
@@ -814,8 +878,13 @@
 								{formatClock(viewedActualSeconds)} / {formatClock(viewedUsage.durationSeconds)}
 							</strong>{/if}
 					</div>
-					{#if viewedSection?.twitchTags.length}<button class="text-button live-twitch-tags" type="button" onclick={copyTwitchTags}>
+					{#if viewedSection?.twitchTags.length}<button
-						<AppIcon name="copy" /> {viewedSection.twitchTags.join(' · ')}
+							class="text-button live-twitch-tags"
+							type="button"
+							onclick={copyTwitchTags}
+						>
+							<AppIcon name="copy" />
+							{viewedSection.twitchTags.join(' · ')}
 						</button>{/if}
 
 					{#if viewedUsage.introHtml}<section class="live-script-section live-intro">
@@ -1000,6 +1069,22 @@
 										>
 									</button>
 									<div class="live-run-actions">
+										{#if usage.status === 'done' || usage.status === 'skipped'}<form
+												method="POST"
+												action={liveAction('resumeUsage')}
+												use:enhance={enhanceCommand}
+											>
+												<input type="hidden" name="showId" value={data.live.show.id} />
+												<input type="hidden" name="usageId" value={usage.id} />
+												<input type="hidden" name="revision" value={data.live.liveRevision} />
+												<input type="hidden" name="commandId" value={data.commandId} />
+												<button
+													class="text-button"
+													type="submit"
+													disabled={data.live.isPaused || Boolean(data.live.endedAtUtc)}
+													>Wiederaufnehmen</button
+												>
+											</form>{/if}
 										{#if usage.status === 'open'}<details class="live-run-order">
 												<summary aria-label={`${usage.title} sortieren`}
 													><AppIcon name="ellipsis" /></summary
@@ -1176,6 +1261,19 @@
 							: 'Präsentieren'}
 					</button>
 				</form>
+				{#if (viewedUsage.status === 'done' || viewedUsage.status === 'skipped') && !viewingLiveCurrent}
+					<form method="POST" action={liveAction('resumeUsage')} use:enhance={enhanceCommand}>
+						<input type="hidden" name="showId" value={data.live.show.id} />
+						<input type="hidden" name="usageId" value={viewedUsage.id} />
+						<input type="hidden" name="revision" value={data.live.liveRevision} />
+						<input type="hidden" name="commandId" value={data.commandId} />
+						<button
+							class="primary-button"
+							type="submit"
+							disabled={data.live.isPaused || Boolean(data.live.endedAtUtc)}>Wiederaufnehmen</button
+						>
+					</form>
+				{:else}
 					<form method="POST" action={liveAction('skip')} use:enhance={enhanceCommand}>
 						<input type="hidden" name="showId" value={data.live.show.id} />
 						<input type="hidden" name="revision" value={data.live.liveRevision} />
@@ -1208,6 +1306,7 @@
 									: 'Erledigen & Sendungsende'}
 						</button>
 					</form>
+				{/if}
 			{:else if sessionComplete}<strong class="live-finished-label">Ablauf abgeschlossen</strong
 				>{/if}
 		</div>

src/routes/login/+page.server.ts

@@ -8,13 +8,26 @@ import {
 	validEmail
 } from '#lib/server/auth.js';
 
-export const load: PageServerLoad = ({ locals }) => {
+function safeReturnTo(value: string | null): string {
+	if (!value || value.length > 4000) return '/fundus';
+	try {
+		const target = new URL(value, 'http://sendewerk.local');
+		if (target.origin === 'http://sendewerk.local' && target.pathname === '/oauth/authorize') {
+			return `${target.pathname}${target.search}`;
+		}
+	} catch {
+		// Fall back to the normal authenticated landing page.
+	}
+	return '/fundus';
+}
+
+export const load: PageServerLoad = ({ locals, url }) => {
 	if (!hasUsers()) redirect(303, '/setup');
-	if (locals.user) redirect(303, '/fundus');
+	if (locals.user) redirect(303, safeReturnTo(url.searchParams.get('returnTo')));
 };
 
 export const actions = {
-	default: async ({ request, cookies, getClientAddress }) => {
+	default: async ({ request, cookies, getClientAddress, url }) => {
 		const data = await request.formData();
 		const email = String(data.get('email') || '').trim();
 		const password = String(data.get('password') || '');
@@ -31,6 +44,6 @@ export const actions = {
 		const user = await authenticate(email, password);
 		if (!user) return fail(400, { email, error: 'E-Mail oder Passwort ist nicht korrekt.' });
 		createSession(user.id, cookies);
-		redirect(303, '/fundus');
+		redirect(303, safeReturnTo(url.searchParams.get('returnTo')));
 	}
 } satisfies Actions;

src/routes/mcp/+server.ts

@@ -0,0 +1,154 @@
+import { json, text } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { handleMcpRequest, validJsonRpcRequest } from '#lib/server/mcp.js';
+import { getAuthConfig } from '#lib/server/config.js';
+import {
+	authenticateOAuth,
+	MCP_SCOPE,
+	OAuthError,
+	protectedResourceMetadataUrl
+} from '#lib/server/oauth.js';
+
+const MODERN_VERSION = '2026-07-28';
+const supportedProtocolVersions = [MODERN_VERSION, '2025-11-25', '2025-06-18', '2025-03-26'];
+
+function challenge(errorCode?: string) {
+	const fields = [`resource_metadata="${protectedResourceMetadataUrl()}"`, `scope="${MCP_SCOPE}"`];
+	if (errorCode) fields.push(`error="${errorCode}"`);
+	return `Bearer ${fields.join(', ')}`;
+}
+
+function authenticate(request: Request) {
+	try {
+		return authenticateOAuth(request);
+	} catch (cause) {
+		if (cause instanceof OAuthError) {
+			const headers: Record<string, string> = { 'Cache-Control': 'no-store' };
+			if (cause.status === 401) headers['WWW-Authenticate'] = challenge(cause.code);
+			return json(
+				{ error: cause.code, error_description: cause.message },
+				{ status: cause.status, headers }
+			);
+		}
+		throw cause;
+	}
+}
+
+function originAllowed(request: Request): boolean {
+	const origin = request.headers.get('origin');
+	return !origin || origin === getAuthConfig().origin.origin;
+}
+
+function protocolError(id: string | number | null, code: number, message: string, data?: unknown) {
+	return {
+		jsonrpc: '2.0',
+		id,
+		error: { code, message, ...(data === undefined ? {} : { data }) }
+	};
+}
+
+function modernValidation(
+	request: Request,
+	body: {
+		id?: string | number | null;
+		method: string;
+		params?: Record<string, unknown>;
+	}
+): Response | null {
+	const id = typeof body.id === 'string' || typeof body.id === 'number' ? body.id : null;
+	const metadata = body.params?._meta;
+	if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata)) {
+		return json(protocolError(id, -32602, 'Required MCP request metadata is missing.'), {
+			status: 400
+		});
+	}
+	const meta = metadata as Record<string, unknown>;
+	const bodyVersion = meta['io.modelcontextprotocol/protocolVersion'];
+	if (typeof bodyVersion !== 'string' || !supportedProtocolVersions.includes(bodyVersion)) {
+		return json(
+			protocolError(id, -32022, 'Unsupported protocol version', {
+				supported: supportedProtocolVersions,
+				requested: bodyVersion ?? null
+			}),
+			{ status: 400 }
+		);
+	}
+	if (
+		request.headers.get('mcp-protocol-version') !== bodyVersion ||
+		request.headers.get('mcp-method') !== body.method ||
+		(body.method === 'tools/call' && request.headers.get('mcp-name') !== body.params?.name)
+	) {
+		return json(protocolError(id, -32020, 'MCP request headers do not match the body.'), {
+			status: 400
+		});
+	}
+	const capabilities = meta['io.modelcontextprotocol/clientCapabilities'];
+	if (
+		body.id === null ||
+		!capabilities ||
+		typeof capabilities !== 'object' ||
+		Array.isArray(capabilities)
+	) {
+		return json(protocolError(id, -32602, 'Required MCP request metadata is invalid.'), {
+			status: 400
+		});
+	}
+	return null;
+}
+
+export const POST: RequestHandler = async ({ request }) => {
+	if (!originAllowed(request)) return text('Forbidden', { status: 403 });
+	const authenticated = authenticate(request);
+	if (authenticated instanceof Response) return authenticated;
+	if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
+		return text('JSON wird erwartet.', { status: 415 });
+	}
+	let body: unknown;
+	try {
+		body = await request.json();
+	} catch {
+		return json({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } });
+	}
+	if (!validJsonRpcRequest(body)) {
+		return json({ jsonrpc: '2.0', id: null, error: { code: -32600, message: 'Invalid Request' } });
+	}
+	const metadata = body.params?._meta;
+	const bodyVersion =
+		metadata && typeof metadata === 'object' && !Array.isArray(metadata)
+			? (metadata as Record<string, unknown>)['io.modelcontextprotocol/protocolVersion']
+			: undefined;
+	const headerVersion = request.headers.get('mcp-protocol-version');
+	const modern = headerVersion === MODERN_VERSION || bodyVersion === MODERN_VERSION;
+	if (modern) {
+		const validationFailure = modernValidation(request, body);
+		if (validationFailure) return validationFailure;
+	} else if (headerVersion && !supportedProtocolVersions.includes(headerVersion)) {
+		return json(
+			protocolError(body.id ?? null, -32022, 'Unsupported protocol version', {
+				supported: supportedProtocolVersions,
+				requested: headerVersion
+			}),
+			{ status: 400 }
+		);
+	}
+	if (body.id === undefined) return new Response(null, { status: 202 });
+	const response = handleMcpRequest(body, authenticated);
+	const status = modern && 'error' in response && response.error?.code === -32601 ? 404 : 200;
+	return json(response, {
+		status,
+		headers: { 'Cache-Control': 'no-store' }
+	});
+};
+
+export const GET: RequestHandler = ({ request }) => {
+	if (!originAllowed(request)) return text('Forbidden', { status: 403 });
+	const authenticated = authenticate(request);
+	if (authenticated instanceof Response) return authenticated;
+	return text('Dieser MCP-Endpunkt bietet keinen serverseitigen Ereignisstrom.', {
+		status: 405,
+		headers: { Allow: 'POST' }
+	});
+};
+
+export const DELETE: RequestHandler = () =>
+	text('Method Not Allowed', { status: 405, headers: { Allow: 'POST' } });

