Purge stale watermark cache once on 0.9.7.13

0.9.7.12: On-Demand-Altbilder nicht mehr auf 404 hängen lassen

.ci-trigger-0977

@@ -0,0 +1 @@
+0.9.7.7

.github/workflows/lint.yml

@@ -0,0 +1,69 @@
+name: Syntax Check
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  php-syntax:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php-version: ['8.2', '8.3', '8.4', '8.5']
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v4
+
+      - name: PHP installieren
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          coverage: none
+
+      - name: PHP Syntax pruefen
+        shell: bash
+        run: |
+          set -euo pipefail
+          while IFS= read -r -d '' file; do
+            php -l "$file"
+          done < <(find . -type f -name '*.php' -print0)
+
+      - name: Doppelte Bratonien-Funktionen pruefen
+        shell: bash
+        run: |
+          set -euo pipefail
+          duplicates="$(grep -RhoE 'function[[:space:]]+bratonien_tools_[A-Za-z0-9_]+' --include='*.php' . | awk '{print $2}' | sort | uniq -d || true)"
+          if [[ -n "$duplicates" ]]; then
+            echo "Doppelte globale Bratonien-Funktionen gefunden:" >&2
+            printf '%s\n' "$duplicates" >&2
+            exit 1
+          fi
+
+  script-syntax:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v4
+
+      - name: Admin JavaScript Syntax pruefen
+        shell: bash
+        run: |
+          set -euo pipefail
+          sed -n '/<script>/,/<\/script>/p' template/admin_tabs.tpl | sed '1d;$d' > /tmp/bratonien-admin-tabs.js
+          node --check /tmp/bratonien-admin-tabs.js
+          node --check js/nc_connector_edit_v2.js
+
+      - name: Python Syntax pruefen
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m compileall -q runtime
+
+      - name: Shell Syntax pruefen
+        shell: bash
+        run: |
+          set -euo pipefail
+          while IFS= read -r -d '' file; do
+            bash -n "$file"
+          done < <(find . -type f -name '*.sh' -print0)

CURRENT_STATUS.md

@@ -1,122 +1,139 @@
 # Aktueller Entwicklungsstand
 
-Stand: 17.08.2026
+Stand: 19.08.2026
 
 ## Plugin
 
-- Aktuelle Plugin-Version: **0.9.3.17**
-- Aktueller Entwicklungsblock: **NC Connector – Verbindungsverwaltung / laufende Optimierung**
-- NC Connector ist Feature 10 und noch nicht vollständig abgeschlossen.
-- Solange dieser Optimierungsblock läuft, bleibt die Version im Bereich `0.9.3.x`.
+- Aktuelle Plugin-Version: **0.9.6.1**
+- Aktueller Entwicklungsblock: **NC Connector – WebDAV-End-to-End-Pfad mit Piwigo-Registrierung, Preview-/Derivatstrecke und sauberem Verbindungs-Lebenszyklus**
+- GitHub ist das führende Repository.
+- Der bestehende lokale Connector bleibt vollständig erhalten und wird nicht automatisch migriert.
 
-## Aktueller GitHub-Stand
+## Nicht verhandelbare Architekturregeln
 
-Der lokale NC Connector ist für den aktuellen Bratonien-Einsatz im bisherigen Login-Weg End-to-End funktionsfähig. Mit `0.9.3.17` beginnt der Umbau auf API-first für die Piwigo-Synchronisierung.
+- Nextcloud bleibt die Quelle der Originalbilder.
+- Originalbilder werden **nicht dauerhaft nach Piwigo kopiert**.
+- Der bestehende lokale Produktionsweg bleibt funktionsfähig.
+- WebDAV benötigt nur Nextcloud-Adresse, Benutzer/App-Passwort und normale WebDAV-Berechtigungen des Benutzers.
+- Kein Nextcloud-PostgreSQL-Zugriff, kein `occ`, keine Storage-IDs, keine Host-Mounts, kein FUSE, davfs oder rclone als Voraussetzung.
+- WebDAV-Verbindungen werden voneinander isoliert verarbeitet.
+- Fehler der WebDAV-Bildverarbeitung dürfen keinen normalen Piwigo-Seitenaufruf zum Absturz bringen.
 
-Bereits erfolgreich umgesetzt und getestet:
+## Bestehende Quellenmodi
 
-- Nextcloud-Freigaben vom Typ `folder` und `file` werden aus der Source-View gelesen.
-- Ordnerfreigaben werden als Verzeichnisbaum im Shadow Tree gespiegelt.
-- Einzeldateifreigaben werden als Symlink direkt im Galerie-Root angelegt und als echte Piwigo-Orphans ohne Albumzuordnung registriert.
-- Entfernte Einzeldateifreigaben werden beim normalen Connector-Lauf aus Shadow Tree und Piwigo entfernt.
-- Das Nextcloud-Original bleibt bei Löschvorgängen unangetastet.
-- Connector-getriggerte neue physische Alben werden standardmäßig privat angelegt.
-- Der gemeinsame systemd-Timer `bratonien-nc-connector.timer` läuft produktiv.
+Weiterhin vorhanden:
 
-Neu in `0.9.3.17`:
+- `legacy-view`
+- `user-shares`
+- `selected-fileids`
 
-- die Piwigo-API ist als bevorzugter Synchronisierungsweg vorgesehen;
-- ein erfolgreich geprüfter API-Key wird verschlüsselt in der Piwigo-Konfiguration gespeichert;
-- produktive API-Synchronisierung ist ausdrücklich an die freigegebene Piwigo-Version **16.4.0** gebunden;
-- neuer Webservice `bratonien.nc.syncProductive` delegiert den freigegebenen produktiven Dateisync an Piwigos Core-Synchronisierung;
-- `runtime/lib/piwigo-sync.php` versucht zuerst die API und fällt nur bei nicht nutzbarer API auf Benutzername/Passwort zurück;
-- der bisherige Benutzername/Passwort-Zugang kann als verschlüsselter Fallback gespeichert oder gelöscht werden;
-- ein Benutzername/Passwort-Fallback kann außerdem einmalig manuell ausgeführt werden, ohne die Zugangsdaten zu speichern;
-- neue lokale Verbindungen werden intern als `api-first` angelegt; ein dauerhaft gespeicherter Login-Fallback ist technisch nicht mehr zwingend, sofern ein API-Zugang vorhanden ist.
+Neuer WebDAV-Modus:
 
-## Architektur NC Connector
+- `webdav-placeholder`
 
-- Nextcloud bleibt die einzige dauerhafte Quelle der Originalbilder.
-- Piwigo erhält nur die benötigte Verzeichnis-/Symlink-Struktur und erzeugt daraus seine Derivate und Cache-Dateien.
-- Der Connector arbeitet mit einem PostgreSQL-Leser und den Views `piwigo_showcase_sources` und `piwigo_showcase_activity`.
-- Laufzeitdaten liegen unter `/var/lib/bratonien-tools/nc-connector/...`.
-- Verbindungs-Konfigurationen liegen unter `/etc/bratonien-tools/nc-connector/connection-*.conf`.
-- Der Shadow Tree enthält Verzeichnisse und Symlinks, keine Kopien der Originaldateien.
-- Alle aktivierten Verbindungen werden über `runtime/run-all.sh` gemeinsam verarbeitet.
+Es gibt keine automatische Migration bestehender Verbindungen auf WebDAV.
 
-## Nextcloud-Freigabemodell
+## WebDAV-Ablauf in 0.9.6.1
 
-Der Connector unterstützt komplette Ordner und einzelne Bilder.
+1. Der Assistent prüft Nextcloud über WebDAV und lässt sichtbare Verzeichnisse auswählen.
+2. `runtime/reconcile-webdav.php` erzeugt die verbindungseigene Runtime-Konfiguration.
+3. `runtime/lib/build_webdav_placeholder_source.py` liest die ausgewählten Verzeichnisse rekursiv per PROPFIND.
+4. Ordner, Dateinamen, Nextcloud-Datei-ID, MIME-Typ, Größe, ETag und WebDAV-Pfad werden erfasst.
+5. Eine lokale Platzhalterquelle wird erzeugt, ohne Originalbilder dauerhaft zu speichern.
+6. `runtime/lib/shadow_tree.py` baut daraus den verbindungseigenen Shadow Tree.
+7. Der WebDAV-Galeriebaum liegt unter `_data/bratonien-tools/nc-webdav-gallery/connection-ID` und wird als eigene physische Piwigo-Site registriert.
+8. Dadurch erscheint die ausgewählte Nextcloud-Wurzel als normales Piwigo-Album; technische `bratonien-webdav-ID`-Wrapper werden nicht angezeigt.
+9. Vorbereitete Arbeitsbilder liegen unter `_data/bratonien-tools/nc-webdav-preview/connection-ID`.
+10. Arbeitsbilder werden als JPEG beziehungsweise PNG erzeugt und maximal auf 4096 px Kantenlänge begrenzt, damit Piwigos Bildbibliothek sie zuverlässig verarbeiten kann.
+11. Der CLI-Derivat-Builder korrigiert die Piwigo-Bildabmessungen anhand des Arbeitsbilds und erzeugt die aktuell konfigurierten Standard- und Custom-Derivate.
+12. Der normale Frontend-Aufruf erzeugt **keine** Derivate. Fehlt ein Derivat, wird das vorbereitete Bild als sicherer Fallback ausgeliefert.
+13. Originalbilder werden bei echtem Originalabruf serverseitig über `webdav-image.php` aus Nextcloud gestreamt; Nextcloud-Zugangsdaten erscheinen nicht im Browser.
 
-- `folder` -> Verzeichnisstruktur spiegeln und über Piwigos Dateisynchronisierung als physische Albumstruktur einlesen;
-- `file` -> Symlink direkt im Galerie-Root und anschließende Registrierung als Piwigo-Orphan.
+## Piwigo-Synchronisierung
 
-Für einzelne Dateien wird kein künstlicher Unterordner erzeugt.
+WebDAV verwendet denselben Piwigo-Synchronisationspfad wie der bestehende Connector, aber mit einer verbindungseigenen physischen Site.
 
-## Activity-Gate
+Nach der Dateisynchronisierung laufen die vorhandenen Piwigo-Nacharbeiten, darunter Metadaten-, Integritäts-, Kategorie-, Pfad-, Rang- und Cache-Aktualisierungen sowie der Orphan-Abgleich.
 
-Das Activity-Gate berücksichtigt neben dem Nextcloud-Aktivitätsstand auch die Signatur der aktuell sichtbaren Freigaben. Weiterhin vorhanden sind Quiet-Time, maximale Wartezeit, periodischer Full-Sync und verbindungsspezifischer State.
+Die direkte produktive Synchronisierung ist derzeit ausdrücklich auf **Piwigo 16.4.0** abgestimmt.
 
-## Piwigo-Synchronisation
+## WebDAV-Bildausgabe und Derivate
 
-### API-first
+Wichtige Dateien:
 
-Der normale Runtime-Lauf verwendet ab `0.9.3.17` folgende Priorität:
+- `include/webdav_image_runtime.inc.php` – Zuordnung Piwigo-Bild ↔ WebDAV-Quelle, Preview-/Derivat-Helfer und URL-Filter.
+- `webdav-image.php` – berechtigungsgeprüfter serverseitiger Original-/Preview-Abruf.
+- `runtime/lib/precache-webdav-previews.php` – vorbereitete JPEG-/PNG-Arbeitsbilder ohne dauerhafte Originalkopie.
+- `runtime/lib/build-webdav-derivatives.php` – CLI-Aufbau der konfigurierten Piwigo-Derivate.
 
-1. gespeicherter Piwigo-API-Key;
-2. bei API-Fehler, fehlender Freigabe für die installierte Piwigo-Version oder nicht vorhandener API: gespeicherter Benutzername/Passwort-Fallback;
-3. ohne nutzbaren API- und Fallback-Zugang wird der Piwigo-Sync mit einer klaren Fehlermeldung abgebrochen.
+Der Frontend-Hook führt keine Bildgenerierung mehr aus. Damit bleibt ein Fehler in GD/Imagick/External ImageMagick auf den Hintergrundlauf begrenzt.
 
-Nach einem Piwigo-Update wird die produktive API nicht automatisch für die neue Version freigeschaltet. Erst nach einem Kompatibilitätstest wird die Versionsfreigabe im Plugin angehoben. Bis dahin bleibt nur der Login-Fallback zulässig.
+## Löschen einer WebDAV-Verbindung seit 0.9.6.1
 
-### Physische Alben
+Eine gelöschte WebDAV-Verbindung darf keine weiterhin sichtbaren oder über alte Piwigo-Datensätze erreichbaren Bilder hinterlassen.
 
-`bratonien.nc.syncProductive` ist aktuell nur für Piwigo **16.4.0** freigegeben. Der Endpoint läuft als Administrator-Webservice und verwendet für den eigentlichen Dateisync Piwigos Core-Synchronisierung. Neue Connector-Alben werden dabei privat angelegt.
+Beim Löschen über die Oberfläche:
 
-### Root-Dateien / Orphans
+- werden die zur Verbindung gehörende Piwigo-Site, ihre Alben und Bilddatensätze entfernt;
+- werden zugehörige Piwigo-Derivate entfernt;
+- bleiben die Nextcloud-Originaldateien unangetastet;
+- werden Laufzeit- und Preview-Daten anschließend bereinigt.
 
-`bratonien.nc.syncOrphans` verarbeitet direkte Dateien im Galerie-Root separat. Neue Root-Dateien werden als Piwigo-Orphans ohne Albumzuordnung registriert. Entfernte Root-Dateien werden nur aus Piwigo entfernt; das Nextcloud-Original bleibt unberührt.
+Zusätzlich läuft `runtime/cleanup-webdav-piwigo.php` im gemeinsamen Runner. Er erkennt verwaiste WebDAV-Piwigo-Sites, für die keine Connector-Verbindung mehr existiert, und entfernt deren Piwigo-Inhalte sowie Gallery-, Source-, Preview-, State-, Status- und Runtime-Reste. Damit werden auch bereits vor 0.9.6.1 gelöschte Verbindungen nachträglich bereinigt.
 
-## Erfolgreiche Live-Tests bis 0.9.3.16
+## Gemeinsamer Runner
 
-Bestätigt wurden:
+`runtime/run-all.sh` verarbeitet die Schritte in kontrollierter Reihenfolge:
 
-- Ordnerfreigaben werden korrekt eingelesen;
-- Einzeldateifreigaben werden als `file` erkannt und im Galerie-Root verlinkt;
-- Orphan-Anlage und Orphan-Löschung funktionieren;
-- physische neue Connector-Alben werden privat angelegt;
-- der automatische Timer kann regulär laufen.
+1. lokale Verbindungen reconciliieren;
+2. WebDAV-Verbindungen reconciliieren;
+3. verwaiste WebDAV-Piwigo-Inhalte bereinigen;
+4. verwaiste allgemeine Runtime-Dateien bereinigen;
+5. aktive WebDAV-Verbindungen synchronisieren;
+6. aktive lokale Verbindungen synchronisieren.
 
-## Offener Test für 0.9.3.17
+Der vorhandene systemd-Timer ruft direkt die Runtime aus dem installierten Plugin auf.
 
-Vor Abschluss des API-first-Blocks muss noch live geprüft werden:
+## Status- und UI-Regeln
 
-1. Plugin-Update auf `0.9.3.17`;
-2. API-Key im NC Connector prüfen und speichern;
-3. produktiver Lauf verwendet `bratonien.nc.syncProductive` erfolgreich;
-4. Ordner- und Orphan-Sync bleiben unverändert korrekt;
-5. gespeicherter Login-Fallback übernimmt bei absichtlich nicht nutzbarer API;
-6. einmaliger Fallback funktioniert ohne Speicherung;
-7. gelöschter Fallback wird vom Runtime-Lauf nicht mehr verwendet.
+- Hintergrund-Polling lädt die Admin-Seite nicht neu.
+- Ein geöffneter Verbindungsassistent bleibt bei Statusaktualisierungen geöffnet.
+- Fehlgeschlagene Fallback-/Credential-Prüfungen schließen den Assistenten nicht.
+- Laufzeitfehler unterscheiden WebDAV-Lesen, Piwigo-Synchronisierung, Preview- und Derivatfehler.
 
-## Sicherheit / Betriebsmodell
+## Sicherheit
 
-- Nextcloud bleibt Eigentümer der Originaldateien.
-- Der Connector löscht keine Originaldateien aus den Storage-Mounts.
-- API- und Login-Zugangsdaten werden verschlüsselt gespeichert und nicht in das Repository geschrieben.
-- Die API hat Vorrang, ist aber streng versionsgebunden.
-- Benutzername/Passwort ist nur Fallback und kann dauerhaft, einmalig oder gar nicht verwendet werden.
-- Neue Connector-Alben werden privat angelegt.
+- Connector-Zugangsdaten werden verschlüsselt gespeichert.
+- WebDAV-Credentials werden nur serverseitig verwendet.
+- Bildzugriffe über `webdav-image.php` werden gegen Piwigos Zugriffsrechte geprüft.
+- Nextcloud-Originale werden weder beim Sync noch beim Löschen einer Verbindung verändert.
+- Derivate und Arbeitsbilder sind lokale Cache-/Arbeitsdaten und dürfen entfernt beziehungsweise neu aufgebaut werden.
 
-## Bekannte offene Punkte
+## Aktueller Prüfstand
 
-Der NC Connector bleibt im Entwicklungsblock `0.9.3.x`. Nach erfolgreichem API-first-Livetest folgen insbesondere:
+Bereits umgesetzt:
 
-- Bereinigung und Vereinfachung der Verbindungsverwaltung im Admin-UI;
-- Remote-Nextcloud-Adapter;
-- Entscheidung über verbleibende Legacy-/Migrationshilfen;
-- weitere Komfortfunktionen für Status, Diagnose und Administration.
+- WebDAV-Verbindungsassistent;
+- Verzeichnisauswahl;
+- rekursiver WebDAV-Scan;
+- Shadow Tree;
+- separate Piwigo-Site je WebDAV-Verbindung;
+- sichtbare Albumstruktur ohne technische Wrapper;
+- echte Bildausgabe aus Nextcloud;
+- lokale vorbereitete Arbeitsbilder;
+- CLI-Derivatstrecke;
+- Piwigo-Nacharbeiten und Orphan-Abgleich;
+- ETag-basierte Wiederverwendung vorbereiteter Bilder;
+- Löschen einer Verbindung einschließlich Piwigo-Inhalten;
+- nachträgliche Bereinigung bereits verwaister WebDAV-Piwigo-Sites.
 
-## Repository-Fallback
+Weiter zu prüfen beziehungsweise unter realer Last zu härten:
 
-Während der Entwicklung bleibt GitHub das führende Repository. Zusätzlich existiert auf dem privaten Gitea-System ein Pull-Mirror als Ausfall-/Fallback-Ebene.
+- vollständiger Derivataufbau für alle in der Installation vorkommenden Standard- und Custom-Größen;
+- Verhalten bei großen Bildmengen und vielen gleichzeitig noch nicht vorbereiteten Bildern;
+- Fehlerfälle verschiedener Bildformate und Bild-Backends;
+- langfristige Änderungserkennung und Performance im produktiven Einsatz.
+
+## Versionsregel
+
+Die aktuelle Versionslinie ist **0.9.6.x**. Weitere Sprünge auf eine neue Minor-/Major-Linie erfolgen nur bewusst und ausdrücklich.

README.md

@@ -1,303 +1,246 @@
 # Piwigo Bratonien Tools
 
-Modular aufgebautes Piwigo-Plugin mit erweiterten Werkzeugen fuer Administration, Bildverarbeitung, Nextcloud-Anbindung und Frontend-Funktionen.
+Modulares Piwigo-Plugin für Administration, Bildverarbeitung, geschützte Freigaben, Fotoauswahl und die Anbindung von Nextcloud an Piwigo.
 
-Das Projekt ist aus der Bratonien-Piwigo-Installation entstanden, wird aber bewusst so entwickelt, dass die einzelnen Funktionen moeglichst neutral und auch ausserhalb dieser Installation nutzbar bleiben.
+Aktuelle Plugin-Version: **0.9.6.1**
 
-Aktuelle Plugin-Version: **0.9.3.16**
+## Grundprinzip
 
-## Funktionsumfang
+Bratonien Tools erweitert Piwigo um Funktionen, die in der Bratonien-Installation benötigt werden, hält die einzelnen Module aber möglichst unabhängig voneinander.
 
-### NC Connector
+Für die Administration gilt: Der normale Nutzer sieht Aufgaben, Entscheidungen und Ergebnisse. Technische Interna werden automatisch ermittelt oder bleiben hinter ausdrücklich technischen Einstellungen verborgen.
 
-Der NC Connector verwaltet Nextcloud-Quellen fuer Piwigo und fuehrt den regelmaessigen Abgleich mit einer Plugin-eigenen Sync-Runtime aus.
+## NC Connector
 
-Aktuell vorhanden:
+Der NC Connector synchronisiert ausdrücklich ausgewählte Nextcloud-Inhalte mit Piwigo.
 
-- mehrere Connector-Verbindungen im eigenen Datenmodell
-- lokale Verbindungen direkt in Bratonien Tools anlegen
-- verschluesselte Speicherung von PostgreSQL- und Piwigo-Sync-Zugangsdaten
-- lokaler Nextcloud-Adapter ueber PostgreSQL-Reader und explizite Storage-Mounts
-- Verifikation von PostgreSQL-Verbindung, Source-View, Activity-View und Storage-Mounts
-- native Aktivierung einer verifizierten Verbindung ohne vorherige Legacy-Installation
-- eigener State pro Verbindung unter `/var/lib/bratonien-tools/nc-connector/connection-ID`
-- gemeinsame Runtime-Konfiguration unter `/etc/bratonien-tools/nc-connector/`
-- Multi-Connection-Runner unter `runtime/run-all.sh`
-- gemeinsame Zeitsteuerung ueber `bratonien-nc-connector.timer`
-- Verbindungen koennen kontrolliert deaktiviert und danach geloescht werden
-- Anzeige von Timer-Status, letztem Lauf, letztem Ergebnis und naechstem geplanten Lauf
-- Plugin-eigene Sync-Runtime unter `runtime/`
-- Activity-Gate mit Quiet-Time, Max-Wartezeit, Share-Fingerprint und periodischem Full-Sync
-- Shadow Tree fuer Piwigo ohne Kopie der Originaldateien
-- Unterstuetzung von Nextcloud-Freigaben fuer komplette Ordner und einzelne Dateien
-- Ordnerfreigaben werden als physische Piwigo-Alben synchronisiert
-- neu importierte Connector-Alben werden direkt als privat angelegt
-- einzelne Dateifreigaben werden direkt im Galerie-Root verlinkt und als echte Piwigo-Orphans registriert
-- entfernte Einzeldateifreigaben werden beim naechsten Lauf wieder aus Piwigo entfernt, ohne das Original zu loeschen
-- Originalbilder bleiben an ihrer Nextcloud-/Storage-Quelle
-- lokale Piwigo-Derivate und Caches bleiben davon getrennt und koennen jederzeit neu erzeugt werden
+### Datenmodell
 
-Die Runtime baut aus den freigegebenen Nextcloud-Quellen einen Piwigo-kompatiblen Shadow Tree. Dateien werden dabei nicht in eine zweite permanente Originalbibliothek kopiert, sondern ueber Symlinks auf die vorhandenen Storage-Mounts referenziert.
+- Nextcloud bleibt die Quelle der Originaldateien.
+- Originalbilder werden nicht dauerhaft in eine zweite Bibliothek unter Piwigo kopiert.
+- Ein Shadow Tree erzeugt die für Piwigo benötigte Ordnerstruktur.
+- Ordner werden als physische Piwigo-Alben synchronisiert.
+- Root-Dateien können als Piwigo-Orphans registriert werden.
+- Neu importierte physische Connector-Alben werden privat angelegt.
+- Entfernte Quellen werden aus Shadow Tree und Piwigo entfernt; die Nextcloud-Originale bleiben erhalten.
 
-#### Freigabemodell
+### Bestehende lokale Quellenmodi
 
-Der Connector unterscheidet zwei Quelltypen:
+Der bestehende Connector unterstützt weiterhin:
 
-- `folder` - komplette Ordnerfreigabe; der Verzeichnisbaum wird gespiegelt und ueber Piwigos normale Dateisynchronisierung als Albumstruktur eingelesen
-- `file` - einzelne Dateifreigabe; die Datei wird direkt als Symlink im Galerie-Root angelegt und separat als Piwigo-Orphan ohne Albumzuordnung registriert
+- `legacy-view`
+- `user-shares`
+- `selected-fileids`
 
-Fuer Einzeldateien wird kein kuenstlicher Unterordner erzeugt. Entfernt Nextcloud eine solche Freigabe, entfernt der Connector den Root-Symlink und anschliessend nur den zugehoerigen Piwigo-Datenbankeintrag. Das Original bleibt unangetastet.
+Diese Modi bleiben erhalten. Es gibt keine automatische Migration auf WebDAV.
 
-#### Neuinstallation
+### WebDAV-Modus
 
-Eine frische Piwigo-Installation benoetigt keinen vorher vorhandenen `piwigo-sync` mehr.
+Der neue Endnutzerpfad verwendet `source_mode=webdav-placeholder` und `adapter=remote`.
 
-Der vorgesehene Ablauf ist:
+Benötigt werden nur:
 
-1. lokale Nextcloud-Verbindung in Bratonien Tools anlegen
-2. PostgreSQL, Views und Storage-Mounts pruefen
-3. die angezeigte Root-Aktivierung ausfuehren
-4. der Installer legt Runtime-Konfiguration, Secrets, State-Verzeichnis sowie systemd-Service und -Timer an
-5. vor der Aktivierung wird ein echter Lauf mit der Plugin-Runtime getestet
+- Nextcloud-Adresse;
+- Nextcloud-Benutzer bzw. App-Passwort;
+- normaler WebDAV-Zugriff auf die Inhalte dieses Benutzers;
+- eine normale Piwigo-Installation mit ihrer vorhandenen PHP-/Bildverarbeitungsumgebung.
 
-Der gemeinsame Service verarbeitet alle aktivierten `connection-*.conf`-Dateien nacheinander. Dadurch koennen mehrere Verbindungen mit einer gemeinsamen Zeitsteuerung betrieben werden.
+Nicht vorausgesetzt werden:
 
-#### Migration bestehender Installationen
+- PostgreSQL-Zugriff auf Nextcloud;
+- `occ`-Adminzugriff;
+- Storage-IDs oder Backend-Pfade;
+- zusätzliche Host-Mounts;
+- FUSE;
+- davfs;
+- rclone.
 
-Fuer bestehende Installationen, die zuvor den separaten `piwigo-sync` aus `Proxmox_Scripts` verwendet haben, existiert weiterhin ein kontrollierter Migrationsweg:
+### WebDAV-Ablauf
 
-- bestehende Verbindung einmalig importieren
-- Connector-Kopie unabhaengig verifizieren
-- kontrollierten Cutover vorbereiten
-- Connector-Timer aktivieren und Legacy-Timer deaktivieren
-- Runtime vom bisherigen `/opt/piwigo-sync` auf die Plugin-eigene Runtime umstellen
-- Legacy-Bestand entfernen
-- den verbliebenen Laufzeit-State anschliessend mit `nc-connector-normalize.php` in die native Struktur unter `/var/lib/bratonien-tools/nc-connector/` ueberfuehren
+1. Der Assistent prüft Nextcloud und liest die sichtbaren Verzeichnisse per WebDAV.
+2. Ausgewählte Verzeichnisse werden rekursiv per PROPFIND eingelesen.
+3. Ordner, Dateiname, Nextcloud-Datei-ID, MIME-Typ, Größe, ETag und WebDAV-Pfad werden erfasst.
+4. `runtime/lib/build_webdav_placeholder_source.py` erzeugt eine lokale Platzhalterquelle ohne dauerhafte Originalkopie.
+5. `runtime/lib/shadow_tree.py` baut daraus den verbindungseigenen Shadow Tree.
+6. Der WebDAV-Galeriebaum liegt unter `_data/bratonien-tools/nc-webdav-gallery/connection-ID`.
+7. Jede WebDAV-Verbindung wird als eigene physische Piwigo-Site registriert. Die ausgewählte Nextcloud-Wurzel erscheint dadurch direkt als Album; technische `bratonien-webdav-ID`-Wrapper bleiben unsichtbar.
+8. `runtime/lib/precache-webdav-previews.php` erzeugt vorbereitete Arbeitsbilder als JPEG beziehungsweise PNG mit maximal 4096 px Kantenlänge.
+9. `runtime/lib/build-webdav-derivatives.php` korrigiert die Piwigo-Bildabmessungen und erzeugt die konfigurierten Standard- und Custom-Derivate im Hintergrundlauf.
+10. Der Frontend-Aufruf erzeugt keine Derivate. Fehlt eines, wird das vorbereitete Arbeitsbild als sicherer Fallback ausgeliefert.
+11. Wenn das Original benötigt wird, streamt `webdav-image.php` es serverseitig direkt aus Nextcloud. Zugangsdaten werden dem Browser nicht offengelegt.
 
-Nach abgeschlossener Migration werden `/opt/piwigo-sync`, `/etc/piwigo-sync`, `piwigo-sync.service` und `piwigo-sync.timer` nicht mehr benoetigt.
+### Piwigo-Synchronisierung
 
-### Bildcache
+Der WebDAV-Pfad nutzt die vorhandene Piwigo-Synchronisationslogik mit einer verbindungseigenen Site.
 
