Merge: Phase 2 - Komfort (v0.2.0)

Lego-Import ueber Rebrickable, Barcode-Scanner, Fehlteile je
Sammlungseintrag, Einladungslinks, Export und Import des gesamten
Bestands sowie die PWA mit offline lesbarem Katalog.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -27,6 +27,8 @@ TZ=Europe/Berlin
 # BIND_ADDRESS=127.0.0.1
 # HOST_PORT=3000
 
-# Optional (ab Phase 2): Rebrickable-API-Key fuer den Lego-Import.
+# Optional: Rebrickable-API-Key fuer den Lego-Import. Damit reicht auf der
-# Ohne Key funktioniert alles manuell weiter.
+# Seite "Neues Set" die Setnummer, und Name, Jahr, Teile, Minifiguren, Thema
+# und Bild werden uebernommen. Ohne Key funktioniert alles manuell weiter.
+# Kostenlos anlegen: https://rebrickable.com/api/ (Konto -> Settings -> API)
 # REBRICKABLE_API_KEY=

.gitignore

@@ -23,6 +23,8 @@ next-env.d.ts
 /data-shots
 /data-docker
 /backups
+/data-test
+/data-test-export
 
 # production
 *.tsbuildinfo

CHANGELOG.md

@@ -7,6 +7,65 @@ die Versionierung [Semantic Versioning](https://semver.org/lang/de/).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-09-07
+
+Phase 2: die Handgriffe, die den Alltag schneller machen.
+
+### Hinzugefuegt
+
+**Lego-Import (Rebrickable)**
+- Auf "Neues Set" reicht die Setnummer von der Packung: Name, Jahr, Teile,
+  Minifiguren und Thema werden uebernommen, das Bild lokal gespeichert.
+- Hersteller und Thema werden bei Bedarf angelegt, ein Oberthema inklusive.
+- Alle Aufrufe laufen serverseitig. Ohne `REBRICKABLE_API_KEY` bleibt der
+  Import sichtbar, aber abgeschaltet - von Hand anlegen geht unveraendert.
+
+**Barcode-Scanner**
+- Knopf im Katalog: Strichcode mit der Handykamera scannen. Ist das Set
+  bekannt, oeffnet es sich; sonst das Formular mit ausgefuellter EAN.
+- Jeder Code wird gegen seine Pruefziffer geprueft; dekodiert wird im
+  Browser, nichts verlaesst das Geraet.
+
+**Fehlteile**
+- Fehlende Teile je Sammlungseintrag mit Teilenummer, Farbe, Anzahl und
+  Notiz, abhakbar wenn nachgekauft.
+- Die Vollstaendigkeit pflegt sich daraus selbst: der erste offene Eintrag
+  setzt "Teile fehlen", der letzte erledigte zurueck auf "vollstaendig".
+
+**Einladungen**
+- Der Admin erzeugt Registrierungslinks, die genau einmal funktionieren,
+  optional an eine E-Mail-Adresse gebunden, mit waehlbarer Rolle und
+  Gueltigkeit. In der Datenbank liegt nur der Hash des Tokens.
+
+**Export und Import**
+- Alles als ZIP (Daten plus hochgeladene Dateien), nur die Daten als JSON,
+  die Sammlung als CSV mit Semikolon und BOM fuer deutsches Excel.
+- Import ersetzt die Anwendungsdaten in einer Transaktion, nur fuer
+  Administratoren und nur nach getipptem ERSETZEN.
+- Nicht im Export: Konten, Passwoerter, Passkeys, Reservierungen und
+  Teilen-Links.
+
+**PWA**
+- Manifest, Icons und Service Worker: installierbar auf dem Startbildschirm,
+  mit Verknuepfungen zu "Fehlende Sets" und zur Sammlung.
+- Einmal geladene Seiten bleiben ohne Verbindung lesbar; Set-Bilder und
+  Build-Dateien kommen aus dem Cache. Beim Abmelden wird der Cache geraeumt.
+
+### Geaendert
+
+- `src/env.ts` behandelt leere Werte wie nicht gesetzt: ein `BASE_URL=` in der
+  `.env` fuehrte bisher zum Start-Abbruch statt zum Standardwert.
+- Unit-Tests koennen jetzt auch Server-Module laden (`server-only` wird in der
+  Testumgebung durch ein leeres Modul ersetzt).
+
+### Bekannte Einschraenkungen
+
+- Rebrickable liefert keine Anleitungsdateien. Der Import legt stattdessen
+  einen Link auf die LEGO-Serviceseite zur Setnummer an.
+- Der Barcode-Scanner braucht wie Passkeys HTTPS.
+- Beim Import wandern Wunschlisten an den importierenden Admin und sind
+  zunaechst nicht geteilt.
+
 ## [0.1.0] - 2026-09-07
 
 Erste lauffaehige Fassung: Phase 1 vollstaendig, im Docker-Stack verifiziert.
@@ -88,5 +147,6 @@ Erste lauffaehige Fassung: Phase 1 vollstaendig, im Docker-Stack verifiziert.
 - Unter Windows scheitert `pnpm build` an fehlenden Symlink-Rechten. Der
   Docker-Build unter Linux ist davon nicht betroffen.
 
-[Unreleased]: https://git.wilde-server.de/florian.wilde/bricktrack/compare/v0.1.0...HEAD
+[Unreleased]: https://git.wilde-server.de/florian.wilde/bricktrack/compare/v0.2.0...HEAD
+[0.2.0]: https://git.wilde-server.de/florian.wilde/bricktrack/releases/tag/v0.2.0
 [0.1.0]: https://git.wilde-server.de/florian.wilde/bricktrack/releases/tag/v0.1.0

CLAUDE.md

@@ -19,6 +19,9 @@ teilbare Wunschlisten.
 | Validierung | zod (serverseitig, immer) | |
 | Bilder | sharp (nur serverseitig, Thumbnails) | |
 | Tests | Vitest (Unit), Playwright (E2E, Screenshots) | |
+| PDF | pdfjs-dist, lokal gebuendelt | kein CDN |
+| Barcode | @zxing/browser, lazy geladen | nur beim Scannen |
+| Archive | fflate | Export/Import als ZIP |
 | Paketmanager | pnpm 10 | |
 
 Bewusst **kein** Prisma (Standalone-Build im Container), **keine**
@@ -43,6 +46,20 @@ Bild-URLs, die der Nutzer selbst hinterlegt hat.
 - Commits: Conventional Commits, Betreff auf Deutsch, Imperativ,
   erste Zeile <= 72 Zeichen.
 
+## Wichtige Module
+
+| Datei | Zustaendig fuer |
+|---|---|
+| `src/lib/ownership.ts` | die eine Definition von "hat er" / "hat er nicht" |
+| `src/lib/wishlist-logic.ts` | Mehrfachauswahl, Dubletten, Prioritaeten (rein, testbar) |
+| `src/lib/tokens.ts` | Share-, Storno- und Einladungs-Token |
+| `src/lib/invites.ts` | Einladungen inklusive der Freigabe fuer die Registrierung |
+| `src/lib/rebrickable.ts` | Lego-Import, ausschliesslich serverseitig |
+| `src/lib/set-number.ts`, `src/lib/ean.ts` | Setnummern und Barcodes (rein, testbar) |
+| `src/lib/uploads.ts` | Datei-Uploads, Magic Bytes, Thumbnails |
+| `src/lib/export.ts` | Export und Import des gesamten Bestands |
+| `src/lib/money.ts`, `src/lib/format.ts` | Cent-Umrechnung, dd.MM.yyyy |
+
 ## Befehle
 
 ```bash
@@ -58,8 +75,22 @@ pnpm db:studio      # Drizzle Studio
 pnpm test           # Vitest
 pnpm test:e2e       # Playwright
 pnpm screenshots    # Screenshots fuer docs/ANLEITUNG.md erzeugen
+
+node scripts/generate-icons.mjs   # PWA-Icons aus der SVG-Quelle rendern
 ```
 
+### Testkonventionen
+
+- Unit-Tests liegen in `tests/unit`, laufen unter Node und duerfen auch
+  Server-Module laden: `server-only` ist in `vitest.config.mts` auf einen
+  leeren Stub gemappt.
+- `tests/setup-env.ts` setzt Platzhalter fuer die Umgebung. `BASE_URL` wird
+  dort **immer** ueberschrieben, weil Vite denselben Namen fuer seinen
+  Public-Base-Path benutzt und ihn auf `/` setzt.
+- Der Playwright-Smoke-Test nutzt `./data-e2e`, der Screenshot-Lauf
+  `./data-shots` gegen das Produktions-Image. Beide Verzeichnisse werden vor
+  jedem Lauf geleert und liegen nie im Git.
+
 ## Datenmodell
 
 Kernregel: Ein **`set`** ist ein *Katalogeintrag* - es existiert,
@@ -145,13 +176,19 @@ Session.
    serverseitig.
 5. Session-Cookies: `httpOnly`, `secure`, `sameSite=lax`.
    Rate-Limiting auf den Login-Endpunkten.
+6. Der Export enthaelt **keine** Konten, Passwoerter oder Passkeys - und
+   keine Reservierungen oder Teilen-Token. Das Backup ist `./data`, nicht der
+   Export.
+7. Der Service Worker beantwortet nur GET-Anfragen aus dem Cache und niemals
+   `/api/auth`, `/api/export` oder den Healthcheck. Beim Abmelden wird der
+   Cache geleert.
 
 ## Phasenplan
 
 - **Phase 1 (MVP)** - Auth mit Passkeys, Stammdaten, Katalog, Sammlung,
-  Wunschlisten inkl. oeffentlicher Ansicht, Docker-Stack.
+  Wunschlisten inkl. oeffentlicher Ansicht, Docker-Stack. *Fertig in 0.1.0.*
 - **Phase 2 (Komfort)** - Rebrickable-Import, Barcode-Scanner, Fehlteile,
-  Einladungen, Export/Import, PWA.
+  Einladungen, Export/Import, PWA. *Fertig in 0.2.0.*
 - **Phase 3 (Nice to have)** - mehrere Sammler, Preisbeobachtung,
   E-Mail-Erinnerungen, Dublettenpruefung.
 

README.md

@@ -172,10 +172,16 @@ pnpm dev                   # http://localhost:3000
 | `pnpm build` | Produktionsbuild (standalone) |
 | `pnpm lint` / `pnpm typecheck` | ESLint / TypeScript – beide müssen sauber sein |
 | `pnpm test` | Unit-Tests (Vitest) |
-| `pnpm test:e2e` | Playwright-Smoke-Test gegen ein eigenes `./data-e2e` |
+| `pnpm test:e2e` | Playwright-Smoke-Test gegen das Docker-Image (eigenes `./data-e2e`) |
 | `pnpm db:generate` | SQL-Migration aus dem Drizzle-Schema erzeugen |
 | `pnpm db:migrate` | Migrationen anwenden |
 | `pnpm db:studio` | Drizzle Studio |
+| `pnpm screenshots` | Bilder für `docs/ANLEITUNG.md` neu erzeugen |
+
+`pnpm test:e2e` und `pnpm screenshots` bauen jeweils das Docker-Image und
+fahren es hoch. Sie brauchen also einen laufenden Docker-Daemon, testen dafür
+aber genau das Artefakt, das später auch deployt wird – der Dev-Server hat
+unter der Last eines ganzen Durchlaufs reproduzierbar Chunks verloren.
 
 > **Unter Windows** schlägt `pnpm build` mit `EPERM … symlink` fehl: der
 > Standalone-Output legt Symlinks an, wofür Windows den Entwicklermodus oder

docs/ANLEITUNG.md

@@ -22,7 +22,12 @@ Kinderzimmer, nicht für den Schreibtisch.
 8. [Wunschlisten](#8-wunschlisten)
 9. [Teilen – so sehen es Oma und Tante Anne](#9-teilen)
 10. [Passkeys einrichten](#10-passkeys-einrichten)
-11. [Antworten auf die zwei wichtigen Fragen](#11-die-zwei-fragen)
+11. [Sets im Schnellverfahren: Import und Scanner](#11-import-und-scanner)
+12. [Fehlteile](#12-fehlteile)
+13. [Noch ein Konto für die Familie](#13-einladungen)
+14. [Daten sichern, umziehen, auswerten](#14-daten)
+15. [Auf den Startbildschirm legen](#15-startbildschirm)
+16. [Antworten auf die zwei wichtigen Fragen](#16-die-zwei-fragen)
 
 ---
 
@@ -291,7 +296,130 @@ gib ihnen sprechende Namen.
 
 ---
 
-## 11. Die zwei Fragen
+## 11. Import und Scanner
+
+Sets von Hand einzutippen ist der langsame Weg. Für Lego gibt es zwei
+schnellere.
+
+### Lego-Import über die Setnummer
+
+![Lego-Import](bilder/17-lego-import.png)
+
+Auf **Katalog → Set anlegen** steht oben das Feld für den Import. Setnummer
+von der Packung eintippen, „Holen" – und Name, Jahr, Teile, Minifiguren und
+Thema stehen drin. Das Bild wird **lokal gespeichert**, funktioniert also auch
+weiter, wenn die Quelle es irgendwann austauscht. Fehlen Hersteller oder
+Thema noch, legt der Import sie an.
+
+Dafür braucht es einen kostenlosen API-Key von
+[rebrickable.com/api](https://rebrickable.com/api/), eingetragen als
+`REBRICKABLE_API_KEY` in der `.env`. Ohne Key steht an derselben Stelle ein
+Hinweis, und alles andere funktioniert unverändert weiter.
+
+> Anleitungsdateien liefert Rebrickable nicht. Der Import legt stattdessen
+> einen Link auf die LEGO-Serviceseite zur Setnummer an – von dort kommst du
+> zum PDF, das du dann hochladen kannst.
+
+### Barcode scannen
+
+Im Katalog sitzt neben „Set anlegen" ein Scanner-Symbol. Strichcode der
+Packung ins Bild halten:
+
+- **Set schon im Katalog** → es öffnet sich direkt. Genau das, was man im
+  Laden vor dem Regal wissen will.
+- **Noch unbekannt** → das Formular „Neues Set" öffnet sich mit
+  ausgefüllter EAN.
+
+Gelesen wird ausschließlich im Browser, es geht nichts an einen fremden
+Dienst. Jeder Code wird gegen seine Prüfziffer geprüft – verlesene Ziffern
+landen so gar nicht erst im Katalog. Die Kamera braucht wie Passkeys HTTPS.
+
+---
+
+## 12. Fehlteile
+
+![Fehlteile](bilder/18-fehlteile.png)
+
+Beim Aufbauen fehlt ein Stein. Auf der Set-Detailseite hat jeder
+Sammlungseintrag ein Puzzle-Symbol: dort trägst du ein, was fehlt – mit
+Teilenummer und Farbe, wenn du sie kennst, sonst reicht eine Notiz wie
+„Dachstein vorne links".
+
+Ist das Teil nachgekauft, hakst du es ab. Die **Vollständigkeit pflegt sich
+dabei selbst**: Der erste offene Eintrag setzt den Sammlungseintrag auf
+„Teile fehlen", der letzte erledigte zurück auf „vollständig". Der Filter in
+der Sammlung stimmt damit, ohne dass du daran denken musst.
+
+---
+
+## 13. Einladungen
+
+![Einladungen](bilder/19-einladungen.png)
+
+Die Registrierung ist nach dem ersten Konto geschlossen – sonst könnte sich
+jeder, der die Adresse kennt, ein Konto anlegen. Für den zweiten Elternteil
+gibt es deshalb **Verwaltung → Einladungen**:
+
+1. „Einladung erstellen", optional an eine E-Mail-Adresse gebunden, mit Rolle
+   und Gültigkeit.
+2. Den Link kopieren und weitergeben. Er wird **nur einmal angezeigt** – in
+   der Datenbank liegt nur sein Hash.
+3. Die eingeladene Person legt darüber ihr Konto an. Danach ist der Link
+   verbraucht.
+
+„Mitglied" darf die Sammlung pflegen und Wunschlisten anlegen; „Administrator"
+zusätzlich einladen und Daten exportieren.
+
+---
+
+## 14. Daten
+
+![Daten](bilder/20-daten.png)
+
+Unter **Verwaltung → Daten** gibt es drei Downloads:
+
+| | Wofür |
+|---|---|
+| **Alles als ZIP** | Umziehen auf einen anderen Server, zweites Netz |
+| **Nur Daten (JSON)** | Zum Reinschauen oder Weiterverarbeiten |
+| **Sammlung als CSV** | Für Excel oder LibreOffice, Semikolon-getrennt |
+
+**Nicht im Export:** Konten, Passwörter und Passkeys. Ein Export voller
+Passwort-Hashes im Download-Ordner wäre ein Risiko, kein Backup. Ebenso außen
+vor: Reservierungen und Teilen-Links – die gehören zu der Instanz, auf der sie
+entstanden sind.
+
+> **Das richtige Backup bleibt `./data`.** Ein Verzeichnis, Datenbank und
+> Dateien darin. Siehe [README](../README.md#backup-und-restore).
+
+Der **Import** liest ein solches ZIP wieder ein – und **ersetzt dabei alle
+vorhandenen Daten**. Zusammenführen zweier Sammlungen ist bewusst nicht
+möglich: Es bräuchte Konfliktregeln für jede Tabelle, und das Ergebnis wäre
+nicht vorhersagbar. Deshalb muss man zur Bestätigung `ERSETZEN` eintippen.
+Wunschlisten gehören danach dir und sind zunächst nicht geteilt.
+
+---
+
+## 15. Startbildschirm
+
+Bricktrack lässt sich wie eine App installieren:
+
+- **iPhone/iPad (Safari):** Teilen-Symbol → „Zum Home-Bildschirm".
+- **Android (Chrome):** Menü → „App installieren" bzw. „Zum Startbildschirm
+  hinzufügen".
+
+Danach startet Bricktrack ohne Browserleiste, und langes Drücken auf das Symbol
+springt direkt zu „Fehlende Sets" oder zur Sammlung.
+
+**Ohne Verbindung** bleibt lesbar, was du schon einmal geöffnet hast – der
+Katalog also, wenn du ihn vorher im WLAN durchgeblättert hast. Ändern lässt
+sich offline nichts: Eine Reservierung, die nur auf deinem Gerät liegt, wäre
+für alle anderen unsichtbar und damit eine Lüge. Beim Abmelden räumt die App
+den Zwischenspeicher, damit auf einem geteilten Gerät nichts lesbar bleibt.
+
+---
+
+## 16. Die zwei Fragen
 
 Dafür ist die ganze App gebaut:
 
@@ -302,8 +430,8 @@ Dafür ist die ganze App gebaut:
 → Katalog, Filter „Fehlt noch". Von dort in zwei Handgriffen auf eine
 Wunschliste und per Link zu Oma.
 
-Im Laden vor dem Regal: Katalog öffnen, Setnummer von der Packung eintippen.
+Im Laden vor dem Regal: Scanner öffnen, Strichcode einlesen. Steht ein grüner
-Steht ein grüner Haken dran, habt ihr es schon.
+Haken dran, habt ihr es schon.
 
 ---
 

docs/DEVLOG.md

@@ -29,6 +29,22 @@ Commit-Spalte verweist auf den Stand am Ende des Schritts.
 
 **Summe Phase 1: 2:44**
 
+## Phase 2 – Komfort (v0.2.0)
+
+### 07.09.2026
+
+| Von | Bis | Dauer | Schritt | Ergebnis | Commit |
+|---|---|---|---|---|---|
+| 06:50 | 07:01 | 0:11 | Einladungen | Admin erzeugt einmal gültige Registrierungslinks; Freigabe über AsyncLocalStorage, damit die Rolle nicht aus dem Formular kommen kann. Smoke-Test deckt den ganzen Weg ab | `52d69e5` |
+| 07:01 | 07:12 | 0:11 | Rebrickable-Import | Setnummer genügt: Metadaten, Thema und lokal gespeichertes Bild; 14 Tests gegen gestubbtes `fetch` inklusive aller Fehlerfälle | `4e3cbb8` |
+| 07:12 | 07:15 | 0:03 | Barcode-Scanner | EAN mit der Handykamera, Prüfziffer-Kontrolle, zxing wird erst beim Öffnen geladen | `baa94bf` |
+| 07:15 | 07:18 | 0:03 | Fehlteile | Liste je Sammlungseintrag; Vollständigkeit pflegt sich daraus selbst | `5c5c521` |
+| 07:18 | 07:23 | 0:05 | Export und Import | ZIP, JSON und CSV; Import ersetzt in einer Transaktion, 10 Tests für den Rundweg | `45aa8f1` |
+| 07:23 | 07:27 | 0:04 | PWA | Manifest, Icons aus SVG-Quelle, Service Worker mit Offline-Katalog | `39271f8` |
+| 07:27 | 07:45 | 0:18 | Verifikation und Dokumentation | Smoke-Test, Docker-Build, Changelog 0.2.0, Anleitung und Roadmap | folgt |
+
+**Summe Phase 2: 0:55**
+
 ---
 
 ## Notizen und Entscheidungen
@@ -86,6 +102,24 @@ Commit-Spalte verweist auf den Stand am Ende des Schritts.
   Produktions-Image im Container – verlässlich und zugleich näher an dem, was
   Nutzer wirklich sehen.
 