src/routes/oauth/authorize/+page.server.ts

@@ -0,0 +1,53 @@
+import { error, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import {
+	authorizationErrorRedirect,
+	authorizationRedirect,
+	createAuthorizationCode,
+	OAuthError,
+	parseAuthorizationRequest
+} from '#lib/server/oauth.js';
+
+function authorization(url: URL) {
+	try {
+		return parseAuthorizationRequest(url);
+	} catch (cause) {
+		if (cause instanceof OAuthError) {
+			const target = authorizationErrorRedirect(url, cause);
+			if (target) redirect(303, target, { external: true });
+			error(cause.status, cause.message);
+		}
+		throw cause;
+	}
+}
+
+export const load: PageServerLoad = ({ locals, url }) => {
+	const request = authorization(url);
+	if (!locals.user) {
+		const returnTo = `${url.pathname}${url.search}`;
+		redirect(303, `/login?returnTo=${encodeURIComponent(returnTo)}`);
+	}
+	return {
+		clientName: request.client.name,
+		redirectHost: new URL(request.redirectUri).host,
+		scope: request.scope,
+		user: locals.user
+	};
+};
+
+export const actions = {
+	default: ({ request: browserRequest, locals, url }) => {
+		if (!locals.user)
+			redirect(303, `/login?returnTo=${encodeURIComponent(`${url.pathname}${url.search}`)}`);
+		const oauthRequest = authorization(url);
+		return browserRequest.formData().then((data) => {
+			if (data.get('decision') !== 'approve') {
+				redirect(303, authorizationRedirect(oauthRequest, { error: 'access_denied' }), {
+					external: true
+				});
+			}
+			const code = createAuthorizationCode(oauthRequest, locals.user!);
+			redirect(303, authorizationRedirect(oauthRequest, { code }), { external: true });
+		});
+	}
+} satisfies Actions;

src/routes/oauth/authorize/+page.svelte

@@ -0,0 +1,30 @@
+<script lang="ts">
+	import type { PageProps } from './$types';
+	let { data }: PageProps = $props();
+</script>
+
+<svelte:head><title>Zugriff erlauben | Sendewerk</title></svelte:head>
+
+<section class="auth-card oauth-consent">
+	<p class="eyebrow">Externe Verbindung</p>
+	<h1>{data.clientName} verbinden?</h1>
+	<p>
+		Die Anwendung erhält im Namen von <strong>{data.user.displayName}</strong> lesenden Zugriff auf redaktionelle
+		Pieces, Sendungen und Abläufe. Dazu gehören auch private Recherche, Moderationsnotizen, Quellen und
+		die Reservebank.
+	</p>
+	<div class="oauth-permission">
+		<strong>Nur lesen</strong>
+		<span>Keine Inhalte anlegen, ändern, einplanen oder archivieren.</span>
+	</div>
+	<p class="oauth-redirect">
+		<strong>Nicht verifizierter OAuth-Client.</strong> Nach Zustimmung erfolgt der Rücksprung zu
+		<code>{data.redirectHost}</code>.
+	</p>
+	<form class="oauth-actions" method="POST">
+		<button class="secondary-button" type="submit" name="decision" value="deny">Ablehnen</button>
+		<button class="primary-button" type="submit" name="decision" value="approve">
+			Zugriff erlauben
+		</button>
+	</form>
+</section>

src/routes/oauth/register/+server.ts

@@ -0,0 +1,36 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { OAuthError, registerOAuthClient, reserveOAuthAttempt } from '#lib/server/oauth.js';
+
+export const POST: RequestHandler = async ({ request, getClientAddress }) => {
+	try {
+		if (!reserveOAuthAttempt('registration', getClientAddress())) {
+			throw new OAuthError('temporarily_unavailable', 'Zu viele Registrierungsversuche.', 429);
+		}
+		if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
+			throw new OAuthError('invalid_client_metadata', 'JSON wird erwartet.');
+		}
+		const client = registerOAuthClient(await request.json());
+		return json(
+			{
+				client_id: client.id,
+				client_id_issued_at: Math.floor(Date.now() / 1000),
+				client_name: client.name,
+				redirect_uris: client.redirectUris,
+				grant_types: ['authorization_code'],
+				response_types: ['code'],
+				token_endpoint_auth_method: 'none'
+			},
+			{ status: 201, headers: { 'Cache-Control': 'no-store' } }
+		);
+	} catch (cause) {
+		const problem =
+			cause instanceof OAuthError
+				? cause
+				: new OAuthError('invalid_client_metadata', 'Ungültige Client-Metadaten.');
+		return json(
+			{ error: problem.code, error_description: problem.message },
+			{ status: problem.status, headers: { 'Cache-Control': 'no-store' } }
+		);
+	}
+};

src/routes/oauth/revoke/+server.ts

@@ -0,0 +1,16 @@
+import { text } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { revokeOAuthToken } from '#lib/server/oauth.js';
+
+export const POST: RequestHandler = async ({ request }) => {
+	if (
+		request.headers
+			.get('content-type')
+			?.toLowerCase()
+			.startsWith('application/x-www-form-urlencoded')
+	) {
+		const data = await request.formData();
+		revokeOAuthToken(String(data.get('token') ?? ''), String(data.get('client_id') ?? ''));
+	}
+	return text('', { headers: { 'Cache-Control': 'no-store' } });
+};

src/routes/oauth/token/+server.ts

@@ -0,0 +1,57 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import {
+	exchangeAuthorizationCode,
+	oauthTokenDurationSeconds,
+	OAuthError,
+	reserveOAuthAttempt
+} from '#lib/server/oauth.js';
+
+function failure(cause: unknown) {
+	const problem =
+		cause instanceof OAuthError
+			? cause
+			: new OAuthError('invalid_request', 'Ungültige Token-Anfrage.');
+	return json(
+		{ error: problem.code, error_description: problem.message },
+		{ status: problem.status, headers: { 'Cache-Control': 'no-store', Pragma: 'no-cache' } }
+	);
+}
+
+export const POST: RequestHandler = async ({ request, getClientAddress }) => {
+	try {
+		if (!reserveOAuthAttempt('token', getClientAddress())) {
+			throw new OAuthError('temporarily_unavailable', 'Zu viele Token-Anfragen.', 429);
+		}
+		if (
+			!request.headers
+				.get('content-type')
+				?.toLowerCase()
+				.startsWith('application/x-www-form-urlencoded')
+		) {
+			throw new OAuthError('invalid_request', 'Formulardaten werden erwartet.');
+		}
+		const data = await request.formData();
+		if (data.get('grant_type') !== 'authorization_code') {
+			throw new OAuthError('unsupported_grant_type', 'Nur Authorization Code wird unterstützt.');
+		}
+		const result = exchangeAuthorizationCode({
+			code: String(data.get('code') ?? ''),
+			clientId: String(data.get('client_id') ?? ''),
+			redirectUri: String(data.get('redirect_uri') ?? ''),
+			codeVerifier: String(data.get('code_verifier') ?? ''),
+			resource: String(data.get('resource') ?? '')
+		});
+		return json(
+			{
+				access_token: result.accessToken,
+				token_type: 'Bearer',
+				expires_in: oauthTokenDurationSeconds(),
+				scope: result.scope
+			},
+			{ headers: { 'Cache-Control': 'no-store', Pragma: 'no-cache' } }
+		);
+	} catch (cause) {
+		return failure(cause);
+	}
+};