-- Piwigo-Bildcache gezielt leeren
-- vorhandene Bildderivate neu erzeugen
-- Cache-Aufbau als Worker-Prozess starten und abbrechen
-- Worker-Einstellungen verwalten
-- Originalbilder bleiben unangetastet
+Nach dem Dateiabgleich laufen die vorhandenen Nacharbeiten, darunter:
 
-### Wasserzeichenverwaltung
+- Metadaten-Synchronisierung;
+- Bild- und Kategorieintegrität;
+- Uppercats/Kategoriestruktur;
+- globale Ränge;
+- Pfadpflege;
+- Rating-Score;
+- Benutzer-Cache-Invalidierung;
+- Orphan-Abgleich.
 
-Erweiterte Wasserzeichenverwaltung als Alternative zur einfachen Piwigo-Standardkonfiguration.
+Die direkte produktive Synchronisierung ist aktuell ausdrücklich auf **Piwigo 16.4.0** abgestimmt.
 
-Unter anderem vorhanden:
+### Fallback-Zugang
 
-- eigene Wasserzeichendateien
-- Wasserzeichenprofile
-- Standardprofil
-- albumbezogene Regeln
-- getrennte Einstellungen fuer Positionierung und Verarbeitung
-- eigener Runtime-Filter fuer Piwigo-Bildderivate
-- Aktivierung und Deaktivierung der erweiterten Wasserzeichen-Engine
+Piwigo wird API-first angesprochen. Ist für eine Verbindung keine API konfiguriert, kann Benutzername/Passwort als Fallback verwendet werden.
 
-Beim Aktivieren wird die bisherige Piwigo-Wasserzeichenkonfiguration gesichert und nicht dauerhaft ueberschrieben. Beim Deaktivieren kann sie wiederhergestellt werden.
+Der Assistent prüft Fallback-Zugangsdaten vor dem Speichern. Eine fehlgeschlagene Prüfung schließt oder leert den Assistenten nicht.
 
-### Bilddateien & Pfade
+### Statusanzeige
 
-Verwaltung eigener Bilddateien fuer die Piwigo-Installation.
+Die Administration zeigt den Laufzeitstatus regelmäßig im Hintergrund an. Dafür wird die Admin-Seite nicht neu geladen; offene Dialoge, Assistenten und aufgeklappte Bereiche bleiben erhalten.
 
-- Upload nach `local/bratonien/assets/`
-- Vorschau vorhandener Dateien
-- Anzeige von Dateiname, Pfad, Abmessungen und Dateigroesse
-- Dateien loeschen
-- konfigurierbare PHP-Uploadgrenzen ueber `.user.ini`
-- Validierung von `upload_max_filesize` und `post_max_size`
+Fehler werden nach Prozessschritt getrennt dargestellt, unter anderem für WebDAV-Einlesen, Piwigo-Synchronisierung, Preview-Erzeugung und Derivat-Erzeugung.
 
-### Oeffentliche Bildauswahl fuer Batch Downloader
+### Löschen einer Verbindung
 
-Erweitert Albumseiten um die Moeglichkeit, einzelne Bilder fuer einen Download auszuwaehlen.
+Seit **0.9.6.1** besitzt der WebDAV-Pfad einen vollständigen Lösch-Lebenszyklus:
 
-- Auswahlmodus direkt in der Albumansicht
-- einzelne Bilder markieren
-- alle Bilder auswaehlen oder Auswahl aufheben
-- nur die ausgewaehlten Bilder an Batch Downloader uebergeben
-- vorhandene Piwigo- und Batch-Downloader-Berechtigungen bleiben wirksam
-- getrennte Freigabe fuer Gaeste, registrierte Benutzer und Gruppen
+- Beim Löschen einer WebDAV-Verbindung werden ihre Piwigo-Site, Alben und Bilddatensätze entfernt.
+- Zugehörige Piwigo-Derivate werden entfernt.
+- Nextcloud-Originale bleiben unverändert.
+- Runtime-, Shadowtree-, Source-, Preview- und Statusdaten werden bereinigt.
+- `runtime/cleanup-webdav-piwigo.php` erkennt zusätzlich bereits verwaiste WebDAV-Piwigo-Sites, für die keine Connector-Verbindung mehr existiert, und bereinigt sie im gemeinsamen Runner nachträglich.
 
-**Abhaengigkeit:** Das Piwigo-Plugin Batch Downloader muss installiert und aktiv sein.
+### Runtime
 
-Die ZIP-Erstellung wird nicht dupliziert. Bratonien Tools uebergibt lediglich die berechtigten Bild-IDs an Batch Downloader.
+Aktive Verbindungen werden über den gemeinsamen Runner verarbeitet:
 
-### Fortlaufende Bildtitel in der Stapelverarbeitung
+- `bratonien-nc-connector.timer`
+- `bratonien-nc-connector.service`
+- `runtime/run-all.sh`
 
-Erweitert Piwigos globale Stapelverarbeitung um die Aktion **Fortlaufende Bildtitel**.
+Verbindungsspezifische Konfigurationen liegen unter `/etc/bratonien-tools/nc-connector/`, State-Daten unter `/var/lib/bratonien-tools/nc-connector/connection-ID`.
 
-- arbeitet ausschliesslich mit der aktuellen Piwigo-Auswahl
-- frei waehlbares Titelpraefix
-- frei waehlbare Startnummer
-- einstellbare Stellenzahl mit fuehrenden Nullen
-- direkte Vorschau des resultierenden Titelformats
-- wahlweise alle ausgewaehlten Titel ueberschreiben oder nur leere beziehungsweise typische Kamera-/Importtitel ersetzen
-- Reihenfolge nach Dateiname, Aufnahmedatum oder aktueller Albumreihenfolge
-- vorhandene individuelle Titel koennen gezielt geschuetzt werden
-- physische Dateinamen werden nicht veraendert
+Die Reihenfolge des gemeinsamen Laufs ist:
 
-Beispiel: `Samt 2026 - 001`, `Samt 2026 - 002`, `Samt 2026 - 003`.
+1. lokale Verbindungen reconciliieren;
+2. WebDAV-Verbindungen reconciliieren;
+3. verwaiste WebDAV-Piwigo-Inhalte bereinigen;
+4. allgemeine verwaiste Runtime-Dateien bereinigen;
+5. WebDAV-Verbindungen synchronisieren;
+6. lokale Verbindungen synchronisieren.
 
-Die Albumreihenfolge steht nur zur Verfuegung, wenn die Stapelverarbeitung auf genau ein Album ohne rekursive Unteralben gefiltert ist.
+## Bildcache
 
-### Albumzugriff verwalten
+Bratonien Tools kann:
 
-In der Administrationsoberflaeche koennen Alben direkt zwischen **oeffentlich** und **privat** umgeschaltet werden.
+- Piwigo-Bildderivate gezielt leeren;
+- vorhandene Bildgrößen neu erzeugen;
+- den Cache-Aufbau als Worker-Prozess starten und abbrechen;
+- die Worker-Zahl automatisch oder manuell konfigurieren.
 
-- Albumliste mit Suchfeld
-- paginierte Darstellung
-- Umschalten des Zugriffs direkt aus Bratonien Tools
-- Verwendung nativer Piwigo-Icons fuer den Zugriffsstatus
-- beim Sperren eines Albums behaelt der aktuell handelnde Benutzer automatisch direkten Zugriff
-
-Der Schutz vor versehentlichem Selbstaussperren greift auch dann, wenn ein Album ueber Piwigos eigene Album-Zugriffsverwaltung von oeffentlich auf privat gesetzt wird.
-
-### Geschuetzte Albumfreigaben
-
-Private Alben koennen direkt mit Bratonien Tools geteilt werden. ShareAlbum oder ein anderes Freigabe-Plugin ist dafuer nicht erforderlich.
-
-- eigener individueller Freigabelink pro Freigabe
-- Passwort **optional**; ohne Passwort reicht der nicht erratbare Link
-- Passwoerter werden nur als Hash gespeichert
-- integrierter Generator fuer sichere Passwoerter
-- erzeugte Passwoerter koennen angezeigt und kopiert werden
-- optionales Ablaufdatum
-- optionaler Freigabe-Tag, um mehrere Freigaben desselben Albums auseinanderzuhalten
-- eigener technischer Piwigo-Benutzer pro Freigabe
-- der technische Benutzer erhaelt nur Zugriff auf das freigegebene private Album
-- aktive Freigabelinks werden in der Administration angezeigt und koennen direkt kopiert werden
-- bei aelteren, nicht rekonstruierbaren Links kann ein neuer Link erzeugt werden; der bisherige Link wird dabei ungueltig
-- Freigaben koennen einzeln widerrufen werden
-- beim Widerruf wird der technische Benutzer samt Sitzungen und Albumrecht entfernt
-- wird das Album geloescht, werden zugehoerige Freigaben automatisch bereinigt
-
-Freigabe-Tokens werden nicht im Klartext gespeichert. Fuer aktuelle Freigaben kann der Link deterministisch aus dem technischen Freigabebenutzer, dem Album und einem lokal gespeicherten Secret rekonstruiert werden; in der Datenbank liegt nur der Hash des Tokens.
-
-### Erweiterte Bildnavigation
-
-Auf der Bilddetailseite werden die vorhandenen Piwigo-Image-Maps weiterverwendet und responsiv neu aufgeteilt.
-
-Die Bildflaeche besteht aus vier Navigationszonen:
-
-- links: vorheriges Bild
-- rechts: naechstes Bild
-- oben mittig: zurueck zur Vorschau beziehungsweise Albumansicht
-- Mitte: PhotoSwipe / Vollbildansicht
-
-Die Zonen werden anhand der aktuell dargestellten Bildgroesse berechnet und bei Groessenaenderungen neu gesetzt.
-
-Fuer die sichtbaren Hover-Elemente werden neutrale CSS-Klassen bereitgestellt. Das Plugin enthaelt bewusst kein Bratonien-spezifisches Farbschema. Individuelles Branding kann ueber Theme- oder Custom-CSS erfolgen.
-
-### Selbstaktualisierung
-
-Bratonien Tools kann den aktuellen Stand des GitHub-Repositories pruefen und sich aus der Administration heraus aktualisieren.
-
-- Versionspruefung gegen `main.inc.php` im GitHub-Repository
-- Update-Pruefung wird kurzzeitig zwischengespeichert
-- Updates duerfen nur vom Piwigo-Webmaster ausgefuehrt werden
-- Download des aktuellen `main`-Branches als ZIP
-- Pruefung auf `ZipArchive` und Schreibrechte des Plugin-Verzeichnisses
-- detailliertere Downloadfehler
-- Status wird nach Update-Pruefungen und Aktionen neu eingelesen
-
-## Architektur
-
-Das Plugin ist modular aufgebaut. Administrative Werkzeuge werden getrennt implementiert und ueber eine zentrale Registry eingebunden. Frontend-, Runtime- und Piwigo-Integrationen liegen ebenfalls in eigenen Modulen.
-
-Wichtige Bestandteile:
-
-- `main.inc.php` - Plugin-Einstieg, Runtime-Module und Admin-Menue
-- `admin.php` - zentraler Admin-Controller
-- `include/tool_registry.inc.php` - Registry der administrativen Aktionen
-- `include/nc_connector.inc.php` - Connector-Datenmodell, Legacy-Import und gemeinsame Low-Level-Funktionen
-- `include/nc_connector_manage.inc.php` - native Connection-Verwaltung und Verifikation
-- `include/nc_connector_takeover.inc.php` - kontrollierte Legacy-Uebergabe
-- `include/nc_connector_system.inc.php` - Timer- und Laufzeitstatus ueber alle aktiven Verbindungen
-- `include/nc_connector_ws.inc.php` - read-only Paritaets-/Synchronisationspruefung ueber den Piwigo-Webservice
-- `include/nc_orphan_ws.inc.php` - produktive Synchronisation einzelner Root-Dateien als Piwigo-Orphans
-- `runtime/sync.sh` - Plugin-eigene Sync-Runtime einer Verbindung
-- `runtime/run-all.sh` - gemeinsamer Runner fuer alle installierten Verbindungen
-- `runtime/lib/activity_gate.py` - Activity-Gate, Share-Fingerprint und zeitgesteuerte Reconciliation
-- `runtime/lib/build_manifest.py` - Aufloesung von Ordner- und Dateifreigaben auf konfigurierte Storage-Mounts
-- `runtime/lib/shadow_tree.py` - Aufbau des Piwigo-kompatiblen Shadow Trees ohne Kopieren der Originale
-- `runtime/lib/piwigo-db-check.php` - Konsistenzpruefung vorhandener Piwigo-Alben
-- `runtime/lib/piwigo-db-sync.pl` - Ausloesen der Piwigo-Dateisynchronisierung und anschliessender Orphan-Abgleich
-- `nc-connector-install.php` - native Aktivierung einer verifizierten Verbindung
-- `nc-connector-disable.php` - kontrollierte Deaktivierung einer aktiven Verbindung
-- `nc-connector-normalize.php` - Ueberfuehrung einer migrierten aktiven Verbindung in den nativen State- und Multi-Connection-Aufbau
-- `nc-connector-migrate.php` - einmaliger Migrationshelfer fuer bestehende Legacy-Installationen
-- `nc-connector-cutover-v2.php` - kontrollierter Legacy-Cutover
-- `nc-connector-runtime-switch.php` - Umstellung einer aktiven Legacy-Verbindung auf die Plugin-eigene Runtime
-- `nc-connector-legacy-cleanup.php` - kontrollierte Entfernung alter Sync-Scripts und systemd-Units
-- `include/public_selection.inc.php` - oeffentliche Fotoauswahl und Batch-Downloader-Anbindung
-- `include/picture_navigation.inc.php` - Einbindung der erweiterten Bildnavigation
-- `include/batch_titles.inc.php` - fortlaufende Titelvergabe in Piwigos Stapelverarbeitung
-- `include/album_lock.inc.php` - Laden und Umschalten des Album-Zugriffsstatus
-- `include/album_shares.inc.php` - Albumfreigaben, Freigabetokens und Schutz vor Selbstaussperren bei privaten Alben
-- `include/cache_worker_settings.inc.php` - Einstellungen fuer den Cache-Worker
-- `include/dependencies.inc.php` - Abhaengigkeitspruefungen
-- `include/watermark_*.inc.php` - Wasserzeichen-Engine und Runtime
-- `include/self_update.inc.php` - Versionspruefung und Selbstaktualisierung
-- `tools/album_rules.inc.php` - albumbezogene Regeln
-- `tools/asset_manager.inc.php` - Verwaltung eigener Bilddateien
-- `tools/image_cache.inc.php` - Cache-Verwaltung
-- `tools/watermark*.inc.php` - administrative Wasserzeichenmodule
-- `main-cache-build.php` - Cache-Aufbau im Worker-Prozess
-- `main-cache-status.php` - Statusschnittstelle fuer den Cache-Worker
-- `js/` - Frontend- und Admin-JavaScript
-- `css/` - strukturelles Plugin-CSS
-- `template/` - Admin- und Frontend-Templates
-- `maintain.class.php` - Piwigo-Lifecycle
-
-## Neues administratives Tool hinzufuegen
-
-1. Neue Implementierung unter `tools/` anlegen.
-2. Datei in `include/tool_registry.inc.php` laden.
-3. Handler in `bratonien_tools_get_tools()` registrieren.
-4. Benoetigte Darstellung in der gemeinsamen Administrationsoberflaeche ergaenzen.
-
-Funktionen sollten moeglichst eigenstaendig bleiben und keine Bratonien-spezifische Gestaltung voraussetzen.
+Originalbilder bleiben unangetastet.
+
+## Wasserzeichenverwaltung
+
+- eigene Wasserzeichendateien;
+- Wasserzeichenprofile;
+- globale Regeln für öffentliche/private Alben;
+- Album-Ausnahmen und Vererbung;
+- Position, Transparenz und Skalierung;
+- eigener Runtime-Filter für Piwigo-Derivate;
+- Sicherung der bisherigen Piwigo-Wasserzeichenkonfiguration beim Aktivieren.
+
+## Bilddateien und Pfade
+
+- Upload nach `local/bratonien/assets/`;
+- Vorschau, Abmessungen und Dateigröße;
+- Löschen verwalteter Assets;
+- konfigurierbare PHP-Uploadgrenzen über `.user.ini`, sofern die Serverkonfiguration dies zulässt.
+
+## Fotoauswahl und Batch Downloader
+
+Bratonien Tools erweitert Albumseiten um eine öffentliche bzw. berechtigungsabhängige Bildauswahl und übergibt nur die ausgewählten Bild-IDs an das Piwigo-Plugin Batch Downloader.
+
+**Abhängigkeit:** Batch Downloader muss installiert und aktiv sein.
+
+## Fortlaufende Bildtitel
+
+Die globale Piwigo-Stapelverarbeitung erhält die Aktion **Fortlaufende Bildtitel** mit Präfix, Startnummer, Stellenzahl, Sortierung und Schutz vorhandener individueller Titel. Physische Dateinamen werden nicht verändert.
+
+## Albumzugriff
+
+Alben können in Bratonien Tools zwischen öffentlich und privat umgeschaltet werden. Beim Sperren wird verhindert, dass sich der handelnde Benutzer versehentlich selbst aussperrt.
+
+## Geschützte Albumfreigaben
+
+Private Alben können über eigene Freigabelinks geteilt werden:
+
+- optionales Passwort;
+- optionales Ablaufdatum;
+- eigener technischer Piwigo-Benutzer pro Freigabe;
+- minimaler Albumzugriff;
+- Hash-Speicherung von Passwörtern und Tokens;
+- Widerruf und automatische Bereinigung beim Löschen eines Albums.
+
+## Erweiterte Bildnavigation
+
+Die Piwigo-Bilddetailseite erhält responsive Navigationszonen für vorheriges Bild, nächstes Bild, Rückkehr zur Übersicht und PhotoSwipe/Vollbild.
+
+## Selbstaktualisierung
+
+Der integrierte Updater:
+
+- liest den Zielstand aus GitHub;
+- bindet ein Update an einen konkreten Commit;
+- prüft Version und SHA-256 des Zielstands;
+- erstellt vor dem Austausch ein Backup;
+- nutzt Post/Redirect/Get;
+- verlangt Webmaster-Rechte, `ZipArchive` und ausreichende Schreibrechte.
+
+## Wichtige Dateien und Verzeichnisse
+
+- `main.inc.php` – Plugin-Einstieg und Runtime-Hooks
+- `admin.php` – zentraler Admin-Controller
+- `include/nc_connector.inc.php` – Datenmodell und gemeinsame Connector-Funktionen
+- `include/nc_connector_wizard.inc.php` – Verbindungsassistent
+- `include/nc_connector_wizard_webdav_flow.inc.php` – WebDAV-first-Wizardablauf
+- `include/nc_connector_delete_safe.inc.php` – sicheres Löschen einschließlich WebDAV-Piwigo-Inhalten
+- `include/nc_productive_ws.inc.php` – produktiver Piwigo-Dateisync
+- `include/nc_orphan_ws.inc.php` – Orphan-Synchronisierung
+- `include/webdav_image_runtime.inc.php` – WebDAV-Bildzuordnung, Preview-/Derivathilfen und URL-Filter
+- `webdav-image.php` – berechtigungsgeprüfter WebDAV-Bildstream
+- `runtime/reconcile-webdav.php` – WebDAV-Runtime-Reconcile
+- `runtime/cleanup-webdav-piwigo.php` – Bereinigung gelöschter/verwaister WebDAV-Verbindungen in Piwigo
+- `runtime/sync-webdav.sh` – Ablauf einer WebDAV-Verbindung
+- `runtime/run-all.sh` – gemeinsamer Multi-Connection-Runner
+- `runtime/lib/build_webdav_placeholder_source.py` – rekursiver WebDAV-Scan und Platzhalterquelle
+- `runtime/lib/precache-webdav-previews.php` – vorbereitete JPEG-/PNG-Arbeitsbilder
+- `runtime/lib/build-webdav-derivatives.php` – CLI-Derivat-Builder
+- `runtime/lib/shadow_tree.py` – atomarer Shadow Tree
+- `runtime/lib/piwigo-sync.php` – Piwigo-Sync mit API/Fallback
+- `main-cache-build.php` – allgemeiner Piwigo-Derivat-/Cache-Builder
+- `include/self_update.inc.php` – Self-Updater
+- `include/album_shares.inc.php` – geschützte Albumfreigaben
+- `include/public_selection.inc.php` – Fotoauswahl
+- `include/batch_titles.inc.php` – fortlaufende Titel
+- `include/watermark_*.inc.php` – Wasserzeichen-Engine
+- `tools/` – administrative Einzelwerkzeuge
+- `template/`, `js/`, `css/` – Oberfläche
 
 ## Sicherheit
 
-Administrative Aktionen pruefen Piwigo-Berechtigungen und verwenden fuer schreibende Aktionen Piwigos CSRF-Schutz.
-
-Weitere Schutzmechanismen sind funktionsabhaengig, unter anderem:
-
-- verschluesselte Speicherung der Connector-Zugangsdaten mit einem lokalen Connector-Secret
-- PostgreSQL-Reader mit minimalen Leserechten fuer lokale Nextcloud-Verbindungen
-- explizite Storage-Zuordnungen statt automatischer Freigabe beliebiger Dateipfade
-- Verifikation von Datenbank, Views und Mounts vor einer Aktivierung
-- Runtime-Test vor der nativen Aktivierung
-- Root-only-Hilfsprogramme fuer systemd-, Secret- und State-Aenderungen
-- getrennte State-Verzeichnisse pro Connector-Verbindung
-- Originalbilder werden vom NC Connector nicht in eine zweite permanente Bibliothek kopiert
-- Validierung von Cache- und Dateipfaden
-- Filterung ausgewaehlter Bild-IDs gegen die aktuell berechtigte Bildmenge
-- Nutzung der von Piwigos Stapelverarbeitung validierten Auswahl fuer die fortlaufende Titelvergabe
-- gehashte Passwoerter und gehashte Freigabetokens fuer Albumfreigaben
-- nicht erratbare Freigabelinks auf Basis eines lokal erzeugten Secrets
-- eigene technische Benutzer mit minimalem Albumzugriff fuer Freigaben
-- automatische Bereinigung widerrufener und geloeschter Albumfreigaben
-- automatischer Erhalt des eigenen Zugriffs beim Umschalten eines Albums auf privat
-- Connector-importierte physische Alben werden standardmaessig privat angelegt
-- Beibehaltung bestehender Piwigo- und Plugin-Berechtigungen
-- kontrollierte Uploadziele und Uploadgrenzen
-- kein Zugriff auf Originalbilder beim Leeren des Bildcaches
-- Webmaster-Pruefung, Schreibbarkeitspruefung und kontrolliertes temporaeres Arbeitsverzeichnis bei Selbstupdates
-
-## Styling und Anpassung
-
-Bratonien Tools soll Funktion und Gestaltung voneinander trennen. Plugin-eigene Styles dienen daher nur der technischen Darstellung und Positionierung.
-
-Farben, Schatten, Hover-Effekte und individuelles Branding sollten ueber das aktive Piwigo-Theme oder Custom CSS umgesetzt werden.
+- administrative Schreibaktionen verwenden Piwigos CSRF-Schutz;
+- Connector-Zugangsdaten werden verschlüsselt gespeichert;
+- Nextcloud-Zugangsdaten werden verbindungseigen gespeichert und nur serverseitig verwendet;
+- Wizard-Geheimnisse werden nicht im Browser-Web-Storage persistiert;
+- SQL-View-Namen werden vor Verwendung validiert;
+- produktive Piwigo-API ist versionsgebunden;
+- Originalbilder werden vom Connector nicht gelöscht;
+- WebDAV-Originalbilder werden nicht dauerhaft lokal gespeichert;
+- Update-Pakete werden an Commit und Hash gebunden.
 
 ## Entwicklungsstand
 
-Das Plugin befindet sich weiterhin in aktiver Entwicklung. Mit Version **0.9.3.16** ist der lokale NC-Connector fuer den aktuellen Bratonien-Einsatz End-to-End funktionsfaehig: Ordner- und Einzeldateifreigaben werden erkannt, der Shadow Tree wird automatisch gepflegt, Piwigo wird synchronisiert, Einzeldateien werden als Orphans verwaltet und der regelmaessige Lauf erfolgt ueber den gemeinsamen systemd-Timer.
+`0.9.6.x` ist die aktuelle Versionslinie.
 
-Als naechster groesserer Connector-Ausbauschritt bleibt der Remote-Nextcloud-Adapter offen.
+Mit **0.9.6.1** ist der WebDAV-Pfad einschließlich Piwigo-Registrierung, vorbereiteter Bildquelle, CLI-Derivatstrecke und Lösch-/Cleanup-Lebenszyklus im Repository umgesetzt. Der bestehende lokale Connector bleibt parallel erhalten.
+
+Der jeweils detaillierte Prüf- und Entwicklungsstand steht in [`CURRENT_STATUS.md`](CURRENT_STATUS.md).

admin.php

@@ -9,12 +9,106 @@ check_status(ACCESS_ADMINISTRATOR);
 require_once(BRATONIEN_TOOLS_PATH . 'include/tool_registry.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_system.inc.php');
 
+function bratonien_tools_nc_connector_admin_connections(array $connections)
+{
+  $by_id = array();
+  foreach ($connections as $connection)
+  {
+    $by_id[(int)$connection['id']] = $connection;
+  }
+
+  $hidden_legacy_ids = array();
+  $logical_remote = array();
+  foreach ($connections as $connection)
+  {
+    if ((string)($connection['adapter'] ?? '') !== 'remote') continue;
+    $migration = isset($connection['config']['migration']) && is_array($connection['config']['migration'])
+      ? $connection['config']['migration']
+      : array();
+    if ((string)($migration['role'] ?? '') !== 'webdav-primary-candidate') continue;
+
+    $legacy_id = (int)($migration['legacy_fallback_connection_id'] ?? 0);
+    if ($legacy_id < 1 || empty($by_id[$legacy_id]) || (string)$by_id[$legacy_id]['adapter'] !== 'local') continue;
+
+    $legacy = $by_id[$legacy_id];
+    $hidden_legacy_ids[$legacy_id] = true;
+    $connection['logical_connection'] = true;
+    $connection['legacy_fallback_connection_id'] = $legacy_id;
+    $connection['enabled'] = !empty($connection['enabled']) || !empty($legacy['enabled']);
+    if ($connection['enabled']) $connection['takeover_state'] = 'active';
+    $connection['fallback_stored'] = !empty($connection['fallback_stored']) || !empty($legacy['fallback_stored']);
+    if (trim((string)$connection['name']) === '') $connection['name'] = (string)$legacy['name'];
+    $logical_remote[(int)$connection['id']] = $connection;
+  }
+
+  $visible = array();
+  foreach ($connections as $connection)
+  {
+    $id = (int)$connection['id'];
+    if (isset($hidden_legacy_ids[$id])) continue;
+    if (isset($logical_remote[$id])) $connection = $logical_remote[$id];
+    $visible[] = $connection;
+  }
+
+  return $visible;
+}
+
+function bratonien_tools_nc_connector_admin_last_status(array $connection)
+{
+  $latest = bratonien_tools_nc_connector_connection_last_status($connection);
+  $legacy_id = (int)($connection['legacy_fallback_connection_id'] ?? 0);
+  if ($legacy_id < 1)
+  {
+    return $latest;
+  }
+
+  $legacy = bratonien_tools_nc_connector_connection($legacy_id, false);
+  if (!$legacy)
+  {
+    return $latest;
+  }
+
+  $legacy_status = bratonien_tools_nc_connector_connection_last_status($legacy);
+  if ((int)($legacy_status['timestamp'] ?? 0) > (int)($latest['timestamp'] ?? 0))
+  {
+    return $legacy_status;
+  }
+
+  return $latest;
+}
+
 $tools = bratonien_tools_get_tools();
 $messages = array();
 $errors = array();
 $self_update_override = null;
 $nc_piwigo_api_test = null;
 
+// Post/Redirect/Get: never leave a mutating Bratonien Tools action as the
+// browser's current request. Otherwise a normal reload can submit the same
+// action again (for example an update, delete or create action).
+if ($_SERVER['REQUEST_METHOD'] !== 'POST' && !empty($_SESSION['bratonien_tools_flash']) && is_array($_SESSION['bratonien_tools_flash']))
+{
+  $flash = $_SESSION['bratonien_tools_flash'];
+  unset($_SESSION['bratonien_tools_flash']);
+
+  if (!empty($flash['messages']) && is_array($flash['messages']))
+  {
+    $messages = array_values($flash['messages']);
+  }
+  if (!empty($flash['errors']) && is_array($flash['errors']))
+  {
+    $errors = array_values($flash['errors']);
+  }
+  if (!empty($flash['self_update']) && is_array($flash['self_update']))
+  {
+    $self_update_override = $flash['self_update'];
+  }
+  if (!empty($flash['nc_piwigo_api_test']) && is_array($flash['nc_piwigo_api_test']))
+  {
+    $nc_piwigo_api_test = $flash['nc_piwigo_api_test'];
+  }
+}
+
 if (
   $_SERVER['REQUEST_METHOD'] === 'POST'
   && empty($_POST)
@@ -59,6 +153,33 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['bratonien_tool']))
       $errors[] = $e->getMessage();
     }
   }
+
+  $_SESSION['bratonien_tools_flash'] = array(
+    'messages' => $messages,
+    'errors' => $errors,
+    'self_update' => $self_update_override,
+    'nc_piwigo_api_test' => $nc_piwigo_api_test,
+  );
+
+  $redirect_url = get_root_url().'admin.php?page=plugin-'.BRATONIEN_TOOLS_ID;
+  $wizard_action = strpos($tool_id, 'nc_connector_wizard_') === 0
+    || $tool_id === 'nc_connector_migrate_start'
+    || $tool_id === 'nc_connector_edit_start';
+  if ($wizard_action)
+  {
+    $wizard_closed = $tool_id === 'nc_connector_wizard_reset'
+      || ($tool_id === 'nc_connector_wizard_finish' && empty($errors));
+    if (($tool_id === 'nc_connector_migrate_start' || $tool_id === 'nc_connector_edit_start') && !empty($errors))
+    {
+      $wizard_closed = true;
+    }
+    $redirect_url .= '&nc_wizard='.($wizard_closed ? 'closed' : 'open');
+  }
+  if (!headers_sent())
+  {
+    header('Location: '.$redirect_url, true, 303);
+    exit;
+  }
 }
 