+### Phase 2
+
+- **`server-only` in Tests**: Das Paket wirft beim Import ausserhalb einer
+  Server-Komponente, wodurch sich Servermodule nicht testen liessen. In
+  `vitest.config.mts` ist es jetzt auf einen leeren Stub gemappt – der Import
+  ist eine Build-Zeit-Absicherung, kein Verhalten.
+- **Namenskonflikt `BASE_URL`**: Vite benutzt genau diesen Namen für seinen
+  Public-Base-Path und setzt ihn auf `/`. Die Tests überschreiben ihn deshalb
+  ausdrücklich. Dabei ist aufgefallen, dass `src/env.ts` bei einem leeren Wert
+  abbrach statt auf den Standard zurückzufallen – behoben, denn ein
+  `BASE_URL=` in der `.env` ist ein realistischer Tippfehler.
+- **Rebrickable und Anleitungen**: Die API v3 stellt keine Anleitungsdateien
+  bereit. Statt das zu verschleiern, legt der Import einen externen Link auf
+  die LEGO-Serviceseite zur Setnummer an.
+- **Import statt Zusammenführen**: Zwei Sammlungen zu mischen bräuchte
+  Konfliktregeln für jede Tabelle und wäre im Ergebnis nicht vorhersagbar.
+  Der Import ersetzt deshalb – dafür mit getipptem `ERSETZEN` als Bremse.
+
 ### Beim Testen gefunden und behoben
 
 - Eine spontan aus dem Katalog angelegte Wunschliste war **nicht teilbar**:

docs/ROADMAP.md

@@ -34,17 +34,17 @@ Laeuft vollstaendig im Docker-Stack.
 - [x] Dokumentation: README, QUICKSTART, bebilderte Anleitung,
       update.sh, Nginx-Proxy-Manager-Konfiguration
 
-## Phase 2 - Komfort (Ziel: v0.2.0)
+## Phase 2 - Komfort (v0.2.0, abgeschlossen am 07.09.2026)
 
-- [ ] Rebrickable-Import: Setnummer eingeben, Metadaten und Bild
+- [x] Rebrickable-Import: Setnummer eingeben, Metadaten und Bild
       uebernehmen, Bild lokal cachen. Ohne API-Key bleibt alles manuell.
-- [ ] Barcode-Scanner (EAN) per Handykamera, Suche nach EAN, bei
+- [x] Barcode-Scanner (EAN) per Handykamera, Suche nach EAN, bei
       Unbekanntem direkt ins Formular "Neues Set"
-- [ ] Fehlteile je Sammlungseintrag pflegen
+- [x] Fehlteile je Sammlungseintrag pflegen
-- [ ] Einladungslinks durch den Admin
+- [x] Einladungslinks durch den Admin
-- [ ] Export/Import: gesamte Datenbank als JSON, Dateien als ZIP,
+- [x] Export/Import: gesamte Datenbank als JSON, Dateien als ZIP,
       Sammlung zusaetzlich als CSV
-- [ ] PWA: Manifest, Service Worker, Katalog offline lesbar
+- [x] PWA: Manifest, Service Worker, Katalog offline lesbar
 
 ## Phase 3 - Nice to have (Ziel: v0.3.0)
 

e2e/global-setup.ts

@@ -1,13 +0,0 @@
-import { execFileSync } from 'node:child_process';
-
-/**
- * Migrates the smoke-test database. The directory itself is wiped earlier by
- * scripts/reset-e2e.mjs, because Playwright starts its web server before this
- * hook runs and the open database file would block the delete on Windows.
- */
-export default function globalSetup() {
-  execFileSync('node', ['node_modules/tsx/dist/cli.mjs', 'scripts/migrate.ts'], {
-    stdio: 'inherit',
-    env: { ...process.env, DATA_DIR: './data-e2e' },
-  });
-}

e2e/screenshots.spec.ts

@@ -127,4 +127,37 @@ test('Screenshots fuer die Anleitung', async ({ page, browser }) => {
   await visit(page, '/konto');
   await expect(page.getByText('Passkeys', { exact: true })).toBeVisible();
   await shoot(page, '16-konto-passkeys');
+
+  // --- 12. Lego import ------------------------------------------------------
+  // The screenshot container runs with a placeholder API key so the manual
+  // shows the form, not the "not configured" hint. Nothing is submitted.
+  await visit(page, '/katalog/neu');
+  await expect(page.getByText('Lego-Import')).toBeVisible();
+  await shoot(page, '17-lego-import');
+
+  // --- 13. missing parts ----------------------------------------------------
+  await visit(page, '/katalog?q=60398');
+  await page.getByText('Familienhaus und Elektroauto').first().click();
+  await expect(page.getByRole('heading', { name: 'Familienhaus und Elektroauto' })).toBeVisible();
+  await page.getByRole('button', { name: 'Fehlteile' }).first().click();
+  await expect(page.getByRole('dialog')).toBeVisible();
+  await page.getByLabel('Teilenummer').fill('3001');
+  await page.getByLabel('Farbe').fill('Rot');
+  await page.getByRole('button', { name: 'Hinzufügen' }).click();
+  await expect(page.getByText('3001')).toBeVisible();
+  await page.screenshot({ path: shotPath('18-fehlteile') });
+  await page.getByRole('button', { name: 'Fertig' }).click();
+
+  // --- 14. invitations ------------------------------------------------------
+  await visit(page, '/verwaltung/einladungen');
+  await expect(page.getByRole('button', { name: 'Einladung erstellen' })).toBeVisible();
+  await page.getByRole('button', { name: 'Einladung erstellen' }).click();
+  await expect(page.getByRole('dialog')).toBeVisible();
+  await page.screenshot({ path: shotPath('19-einladungen') });
+  await page.getByRole('button', { name: 'Abbrechen' }).click();
+
+  // --- 15. export and import ------------------------------------------------
+  await visit(page, '/verwaltung/daten');
+  await expect(page.getByText('Alles als ZIP')).toBeVisible();
+  await shoot(page, '20-daten');
 });

e2e/smoke.spec.ts

@@ -81,6 +81,53 @@ test('Registrieren, Set anlegen, Wunschliste teilen und reservieren', async ({ p
   await visitorContext.close();
 });
 
+test('Einladung: zweiter Elternteil bekommt ein eigenes Konto', async ({ page, browser }) => {
+  // The admin from the first test is still the only account, so log in.
+  await page.goto('/anmelden');
+  await page.getByLabel('E-Mail').fill('test@bricktrack.local');
+  await page.getByLabel('Passwort').fill('smoketest-passwort');
+  await page.getByRole('button', { name: 'Anmelden', exact: true }).click();
+  await expect(page.getByRole('heading', { name: 'Hallo Florian' })).toBeVisible();
+
+  // --- the admin issues an invitation --------------------------------------
+  await page.goto('/verwaltung/einladungen');
+  await page.getByRole('button', { name: 'Einladung erstellen' }).click();
+  await page.getByRole('button', { name: 'Erstellen' }).click();
+
+  const inviteUrl = await page
+    .getByRole('textbox', { name: 'Einladungslink' })
+    .inputValue();
+  expect(inviteUrl).toContain('/einladung/');
+  await page.getByRole('button', { name: 'Fertig' }).click();
+  await expect(page.getByText('Offen').first()).toBeVisible();
+
+  // --- the invited person registers ----------------------------------------
+  const guestContext = await browser.newContext();
+  const guest = await guestContext.newPage();
+  await guest.goto(inviteUrl);
+  await expect(guest.getByRole('button', { name: 'Konto anlegen' })).toBeVisible();
+
+  await guest.getByLabel('Name').fill('Mama');
+  await guest.getByLabel('E-Mail').fill('mama@bricktrack.local');
+  await guest.getByLabel('Passwort').fill('zweites-passwort');
+  await guest.getByRole('button', { name: 'Konto anlegen' }).click();
+
+  await expect(guest.getByRole('heading', { name: 'Hallo Mama' })).toBeVisible();
+
+  // A member is not an admin: no invitation management for them.
+  await guest.goto('/verwaltung/einladungen');
+  await expect(guest).toHaveURL(/\/$|\/anmelden/);
+
+  // --- the link is single use ----------------------------------------------
+  const secondTry = await browser.newContext();
+  const secondPage = await secondTry.newPage();
+  await secondPage.goto(inviteUrl);
+  await expect(secondPage.getByText('Einladung ungültig')).toBeVisible();
+
+  await guestContext.close();
+  await secondTry.close();
+});
+
 test('Ohne Anmeldung fuehrt jeder geschuetzte Pfad zur Anmeldung', async ({ page }) => {
   await page.goto('/sammlung');
   await expect(page).toHaveURL(/\/anmelden|\/registrieren/);

eslint.config.mjs

@@ -11,6 +11,17 @@ const compat = new FlatCompat({
 
 const eslintConfig = [
   ...compat.extends("next/core-web-vitals", "next/typescript"),
+  {
+    rules: {
+      // Destructuring a key out in order to drop it is how we omit fields
+      // (share tokens, reservations) from an export - the binding is
+      // deliberately unused.
+      "@typescript-eslint/no-unused-vars": [
+        "warn",
+        { ignoreRestSiblings: true, argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
+      ],
+    },
+  },
   {
     ignores: [
       "node_modules/**",

package.json

@@ -19,17 +19,20 @@
     "db:studio": "drizzle-kit studio",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:e2e": "node scripts/reset-e2e.mjs && playwright test",
+    "test:e2e": "node scripts/e2e-prepare.mjs && playwright test",
     "screenshots": "node scripts/screenshots-prepare.mjs && playwright test --config=playwright.screenshots.config.ts"
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.3",
+    "@zxing/browser": "^0.2.1",
+    "@zxing/library": "^0.23.0",
     "better-auth": "^1.7.3",
     "better-sqlite3": "^13.0.3",
     "class-variance-authority": "^0.7.1",
     "cn": "^0.2.6",
     "date-fns": "^4.4.0",
     "drizzle-orm": "^0.45.2",
+    "fflate": "^0.8.3",
     "lucide-react": "^1.41.0",
     "next": "15.5.25",
     "next-themes": "^0.4.6",

playwright.config.ts

@@ -1,28 +1,29 @@
+import path from 'node:path';
 import { defineConfig, devices } from '@playwright/test';
 
 /**
  * Smoke test setup.
  *
- * Runs against its own data directory (./data-e2e) so a test never touches the
+ * Runs against the production container with its own data directory
- * real database. The global setup wipes and migrates it before each run.
+ * (./data-e2e), so a test never touches the real database and never depends on
+ * the dev server compiling fast enough.
  */
 const PORT = 3210;
 const BASE_URL = `http://localhost:${PORT}`;
 
+// Docker wants forward slashes, also on Windows.
+const dataDir = path.resolve(process.cwd(), 'data-e2e').replace(/\\/g, '/');
+
 export default defineConfig({
   testDir: './e2e',
   // The screenshot run has its own config, its own server and its own data
   // directory - it must never join the smoke run.
   testMatch: 'smoke.spec.ts',
-  globalSetup: './e2e/global-setup.ts',
   fullyParallel: false,
   workers: 1,
   retries: 0,
-  // Generous: the dev server compiles each route on first visit.
+  timeout: 90_000,
-  timeout: 240_000,
+  expect: { timeout: 15_000 },
-  // A first navigation to a route the dev server has not compiled yet can
-  // take well over ten seconds on a cold cache.
-  expect: { timeout: 30_000 },
   reporter: process.env.CI ? 'github' : 'list',
   use: {
     baseURL: BASE_URL,
@@ -38,18 +39,20 @@ export default defineConfig({
     },
   ],
   webServer: {
-    command: `pnpm exec next dev -p ${PORT}`,
+    command: [
+      'docker run --rm --name bricktrack-e2e',
+      `-p ${PORT}:3000`,
+      `-e BASE_URL=${BASE_URL}`,
+      '-e BETTER_AUTH_SECRET=playwright-smoke-test-secret-0123456789abcdef',
+      '-e TZ=Europe/Berlin',
+      '-e MAX_UPLOAD_MB=25',
+      `-v "${dataDir}:/data"`,
+      'bricktrack:e2e',
+    ].join(' '),
     url: `${BASE_URL}/api/health`,
     reuseExistingServer: false,
     timeout: 180_000,
     stdout: 'pipe',
     stderr: 'pipe',
-    env: {
-      NODE_ENV: 'development',
-      DATA_DIR: './data-e2e',
-      BASE_URL,
-      BETTER_AUTH_SECRET: 'playwright-smoke-test-secret-0123456789abcdef',
-      MAX_UPLOAD_MB: '25',
-    },
   },
 });

playwright.screenshots.config.ts

@@ -41,6 +41,9 @@ export default defineConfig({
       `-e BASE_URL=${BASE_URL}`,
       '-e BETTER_AUTH_SECRET=screenshot-run-secret-0123456789abcdefgh',
       '-e TZ=Europe/Berlin',
+      // A placeholder key so the manual shows the import form rather than the
+      // "not configured" hint. The screenshot run never submits it.
+      '-e REBRICKABLE_API_KEY=screenshot-placeholder',
       `-v "${dataDir}:/data"`,
       'bricktrack:shots',
     ].join(' '),

pnpm-lock.yaml

@@ -11,6 +11,12 @@ importers:
       '@better-auth/passkey':
         specifier: ^1.7.3
         version: 1.7.3(@better-auth/core@1.7.3(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-call@1.4.0(zod@4.5.4))(jose@6.2.12)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(better-auth@1.7.3(better-sqlite3@13.0.3)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@types/better-sqlite3@9.6.0)(better-sqlite3@13.0.3)(kysely@0.29.5))(next@15.5.25(@babel/core@7.29.7)(@playwright/test@1.63.0)(@types/node@20.19.43)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(vitest@5.0.0(@types/node@20.19.43)(vite@8.2.2(@types/node@20.19.43)(esbuild@0.25.12)(jiti@2.7.0)(tsx@4.23.13))))(better-call@1.4.0(zod@4.5.4))(nanostores@1.5.3)
+      '@zxing/browser':
+        specifier: ^0.2.1
+        version: 0.2.1(@zxing/library@0.23.0)
+      '@zxing/library':
+        specifier: ^0.23.0
+        version: 0.23.0
       better-auth:
         specifier: ^1.7.3
         version: 1.7.3(better-sqlite3@13.0.3)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@types/better-sqlite3@9.6.0)(better-sqlite3@13.0.3)(kysely@0.29.5))(next@15.5.25(@babel/core@7.29.7)(@playwright/test@1.63.0)(@types/node@20.19.43)(react-dom@19.1.0(react@19.1.0))(react@19.1.0))(react-dom@19.1.0(react@19.1.0))(react@19.1.0)(vitest@5.0.0(@types/node@20.19.43)(vite@8.2.2(@types/node@20.19.43)(esbuild@0.25.12)(jiti@2.7.0)(tsx@4.23.13)))
@@ -29,6 +35,9 @@ importers:
       drizzle-orm:
         specifier: ^0.45.2
         version: 0.45.2(@types/better-sqlite3@9.6.0)(better-sqlite3@13.0.3)(kysely@0.29.5)
+      fflate:
+        specifier: ^0.8.3
+        version: 0.8.3
       lucide-react:
         specifier: ^1.41.0
         version: 1.41.0(react@19.1.0)
@@ -2457,6 +2466,18 @@ packages:
   '@vitest/spy@5.0.0':
     resolution: {integrity: sha512-uy+luWBAPw9XfthoHi5AkfHUnuPYEESjl0p/r+meoBnU8bxg5GDQ3Ey8MjcJ6sqahkL4PFyrvfMJJBw7LbU06g==}
 
+  '@zxing/browser@0.2.1':
+    resolution: {integrity: sha512-92pVfVDUXbc15xu9vIEmhNyqIEASMEkDF92CwT6T+7sg2EHXJRktH9CQKoQSXe51UtbNsj+Fm09H/JBWHMs/Sw==}
+    peerDependencies:
+      '@zxing/library': ^0.23.0
+
+  '@zxing/library@0.23.0':
+    resolution: {integrity: sha512-6fkkoFwP8CHxl6ugnPsj74PLJgX2iRv5zczGAyt5OBzQgxFhuhF0NCEc4t4OvSr8xAv2MRLlI0Iu9ZGDZQ2urA==}
+    engines: {node: '>= 24.0.0'}
+
+  '@zxing/text-encoding@0.9.0':
+    resolution: {integrity: sha512-U/4aVJ2mxI0aDNI8Uq0wEhMgY+u4CNtEb0om3+y3+niDAsoTCOB33UF0sxpzqzdqXLqmvc+vZyAt4O8pPdfkwA==}
+
   accepts@2.0.0:
     resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
     engines: {node: '>= 0.6'}
@@ -3330,6 +3351,9 @@ packages:
       picomatch:
         optional: true
 
+  fflate@0.8.3:
+    resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==}
+
   figures@6.1.0:
     resolution: {integrity: sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg==}
     engines: {node: '>=18'}
@@ -4745,6 +4769,10 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4'
 
+  ts-custom-error@3.3.1:
+    resolution: {integrity: sha512-5OX1tzOjxWEgsr/YEUWSuPrQ00deKLh6D7OTWcvNHm12/7QPyRh8SYpyWvA4IZv8H/+GQWQEh/kwo95Q9OVW1A==}
+    engines: {node: '>=14.0.0'}
+
   ts-morph@26.0.0:
     resolution: {integrity: sha512-ztMO++owQnz8c/gIENcM9XfCEzgoGphTv+nKpYNM1bgsdOVC/jRZuEBf6N+mLLDNg68Kl+GgUZfOySaRiG1/Ug==}
 
@@ -7104,6 +7132,21 @@ snapshots:
 
   '@vitest/spy@5.0.0': {}
 
+  '@zxing/browser@0.2.1(@zxing/library@0.23.0)':
+    dependencies:
+      '@zxing/library': 0.23.0
+    optionalDependencies:
+      '@zxing/text-encoding': 0.9.0
+
+  '@zxing/library@0.23.0':
+    dependencies:
+      ts-custom-error: 3.3.1
+    optionalDependencies:
+      '@zxing/text-encoding': 0.9.0
+
+  '@zxing/text-encoding@0.9.0':
+    optional: true
+
   accepts@2.0.0:
     dependencies:
       mime-types: 3.0.2
@@ -8094,6 +8137,8 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.7
 
+  fflate@0.8.3: {}
+
   figures@6.1.0:
     dependencies:
       is-unicode-supported: 2.1.0
@@ -9555,6 +9600,8 @@ snapshots:
     dependencies:
       typescript: 5.9.3
 