src/routes/sendungen/+page.server.ts

@@ -2,8 +2,12 @@ import { fail, redirect } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 import { berlinDateKey, berlinMonthKey, normalizeMonthKey, shiftMonth } from '#lib/calendar.js';
 import { getShowOverviewView, requireUser, setShowOverviewView } from '#lib/server/auth.js';
-import { createShow, listShows, listShowTemplates } from '#lib/server/shows.js';
+import {
-import { listPieces } from '#lib/server/content.js';
+	createShow,
+	listPreparationUsages,
+	listShows,
+	listShowTemplates
+} from '#lib/server/shows.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 
 export const load: PageServerLoad = ({ locals, url }) => {
@@ -13,7 +17,7 @@ export const load: PageServerLoad = ({ locals, url }) => {
 	const selectedMonth = normalizeMonthKey(url.searchParams.get('month'), todayMonth);
 	return {
 		shows: listShows(['draft', 'ready', 'live']),
-		preparationPieces: listPieces({ statuses: ['preparing'] }),
+		preparationUsages: listPreparationUsages(),
 		templates: listShowTemplates(),
 		view: getShowOverviewView(user.id),
 		selectedMonth,

src/routes/sendungen/+page.svelte

@@ -53,6 +53,10 @@
 		}).format(new Date(`${value}T12:00:00Z`));
 	}
 
+	function preparationHref(showId: string, usageId: string) {
+		return `${resolve('/sendungen/[id]', { id: showId })}?usage=${encodeURIComponent(usageId)}#usage-${encodeURIComponent(usageId)}`;
+	}
+
 	function statusLabel(status: string) {
 		if (status === 'ready') return 'Bereit';
 		if (status === 'draft') return 'Entwurf';
@@ -125,13 +129,41 @@
 		</form>
 	</details>
 
-	{#if data.preparationPieces.length}<section class="show-library preparation-overview" aria-labelledby="preparation-title">
+	{#if data.preparationUsages.length}<section
-			<header><h2 id="preparation-title">Noch vorzubereiten</h2><span>{data.preparationPieces.length}</span></header>
+			class="show-library preparation-overview"
+			aria-labelledby="preparation-title"
+		>
+			<header>
+				<h2 id="preparation-title">Noch vorzubereiten</h2>
+				<span>{data.preparationUsages.length}</span>
+			</header>
 			<div class="preparation-list">
-				{#each data.preparationPieces as piece (piece.id)}<a href={resolve('/fundus/[id]', { id: piece.id })}>
+				{#each data.preparationUsages as usage (usage.usageId)}
-						<span><strong>{piece.title}</strong>{#if piece.summary}<small>{piece.summary}</small>{/if}</span>
+					<!-- The helper starts from a route resolved against the configured base path. -->
-						{#if piece.preparationEffort}<b class={`effort ${piece.preparationEffort}`}>{piece.preparationEffort === 'low' ? 'Gering' : piece.preparationEffort === 'medium' ? 'Mittel' : 'Hoch'}</b>{/if}
+					<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -->
-					</a>{/each}
+					<a href={preparationHref(usage.showId, usage.usageId)}>
+						<div class="preparation-copy">
+							<span
+								class="preparation-topics"
+								aria-label={usage.topics.map((topic) => topic.name).join(', ')}
+								>{#each usage.topics as topic (topic.name)}<AppIcon
+										name={topic.iconName}
+									/>{/each}</span
+							>
+							<span
+								><strong>{usage.title}</strong><small>{usage.showTitle} · {usage.sectionName}</small
+								></span
+							>
+						</div>
+						{#if usage.preparationEffort}<b class={`effort ${usage.preparationEffort}`}
+								>{usage.preparationEffort === 'low'
+									? 'Gering'
+									: usage.preparationEffort === 'medium'
+										? 'Mittel'
+										: 'Hoch'}</b
+							>{/if}
+					</a>
+				{/each}
 			</div>
 		</section>{/if}
 

src/routes/sendungen/[id]/+page.server.ts

@@ -4,7 +4,13 @@ import type { Actions, PageServerLoad } from './$types';
 import { requireBarkeeper, requireUser } from '#lib/server/auth.js';
 import { getHistoricalActualDurations } from '#lib/server/completion.js';
 import { getTaxonomy, listPieces, listPieceTemplates } from '#lib/server/content.js';
-import { createShare, deleteShare, listShares, updateShare } from '#lib/server/shares.js';
+import {
+	createShare,
+	deleteShare,
+	listShares,
+	replaceShareToken,
+	updateShare
+} from '#lib/server/shares.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 import {
 	addPieceUsage,
@@ -123,7 +129,7 @@ export const load: PageServerLoad = ({ locals, params, url }) => {
 		};
 	}
 	const pieces = listPieces({
-		statuses: ['ready'],
+		statuses: ['preparing', 'ready'],
 		query: url.searchParams.get('q') ?? '',
 		categoryId: url.searchParams.get('category') ?? ''
 	});
@@ -192,6 +198,20 @@ export const actions = {
 			return fail(actionError(cause).status, { intent: 'updateShare', ...actionError(cause) });
 		}
 	},
+	replaceShare: async ({ locals, params, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const token = replaceShareToken(actor, text(data, 'shareId'), params.id);
+			return {
+				intent: 'replaceShare',
+				success: 'Ersatzlink angelegt. Der bisherige Link ist ungültig.',
+				shareUrl: `/freigabe/${token}`
+			};
+		} catch (cause) {
+			return fail(actionError(cause).status, { intent: 'replaceShare', ...actionError(cause) });
+		}
+	},
 	deleteShare: async ({ locals, params, request }) => {
 		const actor = requireBarkeeper(locals.user);
 		const data = await request.formData();
@@ -318,6 +338,9 @@ export const actions = {
 				presentationDescription: text(data, 'presentationDescription'),
 				presentationImageUrl: text(data, 'presentationImageUrl'),
 				presentationSiteName: text(data, 'presentationSiteName'),
+				preparationStatus: text(data, 'preparationStatus') as PieceUsageUpdate['preparationStatus'],
+				preparationEffort: (text(data, 'preparationEffort') ||
+					null) as PieceUsageUpdate['preparationEffort'],
 				presentationMediaId: text(data, 'presentationMediaId') || null,
 				tools: toolIds.map((id, index) => ({
 					id,

src/routes/sendungen/[id]/+page.svelte

@@ -431,7 +431,7 @@
 				<header class="pane-heading">
 					<div>
 						<p class="eyebrow">Quelle</p>
-						<h2 id="source-title">Sendefertiger Fundus</h2>
+						<h2 id="source-title">Planbarer Fundus</h2>
 					</div>
 					<span>{visiblePieces.length}</span>
 				</header>
@@ -661,6 +661,7 @@
 								{#if section.usages.length}<div class="usage-list">
 										{#each section.usages as usage, usageIndex (usage.id)}
 											<div
+												id={`usage-${usage.id}`}
 												class="usage-drag-slot"
 												role="presentation"
 												ondragover={(event) => {
@@ -750,6 +751,7 @@
 														</form>
 														<UsageEditorDialog
 															{usage}
+															open={page.url.searchParams.get('usage') === usage.id}
 															revision={data.show.revision}
 															sectionId={section.id}
 															sections={data.show.sections}
@@ -893,7 +895,11 @@
 							placeholder="optional, Sekunden"
 						/></label
 					><label
-						>Twitch-Tags<input name="twitchTags" maxlength="300" placeholder="Gaming, Deutsch" /></label
+						>Twitch-Tags<input
+							name="twitchTags"
+							maxlength="300"
+							placeholder="Gaming, Deutsch"
+						/></label
 					><button class="primary-button" type="submit">Abschnitt hinzufügen</button>
 				</form>
 