 $watermark = bratonien_tools_get_watermark_data();
@@ -75,11 +196,32 @@ $asset_environment = bratonien_tools_get_asset_environment();
 $album_shares = bratonien_tools_get_album_shares();
 $private_albums = bratonien_tools_get_private_albums();
 $nc_connector = bratonien_tools_nc_connector_status();
+$nc_connector_runtime_connections = $nc_connector['connections'];
+$nc_connector['connections'] = bratonien_tools_nc_connector_admin_connections($nc_connector_runtime_connections);
+$nc_connector['connection_count'] = count($nc_connector['connections']);
+$nc_connector['active_count'] = 0;
+foreach ($nc_connector['connections'] as $visible_connection)
+{
+  if (!empty($visible_connection['enabled'])) $nc_connector['active_count']++;
+}
 foreach ($nc_connector['connections'] as &$nc_connection)
 {
+  $nc_connection['last_sync'] = bratonien_tools_nc_connector_admin_last_status($nc_connection);
+  $nc_connection['display_name'] = $nc_connection['name'];
+
+  $storage_lines = array();
+  $storages = isset($nc_connection['config']['storages']) && is_array($nc_connection['config']['storages'])
+    ? $nc_connection['config']['storages']
+    : array();
+  foreach ($storages as $storage)
+  {
+    $storage_lines[] = (string)($storage['storage_id'] ?? '').' | '.(string)($storage['source_prefix'] ?? '').' | '.(string)($storage['local_mount'] ?? '');
+  }
+  $nc_connection['storage_text'] = implode("\n", $storage_lines);
+
   if (!empty($nc_connection['fallback_stored']))
   {
-    $nc_connection['name'] .= ' · Fallback gespeichert';
+    $nc_connection['display_name'] .= ' · Fallback gespeichert';
     $nc_connection['verification_checks'][] = array(
       'name' => 'Piwigo-Fallback',
       'ok' => true,
@@ -89,6 +231,7 @@ foreach ($nc_connector['connections'] as &$nc_connection)
 }
 unset($nc_connection);
 $nc_connector['piwigo_api_test'] = $nc_piwigo_api_test;
+$nc_connector['wizard'] = bratonien_tools_nc_wizard_state();
 $nc_system_defaults = array(
   'timer_name' => 'bratonien-nc-connector.timer',
   'timer_active' => false,
@@ -97,6 +240,12 @@ $nc_system_defaults = array(
   'last_run_label' => 'Nicht verfügbar',
   'last_run_state' => '',
   'last_run_message' => '',
+  'last_run_auth_mode' => '',
+  'last_run_api_state' => '',
+  'last_run_api_message' => '',
+  'last_run_fallback_state' => '',
+  'last_run_fallback_message' => '',
+  'last_run_error_detail' => '',
   'next_run_timestamp' => 0,
   'next_run_label' => 'Nicht verfügbar',
   'legacy_runtime_exists' => false,
@@ -106,7 +255,7 @@ $nc_system_defaults = array(
 );
 $nc_connector['system'] = array_merge(
   $nc_system_defaults,
-  bratonien_tools_nc_connector_system_status($nc_connector['connections'])
+  bratonien_tools_nc_connector_system_status($nc_connector_runtime_connections)
 );
 $album_lock_page_number = isset($_GET['br_album_page']) ? max(1, (int)$_GET['br_album_page']) : 1;
 $album_lock_search = isset($_GET['br_album_search']) ? trim((string)$_GET['br_album_search']) : '';
@@ -232,4 +381,4 @@ $admin_content .= $template->parse('asset_manager_admin_content', true);
 $admin_content .= $template->parse('album_shares_admin_content', true);
 $admin_content .= $template->parse('nc_connector_admin_content', true);
 $admin_content .= $template->parse('system_admin_content', true);
-$template->assign('ADMIN_CONTENT', $admin_content);
+$template->assign('ADMIN_CONTENT', $admin_content);

include/nc_connector_connection_scope.inc.php

@@ -0,0 +1,231 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_finish_connection_scoped()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 4 || empty($state['technical_complete']) || trim((string)$state['showcase_user']) === '') throw new RuntimeException('Der Assistent ist noch nicht vollständig.');
+
+  if (array_key_exists('nc_wizard_fallback_user', $_POST)) $state['_fallback_user'] = trim((string)$_POST['nc_wizard_fallback_user']);
+  if (array_key_exists('nc_wizard_fallback_password', $_POST)) $state['_fallback_password'] = (string)$_POST['nc_wizard_fallback_password'];
+  bratonien_tools_nc_wizard_store($state);
+
+  $fallback_user = trim((string)$state['_fallback_user']);
+  $fallback_password = (string)$state['_fallback_password'];
+  if (($fallback_user === '') !== ($fallback_password === '')) throw new RuntimeException('Fallback-Benutzer und Fallback-Passwort müssen entweder beide angegeben oder beide leer gelassen werden.');
+  if ($state['api_status'] !== 'ok' && $fallback_user === '') throw new RuntimeException('Da die Piwigo-API übersprungen wurde, ist für diese Verbindung ein Fallback-Zugang erforderlich.');
+
+  $mapping_lines = array();
+  foreach ((array)$state['storages'] as $storage)
+  {
+    $key = (string)$storage['storage_id'].'|'.trim((string)$storage['source_prefix'], '/').'|'.(string)$storage['local_mount'];
+    $mapping_lines[$key] = (string)$storage['storage_id'].' | '.trim((string)$storage['source_prefix'], '/').' | '.(string)$storage['local_mount'];
+  }
+
+  $_POST['nc_name']=(string)$state['connection_name'];
+  $_POST['nc_host']=(string)$state['db_host'];
+  $_POST['nc_port']=(string)$state['db_port'];
+  $_POST['nc_database']=(string)$state['db_database'];
+  $_POST['nc_user']=(string)$state['db_user'];
+  $_POST['nc_db_password']=(string)$state['_db_password'];
+  $_POST['nc_source_view']=(string)$state['source_view'];
+  $_POST['nc_activity_view']=(string)$state['activity_view'];
+  $_POST['nc_gallery_root']=(string)$state['gallery_root'];
+  $_POST['nc_storages']=implode("\n",array_values($mapping_lines));
+  $_POST['nc_quiet_seconds']='120';
+  $_POST['nc_max_wait_seconds']='900';
+  $_POST['nc_full_sync_seconds']='86400';
+  $_POST['nc_piwigo_user']=$fallback_user;
+  $_POST['nc_piwigo_password']=$fallback_password;
+  $_POST['nc_nextcloud_url']=(string)$state['base_url'];
+  $_POST['nc_showcase_user']=(string)$state['showcase_user'];
+  $_POST['nc_access_user']=(string)$state['username'];
+  $_POST['nc_nextcloud_user']=(string)$state['username'];
+  $_POST['nc_nextcloud_password']=(string)$state['_password'];
+  $_POST['nc_product']=(string)$state['product'];
+  $_POST['nc_version']=(string)$state['version'];
+  $_POST['nc_api_validated']=$state['api_status']==='ok'?'1':'0';
+  $_POST['nc_connection_api_key_id']=$state['api_status']==='ok'?(string)$state['_api_key_id']:'';
+  $_POST['nc_connection_api_key_secret']=$state['api_status']==='ok'?(string)$state['_api_key_secret']:'';
+
+  $result = bratonien_tools_nc_connector_create_local_api_first();
+  $connection_id = (int)($result['connection_id'] ?? 0);
+  if ($connection_id < 1) throw new RuntimeException('Die neue Verbindung konnte nicht gespeichert werden.');
+
+  $connection = bratonien_tools_nc_connector_connection($connection_id, false);
+  if (!$connection) throw new RuntimeException('Die neue Verbindung konnte nach dem Anlegen nicht gelesen werden.');
+  $config = $connection['config'];
+  $config['storages'] = array_values($state['storages']);
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Die Verzeichnisauswahl konnte nicht serialisiert werden.');
+  $table = bratonien_tools_nc_connector_table();
+  pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$connection_id." LIMIT 1");
+
+  unset($_SESSION['bratonien_nc_wizard']);
+  unset($result['connection_id']);
+  $result['message'] = 'Verbindung wurde vollständig mit eigener Authentifizierung angelegt. '.$result['message'];
+  return $result;
+}
+
+function bratonien_tools_nc_connector_delete_any()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, false);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+
+  $status_dir = rtrim(PHPWG_ROOT_PATH, '/').'/_data/bratonien-tools/nc-connector-status';
+  if (!is_dir($status_dir) && !@mkdir($status_dir, 0755, true) && !is_dir($status_dir)) throw new RuntimeException('Der Connector-Statusordner konnte nicht angelegt werden.');
+
+  $tombstone = $status_dir.'/deleted-'.$id;
+  if (@file_put_contents($tombstone, date('c')."\n", LOCK_EX) === false) throw new RuntimeException('Die Verbindung konnte nicht sicher für die Laufzeit deaktiviert werden.');
+
+  $public_status = $status_dir.'/connection-'.$id.'.json';
+  if (is_file($public_status)) @unlink($public_status);
+
+  $config = is_array($connection['config'] ?? null) ? $connection['config'] : array();
+  $state_dir = rtrim((string)($config['state_dir'] ?? ''), '/');
+  if ($state_dir !== '' && strpos($state_dir, '/var/lib/bratonien-tools/nc-connector/connection-'.$id) === 0 && file_exists($state_dir))
+  {
+    bratonien_tools_nc_connector_remove_tree($state_dir);
+  }
+
+  $table = bratonien_tools_nc_connector_table();
+  pwg_query("DELETE FROM `$table` WHERE id=".$id." LIMIT 1");
+  return array('message'=>'Connector-Verbindung wurde gelöscht und für weitere Laufzeitabrufe gesperrt. Nextcloud- und Piwigo-Bilder blieben unverändert.');
+}
+
+function bratonien_tools_nc_connector_verify_connection_scoped()
+{
+  $result = bratonien_tools_nc_connector_verify_managed();
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) return $result;
+
+  $config = is_array($connection['config'] ?? null) ? $connection['config'] : array();
+  if ((string)($config['origin'] ?? '') !== 'native' || array_key_exists('api_enabled', $config)) return $result;
+
+  $credentials = bratonien_tools_nc_connector_credentials_from_blob($connection['secret_blob'] ?? '');
+  $db_password = (string)($credentials['db_password'] ?? '');
+  $fallback_user = (string)($credentials['piwigo_user'] ?? '');
+  $fallback_password = (string)($credentials['piwigo_password'] ?? '');
+  if ($db_password === '') return $result;
+
+  $api_key_id = '';
+  $api_key_secret = '';
+  if ($fallback_user === '')
+  {
+    $legacy_api = bratonien_tools_nc_api_credentials();
+    $api_key_id = trim((string)($legacy_api['key_id'] ?? ''));
+    $api_key_secret = trim((string)($legacy_api['key_secret'] ?? ''));
+  }
+
+  $payload = json_encode(array(
+    'v'=>3,
+    'db_password'=>$db_password,
+    'piwigo_user'=>$fallback_user,
+    'piwigo_password'=>$fallback_password,
+    'api_key_id'=>$api_key_id,
+    'api_key_secret'=>$api_key_secret,
+    'nextcloud_user'=>'',
+    'nextcloud_password'=>'',
+  ), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($payload)) throw new RuntimeException('Verbindungsauthentifizierung konnte nicht migriert werden.');
+
+  $config['piwigo_auth'] = 'connection-scoped';
+  $config['api_enabled'] = $api_key_id !== '';
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Connector-Konfiguration konnte nicht migriert werden.');
+
+  $blob = bratonien_tools_nc_connector_encrypt_secret($payload);
+  $table = bratonien_tools_nc_connector_table();
+  pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."', secret_blob='".pwg_db_real_escape_string($blob)."' WHERE id=".$id." LIMIT 1");
+  return $result;
+}
+
+function bratonien_tools_nc_connector_scoped_secret(array $connection)
+{
+  $plain = bratonien_tools_nc_connector_decrypt_secret($connection['secret_blob'] ?? '');
+  $decoded = json_decode($plain, true);
+  if (is_array($decoded) && array_key_exists('db_password', $decoded))
+  {
+    return array(
+      'v'=>3,
+      'db_password'=>(string)($decoded['db_password'] ?? ''),
+      'piwigo_user'=>(string)($decoded['piwigo_user'] ?? ''),
+      'piwigo_password'=>(string)($decoded['piwigo_password'] ?? ''),
+      'api_key_id'=>(string)($decoded['api_key_id'] ?? ''),
+      'api_key_secret'=>(string)($decoded['api_key_secret'] ?? ''),
+      'nextcloud_user'=>(string)($decoded['nextcloud_user'] ?? ''),
+      'nextcloud_password'=>(string)($decoded['nextcloud_password'] ?? ''),
+    );
+  }
+
+  return array(
+    'v'=>3,
+    'db_password'=>(string)$plain,
+    'piwigo_user'=>'',
+    'piwigo_password'=>'',
+    'api_key_id'=>'',
+    'api_key_secret'=>'',
+    'nextcloud_user'=>'',
+    'nextcloud_password'=>'',
+  );
+}
+
+function bratonien_tools_nc_connector_store_scoped_secret($id, array $connection, array $credentials)
+{
+  $config = is_array($connection['config'] ?? null) ? $connection['config'] : array();
+  $is_webdav = (string)($config['source_mode'] ?? '') === 'webdav-placeholder';
+  if (!$is_webdav && trim((string)($credentials['db_password'] ?? '')) === '') throw new RuntimeException('Das Datenbankpasswort der Verbindung fehlt.');
+  if ($is_webdav && (trim((string)($credentials['nextcloud_user'] ?? '')) === '' || (string)($credentials['nextcloud_password'] ?? '') === ''))
+  {
+    throw new RuntimeException('Die Nextcloud-Zugangsdaten der WebDAV-Verbindung fehlen.');
+  }
+
+  $credentials['v'] = 3;
+  $payload = json_encode($credentials, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($payload)) throw new RuntimeException('Verbindungszugangsdaten konnten nicht serialisiert werden.');
+  $blob = bratonien_tools_nc_connector_encrypt_secret($payload);
+
+  if (array_key_exists('api_enabled', $config))
+  {
+    $config['api_enabled'] = trim((string)($credentials['api_key_id'] ?? '')) !== '' && trim((string)($credentials['api_key_secret'] ?? '')) !== '';
+  }
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
+
+  $table = bratonien_tools_nc_connector_table();
+  $now = date('Y-m-d H:i:s');
+  pwg_query("UPDATE `$table` SET secret_blob='".pwg_db_real_escape_string($blob)."', config_json='".pwg_db_real_escape_string($config_json)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".(int)$id." LIMIT 1");
+}
+
+function bratonien_tools_nc_connector_fallback_save_scoped()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $username = trim((string)($_POST['nc_fallback_user'] ?? ''));
+  $password = (string)($_POST['nc_fallback_password'] ?? '');
+  if ($username === '' || $password === '') throw new RuntimeException('Benutzername und Passwort für den Fallback müssen angegeben werden.');
+
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+  $credentials['piwigo_user'] = $username;
+  $credentials['piwigo_password'] = $password;
+  bratonien_tools_nc_connector_store_scoped_secret($id, $connection, $credentials);
+  return array('message'=>'Piwigo-Benutzername und Passwort wurden als Fallback dieser Verbindung gespeichert.');
+}
+
+function bratonien_tools_nc_connector_fallback_delete_scoped()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+  $credentials['piwigo_user'] = '';
+  $credentials['piwigo_password'] = '';
+  bratonien_tools_nc_connector_store_scoped_secret($id, $connection, $credentials);
+  return array('message'=>'Fallback dieser Verbindung wurde gelöscht. Ein vorhandener API-Zugang blieb unverändert.');
+}

include/nc_connector_create_api.inc.php

@@ -5,6 +5,11 @@ if (!defined('PHPWG_ROOT_PATH'))
 }
 
 function bratonien_tools_nc_connector_create_local_api_first()
+{
+  throw new RuntimeException('Neue Verbindungen über die alte lokale PostgreSQL-/Storage-Struktur sind ab 0.9.6.2 gesperrt. Bestehende lokale Verbindungen bleiben für die schrittweise Migration weiterhin aktiv. Neue Verbindungen müssen über den WebDAV-Assistenten angelegt werden.');
+}
+
+function bratonien_tools_nc_connector_create_local_api_first_legacy()
 {
   $required = array(
     'nc_name' => 'Name',
@@ -16,13 +21,9 @@ function bratonien_tools_nc_connector_create_local_api_first()
     'nc_activity_view' => 'Activity-View',
     'nc_gallery_root' => 'Galerie-Pfad',
   );
-
   foreach ($required as $field => $label)
   {
-    if (trim((string)($_POST[$field] ?? '')) === '')
-    {
-      throw new RuntimeException($label.' fehlt.');
-    }
+    if (trim((string)($_POST[$field] ?? '')) === '') throw new RuntimeException($label.' fehlt.');
   }
 
   $fallback_user = trim((string)($_POST['nc_piwigo_user'] ?? ''));
@@ -32,79 +33,101 @@ function bratonien_tools_nc_connector_create_local_api_first()
     throw new RuntimeException('Fallback-Benutzer und Fallback-Passwort muessen entweder beide angegeben oder beide leer gelassen werden.');
   }
 
-  $api = bratonien_tools_nc_api_credentials();
-  if (($api['key_id'] ?? '') === '' && $fallback_user === '')
+  $nextcloud_user = trim((string)($_POST['nc_nextcloud_user'] ?? $_POST['nc_access_user'] ?? ''));
+  $nextcloud_password = (string)($_POST['nc_nextcloud_password'] ?? '');
+  if (($nextcloud_user === '') !== ($nextcloud_password === ''))
   {
-    throw new RuntimeException('Es ist weder ein gespeicherter Piwigo-API-Zugang noch ein Benutzername/Passwort-Fallback vorhanden.');
+    throw new RuntimeException('Nextcloud-Benutzer und Nextcloud-Passwort muessen entweder beide vorhanden oder beide leer sein.');
+  }
+
+  $wizard_auth_present = array_key_exists('nc_api_validated', $_POST);
+  $validated_pending_api = (string)($_POST['nc_api_validated'] ?? '') === '1';
+  $api_key_id = trim((string)($_POST['nc_connection_api_key_id'] ?? ''));
+  $api_key_secret = trim((string)($_POST['nc_connection_api_key_secret'] ?? ''));
+  if (($api_key_id === '') !== ($api_key_secret === ''))
+  {
+    throw new RuntimeException('API-Schluessel-ID und API-Geheimnis muessen entweder beide vorhanden oder beide leer sein.');
+  }
+  if (($validated_pending_api || (!$wizard_auth_present && $fallback_user === '')) && $api_key_id === '')
+  {
+    $legacy_api = bratonien_tools_nc_api_credentials();
+    $api_key_id = trim((string)($legacy_api['key_id'] ?? ''));
+    $api_key_secret = trim((string)($legacy_api['key_secret'] ?? ''));
+  }
+  if ($api_key_id === '' && $fallback_user === '')
+  {
+    throw new RuntimeException('Fuer diese Verbindung ist weder ein eigener gepruefter API-Zugang noch ein Benutzername/Passwort-Fallback vorhanden.');
   }
 
   $port = (int)($_POST['nc_port'] ?? 5432);
-  if ($port < 1 || $port > 65535)
-  {
-    throw new RuntimeException('Ungueltiger PostgreSQL-Port.');
-  }
+  if ($port < 1 || $port > 65535) throw new RuntimeException('Ungueltiger PostgreSQL-Port.');
 
   $gallery_root = rtrim(trim((string)$_POST['nc_gallery_root']), '/');
-  if ($gallery_root === '' || $gallery_root[0] !== '/')
+  if (strpos($gallery_root, './') === 0)
   {
-    throw new RuntimeException('Der Galerie-Pfad muss ein absoluter Pfad sein.');
+    $piwigo_root = realpath(PHPWG_ROOT_PATH);
+    if ($piwigo_root === false) throw new RuntimeException('Piwigo-Stammverzeichnis konnte nicht aufgeloest werden.');
+    $gallery_root = rtrim($piwigo_root, '/').'/'.ltrim(substr($gallery_root, 2), '/');
   }
+  if ($gallery_root === '' || $gallery_root[0] !== '/') throw new RuntimeException('Der Galerie-Pfad muss ein absoluter Pfad sein.');
 
   $config = array(
-    'host' => trim((string)$_POST['nc_host']),
-    'port' => (string)$port,
-    'database' => trim((string)$_POST['nc_database']),
-    'user' => trim((string)$_POST['nc_user']),
-    'source_view' => trim((string)$_POST['nc_source_view']),
-    'activity_view' => trim((string)$_POST['nc_activity_view']),
-    'gallery_root' => $gallery_root,
-    'state_dir' => '',
-    'status_file' => '',
-    'quiet_seconds' => max(0, (int)($_POST['nc_quiet_seconds'] ?? 120)),
-    'max_wait_seconds' => max(60, (int)($_POST['nc_max_wait_seconds'] ?? 900)),
-    'full_sync_seconds' => max(300, (int)($_POST['nc_full_sync_seconds'] ?? 86400)),
-    'storages' => bratonien_tools_nc_connector_parse_storages($_POST['nc_storages'] ?? ''),
-    'origin' => 'native',
-    'piwigo_auth' => 'api-first',
+    'host'=>trim((string)$_POST['nc_host']),
+    'port'=>(string)$port,
+    'database'=>trim((string)$_POST['nc_database']),
+    'user'=>trim((string)$_POST['nc_user']),
+    'source_view'=>trim((string)$_POST['nc_source_view']),
+    'activity_view'=>trim((string)$_POST['nc_activity_view']),
+    'gallery_root'=>$gallery_root,
+    'state_dir'=>'','status_file'=>'',
+    'quiet_seconds'=>max(0,(int)($_POST['nc_quiet_seconds'] ?? 120)),
+    'max_wait_seconds'=>max(60,(int)($_POST['nc_max_wait_seconds'] ?? 900)),
+    'full_sync_seconds'=>max(300,(int)($_POST['nc_full_sync_seconds'] ?? 86400)),
+    'storages'=>bratonien_tools_nc_connector_parse_storages($_POST['nc_storages'] ?? ''),
+    'origin'=>'native',
+    'piwigo_auth'=>'connection-scoped',
+    'api_enabled'=>$api_key_id !== '',
   );
-
+  foreach (array('nextcloud_url'=>'nc_nextcloud_url','showcase_user'=>'nc_showcase_user','nextcloud_access_user'=>'nc_access_user','nextcloud_product'=>'nc_product','nextcloud_version'=>'nc_version') as $config_key=>$post_key)
+  {
+    $value=trim((string)($_POST[$post_key] ?? '')); if($value!=='') $config[$config_key]=$value;
+  }
   bratonien_tools_nc_connector_view_name($config['source_view']);
   bratonien_tools_nc_connector_view_name($config['activity_view']);
 
-  $table = bratonien_tools_nc_connector_table();
-  bratonien_tools_nc_connector_ensure_table();
-  $now = date('Y-m-d H:i:s');
-  $connection_key = 'local-'.bin2hex(random_bytes(12));
-  $secret_blob = bratonien_tools_nc_connector_encrypt_credentials(
-    (string)$_POST['nc_db_password'],
-    $fallback_user,
-    $fallback_password
-  );
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  if (!is_string($config_json))
+  $secret_payload = json_encode(array(
+    'v'=>3,
+    'db_password'=>(string)$_POST['nc_db_password'],
+    'piwigo_user'=>$fallback_user,
+    'piwigo_password'=>$fallback_password,
+    'api_key_id'=>$api_key_id,
+    'api_key_secret'=>$api_key_secret,
+    'nextcloud_user'=>$nextcloud_user,
+    'nextcloud_password'=>$nextcloud_password,
+  ), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($secret_payload)) throw new RuntimeException('Connector-Zugangsdaten konnten nicht serialisiert werden.');
+  $secret_blob = bratonien_tools_nc_connector_encrypt_secret($secret_payload);
+
+  $table=bratonien_tools_nc_connector_table(); bratonien_tools_nc_connector_ensure_table(); $now=date('Y-m-d H:i:s');
+  $connection_key='local-'.bin2hex(random_bytes(12));
+  $config_json=json_encode($config,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);
+  if(!is_string($config_json)) throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
+
+  pwg_query("INSERT INTO `$table` (connection_key, name, adapter, enabled, takeover_state, config_json, secret_blob, created, updated) VALUES ('".pwg_db_real_escape_string($connection_key)."','".pwg_db_real_escape_string(trim((string)$_POST['nc_name']))."','local',0,'disabled','".pwg_db_real_escape_string($config_json)."','".pwg_db_real_escape_string($secret_blob)."','".pwg_db_real_escape_string($now)."','".pwg_db_real_escape_string($now)."')");
+  $id=(int)pwg_db_insert_id();
+  if($id<1) throw new RuntimeException('Die Connector-Verbindung konnte nicht eindeutig angelegt werden.');
+  $config['state_dir']='/var/lib/bratonien-tools/nc-connector/connection-'.$id;
+  $config['status_file']=$config['state_dir'].'/connector-status.json';
+  $config_json=json_encode($config,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);
+  if(!is_string($config_json))
   {
-    throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
+    pwg_query("DELETE FROM `$table` WHERE id=".$id." LIMIT 1");
+    throw new RuntimeException('Connector-Konfiguration konnte nach dem Anlegen nicht serialisiert werden.');
   }
-
-  pwg_query("INSERT INTO `$table`
-    (connection_key, name, adapter, enabled, takeover_state, config_json, secret_blob, created, updated)
-    VALUES ('".pwg_db_real_escape_string($connection_key)."',
-      '".pwg_db_real_escape_string(trim((string)$_POST['nc_name']))."',
-      'local', 0, 'disabled',
-      '".pwg_db_real_escape_string($config_json)."',
-      '".pwg_db_real_escape_string($secret_blob)."',
-      '".pwg_db_real_escape_string($now)."',
-      '".pwg_db_real_escape_string($now)."')");
-
-  $id = (int)pwg_db_insert_id();
-  $config['state_dir'] = '/var/lib/bratonien-tools/nc-connector/connection-'.$id;
-  $config['status_file'] = $config['state_dir'].'/connector-status.json';
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
   pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$id);
 
   return array(
-    'message' => $fallback_user === ''
-      ? 'Nextcloud-Verbindung wurde API-first ohne dauerhaft gespeicherten Benutzername/Passwort-Fallback angelegt. Bitte technisch pruefen und danach im LXC aktivieren.'
-      : 'Nextcloud-Verbindung wurde API-first mit verschluesseltem Benutzername/Passwort-Fallback angelegt. Bitte technisch pruefen und danach im LXC aktivieren.'
+    'connection_id'=>$id,
+    'message'=>'Nextcloud-Verbindung wurde mit verbindungseigener Piwigo-Authentifizierung angelegt.'
   );
 }