+  ts-custom-error@3.3.1: {}
+
   ts-morph@26.0.0:
     dependencies:
       '@ts-morph/common': 0.27.0

public/manifest.webmanifest

@@ -0,0 +1,45 @@
+{
+  "name": "Bricktrack",
+  "short_name": "Bricktrack",
+  "description": "Sammlung und Wunschlisten für Spielzeug-Sets",
+  "lang": "de",
+  "dir": "ltr",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "orientation": "portrait",
+  "background_color": "#ffffff",
+  "theme_color": "#0a0a0a",
+  "icons": [
+    {
+      "src": "/icons/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icons/icon-maskable-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ],
+  "shortcuts": [
+    {
+      "name": "Fehlende Sets",
+      "short_name": "Fehlt noch",
+      "url": "/katalog?besitz=fehlt"
+    },
+    {
+      "name": "Sammlung",
+      "short_name": "Sammlung",
+      "url": "/sammlung"
+    }
+  ]
+}

public/sw.js

@@ -0,0 +1,122 @@
+/**
+ * Bricktrack service worker.
+ *
+ * Goal: the catalog stays readable in the cellar, in the shop, and wherever
+ * else the phone loses its connection. Anything that changes data still needs
+ * the network - a wish reserved offline would be a lie.
+ *
+ * Caches are versioned; bumping VERSION drops the old ones on activation.
+ */
+const VERSION = 'v1';
+const PAGE_CACHE = `bricktrack-pages-${VERSION}`;
+const ASSET_CACHE = `bricktrack-assets-${VERSION}`;
+const IMAGE_CACHE = `bricktrack-images-${VERSION}`;
+const OFFLINE_URL = '/offline';
+
+self.addEventListener('install', (event) => {
+  event.waitUntil(
+    caches
+      .open(PAGE_CACHE)
+      .then((cache) => cache.addAll([OFFLINE_URL, '/manifest.webmanifest']))
+      .then(() => self.skipWaiting()),
+  );
+});
+
+self.addEventListener('activate', (event) => {
+  const keep = new Set([PAGE_CACHE, ASSET_CACHE, IMAGE_CACHE]);
+
+  event.waitUntil(
+    caches
+      .keys()
+      .then((keys) => Promise.all(keys.filter((key) => !keep.has(key)).map((key) => caches.delete(key))))
+      .then(() => self.clients.claim()),
+  );
+});
+
+/**
+ * Signing out must not leave readable pages behind on a shared device, so the
+ * app tells the worker to drop everything it holds.
+ */
+self.addEventListener('message', (event) => {
+  if (event.data === 'bricktrack:clear-cache') {
+    event.waitUntil(caches.keys().then((keys) => Promise.all(keys.map((key) => caches.delete(key)))));
+  }
+});
+
+/** Long-lived, content-addressed build output. */
+function isStaticAsset(url) {
+  return url.pathname.startsWith('/_next/static/') || url.pathname.startsWith('/icons/');
+}
+
+/** Set pictures; their file names contain a UUID and never change. */
+function isCacheableImage(url) {
+  return url.pathname.startsWith('/api/files/images/');
+}
+
+/** Everything that must never be answered from a cache. */
+function isNeverCached(url) {
+  return (
+    url.pathname.startsWith('/api/auth/') ||
+    url.pathname.startsWith('/api/export/') ||
+    url.pathname.startsWith('/api/health')
+  );
+}
+
+async function cacheFirst(request, cacheName) {
+  const cache = await caches.open(cacheName);
+  const hit = await cache.match(request);
+  if (hit) return hit;
+
+  const response = await fetch(request);
+  if (response.ok) cache.put(request, response.clone());
+  return response;
+}
+
+/**
+ * Network first, cache as a fallback: the catalog is always current when there
+ * is a connection, and still readable when there is not.
+ */
+async function networkFirst(request, cacheName) {
+  const cache = await caches.open(cacheName);
+
+  try {
+    const response = await fetch(request);
+    if (response.ok) cache.put(request, response.clone());
+    return response;
+  } catch (error) {
+    const hit = await cache.match(request);
+    if (hit) return hit;
+
+    if (request.mode === 'navigate') {
+      const offline = await cache.match(OFFLINE_URL);
+      if (offline) return offline;
+    }
+    throw error;
+  }
+}
+
+self.addEventListener('fetch', (event) => {
+  const { request } = event;
+
+  // Only plain GETs are safe to serve from a cache.
+  if (request.method !== 'GET') return;
+
+  const url = new URL(request.url);
+  if (url.origin !== self.location.origin) return;
+  if (isNeverCached(url)) return;
+
+  if (isStaticAsset(url)) {
+    event.respondWith(cacheFirst(request, ASSET_CACHE));
+    return;
+  }
+
+  if (isCacheableImage(url)) {
+    event.respondWith(cacheFirst(request, IMAGE_CACHE));
+    return;
+  }
+
+  // Page loads and the RSC payloads behind client-side navigation.
+  if (request.mode === 'navigate' || url.searchParams.has('_rsc')) {
+    event.respondWith(networkFirst(request, PAGE_CACHE));
+  }
+});

scripts/e2e-prepare.mjs

@@ -0,0 +1,22 @@
+/**
+ * Prepares the smoke run.
+ *
+ * The tests run against the production image, not the dev server: the dev
+ * server compiles routes on demand and, under the load of a full run, would
+ * occasionally drop a chunk mid-navigation. Testing the artefact that people
+ * actually deploy is also simply more useful.
+ */
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const dataDir = path.resolve(process.cwd(), 'data-e2e');
+
+fs.rmSync(dataDir, { recursive: true, force: true });
+fs.mkdirSync(path.join(dataDir, 'db'), { recursive: true });
+fs.mkdirSync(path.join(dataDir, 'files'), { recursive: true });
+console.log(`[e2e] ${dataDir} zurueckgesetzt.`);
+
+console.log('[e2e] Image wird gebaut (bricktrack:e2e) …');
+execFileSync('docker', ['build', '-t', 'bricktrack:e2e', '.'], { stdio: 'inherit' });
+console.log('[e2e] Image ist bereit.');

scripts/generate-icons.mjs

@@ -0,0 +1,67 @@
+/**
+ * Renders the app icons from one SVG source.
+ *
+ * Run with `node scripts/generate-icons.mjs` after changing the mark; the
+ * results are committed so neither the build nor the container needs to draw
+ * anything at runtime.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import sharp from 'sharp';
+
+const OUT_DIR = path.resolve(process.cwd(), 'public/icons');
+
+// Four studs on a rounded plate - readable down to 32px, which a detailed
+// brick drawing would not be.
+const mark = (background, foreground) => `
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="112" fill="${background}"/>
+  <g fill="${foreground}">
+    <rect x="112" y="112" width="128" height="128" rx="28"/>
+    <rect x="272" y="112" width="128" height="128" rx="28"/>
+    <rect x="112" y="272" width="128" height="128" rx="28"/>
+    <rect x="272" y="272" width="128" height="128" rx="28"/>
+  </g>
+</svg>`;
+
+/**
+ * A maskable icon has to survive being cropped to a circle, so the mark sits
+ * on a full-bleed background with generous padding.
+ */
+const maskable = (background, foreground) => `
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" fill="${background}"/>
+  <g fill="${foreground}">
+    <rect x="146" y="146" width="100" height="100" rx="22"/>
+    <rect x="266" y="146" width="100" height="100" rx="22"/>
+    <rect x="146" y="266" width="100" height="100" rx="22"/>
+    <rect x="266" y="266" width="100" height="100" rx="22"/>
+  </g>
+</svg>`;
+
+const DARK = '#0a0a0a';
+const LIGHT = '#fafafa';
+
+const targets = [
+  { file: 'icon-192.png', size: 192, svg: mark(DARK, LIGHT) },
+  { file: 'icon-512.png', size: 512, svg: mark(DARK, LIGHT) },
+  { file: 'icon-maskable-512.png', size: 512, svg: maskable(DARK, LIGHT) },
+  { file: 'apple-touch-icon.png', size: 180, svg: mark(DARK, LIGHT) },
+];
+
+fs.mkdirSync(OUT_DIR, { recursive: true });
+
+for (const target of targets) {
+  await sharp(Buffer.from(target.svg))
+    .resize(target.size, target.size)
+    .png({ compressionLevel: 9 })
+    .toFile(path.join(OUT_DIR, target.file));
+  console.log(`[icons] ${target.file} (${target.size}px)`);
+}
+
+// The favicon keeps the same mark so the browser tab matches the home screen.
+await sharp(Buffer.from(mark(DARK, LIGHT)))
+  .resize(32, 32)
+  .png({ compressionLevel: 9 })
+  .toFile(path.resolve(process.cwd(), 'public/favicon.png'));
+console.log('[icons] favicon.png (32px)');

scripts/reset-e2e.mjs

@@ -1,13 +0,0 @@
-/**
- * Wipes the Playwright data directory before the smoke run.
- *
- * Runs before Playwright starts, because Playwright boots its web server
- * before global setup - on Windows the open SQLite file would then block the
- * delete.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-
-const dataDir = path.resolve(process.cwd(), 'data-e2e');
-fs.rmSync(dataDir, { recursive: true, force: true });
-console.log(`[e2e] ${dataDir} zurueckgesetzt.`);

src/app/(app)/katalog/[id]/page.tsx

@@ -18,6 +18,7 @@ import {
   listInstructionsForSet,
   listPhotosForSet,
 } from '@/lib/queries/catalog';
+import { listMissingParts } from '@/lib/queries/collection';
 import { listLocations } from '@/lib/queries/master-data';
 import { listWishlistsForSet, listWishlistTargets } from '@/lib/queries/wishlists';
 import { requireUser } from '@/lib/session';
@@ -45,6 +46,8 @@ export default async function SetDetailPage({ params }: Props) {
   const collectionItems = listCollectionItemsForSet(set.id).map((item) => ({
     ...item,
     locationName: item.locationId ? (locationNames.get(item.locationId) ?? null) : null,
+    setName: `${set.setNumber} · ${set.name}`,
+    missingParts: listMissingParts(item.id),
   }));
 
   const facts: Array<[string, string]> = [

src/app/(app)/katalog/import-actions.ts

@@ -0,0 +1,237 @@
+'use server';
+
+import { revalidatePath } from 'next/cache';
+import { and, eq } from 'drizzle-orm';
+import { db } from '@/db';
+import { instruction, manufacturer, set, theme } from '@/db/schema';
+import { actionData, actionError, type ActionResult } from '@/lib/action-result';
+import {
+  fetchImageBytes,
+  fetchMinifigCount,
+  fetchSet,
+  fetchTheme,
+  isRebrickableEnabled,
+  legoInstructionsUrl,
+  RebrickableError,
+} from '@/lib/rebrickable';
+import { requireUser } from '@/lib/session';
+import { uniqueSlug } from '@/lib/slug';
+import { storeImageBytes, UploadError } from '@/lib/uploads';
+
+/**
+ * Import of a Lego set from Rebrickable.
+ *
+ * Runs entirely on the server, creates the manufacturer and the theme if they
+ * are missing, and stores the picture locally so the catalog keeps working
+ * when Rebrickable changes it.
+ */
+
+const LEGO_SLUG = 'lego';
+
+function now() {
+  return new Date();
+}
+
+/** Returns the Lego manufacturer, creating it on first import. */
+function ensureLegoManufacturer(): string {
+  const existing = db
+    .select({ id: manufacturer.id })
+    .from(manufacturer)
+    .where(eq(manufacturer.slug, LEGO_SLUG))
+    .get();
+  if (existing) return existing.id;
+
+  const taken = db.select({ slug: manufacturer.slug }).from(manufacturer).all();
+  const id = crypto.randomUUID();
+
+  db.insert(manufacturer)
+    .values({
+      id,
+      name: 'Lego',
+      slug: uniqueSlug('Lego', taken.map((row) => row.slug)),
+      website: 'https://www.lego.com/de-de',
+      createdAt: now(),
+      updatedAt: now(),
+    })
+    .run();
+
+  return id;
+}
+
+/**
+ * Maps a Rebrickable theme onto a local one, creating it (and its parent) when
+ * needed. Rebrickable nests themes deeply; one level of parent is enough to
+ * keep "Technic > Cars" readable without importing the whole tree.
+ */
+async function ensureTheme(manufacturerId: string, themeId: number | null): Promise<string | null> {
+  if (themeId === null) return null;
+
+  const remote = await fetchTheme(themeId);
+  if (!remote) return null;
+
+  const existing = db
+    .select({ id: theme.id })
+    .from(theme)
+    .where(and(eq(theme.manufacturerId, manufacturerId), eq(theme.name, remote.name)))
+    .get();
+  if (existing) return existing.id;
+
+  let parentThemeId: string | null = null;
+  if (remote.parentId !== null) {
+    const parent = await fetchTheme(remote.parentId);
+    if (parent) {
+      const existingParent = db
+        .select({ id: theme.id })
+        .from(theme)
+        .where(and(eq(theme.manufacturerId, manufacturerId), eq(theme.name, parent.name)))
+        .get();
+
+      if (existingParent) {
+        parentThemeId = existingParent.id;
+      } else {
+        parentThemeId = crypto.randomUUID();
+        db.insert(theme)
+          .values({
+            id: parentThemeId,
+            manufacturerId,
+            name: parent.name,
+            createdAt: now(),
+            updatedAt: now(),
+          })
+          .run();
+      }
+    }
+  }
+
+  const id = crypto.randomUUID();
+  db.insert(theme)
+    .values({
+      id,
+      manufacturerId,
+      name: remote.name,
+      parentThemeId,
+      createdAt: now(),
+      updatedAt: now(),
+    })
+    .run();
+
+  return id;
+}
+
+export type ImportResult = {
+  setId: string;
+  setNumber: string;
+  name: string;
+  imported: {
+    image: boolean;
+    theme: boolean;
+    minifigs: boolean;
+  };
+};
+
+export async function importSetFromRebrickable(
+  rawSetNumber: unknown,
+): Promise<ActionResult<ImportResult>> {
+  await requireUser();
+
+  if (!isRebrickableEnabled()) {
+    return actionError(
+      'Der Import ist nicht eingerichtet. Trag REBRICKABLE_API_KEY in der .env ein und starte den Container neu.',
+    );
+  }
+
+  const setNumber = typeof rawSetNumber === 'string' ? rawSetNumber.trim() : '';
+  if (!setNumber) return actionError('Bitte gib eine Setnummer ein.');
+  if (setNumber.length > 40) return actionError('Das sieht nicht nach einer Setnummer aus.');
+
+  let remote;
+  try {
+    remote = await fetchSet(setNumber);
+  } catch (error) {
+    if (error instanceof RebrickableError) return actionError(error.message);
+    throw error;
+  }
+
+  if (!remote) {
+    return actionError(
+      `Rebrickable kennt die Setnummer ${setNumber} nicht. Du kannst das Set von Hand anlegen.`,
+    );
+  }
+
+  const manufacturerId = ensureLegoManufacturer();
+
+  const duplicate = db
+    .select({ id: set.id })
+    .from(set)
+    .where(and(eq(set.manufacturerId, manufacturerId), eq(set.setNumber, remote.setNumber)))
+    .get();
+  if (duplicate) {
+    return actionError(`${remote.setNumber} ist schon im Katalog: ${remote.name}.`);
+  }
+
+  const themeId = await ensureTheme(manufacturerId, remote.themeId);
+  const minifigCount = await fetchMinifigCount(remote.setNumber);
+
+  const setId = crypto.randomUUID();
+
+  // Cache the picture locally; a failed download must not fail the import.
+  let imagePath: string | null = null;
+  if (remote.imageUrl) {
+    const bytes = await fetchImageBytes(remote.imageUrl);
+    if (bytes) {
+      try {
+        imagePath = (await storeImageBytes(bytes, 'set-image', setId)).filePath;
+      } catch (error) {
+        if (!(error instanceof UploadError)) throw error;
+        console.error('[import] Bild konnte nicht gespeichert werden', error);
+      }
+    }
+  }
+
+  db.insert(set)
+    .values({
+      id: setId,
+      manufacturerId,
+      themeId,
+      setNumber: remote.setNumber,
+      name: remote.name,
+      year: remote.year,
+      pieceCount: remote.pieceCount,
+      minifigCount,
+      imagePath,
+      // Keep the source URL as a fallback if the local file is ever lost.
+      imageUrl: imagePath ? null : remote.imageUrl,
+      externalIds: { rebrickable: `${remote.setNumber}-1` },
+      createdAt: now(),
+      updatedAt: now(),
+    })
+    .run();
+
+  // Rebrickable does not serve instruction files, so this points at Lego's
+  // own service page for the set number.
+  db.insert(instruction)
+    .values({
+      id: crypto.randomUUID(),
+      setId,
+      kind: 'external_url',
+      url: legoInstructionsUrl(remote.setNumber),
+      label: 'Bauanleitung bei LEGO',
+      sortOrder: 0,
+      createdAt: now(),
+    })
+    .run();
+
+  revalidatePath('/katalog');
+  revalidatePath('/verwaltung/themen');
+
+  return actionData({
+    setId,
+    setNumber: remote.setNumber,
+    name: remote.name,
+    imported: {
+      image: imagePath !== null,
+      theme: themeId !== null,
+      minifigs: minifigCount !== null,
+    },
+  });
+}

src/app/(app)/katalog/neu/page.tsx

@@ -1,8 +1,10 @@
 import type { Metadata } from 'next';
 import Link from 'next/link';
+import { RebrickableImport } from '@/components/katalog/rebrickable-import';
 import { SetForm } from '@/components/katalog/set-form';
 import { Button } from '@/components/ui/button';
 import { listManufacturers, listThemes } from '@/lib/queries/master-data';
+import { isRebrickableEnabled } from '@/lib/rebrickable';
 import { requireUser } from '@/lib/session';
 
 export const metadata: Metadata = { title: 'Neues Set' };
@@ -21,12 +23,19 @@ export default async function NeuesSetPage({ searchParams }: { searchParams: Sea
     manufacturerId: row.manufacturerId,
   }));
 
+  const importEnabled = isRebrickableEnabled();
+
   if (manufacturers.length === 0) {
     return (
-      <div className="space-y-4">
+      <div className="space-y-6">
         <h1 className="text-2xl font-semibold tracking-tight">Neues Set</h1>
+
+        {/* The Lego import creates its manufacturer itself, so it works even
+            on a completely empty instance. */}
+        <RebrickableImport enabled={importEnabled} />
+
         <p className="rounded-lg border border-dashed border-border p-6 text-sm text-muted-foreground">
-          Jedes Set gehört zu einem Hersteller. Leg zuerst einen an – Lego, Playmobil, Cobi oder
+          Für ein Set von Hand brauchst du zuerst einen Hersteller – Lego, Playmobil, Cobi oder
           was auch immer im Kinderzimmer steht.
         </p>
         <Button asChild size="lg">
@@ -45,6 +54,14 @@ export default async function NeuesSetPage({ searchParams }: { searchParams: Sea
           Sammlung hinzufügen“ fest.
         </p>
       </div>
+      <RebrickableImport enabled={importEnabled} />
+
+      <div className="flex items-center gap-3 text-xs text-muted-foreground">
+        <span className="h-px flex-1 bg-border" />
+        oder von Hand
+        <span className="h-px flex-1 bg-border" />
+      </div>
+
       <SetForm manufacturers={manufacturers} themes={themes} defaultEan={ean} />
     </div>
   );

src/app/(app)/katalog/page.tsx

@@ -1,6 +1,7 @@
 import type { Metadata } from 'next';
 import Link from 'next/link';
 import { Plus } from 'lucide-react';
+import { BarcodeScannerButton } from '@/components/katalog/barcode-scanner';
 import { CatalogFilters } from '@/components/katalog/catalog-filters';
 import { CatalogGrid } from '@/components/katalog/catalog-grid';
 import { Pagination } from '@/components/katalog/pagination';
@@ -60,12 +61,15 @@ export default async function KatalogPage({ searchParams }: { searchParams: Sear
               : 'Alle bekannten Sets – unabhängig davon, ob sie schon da sind.'}
           </p>
         </div>
-        <Button asChild size="lg" className="shrink-0">
+        <div className="flex shrink-0 gap-2">
-          <Link href="/katalog/neu">
+          <BarcodeScannerButton />
-            <Plus />
+          <Button asChild size="lg">
-            <span className="hidden sm:inline">Set anlegen</span>
+            <Link href="/katalog/neu">
-          </Link>
+              <Plus />
-        </Button>
+              <span className="hidden sm:inline">Set anlegen</span>
+            </Link>
+          </Button>
+        </div>
       </div>
 