src/routes/verwaltung/+page.server.ts

@@ -8,10 +8,23 @@ import {
 	type TaxonomyKind
 } from '#lib/server/content.js';
 import { getMailConfig } from '#lib/server/config.js';
-import { createShare, deleteShare, listShares, updateShare } from '#lib/server/shares.js';
+import {
+	createShare,
+	deleteShare,
+	listShares,
+	replaceShareToken,
+	updateShare
+} from '#lib/server/shares.js';
 import { listShows } from '#lib/server/shows.js';
 import { berlinLocalToUtc } from '#lib/server/time.js';
 import { createTool, listTools, updateTool, type ToolInput } from '#lib/server/tools.js';
+import { deleteFeedSource, fetchFeed, listFeedSources, saveFeedSource } from '#lib/server/feeds.js';
+import {
+	createTechnicalAccess,
+	listTechnicalAccesses,
+	revokeTechnicalAccess,
+	updateTechnicalAccess
+} from '#lib/server/technical-access.js';
 import {
 	inviteUser,
 	isRole,
@@ -33,6 +46,8 @@ export const load: PageServerLoad = ({ locals }) => {
 		tools: listTools(true),
 		shows: listShows(),
 		shares: listShares(locals.user!),
+		feeds: listFeedSources(),
+		technicalAccesses: listTechnicalAccesses(),
 		mailTransport: getMailConfig().transport
 	};
 };
@@ -59,6 +74,8 @@ function actionError(cause: unknown): string {
 	if (code === 'INVALID_EXPIRY') return 'Der Ablaufzeitpunkt muss in der Zukunft liegen.';
 	if (code === 'INVALID_SCOPE') return 'Der Informationsumfang ist ungültig.';
 	if (code === 'INVALID_PASSWORD_MODE') return 'Die Passwortoption ist ungültig.';
+	if (code === 'INVALID_FEED') return 'Name, URL und Abrufintervall bitte prüfen.';
+	if (code === 'INVALID_ACCESS') return 'Name und Berechtigung bitte prüfen.';
 	return 'Die Aktion konnte nicht ausgeführt werden.';
 }
 
@@ -108,6 +125,20 @@ export const actions = {
 			return fail(400, { intent: 'updateShare', error: actionError(cause) });
 		}
 	},
+	replaceShare: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const token = replaceShareToken(actor, String(data.get('shareId') || ''));
+			return {
+				intent: 'replaceShare',
+				success: 'Ersatzlink angelegt. Der bisherige Link ist ungültig.',
+				shareUrl: `/freigabe/${token}`
+			};
+		} catch (cause) {
+			return fail(400, { intent: 'replaceShare', error: actionError(cause) });
+		}
+	},
 	deleteShare: async ({ locals, request }) => {
 		const actor = requireBarkeeper(locals.user);
 		const data = await request.formData();
@@ -249,5 +280,93 @@ export const actions = {
 		} catch (cause) {
 			return fail(400, { intent: 'tool', error: actionError(cause) });
 		}
+	},
+	saveFeed: async ({ locals, request }) => {
+		requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			saveFeedSource(String(data.get('feedId') || '') || null, {
+				name: String(data.get('name') || ''),
+				url: String(data.get('url') || ''),
+				isEnabled: data.get('isEnabled') === '1',
+				refreshIntervalMinutes: Number(data.get('refreshIntervalMinutes')),
+				defaultCategoryId: String(data.get('defaultCategoryId') || '') || null
+			});
+			return { intent: 'feed', success: 'Feed gespeichert.' };
+		} catch (cause) {
+			return fail(400, { intent: 'feed', error: actionError(cause) });
+		}
+	},
+	deleteFeed: async ({ locals, request }) => {
+		requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			deleteFeedSource(String(data.get('feedId') || ''));
+			return { intent: 'feed', success: 'Feed entfernt.' };
+		} catch (cause) {
+			return fail(400, { intent: 'feed', error: actionError(cause) });
+		}
+	},
+	fetchFeed: async ({ locals, request }) => {
+		requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const result = await fetchFeed(String(data.get('feedId') || ''));
+			return {
+				intent: 'feed',
+				success: result.unchanged
+					? 'Feed ist unverändert.'
+					: `${result.inserted} neue Beiträge abgerufen.`
+			};
+		} catch {
+			return fail(400, {
+				intent: 'feed',
+				error: 'Feed konnte nicht sicher abgerufen oder gelesen werden.'
+			});
+		}
+	},
+	createTechnicalAccess: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			const created = createTechnicalAccess(
+				actor,
+				String(data.get('name') || ''),
+				String(data.get('permissions') || '')
+			);
+			return {
+				intent: 'technicalAccess',
+				success:
+					'Technischer Zugang angelegt. Token jetzt sicher hinterlegen; es wird nicht erneut angezeigt.',
+				technicalToken: created.token
+			};
+		} catch (cause) {
+			return fail(400, { intent: 'technicalAccess', error: actionError(cause) });
+		}
+	},
+	updateTechnicalAccess: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			updateTechnicalAccess(
+				actor,
+				String(data.get('accessId') || ''),
+				String(data.get('name') || ''),
+				String(data.get('permissions') || '')
+			);
+			return { intent: 'technicalAccess', success: 'Technischer Zugang aktualisiert.' };
+		} catch (cause) {
+			return fail(400, { intent: 'technicalAccess', error: actionError(cause) });
+		}
+	},
+	revokeTechnicalAccess: async ({ locals, request }) => {
+		const actor = requireBarkeeper(locals.user);
+		const data = await request.formData();
+		try {
+			revokeTechnicalAccess(actor, String(data.get('accessId') || ''));
+			return { intent: 'technicalAccess', success: 'Technischer Zugang widerrufen.' };
+		} catch (cause) {
+			return fail(400, { intent: 'technicalAccess', error: actionError(cause) });
+		}
 	}
 } satisfies Actions;

src/routes/verwaltung/+page.svelte

@@ -1,11 +1,19 @@
 <script lang="ts">
+	import { resolve } from '$app/paths';
 	import AppIcon from '#lib/components/AppIcon.svelte';
+	import FeedEditorDialog from '#lib/components/FeedEditorDialog.svelte';
 	import IconPicker from '#lib/components/IconPicker.svelte';
 	import ShareManagement from '#lib/components/ShareManagement.svelte';
+	import TechnicalAccessDialog from '#lib/components/TechnicalAccessDialog.svelte';
 	import ToolEditorDialog from '#lib/components/ToolEditorDialog.svelte';
 	import type { PageProps } from './$types';
 	let { data, form }: PageProps = $props();
 	let toolDialog: { showModal: (tool?: (typeof data.tools)[number] | null) => void };
+	let feedDialog: { showModal: (feed?: (typeof data.feeds)[number] | null) => void };
+	let technicalAccessDialog: {
+		showModal: (access?: (typeof data.technicalAccesses)[number] | null) => void;
+	};
+	let managementIntent = $derived(form?.intent?.toLowerCase() ?? '');
 