include/nc_connector_delete_safe.inc.php

@@ -0,0 +1,123 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_connector_webdav_site_id(array $connection)
+{
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  if ((string)($connection['adapter'] ?? '') !== 'remote') return 0;
+  if ((string)($config['source_mode'] ?? '') !== 'webdav-placeholder') return 0;
+
+  $gallery_root = rtrim((string)($config['parallel_gallery_root'] ?? ''), '/');
+  $piwigo_root = rtrim(PHPWG_ROOT_PATH, '/');
+  if ($gallery_root === '' || strpos($gallery_root, $piwigo_root.'/') !== 0) return 0;
+
+  $relative = ltrim(substr($gallery_root, strlen($piwigo_root)), '/');
+  if ($relative === '') return 0;
+  $site_url = './'.rtrim($relative, '/').'/';
+
+  $result = pwg_query(
+    "SELECT id FROM ".SITES_TABLE.
+    " WHERE galleries_url='".pwg_db_real_escape_string($site_url)."' LIMIT 1"
+  );
+  if (!pwg_db_num_rows($result)) return 0;
+
+  $row = pwg_db_fetch_assoc($result);
+  return (int)$row['id'];
+}
+
+function bratonien_tools_nc_connector_remove_webdav_piwigo_content(array $connection)
+{
+  $site_id = bratonien_tools_nc_connector_webdav_site_id($connection);
+  if ($site_id < 1) return array('site_id'=>0, 'images'=>0);
+
+  include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
+
+  $image_rows = array();
+  $query = '\nSELECT DISTINCT i.id, i.path, i.representative_ext\n  FROM '.IMAGES_TABLE.' AS i\n  LEFT JOIN '.CATEGORIES_TABLE.' AS sc ON sc.id = i.storage_category_id\n  LEFT JOIN '.IMAGE_CATEGORY_TABLE.' AS ic ON ic.image_id = i.id\n  LEFT JOIN '.CATEGORIES_TABLE.' AS vc ON vc.id = ic.category_id\n  WHERE sc.site_id = '.$site_id.' OR vc.site_id = '.$site_id.'\n;';
+  $result = pwg_query($query);
+  while ($row = pwg_db_fetch_assoc($result))
+  {
+    $row['id'] = (int)$row['id'];
+    $image_rows[$row['id']] = $row;
+  }
+
+  foreach ($image_rows as $row)
+  {
+    try
+    {
+      delete_element_derivatives($row);
+    }
+    catch (Throwable $e)
+    {
+      error_log('Bratonien WebDAV delete derivative cleanup #'.(int)$row['id'].': '.$e->getMessage());
+    }
+  }
+
+  delete_site($site_id);
+
+  if ($image_rows)
+  {
+    $ids = array_keys($image_rows);
+    $remaining = query2array(
+      'SELECT id FROM '.IMAGES_TABLE.' WHERE id IN ('.implode(',', array_map('intval', $ids)).')',
+      null,
+      'id'
+    );
+    if ($remaining)
+    {
+      delete_elements(array_map('intval', $remaining), false);
+    }
+  }
+
+  invalidate_user_cache(true);
+  return array('site_id'=>$site_id, 'images'=>count($image_rows));
+}
+
+/**
+ * Delete exactly the connection selected by the user.
+ * No other connector record is implicitly removed.
+ */
+function bratonien_tools_nc_connector_delete_safe()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, false);
+  if (!$connection)
+  {
+    throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+  }
+
+  $cleanup = array('site_id'=>0, 'images'=>0);
+  if (
+    (string)($connection['adapter'] ?? '') === 'remote'
+    && (string)($connection['config']['source_mode'] ?? '') === 'webdav-placeholder'
+  )
+  {
+    $cleanup = bratonien_tools_nc_connector_remove_webdav_piwigo_content($connection);
+  }
+
+  $table = bratonien_tools_nc_connector_table();
+  pwg_query("DELETE FROM `$table` WHERE id=".$id." LIMIT 1");
+
+  $status_dir = rtrim(PHPWG_ROOT_PATH, '/').'/_data/bratonien-tools/nc-connector-status';
+  $public_status = $status_dir.'/connection-'.$id.'.json';
+  if (is_file($public_status)) @unlink($public_status);
+
+  if (is_dir($status_dir) || @mkdir($status_dir, 0755, true))
+  {
+    @file_put_contents($status_dir.'/deleted-'.$id, date('c')."\n", LOCK_EX);
+  }
+
+  if ((int)$cleanup['site_id'] > 0)
+  {
+    return array(
+      'message'=>'Verbindung wurde gelöscht. Die zugehörigen Piwigo-Alben und '.(int)$cleanup['images'].' Bilder wurden aus Piwigo entfernt. Nextcloud-Dateien blieben unverändert.',
+    );
+  }
+
+  return array(
+    'message'=>'Verbindung wurde gelöscht. Verbliebene Laufzeitdaten werden automatisch bereinigt. Quelldateien blieben unverändert.',
+  );
+}

include/nc_connector_edit.inc.php

@@ -0,0 +1,348 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_connector_migration_state(array $connection)
+{
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+  $missing = array();
+
+  if (trim((string)($config['nextcloud_url'] ?? '')) === '') $missing[] = 'Nextcloud-Adresse';
+  if (trim((string)($credentials['nextcloud_user'] ?? '')) === '') $missing[] = 'Nextcloud-Benutzer';
+  if ((string)($credentials['nextcloud_password'] ?? '') === '') $missing[] = 'Nextcloud-Passwort';
+
+  $api_id = trim((string)($credentials['api_key_id'] ?? ''));
+  $api_secret = trim((string)($credentials['api_key_secret'] ?? ''));
+  $fallback_user = trim((string)($credentials['piwigo_user'] ?? ''));
+  $fallback_password = (string)($credentials['piwigo_password'] ?? '');
+  $api_complete = $api_id !== '' && $api_secret !== '';
+  $fallback_complete = $fallback_user !== '' && $fallback_password !== '';
+
+  if (($api_id === '') !== ($api_secret === '')) $missing[] = 'vollstaendiger Piwigo-API-Zugang';
+  if (!$api_complete && !$fallback_complete) $missing[] = 'Piwigo-API oder Benutzer/Passwort-Fallback';
+
+  return array(
+    'ready'=>!$missing,
+    'missing'=>$missing,
+    'api_available'=>$api_complete,
+    'fallback_available'=>$fallback_complete,
+  );
+}
+
+function bratonien_tools_nc_connector_validate_nextcloud_access($base_url, $username, $password)
+{
+  $base_url = bratonien_tools_nc_wizard_normalize_url($base_url);
+  $username = trim((string)$username);
+  $password = (string)$password;
+  if ($username === '' || $password === '') throw new RuntimeException('Nextcloud-Benutzer und Passwort werden benoetigt.');
+
+  $status_response = bratonien_tools_nc_wizard_http($base_url.'/status.php');
+  if ($status_response['status'] < 200 || $status_response['status'] >= 300)
+  {
+    throw new RuntimeException('Die Nextcloud-Adresse konnte nicht bestaetigt werden.');
+  }
+  $status = json_decode((string)$status_response['body'], true);
+  if (!is_array($status) || empty($status['installed']))
+  {
+    throw new RuntimeException('Unter dieser Adresse wurde keine installierte Nextcloud erkannt.');
+  }
+
+  $user_response = bratonien_tools_nc_wizard_http(
+    $base_url.'/ocs/v2.php/cloud/user?format=json',
+    $username,
+    $password,
+    array('OCS-APIRequest: true')
+  );
+  if ($user_response['status'] === 401 || $user_response['status'] === 403)
+  {
+    throw new RuntimeException('Nextcloud hat Benutzername oder Passwort abgelehnt.');
+  }
+  if ($user_response['status'] < 200 || $user_response['status'] >= 300)
+  {
+    throw new RuntimeException('Nextcloud ist erreichbar, aber der Benutzerzugang konnte nicht geprueft werden.');
+  }
+  $user_data = bratonien_tools_nc_wizard_ocs_data($user_response['body']);
+  $resolved = trim((string)($user_data['id'] ?? $username));
+
+  return array(
+    'base_url'=>$base_url,
+    'username'=>$resolved !== '' ? $resolved : $username,
+  );
+}
+
+function bratonien_tools_nc_connector_validate_scoped_api($api_key_id, $api_key_secret)
+{
+  $api_key_id = trim((string)$api_key_id);
+  $api_key_secret = trim((string)$api_key_secret);
+  if ($api_key_id === '' || $api_key_secret === '')
+  {
+    throw new RuntimeException('Piwigo-API-Schluessel-ID und API-Geheimnis werden benoetigt.');
+  }
+
+  $status = bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, 'pwg.session.getStatus');
+  if (!is_array($status)) throw new RuntimeException('Piwigo hat keinen auswertbaren API-Benutzerstatus geliefert.');
+  $role = strtolower(trim((string)($status['status'] ?? '')));
+  if (!in_array($role, array('admin','webmaster'), true))
+  {
+    throw new RuntimeException('Der API-Key funktioniert, gehoert aber keinem Piwigo-Administrator/Webmaster.');
+  }
+
+  $method_result = bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, 'reflection.getMethodList');
+  $method_map = array();
+  bratonien_tools_nc_connector_collect_method_names($method_result, $method_map);
+  $required = array('bratonien.nc.syncProductive', 'bratonien.nc.syncOrphans');
+  $missing = array_values(array_diff($required, array_keys($method_map)));
+  if ($missing)
+  {
+    throw new RuntimeException('Der API-Key ist gueltig, aber benoetigte Bratonien-Sync-Methoden fehlen: '.implode(', ', $missing).'.');
+  }
+}
+
+function bratonien_tools_nc_connector_prepare_webdav_wizard_from_connection(array $connection, $mode)
+{
+  $id = (int)$connection['id'];
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+
+  $base_url = trim((string)($config['nextcloud_url'] ?? ''));
+  $username = trim((string)($credentials['nextcloud_user'] ?? ''));
+  if ($username === '')
+  {
+    $username = trim((string)($config['nextcloud_access_user'] ?? $config['access_user'] ?? ''));
+  }
+  $password = (string)($credentials['nextcloud_password'] ?? '');
+
+  $roots = isset($config['roots']) && is_array($config['roots']) ? array_values($config['roots']) : array();
+  $selected = array();
+  $selected_ids = array();
+  foreach ($roots as $root)
+  {
+    $path = trim((string)($root['webdav_path'] ?? ''), '/');
+    $fileid = (int)($root['fileid'] ?? 0);
+    if ($fileid < 1) continue;
+    $selected[] = $path;
+    $selected_ids[$path] = $fileid;
+  }
+
+  $state = bratonien_tools_nc_wizard_state();
+  $state = array_merge($state, array(
+    'editing_connection_id'=>$id,
+    'editing_adapter'=>(string)$connection['adapter'],
+    'editing_mode'=>(string)$mode,
+    'connection_name'=>(string)$connection['name'],
+    'host_input'=>$base_url,
+    'base_url'=>$base_url,
+    'username'=>$username,
+    '_password'=>$password,
+    '_fallback_user'=>(string)($credentials['piwigo_user'] ?? ''),
+    '_fallback_password'=>(string)($credentials['piwigo_password'] ?? ''),
+    '_api_key_id'=>(string)($credentials['api_key_id'] ?? ''),
+    '_api_key_secret'=>(string)($credentials['api_key_secret'] ?? ''),
+    'api_status'=>trim((string)($credentials['api_key_id'] ?? '')) !== '' && trim((string)($credentials['api_key_secret'] ?? '')) !== '' ? 'ok' : 'pending',
+    'roots'=>$roots,
+    'directory_selected'=>$selected,
+    'directory_selected_fileids'=>$selected_ids,
+    'source_mode'=>'webdav-placeholder',
+    'transport'=>'webdav',
+  ));
+
+  if ($base_url !== '' && $username !== '' && $password !== '')
+  {
+    $state['step'] = 2;
+    $state['scan_ok'] = true;
+    $state['technical_stage'] = 'mounts';
+    $state['technical_source'] = 'WebDAV';
+    $state['technical_error'] = '';
+    $state['technical_complete'] = false;
+    $state['directory_selection_ready'] = true;
+    $state['directory_path'] = '';
+    $state['directory_parent'] = '';
+    $state['directory_children'] = array();
+    $state['directory_current_fileid'] = 0;
+
+    try
+    {
+      bratonien_tools_nc_wizard_refresh_directory_state($state, '');
+    }
+    catch (Throwable $e)
+    {
+      $state['step'] = 1;
+      $state['scan_ok'] = false;
+      $state['technical_error'] = $e->getMessage();
+    }
+  }
+  else
+  {
+    $state['step'] = 1;
+    $state['scan_ok'] = false;
+  }
+
+  bratonien_tools_nc_wizard_store($state);
+}
+
+function bratonien_tools_nc_connector_edit_start()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $is_webdav = (string)$connection['adapter'] === 'remote'
+    && (string)($config['source_mode'] ?? '') === 'webdav-placeholder';
+  if (!$is_webdav)
+  {
+    throw new RuntimeException('Diese Legacy-Verbindung wird direkt bearbeitet. Eine WebDAV-Migration ist eine separate Aktion.');
+  }
+
+  bratonien_tools_nc_connector_prepare_webdav_wizard_from_connection($connection, 'update');
+  return array('message'=>'Verbindung #'.$id.' wurde zum Bearbeiten geoeffnet.');
+}
+
+function bratonien_tools_nc_connector_migrate_start()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+  if ((string)$connection['adapter'] !== 'local')
+  {
+    throw new RuntimeException('Nur eine Legacy-Verbindung kann auf WebDAV migriert werden.');
+  }
+
+  $migration = bratonien_tools_nc_connector_migration_state($connection);
+  if (empty($migration['ready']))
+  {
+    throw new RuntimeException('Die WebDAV-Migration ist noch nicht bereit. Unter Bearbeiten fehlen: '.implode(', ', $migration['missing']).'.');
+  }
+
+  bratonien_tools_nc_connector_prepare_webdav_wizard_from_connection($connection, 'migrate');
+  return array('message'=>'Die WebDAV-Migration fuer Verbindung #'.$id.' wurde geoeffnet. Die bestehende Legacy-Verbindung bleibt bis zum erfolgreichen Umstieg unveraendert.');
+}
+
+function bratonien_tools_nc_connector_update_local_friendly()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+  if ((string)$connection['adapter'] !== 'local') throw new RuntimeException('Diese Bearbeitung ist nur fuer Legacy-Verbindungen vorgesehen.');
+
+  $name = trim((string)($_POST['connection_name'] ?? ''));
+  if ($name === '') throw new RuntimeException('Bitte einen Namen fuer die Verbindung angeben.');
+
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $host = trim((string)($_POST['nc_host'] ?? ''));
+  $port = (int)($_POST['nc_port'] ?? 5432);
+  $database = trim((string)($_POST['nc_database'] ?? ''));
+  $user = trim((string)($_POST['nc_user'] ?? ''));
+  $gallery_root = rtrim(trim((string)($_POST['nc_gallery_root'] ?? '')), '/');
+  $source_view = trim((string)($_POST['nc_source_view'] ?? ''));
+  $activity_view = trim((string)($_POST['nc_activity_view'] ?? ''));
+
+  if ($host === '') throw new RuntimeException('Datenbank-Server fehlt.');
+  if ($port < 1 || $port > 65535) throw new RuntimeException('Der Datenbank-Port ist ungueltig.');
+  if ($database === '') throw new RuntimeException('Datenbankname fehlt.');
+  if ($user === '') throw new RuntimeException('Reader-Benutzer fehlt.');
+  if ($gallery_root === '' || $gallery_root[0] !== '/') throw new RuntimeException('Der Piwigo-Galerieordner muss ein absoluter Pfad sein.');
+  if ($source_view === '' || $activity_view === '') throw new RuntimeException('Die gespeicherten Datenbankansichten duerfen nicht leer sein.');
+  bratonien_tools_nc_connector_view_name($source_view);
+  bratonien_tools_nc_connector_view_name($activity_view);
+
+  $storage_ids = isset($_POST['nc_storage_id']) && is_array($_POST['nc_storage_id']) ? $_POST['nc_storage_id'] : array();
+  $storage_prefixes = isset($_POST['nc_source_prefix']) && is_array($_POST['nc_source_prefix']) ? $_POST['nc_source_prefix'] : array();
+  $storage_mounts = isset($_POST['nc_local_mount']) && is_array($_POST['nc_local_mount']) ? $_POST['nc_local_mount'] : array();
+  $storages = array();
+  $count = max(count($storage_ids), count($storage_prefixes), count($storage_mounts));
+  for ($index = 0; $index < $count; $index++)
+  {
+    $storage_id = trim((string)($storage_ids[$index] ?? ''));
+    $prefix = trim((string)($storage_prefixes[$index] ?? ''), '/');
+    $mount = rtrim(trim((string)($storage_mounts[$index] ?? '')), '/');
+    if ($storage_id === '' && $prefix === '' && $mount === '') continue;
+    if ($storage_id === '') throw new RuntimeException('Bei einem Speicherort fehlt die Storage-ID.');
+    if ($mount === '' || $mount[0] !== '/') throw new RuntimeException('Bei einem Speicherort fehlt ein gueltiger lokaler Pfad.');
+    $storages[] = array('storage_id'=>$storage_id, 'source_prefix'=>$prefix, 'local_mount'=>$mount);
+  }
+  if (!$storages) throw new RuntimeException('Mindestens ein Speicherort muss vorhanden sein.');
+
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+  $new_db_password = (string)($_POST['nc_db_password'] ?? '');
+  if ($new_db_password !== '') $credentials['db_password'] = $new_db_password;
+  if (trim((string)($credentials['db_password'] ?? '')) === '') throw new RuntimeException('Fuer die Legacy-Verbindung ist kein Datenbankpasswort gespeichert.');
+
+  $nextcloud_url = trim((string)($_POST['nc_nextcloud_url'] ?? ($config['nextcloud_url'] ?? '')));
+  $nextcloud_user = trim((string)($_POST['nc_nextcloud_user'] ?? ($credentials['nextcloud_user'] ?? '')));
+  $new_nextcloud_password = (string)($_POST['nc_nextcloud_password'] ?? '');
+  if ($new_nextcloud_password !== '') $credentials['nextcloud_password'] = $new_nextcloud_password;
+  $nextcloud_password = (string)($credentials['nextcloud_password'] ?? '');
+
+  $api_key_id = trim((string)($_POST['nc_connection_api_key_id'] ?? ($credentials['api_key_id'] ?? '')));
+  $new_api_secret = trim((string)($_POST['nc_connection_api_key_secret'] ?? ''));
+  $old_api_id = trim((string)($credentials['api_key_id'] ?? ''));
+  if ($api_key_id !== $old_api_id && $new_api_secret === '')
+  {
+    throw new RuntimeException('Wenn die API-Schluessel-ID geaendert wird, muss auch das API-Geheimnis neu eingegeben werden.');
+  }
+  if ($new_api_secret !== '') $credentials['api_key_secret'] = $new_api_secret;
+  $api_key_secret = trim((string)($credentials['api_key_secret'] ?? ''));
+
+  if (($nextcloud_url === '' || $nextcloud_user === '' || $nextcloud_password === '') && ($nextcloud_url !== '' || $nextcloud_user !== '' || $nextcloud_password !== ''))
+  {
+    throw new RuntimeException('Nextcloud-Adresse, Nextcloud-Benutzer und Nextcloud-Passwort muessen fuer WebDAV gemeinsam vollstaendig sein.');
+  }
+  if (($api_key_id === '') !== ($api_key_secret === ''))
+  {
+    throw new RuntimeException('Piwigo-API-Schluessel-ID und API-Geheimnis muessen gemeinsam vollstaendig sein.');
+  }
+
+  if ($nextcloud_url !== '')
+  {
+    $validated_nc = bratonien_tools_nc_connector_validate_nextcloud_access($nextcloud_url, $nextcloud_user, $nextcloud_password);
+    $nextcloud_url = $validated_nc['base_url'];
+    $nextcloud_user = $validated_nc['username'];
+    $credentials['nextcloud_user'] = $nextcloud_user;
+  }
+  if ($api_key_id !== '')
+  {
+    bratonien_tools_nc_connector_validate_scoped_api($api_key_id, $api_key_secret);
+    $credentials['api_key_id'] = $api_key_id;
+  }
+
+  $config['host'] = $host;
+  $config['port'] = (string)$port;
+  $config['database'] = $database;
+  $config['user'] = $user;
+  $config['source_view'] = $source_view;
+  $config['activity_view'] = $activity_view;
+  $config['gallery_root'] = $gallery_root;
+  $config['quiet_seconds'] = max(0, (int)($_POST['nc_quiet_seconds'] ?? ($config['quiet_seconds'] ?? 120)));
+  $config['max_wait_seconds'] = max(60, (int)($_POST['nc_max_wait_seconds'] ?? ($config['max_wait_seconds'] ?? 900)));
+  $config['full_sync_seconds'] = max(300, (int)($_POST['nc_full_sync_seconds'] ?? ($config['full_sync_seconds'] ?? 86400)));
+  $config['storages'] = $storages;
+  if ($nextcloud_url !== '')
+  {
+    $config['nextcloud_url'] = $nextcloud_url;
+    $config['access_user'] = $nextcloud_user;
+    $config['nextcloud_access_user'] = $nextcloud_user;
+  }
+  $config['piwigo_auth'] = 'connection-scoped';
+  $config['api_enabled'] = $api_key_id !== '' && $api_key_secret !== '';
+  unset($config['verification']);
+
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
+  $secret_payload = json_encode($credentials, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($secret_payload)) throw new RuntimeException('Connector-Zugangsdaten konnten nicht serialisiert werden.');
+  $secret_blob = bratonien_tools_nc_connector_encrypt_secret($secret_payload);
+
+  $table = bratonien_tools_nc_connector_table();
+  $now = date('Y-m-d H:i:s');
+  pwg_query("UPDATE `$table` SET name='".pwg_db_real_escape_string($name)."', config_json='".pwg_db_real_escape_string($config_json)."', secret_blob='".pwg_db_real_escape_string($secret_blob)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".$id." LIMIT 1");
+
+  $updated = bratonien_tools_nc_connector_connection($id, true);
+  $migration = $updated ? bratonien_tools_nc_connector_migration_state($updated) : array('ready'=>false);
+  return array(
+    'message'=>'Verbindung #'.$id.' wurde gespeichert. '.(!empty($migration['ready']) ? 'Die WebDAV-Migration ist jetzt bereit.' : 'Die WebDAV-Migration ist noch nicht vollstaendig vorbereitet.'),
+  );
+}

include/nc_connector_generic_scope.inc.php

@@ -0,0 +1,101 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_finish_generic_scope()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)($state['step'] ?? 0) !== 4 || empty($state['technical_complete']) || trim((string)($state['username'] ?? '')) === '')
+  {
+    throw new RuntimeException('Der Assistent ist noch nicht vollständig.');
+  }
+
+  $roots = isset($state['roots']) && is_array($state['roots']) ? $state['roots'] : array();
+  $storages = isset($state['storages']) && is_array($state['storages']) ? $state['storages'] : array();
+  if (!$roots) throw new RuntimeException('Es wurden keine Nextcloud-Quellen ausgewählt.');
+  if (!$storages) throw new RuntimeException('Es wurden keine Storage-Adapter zugeordnet.');
+
+  if (array_key_exists('nc_wizard_fallback_user', $_POST)) $state['_fallback_user'] = trim((string)$_POST['nc_wizard_fallback_user']);
+  if (array_key_exists('nc_wizard_fallback_password', $_POST)) $state['_fallback_password'] = (string)$_POST['nc_wizard_fallback_password'];
+  bratonien_tools_nc_wizard_store($state);
+
+  $fallback_user = trim((string)$state['_fallback_user']);
+  $fallback_password = (string)$state['_fallback_password'];
+  if (($fallback_user === '') !== ($fallback_password === '')) throw new RuntimeException('Fallback-Benutzer und Fallback-Passwort müssen entweder beide angegeben oder beide leer gelassen werden.');
+  if (($state['api_status'] ?? '') !== 'ok' && $fallback_user === '') throw new RuntimeException('Da die Piwigo-API übersprungen wurde, ist für diese Verbindung ein Fallback-Zugang erforderlich.');
+
+  $mapping_lines = array();
+  foreach ($storages as $storage)
+  {
+    $storage_id = trim((string)($storage['storage_id'] ?? ''));
+    $source_prefix = trim((string)($storage['source_prefix'] ?? ''), '/');
+    $local_mount = rtrim(trim((string)($storage['local_mount'] ?? '')), '/');
+    if ($storage_id === '' || $local_mount === '') throw new RuntimeException('Eine Storage-Zuordnung ist unvollständig.');
+    $key = $storage_id.'|'.$source_prefix.'|'.$local_mount;
+    $mapping_lines[$key] = $storage_id.' | '.$source_prefix.' | '.$local_mount;
+  }
+
+  $_POST['nc_name']=(string)$state['connection_name'];
+  $_POST['nc_host']=(string)$state['db_host'];
+  $_POST['nc_port']=(string)$state['db_port'];
+  $_POST['nc_database']=(string)$state['db_database'];
+  $_POST['nc_user']=(string)$state['db_user'];
+  $_POST['nc_db_password']=(string)$state['_db_password'];
+  $_POST['nc_source_view']='piwigo_connector_files';
+  $_POST['nc_activity_view']='piwigo_connector_activity';
+  $_POST['nc_gallery_root']=(string)$state['gallery_root'];
+  $_POST['nc_storages']=implode("\n", array_values($mapping_lines));
+  $_POST['nc_quiet_seconds']='120';
+  $_POST['nc_max_wait_seconds']='900';
+  $_POST['nc_full_sync_seconds']='86400';
+  $_POST['nc_piwigo_user']=$fallback_user;
+  $_POST['nc_piwigo_password']=$fallback_password;
+  $_POST['nc_nextcloud_url']=(string)$state['base_url'];
+  $_POST['nc_access_user']=(string)$state['username'];
+  $_POST['nc_nextcloud_user']=(string)$state['username'];
+  $_POST['nc_nextcloud_password']=(string)$state['_password'];
+  $_POST['nc_product']=(string)$state['product'];
+  $_POST['nc_version']=(string)$state['version'];
+  $_POST['nc_api_validated']=($state['api_status'] ?? '')==='ok'?'1':'0';
+  $_POST['nc_connection_api_key_id']=($state['api_status'] ?? '')==='ok'?(string)$state['_api_key_id']:'';
+  $_POST['nc_connection_api_key_secret']=($state['api_status'] ?? '')==='ok'?(string)$state['_api_key_secret']:'';
+
+  $result = bratonien_tools_nc_connector_create_local_api_first();
+  $connection_id = (int)($result['connection_id'] ?? 0);
+  if ($connection_id < 1) throw new RuntimeException('Die neue Verbindung konnte nicht gespeichert werden.');
+
+  $connection = bratonien_tools_nc_connector_connection($connection_id, false);
+  if (!$connection) throw new RuntimeException('Die neue Verbindung konnte nach dem Anlegen nicht gelesen werden.');
+  $config = is_array($connection['config'] ?? null) ? $connection['config'] : array();
+  $config['source_mode'] = 'selected-fileids';
+  $config['source_view'] = 'piwigo_connector_files';
+  $config['activity_view'] = 'piwigo_connector_activity';
+  $config['access_user'] = (string)$state['username'];
+  $config['nextcloud_access_user'] = (string)$state['username'];
+  $config['storages'] = array_values($storages);
+  $config['roots'] = array_values(array_map(function($root) {
+    return array(
+      'fileid'=>(int)($root['fileid'] ?? 0),
+      'display_name'=>(string)($root['display_name'] ?? ''),
+      'webdav_path'=>(string)($root['webdav_path'] ?? ''),
+    );
+  }, $roots));
+  unset($config['showcase_user']);
+
+  foreach ($config['roots'] as $root)
+  {
+    if ((int)$root['fileid'] < 1 || trim((string)$root['display_name']) === '') throw new RuntimeException('Eine ausgewählte Nextcloud-Quelle ist unvollständig.');
+  }
+
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Die Quellenkonfiguration konnte nicht serialisiert werden.');
+  $table = bratonien_tools_nc_connector_table();
+  pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$connection_id." LIMIT 1");
+
+  unset($_SESSION['bratonien_nc_wizard']);
+  unset($result['connection_id']);
+  $result['message'] = 'Verbindung wurde mit generischer Nextcloud-Quellenauswahl angelegt. '.$result['message'];
+  return $result;
+}

include/nc_connector_manage.inc.php

@@ -7,304 +7,101 @@ if (!defined('PHPWG_ROOT_PATH'))
 function bratonien_tools_nc_connector_credentials_from_blob($blob)
 {
   $plain = bratonien_tools_nc_connector_decrypt_secret($blob);
-  if ($plain === '')
-  {
-    return array('db_password'=>'', 'piwigo_user'=>'', 'piwigo_password'=>'');
-  }
-
+  if ($plain === '') return array('db_password'=>'', 'piwigo_user'=>'', 'piwigo_password'=>'');
   $decoded = json_decode($plain, true);
   if (is_array($decoded) && isset($decoded['db_password']))
   {
     return array(
-      'db_password' => (string)($decoded['db_password'] ?? ''),
-      'piwigo_user' => (string)($decoded['piwigo_user'] ?? ''),
-      'piwigo_password' => (string)($decoded['piwigo_password'] ?? ''),
+      'db_password'=>(string)($decoded['db_password'] ?? ''),
+      'piwigo_user'=>(string)($decoded['piwigo_user'] ?? ''),
+      'piwigo_password'=>(string)($decoded['piwigo_password'] ?? ''),
     );
   }
-
-  // Backwards compatibility for migrated 0.14.x connections.
   return array('db_password'=>$plain, 'piwigo_user'=>'', 'piwigo_password'=>'');
 }
 
 function bratonien_tools_nc_connector_encrypt_credentials($db_password, $piwigo_user, $piwigo_password)
 {
-  $payload = json_encode(array(
-    'v' => 1,
-    'db_password' => (string)$db_password,
-    'piwigo_user' => (string)$piwigo_user,
-    'piwigo_password' => (string)$piwigo_password,
-  ), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-
-  if (!is_string($payload))
-  {
-    throw new RuntimeException('Connector-Zugangsdaten konnten nicht serialisiert werden.');
-  }
-
+  $payload=json_encode(array('v'=>1,'db_password'=>(string)$db_password,'piwigo_user'=>(string)$piwigo_user,'piwigo_password'=>(string)$piwigo_password),JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);
+  if(!is_string($payload)) throw new RuntimeException('Connector-Zugangsdaten konnten nicht serialisiert werden.');
   return bratonien_tools_nc_connector_encrypt_secret($payload);
 }
 