       <CatalogFilters options={{ manufacturers, themes, years: listSetYears() }} />

src/app/(app)/katalog/scan-actions.ts

@@ -0,0 +1,37 @@
+'use server';
+
+import { actionData, actionError, type ActionResult } from '@/lib/action-result';
+import { isValidEan } from '@/lib/ean';
+import { findSetByEan } from '@/lib/queries/catalog';
+import { requireUser } from '@/lib/session';
+
+export type ScanLookup =
+  | { found: true; setId: string; setNumber: string; name: string }
+  | { found: false; ean: string };
+
+/**
+ * Resolves a scanned barcode.
+ *
+ * Either the set is already in the catalog - then we jump straight to it - or
+ * it is not, and the caller opens the "new set" form with the number filled in.
+ */
+export async function lookupScannedEan(rawEan: unknown): Promise<ActionResult<ScanLookup>> {
+  await requireUser();
+
+  const ean = typeof rawEan === 'string' ? rawEan.replace(/\D/g, '') : '';
+  if (!isValidEan(ean)) {
+    return actionError('Der Strichcode wurde nicht sauber erkannt. Bitte noch einmal scannen.');
+  }
+
+  const match = findSetByEan(ean);
+  if (match) {
+    return actionData({
+      found: true as const,
+      setId: match.id,
+      setNumber: match.setNumber,
+      name: match.name,
+    });
+  }
+
+  return actionData({ found: false as const, ean });
+}

src/app/(app)/sammlung/actions.ts

@@ -1,9 +1,9 @@
 'use server';
 
 import { revalidatePath } from 'next/cache';
-import { eq } from 'drizzle-orm';
+import { and, eq } from 'drizzle-orm';
 import { db } from '@/db';
-import { collectionItem, set } from '@/db/schema';
+import { collectionItem, missingPart, set } from '@/db/schema';
 import {
   actionData,
   actionError,
@@ -13,7 +13,7 @@ import {
 } from '@/lib/action-result';
 import { reconcileFulfilledWishlistItems } from '@/lib/queries/wishlists';
 import { requireUser } from '@/lib/session';
-import { collectionItemSchema } from '@/lib/validation';
+import { collectionItemSchema, missingPartSchema } from '@/lib/validation';
 import type { Condition } from '@/db/types';
 
 function now() {
@@ -103,3 +103,123 @@ export async function deleteCollectionItem(id: string): Promise<ActionResult> {
   revalidateCollection(existing.setId);
   return actionOk();
 }
+
+// ---------------------------------------------------------------------------
+// Missing parts
+// ---------------------------------------------------------------------------
+
+/**
+ * Keeps `completeness` honest without ever fighting the user.
+ *
+ * The moment a part is reported missing the item is not complete any more, and
+ * once the last open entry is resolved it is complete again. A deliberate
+ * "unknown" is left alone in the second direction only.
+ */
+function syncCompleteness(collectionItemId: string): void {
+  const open = db
+    .select({ id: missingPart.id })
+    .from(missingPart)
+    .where(and(eq(missingPart.collectionItemId, collectionItemId), eq(missingPart.resolved, false)))
+    .all();
+
+  const item = db
+    .select({ completeness: collectionItem.completeness })
+    .from(collectionItem)
+    .where(eq(collectionItem.id, collectionItemId))
+    .get();
+  if (!item) return;
+
+  if (open.length > 0 && item.completeness !== 'missing_parts') {
+    db.update(collectionItem)
+      .set({ completeness: 'missing_parts', updatedAt: now() })
+      .where(eq(collectionItem.id, collectionItemId))
+      .run();
+    return;
+  }
+
+  if (open.length === 0 && item.completeness === 'missing_parts') {
+    db.update(collectionItem)
+      .set({ completeness: 'complete', updatedAt: now() })
+      .where(eq(collectionItem.id, collectionItemId))
+      .run();
+  }
+}
+
+function loadItemSetId(collectionItemId: string): string | null {
+  const row = db
+    .select({ setId: collectionItem.setId })
+    .from(collectionItem)
+    .where(eq(collectionItem.id, collectionItemId))
+    .get();
+  return row?.setId ?? null;
+}
+
+export async function addMissingPart(
+  collectionItemId: string,
+  input: unknown,
+): Promise<ActionResult> {
+  await requireUser();
+
+  const parsed = parseForm(missingPartSchema, input);
+  if (!parsed.ok) return parsed;
+
+  const setId = loadItemSetId(collectionItemId);
+  if (!setId) return actionError('Diesen Sammlungseintrag gibt es nicht mehr.');
+
+  db.insert(missingPart)
+    .values({
+      id: crypto.randomUUID(),
+      collectionItemId,
+      partNumber: parsed.data.partNumber,
+      colorName: parsed.data.colorName,
+      quantity: parsed.data.quantity,
+      resolved: false,
+      notes: parsed.data.notes,
+      createdAt: now(),
+    })
+    .run();
+
+  syncCompleteness(collectionItemId);
+  revalidateCollection(setId);
+  return actionOk();
+}
+
+export async function setMissingPartResolved(
+  missingPartId: string,
+  resolved: boolean,
+): Promise<ActionResult> {
+  await requireUser();
+
+  const row = db
+    .select({ collectionItemId: missingPart.collectionItemId })
+    .from(missingPart)
+    .where(eq(missingPart.id, missingPartId))
+    .get();
+  if (!row) return actionOk();
+
+  db.update(missingPart)
+    .set({ resolved })
+    .where(eq(missingPart.id, missingPartId))
+    .run();
+
+  syncCompleteness(row.collectionItemId);
+  revalidateCollection(loadItemSetId(row.collectionItemId) ?? undefined);
+  return actionOk();
+}
+
+export async function deleteMissingPart(missingPartId: string): Promise<ActionResult> {
+  await requireUser();
+
+  const row = db
+    .select({ collectionItemId: missingPart.collectionItemId })
+    .from(missingPart)
+    .where(eq(missingPart.id, missingPartId))
+    .get();
+  if (!row) return actionOk();
+
+  db.delete(missingPart).where(eq(missingPart.id, missingPartId)).run();
+
+  syncCompleteness(row.collectionItemId);
+  revalidateCollection(loadItemSetId(row.collectionItemId) ?? undefined);
+  return actionOk();
+}

src/app/(app)/sammlung/page.tsx

@@ -10,6 +10,7 @@ import { completenessLabel, statusLabel } from '@/lib/labels';
 import { formatEuro } from '@/lib/money';
 import {
   countMissingSets,
+  countOpenMissingParts,
   getCollectionStats,
   listCollectionItems,
   type CollectionFilters as Filters,
@@ -40,6 +41,7 @@ export default async function SammlungPage({ searchParams }: { searchParams: Sea
   };
 
   const items = listCollectionItems(filters);
+  const openParts = countOpenMissingParts(items.map((item) => item.id));
   const stats = getCollectionStats();
   const missing = countMissingSets();
 
@@ -132,6 +134,9 @@ export default async function SammlungPage({ searchParams }: { searchParams: Sea
                       {item.completeness !== 'unknown' ? (
                         <Badge variant="secondary">{completenessLabel(item.completeness)}</Badge>
                       ) : null}
+                      {openParts.get(item.id) ? (
+                        <Badge variant="outline">{openParts.get(item.id)} Fehlteile</Badge>
+                      ) : null}
                       {item.acquiredAt ? (
                         <span className="text-xs text-muted-foreground">
                           seit {formatDate(item.acquiredAt)}

src/app/(app)/verwaltung/daten/actions.ts

@@ -0,0 +1,45 @@
+'use server';
+
+import { revalidatePath } from 'next/cache';
+import { actionData, actionError, type ActionResult } from '@/lib/action-result';
+import { importArchive, ImportError, type ImportSummary } from '@/lib/export';
+import { requireAdmin } from '@/lib/session';
+
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+
+/** Typed by hand before anything is deleted. */
+const CONFIRMATION = 'ERSETZEN';
+
+export async function importArchiveAction(
+  formData: FormData,
+): Promise<ActionResult<ImportSummary>> {
+  const admin = await requireAdmin();
+
+  if (formData.get('confirmation') !== CONFIRMATION) {
+    return actionError(`Bitte tipp ${CONFIRMATION} ein, um den Austausch zu bestätigen.`);
+  }
+
+  const file = formData.get('archive');
+  if (!(file instanceof File) || file.size === 0) {
+    return actionError('Bitte wähle ein Bricktrack-Archiv (.zip) aus.');
+  }
+  if (file.size > MAX_ARCHIVE_BYTES) {
+    return actionError('Das Archiv ist größer als 512 MB und wird nicht eingelesen.');
+  }
+
+  try {
+    const summary = importArchive(
+      new Uint8Array(await file.arrayBuffer()),
+      admin.id,
+    );
+
+    revalidatePath('/', 'layout');
+    return actionData(summary);
+  } catch (error) {
+    if (error instanceof ImportError) return actionError(error.message);
+    console.error('[import] Archiv konnte nicht eingelesen werden', error);
+    return actionError(
+      'Das Archiv konnte nicht eingelesen werden. Die vorhandenen Daten wurden nicht verändert.',
+    );
+  }
+}

src/app/(app)/verwaltung/daten/page.tsx

@@ -0,0 +1,10 @@
+import type { Metadata } from 'next';
+import { DataTransfer } from '@/components/verwaltung/data-transfer';
+import { requireAdmin } from '@/lib/session';
+
+export const metadata: Metadata = { title: 'Daten' };
+
+export default async function DatenPage() {
+  await requireAdmin();
+  return <DataTransfer />;
+}

src/app/(app)/verwaltung/einladungen/actions.ts

@@ -0,0 +1,44 @@
+'use server';
+
+import { revalidatePath } from 'next/cache';
+import { z } from 'zod';
+import { actionData, actionOk, parseForm, type ActionResult } from '@/lib/action-result';
+import { createInvite, deleteInvite, INVITE_VALID_DAYS } from '@/lib/invites';
+import { requireAdmin } from '@/lib/session';
+import { optionalText } from '@/lib/validation';
+
+const schema = z.object({
+  // Optional: when set, the invitation only works for that address.
+  email: optionalText(160),
+  role: z.enum(['admin', 'member']).default('member'),
+  validDays: z.coerce.number().int().min(1).max(90).default(INVITE_VALID_DAYS),
+});
+
+export async function createInviteAction(
+  input: unknown,
+): Promise<ActionResult<{ token: string }>> {
+  const admin = await requireAdmin();
+
+  const parsed = parseForm(schema, input);
+  if (!parsed.ok) return parsed;
+
+  const created = createInvite({
+    createdByUserId: admin.id,
+    email: parsed.data.email,
+    role: parsed.data.role,
+    validDays: parsed.data.validDays,
+  });
+
+  revalidatePath('/verwaltung/einladungen');
+  // The plaintext token is returned once and never stored - only its hash is.
+  return actionData({ token: created.token });
+}
+
+export async function deleteInviteAction(id: string): Promise<ActionResult> {
+  await requireAdmin();
+
+  deleteInvite(id);
+
+  revalidatePath('/verwaltung/einladungen');
+  return actionOk();
+}

src/app/(app)/verwaltung/einladungen/page.tsx

@@ -0,0 +1,22 @@
+import type { Metadata } from 'next';
+import { InviteList, type InviteListRow } from '@/components/verwaltung/invite-list';
+import { inviteState, listInvites } from '@/lib/invites';
+import { requireAdmin } from '@/lib/session';
+
+export const metadata: Metadata = { title: 'Einladungen' };
+
+export default async function EinladungenPage() {
+  await requireAdmin();
+
+  const invites: InviteListRow[] = listInvites().map((row) => ({
+    id: row.id,
+    email: row.email,
+    role: row.role,
+    expiresAt: row.expiresAt,
+    usedAt: row.usedAt,
+    usedByName: row.usedByName,
+    state: inviteState(row),
+  }));
+
+  return <InviteList invites={invites} />;
+}

src/app/(app)/verwaltung/layout.tsx

@@ -5,7 +5,7 @@ import { requireUser } from '@/lib/session';
 export const metadata: Metadata = { title: 'Verwaltung' };
 
 export default async function VerwaltungLayout({ children }: { children: React.ReactNode }) {
-  await requireUser();
+  const user = await requireUser();
 
   return (
     <div className="space-y-6">
@@ -15,7 +15,7 @@ export default async function VerwaltungLayout({ children }: { children: React.R
           Stammdaten, die im Katalog und in der Sammlung ausgewählt werden.
         </p>
       </div>
-      <VerwaltungNav />
+      <VerwaltungNav isAdmin={user.role === 'admin'} />
       {children}
     </div>
   );

src/app/(auth)/einladung/[token]/actions.ts

@@ -0,0 +1,63 @@
+'use server';
+
+import { headers } from 'next/headers';
+import { z } from 'zod';
+import { actionError, actionOk, parseForm, type ActionResult } from '@/lib/action-result';
+import { auth } from '@/lib/auth';
+import { findUsableInvite, markInviteUsed, withInviteGrant } from '@/lib/invites';
+
+const schema = z.object({
+  token: z.string().trim().min(1),
+  name: z.string().trim().min(1, 'Bitte gib deinen Namen an.').max(80),
+  email: z.email('Bitte gib eine gültige E-Mail-Adresse an.'),
+  password: z.string().min(10, 'Das Passwort braucht mindestens 10 Zeichen.'),
+});
+
+/**
+ * Registration through an invitation link.
+ *
+ * The token is checked here, on the server, and only then is the sign-up
+ * wrapped in a grant that the user-create hook can see. The role comes from
+ * the invitation, never from the submitted form.
+ */
+export async function registerWithInvite(input: unknown): Promise<ActionResult> {
+  const parsed = parseForm(schema, input);
+  if (!parsed.ok) return parsed;
+
+  const invitation = findUsableInvite(parsed.data.token);
+  if (!invitation) {
+    return actionError('Diese Einladung ist abgelaufen oder wurde bereits verwendet.');
+  }
+
+  if (invitation.email && invitation.email.toLowerCase() !== parsed.data.email.toLowerCase()) {
+    return actionError(`Diese Einladung gilt für ${invitation.email}.`);
+  }
+
+  const requestHeaders = await headers();
+
+  try {
+    const result = await withInviteGrant(
+      { inviteId: invitation.id, role: invitation.role },
+      () =>
+        auth.api.signUpEmail({
+          body: {
+            name: parsed.data.name,
+            email: parsed.data.email,
+            password: parsed.data.password,
+          },
+          headers: requestHeaders,
+        }),
+    );
+
+    markInviteUsed(invitation.id, result.user.id);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : '';
+    if (message.toLowerCase().includes('exist')) {
+      return actionError('Zu dieser E-Mail-Adresse gibt es schon ein Konto.');
+    }
+    console.error('[invite] Registrierung fehlgeschlagen', error);
+    return actionError('Die Registrierung hat nicht geklappt. Bitte versuch es noch einmal.');
+  }
+
+  return actionOk();
+}

src/app/(auth)/einladung/[token]/page.tsx

@@ -0,0 +1,54 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import { redirect } from 'next/navigation';
+import { InviteForm } from '@/components/auth/invite-form';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { formatDate } from '@/lib/format';
+import { findUsableInvite } from '@/lib/invites';
+import { getSession } from '@/lib/session';
+
+export const metadata: Metadata = {
+  title: 'Einladung',
+  robots: { index: false, follow: false },
+};
+
+export default async function InvitePage({ params }: { params: Promise<{ token: string }> }) {
+  if (await getSession()) redirect('/');
+
+  const { token } = await params;
+  const invitation = findUsableInvite(token);
+
+  if (!invitation) {
+    return (
+      <Card>
+        <CardHeader>
+          <CardTitle>Einladung ungültig</CardTitle>
+          <CardDescription>
+            Dieser Link ist abgelaufen oder wurde schon benutzt. Lass dir einfach einen neuen
+            schicken.
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <Link href="/anmelden" className="text-sm underline underline-offset-4">
+            Zur Anmeldung
+          </Link>
+        </CardContent>
+      </Card>
+    );
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Konto anlegen</CardTitle>
+        <CardDescription>
+          Du wurdest zu Bricktrack eingeladen. Der Link gilt noch bis zum{' '}
+          {formatDate(invitation.expiresAt)}.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <InviteForm token={token} email={invitation.email} />
+      </CardContent>
+    </Card>
+  );
+}

src/app/api/export/[kind]/route.ts

@@ -0,0 +1,106 @@
+import { NextResponse } from 'next/server';
+import {
+  buildCollectionCsv,
+  buildExportPayload,
+  buildExportZip,
+  exportFileName,
+} from '@/lib/export';
+import { formatDate } from '@/lib/format';
+import { conditionLabel, completenessLabel, statusLabel } from '@/lib/labels';
+import { centsToInput } from '@/lib/money';
+import { listCollectionItems } from '@/lib/queries/collection';
+import { getCurrentUser } from '@/lib/session';
+
+export const dynamic = 'force-dynamic';
+
+const CSV_COLUMNS = [
+  { key: 'setNumber', label: 'Setnummer' },
+  { key: 'setName', label: 'Name' },
+  { key: 'manufacturer', label: 'Hersteller' },
+  { key: 'theme', label: 'Thema' },
+  { key: 'year', label: 'Jahr' },
+  { key: 'pieceCount', label: 'Teile' },
+  { key: 'status', label: 'Status' },
+  { key: 'completeness', label: 'Vollständigkeit' },
+  { key: 'condition', label: 'Zustand' },
+  { key: 'location', label: 'Standort' },
+  { key: 'acquiredAt', label: 'Im Besitz seit' },
+  { key: 'acquiredPrice', label: 'Kaufpreis (EUR)' },
+  { key: 'retailPrice', label: 'UVP (EUR)' },
+  { key: 'acquiredFrom', label: 'Gekauft bei' },
+  { key: 'giftedBy', label: 'Geschenkt von' },
+  { key: 'notes', label: 'Notizen' },
+];
+
+/**
+ * Downloads.
+ *
+ * The full archive is for admins - it contains the whole collection. The CSV
+ * of the collection is available to every signed-in member.
+ */
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ kind: string }> },
+) {
+  const user = await getCurrentUser();
+  if (!user) return new NextResponse('Nicht angemeldet', { status: 401 });
+
+  const { kind } = await context.params;
+
+  if (kind === 'csv') {
+    const rows = listCollectionItems({}).map((item) => ({
+      setNumber: item.setNumber,
+      setName: item.setName,
+      manufacturer: item.manufacturerName,
+      theme: item.themeName,
+      year: item.year,
+      pieceCount: item.pieceCount,
+      status: statusLabel(item.status),
+      completeness: completenessLabel(item.completeness),
+      condition: conditionLabel(item.condition),
+      location: item.locationName,
+      acquiredAt: item.acquiredAt ? formatDate(item.acquiredAt) : '',
+      acquiredPrice: centsToInput(item.acquiredPriceCents),
+      retailPrice: centsToInput(item.retailPriceCents),
+      acquiredFrom: item.acquiredFrom,
+      giftedBy: item.giftedBy,
+      notes: item.notes,
+    }));
+
+    return new NextResponse(buildCollectionCsv(rows, CSV_COLUMNS), {
+      headers: {
+        'Content-Type': 'text/csv; charset=utf-8',
+        'Content-Disposition': `attachment; filename="${exportFileName('csv')}"`,
+        'Cache-Control': 'no-store',
+      },
+    });
+  }
+
+  if (user.role !== 'admin') {
+    return new NextResponse('Nur Administratoren dürfen die Daten exportieren', { status: 403 });
+  }
+
+  if (kind === 'json') {
+    return new NextResponse(JSON.stringify(buildExportPayload(), null, 2), {
+      headers: {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Disposition': `attachment; filename="${exportFileName('json')}"`,
+        'Cache-Control': 'no-store',
+      },
+    });
+  }
+
+  if (kind === 'zip') {
+    const archive = buildExportZip();
+    return new NextResponse(archive as unknown as BodyInit, {
+      headers: {
+        'Content-Type': 'application/zip',
+        'Content-Length': String(archive.byteLength),
+        'Content-Disposition': `attachment; filename="${exportFileName('zip')}"`,
+        'Cache-Control': 'no-store',
+      },
+    });
+  }
+
+  return new NextResponse('Unbekanntes Format', { status: 404 });
+}

src/app/layout.tsx

@@ -1,4 +1,5 @@
 import type { Metadata, Viewport } from 'next';
+import { ServiceWorkerRegistration } from '@/components/layout/service-worker';
 import { Toaster } from '@/components/ui/sonner';
 import './globals.css';
 