 	function confirmTaxonomyRemoval(event: SubmitEvent) {
 		if (!confirm('Eintrag wirklich entfernen?')) event.preventDefault();
@@ -19,19 +27,144 @@
 		<h1>Verwaltung</h1>
 		<p class="page-intro">Konten, Werkzeuge und bestehende Taxonomie verwalten.</p>
 	</header>
-	{#if form?.error && !form.intent?.toLowerCase().includes('share')}<div
+	{#if form?.error && !['share', 'technicalaccess'].some( (intent) => managementIntent.includes(intent) )}<div
 			class="form-message error"
 			role="alert"
 		>
 			{form.error}
 		</div>{/if}
-	{#if form?.success && !form.intent?.toLowerCase().includes('share')}<div
+	{#if form?.success && !['share', 'technicalaccess'].some( (intent) => managementIntent.includes(intent) )}<div
 			class="form-message success"
 			role="status"
 		>
 			{form.success}
 		</div>{/if}
-	<ShareManagement shows={data.shows} shares={data.shares} {form} />
+	<h2 class="section-heading">Schnittstellen</h2>
+	<section class="quiet-panel integration-catalog">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Import</p>
+				<h2>RSS-Feeds</h2>
+			</div>
+			<button class="compact-add-button" type="button" onclick={() => feedDialog.showModal()}>
+				<AppIcon name="plus" /> Feed hinzufügen
+			</button>
+		</div>
+		<p class="catalog-note">
+			Aktive Feeds werden im gewählten Intervall abgerufen. Beiträge landen zuerst separat im
+			Eingang.
+		</p>
+		<div class="catalog-settings-list integration-settings-list">
+			{#each data.feeds as feed (feed.id)}
+				<article class:inactive={!feed.isEnabled} class="catalog-setting-row">
+					<button
+						class="catalog-entry-main"
+						type="button"
+						aria-label={`${feed.name} bearbeiten`}
+						onclick={() => feedDialog.showModal(feed)}
+					>
+						<span class="catalog-entry-icon"><AppIcon name="rss" /></span>
+						<span class="catalog-entry-copy">
+							<strong>{feed.name}</strong>
+							<small
+								>{feed.lastError
+									? `Fehler: ${feed.lastError}`
+									: feed.lastFetchedAtUtc
+										? `Zuletzt ${new Date(feed.lastFetchedAtUtc).toLocaleString('de-DE')}`
+										: 'Noch nicht abgerufen'} · {feed.isEnabled ? 'Automatisch' : 'Pausiert'}</small
+							>
+						</span>
+						<AppIcon name="pen" />
+					</button>
+					<div class="catalog-entry-actions">
+						<form method="POST" action="?/fetchFeed">
+							<input type="hidden" name="feedId" value={feed.id} />
+							<button type="submit" aria-label={`${feed.name} jetzt abrufen`} title="Jetzt abrufen"
+								><AppIcon name="arrow-rotate-right" /></button
+							>
+						</form>
+						<form
+							method="POST"
+							action="?/deleteFeed"
+							onsubmit={(event) =>
+								!confirm('Feed und seinen Importeingang löschen?') && event.preventDefault()}
+						>
+							<input type="hidden" name="feedId" value={feed.id} />
+							<button
+								class="danger-text"
+								type="submit"
+								aria-label={`${feed.name} löschen`}
+								title="Feed löschen"><AppIcon name="trash" /></button
+							>
+						</form>
+					</div>
+				</article>
+			{/each}
+			{#if !data.feeds.length}<p class="empty-copy">Noch keine RSS-Feeds eingerichtet.</p>{/if}
+		</div>
+	</section>
+	<FeedEditorDialog bind:this={feedDialog} categories={data.taxonomy.categories} />
+
+	<section class="quiet-panel integration-catalog">
+		<div class="panel-heading">
+			<div>
+				<p class="eyebrow">Externe Assistenz</p>
+				<h2>Technische Zugänge</h2>
+			</div>
+			<button
+				class="compact-add-button"
+				type="button"
+				onclick={() => technicalAccessDialog.showModal()}
+			>
+				<AppIcon name="plus" /> Zugang hinzufügen
+			</button>
+		</div>
+		<p class="catalog-note">
+			Tokens gelten ausschließlich für die API. Schreibende Aufrufe werden protokolliert und müssen
+			idempotent sein. <a href={resolve('/api/v1/openapi.json')} target="_blank">OpenAPI öffnen</a>
+		</p>
+		<div class="catalog-settings-list integration-settings-list">
+			{#each data.technicalAccesses as access (access.id)}
+				<article class:inactive={Boolean(access.revokedAtUtc)} class="catalog-setting-row">
+					<button
+						class="catalog-entry-main"
+						type="button"
+						disabled={Boolean(access.revokedAtUtc)}
+						aria-label={`${access.name} bearbeiten`}
+						onclick={() => technicalAccessDialog.showModal(access)}
+					>
+						<span class="catalog-entry-icon"><AppIcon name="key" /></span>
+						<span class="catalog-entry-copy">
+							<strong>{access.name}</strong>
+							<small
+								>{access.permissions === 'read' ? 'Nur lesen' : 'Lesen und schreiben'} · {access.revokedAtUtc
+									? 'Widerrufen'
+									: access.lastUsedAtUtc
+										? `Zuletzt genutzt ${new Date(access.lastUsedAtUtc).toLocaleString('de-DE')}`
+										: 'Noch nicht genutzt'}</small
+							>
+						</span>
+						{#if !access.revokedAtUtc}<AppIcon name="pen" />{/if}
+					</button>
+					{#if !access.revokedAtUtc}<div class="catalog-entry-actions">
+							<form method="POST" action="?/revokeTechnicalAccess">
+								<input type="hidden" name="accessId" value={access.id} />
+								<button
+									class="danger-text"
+									type="submit"
+									aria-label={`${access.name} widerrufen`}
+									title="Zugang widerrufen"><AppIcon name="ban" /></button
+								>
+							</form>
+						</div>{/if}
+				</article>
+			{/each}
+			{#if !data.technicalAccesses.length}<p class="empty-copy">
+					Noch keine technischen Zugänge angelegt.
+				</p>{/if}
+		</div>
+	</section>
+	<TechnicalAccessDialog bind:this={technicalAccessDialog} {form} />
 
 	<section class="quiet-panel account-panel">
 		<div class="panel-heading">
@@ -129,7 +262,8 @@
 		</section>
 	</div>
 
-	<h2 class="section-heading">Werkzeuge</h2>
+	<h2 class="section-heading">Werkzeuge & Freigaben</h2>
+	<ShareManagement shows={data.shows} shares={data.shares} {form} catalogPanel />
 	<section class="quiet-panel tool-management">
 		<div class="panel-heading">
 			<div>
@@ -272,3 +406,13 @@
 		</section>
 	</div>
 </div>
+
+<style>
+	.integration-catalog {
+		margin-block: 1.5rem;
+		padding: clamp(0.85rem, 2vw, 1.2rem);
+	}
+	.integration-catalog .catalog-note a {
+		white-space: nowrap;
+	}
+</style>

static/manifest.webmanifest

@@ -0,0 +1,11 @@
+{
+	"name": "Sendewerk",
+	"short_name": "Sendewerk",
+	"description": "Redaktion, Sendungsplanung und Live-Regie für heinzlive",
+	"start_url": "/sendungen",
+	"display": "standalone",
+	"background_color": "#0b1220",
+	"theme_color": "#0b1220",
+	"lang": "de",
+	"orientation": "any"
+}

tests/ui.e2e.ts

@@ -247,6 +247,80 @@ function removeCompletionFixture() {
 	rmSync(path.join(dataDirectory, 'uploads', 'e2e-share.png'), { force: true });
 }
 
+function addRssSelectionFixture() {
+	const dataDirectory = process.env.SENDEWERK_E2E_DATA_DIR;
+	if (!dataDirectory) throw new Error('E2E-Datenverzeichnis ist nicht konfiguriert.');
+	const database = new Database(path.join(dataDirectory, 'e2e.sqlite'));
+	const now = '2026-10-26T12:00:00.000Z';
+	const insertFeed = database.prepare(
+		`INSERT INTO feed_sources
+		 (id, name, url, is_enabled, refresh_interval_minutes, created_at_utc, updated_at_utc)
+		 VALUES (?, ?, ?, 1, 60, ?, ?)`
+	);
+	const insertEntry = database.prepare(
+		`INSERT INTO feed_entries
+		 (id, feed_id, external_id, title, url, summary, published_at_utc, first_seen_at_utc, updated_at_utc)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+	);
+	database.transaction(() => {
+		insertFeed.run('e2e-feed-a', 'E2E Quelle A', 'https://example.org/e2e-a.xml', now, now);
+		insertFeed.run('e2e-feed-b', 'E2E Quelle B', 'https://example.org/e2e-b.xml', now, now);
+		for (let index = 1; index <= 25; index += 1) {
+			const published = new Date(Date.UTC(2026, 8, index)).toISOString();
+			insertEntry.run(
+				`e2e-entry-a-${index}`,
+				'e2e-feed-a',
+				`a-${index}`,
+				`E2E Quelle A Beitrag ${index}`,
+				`https://example.org/a/${index}`,
+				`Auszug für Beitrag ${index} aus Quelle A.`,
+				published,
+				now,
+				now
+			);
+		}
+		for (let index = 1; index <= 20; index += 1) {
+			const published = new Date(Date.UTC(2026, 7, index)).toISOString();
+			insertEntry.run(
+				`e2e-entry-b-${index}`,
+				'e2e-feed-b',
+				`b-${index}`,
+				`E2E Quelle B Beitrag ${index}`,
+				`https://example.org/b/${index}`,
+				`Auszug für Beitrag ${index} aus Quelle B.`,
+				published,
+				now,
+				now
+			);
+		}
+	})();
+	database.close();
+}
+
+function removeIntegrationFixtures() {
+	const dataDirectory = process.env.SENDEWERK_E2E_DATA_DIR;
+	if (!dataDirectory) return;
+	const database = new Database(path.join(dataDirectory, 'e2e.sqlite'));
+	database.pragma('foreign_keys = ON');
+	database.transaction(() => {
+		const pieceIds = database
+			.prepare(
+				"SELECT piece_id AS id FROM feed_entries WHERE id LIKE 'e2e-entry-%' AND piece_id IS NOT NULL"
+			)
+			.all() as { id: string }[];
+		database.prepare("DELETE FROM feed_sources WHERE id LIKE 'e2e-feed-%'").run();
+		for (const piece of pieceIds) database.prepare('DELETE FROM pieces WHERE id = ?').run(piece.id);
+		const accessIds = database
+			.prepare("SELECT id FROM technical_accesses WHERE name LIKE 'E2E API-Zugang%'")
+			.all() as { id: string }[];
+		for (const access of accessIds) {
+			database.prepare('DELETE FROM audit_events WHERE target_id = ?').run(access.id);
+			database.prepare('DELETE FROM technical_accesses WHERE id = ?').run(access.id);
+		}
+	})();
+	database.close();
+}
+
 function addPresentationFixture() {
 	const dataDirectory = process.env.SENDEWERK_E2E_DATA_DIR;
 	if (!dataDirectory) throw new Error('E2E-Datenverzeichnis ist nicht konfiguriert.');
@@ -364,6 +438,23 @@ function setSectionDuration(sectionId: string, seconds: number | null) {
 	database.close();
 }
 