 function bratonien_tools_nc_connector_parse_storages($raw)
 {
-  $storages = array();
-  $lines = preg_split('/\r\n|\r|\n/', trim((string)$raw));
-  foreach ($lines as $line)
+  $storages=array();
+  $lines=preg_split('/\r\n|\r|\n/',trim((string)$raw));
+  foreach($lines as $line)
   {
-    $line = trim($line);
-    if ($line === '')
+    if(trim($line)==='') continue;
+    $parts=array_map('trim',explode('|',$line,3));
+    if(count($parts)!==3 || $parts[0]==='' || $parts[2]==='')
     {
-      continue;
+      throw new RuntimeException('Eine Speicherzuordnung ist unvollständig. Benötigt werden Storage-ID und lokaler Speicherpfad.');
     }
-    $parts = array_map('trim', explode('|', $line));
-    if (count($parts) !== 3 || $parts[0] === '' || $parts[1] === '' || $parts[2] === '')
-    {
-      throw new RuntimeException('Storage-Zeilen muessen das Format storage_id | source_prefix | local_mount verwenden.');
-    }
-    if ($parts[2][0] !== '/')
-    {
-      throw new RuntimeException('Der lokale Storage-Mount muss ein absoluter Pfad sein.');
-    }
-    $storages[] = array(
-      'storage_id' => $parts[0],
-      'source_prefix' => $parts[1],
-      'local_mount' => rtrim($parts[2], '/'),
+    if($parts[2][0]!=='/') throw new RuntimeException('Der lokale Speicherpfad muss ein absoluter Pfad sein.');
+    $storages[]=array(
+      'storage_id'=>$parts[0],
+      'source_prefix'=>trim($parts[1],'/'),
+      'local_mount'=>rtrim($parts[2],'/'),
     );
   }
-  if (!$storages)
-  {
-    throw new RuntimeException('Mindestens ein Storage muss konfiguriert werden.');
-  }
+  if(!$storages) throw new RuntimeException('Mindestens ein Speicherort muss zugeordnet werden.');
   return $storages;
 }
 
 function bratonien_tools_nc_connector_create_local()
 {
-  $required = array(
-    'nc_name' => 'Name',
-    'nc_host' => 'PostgreSQL-Host',
-    'nc_database' => 'Datenbank',
-    'nc_user' => 'Reader-Benutzer',
-    'nc_db_password' => 'Reader-Passwort',
-    'nc_source_view' => 'Source-View',
-    'nc_activity_view' => 'Activity-View',
-    'nc_gallery_root' => 'Galerie-Pfad',
-    'nc_piwigo_user' => 'Piwigo-Benutzer',
-    'nc_piwigo_password' => 'Piwigo-Passwort',
-  );
-
-  foreach ($required as $field => $label)
-  {
-    if (trim((string)($_POST[$field] ?? '')) === '')
-    {
-      throw new RuntimeException($label.' fehlt.');
-    }
-  }
-
-  $port = (int)($_POST['nc_port'] ?? 5432);
-  if ($port < 1 || $port > 65535)
-  {
-    throw new RuntimeException('Ungueltiger PostgreSQL-Port.');
-  }
-
-  $gallery_root = rtrim(trim((string)$_POST['nc_gallery_root']), '/');
-  if ($gallery_root === '' || $gallery_root[0] !== '/')
-  {
-    throw new RuntimeException('Der Galerie-Pfad muss ein absoluter Pfad sein.');
-  }
-
-  $config = array(
-    'host' => trim((string)$_POST['nc_host']),
-    'port' => (string)$port,
-    'database' => trim((string)$_POST['nc_database']),
-    'user' => trim((string)$_POST['nc_user']),
-    'source_view' => trim((string)$_POST['nc_source_view']),
-    'activity_view' => trim((string)$_POST['nc_activity_view']),
-    'gallery_root' => $gallery_root,
-    'state_dir' => '',
-    'status_file' => '',
-    'quiet_seconds' => max(0, (int)($_POST['nc_quiet_seconds'] ?? 120)),
-    'max_wait_seconds' => max(60, (int)($_POST['nc_max_wait_seconds'] ?? 900)),
-    'full_sync_seconds' => max(300, (int)($_POST['nc_full_sync_seconds'] ?? 86400)),
-    'storages' => bratonien_tools_nc_connector_parse_storages($_POST['nc_storages'] ?? ''),
-    'origin' => 'native',
-  );
-
-  bratonien_tools_nc_connector_view_name($config['source_view']);
-  bratonien_tools_nc_connector_view_name($config['activity_view']);
-
-  $table = bratonien_tools_nc_connector_table();
-  bratonien_tools_nc_connector_ensure_table();
-  $now = date('Y-m-d H:i:s');
-  $connection_key = 'local-'.bin2hex(random_bytes(12));
-  $secret_blob = bratonien_tools_nc_connector_encrypt_credentials(
-    (string)$_POST['nc_db_password'],
-    trim((string)$_POST['nc_piwigo_user']),
-    (string)$_POST['nc_piwigo_password']
-  );
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  if (!is_string($config_json))
-  {
-    throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
-  }
-
-  pwg_query("INSERT INTO `$table`
-    (connection_key, name, adapter, enabled, takeover_state, config_json, secret_blob, created, updated)
-    VALUES ('".pwg_db_real_escape_string($connection_key)."',
-      '".pwg_db_real_escape_string(trim((string)$_POST['nc_name']))."',
-      'local', 0, 'disabled',
-      '".pwg_db_real_escape_string($config_json)."',
-      '".pwg_db_real_escape_string($secret_blob)."',
-      '".pwg_db_real_escape_string($now)."',
-      '".pwg_db_real_escape_string($now)."')");
-
-  $id = (int)pwg_db_insert_id();
-  $config['state_dir'] = '/var/lib/bratonien-tools/nc-connector/connection-'.$id;
-  $config['status_file'] = $config['state_dir'].'/connector-status.json';
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$id);
-
+  $required=array('nc_name'=>'Name','nc_host'=>'PostgreSQL-Host','nc_database'=>'Datenbank','nc_user'=>'Reader-Benutzer','nc_db_password'=>'Reader-Passwort','nc_source_view'=>'Source-View','nc_activity_view'=>'Activity-View','nc_gallery_root'=>'Galerie-Pfad','nc_piwigo_user'=>'Piwigo-Benutzer','nc_piwigo_password'=>'Piwigo-Passwort');
+  foreach($required as $field=>$label)if(trim((string)($_POST[$field]??''))==='')throw new RuntimeException($label.' fehlt.');
+  $port=(int)($_POST['nc_port']??5432);if($port<1||$port>65535)throw new RuntimeException('Ungueltiger PostgreSQL-Port.');
+  $gallery_root=rtrim(trim((string)$_POST['nc_gallery_root']),'/');if($gallery_root===''||$gallery_root[0]!=='/')throw new RuntimeException('Der Galerie-Pfad muss ein absoluter Pfad sein.');
+  $config=array('host'=>trim((string)$_POST['nc_host']),'port'=>(string)$port,'database'=>trim((string)$_POST['nc_database']),'user'=>trim((string)$_POST['nc_user']),'source_view'=>trim((string)$_POST['nc_source_view']),'activity_view'=>trim((string)$_POST['nc_activity_view']),'gallery_root'=>$gallery_root,'state_dir'=>'','status_file'=>'','quiet_seconds'=>max(0,(int)($_POST['nc_quiet_seconds']??120)),'max_wait_seconds'=>max(60,(int)($_POST['nc_max_wait_seconds']??900)),'full_sync_seconds'=>max(300,(int)($_POST['nc_full_sync_seconds']??86400)),'storages'=>bratonien_tools_nc_connector_parse_storages($_POST['nc_storages']??''),'origin'=>'native');
+  bratonien_tools_nc_connector_view_name($config['source_view']);bratonien_tools_nc_connector_view_name($config['activity_view']);
+  $table=bratonien_tools_nc_connector_table();bratonien_tools_nc_connector_ensure_table();$now=date('Y-m-d H:i:s');$connection_key='local-'.bin2hex(random_bytes(12));$secret_blob=bratonien_tools_nc_connector_encrypt_credentials((string)$_POST['nc_db_password'],trim((string)$_POST['nc_piwigo_user']),(string)$_POST['nc_piwigo_password']);$config_json=json_encode($config,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);if(!is_string($config_json))throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
+  pwg_query("INSERT INTO `$table` (connection_key,name,adapter,enabled,takeover_state,config_json,secret_blob,created,updated) VALUES ('".pwg_db_real_escape_string($connection_key)."','".pwg_db_real_escape_string(trim((string)$_POST['nc_name']))."','local',0,'disabled','".pwg_db_real_escape_string($config_json)."','".pwg_db_real_escape_string($secret_blob)."','".pwg_db_real_escape_string($now)."','".pwg_db_real_escape_string($now)."')");
+  $id=(int)pwg_db_insert_id();$config['state_dir']='/var/lib/bratonien-tools/nc-connector/connection-'.$id;$config['status_file']=$config['state_dir'].'/connector-status.json';$config_json=json_encode($config,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$id);
   return array('message'=>'Nextcloud-Verbindung wurde angelegt. Bitte zuerst technisch pruefen und danach im LXC aktivieren.');
 }
 
 function bratonien_tools_nc_connector_verify_managed()
 {
-  $id = isset($_POST['connection_id']) ? (int)$_POST['connection_id'] : 0;
-  $connection = bratonien_tools_nc_connector_connection($id, true);
-  if (!$connection)
+  $id=isset($_POST['connection_id'])?(int)$_POST['connection_id']:0;$connection=bratonien_tools_nc_connector_connection($id,true);if(!$connection)throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');if((string)$connection['adapter']!=='local')throw new RuntimeException('Diese Verifikation ist derzeit nur fuer lokale Connector-Verbindungen verfuegbar.');
+  $config=$connection['config'];foreach(array('host','port','database','user','source_view','activity_view') as $key)if(trim((string)($config[$key]??''))==='')throw new RuntimeException('Connector-Konfiguration ist unvollstaendig: '.$key.' fehlt.');
+  $credentials=bratonien_tools_nc_connector_credentials_from_blob($connection['secret_blob']??'');if($credentials['db_password']==='')throw new RuntimeException('Fuer diese Verbindung ist kein Datenbankpasswort gespeichert.');
+  $checks=array();$ok=true;$source_count=null;
+  try{bratonien_tools_nc_connector_psql($config,$credentials['db_password'],'SELECT 1');$checks[]=array('name'=>'PostgreSQL-Verbindung','ok'=>true,'detail'=>'Reader-Anmeldung erfolgreich');}catch(Throwable $e){$checks[]=array('name'=>'PostgreSQL-Verbindung','ok'=>false,'detail'=>$e->getMessage());$ok=false;}
+  if($ok)
   {
-    throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
-  }
-  if ((string)$connection['adapter'] !== 'local')
-  {
-    throw new RuntimeException('Diese Verifikation ist derzeit nur fuer lokale Connector-Verbindungen verfuegbar.');
+    try{$source_view=bratonien_tools_nc_connector_view_name($config['source_view']);$value=bratonien_tools_nc_connector_psql($config,$credentials['db_password'],'SELECT COUNT(*) FROM '.$source_view);if(!preg_match('/^\d+$/',$value))throw new RuntimeException('Source-View lieferte keinen gueltigen Zaehler.');$source_count=(int)$value;$checks[]=array('name'=>'Source-View','ok'=>true,'detail'=>$source_count.' Quelle(n) lesbar');}catch(Throwable $e){$checks[]=array('name'=>'Source-View','ok'=>false,'detail'=>$e->getMessage());$ok=false;}
+    try{$activity_view=bratonien_tools_nc_connector_view_name($config['activity_view']);bratonien_tools_nc_connector_psql($config,$credentials['db_password'],'SELECT 1 FROM '.$activity_view.' LIMIT 1');$checks[]=array('name'=>'Activity-View','ok'=>true,'detail'=>'View lesbar');}catch(Throwable $e){$checks[]=array('name'=>'Activity-View','ok'=>false,'detail'=>$e->getMessage());$ok=false;}
   }
+  $storages=isset($config['storages'])&&is_array($config['storages'])?$config['storages']:array();$mount_points=bratonien_tools_nc_connector_mount_points();
+  if(!$storages){$checks[]=array('name'=>'Storage-Mounts','ok'=>false,'detail'=>'Keine Storage-Zuordnung gespeichert');$ok=false;}
+  else foreach($storages as $index=>$storage){$path=rtrim((string)($storage['local_mount']??''),'/');$exists=$path!==''&&is_dir($path);$readable=$exists&&is_readable($path);$mounted=$path!==''&&isset($mount_points[$path]);$storage_ok=$exists&&$readable&&$mounted;$storage_id=(string)($storage['storage_id']??('#'.($index+1)));$detail=$storage_id.' -> '.($path!==''?$path:'(kein Pfad)');if(!$exists)$detail.=' (Pfad fehlt)';elseif(!$readable)$detail.=' (nicht lesbar)';elseif(!$mounted)$detail.=' (kein aktiver Mount)';else$detail.=' (bereit)';$checks[]=array('name'=>'Storage '.($index+1),'ok'=>$storage_ok,'detail'=>$detail);if(!$storage_ok)$ok=false;}
+  $config['verification']=array('checked_at'=>date('Y-m-d H:i:s'),'ok'=>$ok,'source_count'=>$source_count,'checks'=>$checks);$table=bratonien_tools_nc_connector_table();$config_json=json_encode($config,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);if(!is_string($config_json))throw new RuntimeException('Verifikationsergebnis konnte nicht gespeichert werden.');$state=$ok?'verified':((string)$connection['takeover_state']==='disabled'?'disabled':'imported');$now=date('Y-m-d H:i:s');pwg_query("UPDATE `$table` SET takeover_state='".pwg_db_real_escape_string($state)."', enabled=0, config_json='".pwg_db_real_escape_string($config_json)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".$id);
+  if(!$ok)throw new RuntimeException('Connector-Verifikation ist fehlgeschlagen. Die Verbindung bleibt deaktiviert; Details stehen im NC Connector.');return array('message'=>'Connector-Verbindung wurde erfolgreich verifiziert. PostgreSQL, Views und Storage-Mounts sind erreichbar.');
+}
 
-  $config = $connection['config'];
-  foreach (array('host','port','database','user','source_view','activity_view') as $key)
-  {
-    if (trim((string)($config[$key] ?? '')) === '')
-    {
-      throw new RuntimeException('Connector-Konfiguration ist unvollstaendig: '.$key.' fehlt.');
-    }
-  }
-
-  $credentials = bratonien_tools_nc_connector_credentials_from_blob($connection['secret_blob'] ?? '');
-  if ($credentials['db_password'] === '')
-  {
-    throw new RuntimeException('Fuer diese Verbindung ist kein Datenbankpasswort gespeichert.');
-  }
-
-  $checks = array();
-  $ok = true;
-  $source_count = null;
-
-  try
-  {
-    bratonien_tools_nc_connector_psql($config, $credentials['db_password'], 'SELECT 1');
-    $checks[] = array('name'=>'PostgreSQL-Verbindung', 'ok'=>true, 'detail'=>'Reader-Anmeldung erfolgreich');
-  }
-  catch (Throwable $e)
-  {
-    $checks[] = array('name'=>'PostgreSQL-Verbindung', 'ok'=>false, 'detail'=>$e->getMessage());
-    $ok = false;
-  }
-
-  if ($ok)
-  {
-    try
-    {
-      $source_view = bratonien_tools_nc_connector_view_name($config['source_view']);
-      $value = bratonien_tools_nc_connector_psql($config, $credentials['db_password'], 'SELECT COUNT(*) FROM '.$source_view);
-      if (!preg_match('/^\d+$/', $value))
-      {
-        throw new RuntimeException('Source-View lieferte keinen gueltigen Zaehler.');
-      }
-      $source_count = (int)$value;
-      $checks[] = array('name'=>'Source-View', 'ok'=>true, 'detail'=>$source_count.' Quelle(n) lesbar');
-    }
-    catch (Throwable $e)
-    {
-      $checks[] = array('name'=>'Source-View', 'ok'=>false, 'detail'=>$e->getMessage());
-      $ok = false;
-    }
-
-    try
-    {
-      $activity_view = bratonien_tools_nc_connector_view_name($config['activity_view']);
-      bratonien_tools_nc_connector_psql($config, $credentials['db_password'], 'SELECT 1 FROM '.$activity_view.' LIMIT 1');
-      $checks[] = array('name'=>'Activity-View', 'ok'=>true, 'detail'=>'View lesbar');
-    }
-    catch (Throwable $e)
-    {
-      $checks[] = array('name'=>'Activity-View', 'ok'=>false, 'detail'=>$e->getMessage());
-      $ok = false;
-    }
-  }
-
-  $storages = isset($config['storages']) && is_array($config['storages']) ? $config['storages'] : array();
-  $mount_points = bratonien_tools_nc_connector_mount_points();
-  if (!$storages)
-  {
-    $checks[] = array('name'=>'Storage-Mounts', 'ok'=>false, 'detail'=>'Keine Storage-Zuordnung gespeichert');
-    $ok = false;
-  }
-  else
-  {
-    foreach ($storages as $index => $storage)
-    {
-      $path = rtrim((string)($storage['local_mount'] ?? ''), '/');
-      $exists = $path !== '' && is_dir($path);
-      $readable = $exists && is_readable($path);
-      $mounted = $path !== '' && isset($mount_points[$path]);
-      $storage_ok = $exists && $readable && $mounted;
-      $storage_id = (string)($storage['storage_id'] ?? ('#'.($index + 1)));
-      $detail = $storage_id.' -> '.($path !== '' ? $path : '(kein Pfad)');
-      if (!$exists) $detail .= ' (Pfad fehlt)';
-      elseif (!$readable) $detail .= ' (nicht lesbar)';
-      elseif (!$mounted) $detail .= ' (kein aktiver Mount)';
-      else $detail .= ' (bereit)';
-      $checks[] = array('name'=>'Storage '.($index + 1), 'ok'=>$storage_ok, 'detail'=>$detail);
-      if (!$storage_ok) $ok = false;
-    }
-  }
-
-  $config['verification'] = array(
-    'checked_at' => date('Y-m-d H:i:s'),
-    'ok' => $ok,
-    'source_count' => $source_count,
-    'checks' => $checks,
-  );
-  $table = bratonien_tools_nc_connector_table();
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  if (!is_string($config_json))
-  {
-    throw new RuntimeException('Verifikationsergebnis konnte nicht gespeichert werden.');
-  }
-  $state = $ok ? 'verified' : ((string)$connection['takeover_state'] === 'disabled' ? 'disabled' : 'imported');
-  $now = date('Y-m-d H:i:s');
-  pwg_query("UPDATE `$table` SET takeover_state='".pwg_db_real_escape_string($state)."', enabled=0, config_json='".pwg_db_real_escape_string($config_json)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".$id);
-
-  if (!$ok)
-  {
-    throw new RuntimeException('Connector-Verifikation ist fehlgeschlagen. Die Verbindung bleibt deaktiviert; Details stehen im NC Connector.');
-  }
-
-  return array('message'=>'Connector-Verbindung wurde erfolgreich verifiziert. PostgreSQL, Views und Storage-Mounts sind erreichbar.');
+function bratonien_tools_nc_connector_remove_tree($path)
+{
+  $path=rtrim((string)$path,'/');if($path===''||$path==='/'||!file_exists($path))return true;
+  if(is_link($path)||is_file($path))return @unlink($path);
+  $items=@scandir($path);if(!is_array($items))return false;
+  foreach($items as $item){if($item==='.'||$item==='..')continue;if(!bratonien_tools_nc_connector_remove_tree($path.'/'.$item))return false;}
+  return @rmdir($path);
 }
 
 function bratonien_tools_nc_connector_delete()
 {
-  $id = (int)($_POST['connection_id'] ?? 0);
-  $connection = bratonien_tools_nc_connector_connection($id, false);
-  if (!$connection)
+  $id=(int)($_POST['connection_id']??0);$connection=bratonien_tools_nc_connector_connection($id,false);if(!$connection)throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');if(!empty($connection['enabled'])||(string)$connection['takeover_state']==='active')throw new RuntimeException('Eine aktive Verbindung kann nicht geloescht werden. Sie muss zuerst deaktiviert werden.');
+  $config=is_array($connection['config'])?$connection['config']:array();
+  $public_status=rtrim(PHPWG_ROOT_PATH,'/').'/_data/bratonien-tools/nc-connector-status/connection-'.$id.'.json';if(is_file($public_status))@unlink($public_status);
+  $state_dir=rtrim((string)($config['state_dir']??''),'/');
+  if($state_dir!==''&&strpos($state_dir,'/var/lib/bratonien-tools/nc-connector/connection-'.$id)===0&&file_exists($state_dir))
   {
-    throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+    bratonien_tools_nc_connector_remove_tree($state_dir);
   }
-  if (!empty($connection['enabled']) || (string)$connection['takeover_state'] === 'active')
-  {
-    throw new RuntimeException('Eine aktive Verbindung kann nicht geloescht werden. Sie muss zuerst deaktiviert werden.');
-  }
-
-  $table = bratonien_tools_nc_connector_table();
-  pwg_query("DELETE FROM `$table` WHERE id=".$id." LIMIT 1");
-  return array('message'=>'Connector-Verbindung wurde geloescht.');
+  $table=bratonien_tools_nc_connector_table();pwg_query("DELETE FROM `$table` WHERE id=".$id." LIMIT 1");
+  return array('message'=>'Connector-Verbindung und erreichbare Connector-eigene Statusdaten wurden geloescht. Nextcloud- und Piwigo-Bilder blieben unverändert.');
 }

include/nc_connector_piwigo_api.inc.php

@@ -86,6 +86,38 @@ function bratonien_tools_nc_connector_api_payload(array $decoded)
   return $decoded;
 }
 
+function bratonien_tools_nc_connector_collect_method_names($value, array &$methods)
+{
+  if (is_string($value))
+  {
+    $value = trim($value);
+    if ($value !== '' && preg_match('/^[A-Za-z0-9_]+(?:\.[A-Za-z0-9_]+)+$/', $value))
+    {
+      $methods[$value] = true;
+    }
+    return;
+  }
+
+  if (!is_array($value))
+  {
+    return;
+  }
+
+  if (isset($value['name']) && is_string($value['name']))
+  {
+    $name = trim($value['name']);
+    if ($name !== '')
+    {
+      $methods[$name] = true;
+    }
+  }
+
+  foreach ($value as $entry)
+  {
+    bratonien_tools_nc_connector_collect_method_names($entry, $methods);
+  }
+}
+
 function bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, $method)
 {
   if (!function_exists('curl_init'))
@@ -147,6 +179,76 @@ function bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_s
   return bratonien_tools_nc_connector_api_payload($decoded);
 }
 
+function bratonien_tools_nc_connector_validate_fallback_credentials($username, $password)
+{
+  if (!function_exists('curl_init'))
+  {
+    throw new RuntimeException('cURL ist in PHP nicht verfuegbar. Der Piwigo-Fallback kann nicht geprueft werden.');
+  }
+
+  $username = trim((string)$username);
+  $password = (string)$password;
+  if ($username === '' || $password === '')
+  {
+    throw new RuntimeException('Piwigo-Benutzername und Passwort muessen angegeben werden.');
+  }
+
+  $cookie_file = tempnam(sys_get_temp_dir(), 'br-pwg-auth-');
+  if ($cookie_file === false)
+  {
+    throw new RuntimeException('Temporare Piwigo-Sitzung konnte nicht angelegt werden.');
+  }
+
+  try
+  {
+    $url = rtrim(get_absolute_root_url(true), '/').'/ws.php?format=json';
+    $request = function(array $fields) use ($url, $cookie_file)
+    {
+      $ch = curl_init($url);
+      curl_setopt_array($ch, array(
+        CURLOPT_RETURNTRANSFER=>true,
+        CURLOPT_POST=>true,
+        CURLOPT_POSTFIELDS=>http_build_query($fields),
+        CURLOPT_COOKIEJAR=>$cookie_file,
+        CURLOPT_COOKIEFILE=>$cookie_file,
+        CURLOPT_CONNECTTIMEOUT=>10,
+        CURLOPT_TIMEOUT=>20,
+        CURLOPT_FOLLOWLOCATION=>false,
+        CURLOPT_USERAGENT=>'Bratonien-Tools-NC-Connector/'.(function_exists('bratonien_tools_current_version') ? bratonien_tools_current_version() : 'dev'),
+      ));
+      $body = curl_exec($ch);
+      $errno = curl_errno($ch);
+      $error = curl_error($ch);
+      $http = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+      $type = (string)curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
+      curl_close($ch);
+      if ($body === false || $errno !== 0) throw new RuntimeException('Piwigo-Fallback konnte nicht geprueft werden: '.$error);
+      if ($http < 200 || $http >= 300) throw new RuntimeException('Piwigo-Fallback-Pruefung antwortete mit HTTP '.$http.'.');
+      $decoded = bratonien_tools_nc_connector_decode_api_response((string)$body, $type);
+      if (($decoded['stat'] ?? '') !== 'ok')
+      {
+        $message = trim((string)($decoded['message'] ?? $decoded['err'] ?? 'Piwigo hat die Anmeldung abgelehnt.'));
+        throw new RuntimeException($message !== '' ? $message : 'Piwigo hat die Anmeldung abgelehnt.');
+      }
+      return bratonien_tools_nc_connector_api_payload($decoded);
+    };
+
+    $request(array('method'=>'pwg.session.login', 'username'=>$username, 'password'=>$password));
+    $status = $request(array('method'=>'pwg.session.getStatus'));
+    if (!is_array($status)) throw new RuntimeException('Piwigo hat keinen auswertbaren Benutzerstatus geliefert.');
+    $role = strtolower(trim((string)($status['status'] ?? '')));
+    if (!in_array($role, array('admin','webmaster'), true))
+    {
+      throw new RuntimeException('Der Piwigo-Fallback funktioniert, gehoert aber keinem Administrator/Webmaster.');
+    }
+    return array('username'=>(string)($status['username'] ?? $username), 'status'=>$role);
+  }
+  finally
+  {
+    @unlink($cookie_file);
+  }
+}
+
 function bratonien_tools_nc_connector_piwigo_api_test()
 {
   $api_key_id = trim((string)($_POST['nc_piwigo_api_key_id'] ?? ''));
@@ -175,30 +277,10 @@ function bratonien_tools_nc_connector_piwigo_api_test()
   }
 
   $method_result = bratonien_tools_nc_connector_piwigo_api_request($api_key_id, $api_key_secret, 'reflection.getMethodList');
-  $methods = array();
-  if (is_array($method_result))
-  {
-    if (isset($method_result['method']))
-    {
-      $entries = is_array($method_result['method']) ? $method_result['method'] : array($method_result['method']);
-    }
-    else
-    {
-      $entries = $method_result;
-    }
-
-    foreach ($entries as $entry)
-    {
-      if (is_string($entry))
-      {
-        $methods[] = $entry;
-      }
-      elseif (is_array($entry) && isset($entry['name']))
-      {
-        $methods[] = (string)$entry['name'];
-      }
-    }
-  }
+  $method_map = array();
+  bratonien_tools_nc_connector_collect_method_names($method_result, $method_map);
+  $methods = array_keys($method_map);
+  sort($methods, SORT_STRING);
 
   $required_methods = array('bratonien.nc.syncProductive', 'bratonien.nc.syncOrphans');
   $missing = array_values(array_diff($required_methods, $methods));
@@ -213,7 +295,6 @@ function bratonien_tools_nc_connector_piwigo_api_test()
   {
     return preg_match('/sync|synchron|site/i', (string)$method) === 1;
   }));
-  sort($sync_candidates, SORT_STRING);
 