@@ -9,6 +10,16 @@ export const metadata: Metadata = {
   },
   description: 'Sammlung und Wunschlisten für Spielzeug-Sets',
   applicationName: 'Bricktrack',
+  manifest: '/manifest.webmanifest',
+  icons: {
+    icon: [{ url: '/favicon.png', type: 'image/png', sizes: '32x32' }],
+    apple: [{ url: '/icons/apple-touch-icon.png', sizes: '180x180' }],
+  },
+  appleWebApp: {
+    capable: true,
+    title: 'Bricktrack',
+    statusBarStyle: 'default',
+  },
   // A private, self-hosted instance never belongs in a search index - and the
   // public wishlist links are meant to be shared, not found.
   robots: { index: false, follow: false },
@@ -30,6 +41,7 @@ export default function RootLayout({ children }: Readonly<{ children: React.Reac
       <body className="min-h-dvh bg-background text-foreground antialiased">
         {children}
         <Toaster position="top-center" richColors closeButton />
+        <ServiceWorkerRegistration />
       </body>
     </html>
   );

src/app/offline/page.tsx

@@ -0,0 +1,28 @@
+import type { Metadata } from 'next';
+import { CloudOff } from 'lucide-react';
+
+export const metadata: Metadata = {
+  title: 'Offline',
+  robots: { index: false, follow: false },
+};
+
+/**
+ * Shown when a page is requested that the device has never loaded before and
+ * there is no connection. Pages that were visited once come from the cache
+ * instead of landing here.
+ */
+export default function OfflinePage() {
+  return (
+    <div className="mx-auto flex min-h-dvh max-w-sm flex-col items-center justify-center gap-4 px-4 text-center">
+      <CloudOff className="size-10 text-muted-foreground" aria-hidden />
+      <h1 className="text-xl font-semibold tracking-tight">Gerade offline</h1>
+      <p className="text-sm text-muted-foreground">
+        Diese Seite war noch nie geladen und lässt sich ohne Verbindung nicht anzeigen. Seiten,
+        die du schon einmal geöffnet hast – zum Beispiel der Katalog – funktionieren weiter.
+      </p>
+      <p className="text-xs text-muted-foreground">
+        Sobald wieder Netz da ist, aktualisiert sich alles von selbst.
+      </p>
+    </div>
+  );
+}

src/components/auth/invite-form.tsx

@@ -0,0 +1,83 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+import { useState, useTransition } from 'react';
+import { Loader2 } from 'lucide-react';
+import { toast } from 'sonner';
+import { registerWithInvite } from '@/app/(auth)/einladung/[token]/actions';
+import { Button } from '@/components/ui/button';
+import { Field } from '@/components/ui/field';
+import { Input } from '@/components/ui/input';
+
+const MIN_PASSWORD_LENGTH = 10;
+
+export function InviteForm({ token, email }: { token: string; email: string | null }) {
+  const router = useRouter();
+  const [pending, startTransition] = useTransition();
+  const [password, setPassword] = useState('');
+
+  function onSubmit(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const input = Object.fromEntries(new FormData(event.currentTarget).entries());
+
+    startTransition(async () => {
+      const result = await registerWithInvite({ ...input, token });
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+      toast.success('Konto angelegt. Willkommen bei Bricktrack!');
+      router.push('/');
+      router.refresh();
+    });
+  }
+
+  return (
+    <form onSubmit={onSubmit} className="space-y-4">
+      <Field label="Name" htmlFor="name" required>
+        <Input id="name" name="name" autoComplete="name" required maxLength={80} />
+      </Field>
+
+      <Field
+        label="E-Mail"
+        htmlFor="email"
+        required
+        hint={email ? 'Diese Einladung gilt für genau diese Adresse.' : undefined}
+      >
+        <Input
+          id="email"
+          name="email"
+          type="email"
+          inputMode="email"
+          autoComplete="username"
+          required
+          defaultValue={email ?? ''}
+          readOnly={Boolean(email)}
+        />
+      </Field>
+
+      <Field
+        label="Passwort"
+        htmlFor="password"
+        required
+        hint={`Mindestens ${MIN_PASSWORD_LENGTH} Zeichen. Einen Passkey kannst du danach unter „Konto“ hinterlegen.`}
+      >
+        <Input
+          id="password"
+          name="password"
+          type="password"
+          autoComplete="new-password"
+          required
+          minLength={MIN_PASSWORD_LENGTH}
+          value={password}
+          onChange={(event) => setPassword(event.target.value)}
+        />
+      </Field>
+
+      <Button type="submit" size="lg" className="w-full" disabled={pending}>
+        {pending ? <Loader2 className="animate-spin" /> : null}
+        Konto anlegen
+      </Button>
+    </form>
+  );
+}

src/components/katalog/barcode-scanner.tsx

@@ -0,0 +1,199 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { Loader2, ScanLine } from 'lucide-react';
+import { toast } from 'sonner';
+import { lookupScannedEan } from '@/app/(app)/katalog/scan-actions';
+import { formatEan, isValidEan } from '@/lib/ean';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+
+type Controls = { stop: () => void };
+
+/**
+ * Scans the barcode on a box with the phone camera.
+ *
+ * Decoding runs in the browser with zxing, which is bundled with the app and
+ * loaded only when the scanner is opened - nothing leaves the device, and the
+ * catalog pages stay light for everyone who never scans.
+ */
+export function BarcodeScannerButton() {
+  const router = useRouter();
+  const videoRef = useRef<HTMLVideoElement>(null);
+  const controlsRef = useRef<Controls | null>(null);
+  const handledRef = useRef(false);
+
+  const [open, setOpen] = useState(false);
+  const [status, setStatus] = useState<'starting' | 'scanning' | 'checking' | 'error'>('starting');
+  const [message, setMessage] = useState<string | null>(null);
+
+  const stop = useCallback(() => {
+    controlsRef.current?.stop();
+    controlsRef.current = null;
+  }, []);
+
+  const onDetected = useCallback(
+    (raw: string) => {
+      if (handledRef.current) return;
+      if (!isValidEan(raw)) return; // keep scanning on a misread
+
+      handledRef.current = true;
+      stop();
+      setStatus('checking');
+
+      void lookupScannedEan(raw).then((result) => {
+        if (!result.ok) {
+          toast.error(result.error);
+          setOpen(false);
+          return;
+        }
+
+        setOpen(false);
+
+        if (result.data.found) {
+          toast.success(`${result.data.setNumber} · ${result.data.name}`);
+          router.push(`/katalog/${result.data.setId}`);
+        } else {
+          toast.info(`${formatEan(result.data.ean)} ist noch nicht im Katalog.`);
+          router.push(`/katalog/neu?ean=${encodeURIComponent(result.data.ean)}`);
+        }
+        router.refresh();
+      });
+    },
+    [router, stop],
+  );
+
+  useEffect(() => {
+    if (!open) return;
+
+    handledRef.current = false;
+    setStatus('starting');
+    setMessage(null);
+
+    // The camera needs a secure context - same rule as for passkeys.
+    if (!window.isSecureContext) {
+      setStatus('error');
+      setMessage(
+        'Die Kamera funktioniert nur über HTTPS. Ruf Bricktrack über deine Domain auf, nicht über die IP-Adresse.',
+      );
+      return;
+    }
+
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        const { BrowserMultiFormatReader } = await import('@zxing/browser');
+        const reader = new BrowserMultiFormatReader();
+        const video = videoRef.current;
+        if (!video || cancelled) return;
+
+        const controls = await reader.decodeFromConstraints(
+          // The rear camera is the one pointing at the box.
+          { video: { facingMode: 'environment' } },
+          video,
+          (result) => {
+            if (result) onDetected(result.getText());
+          },
+        );
+
+        if (cancelled) {
+          controls.stop();
+          return;
+        }
+
+        controlsRef.current = controls;
+        setStatus('scanning');
+      } catch (error) {
+        if (cancelled) return;
+        console.error('[scan] Kamera konnte nicht gestartet werden', error);
+        setStatus('error');
+
+        const name = (error as { name?: string })?.name;
+        setMessage(
+          name === 'NotAllowedError'
+            ? 'Der Zugriff auf die Kamera wurde abgelehnt. Erlaube ihn in den Browser-Einstellungen und versuch es noch einmal.'
+            : name === 'NotFoundError'
+              ? 'Dieses Gerät hat keine nutzbare Kamera.'
+              : 'Die Kamera lässt sich nicht starten.',
+        );
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+      stop();
+    };
+  }, [open, onDetected, stop]);
+
+  return (
+    <>
+      <Button
+        variant="outline"
+        size="icon-lg"
+        aria-label="Barcode scannen"
+        title="Barcode scannen"
+        onClick={() => setOpen(true)}
+      >
+        <ScanLine />
+      </Button>
+
+      <Dialog
+        open={open}
+        onOpenChange={(next) => {
+          if (!next) stop();
+          setOpen(next);
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Barcode scannen</DialogTitle>
+            <DialogDescription>
+              Halte den Strichcode auf der Packung ins Bild. Kennt der Katalog das Set schon,
+              landest du direkt darauf – sonst im Formular mit ausgefüllter EAN.
+            </DialogDescription>
+          </DialogHeader>
+
+          {status === 'error' ? (
+            <p className="rounded-lg border border-dashed border-border p-4 text-sm text-muted-foreground">
+              {message}
+            </p>
+          ) : (
+            <div className="relative overflow-hidden rounded-lg bg-black">
+              <video
+                ref={videoRef}
+                className="aspect-[3/4] w-full object-cover"
+                muted
+                playsInline
+                aria-label="Kamerabild"
+              />
+              {/* A guide line makes people hold the box the right way round. */}
+              <div className="pointer-events-none absolute inset-x-6 top-1/2 h-0.5 -translate-y-1/2 bg-red-500/80" />
+
+              {status !== 'scanning' ? (
+                <div className="absolute inset-0 flex items-center justify-center gap-2 bg-black/60 text-sm text-white">
+                  <Loader2 className="size-4 animate-spin" />
+                  {status === 'checking' ? 'Im Katalog nachsehen …' : 'Kamera startet …'}
+                </div>
+              ) : null}
+            </div>
+          )}
+
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setOpen(false)}>
+              Abbrechen
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}

src/components/katalog/rebrickable-import.tsx

@@ -0,0 +1,95 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+import { useState, useTransition } from 'react';
+import { Download, Loader2 } from 'lucide-react';
+import { toast } from 'sonner';
+import { importSetFromRebrickable } from '@/app/(app)/katalog/import-actions';
+import { Button } from '@/components/ui/button';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Field } from '@/components/ui/field';
+import { Input } from '@/components/ui/input';
+
+/**
+ * One-field Lego import: type the number from the box, get a finished catalog
+ * entry. Hidden entirely when no API key is configured.
+ */
+export function RebrickableImport({ enabled }: { enabled: boolean }) {
+  const router = useRouter();
+  const [setNumber, setSetNumber] = useState('');
+  const [pending, startTransition] = useTransition();
+
+  if (!enabled) {
+    return (
+      <Card className="border-dashed">
+        <CardHeader>
+          <CardTitle>Lego-Import</CardTitle>
+          <CardDescription>
+            Mit einem Rebrickable-API-Key füllt sich das Formular von selbst: Setnummer eingeben,
+            und Name, Jahr, Teile, Thema und Bild kommen automatisch. Dafür{' '}
+            <code className="font-mono text-xs">REBRICKABLE_API_KEY</code> in die{' '}
+            <code className="font-mono text-xs">.env</code> eintragen und den Container neu
+            starten.
+          </CardDescription>
+        </CardHeader>
+      </Card>
+    );
+  }
+
+  function submit(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+
+    startTransition(async () => {
+      const result = await importSetFromRebrickable(setNumber);
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+
+      const missing = [
+        result.data.imported.image ? null : 'Bild',
+        result.data.imported.theme ? null : 'Thema',
+      ].filter(Boolean);
+
+      toast.success(
+        missing.length === 0
+          ? `${result.data.setNumber} „${result.data.name}“ übernommen.`
+          : `${result.data.setNumber} übernommen – ohne ${missing.join(' und ')}.`,
+      );
+
+      router.push(`/katalog/${result.data.setId}`);
+      router.refresh();
+    });
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Lego-Import</CardTitle>
+        <CardDescription>
+          Setnummer von der Packung eintippen – Name, Jahr, Teile, Minifiguren, Thema und Bild
+          werden übernommen. Das Bild wird lokal gespeichert.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form onSubmit={submit} className="flex items-end gap-2">
+          <Field label="Setnummer" htmlFor="import-number" className="flex-1">
+            <Input
+              id="import-number"
+              value={setNumber}
+              onChange={(event) => setSetNumber(event.target.value)}
+              placeholder="60398"
+              inputMode="numeric"
+              maxLength={40}
+              className="font-mono"
+            />
+          </Field>
+          <Button type="submit" size="lg" disabled={pending || setNumber.trim().length === 0}>
+            {pending ? <Loader2 className="animate-spin" /> : <Download />}
+            Holen
+          </Button>
+        </form>
+      </CardContent>
+    </Card>
+  );
+}

src/components/layout/service-worker.tsx

@@ -0,0 +1,38 @@
+'use client';
+
+import { useEffect } from 'react';
+
+/**
+ * Registers the service worker.
+ *
+ * Only in production: in development the worker would serve stale chunks and
+ * turn every edit into a puzzle.
+ */
+export function ServiceWorkerRegistration() {
+  useEffect(() => {
+    if (process.env.NODE_ENV !== 'production') return;
+    if (!('serviceWorker' in navigator)) return;
+
+    const register = () => {
+      void navigator.serviceWorker.register('/sw.js').catch((error) => {
+        console.error('[pwa] Service Worker konnte nicht registriert werden', error);
+      });
+    };
+
+    // Waiting for load keeps the worker from competing with the first render.
+    if (document.readyState === 'complete') register();
+    else window.addEventListener('load', register, { once: true });
+
+    return () => window.removeEventListener('load', register);
+  }, []);
+
+  return null;
+}
+
+/** Drops every cached page - called on sign-out. */
+export async function clearOfflineCaches(): Promise<void> {
+  if (!('serviceWorker' in navigator)) return;
+
+  const registration = await navigator.serviceWorker.getRegistration();
+  registration?.active?.postMessage('bricktrack:clear-cache');
+}

src/components/layout/user-menu.tsx

@@ -3,6 +3,7 @@
 import Link from 'next/link';
 import { useRouter } from 'next/navigation';
 import { LogOut, Settings, UserRound } from 'lucide-react';
+import { clearOfflineCaches } from '@/components/layout/service-worker';
 import { authClient } from '@/lib/auth-client';
 import { Button } from '@/components/ui/button';
 import {
@@ -20,6 +21,8 @@ export function UserMenu({ user }: { user: SessionUser }) {
 
   async function signOut() {
     await authClient.signOut();
+    // Cached pages must not stay readable on a shared device.
+    await clearOfflineCaches();
     router.push('/anmelden');
     router.refresh();
   }

src/components/sammlung/collection-items-section.tsx

@@ -2,9 +2,11 @@
 
 import { useRouter } from 'next/navigation';
 import { useState, useTransition } from 'react';
-import { Loader2, Pencil, Trash2 } from 'lucide-react';
+import { Loader2, Pencil, PuzzleIcon, Trash2 } from 'lucide-react';
 import { toast } from 'sonner';
 import { deleteCollectionItem, updateCollectionItem } from '@/app/(app)/sammlung/actions';
+import type { MissingPartRow } from '@/lib/queries/collection';
+import { MissingPartsDialog } from './missing-parts-dialog';
 import type { CollectionStatus, Completeness, Condition } from '@/db/types';
 import { formatDate, toDateInputValue } from '@/lib/format';
 import {
@@ -54,6 +56,8 @@ export type CollectionItemRow = {
   giftedBy: string | null;
   lentOutTo: string | null;
   notes: string | null;
+  setName: string;
+  missingParts: MissingPartRow[];
 };
 
 export function CollectionItemsSection({
@@ -67,6 +71,11 @@ export function CollectionItemsSection({
   const [pending, startTransition] = useTransition();
   const [editing, setEditing] = useState<CollectionItemRow | null>(null);
   const [deleting, setDeleting] = useState<CollectionItemRow | null>(null);
+  // Only the id, never a snapshot: the dialog shows a live list, and a copy
+  // taken when it opened would not show a part that was just added.
+  const [partsItemId, setPartsItemId] = useState<string | null>(null);
+
+  const partsItem = items.find((item) => item.id === partsItemId) ?? null;
 
   function submit(event: React.FormEvent<HTMLFormElement>) {
     event.preventDefault();
@@ -121,6 +130,11 @@ export function CollectionItemsSection({
                   {statusLabel(item.status)}
                 </Badge>
                 <Badge variant="secondary">{completenessLabel(item.completeness)}</Badge>
+                {item.missingParts.some((part) => !part.resolved) ? (
+                  <Badge variant="outline">
+                    {item.missingParts.filter((part) => !part.resolved).length} Fehlteile
+                  </Badge>
+                ) : null}
                 {item.locationName ? (
                   <span className="text-xs text-muted-foreground">{item.locationName}</span>
                 ) : null}
@@ -140,6 +154,16 @@ export function CollectionItemsSection({
               </p>
               {item.notes ? <p className="text-xs">{item.notes}</p> : null}
             </div>
+            <Button
+              variant="ghost"
+              size="icon-sm"
+              aria-label="Fehlteile"
+              title="Fehlteile"
+              onClick={() => setPartsItemId(item.id)}
+              disabled={pending}
+            >
+              <PuzzleIcon />
+            </Button>
             <Button
               variant="ghost"
               size="icon-sm"
@@ -283,6 +307,16 @@ export function CollectionItemsSection({
         </DialogContent>
       </Dialog>
 
+      {partsItem ? (
+        <MissingPartsDialog
+          collectionItemId={partsItem.id}
+          setName={partsItem.setName}
+          parts={partsItem.missingParts}
+          open
+          onOpenChange={(open) => !open && setPartsItemId(null)}
+        />
+      ) : null}
+
       <AlertDialog open={deleting !== null} onOpenChange={(open) => !open && setDeleting(null)}>
         <AlertDialogContent>
           <AlertDialogHeader>

src/components/sammlung/missing-parts-dialog.tsx

@@ -0,0 +1,186 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+import { useTransition } from 'react';
+import { Loader2, Plus, Trash2 } from 'lucide-react';
+import { toast } from 'sonner';
+import {
+  addMissingPart,
+  deleteMissingPart,
+  setMissingPartResolved,
+} from '@/app/(app)/sammlung/actions';
+import type { MissingPartRow } from '@/lib/queries/collection';
+import { cn } from 'cn';
+import { Button } from '@/components/ui/button';
+import { Checkbox } from '@/components/ui/checkbox';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Field } from '@/components/ui/field';
+import { Input } from '@/components/ui/input';
+
+/**
+ * Missing parts of one owned copy.
+ *
+ * Adding an entry marks the copy as incomplete, resolving the last one marks
+ * it complete again - so the collection filter stays truthful without anyone
+ * having to remember to update it.
+ */
+export function MissingPartsDialog({
+  collectionItemId,
+  setName,
+  parts,
+  open,
+  onOpenChange,
+}: {
+  collectionItemId: string;
+  setName: string;
+  parts: MissingPartRow[];
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const router = useRouter();
+  const [pending, startTransition] = useTransition();
+
+  function add(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const form = event.currentTarget;
+    const input = Object.fromEntries(new FormData(form).entries());
+
+    startTransition(async () => {
+      const result = await addMissingPart(collectionItemId, input);
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+      form.reset();
+      toast.success('Fehlteil vermerkt.');
+      router.refresh();
+    });
+  }
+
+  function toggle(part: MissingPartRow) {
+    startTransition(async () => {
+      const result = await setMissingPartResolved(part.id, !part.resolved);
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+      router.refresh();
+    });
+  }
+
+  function remove(part: MissingPartRow) {
+    startTransition(async () => {
+      const result = await deleteMissingPart(part.id);
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+      toast.success('Eintrag gelöscht.');
+      router.refresh();
+    });
+  }
+
+  const open_ = parts.filter((part) => !part.resolved).length;
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[85dvh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>Fehlteile</DialogTitle>
+          <DialogDescription>
+            {setName} –{' '}
+            {open_ === 0
+              ? 'aktuell fehlt nichts.'
+              : open_ === 1
+                ? 'ein Teil fehlt noch.'
+                : `${open_} Teile fehlen noch.`}
+          </DialogDescription>
+        </DialogHeader>
+
+        {parts.length > 0 ? (
+          <ul className="divide-y divide-border rounded-lg border border-border">
+            {parts.map((part) => (
+              <li key={part.id} className="flex items-center gap-3 p-3">
+                <Checkbox
+                  checked={part.resolved}
+                  onCheckedChange={() => toggle(part)}
+                  disabled={pending}
+                  aria-label={part.resolved ? 'Wieder als fehlend markieren' : 'Als erledigt markieren'}
+                />
+                <div className={cn('min-w-0 flex-1', part.resolved && 'opacity-50')}>
+                  <p className={cn('truncate text-sm font-medium', part.resolved && 'line-through')}>
+                    {part.quantity}× {part.partNumber ?? 'Teil'}
+                    {part.colorName ? ` · ${part.colorName}` : ''}
+                  </p>
+                  {part.notes ? (
+                    <p className="truncate text-xs text-muted-foreground">{part.notes}</p>
+                  ) : null}
+                </div>
+                <Button
+                  variant="ghost"
+                  size="icon-sm"
+                  aria-label="Eintrag löschen"
+                  onClick={() => remove(part)}
+                  disabled={pending}
+                >
+                  <Trash2 className="text-destructive" />
+                </Button>
+              </li>
+            ))}
+          </ul>
+        ) : (
+          <p className="rounded-lg border border-dashed border-border p-4 text-sm text-muted-foreground">
+            Noch nichts vermerkt. Trag hier ein, was beim Aufbauen fehlt – dann weißt du beim
+            Nachbestellen, worum es geht.
+          </p>
+        )}
+
+        <form onSubmit={add} className="space-y-3 rounded-lg border border-border p-3">
+          <p className="text-sm font-medium">Fehlteil hinzufügen</p>
+
+          <div className="grid gap-3 sm:grid-cols-3">
+            <Field label="Teilenummer" htmlFor="partNumber" className="sm:col-span-1">
+              <Input id="partNumber" name="partNumber" maxLength={40} placeholder="3001" className="font-mono" />
+            </Field>
+            <Field label="Farbe" htmlFor="colorName">
+              <Input id="colorName" name="colorName" maxLength={40} placeholder="Rot" />
+            </Field>
+            <Field label="Anzahl" htmlFor="quantity">
+              <Input
+                id="quantity"
+                name="quantity"
+                type="number"
+                inputMode="numeric"
+                min={1}
+                max={999}
+                defaultValue={1}
+              />
+            </Field>
+          </div>
+
+          <Field label="Notiz" htmlFor="part-notes" hint="Reicht auch allein, wenn du die Nummer nicht kennst.">
+            <Input id="part-notes" name="notes" maxLength={300} placeholder="Dachstein vorne links" />
+          </Field>
+
+          <Button type="submit" disabled={pending}>
+            {pending ? <Loader2 className="animate-spin" /> : <Plus />}
+            Hinzufügen
+          </Button>
+        </form>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)}>
+            Fertig
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