+function setUsagePreparation(
+	usageId: string,
+	status: 'preparing' | 'ready',
+	effort: 'low' | 'medium' | 'high' | null
+) {
+	const dataDirectory = process.env.SENDEWERK_E2E_DATA_DIR;
+	if (!dataDirectory) throw new Error('E2E-Datenverzeichnis ist nicht konfiguriert.');
+	const database = new Database(path.join(dataDirectory, 'e2e.sqlite'));
+	database
+		.prepare(
+			`UPDATE piece_usages SET preparation_status_snapshot = ?,
+			 preparation_effort_snapshot = ? WHERE id = ?`
+		)
+		.run(status, effort, usageId);
+	database.close();
+}
+
 test.beforeAll(async ({ browser }) => {
 	const page = await browser.newPage();
 	await page.goto('/');
@@ -665,7 +756,6 @@ test('show overview switches persistently between list, calendar and mobile agen
 		const octoberDay = page
 			.locator('.show-calendar-day')
 			.filter({ hasText: 'Kalender Frühtermin' });
-		await expect(octoberDay).toHaveClass(/today/);
 		await expect(octoberDay).toContainText('Kalender Spättermin');
 		await expect(octoberDay.locator('.show-calendar-event')).toHaveCount(2);
 		await expect(octoberDay.locator('.show-calendar-event').first()).toContainText('10:00');
@@ -703,6 +793,43 @@ test('show overview switches persistently between list, calendar and mobile agen
 	}
 });
 
+test('preparation opens and updates the concrete scheduled usage', async ({ page }) => {
+	setUsagePreparation('usage-console', 'preparing', 'high');
+	try {
+		await page.goto('/sendungen');
+		const preparation = page.locator('.preparation-overview');
+		await expect(preparation).toContainText('Die kleine Konsole mit dem großen Dreh');
+		await expect(preparation).toContainText('Hoch');
+		await preparation.getByRole('link', { name: /Die kleine Konsole/ }).click();
+		await expect(page).toHaveURL(/usage=usage-console/);
+
+		const editor = page.getByRole('dialog', {
+			name: 'Die kleine Konsole mit dem großen Dreh'
+		});
+		await expect(editor).toBeVisible();
+		await editor.getByRole('button', { name: 'Präsentation', exact: true }).click();
+		await expect(editor.getByRole('radio', { name: 'Text', exact: true })).toBeChecked();
+		await editor.getByRole('radio', { name: 'Nur Bild', exact: true }).check();
+		await expect(editor.getByRole('combobox', { name: 'Quelle/URL', exact: true })).toHaveCount(0);
+		await editor.getByRole('radio', { name: 'Linkvorschau', exact: true }).check();
+		await expect(editor.getByRole('combobox', { name: 'Quelle/URL', exact: true })).toBeVisible();
+		await expect(editor.getByLabel('Kartentitel')).toBeVisible();
+		await editor.getByRole('radio', { name: 'Video', exact: true }).check();
+		await expect(editor.getByRole('combobox', { name: 'Video-URL', exact: true })).toBeVisible();
+		await expect(editor.getByLabel('Videotitel')).toBeVisible();
+		await editor.getByRole('radio', { name: 'Text', exact: true }).check();
+		await editor.getByRole('button', { name: 'Sendungstext', exact: true }).click();
+		await editor.getByText('Dauer und Einplanung', { exact: true }).click();
+		await editor.getByLabel('Vorbereitungsstatus').selectOption('ready');
+		await editor.getByRole('button', { name: 'Verwendung speichern' }).click();
+
+		await page.goto('/sendungen');
+		await expect(page.locator('.preparation-overview')).toHaveCount(0);
+	} finally {
+		setUsagePreparation('usage-console', 'ready', null);
+	}
+});
+
 test('desktop builder keeps the fundus beside the wider run sheet', async ({ page }, testInfo) => {
 	await page.setViewportSize({ width: 1280, height: 900 });
 	await page.goto('/fundus');
@@ -1106,6 +1233,7 @@ test('inbox, archive and administration stay concise', async ({ page }) => {
 		await topicIconPicker.getByText('Icon auswählen', { exact: true }).click();
 		const popover = topicIconPicker.locator('.icon-picker-popover');
 		await expect(popover).toBeVisible();
+		await expect(topicIconPicker.getByPlaceholder('Icon suchen')).toBeFocused();
 		const popoverBox = await popover.boundingBox();
 		expect(popoverBox?.x ?? -1).toBeGreaterThanOrEqual(0);
 		expect((popoverBox?.x ?? width) + (popoverBox?.width ?? 1)).toBeLessThanOrEqual(width);
@@ -1119,6 +1247,124 @@ test('inbox, archive and administration stay concise', async ({ page }) => {
 	await expect(topicIconPicker.locator('input[type="hidden"]')).toHaveValue('satellite-dish');
 });
 