   $result = array(
     'ok' => true,

include/nc_connector_scheduler.inc.php

@@ -0,0 +1,210 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_scheduler_paths()
+{
+  $base = rtrim(PHPWG_ROOT_PATH, '/').'/_data/bratonien-tools';
+  return array(
+    'base'=>$base,
+    'runtime'=>$base.'/nc-connector-runtime',
+    'state_root'=>$base.'/nc-connector-state',
+    'scheduler'=>$base.'/nc-connector-scheduler',
+    'state'=>$base.'/nc-connector-scheduler/state.json',
+    'trigger_lock'=>$base.'/nc-connector-scheduler/trigger.lock',
+    'worker_lock'=>$base.'/nc-connector-scheduler/worker.lock',
+    'log'=>$base.'/nc-connector-scheduler/last-worker.log',
+    'status_root'=>$base.'/nc-connector-status',
+  );
+}
+
+function bratonien_tools_nc_scheduler_interval()
+{
+  global $conf;
+  $interval = isset($conf['bratonien_nc_scheduler_interval']) ? (int)$conf['bratonien_nc_scheduler_interval'] : 60;
+  return max(60, $interval);
+}
+
+function bratonien_tools_nc_scheduler_ensure_dirs()
+{
+  foreach (bratonien_tools_nc_scheduler_paths() as $key=>$path)
+  {
+    if (in_array($key, array('state','trigger_lock','worker_lock','log'), true)) continue;
+    if (!is_dir($path) && !@mkdir($path, 0750, true) && !is_dir($path))
+    {
+      return false;
+    }
+  }
+  return true;
+}
+
+function bratonien_tools_nc_scheduler_read_state()
+{
+  $paths = bratonien_tools_nc_scheduler_paths();
+  if (!is_readable($paths['state'])) return array();
+  $decoded = json_decode((string)@file_get_contents($paths['state']), true);
+  return is_array($decoded) ? $decoded : array();
+}
+
+function bratonien_tools_nc_scheduler_write_state(array $state)
+{
+  $paths = bratonien_tools_nc_scheduler_paths();
+  if (!bratonien_tools_nc_scheduler_ensure_dirs()) return false;
+  $json = json_encode($state, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+  if (!is_string($json)) return false;
+  $tmp = $paths['state'].'.tmp';
+  if (@file_put_contents($tmp, $json."\n", LOCK_EX) === false) return false;
+  @chmod($tmp, 0640);
+  return @rename($tmp, $paths['state']);
+}
+
+function bratonien_tools_nc_scheduler_write_connection_status($connection_id, $state, $message)
+{
+  $connection_id = (int)$connection_id;
+  if ($connection_id < 1) return false;
+  $paths = bratonien_tools_nc_scheduler_paths();
+  if (!bratonien_tools_nc_scheduler_ensure_dirs()) return false;
+  $target = $paths['status_root'].'/connection-'.$connection_id.'.json';
+  $existing = array();
+  if (is_readable($target))
+  {
+    $decoded = json_decode((string)@file_get_contents($target), true);
+    if (is_array($decoded)) $existing = $decoded;
+  }
+  $existing['state'] = (string)$state;
+  $existing['message'] = (string)$message;
+  $existing['timestamp'] = time();
+  $existing['connection_id'] = $connection_id;
+  $json = json_encode($existing, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+  if (!is_string($json)) return false;
+  $tmp = $target.'.tmp';
+  if (@file_put_contents($tmp, $json."\n", LOCK_EX) === false) return false;
+  @chmod($tmp, 0644);
+  return @rename($tmp, $target);
+}
+
+function bratonien_tools_nc_scheduler_install()
+{
+  if (!bratonien_tools_nc_scheduler_ensure_dirs()) return false;
+  $state = bratonien_tools_nc_scheduler_read_state();
+  if (empty($state['next_due']))
+  {
+    $state['next_due'] = time();
+    $state['enabled'] = true;
+    $state['mode'] = 'piwigo-native';
+    bratonien_tools_nc_scheduler_write_state($state);
+  }
+  return true;
+}
+
+function bratonien_tools_nc_scheduler_php_binary()
+{
+  foreach (array('/usr/bin/php', '/usr/local/bin/php', PHP_BINARY) as $candidate)
+  {
+    if (is_string($candidate) && $candidate !== '' && is_executable($candidate)) return $candidate;
+  }
+  return '';
+}
+
+function bratonien_tools_nc_scheduler_spawn($force = false, $connection_id = 0)
+{
+  $connection_id = max(0, (int)$connection_id);
+  $paths = bratonien_tools_nc_scheduler_paths();
+  if (!bratonien_tools_nc_scheduler_ensure_dirs())
+  {
+    throw new RuntimeException('Der native NC-Scheduler kann sein Laufzeitverzeichnis nicht anlegen.');
+  }
+
+  $lock = @fopen($paths['trigger_lock'], 'c+');
+  if (!is_resource($lock) || !@flock($lock, LOCK_EX | LOCK_NB))
+  {
+    if (is_resource($lock)) fclose($lock);
+    return array('started'=>false, 'message'=>'Ein NC-Abgleich wird bereits vorbereitet.');
+  }
+
+  $state = bratonien_tools_nc_scheduler_read_state();
+  $now = time();
+  $next_due = (int)($state['next_due'] ?? 0);
+  if (!$force && $next_due > $now)
+  {
+    @flock($lock, LOCK_UN);
+    fclose($lock);
+    return array('started'=>false, 'message'=>'Der nächste NC-Abgleich ist noch nicht fällig.');
+  }
+
+  $php = bratonien_tools_nc_scheduler_php_binary();
+  if ($php === '')
+  {
+    @flock($lock, LOCK_UN);
+    fclose($lock);
+    throw new RuntimeException('Kein ausführbares PHP-CLI für den nativen NC-Scheduler gefunden.');
+  }
+
+  $state['enabled'] = true;
+  $state['mode'] = 'piwigo-native';
+  $state['state'] = 'queued';
+  $state['message'] = $connection_id > 0 ? 'NC-Abgleich für Verbindung #'.$connection_id.' wurde angefordert.' : 'NC-Abgleich für alle Verbindungen wurde angefordert.';
+  $state['queued_at'] = $now;
+  $state['timestamp'] = $now;
+  $state['connection_id'] = $connection_id;
+  $state['next_due'] = $now + bratonien_tools_nc_scheduler_interval();
+  bratonien_tools_nc_scheduler_write_state($state);
+  if ($connection_id > 0)
+  {
+    bratonien_tools_nc_scheduler_write_connection_status($connection_id, 'queued', 'Abgleich wurde angefordert.');
+  }
+
+  $runner = BRATONIEN_TOOLS_PATH.'runtime/native-runner.php';
+  $runner_args = $connection_id > 0 ? ' --connection-id='.escapeshellarg((string)$connection_id) : '';
+  $command = escapeshellarg($php).' '.escapeshellarg($runner).$runner_args.' >> '.escapeshellarg($paths['log']).' 2>&1 &';
+  $spec = array(
+    0=>array('file','/dev/null','r'),
+    1=>array('file','/dev/null','a'),
+    2=>array('file','/dev/null','a'),
+  );
+  $process = function_exists('proc_open') ? @proc_open(array('/bin/sh','-c',$command), $spec, $pipes) : false;
+  $exit = is_resource($process) ? proc_close($process) : 1;
+
+  @flock($lock, LOCK_UN);
+  fclose($lock);
+
+  if ($exit !== 0)
+  {
+    $state = bratonien_tools_nc_scheduler_read_state();
+    $state['state'] = 'error';
+    $state['message'] = 'Der native NC-Abgleich konnte nicht gestartet werden.';
+    $state['timestamp'] = time();
+    bratonien_tools_nc_scheduler_write_state($state);
+    if ($connection_id > 0)
+    {
+      bratonien_tools_nc_scheduler_write_connection_status($connection_id, 'error', 'Abgleich konnte nicht gestartet werden.');
+    }
+    throw new RuntimeException('Der native NC-Abgleich konnte nicht gestartet werden.');
+  }
+
+  return array('started'=>true, 'message'=>$connection_id > 0 ? 'Abgleich für Verbindung #'.$connection_id.' wurde angefordert.' : 'Abgleich für alle Verbindungen wurde angefordert.');
+}
+
+function bratonien_tools_nc_scheduler_tick()
+{
+  $state = bratonien_tools_nc_scheduler_read_state();
+  if (isset($state['enabled']) && !$state['enabled']) return;
+  $next_due = (int)($state['next_due'] ?? 0);
+  if ($next_due > time()) return;
+
+  try
+  {
+    bratonien_tools_nc_scheduler_spawn(false, 0);
+  }
+  catch (Throwable $e)
+  {
+    $state = bratonien_tools_nc_scheduler_read_state();
+    $state['state'] = 'error';
+    $state['message'] = $e->getMessage();
+    $state['timestamp'] = time();
+    $state['next_due'] = time() + bratonien_tools_nc_scheduler_interval();
+    bratonien_tools_nc_scheduler_write_state($state);
+  }
+}

include/nc_connector_system.inc.php

@@ -4,182 +4,137 @@ if (!defined('PHPWG_ROOT_PATH'))
   die('Hacking attempt!');
 }
 
-function bratonien_tools_nc_connector_systemctl_value(array $args)
-{
-  if (!function_exists('proc_open'))
-  {
-    return '';
-  }
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_scheduler.inc.php');
 
-  $command = array_merge(array('/usr/bin/systemctl'), $args);
-  $spec = array(
-    0 => array('file', '/dev/null', 'r'),
-    1 => array('pipe', 'w'),
-    2 => array('pipe', 'w'),
+function bratonien_tools_nc_connector_connection_last_status(array $connection)
+{
+  $empty = array(
+    'timestamp'=>0,'label'=>'Nicht verfügbar','state'=>'','message'=>'','auth_mode'=>'',
+    'api_state'=>'','api_message'=>'','fallback_state'=>'','fallback_message'=>'','error_detail'=>'',
   );
-  $environment = array_merge($_ENV, array('LC_ALL'=>'C', 'LANG'=>'C'));
-  $process = @proc_open($command, $spec, $pipes, null, $environment);
-  if (!is_resource($process))
-  {
-    return '';
-  }
-  $stdout = stream_get_contents($pipes[1]);
-  stream_get_contents($pipes[2]);
-  fclose($pipes[1]);
-  fclose($pipes[2]);
-  $exit = proc_close($process);
-  return $exit === 0 ? trim((string)$stdout) : '';
-}
 
-function bratonien_tools_nc_connector_parse_systemd_time($value)
-{
-  $value = trim((string)$value);
-  if ($value === '' || strtolower($value) === 'n/a')
+  $connection_id = (int)($connection['id'] ?? 0);
+  $candidates = array();
+  if ($connection_id > 0)
   {
-    return 0;
-  }
-  $parsed = strtotime($value);
-  return $parsed === false ? 0 : (int)$parsed;
-}
-
-function bratonien_tools_nc_connector_monotonic_to_timestamp($value)
-{
-  $value = trim((string)$value);
-  if ($value === '' || $value === '0' || strtolower($value) === 'n/a')
-  {
-    return 0;
+    $candidates[] = rtrim(PHPWG_ROOT_PATH, '/').'/_data/bratonien-tools/nc-connector-status/connection-'.$connection_id.'.json';
+    $candidates[] = rtrim(PHPWG_ROOT_PATH, '/').'/_data/bratonien-tools/nc-connector-state/connection-'.$connection_id.'/connector-status.json';
   }
 
-  if (preg_match('/^([0-9]+)(?:us)?$/', $value, $matches))
-  {
-    $next_boot_seconds = ((float)$matches[1]) / 1000000;
-  }
-  else
-  {
-    return 0;
-  }
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $state_dir = rtrim((string)($config['state_dir'] ?? ''), '/');
+  if ($state_dir !== '') $candidates[] = $state_dir.'/connector-status.json';
 
-  $uptime_raw = @file_get_contents('/proc/uptime');
-  if (!is_string($uptime_raw) || !preg_match('/^([0-9]+(?:\.[0-9]+)?)/', trim($uptime_raw), $uptime_match))
+  $decoded = null;
+  foreach (array_unique($candidates) as $candidate)
   {
-    return 0;
+    if (!is_readable($candidate)) continue;
+    $value = json_decode((string)@file_get_contents($candidate), true);
+    if (is_array($value)) { $decoded = $value; break; }
   }
+  if (!is_array($decoded)) return $empty;
 
-  $remaining = $next_boot_seconds - (float)$uptime_match[1];
-  if ($remaining < -1)
-  {
-    return 0;
-  }
-
-  return (int)round(time() + max(0, $remaining));
-}
-
-function bratonien_tools_nc_connector_next_from_timer_list($timer)
-{
-  $line = bratonien_tools_nc_connector_systemctl_value(array(
-    'list-timers', '--all', '--no-pager', '--no-legend', $timer,
-  ));
-  if ($line === '')
-  {
-    return 0;
-  }
-
-  $first_line = trim((string)strtok($line, "\n"));
-  if (preg_match('/^(\S+\s+\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+\S+)/', $first_line, $matches))
-  {
-    $parsed = strtotime($matches[1]);
-    return $parsed === false ? 0 : (int)$parsed;
-  }
-
-  return 0;
+  $timestamp = (int)($decoded['timestamp'] ?? 0);
+  $api = isset($decoded['api']) && is_array($decoded['api']) ? $decoded['api'] : array();
+  $fallback = isset($decoded['fallback']) && is_array($decoded['fallback']) ? $decoded['fallback'] : array();
+  return array(
+    'timestamp'=>$timestamp,
+    'label'=>$timestamp > 0 ? date('d.m.Y H:i:s', $timestamp) : 'Nicht verfügbar',
+    'state'=>(string)($decoded['state'] ?? ''),
+    'message'=>(string)($decoded['message'] ?? ''),
+    'auth_mode'=>(string)($decoded['auth_mode'] ?? ''),
+    'api_state'=>(string)($api['state'] ?? ''),
+    'api_message'=>(string)($api['message'] ?? ''),
+    'fallback_state'=>(string)($fallback['state'] ?? ''),
+    'fallback_message'=>(string)($fallback['message'] ?? ''),
+    'error_detail'=>(string)($decoded['error_detail'] ?? ''),
+  );
 }
 
 function bratonien_tools_nc_connector_last_status(array $connections)
 {
-  $latest = array('timestamp'=>0, 'state'=>'', 'message'=>'');
-
+  $latest = array('timestamp'=>0,'state'=>'','message'=>'','auth_mode'=>'','api_state'=>'','api_message'=>'','fallback_state'=>'','fallback_message'=>'','error_detail'=>'');
   foreach ($connections as $connection)
   {
-    if (empty($connection['enabled']) || (string)($connection['takeover_state'] ?? '') !== 'active')
-    {
-      continue;
-    }
-
-    $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
-    $state_dir = rtrim((string)($config['state_dir'] ?? ''), '/');
-    if ($state_dir === '')
-    {
-      continue;
-    }
-
-    $status_path = $state_dir.'/connector-status.json';
-    if (!is_readable($status_path))
-    {
-      continue;
-    }
-
-    $decoded = json_decode((string)@file_get_contents($status_path), true);
-    if (!is_array($decoded))
-    {
-      continue;
-    }
-
-    $timestamp = (int)($decoded['timestamp'] ?? 0);
-    if ($timestamp >= $latest['timestamp'])
-    {
-      $latest = array(
-        'timestamp' => $timestamp,
-        'state' => (string)($decoded['state'] ?? ''),
-        'message' => (string)($decoded['message'] ?? ''),
-      );
-    }
+    if (empty($connection['enabled'])) continue;
+    $status = bratonien_tools_nc_connector_connection_last_status($connection);
+    if ((int)$status['timestamp'] >= (int)$latest['timestamp']) $latest = $status;
   }
-
   return $latest;
 }
 
 function bratonien_tools_nc_connector_system_status(array $connections = array())
 {
-  $timer = 'bratonien-nc-connector.timer';
-  $service = 'bratonien-nc-connector.service';
-
-  $next_realtime_raw = bratonien_tools_nc_connector_systemctl_value(array('show', $timer, '--property=NextElapseUSecRealtime', '--value'));
-  $next_timestamp = bratonien_tools_nc_connector_parse_systemd_time($next_realtime_raw);
-
-  if ($next_timestamp <= 0)
-  {
-    $next_monotonic_raw = bratonien_tools_nc_connector_systemctl_value(array('show', $timer, '--property=NextElapseUSecMonotonic', '--value'));
-    $next_timestamp = bratonien_tools_nc_connector_monotonic_to_timestamp($next_monotonic_raw);
-  }
-
-  if ($next_timestamp <= 0)
-  {
-    $next_timestamp = bratonien_tools_nc_connector_next_from_timer_list($timer);
-  }
-
-  $active = bratonien_tools_nc_connector_systemctl_value(array('is-active', $timer));
-  $enabled = bratonien_tools_nc_connector_systemctl_value(array('is-enabled', $timer));
-
+  $scheduler = bratonien_tools_nc_scheduler_read_state();
+  $enabled = !isset($scheduler['enabled']) || !empty($scheduler['enabled']);
+  $scheduler_state = (string)($scheduler['state'] ?? '');
+  $running = $scheduler_state === 'running';
+  $queued = $scheduler_state === 'queued';
+  $started = (int)($scheduler['started_at'] ?? 0);
+  $next = (int)($scheduler['next_due'] ?? 0);
   $last = bratonien_tools_nc_connector_last_status($connections);
-  if ($last['timestamp'] <= 0)
+
+  if ($next > 0)
   {
-    $last_raw = bratonien_tools_nc_connector_systemctl_value(array('show', $service, '--property=ExecMainExitTimestamp', '--value'));
-    $last['timestamp'] = bratonien_tools_nc_connector_parse_systemd_time($last_raw);
+    $next_label = date('d.m.Y H:i:s', $next).' (beim nächsten Piwigo-Aufruf)';
   }
+  else
+  {
+    $next_label = 'Beim nächsten Piwigo-Aufruf';
+  }
+
+  $scheduler_timestamp = (int)($scheduler['timestamp'] ?? 0);
+  if ($scheduler_timestamp > (int)$last['timestamp'])
+  {
+    $last['timestamp'] = $scheduler_timestamp;
+    $last['state'] = $scheduler_state;
+    $last['message'] = (string)($scheduler['message'] ?? '');
+    if ($scheduler_state === 'error')
+    {
+      $detail = trim((string)($scheduler['stderr'] ?? ''));
+      if ($detail === '') $detail = trim((string)($scheduler['stdout'] ?? ''));
+      $last['error_detail'] = $detail;
+    }
+  }
+  elseif ((int)$last['timestamp'] <= 0 && !empty($scheduler['finished_at']))
+  {
+    $last['timestamp'] = (int)$scheduler['finished_at'];
+    $last['state'] = $scheduler_state;
+    $last['message'] = (string)($scheduler['message'] ?? '');
+    if ((string)$last['state'] === 'error')
+    {
+      $detail = trim((string)($scheduler['stderr'] ?? ''));
+      if ($detail === '') $detail = trim((string)($scheduler['stdout'] ?? ''));
+      $last['error_detail'] = $detail;
+    }
+  }
+
+  $current_label = 'Kein Lauf aktiv';
+  if ($queued) $current_label = 'Abgleich angefordert';
+  if ($running) $current_label = $started > 0 ? 'Läuft seit '.date('d.m.Y H:i:s', $started) : 'Läuft gerade';
 
   return array(
-    'timer_name' => $timer,
-    'timer_active' => $active === 'active',
-    'timer_enabled' => $enabled === 'enabled',
-    'last_run_timestamp' => (int)$last['timestamp'],
-    'last_run_label' => $last['timestamp'] > 0 ? date('d.m.Y H:i:s', (int)$last['timestamp']) : 'Nicht verfügbar',
-    'last_run_state' => (string)$last['state'],
-    'last_run_message' => (string)$last['message'],
-    'next_run_timestamp' => $next_timestamp,
-    'next_run_label' => $next_timestamp > 0 ? date('d.m.Y H:i:s', $next_timestamp) : 'Nicht verfügbar',
-    'legacy_runtime_exists' => is_dir('/opt/piwigo-sync'),
-    'legacy_config_exists' => is_dir('/etc/piwigo-sync'),
-    'legacy_service_exists' => is_file('/etc/systemd/system/piwigo-sync.service'),
-    'legacy_timer_exists' => is_file('/etc/systemd/system/piwigo-sync.timer'),
+    'timer_name'=>'Piwigo nativer NC-Scheduler',
+    'timer_active'=>$enabled,
+    'timer_enabled'=>$enabled,
+    'service_active'=>$running || $queued,
+    'current_run_timestamp'=>$queued ? (int)($scheduler['queued_at'] ?? 0) : $started,
+    'current_run_label'=>$current_label,
+    'last_run_timestamp'=>(int)$last['timestamp'],
+    'last_run_label'=>(int)$last['timestamp'] > 0 ? date('d.m.Y H:i:s', (int)$last['timestamp']) : 'Nicht verfügbar',
+    'last_run_state'=>(string)$last['state'],
+    'last_run_message'=>(string)$last['message'],
+    'last_run_auth_mode'=>(string)$last['auth_mode'],
+    'last_run_api_state'=>(string)$last['api_state'],
+    'last_run_api_message'=>(string)$last['api_message'],
+    'last_run_fallback_state'=>(string)$last['fallback_state'],
+    'last_run_fallback_message'=>(string)$last['fallback_message'],
+    'last_run_error_detail'=>(string)$last['error_detail'],
+    'next_run_timestamp'=>$next,
+    'next_run_label'=>$next_label,
+    'legacy_runtime_exists'=>is_dir('/opt/piwigo-sync'),
+    'legacy_config_exists'=>is_dir('/etc/piwigo-sync'),
+    'legacy_service_exists'=>is_file('/etc/systemd/system/piwigo-sync.service'),
+    'legacy_timer_exists'=>is_file('/etc/systemd/system/piwigo-sync.timer'),
   );
 }

include/nc_connector_takeover.inc.php

@@ -1,135 +0,0 @@
-<?php
-if (!defined('PHPWG_ROOT_PATH'))
-{
-  die('Hacking attempt!');
-}
-
-/**
- * Controlled handover preparation for verified NC Connector connections.
- *
- * This phase intentionally does not stop, disable or modify the legacy
- * piwigo-sync service. It only marks a verified Connector connection as ready
- * for a later controlled takeover. The marker can be rolled back at any time.
- */
-
-function bratonien_tools_nc_connector_ensure_takeover_state()
-{
-  bratonien_tools_nc_connector_ensure_table();
-  $table = bratonien_tools_nc_connector_table();
-  pwg_query("ALTER TABLE `$table` MODIFY takeover_state enum('imported','verified','ready','active','disabled') NOT NULL DEFAULT 'imported'");
-}
-
-function bratonien_tools_nc_connector_prepare_takeover()
-{
-  $id = isset($_POST['connection_id']) ? (int)$_POST['connection_id'] : 0;
-  $connection = bratonien_tools_nc_connector_connection($id, false);
-  if (!$connection)
-  {
-    throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
-  }
-  if ($connection['takeover_state'] !== 'verified')
-  {
-    throw new RuntimeException('Nur eine erfolgreich verifizierte Verbindung kann fuer die Uebergabe vorbereitet werden.');
-  }
-
-  $config = $connection['config'];
-  $verification = isset($config['verification']) && is_array($config['verification'])
-    ? $config['verification']
-    : array();
-  if (empty($verification['ok']))
-  {
-    throw new RuntimeException('Die gespeicherte Verifikation ist nicht erfolgreich. Bitte die Verbindung erneut pruefen.');
-  }
-
-  $config['takeover'] = array(
-    'prepared_at' => date('Y-m-d H:i:s'),
-    'legacy_sync_untouched' => true,
-    'connector_enabled' => false,
-    'first_run' => array(
-      'status' => 'pending',
-      'finished_at' => null,
-      'detail' => '',
-    ),
-  );
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  if (!is_string($config_json))
-  {
-    throw new RuntimeException('Uebergabestatus konnte nicht gespeichert werden.');
-  }
-
-  bratonien_tools_nc_connector_ensure_takeover_state();
-  $table = bratonien_tools_nc_connector_table();
-  $now = date('Y-m-d H:i:s');
-  pwg_query("UPDATE `$table` SET
-    takeover_state = 'ready',
-    enabled = 0,
-    config_json = '".pwg_db_real_escape_string($config_json)."',
-    updated = '".pwg_db_real_escape_string($now)."'
-    WHERE id = ".(int)$connection['id']);
-
-  return array(
-    'message' => 'Die verifizierte Nextcloud-Verbindung ist jetzt fuer die kontrollierte Uebergabe vorbereitet. Der Connector wurde noch nicht aktiviert und der Legacy-Sync bleibt unveraendert Produktionsverbindung.',
-  );
-}
-
-function bratonien_tools_nc_connector_cancel_takeover()
-{
-  $id = isset($_POST['connection_id']) ? (int)$_POST['connection_id'] : 0;
-  $connection = bratonien_tools_nc_connector_connection($id, false);
-  if (!$connection)
-  {
-    throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
-  }
-  if ($connection['takeover_state'] !== 'ready')
-  {
-    throw new RuntimeException('Diese Verbindung befindet sich nicht in der Uebergabevorbereitung.');
-  }
-
-  $config = $connection['config'];
-  if (isset($config['takeover']))
-  {
-    unset($config['takeover']);
-  }
-  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  if (!is_string($config_json))
-  {
-    throw new RuntimeException('Uebergabestatus konnte nicht zurueckgesetzt werden.');
-  }
-
-  bratonien_tools_nc_connector_ensure_takeover_state();
-  $table = bratonien_tools_nc_connector_table();
-  $now = date('Y-m-d H:i:s');
-  pwg_query("UPDATE `$table` SET
-    takeover_state = 'verified',
-    enabled = 0,
-    config_json = '".pwg_db_real_escape_string($config_json)."',
-    updated = '".pwg_db_real_escape_string($now)."'
-    WHERE id = ".(int)$connection['id']);
-
-  return array(
-    'message' => 'Die Uebergabevorbereitung wurde zurueckgenommen. Die Verbindung bleibt verifiziert und deaktiviert; der Legacy-Sync bleibt unveraendert aktiv.',
-  );
-}
-
-/**
- * Normalize the outcome of a Connector sync run during takeover.
- *
- * Both "changed" and "no_changes" are successful results. Only "error"
- * represents a failed run and may trigger rollback of a controlled handover.
- */
-function bratonien_tools_nc_connector_takeover_result($status, $detail = '')
-{
-  $status = trim((string)$status);
-  if (!in_array($status, array('changed', 'no_changes', 'error'), true))
-  {
-    throw new RuntimeException('Unbekannter Connector-Laufstatus: '.$status);
-  }
-
-  return array(
-    'status' => $status,
-    'success' => $status !== 'error',
-    'changed' => $status === 'changed',
-    'finished_at' => date('Y-m-d H:i:s'),
-    'detail' => (string)$detail,
-  );
-}

include/nc_connector_webdav.inc.php

@@ -0,0 +1,179 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+/**
+ * Create or update one independent WebDAV connector connection.
+ * No migration pair, successor or implicit legacy fallback is created.
+ */
+function bratonien_tools_nc_connector_create_webdav_placeholder_from_wizard()
+{
+  $state = bratonien_tools_nc_wizard_state();
+
+  if (empty($state['scan_ok']) || empty($state['technical_complete']))
+  {
+    throw new RuntimeException('Die WebDAV-Verbindung wurde im Assistenten noch nicht vollstaendig vorbereitet.');
+  }
+
+  $base_url = rtrim(trim((string)($state['base_url'] ?? '')), '/');
+  $username = trim((string)($state['username'] ?? ''));
+  $password = (string)($state['_password'] ?? '');
+  if ($base_url === '' || $username === '' || $password === '')
+  {
+    throw new RuntimeException('Fuer den WebDAV-Zugang fehlen Nextcloud-Adresse oder Zugangsdaten.');
+  }
+
+  $selected = isset($state['directory_selected']) && is_array($state['directory_selected'])
+    ? array_values(array_unique(array_map(function($path) { return trim((string)$path, '/'); }, $state['directory_selected'])))
+    : array();
+  $selected_ids = isset($state['directory_selected_fileids']) && is_array($state['directory_selected_fileids'])
+    ? $state['directory_selected_fileids']
+    : array();
+
+  if (!$selected)
+  {
+    $selected = array('');
+  }
+
+  $roots = array();
+  foreach ($selected as $path)
+  {
+    $fileid = isset($selected_ids[$path]) ? (int)$selected_ids[$path] : 0;
+    if ($fileid < 1)
+    {
+      throw new RuntimeException('Fuer ein ausgewaehltes Nextcloud-Verzeichnis fehlt die eindeutige Datei-ID.');
+    }
+    $display_name = $path === ''
+      ? (trim((string)($state['display_name'] ?? '')) !== '' ? trim((string)$state['display_name']) : $username)
+      : basename($path);
+    $roots[] = array(
+      'fileid'=>$fileid,
+      'display_name'=>$display_name,
+      'webdav_path'=>$path,
+    );
+  }
+
+  $name = trim((string)($state['connection_name'] ?? ''));
+  if ($name === '') $name = 'Nextcloud WebDAV';
+  $gallery_root = rtrim(trim((string)($state['gallery_root'] ?? '')), '/');
+  if ($gallery_root === '') $gallery_root = rtrim(PHPWG_ROOT_PATH, '/').'/galleries';
+
+  $api_key_id = ($state['api_status'] ?? '') === 'ok' ? trim((string)($state['_api_key_id'] ?? '')) : '';
+  $api_key_secret = ($state['api_status'] ?? '') === 'ok' ? trim((string)($state['_api_key_secret'] ?? '')) : '';
+  $fallback_user = trim((string)($state['_fallback_user'] ?? ''));
+  $fallback_password = (string)($state['_fallback_password'] ?? '');
+  $api_enabled = $api_key_id !== '' && $api_key_secret !== '';
+
+  $editing_id = (int)($state['editing_connection_id'] ?? 0);
+  $editing_mode = (string)($state['editing_mode'] ?? '');
+  $editing_connection = $editing_id > 0 ? bratonien_tools_nc_connector_connection($editing_id, false) : null;
+  $editing_remote = $editing_connection
+    && (string)$editing_connection['adapter'] === 'remote'
+    && (string)($editing_connection['config']['source_mode'] ?? '') === 'webdav-placeholder'
+    && $editing_mode === 'update';
+
+  if ($editing_mode === 'migrate')
+  {
+    throw new RuntimeException('Die Migrationsfunktion wurde entfernt. Bitte eine normale WebDAV-Verbindung anlegen.');
+  }
+
+  $config = array(
+    'origin'=>'native',
+    'source_mode'=>'webdav-placeholder',
+    'transport'=>'webdav',
+    'nextcloud_url'=>$base_url,
+    'access_user'=>$username,
+    'nextcloud_access_user'=>$username,
+    'gallery_root'=>$gallery_root,
+    'roots'=>$roots,
+    'state_dir'=>'',
+    'status_file'=>'',
+    'quiet_seconds'=>120,
+    'max_wait_seconds'=>900,
+    'full_sync_seconds'=>86400,
+    'piwigo_auth'=>'connection-scoped',
+    'api_enabled'=>$api_enabled,
+  );
+
+  if ($editing_remote)
+  {
+    $old_config = is_array($editing_connection['config'] ?? null) ? $editing_connection['config'] : array();
+    foreach (array('state_dir','status_file','parallel_gallery_root','source_fingerprint','runtime') as $preserve)
+    {
+      if (array_key_exists($preserve, $old_config)) $config[$preserve] = $old_config[$preserve];
+    }
+    foreach (array('quiet_seconds','max_wait_seconds','full_sync_seconds') as $preserve)
+    {
+      if (isset($old_config[$preserve])) $config[$preserve] = (int)$old_config[$preserve];
+    }
+  }
+
+  foreach (array('product'=>'nextcloud_product', 'version'=>'nextcloud_version') as $state_key=>$config_key)
+  {
+    $value = trim((string)($state[$state_key] ?? ''));
+    if ($value !== '') $config[$config_key] = $value;
+  }
+
+  $secret_payload = json_encode(array(
+    'v'=>3,
+    'db_password'=>'',
+    'piwigo_user'=>$fallback_user,
+    'piwigo_password'=>$fallback_password,
+    'api_key_id'=>$api_key_id,
+    'api_key_secret'=>$api_key_secret,
+    'nextcloud_user'=>$username,
+    'nextcloud_password'=>$password,
+  ), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($secret_payload)) throw new RuntimeException('WebDAV-Zugangsdaten konnten nicht serialisiert werden.');
+
+  bratonien_tools_nc_connector_ensure_table();
+  $table = bratonien_tools_nc_connector_table();
+  $now = date('Y-m-d H:i:s');
+  $secret_blob = bratonien_tools_nc_connector_encrypt_secret($secret_payload);
+
+  if ($editing_remote)
+  {
+    $config['state_dir'] = trim((string)($config['state_dir'] ?? '')) !== '' ? $config['state_dir'] : '/var/lib/bratonien-tools/nc-connector/connection-'.$editing_id;
+    $config['status_file'] = trim((string)($config['status_file'] ?? '')) !== '' ? $config['status_file'] : $config['state_dir'].'/connector-status.json';
+    $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+    if (!is_string($config_json)) throw new RuntimeException('WebDAV-Konfiguration konnte nicht serialisiert werden.');
+
+    pwg_query("UPDATE `$table` SET name='".pwg_db_real_escape_string($name)."', config_json='".pwg_db_real_escape_string($config_json)."', secret_blob='".pwg_db_real_escape_string($secret_blob)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".$editing_id." AND adapter='remote' LIMIT 1");
+    unset($_SESSION['bratonien_nc_wizard']);
+
+    return array(
+      'connection_id'=>$editing_id,
+      'message'=>'WebDAV-Verbindung wurde gespeichert.',
+    );
+  }
+
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('WebDAV-Konfiguration konnte nicht serialisiert werden.');
+
+  $connection_key = 'webdav-'.bin2hex(random_bytes(12));
+  pwg_query("INSERT INTO `$table` (connection_key,name,adapter,enabled,takeover_state,config_json,secret_blob,created,updated) VALUES ('"
+    .pwg_db_real_escape_string($connection_key)."','"
+    .pwg_db_real_escape_string($name)."','remote',0,'disabled','"
+    .pwg_db_real_escape_string($config_json)."','"
+    .pwg_db_real_escape_string($secret_blob)."','"
+    .pwg_db_real_escape_string($now)."','"
+    .pwg_db_real_escape_string($now)."')");
+
+  $id = (int)pwg_db_insert_id();
+  if ($id < 1) throw new RuntimeException('Die WebDAV-Verbindung konnte nicht eindeutig angelegt werden.');
+
+  $config['state_dir'] = '/var/lib/bratonien-tools/nc-connector/connection-'.$id;
+  $config['status_file'] = $config['state_dir'].'/connector-status.json';
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('WebDAV-Konfiguration konnte nach dem Anlegen nicht serialisiert werden.');
+  pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$id." AND adapter='remote' LIMIT 1");
+
+  unset($_SESSION['bratonien_nc_wizard']);
+
+  return array(
+    'connection_id'=>$id,
+    'message'=>'WebDAV-Verbindung wurde angelegt.',
+  );
+}