src/components/verwaltung/data-transfer.tsx

@@ -0,0 +1,138 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+import { useState, useTransition } from 'react';
+import { AlertTriangle, Download, FileSpreadsheet, FileText, Loader2, Upload } from 'lucide-react';
+import { toast } from 'sonner';
+import { importArchiveAction } from '@/app/(app)/verwaltung/daten/actions';
+import { Button } from '@/components/ui/button';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Field } from '@/components/ui/field';
+import { Input } from '@/components/ui/input';
+
+const CONFIRMATION = 'ERSETZEN';
+
+export function DataTransfer() {
+  const router = useRouter();
+  const [pending, startTransition] = useTransition();
+  const [confirmation, setConfirmation] = useState('');
+
+  function submit(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const form = event.currentTarget;
+
+    startTransition(async () => {
+      const result = await importArchiveAction(new FormData(form));
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+
+      toast.success(
+        `Eingelesen: ${result.data.sets} Sets, ${result.data.collectionItems} Sammlungseinträge, ${result.data.wishlists} Wunschlisten, ${result.data.files} Dateien.`,
+      );
+      form.reset();
+      setConfirmation('');
+      router.refresh();
+    });
+  }
+
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardHeader>
+          <CardTitle>Exportieren</CardTitle>
+          <CardDescription>
+            Zum Umziehen, zum Nachsehen außerhalb der App oder als zweites Netz. Das eigentliche
+            Backup bleibt das Verzeichnis <code className="font-mono text-xs">./data</code>.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="flex flex-wrap gap-2">
+          <Button asChild size="lg">
+            <a href="/api/export/zip" download>
+              <Download />
+              Alles als ZIP
+            </a>
+          </Button>
+          <Button asChild variant="outline" size="lg">
+            <a href="/api/export/json" download>
+              <FileText />
+              Nur Daten (JSON)
+            </a>
+          </Button>
+          <Button asChild variant="outline" size="lg">
+            <a href="/api/export/csv" download>
+              <FileSpreadsheet />
+              Sammlung als CSV
+            </a>
+          </Button>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>Was im Export steckt</CardTitle>
+        </CardHeader>
+        <CardContent className="space-y-2 text-sm text-muted-foreground">
+          <p>
+            <span className="font-medium text-foreground">Dabei:</span> Hersteller, Themen, Sets,
+            Anleitungen, Standorte, Sammlungseinträge, Fehlteile, Fotos und Wunschlisten – im ZIP
+            zusätzlich alle hochgeladenen Dateien.
+          </p>
+          <p>
+            <span className="font-medium text-foreground">Nicht dabei:</span> Konten, Passwörter
+            und Passkeys. Ein Export voller Passwort-Hashes im Download-Ordner wäre ein Risiko,
+            kein Backup. Ebenfalls draußen: Reservierungen und Teilen-Links – die gehören zu der
+            Instanz, auf der sie entstanden sind.
+          </p>
+        </CardContent>
+      </Card>
+
+      <Card className="border-destructive/40">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <AlertTriangle className="size-5 text-destructive" aria-hidden />
+            Importieren
+          </CardTitle>
+          <CardDescription>
+            Ein Import <strong>ersetzt</strong> alle vorhandenen Daten – Katalog, Sammlung und
+            Wunschlisten. Zusammenführen ist nicht möglich. Wunschlisten gehören danach dir und
+            sind zunächst nicht geteilt.
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={submit} className="space-y-4">
+            <Field label="Archiv" htmlFor="archive" required>
+              <Input id="archive" name="archive" type="file" accept=".zip,application/zip" required />
+            </Field>
+
+            <Field
+              label={`Zum Bestätigen ${CONFIRMATION} eintippen`}
+              htmlFor="confirmation"
+              required
+            >
+              <Input
+                id="confirmation"
+                name="confirmation"
+                value={confirmation}
+                onChange={(event) => setConfirmation(event.target.value)}
+                placeholder={CONFIRMATION}
+                autoComplete="off"
+              />
+            </Field>
+
+            <Button
+              type="submit"
+              size="lg"
+              variant="destructive"
+              disabled={pending || confirmation !== CONFIRMATION}
+            >
+              {pending ? <Loader2 className="animate-spin" /> : <Upload />}
+              Daten ersetzen
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

src/components/verwaltung/invite-list.tsx

@@ -0,0 +1,212 @@
+'use client';
+
+import { useRouter } from 'next/navigation';
+import { useState, useTransition } from 'react';
+import { Check, Copy, Loader2, Mail, Plus, Trash2 } from 'lucide-react';
+import { toast } from 'sonner';
+import {
+  createInviteAction,
+  deleteInviteAction,
+} from '@/app/(app)/verwaltung/einladungen/actions';
+import { formatDate } from '@/lib/format';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Field } from '@/components/ui/field';
+import { Input } from '@/components/ui/input';
+import { NativeSelect } from '@/components/ui/native-select';
+
+export type InviteListRow = {
+  id: string;
+  email: string | null;
+  role: 'admin' | 'member';
+  expiresAt: Date;
+  usedAt: Date | null;
+  usedByName: string | null;
+  state: 'open' | 'used' | 'expired';
+};
+
+export function InviteList({ invites }: { invites: InviteListRow[] }) {
+  const router = useRouter();
+  const [pending, startTransition] = useTransition();
+  const [createOpen, setCreateOpen] = useState(false);
+  const [link, setLink] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+
+  function submit(event: React.FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const input = Object.fromEntries(new FormData(event.currentTarget).entries());
+
+    startTransition(async () => {
+      const result = await createInviteAction(input);
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+      setCreateOpen(false);
+      setLink(`${window.location.origin}/einladung/${result.data.token}`);
+      router.refresh();
+    });
+  }
+
+  function remove(id: string) {
+    startTransition(async () => {
+      const result = await deleteInviteAction(id);
+      if (!result.ok) {
+        toast.error(result.error);
+        return;
+      }
+      toast.success('Einladung gelöscht.');
+      router.refresh();
+    });
+  }
+
+  async function copy() {
+    if (!link) return;
+    try {
+      await navigator.clipboard.writeText(link);
+      setCopied(true);
+      toast.success('Link kopiert.');
+      setTimeout(() => setCopied(false), 2000);
+    } catch {
+      toast.error('Kopieren hat nicht geklappt. Markiere den Link und kopiere ihn von Hand.');
+    }
+  }
+
+  return (
+    <div className="space-y-4">
+      <Button size="lg" className="w-full sm:w-auto" onClick={() => setCreateOpen(true)}>
+        <Plus />
+        Einladung erstellen
+      </Button>
+
+      {invites.length === 0 ? (
+        <p className="rounded-lg border border-dashed border-border p-6 text-center text-sm text-muted-foreground">
+          Noch keine Einladung. Damit bekommt zum Beispiel der zweite Elternteil ein eigenes
+          Konto – ohne dass die Registrierung für alle offen steht.
+        </p>
+      ) : (
+        <ul className="divide-y divide-border rounded-lg border border-border">
+          {invites.map((item) => (
+            <li key={item.id} className="flex items-center gap-3 p-3">
+              <Mail className="size-5 shrink-0 text-muted-foreground" aria-hidden />
+              <div className="min-w-0 flex-1">
+                <p className="truncate text-sm font-medium">
+                  {item.email ?? 'Für beliebige Adresse'}
+                </p>
+                <p className="text-xs text-muted-foreground">
+                  {item.state === 'used'
+                    ? `Verwendet von ${item.usedByName ?? 'jemandem'} am ${formatDate(item.usedAt)}`
+                    : `Gültig bis ${formatDate(item.expiresAt)}`}
+                </p>
+              </div>
+
+              <Badge
+                variant={
+                  item.state === 'open' ? 'default' : item.state === 'used' ? 'secondary' : 'outline'
+                }
+              >
+                {item.state === 'open' ? 'Offen' : item.state === 'used' ? 'Verwendet' : 'Abgelaufen'}
+              </Badge>
+              {item.role === 'admin' ? <Badge variant="outline">Admin</Badge> : null}
+
+              <Button
+                variant="ghost"
+                size="icon-sm"
+                aria-label="Einladung löschen"
+                onClick={() => remove(item.id)}
+                disabled={pending}
+              >
+                <Trash2 className="text-destructive" />
+              </Button>
+            </li>
+          ))}
+        </ul>
+      )}
+
+      <Dialog open={createOpen} onOpenChange={setCreateOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Einladung erstellen</DialogTitle>
+            <DialogDescription>
+              Du bekommst einen Link, den du weitergibst. Er funktioniert genau einmal.
+            </DialogDescription>
+          </DialogHeader>
+
+          <form id="invite-form" onSubmit={submit} className="space-y-4">
+            <Field
+              label="E-Mail"
+              htmlFor="invite-email"
+              hint="Optional. Wenn gesetzt, funktioniert der Link nur mit dieser Adresse."
+            >
+              <Input id="invite-email" name="email" type="email" inputMode="email" maxLength={160} />
+            </Field>
+
+            <div className="grid gap-4 sm:grid-cols-2">
+              <Field label="Rolle" htmlFor="invite-role">
+                <NativeSelect id="invite-role" name="role" defaultValue="member">
+                  <option value="member">Mitglied</option>
+                  <option value="admin">Administrator</option>
+                </NativeSelect>
+              </Field>
+
+              <Field label="Gültig für" htmlFor="invite-days">
+                <NativeSelect id="invite-days" name="validDays" defaultValue="14">
+                  <option value="1">1 Tag</option>
+                  <option value="7">7 Tage</option>
+                  <option value="14">14 Tage</option>
+                  <option value="30">30 Tage</option>
+                </NativeSelect>
+              </Field>
+            </div>
+          </form>
+
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setCreateOpen(false)} disabled={pending}>
+              Abbrechen
+            </Button>
+            <Button type="submit" form="invite-form" disabled={pending}>
+              {pending ? <Loader2 className="animate-spin" /> : <Plus />}
+              Erstellen
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={link !== null} onOpenChange={(open) => !open && setLink(null)}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Einladungslink</DialogTitle>
+            <DialogDescription>
+              Der Link wird nur jetzt angezeigt – in der Datenbank liegt nur sein Hash. Kopiere
+              ihn und schick ihn weiter.
+            </DialogDescription>
+          </DialogHeader>
+
+          <Input
+            readOnly
+            aria-label="Einladungslink"
+            value={link ?? ''}
+            onFocus={(event) => event.currentTarget.select()}
+            className="font-mono text-xs"
+          />
+
+          <DialogFooter>
+            <Button variant="outline" onClick={copy}>
+              {copied ? <Check className="text-emerald-600" /> : <Copy />}
+              Link kopieren
+            </Button>
+            <Button onClick={() => setLink(null)}>Fertig</Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </div>
+  );
+}

src/components/verwaltung/verwaltung-nav.tsx

@@ -5,17 +5,20 @@ import { usePathname } from 'next/navigation';
 import { cn } from 'cn';
 
 const tabs = [
-  { href: '/verwaltung/hersteller', label: 'Hersteller' },
+  { href: '/verwaltung/hersteller', label: 'Hersteller', adminOnly: false },
-  { href: '/verwaltung/themen', label: 'Themen' },
+  { href: '/verwaltung/themen', label: 'Themen', adminOnly: false },
-  { href: '/verwaltung/standorte', label: 'Standorte' },
+  { href: '/verwaltung/standorte', label: 'Standorte', adminOnly: false },
+  { href: '/verwaltung/einladungen', label: 'Einladungen', adminOnly: true },
+  { href: '/verwaltung/daten', label: 'Daten', adminOnly: true },
 ] as const;
 
-export function VerwaltungNav() {
+export function VerwaltungNav({ isAdmin }: { isAdmin: boolean }) {
   const pathname = usePathname();
+  const visible = tabs.filter((tab) => !tab.adminOnly || isAdmin);
 
   return (
     <nav className="flex gap-1 overflow-x-auto rounded-lg bg-muted p-1" aria-label="Stammdaten">
-      {tabs.map((tab) => {
+      {visible.map((tab) => {
         const active = pathname === tab.href;
         return (
           <Link

src/env.ts

@@ -31,8 +31,23 @@ const schema = z.object({
   REBRICKABLE_API_KEY: z.string().min(1).optional(),
 });
 
+/**
+ * An empty value counts as "not set".
+ *
+ * A line like `BASE_URL=` in a .env file is a common slip, and so is an empty
+ * variable injected by a container runtime. Falling back to the default beats
+ * failing to start with "Invalid URL".
+ */
+function withoutEmptyValues(source: NodeJS.ProcessEnv): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (typeof value === 'string' && value.trim() !== '') result[key] = value;
+  }
+  return result;
+}
+
 function parseEnv() {
-  const parsed = schema.safeParse(process.env);
+  const parsed = schema.safeParse(withoutEmptyValues(process.env));
   if (!parsed.success) {
     const issues = parsed.error.issues
       .map((issue) => `  - ${issue.path.join('.')}: ${issue.message}`)

src/lib/auth.ts

@@ -6,6 +6,7 @@ import { nextCookies } from 'better-auth/next-js';
 import { count } from 'drizzle-orm';
 import { db, schema } from '@/db';
 import { env } from '@/env';
+import { currentInviteGrant } from './invites';
 
 /**
  * Returns true while the instance has no user at all.
@@ -90,15 +91,22 @@ export const auth = betterAuth({
     user: {
       create: {
         before: async (user) => {
-          const firstRun = isFirstRun();
+          // The very first account owns the instance.
-          if (!firstRun) {
+          if (isFirstRun()) {
-            // Phase 2 opens this up again for invited users.
+            return { data: { ...user, role: 'admin' as const } };
+          }
+
+          // Everyone after that needs an invitation. The grant is set by the
+          // server action that verified the link token, never by the client.
+          const grant = currentInviteGrant();
+          if (!grant) {
             throw new APIError('FORBIDDEN', {
               message:
                 'Die Registrierung ist geschlossen. Bitte lass dir vom Administrator einen Einladungslink schicken.',
             });
           }
-          return { data: { ...user, role: 'admin' as const } };
+
+          return { data: { ...user, role: grant.role } };
         },
       },
     },

src/lib/ean.ts

@@ -0,0 +1,41 @@
+/**
+ * Barcode helpers.
+ *
+ * Kept free of server-only imports so both the scanner in the browser and the
+ * lookup on the server use the very same rules.
+ */
+
+/** Digits only - scanners and humans disagree about spaces and dashes. */
+export function normalizeEan(input: string): string {
+  return input.replace(/\D/g, '');
+}
+
+/**
+ * Checks an EAN-8, EAN-13 or UPC-A against its check digit.
+ *
+ * Worth doing: a camera occasionally reads a digit wrong, and without this a
+ * misread would silently create a second catalog entry for a set that is
+ * already there.
+ */
+export function isValidEan(input: string): boolean {
+  const digits = normalizeEan(input);
+  if (![8, 12, 13].includes(digits.length)) return false;
+
+  // From the right: every second digit counts three times.
+  const checkDigit = Number(digits[digits.length - 1]);
+  const body = digits.slice(0, -1);
+
+  let sum = 0;
+  for (let index = body.length - 1, weight = 3; index >= 0; index -= 1, weight = weight === 3 ? 1 : 3) {
+    sum += Number(body[index]) * weight;
+  }
+
+  return (10 - (sum % 10)) % 10 === checkDigit;
+}
+
+/** "4005556603985" -> "4 005556 603985" for readable display. */
+export function formatEan(input: string): string {
+  const digits = normalizeEan(input);
+  if (digits.length !== 13) return digits;
+  return `${digits.slice(0, 1)} ${digits.slice(1, 7)} ${digits.slice(7)}`;
+}

src/lib/export.ts

@@ -0,0 +1,304 @@
+import 'server-only';
+import fs from 'node:fs';
+import path from 'node:path';
+import { zipSync, unzipSync, strToU8, strFromU8 } from 'fflate';
+import { db } from '@/db';
+import * as schema from '@/db/schema';
+import { env } from '@/env';
+import { formatDate } from './format';
+
+/**
+ * Export and import of the whole collection.
+ *
+ * What this is: a portable copy of the data - to move to another machine, to
+ * look at outside the app, or as a second safety net.
+ *
+ * What this is not: a replacement for backing up ./data. Accounts, passwords
+ * and passkeys are deliberately left out, because a JSON file full of password
+ * hashes in someone's download folder is a liability, not a backup.
+ */
+
+export const EXPORT_FORMAT_VERSION = 1;
+
+export type ExportPayload = {
+  formatVersion: number;
+  exportedAt: string;
+  app: string;
+  data: {
+    manufacturers: unknown[];
+    themes: unknown[];
+    sets: unknown[];
+    tags: unknown[];
+    setTags: unknown[];
+    instructions: unknown[];
+    locations: unknown[];
+    collectionItems: unknown[];
+    missingParts: unknown[];
+    photos: unknown[];
+    wishlists: unknown[];
+    wishlistItems: unknown[];
+  };
+};
+
+/** Everything except accounts and sessions. */
+export function buildExportPayload(): ExportPayload {
+  return {
+    formatVersion: EXPORT_FORMAT_VERSION,
+    exportedAt: new Date().toISOString(),
+    app: 'bricktrack',
+    data: {
+      manufacturers: db.select().from(schema.manufacturer).all(),
+      themes: db.select().from(schema.theme).all(),
+      sets: db.select().from(schema.set).all(),
+      tags: db.select().from(schema.tag).all(),
+      setTags: db.select().from(schema.setTag).all(),
+      instructions: db.select().from(schema.instruction).all(),
+      locations: db.select().from(schema.location).all(),
+      collectionItems: db.select().from(schema.collectionItem).all(),
+      missingParts: db.select().from(schema.missingPart).all(),
+      photos: db.select().from(schema.photo).all(),
+      // Reservations are personal data of people without an account and have
+      // no meaning outside the running instance - so they stay behind.
+      wishlists: db
+        .select()
+        .from(schema.wishlist)
+        .all()
+        .map(({ shareToken, ...rest }) => ({ ...rest, shareToken: null })),
+      wishlistItems: db
+        .select()
+        .from(schema.wishlistItem)
+        .all()
+        .map(({ reservationTokenHash, reservedByName, reservedAt, ...rest }) => rest),
+    },
+  };
+}
+
+/** Collects every uploaded file, keyed by its path relative to FILES_DIR. */
+function collectFiles(): Record<string, Uint8Array> {
+  const files: Record<string, Uint8Array> = {};
+  const root = env.FILES_DIR;
+  if (!fs.existsSync(root)) return files;
+
+  const walk = (dir: string) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const absolute = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(absolute);
+        continue;
+      }
+      const relative = path.relative(root, absolute).split(path.sep).join('/');
+      files[`files/${relative}`] = new Uint8Array(fs.readFileSync(absolute));
+    }
+  };
+
+  walk(root);
+  return files;
+}
+
+/** One archive with the data and every uploaded file. */
+export function buildExportZip(): Uint8Array {
+  const payload = buildExportPayload();
+
+  return zipSync(
+    {
+      'bricktrack.json': strToU8(JSON.stringify(payload, null, 2)),
+      ...collectFiles(),
+    },
+    // Level 6 is the sweet spot: JPEGs and PDFs barely compress anyway.
+    { level: 6 },
+  );
+}
+
+export function exportFileName(extension: string): string {
+  const today = formatDate(new Date()).split('.').reverse().join('-');
+  return `bricktrack-${today}.${extension}`;
+}
+
+// ---------------------------------------------------------------------------
+// CSV
+// ---------------------------------------------------------------------------
+
+function csvCell(value: unknown): string {
+  if (value === null || value === undefined) return '';
+  const text = String(value);
+  return /[";\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
+/**
+ * The collection as CSV, semicolon separated with a BOM - that is what German
+ * Excel opens without asking questions.
+ */
+export function buildCollectionCsv(
+  rows: Array<Record<string, string | number | null>>,
+  columns: Array<{ key: string; label: string }>,
+): string {
+  const lines = [columns.map((column) => csvCell(column.label)).join(';')];
+
+  for (const row of rows) {
+    lines.push(columns.map((column) => csvCell(row[column.key])).join(';'));
+  }
+
+  return `${lines.join('\r\n')}\r\n`;
+}
+
+// ---------------------------------------------------------------------------
+// Import
+// ---------------------------------------------------------------------------
+
+export class ImportError extends Error {}
+
+export type ImportSummary = {
+  sets: number;
+  collectionItems: number;
+  wishlists: number;
+  files: number;
+};
+
+type ArchiveContents = {
+  payload: ExportPayload;
+  files: Record<string, Uint8Array>;
+};
+
+function readArchive(bytes: Uint8Array): ArchiveContents {
+  let entries: Record<string, Uint8Array>;
+  try {
+    entries = unzipSync(bytes);
+  } catch {
+    throw new ImportError('Die Datei ist kein gültiges Bricktrack-Archiv (ZIP erwartet).');
+  }
+
+  const json = entries['bricktrack.json'];
+  if (!json) {
+    throw new ImportError('Im Archiv fehlt bricktrack.json. Stammt es wirklich aus Bricktrack?');
+  }
+
+  let payload: ExportPayload;
+  try {
+    payload = JSON.parse(strFromU8(json)) as ExportPayload;
+  } catch {
+    throw new ImportError('bricktrack.json lässt sich nicht lesen.');
+  }
+
+  if (payload.app !== 'bricktrack' || typeof payload.data !== 'object') {
+    throw new ImportError('Das Archiv stammt nicht aus Bricktrack.');
+  }
+  if (payload.formatVersion > EXPORT_FORMAT_VERSION) {
+    throw new ImportError(
+      `Das Archiv wurde mit einer neueren Version erstellt (Format ${payload.formatVersion}). Bitte zuerst Bricktrack aktualisieren.`,
+    );
+  }
+
+  const files: Record<string, Uint8Array> = {};
+  for (const [name, content] of Object.entries(entries)) {
+    if (name.startsWith('files/') && !name.endsWith('/')) {
+      files[name.slice('files/'.length)] = content;
+    }
+  }
+
+  return { payload, files };
+}
+
+/** Guards against a path escaping FILES_DIR through the archive. */
+function safeTarget(relative: string): string | null {
+  const absolute = path.resolve(env.FILES_DIR, relative);
+  const root = path.resolve(env.FILES_DIR);
+  return absolute.startsWith(root + path.sep) ? absolute : null;
+}
+
+/**
+ * Replaces all application data with the contents of the archive.
+ *
+ * Deliberately a replacement and not a merge: merging two collections would
+ * need conflict rules for every table, and the result would be impossible to
+ * predict. Wishlists are handed to the importing admin, since the original
+ * owner's account does not travel with the archive.
+ */
+export function importArchive(bytes: Uint8Array, ownerUserId: string): ImportSummary {
+  const { payload, files } = readArchive(bytes);
+  const data = payload.data;
+
+  db.transaction((tx) => {
+    // Order matters only for readability - the foreign keys cascade anyway.
+    tx.delete(schema.wishlistItem).run();
+    tx.delete(schema.wishlist).run();
+    tx.delete(schema.missingPart).run();
+    tx.delete(schema.photo).run();
+    tx.delete(schema.instruction).run();
+    tx.delete(schema.collectionItem).run();
+    tx.delete(schema.setTag).run();
+    tx.delete(schema.set).run();
+    tx.delete(schema.tag).run();
+    tx.delete(schema.theme).run();
+    tx.delete(schema.manufacturer).run();
+    tx.delete(schema.location).run();
+
+    const insertAll = (table: never, rows: unknown[]) => {
+      if (!Array.isArray(rows) || rows.length === 0) return;
+      // Insert in batches: SQLite caps the number of bound variables.
+      for (let index = 0; index < rows.length; index += 100) {
+        tx.insert(table)
+          .values(rows.slice(index, index + 100) as never)
+          .run();
+      }
+    };
+
+    insertAll(schema.manufacturer as never, revive(data.manufacturers));
+    insertAll(schema.location as never, revive(data.locations));
+    insertAll(schema.theme as never, revive(data.themes));
+    insertAll(schema.set as never, revive(data.sets));
+    insertAll(schema.tag as never, revive(data.tags));
+    insertAll(schema.setTag as never, revive(data.setTags));
+    insertAll(schema.instruction as never, revive(data.instructions));
+    insertAll(schema.collectionItem as never, revive(data.collectionItems));
+    insertAll(schema.missingPart as never, revive(data.missingParts));
+    insertAll(schema.photo as never, revive(data.photos));
+
+    const wishlists = revive(data.wishlists).map((row) => ({
+      ...(row as Record<string, unknown>),
+      ownerUserId,
+      // Fresh tokens: links from the exporting instance must not resurrect.
+      shareToken: crypto.randomUUID().replace(/-/g, ''),
+      isPublic: false,
+    }));
+    insertAll(schema.wishlist as never, wishlists);
+    insertAll(schema.wishlistItem as never, revive(data.wishlistItems));
+  });
+
+  let restored = 0;
+  for (const [relative, content] of Object.entries(files)) {
+    const target = safeTarget(relative);
+    if (!target) continue;
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, content);
+    restored += 1;
+  }
+
+  return {
+    sets: data.sets?.length ?? 0,
+    collectionItems: data.collectionItems?.length ?? 0,
+    wishlists: data.wishlists?.length ?? 0,
+    files: restored,
+  };
+}
+
+/**
+ * JSON has no date type, so timestamps come back as strings. Drizzle expects
+ * Date objects for its timestamp columns.
+ */
+function revive(rows: unknown[]): unknown[] {
+  if (!Array.isArray(rows)) return [];
+
+  return rows.map((row) => {
+    if (typeof row !== 'object' || row === null) return row;
+
+    const result: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(row as Record<string, unknown>)) {
+      const looksLikeDate =
+        typeof value === 'string' &&
+        /(At|Date)$/.test(key) &&
+        /^\d{4}-\d{2}-\d{2}T/.test(value);
+      result[key] = looksLikeDate ? new Date(value) : value;
+    }
+    return result;
+  });
+}