+test('rss selection and integration catalogs keep deliberate choices', async ({
+	page
+}, testInfo) => {
+	addRssSelectionFixture();
+	try {
+		await page.context().route('https://example.org/**', (route) =>
+			route.fulfill({
+				contentType: 'text/html',
+				body: '<!doctype html><title>RSS-Original</title>'
+			})
+		);
+		await page.setViewportSize({ width: 1100, height: 760 });
+		await setTheme(page, 'light');
+		await page.goto('/eingang');
+		const rssPanel = page.locator('.rss-inbox-panel');
+		await expect(rssPanel).toContainText('45 Beiträge sind verfügbar');
+		await rssPanel.getByRole('button', { name: 'RSS-Beiträge auswählen' }).click();
+		const rssDialog = page.getByRole('dialog', { name: 'RSS-Beiträge auswählen' });
+		await expect(rssDialog).toBeVisible();
+		await expect(rssDialog.getByRole('option')).toHaveCount(20);
+		await rssDialog.getByRole('button', { name: 'E2E Quelle B' }).click();
+		await expect(rssDialog).toContainText('25 verfügbare Beiträge');
+
+		const firstChoice = rssDialog.getByRole('option', { name: /E2E Quelle A Beitrag 25/ });
+		await firstChoice.press('Enter');
+		await expect(firstChoice).toHaveAttribute('aria-selected', 'true');
+		const [original] = await Promise.all([
+			page.waitForEvent('popup'),
+			firstChoice.getByRole('link', { name: 'Original öffnen' }).click()
+		]);
+		await original.close();
+		await expect(firstChoice).toHaveAttribute('aria-selected', 'true');
+		await rssDialog.getByRole('button', { name: 'Weiter' }).click();
+		const secondChoice = rssDialog.getByRole('option', { name: /E2E Quelle A Beitrag 1/ });
+		await secondChoice.press(' ');
+		await expect(secondChoice).toHaveAttribute('aria-selected', 'true');
+		await rssDialog.getByRole('button', { name: 'E2E Quelle B' }).click();
+		await expect(
+			rssDialog.getByRole('button', { name: 'Auswahl in den Eingang übernehmen (2)' })
+		).toBeEnabled();
+
+		await page.setViewportSize({ width: 390, height: 844 });
+		await page.evaluate(() => (document.documentElement.dataset.theme = 'dark'));
+		await expectNoHorizontalOverflow(page);
+		await expect(
+			rssDialog.getByRole('button', { name: 'Auswahl in den Eingang übernehmen (2)' })
+		).toBeVisible();
+		await page.screenshot({ path: testInfo.outputPath('rss-selection-mobile-dark.png') });
+		await rssDialog.getByRole('button', { name: 'Auswahl in den Eingang übernehmen (2)' }).click();
+		await expect(page.getByRole('status')).toContainText('2 Beiträge in den Eingang übernommen');
+		await expect(rssPanel).toContainText('43 Beiträge sind verfügbar');
+		await expect(page.getByText('E2E Quelle A Beitrag 25', { exact: true })).toBeVisible();
+		await rssPanel.getByRole('button', { name: 'RSS-Beiträge auswählen' }).click();
+		await expect(rssDialog.getByText('E2E Quelle A Beitrag 25', { exact: true })).toHaveCount(0);
+		await expect(rssDialog.getByText('E2E Quelle A Beitrag 1', { exact: true })).toHaveCount(0);
+		await rssDialog.getByRole('button', { name: 'RSS-Auswahl schließen' }).click();
+
+		await page.setViewportSize({ width: 1100, height: 800 });
+		await setTheme(page, 'light');
+		await page.goto('/verwaltung');
+		await page.getByRole('button', { name: 'Feed hinzufügen' }).click();
+		let feedDialog = page.getByRole('dialog', { name: 'Feed hinzufügen' });
+		await feedDialog.getByLabel('Name').fill('E2E Feed Verwaltung');
+		await feedDialog.getByLabel('Feed-URL').fill('https://example.org/e2e-admin.xml');
+		await feedDialog.getByLabel('Intervall in Minuten').fill('90');
+		await feedDialog.getByLabel('Standardkategorie').selectOption({ index: 1 });
+		await feedDialog.getByRole('button', { name: 'Feed anlegen' }).click();
+		const feedEntry = page.getByRole('button', { name: 'E2E Feed Verwaltung bearbeiten' });
+		await expect(feedEntry).toBeVisible();
+		await feedEntry.click();
+		feedDialog = page.getByRole('dialog', { name: 'E2E Feed Verwaltung' });
+		await feedDialog.getByLabel('Name').fill('E2E Feed Verwaltung bearbeitet');
+		await feedDialog.getByLabel('Intervall in Minuten').fill('120');
+		await feedDialog.getByRole('button', { name: 'Änderungen speichern' }).click();
+		await expect(
+			page.getByRole('button', { name: 'E2E Feed Verwaltung bearbeitet bearbeiten' })
+		).toBeVisible();
+		await page.setViewportSize({ width: 390, height: 844 });
+		await page.evaluate(() => (document.documentElement.dataset.theme = 'dark'));
+		await page.getByRole('button', { name: 'E2E Feed Verwaltung bearbeitet bearbeiten' }).click();
+		feedDialog = page.getByRole('dialog', { name: 'E2E Feed Verwaltung bearbeitet' });
+		await expect(feedDialog.getByRole('button', { name: 'Änderungen speichern' })).toBeVisible();
+		await expectNoHorizontalOverflow(page);
+		await page.screenshot({ path: testInfo.outputPath('feed-editor-mobile-dark.png') });
+		await feedDialog.getByRole('button', { name: 'Feeddialog schließen' }).click();
+
+		await page.setViewportSize({ width: 1100, height: 800 });
+		await page.evaluate(() => (document.documentElement.dataset.theme = 'light'));
+		await page.context().grantPermissions(['clipboard-read', 'clipboard-write']);
+		await page.getByRole('button', { name: 'Zugang hinzufügen' }).click();
+		let accessDialog = page.getByRole('dialog', { name: 'API-Zugang hinzufügen' });
+		await accessDialog.getByLabel('Name').fill('E2E API-Zugang');
+		await accessDialog.getByLabel('Berechtigung').selectOption('read_write');
+		await accessDialog.getByRole('button', { name: 'Zugang anlegen' }).click();
+		await expect(accessDialog.getByText('Token, einmalig sichtbar')).toBeVisible();
+		const token = await accessDialog.locator('code').textContent();
+		expect(token?.length ?? 0).toBeGreaterThan(20);
+		await accessDialog.getByRole('button', { name: 'Token kopieren' }).click();
+		await expect(accessDialog.getByText('Token kopiert.')).toBeVisible();
+		expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(token);
+		await accessDialog.getByRole('button', { name: 'Zugangsdialog schließen' }).click();
+		await page.getByRole('button', { name: 'E2E API-Zugang bearbeiten' }).click();
+		accessDialog = page.getByRole('dialog', { name: 'E2E API-Zugang' });
+		await accessDialog.getByLabel('Name').fill('E2E API-Zugang bearbeitet');
+		await accessDialog.getByLabel('Berechtigung').selectOption('read');
+		await accessDialog.getByRole('button', { name: 'Änderungen speichern' }).click();
+		await expect(
+			page.getByRole('button', { name: 'E2E API-Zugang bearbeitet bearbeiten' })
+		).toContainText('Nur lesen');
+		await page.screenshot({
+			path: testInfo.outputPath('integration-catalogs-light.png'),
+			fullPage: true
+		});
+	} finally {
+		removeIntegrationFixtures();
+	}
+});
+
 test('tools stay editable in pieces after catalog deactivation', async ({ page }, testInfo) => {
 	await page.goto('/verwaltung');
 	for (const width of [390, 1280]) {
@@ -1212,8 +1458,9 @@ test('validated YouTube and TikTok players switch without exposing private field
 		);
 		await page.goto('/live?show=e2e-presentation');
 		await page.getByText('Menü', { exact: true }).click();
+		await page.getByText('Ausgabe einrichten', { exact: true }).click();
 		const popupPromise = page.waitForEvent('popup');
-		await page.getByRole('button', { name: 'Ausgabe verbinden und öffnen' }).click();
+		await page.getByRole('button', { name: 'Mit dieser Sendung verbinden und öffnen' }).click();
 		const output = await popupPromise;
 		await expect(output.locator('.output-content')).toHaveCount(0);
 		await expect(output.locator('.heinzlive-output')).toHaveClass(/empty/);
@@ -1276,6 +1523,14 @@ test('live control persists state and exposes only explicit presentation data',
 	});
 	await page.getByLabel('Alternativtext').fill('Kleine Konsole im Live-Bild');
 	await page.getByRole('button', { name: 'Bild hochladen' }).click();
+	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
+	await page.getByRole('radio', { name: 'Nur Bild', exact: true }).check();
+	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
+	await page.reload();
+	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
+	await expect(page.getByRole('radio', { name: 'Nur Bild', exact: true })).toBeChecked();
+	await page.getByRole('radio', { name: 'Text', exact: true }).check();
+	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
 	await page.goto('/sendungen/show-october');
 	const plannedConsole = page
 		.locator('.editable-usage')
@@ -1298,11 +1553,23 @@ test('live control persists state and exposes only explicit presentation data',
 	const liveMenu = page.getByRole('dialog', { name: 'Regiemenü' });
 	await expect(liveMenu).toBeVisible();
 	await expect(liveMenu).toContainText('Herbstsendung: Kleine Welten');
+	await expect(liveMenu).toContainText('Läuft');
 	await expect(liveMenu.getByRole('button', { name: 'Live-Stand wiederaufnehmen' })).toHaveCount(0);
+	await expect(liveMenu.getByRole('button', { name: 'Pausieren', exact: true })).toHaveCount(0);
+	await expect(liveMenu.getByRole('button', { name: 'Fortsetzen', exact: true })).toHaveCount(0);
+	await expect(liveMenu.getByText(/zurücksetzen/)).toHaveCount(0);
 	await expect(page.getByRole('button', { name: 'Schrift verkleinern' })).toBeFocused();
 	await page.keyboard.press('Escape');
 	await expect(liveMenu).toBeHidden();
 	await expect(liveMenuTrigger).toBeFocused();
+	await page.getByRole('button', { name: 'Sendung pausieren' }).click();
+	await expect(page.getByRole('button', { name: 'Sendung fortsetzen' })).toBeVisible();
+	await liveMenuTrigger.click();
+	await expect(liveMenu).toContainText('Pausiert');
+	await expect(liveMenu.getByRole('button', { name: 'Fortsetzen', exact: true })).toHaveCount(0);
+	await page.keyboard.press('Escape');
+	await page.getByRole('button', { name: 'Sendung fortsetzen' }).click();
+	await expect(page.getByRole('button', { name: 'Sendung pausieren' })).toBeVisible();
 	await liveMenuTrigger.press('Enter');
 	await expect(liveMenu).toBeVisible();
 	await page.locator('.live-current').click({ position: { x: 8, y: 8 } });
@@ -1330,9 +1597,10 @@ test('live control persists state and exposes only explicit presentation data',
 	await expect(page.locator('.research-details')).toHaveAttribute('open', '');
 