include/nc_connector_wizard.inc.php

@@ -0,0 +1,683 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_state()
+{
+  $state = isset($_SESSION['bratonien_nc_wizard']) && is_array($_SESSION['bratonien_nc_wizard']) ? $_SESSION['bratonien_nc_wizard'] : array();
+
+  return array_merge(array(
+    'step'=>1,
+    'scan_ok'=>false,
+    'base_url'=>'',
+    'host_input'=>'',
+    'username'=>'',
+    'display_name'=>'',
+    'version'=>'',
+    'product'=>'Nextcloud',
+    'users'=>array(),
+    'can_list_users'=>false,
+    'showcase_user'=>'',
+    'connection_name'=>'',
+    'scan_message'=>'',
+    'technical_stage'=>'auto_check',
+    'technical_source'=>'Noch nicht geprüft',
+    'technical_error'=>'',
+    'technical_complete'=>false,
+    'db_host'=>'',
+    'db_port'=>'5432',
+    'db_database'=>'nextcloud',
+    'db_user'=>'',
+    'db_password_set'=>false,
+    'source_view'=>'piwigo_showcase_sources',
+    'activity_view'=>'piwigo_showcase_activity',
+    'gallery_root'=>'',
+    'storages'=>array(),
+    'storage_candidates'=>array(),
+    'api_status'=>'pending',
+    'api_username'=>'',
+    'api_error'=>'',
+    '_password'=>'',
+    '_db_password'=>'',
+    '_api_key_id'=>'',
+    '_api_key_secret'=>'',
+    '_fallback_user'=>'',
+    '_fallback_password'=>'',
+  ), $state);
+}
+
+function bratonien_tools_nc_wizard_store(array $state)
+{
+  $_SESSION['bratonien_nc_wizard'] = $state;
+}
+
+function bratonien_tools_nc_wizard_reset()
+{
+  unset($_SESSION['bratonien_nc_wizard']);
+  return array('message'=>'Verbindungsassistent wurde zurückgesetzt.');
+}
+
+function bratonien_tools_nc_wizard_normalize_url($host)
+{
+  $host = trim((string)$host);
+  if ($host === '') throw new RuntimeException('Nextcloud-Adresse fehlt.');
+  if (!preg_match('#^https?://#i', $host)) $host = 'https://'.$host;
+
+  $parts = parse_url($host);
+  if (!is_array($parts) || empty($parts['host'])) throw new RuntimeException('Die Nextcloud-Adresse ist ungültig.');
+
+  $scheme = strtolower((string)($parts['scheme'] ?? 'https'));
+  if (!in_array($scheme, array('http','https'), true)) throw new RuntimeException('Nextcloud muss per HTTP oder HTTPS erreichbar sein.');
+
+  $url = $scheme.'://'.$parts['host'];
+  if (!empty($parts['port'])) $url .= ':'.(int)$parts['port'];
+  if (!empty($parts['path']) && $parts['path'] !== '/') $url .= '/'.trim($parts['path'], '/');
+
+  return rtrim($url, '/');
+}
+
+function bratonien_tools_nc_wizard_candidate_urls($host)
+{
+  $host = trim((string)$host);
+  if ($host === '') throw new RuntimeException('Bitte die Adresse der Nextcloud angeben.');
+  if (preg_match('#^https?://#i', $host)) return array(bratonien_tools_nc_wizard_normalize_url($host));
+
+  return array(
+    bratonien_tools_nc_wizard_normalize_url('https://'.$host),
+    bratonien_tools_nc_wizard_normalize_url('http://'.$host),
+  );
+}
+
+function bratonien_tools_nc_wizard_http($url, $username = '', $password = '', array $headers = array())
+{
+  if (!function_exists('curl_init')) throw new RuntimeException('Der Server kann Nextcloud derzeit nicht per HTTP prüfen.');
+
+  $ch = curl_init($url);
+  $options = array(
+    CURLOPT_RETURNTRANSFER=>true,
+    CURLOPT_FOLLOWLOCATION=>true,
+    CURLOPT_MAXREDIRS=>3,
+    CURLOPT_CONNECTTIMEOUT=>8,
+    CURLOPT_TIMEOUT=>15,
+    CURLOPT_HTTPHEADER=>array_merge(array('Accept: application/json'), $headers),
+    CURLOPT_USERAGENT=>'Bratonien-Tools-NC-Wizard/'.(function_exists('bratonien_tools_current_version') ? bratonien_tools_current_version() : 'dev'),
+  );
+
+  if ($username !== '')
+  {
+    $options[CURLOPT_HTTPAUTH] = CURLAUTH_BASIC;
+    $options[CURLOPT_USERPWD] = $username.':'.$password;
+  }
+
+  curl_setopt_array($ch, $options);
+  $body = curl_exec($ch);
+  $errno = curl_errno($ch);
+  $status = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  if ($body === false || $errno !== 0) throw new RuntimeException('Verbindung fehlgeschlagen.');
+
+  return array('status'=>$status, 'body'=>(string)$body);
+}
+
+function bratonien_tools_nc_wizard_ocs_data($body)
+{
+  $decoded = json_decode((string)$body, true);
+  if (!is_array($decoded) || !isset($decoded['ocs']) || !is_array($decoded['ocs'])) throw new RuntimeException('Nextcloud hat keine gültige Antwort geliefert.');
+
+  $meta = isset($decoded['ocs']['meta']) && is_array($decoded['ocs']['meta']) ? $decoded['ocs']['meta'] : array();
+  $status = strtolower(trim((string)($meta['status'] ?? '')));
+  $status_code = isset($meta['statuscode']) ? (int)$meta['statuscode'] : 0;
+
+  if ($status !== 'ok' && !in_array($status_code, array(100,200), true))
+  {
+    $message = trim((string)($meta['message'] ?? ''));
+    if ($message === '' || strtolower($message) === 'ok') $message = 'Nextcloud hat die Anfrage abgelehnt.';
+    throw new RuntimeException($message);
+  }
+
+  return isset($decoded['ocs']['data']) && is_array($decoded['ocs']['data']) ? $decoded['ocs']['data'] : array();
+}
+
+function bratonien_tools_nc_wizard_fill_profile(array &$state)
+{
+  $url_host = strtolower((string)parse_url($state['base_url'], PHP_URL_HOST));
+
+  $state['db_host'] = $url_host;
+  $state['db_port'] = '5432';
+  $state['db_database'] = 'nextcloud';
+  $state['db_user'] = (string)$state['username'];
+  $state['_db_password'] = (string)$state['_password'];
+  $state['db_password_set'] = $state['_db_password'] !== '';
+  $state['source_view'] = 'piwigo_showcase_sources';
+  $state['activity_view'] = 'piwigo_showcase_activity';
+  $state['gallery_root'] = rtrim(PHPWG_ROOT_PATH, '/').'/galleries/nextcloud';
+  $state['storages'] = array();
+  $state['storage_candidates'] = array();
+  $state['technical_stage'] = 'auto_check';
+  $state['technical_source'] = 'Automatische Prüfung';
+  $state['technical_error'] = '';
+  $state['technical_complete'] = false;
+
+  foreach (bratonien_tools_nc_connector_connections() as $candidate)
+  {
+    $config = isset($candidate['config']) && is_array($candidate['config']) ? $candidate['config'] : array();
+    $candidate_url = trim((string)($config['nextcloud_url'] ?? ''));
+    $match = false;
+
+    if ($candidate_url !== '')
+    {
+      try
+      {
+        $match = bratonien_tools_nc_wizard_normalize_url($candidate_url) === $state['base_url'];
+      }
+      catch (Throwable $ignored)
+      {
+        $match = false;
+      }
+    }
+
+    if (!$match) continue;
+
+    $state['db_host'] = trim((string)($config['host'] ?? $state['db_host']));
+    $state['db_port'] = trim((string)($config['port'] ?? $state['db_port']));
+    $state['db_database'] = trim((string)($config['database'] ?? $state['db_database']));
+    $state['source_view'] = trim((string)($config['source_view'] ?? $state['source_view']));
+    $state['activity_view'] = trim((string)($config['activity_view'] ?? $state['activity_view']));
+    $state['gallery_root'] = trim((string)($config['gallery_root'] ?? $state['gallery_root']));
+    $state['storages'] = isset($config['storages']) && is_array($config['storages']) ? $config['storages'] : array();
+    $state['storage_candidates'] = $state['storages'];
+    $state['technical_source'] = 'Bekannte Verbindungswerte werden erneut geprüft';
+    break;
+  }
+}
+
+function bratonien_tools_nc_wizard_finish_data_access(array &$state)
+{
+  $config = array(
+    'host'=>$state['db_host'],
+    'port'=>$state['db_port'],
+    'database'=>$state['db_database'],
+    'user'=>$state['db_user'],
+  );
+  $password = (string)$state['_db_password'];
+
+  bratonien_tools_nc_connector_psql($config, $password, 'SELECT 1');
+
+  $source_view = bratonien_tools_nc_connector_view_name($state['source_view']);
+  $activity_view = bratonien_tools_nc_connector_view_name($state['activity_view']);
+  bratonien_tools_nc_connector_psql($config, $password, 'SELECT COUNT(*) FROM '.$source_view);
+  bratonien_tools_nc_connector_psql($config, $password, 'SELECT 1 FROM '.$activity_view.' LIMIT 1');
+
+  $rows = bratonien_tools_nc_connector_psql(
+    $config,
+    $password,
+    "SELECT DISTINCT storage_id::text || E'\\t' || COALESCE(source_path, '') FROM ".$source_view." ORDER BY 1"
+  );
+
+  $candidates = array();
+  foreach (preg_split('/\r\n|\r|\n/', trim($rows)) as $line)
+  {
+    if ($line === '') continue;
+
+    $parts = explode("\t", $line, 2);
+    if (count($parts) !== 2) continue;
+
+    $storage_id = trim($parts[0]);
+    $source_path = trim($parts[1], '/');
+    if ($storage_id === '') continue;
+
+    $prefix = $source_path;
+    if (strpos($source_path, '/') !== false) $prefix = substr($source_path, 0, strpos($source_path, '/'));
+
+    if (!isset($candidates[$storage_id]))
+    {
+      $candidates[$storage_id] = array(
+        'storage_id'=>$storage_id,
+        'source_prefix'=>$prefix,
+        'local_mount'=>'',
+      );
+    }
+  }
+
+  if (!$candidates) throw new RuntimeException('Die Verbindung zur Datenquelle funktioniert, aber es wurden noch keine freigegebenen Speicherorte gefunden.');
+
+  $known = array();
+  foreach (bratonien_tools_nc_connector_connections() as $connection)
+  {
+    foreach (($connection['config']['storages'] ?? array()) as $storage)
+    {
+      $key = (string)($storage['storage_id'] ?? '').'|'.trim((string)($storage['source_prefix'] ?? ''), '/');
+      if ($key !== '|') $known[$key] = (string)($storage['local_mount'] ?? '');
+    }
+  }
+
+  foreach ($candidates as &$candidate)
+  {
+    $key = $candidate['storage_id'].'|'.trim($candidate['source_prefix'], '/');
+    if (!empty($known[$key]) && is_dir($known[$key]) && is_readable($known[$key])) $candidate['local_mount'] = $known[$key];
+  }
+  unset($candidate);
+
+  $state['storage_candidates'] = array_values($candidates);
+  $state['storages'] = array_values(array_filter($state['storage_candidates'], function($storage) {
+    return trim((string)($storage['local_mount'] ?? '')) !== '';
+  }));
+  $state['technical_error'] = '';
+  $state['technical_source'] = 'Datenzugriff erfolgreich geprüft';
+  $state['technical_complete'] = count($state['storages']) === count($state['storage_candidates']);
+  $state['technical_stage'] = $state['technical_complete'] ? 'ready' : 'mounts';
+}
+
+function bratonien_tools_nc_wizard_scan()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $host_input = trim((string)($_POST['nc_wizard_host'] ?? $state['host_input']));
+  $username = trim((string)($_POST['nc_wizard_user'] ?? $state['username']));
+  $password = array_key_exists('nc_wizard_password', $_POST) ? (string)$_POST['nc_wizard_password'] : (string)$state['_password'];
+
+  $state['step'] = 1;
+  $state['host_input'] = $host_input;
+  $state['username'] = $username;
+  $state['_password'] = $password;
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($username === '' || $password === '') throw new RuntimeException('Nextcloud-Benutzer und Passwort werden für den Scan benötigt.');
+
+  $base_url = '';
+  $status_data = null;
+  foreach (bratonien_tools_nc_wizard_candidate_urls($host_input) as $candidate_url)
+  {
+    try
+    {
+      $response = bratonien_tools_nc_wizard_http($candidate_url.'/status.php');
+      if ($response['status'] < 200 || $response['status'] >= 300) continue;
+
+      $candidate_status = json_decode($response['body'], true);
+      if (!is_array($candidate_status) || empty($candidate_status['installed'])) continue;
+
+      $base_url = $candidate_url;
+      $status_data = $candidate_status;
+      break;
+    }
+    catch (Throwable $ignored)
+    {
+    }
+  }
+
+  if ($base_url === '' || !is_array($status_data)) throw new RuntimeException('Unter dieser Adresse konnte keine Nextcloud erreicht werden. HTTP und HTTPS wurden automatisch geprüft.');
+
+  $user_response = bratonien_tools_nc_wizard_http(
+    $base_url.'/ocs/v2.php/cloud/user?format=json',
+    $username,
+    $password,
+    array('OCS-APIRequest: true')
+  );
+
+  if ($user_response['status'] === 401 || $user_response['status'] === 403) throw new RuntimeException('Nextcloud hat Benutzername oder Passwort abgelehnt.');
+  if ($user_response['status'] < 200 || $user_response['status'] >= 300) throw new RuntimeException('Nextcloud ist erreichbar, aber die Anmeldung konnte nicht geprüft werden.');
+
+  $user_data = bratonien_tools_nc_wizard_ocs_data($user_response['body']);
+
+  $users = array();
+  $can_list_users = false;
+  try
+  {
+    $users_response = bratonien_tools_nc_wizard_http(
+      $base_url.'/ocs/v2.php/cloud/users?format=json',
+      $username,
+      $password,
+      array('OCS-APIRequest: true')
+    );
+
+    if ($users_response['status'] >= 200 && $users_response['status'] < 300)
+    {
+      $users_data = bratonien_tools_nc_wizard_ocs_data($users_response['body']);
+      if (isset($users_data['users']) && is_array($users_data['users']))
+      {
+        $users = array_values(array_filter(array_map('strval', $users_data['users'])));
+        sort($users, SORT_NATURAL | SORT_FLAG_CASE);
+        $can_list_users = true;
+      }
+    }
+  }
+  catch (Throwable $ignored)
+  {
+  }
+
+  $resolved_username = trim((string)($user_data['id'] ?? $username));
+  if ($resolved_username === '') $resolved_username = $username;
+  $url_host = (string)parse_url($base_url, PHP_URL_HOST);
+
+  $state = array_merge($state, array(
+    'step'=>2,
+    'scan_ok'=>true,
+    'base_url'=>$base_url,
+    'host_input'=>$host_input,
+    'username'=>$resolved_username,
+    'display_name'=>(string)($user_data['display-name'] ?? $user_data['displayname'] ?? ''),
+    'version'=>(string)($status_data['versionstring'] ?? $status_data['version'] ?? ''),
+    'product'=>(string)($status_data['productname'] ?? 'Nextcloud'),
+    'users'=>$users,
+    'can_list_users'=>$can_list_users,
+    'showcase_user'=>'',
+    'connection_name'=>$url_host !== '' ? $url_host : 'Nextcloud',
+    'scan_message'=>'Nextcloud wurde erkannt und der Benutzerzugriff wurde bestätigt.',
+    '_password'=>$password,
+    'api_status'=>'pending',
+    'api_username'=>'',
+    'api_error'=>'',
+  ));
+
+  bratonien_tools_nc_wizard_fill_profile($state);
+
+  try
+  {
+    bratonien_tools_nc_wizard_finish_data_access($state);
+  }
+  catch (Throwable $e)
+  {
+    $state['technical_complete'] = false;
+    $state['technical_stage'] = 'database_details';
+    $state['technical_error'] = $e->getMessage();
+  }
+
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($state['technical_stage'] === 'database_details')
+  {
+    return array('message'=>'Nextcloud wurde gefunden. Die Datenbank-Adresse muss noch bestätigt werden.');
+  }
+  if ($state['technical_stage'] === 'mounts')
+  {
+    return array('message'=>'Nextcloud und Datenzugriff wurden bestätigt. Ein Speicherort muss noch zugeordnet werden.');
+  }
+
+  return array('message'=>'Nextcloud und Datenzugriff wurden erfolgreich bestätigt.');
+}
+
+function bratonien_tools_nc_wizard_save_technical()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if (empty($state['scan_ok'])) throw new RuntimeException('Bitte zuerst Nextcloud erfolgreich scannen.');
+  if ((string)$state['username'] === '' || (string)$state['_password'] === '') throw new RuntimeException('Die Zugangsdaten aus dem ersten Schritt sind nicht mehr verfügbar. Bitte den Assistenten neu starten.');
+
+  $state['db_user'] = (string)$state['username'];
+  $state['_db_password'] = (string)$state['_password'];
+  $state['db_password_set'] = true;
+  $state['db_host'] = trim((string)($_POST['nc_wizard_db_host'] ?? $state['db_host']));
+  $state['db_port'] = (string)max(1, min(65535, (int)($_POST['nc_wizard_db_port'] ?? $state['db_port'])));
+  $state['db_database'] = trim((string)($_POST['nc_wizard_db_database'] ?? $state['db_database']));
+  $state['technical_stage'] = 'database_details';
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($state['db_host'] === '' || $state['db_database'] === '') throw new RuntimeException('Die Adresse der Datenbank ist noch unvollständig.');
+
+  try
+  {
+    bratonien_tools_nc_wizard_finish_data_access($state);
+    bratonien_tools_nc_wizard_store($state);
+
+    return array(
+      'message'=>$state['technical_complete']
+        ? 'Datenzugriff wurde erfolgreich geprüft.'
+        : 'Datenzugriff funktioniert. Ein Speicherort muss noch bestätigt werden.'
+    );
+  }
+  catch (Throwable $e)
+  {
+    $state['technical_error'] = $e->getMessage();
+    $state['technical_stage'] = 'database_details';
+    bratonien_tools_nc_wizard_store($state);
+    throw $e;
+  }
+}
+
+function bratonien_tools_nc_wizard_save_mounts()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $candidates = is_array($state['storage_candidates']) ? $state['storage_candidates'] : array();
+  $mounts = isset($_POST['nc_wizard_storage_mount']) && is_array($_POST['nc_wizard_storage_mount']) ? $_POST['nc_wizard_storage_mount'] : array();
+
+  if (!$candidates) throw new RuntimeException('Es wurden noch keine Speicherorte erkannt.');
+
+  $storages = array();
+  foreach ($candidates as $index=>$candidate)
+  {
+    $mount = trim((string)($candidate['local_mount'] ?? ''));
+    if ($mount === '') $mount = trim((string)($mounts[$index] ?? ''));
+    if ($mount === '' || $mount[0] !== '/') throw new RuntimeException('Für einen Speicherort fehlt ein gültiger lokaler Pfad.');
+
+    $mount = rtrim($mount, '/');
+    if (!is_dir($mount) || !is_readable($mount)) throw new RuntimeException('Der angegebene Speicherort ist nicht vorhanden oder nicht lesbar: '.$mount);
+
+    $candidate['local_mount'] = $mount;
+    $storages[] = $candidate;
+  }
+
+  $state['storages'] = $storages;
+  $state['storage_candidates'] = $storages;
+  $state['technical_complete'] = true;
+  $state['technical_stage'] = 'ready';
+  $state['technical_error'] = '';
+  bratonien_tools_nc_wizard_store($state);
+
+  return array('message'=>'Speicherzuordnung wurde erfolgreich geprüft.');
+}
+
+function bratonien_tools_nc_wizard_select_user()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if (empty($state['scan_ok'])) throw new RuntimeException('Bitte zuerst Nextcloud erfolgreich scannen.');
+  if (empty($state['technical_complete'])) throw new RuntimeException('Die Verbindung ist noch nicht vollständig geprüft.');
+
+  $showcase_user = trim((string)($_POST['nc_wizard_showcase_user'] ?? ''));
+  $connection_name = trim((string)($_POST['nc_wizard_connection_name'] ?? $state['connection_name']));
+  if ($showcase_user === '') throw new RuntimeException('Bitte den Benutzer auswählen, der die Showcase-Freigaben bereitstellt.');
+  if ($connection_name === '') throw new RuntimeException('Bitte einen Namen für die Verbindung angeben.');
+
+  $state['connection_name'] = $connection_name;
+  $state['showcase_user'] = $showcase_user;
+  $state['step'] = 3;
+  $state['api_error'] = '';
+  bratonien_tools_nc_wizard_store($state);
+
+  return array('message'=>'Showcase-Benutzer übernommen. Jetzt folgt der Piwigo-API-Zugang.');
+}
+
+function bratonien_tools_nc_wizard_api_test()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 3) throw new RuntimeException('Der API-Test ist in diesem Assistentenschritt nicht verfügbar.');
+
+  $posted_id = trim((string)($_POST['nc_wizard_api_key_id'] ?? ''));
+  $posted_secret = trim((string)($_POST['nc_wizard_api_key_secret'] ?? ''));
+  if ($posted_id !== '') $state['_api_key_id'] = $posted_id;
+  if ($posted_secret !== '') $state['_api_key_secret'] = $posted_secret;
+  bratonien_tools_nc_wizard_store($state);
+
+  $key_id = trim((string)$state['_api_key_id']);
+  $secret = trim((string)$state['_api_key_secret']);
+
+  if ($key_id === '' && $secret === '')
+  {
+    $stored = bratonien_tools_nc_api_credentials();
+    $key_id = trim((string)($stored['key_id'] ?? ''));
+    $secret = trim((string)($stored['key_secret'] ?? ''));
+  }
+
+  if ($key_id === '' || $secret === '') throw new RuntimeException('API-Schlüssel-ID und API-Geheimnis fehlen.');
+
+  try
+  {
+    $status = bratonien_tools_nc_connector_piwigo_api_request($key_id, $secret, 'pwg.session.getStatus');
+    $user_status = strtolower((string)($status['status'] ?? ''));
+    if (!in_array($user_status, array('admin','webmaster'), true)) throw new RuntimeException('Der API-Key gehört keinem Piwigo-Administrator/Webmaster.');
+
+    $method_result = bratonien_tools_nc_connector_piwigo_api_request($key_id, $secret, 'reflection.getMethodList');
+    $method_map = array();
+    bratonien_tools_nc_connector_collect_method_names($method_result, $method_map);
+    $missing = array_values(array_diff(array('bratonien.nc.syncProductive','bratonien.nc.syncOrphans'), array_keys($method_map)));
+    if ($missing) throw new RuntimeException('Benötigte Bratonien-Sync-Methoden fehlen: '.implode(', ', $missing).'.');
+
+    $state['_api_key_id'] = $key_id;
+    $state['_api_key_secret'] = $secret;
+    $state['api_status'] = 'ok';
+    $state['api_username'] = (string)($status['username'] ?? $status['user'] ?? '');
+    $state['api_error'] = '';
+    $state['step'] = 4;
+    bratonien_tools_nc_wizard_store($state);
+
+    return array('message'=>'Piwigo-API erfolgreich geprüft. Gespeichert wird sie erst beim Abschluss des Assistenten.');
+  }
+  catch (Throwable $e)
+  {
+    $state['api_status'] = 'error';
+    $state['api_error'] = $e->getMessage();
+    bratonien_tools_nc_wizard_store($state);
+    throw $e;
+  }
+}
+
+function bratonien_tools_nc_wizard_api_skip()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 3) throw new RuntimeException('Die API kann in diesem Assistentenschritt nicht übersprungen werden.');
+
+  $state['api_status'] = 'skipped';
+  $state['api_error'] = '';
+  $state['step'] = 4;
+  bratonien_tools_nc_wizard_store($state);
+
+  return array('message'=>'Piwigo-API wurde übersprungen. Für diese Verbindung ist deshalb ein Fallback-Zugang erforderlich.');
+}
+
+function bratonien_tools_nc_wizard_finish()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 4 || empty($state['technical_complete']) || trim((string)$state['showcase_user']) === '') throw new RuntimeException('Der Assistent ist noch nicht vollständig.');
+
+  if (array_key_exists('nc_wizard_fallback_user', $_POST)) $state['_fallback_user'] = trim((string)$_POST['nc_wizard_fallback_user']);
+  if (array_key_exists('nc_wizard_fallback_password', $_POST)) $state['_fallback_password'] = (string)$_POST['nc_wizard_fallback_password'];
+  bratonien_tools_nc_wizard_store($state);
+
+  $fallback_user = trim((string)$state['_fallback_user']);
+  $fallback_password = (string)$state['_fallback_password'];
+  if (($fallback_user === '') !== ($fallback_password === '')) throw new RuntimeException('Fallback-Benutzer und Fallback-Passwort müssen entweder beide angegeben oder beide leer gelassen werden.');
+  if ($state['api_status'] !== 'ok' && $fallback_user === '') throw new RuntimeException('Da die Piwigo-API übersprungen wurde, ist ein Fallback-Zugang erforderlich.');
+
+  $storage_lines = array();
+  foreach ($state['storages'] as $storage)
+  {
+    $storage_lines[] = (string)$storage['storage_id'].' | '.trim((string)$storage['source_prefix'], '/').' | '.(string)$storage['local_mount'];
+  }
+
+  $_POST['nc_name'] = (string)$state['connection_name'];
+  $_POST['nc_host'] = (string)$state['db_host'];
+  $_POST['nc_port'] = (string)$state['db_port'];
+  $_POST['nc_database'] = (string)$state['db_database'];
+  $_POST['nc_user'] = (string)$state['db_user'];
+  $_POST['nc_db_password'] = (string)$state['_db_password'];
+  $_POST['nc_source_view'] = (string)$state['source_view'];
+  $_POST['nc_activity_view'] = (string)$state['activity_view'];
+  $_POST['nc_gallery_root'] = (string)$state['gallery_root'];
+  $_POST['nc_storages'] = implode("\n", $storage_lines);
+  $_POST['nc_quiet_seconds'] = '120';
+  $_POST['nc_max_wait_seconds'] = '900';
+  $_POST['nc_full_sync_seconds'] = '86400';
+  $_POST['nc_piwigo_user'] = $fallback_user;
+  $_POST['nc_piwigo_password'] = $fallback_password;
+  $_POST['nc_nextcloud_url'] = (string)$state['base_url'];
+  $_POST['nc_showcase_user'] = (string)$state['showcase_user'];
+  $_POST['nc_access_user'] = (string)$state['username'];
+  $_POST['nc_product'] = (string)$state['product'];
+  $_POST['nc_version'] = (string)$state['version'];
+  $_POST['nc_api_validated'] = $state['api_status'] === 'ok' ? '1' : '0';
+
+  $result = bratonien_tools_nc_connector_create_local_api_first();
+  $connection_id = (int)($result['connection_id'] ?? 0);
+
+  try
+  {
+    if ($state['api_status'] === 'ok') bratonien_tools_nc_api_credentials_store((string)$state['_api_key_id'], (string)$state['_api_key_secret']);
+  }
+  catch (Throwable $e)
+  {
+    if ($connection_id > 0)
+    {
+      $table = bratonien_tools_nc_connector_table();
+      pwg_query("DELETE FROM `$table` WHERE id=".$connection_id." LIMIT 1");
+    }
+    throw new RuntimeException('Die Verbindung wurde nicht übernommen, weil der geprüfte API-Zugang nicht gespeichert werden konnte: '.$e->getMessage());
+  }
+
+  unset($_SESSION['bratonien_nc_wizard']);
+  unset($result['connection_id']);
+  $result['message'] = 'Verbindung wurde vollständig durch den Assistenten angelegt. '.$result['message'];
+
+  return $result;
+}
+
+function bratonien_tools_nc_connector_update_name()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $name = trim((string)($_POST['connection_name'] ?? ''));
+  if ($id < 1 || $name === '') throw new RuntimeException('Verbindung oder Name fehlt.');
+
+  $connection = bratonien_tools_nc_connector_connection($id, false);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+
+  $table = bratonien_tools_nc_connector_table();
+  $now = date('Y-m-d H:i:s');
+  pwg_query("UPDATE `$table` SET name='".pwg_db_real_escape_string($name)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".$id." LIMIT 1");
+
+  return array('message'=>'Verbindungsname wurde aktualisiert.');
+}
+
+function bratonien_tools_nc_connector_update_technical()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+  if (!empty($connection['enabled']) || (string)$connection['takeover_state'] === 'active') throw new RuntimeException('Technische Einstellungen einer aktiven Verbindung können nicht geändert werden. Bitte zuerst deaktivieren.');
+
+  $config = $connection['config'];
+  $port = (int)($_POST['nc_port'] ?? ($config['port'] ?? 5432));
+  if ($port < 1 || $port > 65535) throw new RuntimeException('Ungültiger PostgreSQL-Port.');
+
+  $gallery_root = rtrim(trim((string)($_POST['nc_gallery_root'] ?? ($config['gallery_root'] ?? ''))), '/');
+  if ($gallery_root === '' || $gallery_root[0] !== '/') throw new RuntimeException('Der Galerie-Pfad muss ein absoluter Pfad sein.');
+
+  $config['host'] = trim((string)($_POST['nc_host'] ?? ($config['host'] ?? '')));
+  $config['port'] = (string)$port;
+  $config['database'] = trim((string)($_POST['nc_database'] ?? ($config['database'] ?? '')));
+  $config['user'] = trim((string)($_POST['nc_user'] ?? ($config['user'] ?? '')));
+  $config['source_view'] = trim((string)($_POST['nc_source_view'] ?? ($config['source_view'] ?? '')));
+  $config['activity_view'] = trim((string)($_POST['nc_activity_view'] ?? ($config['activity_view'] ?? '')));
+  $config['gallery_root'] = $gallery_root;
+  $config['quiet_seconds'] = max(0, (int)($_POST['nc_quiet_seconds'] ?? ($config['quiet_seconds'] ?? 120)));
+  $config['max_wait_seconds'] = max(60, (int)($_POST['nc_max_wait_seconds'] ?? ($config['max_wait_seconds'] ?? 900)));
+  $config['full_sync_seconds'] = max(300, (int)($_POST['nc_full_sync_seconds'] ?? ($config['full_sync_seconds'] ?? 86400)));
+  $config['storages'] = bratonien_tools_nc_connector_parse_storages($_POST['nc_storages'] ?? '');
+  unset($config['verification']);
+
+  bratonien_tools_nc_connector_view_name($config['source_view']);
+  bratonien_tools_nc_connector_view_name($config['activity_view']);
+
+  $credentials = bratonien_tools_nc_connector_credentials_from_blob($connection['secret_blob'] ?? '');
+  $db_password = (string)($_POST['nc_db_password'] ?? '');
+  if ($db_password === '') $db_password = $credentials['db_password'];
+  if ($db_password === '') throw new RuntimeException('Datenbankpasswort fehlt.');
+
+  $secret_blob = bratonien_tools_nc_connector_encrypt_credentials($db_password, $credentials['piwigo_user'], $credentials['piwigo_password']);
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Connector-Konfiguration konnte nicht serialisiert werden.');
+
+  $table = bratonien_tools_nc_connector_table();
+  $now = date('Y-m-d H:i:s');
+  pwg_query("UPDATE `$table` SET takeover_state='disabled', enabled=0, config_json='".pwg_db_real_escape_string($config_json)."', secret_blob='".pwg_db_real_escape_string($secret_blob)."', updated='".pwg_db_real_escape_string($now)."' WHERE id=".$id." LIMIT 1");
+
+  return array('message'=>'Technische Verbindungseinstellungen wurden gespeichert. Die Verbindung muss erneut geprüft werden.');
+}