src/lib/invites.ts

@@ -0,0 +1,140 @@
+import 'server-only';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { and, desc, eq, isNull, gt } from 'drizzle-orm';
+import { db } from '@/db';
+import { invite, user } from '@/db/schema';
+import type { UserRole } from '@/db/types';
+import { createToken, hashToken } from './tokens';
+
+/**
+ * Invitations.
+ *
+ * After the first user, sign-up is closed. An admin issues a link; the
+ * plaintext token only ever lives in that link, the database keeps its
+ * SHA-256 hash.
+ */
+
+export type InviteGrant = { inviteId: string; role: UserRole };
+
+/**
+ * Marks the current call stack as "covered by a valid invitation".
+ *
+ * better-auth's user-create hook has no way of receiving extra arguments, and
+ * the sign-up payload must not be trusted with a role. AsyncLocalStorage keeps
+ * the grant tied to the one server action that verified the token - it can
+ * neither leak into another request nor be forged from the client.
+ */
+const grantStorage = new AsyncLocalStorage<InviteGrant>();
+
+export function withInviteGrant<T>(grant: InviteGrant, fn: () => Promise<T>): Promise<T> {
+  return grantStorage.run(grant, fn);
+}
+
+export function currentInviteGrant(): InviteGrant | undefined {
+  return grantStorage.getStore();
+}
+
+export const INVITE_VALID_DAYS = 14;
+
+export function createInvite(input: {
+  createdByUserId: string;
+  email: string | null;
+  role: UserRole;
+  validDays?: number;
+}): { id: string; token: string; expiresAt: Date } {
+  const token = createToken();
+  const expiresAt = new Date(
+    Date.now() + (input.validDays ?? INVITE_VALID_DAYS) * 24 * 60 * 60 * 1000,
+  );
+  const id = crypto.randomUUID();
+
+  db.insert(invite)
+    .values({
+      id,
+      tokenHash: hashToken(token),
+      email: input.email,
+      role: input.role,
+      createdByUserId: input.createdByUserId,
+      expiresAt,
+      createdAt: new Date(),
+    })
+    .run();
+
+  return { id, token, expiresAt };
+}
+
+export type UsableInvite = {
+  id: string;
+  email: string | null;
+  role: UserRole;
+  expiresAt: Date;
+};
+
+/** Returns the invite behind a link token, or null if it cannot be used. */
+export function findUsableInvite(token: string): UsableInvite | null {
+  if (!token) return null;
+
+  const row = db
+    .select({
+      id: invite.id,
+      email: invite.email,
+      role: invite.role,
+      expiresAt: invite.expiresAt,
+    })
+    .from(invite)
+    .where(
+      and(
+        eq(invite.tokenHash, hashToken(token)),
+        isNull(invite.usedAt),
+        gt(invite.expiresAt, new Date()),
+      ),
+    )
+    .get();
+
+  return row ?? null;
+}
+
+export function markInviteUsed(inviteId: string, userId: string): void {
+  db.update(invite)
+    .set({ usedAt: new Date(), usedByUserId: userId })
+    .where(eq(invite.id, inviteId))
+    .run();
+}
+
+export function deleteInvite(inviteId: string): void {
+  db.delete(invite).where(eq(invite.id, inviteId)).run();
+}
+
+export type InviteRow = {
+  id: string;
+  email: string | null;
+  role: UserRole;
+  expiresAt: Date;
+  usedAt: Date | null;
+  usedByName: string | null;
+  createdAt: Date;
+};
+
+export function listInvites(): InviteRow[] {
+  return db
+    .select({
+      id: invite.id,
+      email: invite.email,
+      role: invite.role,
+      expiresAt: invite.expiresAt,
+      usedAt: invite.usedAt,
+      usedByName: user.name,
+      createdAt: invite.createdAt,
+    })
+    .from(invite)
+    .leftJoin(user, eq(user.id, invite.usedByUserId))
+    .orderBy(desc(invite.createdAt))
+    .all();
+}
+
+/** An invite is only interesting while it can still be used. */
+export function inviteState(row: InviteRow): 'used' | 'expired' | 'open' {
+  if (row.usedAt) return 'used';
+  if (row.expiresAt.getTime() <= Date.now()) return 'expired';
+  return 'open';
+}

src/lib/queries/catalog.ts

@@ -160,6 +160,24 @@ export function getSetById(id: string) {
   return row ?? null;
 }
 
+/**
+ * Lookup by barcode. EANs are stored as typed, so the comparison strips
+ * everything but digits on both sides - a scanner never produces the spaces
+ * and dashes people write by hand.
+ */
+export function findSetByEan(ean: string) {
+  const digits = ean.replace(/\D/g, '');
+  if (digits.length === 0) return null;
+
+  return (
+    db
+      .select({ id: set.id, setNumber: set.setNumber, name: set.name })
+      .from(set)
+      .where(sql`replace(replace(coalesce(${set.ean}, ''), '-', ''), ' ', '') = ${digits}`)
+      .get() ?? null
+  );
+}
+
 export function getSetByNumber(manufacturerId: string, setNumber: string) {
   return (
     db

src/lib/queries/collection.ts

@@ -1,7 +1,7 @@
 import 'server-only';
-import { and, asc, countDistinct, eq, sql, type SQL } from 'drizzle-orm';
+import { and, asc, countDistinct, eq, inArray, sql, type SQL } from 'drizzle-orm';
 import { db } from '@/db';
-import { collectionItem, location, manufacturer, set, theme } from '@/db/schema';
+import { collectionItem, location, manufacturer, missingPart, set, theme } from '@/db/schema';
 import { SOLD_STATUS } from '@/lib/ownership';
 import type { CollectionStatus, Completeness, Condition } from '@/db/types';
 
@@ -158,3 +158,51 @@ export function countMissingSets(): number {
 
   return row?.total ?? 0;
 }
+
+export type MissingPartRow = {
+  id: string;
+  partNumber: string | null;
+  colorName: string | null;
+  quantity: number;
+  resolved: boolean;
+  notes: string | null;
+};
+
+export function listMissingParts(collectionItemId: string): MissingPartRow[] {
+  return db
+    .select({
+      id: missingPart.id,
+      partNumber: missingPart.partNumber,
+      colorName: missingPart.colorName,
+      quantity: missingPart.quantity,
+      resolved: missingPart.resolved,
+      notes: missingPart.notes,
+    })
+    .from(missingPart)
+    .where(eq(missingPart.collectionItemId, collectionItemId))
+    // Open entries first: those are the ones you act on.
+    .orderBy(asc(missingPart.resolved), asc(missingPart.createdAt))
+    .all();
+}
+
+/** Open missing parts per collection item, for the badges in the lists. */
+export function countOpenMissingParts(collectionItemIds: string[]): Map<string, number> {
+  if (collectionItemIds.length === 0) return new Map();
+
+  const rows = db
+    .select({
+      collectionItemId: missingPart.collectionItemId,
+      open: sql<number>`count(*)`.mapWith(Number),
+    })
+    .from(missingPart)
+    .where(
+      and(
+        inArray(missingPart.collectionItemId, collectionItemIds),
+        eq(missingPart.resolved, false),
+      ),
+    )
+    .groupBy(missingPart.collectionItemId)
+    .all();
+
+  return new Map(rows.map((row) => [row.collectionItemId, row.open]));
+}

src/lib/rebrickable.ts

@@ -0,0 +1,140 @@
+import 'server-only';
+import { env } from '@/env';
+import { displaySetNumber, normalizeSetNumber } from './set-number';
+
+export { displaySetNumber, legoInstructionsUrl, normalizeSetNumber } from './set-number';
+
+/**
+ * Rebrickable lookup for Lego sets.
+ *
+ * Entirely optional: without REBRICKABLE_API_KEY the import stays switched
+ * off and everything keeps working by hand. Every request runs here on the
+ * server - the browser never talks to rebrickable.com.
+ */
+
+const API_BASE = 'https://rebrickable.com/api/v3/lego';
+const REQUEST_TIMEOUT_MS = 10_000;
+
+export function isRebrickableEnabled(): boolean {
+  return Boolean(env.REBRICKABLE_API_KEY);
+}
+
+export class RebrickableError extends Error {}
+
+export type RebrickableSet = {
+  setNumber: string;
+  name: string;
+  year: number | null;
+  pieceCount: number | null;
+  themeId: number | null;
+  imageUrl: string | null;
+  externalUrl: string | null;
+};
+
+export type RebrickableTheme = {
+  id: number;
+  name: string;
+  parentId: number | null;
+};
+
+async function request<T>(path: string): Promise<T | null> {
+  const key = env.REBRICKABLE_API_KEY;
+  if (!key) throw new RebrickableError('Für den Import fehlt der Rebrickable-API-Key.');
+
+  let response: Response;
+  try {
+    response = await fetch(`${API_BASE}${path}`, {
+      headers: {
+        Authorization: `key ${key}`,
+        Accept: 'application/json',
+      },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      // The catalog is not a moving target; a day of caching is plenty.
+      next: { revalidate: 86_400 },
+    });
+  } catch (error) {
+    console.error('[rebrickable] Anfrage fehlgeschlagen', path, error);
+    throw new RebrickableError('Rebrickable ist gerade nicht erreichbar.');
+  }
+
+  if (response.status === 404) return null;
+  if (response.status === 401 || response.status === 403) {
+    throw new RebrickableError('Der Rebrickable-API-Key wird abgelehnt. Bitte prüf ihn.');
+  }
+  if (response.status === 429) {
+    throw new RebrickableError('Rebrickable drosselt gerade. Bitte in einer Minute noch einmal.');
+  }
+  if (!response.ok) {
+    throw new RebrickableError(`Rebrickable antwortet mit Status ${response.status}.`);
+  }
+
+  return (await response.json()) as T;
+}
+
+type SetResponse = {
+  set_num: string;
+  name: string;
+  year: number | null;
+  theme_id: number | null;
+  num_parts: number | null;
+  set_img_url: string | null;
+  set_url: string | null;
+};
+
+export async function fetchSet(setNumber: string): Promise<RebrickableSet | null> {
+  const data = await request<SetResponse>(`/sets/${encodeURIComponent(normalizeSetNumber(setNumber))}/`);
+  if (!data) return null;
+
+  return {
+    setNumber: displaySetNumber(data.set_num),
+    name: data.name,
+    year: data.year ?? null,
+    pieceCount: data.num_parts ?? null,
+    themeId: data.theme_id ?? null,
+    imageUrl: data.set_img_url ?? null,
+    externalUrl: data.set_url ?? null,
+  };
+}
+
+type ThemeResponse = { id: number; name: string; parent_id: number | null };
+
+export async function fetchTheme(themeId: number): Promise<RebrickableTheme | null> {
+  const data = await request<ThemeResponse>(`/themes/${themeId}/`);
+  if (!data) return null;
+  return { id: data.id, name: data.name, parentId: data.parent_id ?? null };
+}
+
+type MinifigsResponse = { results: Array<{ quantity: number | null }> };
+
+/** Number of minifigures, or null when the lookup does not work out. */
+export async function fetchMinifigCount(setNumber: string): Promise<number | null> {
+  try {
+    const data = await request<MinifigsResponse>(
+      `/sets/${encodeURIComponent(normalizeSetNumber(setNumber))}/minifigs/`,
+    );
+    if (!data) return null;
+    return data.results.reduce((total, row) => total + (row.quantity ?? 0), 0);
+  } catch {
+    // A missing minifig list must not fail the whole import.
+    return null;
+  }
+}
+
+/**
+ * Downloads the set image so it keeps working when Rebrickable changes or
+ * removes it. Returns null instead of throwing: an import without a picture
+ * is still a good import.
+ */
+export async function fetchImageBytes(url: string): Promise<Buffer | null> {
+  try {
+    const response = await fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    if (!response.ok) return null;
+
+    const buffer = Buffer.from(await response.arrayBuffer());
+    return buffer.byteLength > 0 ? buffer : null;
+  } catch (error) {
+    console.error('[rebrickable] Bild konnte nicht geladen werden', url, error);
+    return null;
+  }
+}
+

src/lib/set-number.ts

@@ -0,0 +1,32 @@
+/**
+ * Set-number handling for the Lego import.
+ *
+ * Deliberately free of server-only imports so it can be unit tested and, if
+ * ever needed, used on the client.
+ */
+
+/**
+ * Rebrickable numbers a set's variant explicitly: the box says "60398", the
+ * API knows "60398-1". People type what is printed on the box, so the suffix
+ * is added when it is missing.
+ */
+export function normalizeSetNumber(input: string): string {
+  const trimmed = input.trim().toUpperCase();
+  return /-\d+$/.test(trimmed) ? trimmed : `${trimmed}-1`;
+}
+
+/** The number as it should be stored and shown: without the "-1" variant. */
+export function displaySetNumber(setNum: string): string {
+  return setNum.trim().replace(/-1$/, '');
+}
+
+/**
+ * Lego publishes building instructions per set number. Rebrickable's API does
+ * not expose instruction files, so the import links to Lego's own service page
+ * rather than pretending to have the PDF.
+ */
+export function legoInstructionsUrl(setNumber: string): string {
+  return `https://www.lego.com/de-de/service/building-instructions/${encodeURIComponent(
+    displaySetNumber(setNumber),
+  )}`;
+}

src/lib/uploads.ts

@@ -88,8 +88,25 @@ export type StoredImage = {
  */
 export async function storeImage(file: File, kind: UploadKind, ownerId: string): Promise<StoredImage> {
   assertSize(file);
+  return storeImageBytes(Buffer.from(await file.arrayBuffer()), kind, ownerId);
+}
+
+/**
+ * Same as `storeImage`, but for bytes we already hold - for instance an image
+ * the server fetched from an import source. The size limit still applies.
+ */
+export async function storeImageBytes(
+  bytes: Buffer,
+  kind: UploadKind,
+  ownerId: string,
+): Promise<StoredImage> {
+  if (bytes.byteLength === 0) throw new UploadError('Die Datei ist leer.');
+  if (bytes.byteLength > env.MAX_UPLOAD_BYTES) {
+    throw new UploadError(
+      `Das Bild ist größer als ${env.MAX_UPLOAD_MB} MB und wurde nicht übernommen.`,
+    );
+  }
 
-  const bytes = Buffer.from(await file.arrayBuffer());
   const mime = detectMimeType(bytes);
   if (!mime || !IMAGE_MIME_TYPES.includes(mime as (typeof IMAGE_MIME_TYPES)[number])) {
     throw new UploadError('Erlaubt sind nur JPEG-, PNG- und WebP-Bilder.');

src/lib/validation.ts

@@ -147,6 +147,22 @@ export const collectionItemSchema = z.object({
   notes: optionalText(2000),
 });
 