 	await page.getByText('Menü', { exact: true }).click();
+	await page.getByText('Ausgabe einrichten', { exact: true }).click();
 	const [popup] = await Promise.all([
 		page.waitForEvent('popup'),
-		page.getByRole('button', { name: 'Ausgabe verbinden und öffnen' }).click()
+		page.getByRole('button', { name: 'Mit dieser Sendung verbinden und öffnen' }).click()
 	]);
 	await popup.waitForURL(/\/heinzlive\/default#/);
 	const outputUrl = popup.url();
@@ -1414,8 +1682,11 @@ test('live control persists state and exposes only explicit presentation data',
 			.locator('.live-run-item.current')
 			.filter({ hasText: 'Warum praktische Effekte wieder auffallen' })
 	).toBeVisible();
-	await expect(page.getByRole('button', { name: 'Überspringen' })).toBeDisabled();
+	await expect(
-	await expect(page.getByRole('button', { name: /Erledigen/ })).toBeDisabled();
+		page.locator('.live-action-bar').getByRole('button', { name: 'Wiederaufnehmen', exact: true })
+	).toBeVisible();
+	await expect(page.getByRole('button', { name: 'Überspringen' })).toHaveCount(0);
+	await expect(page.getByRole('button', { name: /Erledigen/ })).toHaveCount(0);
 	await expect(
 		output.getByRole('heading', { name: 'Die kleine Konsole mit dem großen Dreh' })
 	).toBeVisible();
@@ -1647,12 +1918,19 @@ test('live control persists state and exposes only explicit presentation data',
 		window.open = () => null;
 	});
 	await page.getByText('Menü', { exact: true }).click();
-	await page.getByRole('button', { name: 'Ausgabe verbinden und öffnen' }).click();
+	await page.getByText('Ausgabe einrichten', { exact: true }).click();
+	await page.getByRole('button', { name: 'Ausgabe öffnen' }).click();
 	await expect(
 		page
 			.getByRole('status')
 			.filter({ hasText: 'Präsentationsfenster konnte nicht geöffnet werden' })
 	).toBeVisible();
+	await page.getByText('Menü', { exact: true }).click();
+	page.once('dialog', (dialog) => dialog.accept());
+	await page.getByRole('button', { name: 'Sendung beenden' }).click();
+	await page.getByText('Menü', { exact: true }).click();
+	await expect(page.getByRole('dialog', { name: 'Regiemenü' })).toContainText('Lauf beendet');
+	await expect(page.getByRole('button', { name: 'Beendeten Lauf wiederaufnehmen' })).toBeVisible();
 	await anonymous.close();
 	await popup.close();
 	await expectNoHorizontalOverflow(page);
@@ -1737,10 +2015,31 @@ test('completion, archive and protected guest sharing work end to end', async ({
 		await expect(page.getByText('Gesendeter Abschlussbeitrag')).toBeVisible();
 		await expect(page.getByText('Übersprungener Abschlussbeitrag')).toBeVisible();
 		await expect(page.getByRole('button', { name: 'Sendungsdaten speichern' })).toHaveCount(0);
+		expect(
+			await page
+				.locator('.historical-section')
+				.first()
+				.evaluate((element) => Number.parseFloat(getComputedStyle(element).paddingInlineStart))
+		).toBeGreaterThan(0);
 
 		await page.goto('/verwaltung');
+		const shareCatalog = page.locator('.share-catalog-panel');
+		await expect(shareCatalog).toBeVisible();
+		const catalogOrder = await page.evaluate(() => {
+			const share = document.querySelector('.share-catalog-panel')?.getBoundingClientRect();
+			const tools = document.querySelector('.tool-management')?.getBoundingClientRect();
+			return share && tools ? share.bottom <= tools.top : false;
+		});
+		expect(catalogOrder).toBe(true);
 		await page.getByRole('button', { name: 'Lesefreigaben' }).click();
 		const shareManagement = page.locator('.share-management');
+		await expect(page.locator('.share-management-dialog')).toBeVisible();
+		const dialogStyle = await page.locator('.share-management-dialog').evaluate((element) => ({
+			borderRadius: Number.parseFloat(getComputedStyle(element).borderRadius),
+			background: getComputedStyle(element).backgroundColor
+		}));
+		expect(dialogStyle.borderRadius).toBeGreaterThan(0);
+		expect(dialogStyle.background).not.toBe('rgba(0, 0, 0, 0)');
 		await shareManagement.getByLabel('Sendung').selectOption('e2e-completion');
 		await shareManagement.getByLabel('Informationsumfang').selectOption('moderation');
 		await shareManagement.getByLabel('Optionales Passwort').fill('E2E-Freigabe-Passwort');
@@ -1768,6 +2067,12 @@ test('completion, archive and protected guest sharing work end to end', async ({
 		await expect(guestPage.getByText('PRIVATE_FREIGABE_RECHERCHE')).toHaveCount(0);
 		await expect(guestPage.getByText('PRIVATE_FREIGABE_NOTIZ')).toHaveCount(0);
 		await expect(guestPage.getByAltText('Freigegebenes Abschlussbild')).toBeVisible();
+		expect(
+			await guestPage
+				.locator('.shared-section')
+				.first()
+				.evaluate((element) => Number.parseFloat(getComputedStyle(element).paddingInlineStart))
+		).toBeGreaterThan(0);
 		await guestPage.setViewportSize({ width: 390, height: 844 });
 		await expectNoHorizontalOverflow(guestPage);
 		await guestPage.screenshot({ path: testInfo.outputPath('share-mobile.png'), fullPage: true });
@@ -1786,6 +2091,7 @@ test('completion, archive and protected guest sharing work end to end', async ({
 		expect(guestWrite.status()).toBe(403);
 
 		await page.goto('/verwaltung');
+		await page.getByRole('button', { name: 'Lesefreigaben' }).click();
 		const showCard = page.locator('.share-show-card').filter({ hasText: 'E2E Abschluss' });
 		await expect(showCard.getByText('Abgeschlossen')).toBeVisible();
 		const shareRow = showCard.locator('.share-row').first();
@@ -1854,7 +2160,7 @@ test('pieces autosave safely, detect conflicts and protect uploaded images', asy
 	);
 	await openEditorialField(page, 'Präsentationstext');
 	await page
-		.getByRole('textbox', { name: 'Öffentlicher Text', exact: true })
+		.getByRole('textbox', { name: 'Öffentlicher Vorspann', exact: true })
 		.fill('## Sichere Vorschau\n\n<script>globalThis.e2eXss = true</script> **sichtbar**');
 	await openEditorialField(page, 'Private Recherche');
 	await page.getByRole('button', { name: 'Quelle hinzufügen' }).click();
@@ -2002,7 +2308,7 @@ test('a quickly captured video can be written and previewed before classificatio
 
 	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
 	await page.getByRole('radio', { name: 'Video', exact: true }).check();
-	await page.getByRole('combobox', { name: 'Quelle', exact: true }).selectOption('0');
+	await page.getByRole('combobox', { name: 'Video-URL', exact: true }).selectOption('0');
 	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
 
 	const previewPromise = page.waitForEvent('popup');
@@ -2028,9 +2334,10 @@ test('link preview uses one existing source, persists manual fields and isolates
 	await page.goto('/fundus/piece-console');
 	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
 	await page.getByRole('radio', { name: 'Linkvorschau', exact: true }).check();
-	await page.getByRole('combobox', { name: 'Quelle', exact: true }).selectOption('0');
+	await page.getByRole('combobox', { name: 'Quelle/URL', exact: true }).selectOption('0');
 	await page.getByLabel('Kartentitel').fill('Manuell korrigierte Linkvorschau');
 	await page.getByLabel('Anreißer').fill('Ein kurzer manueller Anreißer ohne Vorschaubild.');
+	await page.getByLabel('Vorschaubild-URL').fill('');
 	await expect(page.locator('.save-indicator')).toContainText('Gespeichert', { timeout: 10_000 });
 	await page.reload();
 	await page.getByRole('button', { name: 'Präsentation', exact: true }).click();
@@ -2046,7 +2353,7 @@ test('link preview uses one existing source, persists manual fields and isolates
 		preview.getByRole('heading', { name: 'Manuell korrigierte Linkvorschau' })
 	).toBeVisible();
 	await expect(preview.getByText('Ein kurzer manueller Anreißer ohne Vorschaubild.')).toBeVisible();
-	await expect(preview.locator('.output-link-image')).toHaveCount(1);
+	await expect(preview.locator('.output-link-image')).toHaveCount(0);
 	await preview.screenshot({
 		path: testInfo.outputPath('linkvorschau-desktop.png'),
 		fullPage: true