+/**
+ * A missing part needs at least something identifying: a part number or a
+ * note. An entry with neither says nothing and would only clutter the list.
+ */
+export const missingPartSchema = z
+  .object({
+    partNumber: optionalText(40),
+    colorName: optionalText(40),
+    quantity: z.coerce.number().int().min(1).max(999).default(1),
+    notes: optionalText(300),
+  })
+  .refine(
+    (value) => value.partNumber !== null || value.notes !== null,
+    'Bitte gib mindestens die Teilenummer oder eine Notiz an.',
+  );
+
 // ---------------------------------------------------------------------------
 // Wishlists
 // ---------------------------------------------------------------------------

src/middleware.ts

@@ -24,9 +24,11 @@ export const config = {
      * Everything except the public surface:
      * - /anmelden, /registrieren, /einladung  (auth pages)
      * - /w/...                                (public wishlists)
+     * - /offline                              (shown by the service worker)
      * - /api/auth, /api/health, /api/files    (handled by their own guards)
+     * - sw.js, manifest, icons                (must load before a session exists)
      * - Next internals and static assets
      */
-    '/((?!anmelden|registrieren|einladung|w/|api/auth|api/health|api/files|_next/static|_next/image|favicon.ico|icons/|manifest.webmanifest).*)',
+    '/((?!anmelden|registrieren|einladung|offline|w/|api/auth|api/health|api/files|_next/static|_next/image|favicon.ico|favicon.png|icons/|sw.js|manifest.webmanifest).*)',
   ],
 };

tests/setup-env.ts

@@ -0,0 +1,17 @@
+/**
+ * Baseline environment for unit tests.
+ *
+ * src/env.ts validates on import and refuses to start on a bad configuration -
+ * which is the point in production, but in tests every module that reads the
+ * environment would fail before its first assertion. These are placeholders,
+ * never anything a test asserts on.
+ *
+ * BASE_URL is overwritten unconditionally: Vite uses that very name for its
+ * public base path and sets it to "/", which is not a URL. The clash only
+ * exists under Vite-based tooling, never in the app itself.
+ */
+// NODE_ENV is typed read-only; vitest already sets it to 'test'.
+process.env.BASE_URL = 'http://localhost:3000';
+process.env.BETTER_AUTH_SECRET =
+  process.env.BETTER_AUTH_SECRET || 'test-secret-mindestens-32-zeichen-lang-0123';
+process.env.DATA_DIR = process.env.DATA_DIR || './data-test';

tests/stubs/server-only.ts

@@ -0,0 +1,8 @@
+/**
+ * Stub for the `server-only` marker package.
+ *
+ * The real module throws on import outside a React Server Component, which
+ * would make every server module untestable. Importing it is a build-time
+ * guard, not behaviour, so an empty module is the honest replacement here.
+ */
+export {};

tests/unit/ean.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { formatEan, isValidEan, normalizeEan } from '@/lib/ean';
+
+describe('EAN normalisieren', () => {
+  it('behaelt nur Ziffern', () => {
+    expect(normalizeEan('4 005556 603985')).toBe('4005556603985');
+    expect(normalizeEan('4005556-603985')).toBe('4005556603985');
+  });
+});
+
+describe('EAN pruefen', () => {
+  it('akzeptiert gueltige EAN-13', () => {
+    // Playmobil 70392 und ein Lego-Beispiel.
+    expect(isValidEan('4008789703927')).toBe(true);
+    expect(isValidEan('5702017152677')).toBe(true);
+  });
+
+  it('akzeptiert gueltige EAN-8 und UPC-A', () => {
+    expect(isValidEan('96385074')).toBe(true);
+    expect(isValidEan('036000291452')).toBe(true);
+  });
+
+  it('lehnt eine falsche Pruefziffer ab', () => {
+    // Letzte Ziffer verdreht - genau der Fall, den eine Kamera produziert.
+    expect(isValidEan('4008789703928')).toBe(false);
+    expect(isValidEan('5702017152678')).toBe(false);
+  });
+
+  it('lehnt falsche Laengen ab', () => {
+    expect(isValidEan('')).toBe(false);
+    expect(isValidEan('123')).toBe(false);
+    expect(isValidEan('40087897039271')).toBe(false);
+  });
+
+  it('ignoriert Trennzeichen bei der Pruefung', () => {
+    expect(isValidEan('4 008789 703927')).toBe(true);
+  });
+});
+
+describe('EAN anzeigen', () => {
+  it('gruppiert eine EAN-13 lesbar', () => {
+    expect(formatEan('4008789703927')).toBe('4 008789 703927');
+  });
+
+  it('laesst andere Laengen unveraendert', () => {
+    expect(formatEan('96385074')).toBe('96385074');
+  });
+});

tests/unit/export.test.ts

@@ -0,0 +1,313 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import Database from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+import { migrate } from 'drizzle-orm/better-sqlite3/migrator';
+import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
+
+// A throwaway database for this file alone, so the round trip can delete
+// everything without touching the development data.
+const DATA_DIR = path.resolve(process.cwd(), 'data-test-export');
+process.env.DATA_DIR = DATA_DIR;
+
+fs.rmSync(DATA_DIR, { recursive: true, force: true });
+fs.mkdirSync(path.join(DATA_DIR, 'db'), { recursive: true });
+fs.mkdirSync(path.join(DATA_DIR, 'files', 'images', 'sets'), { recursive: true });
+
+{
+  const sqlite = new Database(path.join(DATA_DIR, 'db', 'bricktrack.db'));
+  migrate(drizzle(sqlite), { migrationsFolder: path.resolve(process.cwd(), 'drizzle') });
+  sqlite.close();
+}
+
+const { db } = await import('@/db');
+const schema = await import('@/db/schema');
+const { buildExportPayload, buildExportZip, importArchive, ImportError, buildCollectionCsv } =
+  await import('@/lib/export');
+
+const now = new Date('2026-09-07T10:00:00.000Z');
+const USER_ID = 'user-1';
+const OTHER_USER_ID = 'user-2';
+
+function seed() {
+  db.insert(schema.user)
+    .values([
+      {
+        id: USER_ID,
+        name: 'Florian',
+        email: 'florian@example.test',
+        emailVerified: false,
+        role: 'admin',
+        createdAt: now,
+        updatedAt: now,
+      },
+      {
+        id: OTHER_USER_ID,
+        name: 'Mama',
+        email: 'mama@example.test',
+        emailVerified: false,
+        role: 'member',
+        createdAt: now,
+        updatedAt: now,
+      },
+    ])
+    .run();
+
+  db.insert(schema.manufacturer)
+    .values({ id: 'm-1', name: 'Lego', slug: 'lego', createdAt: now, updatedAt: now })
+    .run();
+
+  db.insert(schema.theme)
+    .values({ id: 't-1', manufacturerId: 'm-1', name: 'City', createdAt: now, updatedAt: now })
+    .run();
+
+  db.insert(schema.set)
+    .values({
+      id: 's-1',
+      manufacturerId: 'm-1',
+      themeId: 't-1',
+      setNumber: '60398',
+      name: 'Familienhaus und Elektroauto',
+      year: 2023,
+      pieceCount: 462,
+      retailPriceCents: 4999,
+      imagePath: 'images/sets/s-1/bild.webp',
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+
+  db.insert(schema.collectionItem)
+    .values({
+      id: 'c-1',
+      setId: 's-1',
+      status: 'built',
+      completeness: 'missing_parts',
+      acquiredPriceCents: 4500,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+
+  db.insert(schema.missingPart)
+    .values({
+      id: 'p-1',
+      collectionItemId: 'c-1',
+      partNumber: '3001',
+      colorName: 'Rot',
+      quantity: 2,
+      resolved: false,
+      createdAt: now,
+    })
+    .run();
+
+  db.insert(schema.wishlist)
+    .values({
+      id: 'w-1',
+      ownerUserId: OTHER_USER_ID,
+      title: 'Weihnachten 2026',
+      occasion: 'christmas',
+      shareToken: 'geheimer-token-der-nicht-wandern-darf',
+      isPublic: true,
+      surpriseMode: false,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+
+  db.insert(schema.wishlistItem)
+    .values({
+      id: 'wi-1',
+      wishlistId: 'w-1',
+      setId: 's-1',
+      priority: 1,
+      sortOrder: 0,
+      reservedByName: 'Tante Anne',
+      reservedAt: now,
+      reservationTokenHash: 'a'.repeat(64),
+      createdAt: now,
+    })
+    .run();
+
+  fs.mkdirSync(path.join(DATA_DIR, 'files', 'images', 'sets', 's-1'), { recursive: true });
+  fs.writeFileSync(
+    path.join(DATA_DIR, 'files', 'images', 'sets', 's-1', 'bild.webp'),
+    Buffer.from([1, 2, 3, 4, 5]),
+  );
+}
+
+function clearAll() {
+  db.delete(schema.wishlistItem).run();
+  db.delete(schema.wishlist).run();
+  db.delete(schema.missingPart).run();
+  db.delete(schema.collectionItem).run();
+  db.delete(schema.set).run();
+  db.delete(schema.theme).run();
+  db.delete(schema.manufacturer).run();
+  db.delete(schema.user).run();
+}
+
+beforeAll(() => {
+  clearAll();
+});
+
+beforeEach(() => {
+  clearAll();
+  seed();
+});
+
+describe('Export', () => {
+  it('nimmt Katalog, Sammlung und Wunschlisten mit', () => {
+    const payload = buildExportPayload();
+
+    expect(payload.app).toBe('bricktrack');
+    expect(payload.data.manufacturers).toHaveLength(1);
+    expect(payload.data.sets).toHaveLength(1);
+    expect(payload.data.collectionItems).toHaveLength(1);
+    expect(payload.data.missingParts).toHaveLength(1);
+    expect(payload.data.wishlists).toHaveLength(1);
+    expect(payload.data.wishlistItems).toHaveLength(1);
+  });
+
+  it('nimmt weder Teilen-Token noch Reservierungen mit', () => {
+    const payload = buildExportPayload();
+    const serialized = JSON.stringify(payload);
+
+    expect(serialized).not.toContain('geheimer-token-der-nicht-wandern-darf');
+    expect(serialized).not.toContain('Tante Anne');
+    expect(serialized).not.toContain('a'.repeat(64));
+  });
+
+  it('nimmt keine Konten mit', () => {
+    const serialized = JSON.stringify(buildExportPayload());
+
+    expect(serialized).not.toContain('florian@example.test');
+    expect(serialized).not.toContain('mama@example.test');
+  });
+
+  it('packt die hochgeladenen Dateien ins Archiv', () => {
+    const archive = buildExportZip();
+
+    expect(archive.byteLength).toBeGreaterThan(0);
+    // Der Dateiname steht im ZIP-Verzeichnis im Klartext.
+    expect(Buffer.from(archive).toString('latin1')).toContain('files/images/sets/s-1/bild.webp');
+  });
+});
+
+describe('Import', () => {
+  it('stellt einen vollstaendigen Rundweg wieder her', () => {
+    const archive = buildExportZip();
+    clearAll();
+
+    // Der importierende Admin muss existieren - die Konten reisen nicht mit.
+    db.insert(schema.user)
+      .values({
+        id: USER_ID,
+        name: 'Florian',
+        email: 'florian@example.test',
+        emailVerified: false,
+        role: 'admin',
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    const summary = importArchive(archive, USER_ID);
+
+    expect(summary.sets).toBe(1);
+    expect(summary.collectionItems).toBe(1);
+    expect(summary.wishlists).toBe(1);
+    expect(summary.files).toBeGreaterThan(0);
+
+    const sets = db.select().from(schema.set).all();
+    expect(sets).toHaveLength(1);
+    expect(sets[0]).toMatchObject({
+      setNumber: '60398',
+      name: 'Familienhaus und Elektroauto',
+      pieceCount: 462,
+      retailPriceCents: 4999,
+    });
+    // Zeitstempel muessen als Date zurueckkommen, nicht als String.
+    expect(sets[0]!.createdAt).toBeInstanceOf(Date);
+
+    expect(db.select().from(schema.missingPart).all()).toHaveLength(1);
+  });
+
+  it('uebergibt die Wunschlisten dem importierenden Admin und teilt sie nicht', () => {
+    const archive = buildExportZip();
+    clearAll();
+    db.insert(schema.user)
+      .values({
+        id: USER_ID,
+        name: 'Florian',
+        email: 'florian@example.test',
+        emailVerified: false,
+        role: 'admin',
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    importArchive(archive, USER_ID);
+
+    const [list] = db.select().from(schema.wishlist).all();
+    expect(list?.ownerUserId).toBe(USER_ID);
+    expect(list?.isPublic).toBe(false);
+    expect(list?.shareToken).not.toBe('geheimer-token-der-nicht-wandern-darf');
+    expect(list?.shareToken.length).toBeGreaterThan(16);
+  });
+
+  it('ersetzt vorhandene Daten, statt sie zu vermischen', () => {
+    const archive = buildExportZip();
+
+    // Zweites Set, das im Archiv nicht vorkommt.
+    db.insert(schema.set)
+      .values({
+        id: 's-2',
+        manufacturerId: 'm-1',
+        setNumber: '99999',
+        name: 'Wird ersetzt',
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    importArchive(archive, USER_ID);
+
+    const numbers = db
+      .select({ setNumber: schema.set.setNumber })
+      .from(schema.set)
+      .all()
+      .map((row) => row.setNumber);
+    expect(numbers).toEqual(['60398']);
+  });
+
+  it('lehnt ein fremdes Archiv ab, ohne etwas zu loeschen', () => {
+    const before = db.select().from(schema.set).all().length;
+
+    expect(() => importArchive(new Uint8Array([1, 2, 3]), USER_ID)).toThrow(ImportError);
+    expect(db.select().from(schema.set).all()).toHaveLength(before);
+  });
+});
+
+describe('CSV', () => {
+  it('trennt mit Semikolon und beginnt mit einer BOM', () => {
+    const csv = buildCollectionCsv([{ a: 'x', b: 1 }], [
+      { key: 'a', label: 'Spalte A' },
+      { key: 'b', label: 'Spalte B' },
+    ]);
+
+    expect(csv.startsWith('')).toBe(true);
+    expect(csv).toContain('Spalte A;Spalte B');
+    expect(csv).toContain('x;1');
+  });
+
+  it('maskiert Semikolon, Anfuehrungszeichen und Zeilenumbrueche', () => {
+    const csv = buildCollectionCsv(
+      [{ note: 'a;b "c"\nd' }],
+      [{ key: 'note', label: 'Notiz' }],
+    );
+
+    expect(csv).toContain('"a;b ""c""\nd"');
+  });
+});

tests/unit/rebrickable.test.ts

@@ -0,0 +1,179 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// The module reads the key through src/env, which validates on import - so
+// the variable has to be in place before the dynamic import below.
+process.env.REBRICKABLE_API_KEY = 'test-key';
+
+const {
+  fetchImageBytes,
+  fetchMinifigCount,
+  fetchSet,
+  fetchTheme,
+  isRebrickableEnabled,
+  RebrickableError,
+} = await import('@/lib/rebrickable');
+
+type FetchArgs = Parameters<typeof fetch>;
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+function stubFetch(handler: (url: string, init?: FetchArgs[1]) => Response | Promise<Response>) {
+  const spy = vi.fn(async (input: FetchArgs[0], init?: FetchArgs[1]) =>
+    handler(String(input), init),
+  );
+  globalThis.fetch = spy as unknown as typeof fetch;
+  return spy;
+}
+
+const SET_RESPONSE = {
+  set_num: '60398-1',
+  name: 'Familienhaus und Elektroauto',
+  year: 2023,
+  theme_id: 52,
+  num_parts: 462,
+  set_img_url: 'https://cdn.rebrickable.com/media/sets/60398-1.jpg',
+  set_url: 'https://rebrickable.com/sets/60398-1/',
+};
+
+describe('Verfuegbarkeit', () => {
+  it('ist mit gesetztem API-Key aktiv', () => {
+    expect(isRebrickableEnabled()).toBe(true);
+  });
+});
+
+describe('Set abrufen', () => {
+  it('uebersetzt die Antwort in unser Format', async () => {
+    stubFetch(() => jsonResponse(SET_RESPONSE));
+
+    const result = await fetchSet('60398');
+
+    expect(result).toEqual({
+      setNumber: '60398',
+      name: 'Familienhaus und Elektroauto',
+      year: 2023,
+      pieceCount: 462,
+      themeId: 52,
+      imageUrl: 'https://cdn.rebrickable.com/media/sets/60398-1.jpg',
+      externalUrl: 'https://rebrickable.com/sets/60398-1/',
+    });
+  });
+
+  it('fragt die Nummer mit Variante ab und schickt den Key im Header', async () => {
+    const spy = stubFetch(() => jsonResponse(SET_RESPONSE));
+
+    await fetchSet('60398');
+
+    const [url, init] = spy.mock.calls[0]!;
+    expect(String(url)).toContain('/sets/60398-1/');
+    // Der Key gehoert in den Header, nicht in die URL - sonst steht er in
+    // jedem Proxy-Log.
+    expect(String(url)).not.toContain('test-key');
+    expect((init?.headers as Record<string, string>).Authorization).toBe('key test-key');
+  });
+
+  it('liefert null, wenn Rebrickable die Nummer nicht kennt', async () => {
+    stubFetch(() => new Response('', { status: 404 }));
+
+    await expect(fetchSet('99999')).resolves.toBeNull();
+  });
+
+  it('meldet einen abgelehnten API-Key verstaendlich', async () => {
+    stubFetch(() => new Response('', { status: 401 }));
+
+    await expect(fetchSet('60398')).rejects.toBeInstanceOf(RebrickableError);
+    await expect(fetchSet('60398')).rejects.toThrow(/API-Key/);
+  });
+
+  it('meldet eine Drosselung als eigenen Fall', async () => {
+    stubFetch(() => new Response('', { status: 429 }));
+
+    await expect(fetchSet('60398')).rejects.toThrow(/drosselt/);
+  });
+
+  it('macht aus einem Netzwerkfehler keine Ausnahme mit Innenleben', async () => {
+    stubFetch(() => {
+      throw new Error('ECONNREFUSED');
+    });
+
+    await expect(fetchSet('60398')).rejects.toThrow(/nicht erreichbar/);
+  });
+
+  it('kommt mit fehlenden Feldern klar', async () => {
+    stubFetch(() =>
+      jsonResponse({ set_num: '1234-1', name: 'Ohne alles', year: null, theme_id: null }),
+    );
+
+    const result = await fetchSet('1234');
+
+    expect(result).toMatchObject({
+      setNumber: '1234',
+      pieceCount: null,
+      themeId: null,
+      imageUrl: null,
+    });
+  });
+});
+
+describe('Thema abrufen', () => {
+  it('liefert Name und Oberthema', async () => {
+    stubFetch(() => jsonResponse({ id: 52, name: 'City', parent_id: 50 }));
+
+    await expect(fetchTheme(52)).resolves.toEqual({ id: 52, name: 'City', parentId: 50 });
+  });
+
+  it('behandelt ein Thema ohne Oberthema', async () => {
+    stubFetch(() => jsonResponse({ id: 1, name: 'Technic', parent_id: null }));
+
+    await expect(fetchTheme(1)).resolves.toEqual({ id: 1, name: 'Technic', parentId: null });
+  });
+});
+
+describe('Minifiguren zaehlen', () => {
+  it('summiert die Mengen', async () => {
+    stubFetch(() => jsonResponse({ results: [{ quantity: 2 }, { quantity: 3 }] }));
+
+    await expect(fetchMinifigCount('60398')).resolves.toBe(5);
+  });
+
+  it('laesst den Import nicht scheitern, wenn die Liste fehlt', async () => {
+    stubFetch(() => new Response('', { status: 500 }));
+
+    // null statt Ausnahme: ein Set ohne Minifiguren-Angabe ist kein Fehler.
+    await expect(fetchMinifigCount('60398')).resolves.toBeNull();
+  });
+});
+
+describe('Bild laden', () => {
+  it('gibt die Bytes zurueck', async () => {
+    stubFetch(() => new Response(new Uint8Array([1, 2, 3])));
+
+    const bytes = await fetchImageBytes('https://example.test/bild.jpg');
+
+    expect(bytes?.byteLength).toBe(3);
+  });
+
+  it('gibt null zurueck, statt den Import scheitern zu lassen', async () => {
+    stubFetch(() => new Response('', { status: 404 }));
+    await expect(fetchImageBytes('https://example.test/weg.jpg')).resolves.toBeNull();
+
+    stubFetch(() => {
+      throw new Error('timeout');
+    });
+    await expect(fetchImageBytes('https://example.test/lahm.jpg')).resolves.toBeNull();
+  });
+});

tests/unit/set-number.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest';
+import { displaySetNumber, legoInstructionsUrl, normalizeSetNumber } from '@/lib/set-number';
+
+describe('Setnummern fuer den Rebrickable-Import', () => {
+  it('haengt die Variante an, wenn nur die Packungsnummer eingetippt wurde', () => {
+    expect(normalizeSetNumber('60398')).toBe('60398-1');
+    expect(normalizeSetNumber('71427')).toBe('71427-1');
+  });
+
+  it('laesst eine bereits vollstaendige Nummer unveraendert', () => {
+    expect(normalizeSetNumber('60398-1')).toBe('60398-1');
+    expect(normalizeSetNumber('10265-2')).toBe('10265-2');
+  });
+
+  it('ignoriert Leerzeichen und vereinheitlicht Grossschreibung', () => {
+    expect(normalizeSetNumber('  60398 ')).toBe('60398-1');
+    expect(normalizeSetNumber('k8672')).toBe('K8672-1');
+  });
+
+  it('entfernt fuer die Anzeige nur die erste Variante', () => {
+    expect(displaySetNumber('60398-1')).toBe('60398');
+    // -2 ist eine echte zweite Variante und muss sichtbar bleiben.
+    expect(displaySetNumber('10265-2')).toBe('10265-2');
+    expect(displaySetNumber('60398')).toBe('60398');
+  });
+
+  it('ueberlebt den Rundweg Anzeige -> API -> Anzeige', () => {
+    for (const number of ['60398', '71427', '42172']) {
+      expect(displaySetNumber(normalizeSetNumber(number))).toBe(number);
+    }
+  });
+});
+
+describe('Link auf die LEGO-Bauanleitung', () => {
+  it('nutzt die Nummer ohne Variante', () => {
+    expect(legoInstructionsUrl('60398-1')).toBe(
+      'https://www.lego.com/de-de/service/building-instructions/60398',
+    );
+  });
+
+  it('maskiert Sonderzeichen in der Nummer', () => {
+    expect(legoInstructionsUrl('2 30500')).toContain('2%2030500');
+  });
+});

vitest.config.mts

@@ -8,10 +8,14 @@ export default defineConfig({
   resolve: {
     alias: {
       '@': path.resolve(root, './src'),
+      // `server-only` is a build-time marker that throws when imported outside
+      // a server component. Stubbing it keeps server modules testable.
+      'server-only': path.resolve(root, './tests/stubs/server-only.ts'),
     },
   },
   test: {
     environment: 'node',
+    setupFiles: ['./tests/setup-env.ts'],
     include: ['tests/unit/**/*.test.ts'],
     globals: false,
   },