include/nc_connector_wizard_db_bridge.inc.php

@@ -0,0 +1,448 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_apply_known_database_profile(array &$state)
+{
+  if (empty($state['scan_ok']) || trim((string)($state['base_url'] ?? '')) === '') return false;
+
+  $base_host = strtolower(trim((string)parse_url((string)$state['base_url'], PHP_URL_HOST)));
+
+  foreach (bratonien_tools_nc_connector_connections() as $candidate)
+  {
+    $config = isset($candidate['config']) && is_array($candidate['config']) ? $candidate['config'] : array();
+    $candidate_url = trim((string)($config['nextcloud_url'] ?? ''));
+    $match = false;
+
+    if ($candidate_url !== '')
+    {
+      try
+      {
+        $match = bratonien_tools_nc_wizard_normalize_url($candidate_url) === (string)$state['base_url'];
+      }
+      catch (Throwable $ignored)
+      {
+        $match = false;
+      }
+    }
+    elseif ($base_host !== '')
+    {
+      $match = strtolower(trim((string)($config['host'] ?? ''))) === $base_host;
+    }
+
+    if (!$match) continue;
+
+    $connection = bratonien_tools_nc_connector_connection((int)$candidate['id'], true);
+    if (!$connection || !is_array($connection['config'] ?? null)) continue;
+
+    $known = $connection['config'];
+    $db_user = trim((string)($known['user'] ?? ''));
+    if ($db_user === '') continue;
+
+    $db_password = '';
+    try
+    {
+      $plain = bratonien_tools_nc_connector_decrypt_secret($connection['secret_blob'] ?? '');
+      $decoded = json_decode($plain, true);
+      $db_password = is_array($decoded) && array_key_exists('db_password', $decoded)
+        ? (string)$decoded['db_password']
+        : (string)$plain;
+    }
+    catch (Throwable $ignored)
+    {
+      $db_password = '';
+    }
+    if ($db_password === '') continue;
+
+    $state['db_host'] = trim((string)($known['host'] ?? $state['db_host']));
+    $state['db_port'] = trim((string)($known['port'] ?? $state['db_port']));
+    $state['db_database'] = trim((string)($known['database'] ?? $state['db_database']));
+    $state['db_user'] = $db_user;
+    $state['_db_password'] = $db_password;
+    $state['db_password_set'] = true;
+    $state['source_view'] = trim((string)($known['source_view'] ?? $state['source_view']));
+    $state['activity_view'] = trim((string)($known['activity_view'] ?? $state['activity_view']));
+    $state['gallery_root'] = trim((string)($known['gallery_root'] ?? $state['gallery_root']));
+    $state['storages'] = isset($known['storages']) && is_array($known['storages']) ? $known['storages'] : array();
+    $state['storage_candidates'] = $state['storages'];
+    $state['technical_source'] = 'Gespeicherte Reader-Verbindung wird erneut geprüft';
+    $state['technical_error'] = '';
+    return true;
+  }
+
+  return false;
+}
+
+function bratonien_tools_nc_wizard_prepare_directory_stage(array &$state, array $known_storages)
+{
+  if ((string)($state['technical_stage'] ?? '') === 'database_details') return;
+
+  $known_by_storage = array();
+  foreach ($known_storages as $known)
+  {
+    $storage_id = trim((string)($known['storage_id'] ?? ''));
+    $mount = rtrim(trim((string)($known['local_mount'] ?? '')), '/');
+    if ($storage_id === '' || $mount === '') continue;
+    if (!isset($known_by_storage[$storage_id])) $known_by_storage[$storage_id] = $known;
+  }
+
+  $candidates = isset($state['storage_candidates']) && is_array($state['storage_candidates']) ? $state['storage_candidates'] : array();
+  $all_mapped = !empty($candidates);
+
+  foreach ($candidates as &$candidate)
+  {
+    $storage_id = trim((string)($candidate['storage_id'] ?? ''));
+    $known = isset($known_by_storage[$storage_id]) ? $known_by_storage[$storage_id] : null;
+    if (is_array($known))
+    {
+      $candidate['source_prefix'] = trim((string)($known['source_prefix'] ?? $candidate['source_prefix'] ?? ''), '/');
+      $candidate['local_mount'] = rtrim(trim((string)($known['local_mount'] ?? '')), '/');
+    }
+
+    $mount = trim((string)($candidate['local_mount'] ?? ''));
+    if ($mount === '' || !is_dir($mount) || !is_readable($mount)) $all_mapped = false;
+    $candidate['include_prefix'] = '';
+  }
+  unset($candidate);
+
+  $state['storage_candidates'] = $candidates;
+  $state['storages'] = array();
+  $state['technical_complete'] = false;
+  $state['technical_stage'] = 'mounts';
+  $state['technical_source'] = $all_mapped
+    ? 'Datenzugriff und Speicherzuordnung erkannt; Verzeichnisauswahl offen'
+    : 'Datenzugriff erkannt; Speicherzuordnung muss bestätigt werden';
+  $state['directory_selection_ready'] = $all_mapped;
+}
+
+function bratonien_tools_nc_wizard_finish_data_access_for_selection(array &$state, array $known_storages)
+{
+  bratonien_tools_nc_wizard_finish_data_access($state);
+  bratonien_tools_nc_wizard_prepare_directory_stage($state, $known_storages);
+}
+
+function bratonien_tools_nc_wizard_scan_with_known_database()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $host_input = trim((string)($_POST['nc_wizard_host'] ?? $state['host_input']));
+  $username = trim((string)($_POST['nc_wizard_user'] ?? $state['username']));
+  $password = array_key_exists('nc_wizard_password', $_POST) ? (string)$_POST['nc_wizard_password'] : (string)$state['_password'];
+
+  $state['step'] = 1;
+  $state['host_input'] = $host_input;
+  $state['username'] = $username;
+  $state['_password'] = $password;
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($username === '' || $password === '') throw new RuntimeException('Nextcloud-Benutzer und Passwort werden für den Scan benötigt.');
+
+  $base_url = '';
+  $status_data = null;
+  foreach (bratonien_tools_nc_wizard_candidate_urls($host_input) as $candidate_url)
+  {
+    try
+    {
+      $response = bratonien_tools_nc_wizard_http($candidate_url.'/status.php');
+      if ($response['status'] < 200 || $response['status'] >= 300) continue;
+      $candidate_status = json_decode($response['body'], true);
+      if (!is_array($candidate_status) || empty($candidate_status['installed'])) continue;
+      $base_url = $candidate_url;
+      $status_data = $candidate_status;
+      break;
+    }
+    catch (Throwable $ignored)
+    {
+    }
+  }
+
+  if ($base_url === '' || !is_array($status_data)) throw new RuntimeException('Unter dieser Adresse konnte keine Nextcloud erreicht werden. HTTP und HTTPS wurden automatisch geprüft.');
+
+  $user_response = bratonien_tools_nc_wizard_http(
+    $base_url.'/ocs/v2.php/cloud/user?format=json',
+    $username,
+    $password,
+    array('OCS-APIRequest: true')
+  );
+  if ($user_response['status'] === 401 || $user_response['status'] === 403) throw new RuntimeException('Nextcloud hat Benutzername oder Passwort abgelehnt.');
+  if ($user_response['status'] < 200 || $user_response['status'] >= 300) throw new RuntimeException('Nextcloud ist erreichbar, aber die Anmeldung konnte nicht geprüft werden.');
+
+  $user_data = bratonien_tools_nc_wizard_ocs_data($user_response['body']);
+  $users = array();
+  $can_list_users = false;
+  try
+  {
+    $users_response = bratonien_tools_nc_wizard_http(
+      $base_url.'/ocs/v2.php/cloud/users?format=json',
+      $username,
+      $password,
+      array('OCS-APIRequest: true')
+    );
+    if ($users_response['status'] >= 200 && $users_response['status'] < 300)
+    {
+      $users_data = bratonien_tools_nc_wizard_ocs_data($users_response['body']);
+      if (isset($users_data['users']) && is_array($users_data['users']))
+      {
+        $users = array_values(array_filter(array_map('strval', $users_data['users'])));
+        sort($users, SORT_NATURAL | SORT_FLAG_CASE);
+        $can_list_users = true;
+      }
+    }
+  }
+  catch (Throwable $ignored)
+  {
+  }
+
+  $resolved_username = trim((string)($user_data['id'] ?? $username));
+  if ($resolved_username === '') $resolved_username = $username;
+  $url_host = (string)parse_url($base_url, PHP_URL_HOST);
+
+  $state = array_merge($state, array(
+    'step'=>2,
+    'scan_ok'=>true,
+    'base_url'=>$base_url,
+    'host_input'=>$host_input,
+    'username'=>$resolved_username,
+    'display_name'=>(string)($user_data['display-name'] ?? $user_data['displayname'] ?? ''),
+    'version'=>(string)($status_data['versionstring'] ?? $status_data['version'] ?? ''),
+    'product'=>(string)($status_data['productname'] ?? 'Nextcloud'),
+    'users'=>$users,
+    'can_list_users'=>$can_list_users,
+    'showcase_user'=>'',
+    'connection_name'=>$url_host !== '' ? $url_host : 'Nextcloud',
+    'scan_message'=>'Nextcloud wurde erkannt und der Benutzerzugriff wurde bestätigt.',
+    '_password'=>$password,
+    'api_status'=>'pending','api_username'=>'','api_error'=>'',
+    'db_host'=>strtolower($url_host),'db_port'=>'5432','db_database'=>'nextcloud','db_user'=>'','db_password_set'=>false,'_db_password'=>'',
+    'source_view'=>'piwigo_showcase_sources','activity_view'=>'piwigo_showcase_activity',
+    'gallery_root'=>rtrim(PHPWG_ROOT_PATH, '/').'/galleries/nextcloud',
+    'storages'=>array(),'storage_candidates'=>array(),
+    'technical_stage'=>'auto_check','technical_source'=>'Automatische Prüfung','technical_error'=>'','technical_complete'=>false,
+    'directory_selection_ready'=>false,
+  ));
+
+  if (!bratonien_tools_nc_wizard_apply_known_database_profile($state))
+  {
+    $state['technical_stage'] = 'database_details';
+    $state['technical_source'] = 'Keine bekannte Reader-Verbindung gefunden';
+    $state['technical_error'] = 'Für diese Nextcloud ist noch keine bekannte Datenbank-Reader-Verbindung gespeichert. Die Nextcloud-Anmeldedaten werden nicht als PostgreSQL-Zugang verwendet.';
+    bratonien_tools_nc_wizard_store($state);
+    return array('message'=>'Nextcloud wurde gefunden. Für den Datenzugriff wird eine separate Reader-Verbindung benötigt.');
+  }
+
+  $known_storages = isset($state['storages']) && is_array($state['storages']) ? $state['storages'] : array();
+  try
+  {
+    bratonien_tools_nc_wizard_finish_data_access_for_selection($state, $known_storages);
+  }
+  catch (Throwable $e)
+  {
+    $state['technical_complete'] = false;
+    $state['technical_stage'] = 'database_details';
+    $state['technical_error'] = $e->getMessage();
+  }
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($state['technical_stage'] === 'database_details') return array('message'=>'Nextcloud wurde gefunden. Die bekannte Reader-Verbindung konnte noch nicht vollständig bestätigt werden.');
+  return array('message'=>'Nextcloud und Datenzugriff wurden bestätigt. Jetzt können die gewünschten Verzeichnisse gewählt werden.');
+}
+
+function bratonien_tools_nc_wizard_save_technical_with_known_database()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if (empty($state['scan_ok'])) throw new RuntimeException('Bitte zuerst Nextcloud erfolgreich scannen.');
+  if (trim((string)($state['db_user'] ?? '')) === '' || (string)($state['_db_password'] ?? '') === '') bratonien_tools_nc_wizard_apply_known_database_profile($state);
+  if (trim((string)($state['db_user'] ?? '')) === '' || (string)($state['_db_password'] ?? '') === '') throw new RuntimeException('Für diese Nextcloud sind noch keine Datenbank-Reader-Zugangsdaten bekannt. Nextcloud-Benutzer und -Passwort werden dafür bewusst nicht verwendet.');
+
+  $known_storages = isset($state['storages']) && is_array($state['storages']) ? $state['storages'] : array();
+  $state['db_host'] = trim((string)($_POST['nc_wizard_db_host'] ?? $state['db_host']));
+  $state['db_port'] = (string)max(1, min(65535, (int)($_POST['nc_wizard_db_port'] ?? $state['db_port'])));
+  $state['db_database'] = trim((string)($_POST['nc_wizard_db_database'] ?? $state['db_database']));
+  if ($state['db_host'] === '' || $state['db_database'] === '') throw new RuntimeException('Die Adresse der Datenbank ist noch unvollständig.');
+
+  try
+  {
+    bratonien_tools_nc_wizard_finish_data_access_for_selection($state, $known_storages);
+    bratonien_tools_nc_wizard_store($state);
+    return array('message'=>'Datenzugriff wurde erfolgreich geprüft. Jetzt können die gewünschten Verzeichnisse gewählt werden.');
+  }
+  catch (Throwable $e)
+  {
+    $state['technical_error'] = $e->getMessage();
+    $state['technical_stage'] = 'database_details';
+    bratonien_tools_nc_wizard_store($state);
+    throw $e;
+  }
+}
+
+function bratonien_tools_nc_wizard_directory_options(array $state)
+{
+  if (empty($state['scan_ok']) || trim((string)($state['db_user'] ?? '')) === '' || (string)($state['_db_password'] ?? '') === '') return array();
+
+  $config = array('host'=>$state['db_host'],'port'=>$state['db_port'],'database'=>$state['db_database'],'user'=>$state['db_user']);
+  $source_view = bratonien_tools_nc_connector_view_name($state['source_view']);
+  $rows = bratonien_tools_nc_connector_psql($config, (string)$state['_db_password'], "SELECT DISTINCT storage_id::text || E'\\t' || COALESCE(source_path, '') FROM ".$source_view." ORDER BY 1");
+
+  $paths = array();
+  foreach (preg_split('/\r\n|\r|\n/', trim($rows)) as $line)
+  {
+    if ($line === '') continue;
+    $parts = explode("\t", $line, 2);
+    if (count($parts) !== 2) continue;
+    $storage_id = trim($parts[0]);
+    $source_path = trim($parts[1], '/');
+    if ($storage_id === '') continue;
+    if (!isset($paths[$storage_id])) $paths[$storage_id] = array();
+    $paths[$storage_id][] = $source_path;
+  }
+
+  $result = array();
+  foreach ((array)($state['storage_candidates'] ?? array()) as $index=>$candidate)
+  {
+    $storage_id = trim((string)($candidate['storage_id'] ?? ''));
+    $mapping_prefix = trim((string)($candidate['source_prefix'] ?? ''), '/');
+    $options = array(''=>'Stammverzeichnis');
+
+    foreach (($paths[$storage_id] ?? array()) as $source_path)
+    {
+      $relative = $source_path;
+      if ($mapping_prefix !== '')
+      {
+        if ($source_path === $mapping_prefix) $relative = '';
+        elseif (strpos($source_path, $mapping_prefix.'/') === 0) $relative = substr($source_path, strlen($mapping_prefix) + 1);
+        else continue;
+      }
+      $relative = trim($relative, '/');
+      if ($relative === '') continue;
+      $segments = explode('/', $relative);
+      $current = '';
+      foreach ($segments as $segment)
+      {
+        if ($segment === '') continue;
+        $current = $current === '' ? $segment : $current.'/'.$segment;
+        $options[$current] = $current;
+      }
+    }
+
+    if (count($options) > 1)
+    {
+      $root = $options[''];
+      unset($options['']);
+      natcasesort($options);
+      $options = array(''=>$root) + $options;
+    }
+
+    $result[] = array(
+      'index'=>(int)$index,
+      'storage_id'=>$storage_id,
+      'mount'=>(string)($candidate['local_mount'] ?? ''),
+      'ready'=>trim((string)($candidate['local_mount'] ?? '')) !== '',
+      'options'=>$options,
+    );
+  }
+  return $result;
+}
+
+function bratonien_tools_nc_wizard_save_mounts_with_directories()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $candidates = isset($state['storage_candidates']) && is_array($state['storage_candidates']) ? $state['storage_candidates'] : array();
+  if (!$candidates) throw new RuntimeException('Es wurden noch keine Speicherorte erkannt.');
+
+  $mounts = isset($_POST['nc_wizard_storage_mount']) && is_array($_POST['nc_wizard_storage_mount']) ? $_POST['nc_wizard_storage_mount'] : array();
+  $directories = isset($_POST['nc_wizard_directory']) && is_array($_POST['nc_wizard_directory']) ? $_POST['nc_wizard_directory'] : array();
+  $storages = array();
+
+  foreach ($candidates as $index=>$candidate)
+  {
+    $mount = rtrim(trim((string)($candidate['local_mount'] ?? '')), '/');
+    if ($mount === '') $mount = rtrim(trim((string)($mounts[$index] ?? '')), '/');
+    if ($mount === '' || $mount[0] !== '/') throw new RuntimeException('Für einen Speicherort fehlt ein gültiger lokaler Pfad.');
+    if (!is_dir($mount) || !is_readable($mount)) throw new RuntimeException('Der angegebene Speicherort ist nicht vorhanden oder nicht lesbar: '.$mount);
+
+    $selected = isset($directories[$index]) && is_array($directories[$index]) ? $directories[$index] : array();
+    $normalized = array();
+    foreach ($selected as $directory)
+    {
+      $directory = trim((string)$directory, '/');
+      if ($directory === '') continue;
+      if ($directory[0] === '/' || preg_match('#(^|/)\.\.(/|$)#', $directory)) throw new RuntimeException('Ungültige Verzeichnisauswahl.');
+      $normalized[$directory] = true;
+    }
+    if (!$normalized) $normalized[''] = true;
+
+    foreach (array_keys($normalized) as $include_prefix)
+    {
+      $storages[] = array(
+        'storage_id'=>(string)($candidate['storage_id'] ?? ''),
+        'source_prefix'=>trim((string)($candidate['source_prefix'] ?? ''), '/'),
+        'local_mount'=>$mount,
+        'include_prefix'=>$include_prefix,
+      );
+    }
+  }
+
+  $state['storages'] = $storages;
+  $state['technical_complete'] = true;
+  $state['technical_stage'] = 'ready';
+  $state['technical_error'] = '';
+  $state['directory_selection_ready'] = false;
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Verzeichnisauswahl wurde übernommen.');
+}
+
+function bratonien_tools_nc_wizard_finish_with_directories()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 4 || empty($state['technical_complete']) || trim((string)$state['showcase_user']) === '') throw new RuntimeException('Der Assistent ist noch nicht vollständig.');
+
+  if (array_key_exists('nc_wizard_fallback_user', $_POST)) $state['_fallback_user'] = trim((string)$_POST['nc_wizard_fallback_user']);
+  if (array_key_exists('nc_wizard_fallback_password', $_POST)) $state['_fallback_password'] = (string)$_POST['nc_wizard_fallback_password'];
+  bratonien_tools_nc_wizard_store($state);
+
+  $fallback_user = trim((string)$state['_fallback_user']);
+  $fallback_password = (string)$state['_fallback_password'];
+  if (($fallback_user === '') !== ($fallback_password === '')) throw new RuntimeException('Fallback-Benutzer und Fallback-Passwort müssen entweder beide angegeben oder beide leer gelassen werden.');
+  if ($state['api_status'] !== 'ok' && $fallback_user === '') throw new RuntimeException('Da die Piwigo-API übersprungen wurde, ist ein Fallback-Zugang erforderlich.');
+
+  $mapping_lines = array();
+  foreach ((array)$state['storages'] as $storage)
+  {
+    $key = (string)$storage['storage_id'].'|'.trim((string)$storage['source_prefix'], '/').'|'.(string)$storage['local_mount'];
+    $mapping_lines[$key] = (string)$storage['storage_id'].' | '.trim((string)$storage['source_prefix'], '/').' | '.(string)$storage['local_mount'];
+  }
+
+  $_POST['nc_name']=(string)$state['connection_name'];$_POST['nc_host']=(string)$state['db_host'];$_POST['nc_port']=(string)$state['db_port'];$_POST['nc_database']=(string)$state['db_database'];$_POST['nc_user']=(string)$state['db_user'];$_POST['nc_db_password']=(string)$state['_db_password'];
+  $_POST['nc_source_view']=(string)$state['source_view'];$_POST['nc_activity_view']=(string)$state['activity_view'];$_POST['nc_gallery_root']=(string)$state['gallery_root'];$_POST['nc_storages']=implode("\n",array_values($mapping_lines));
+  $_POST['nc_quiet_seconds']='120';$_POST['nc_max_wait_seconds']='900';$_POST['nc_full_sync_seconds']='86400';$_POST['nc_piwigo_user']=$fallback_user;$_POST['nc_piwigo_password']=$fallback_password;
+  $_POST['nc_nextcloud_url']=(string)$state['base_url'];$_POST['nc_showcase_user']=(string)$state['showcase_user'];$_POST['nc_access_user']=(string)$state['username'];$_POST['nc_product']=(string)$state['product'];$_POST['nc_version']=(string)$state['version'];$_POST['nc_api_validated']=$state['api_status']==='ok'?'1':'0';
+
+  $result = bratonien_tools_nc_connector_create_local_api_first();
+  $connection_id = (int)($result['connection_id'] ?? 0);
+  if ($connection_id < 1) throw new RuntimeException('Die neue Verbindung konnte nicht gespeichert werden.');
+
+  $connection = bratonien_tools_nc_connector_connection($connection_id, false);
+  if (!$connection) throw new RuntimeException('Die neue Verbindung konnte nach dem Anlegen nicht gelesen werden.');
+  $config = $connection['config'];
+  $config['storages'] = array_values($state['storages']);
+  $config_json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($config_json)) throw new RuntimeException('Die Verzeichnisauswahl konnte nicht serialisiert werden.');
+  $table = bratonien_tools_nc_connector_table();
+  pwg_query("UPDATE `$table` SET config_json='".pwg_db_real_escape_string($config_json)."' WHERE id=".$connection_id." LIMIT 1");
+
+  try
+  {
+    if ($state['api_status'] === 'ok') bratonien_tools_nc_api_credentials_store((string)$state['_api_key_id'], (string)$state['_api_key_secret']);
+  }
+  catch (Throwable $e)
+  {
+    pwg_query("DELETE FROM `$table` WHERE id=".$connection_id." LIMIT 1");
+    throw new RuntimeException('Die Verbindung wurde nicht übernommen, weil der geprüfte API-Zugang nicht gespeichert werden konnte: '.$e->getMessage());
+  }
+
+  unset($_SESSION['bratonien_nc_wizard']);
+  unset($result['connection_id']);
+  $result['message'] = 'Verbindung wurde vollständig durch den Assistenten angelegt. '.$result['message'];
+  return $result;
+}

include/nc_connector_wizard_flow.inc.php

@@ -0,0 +1,10 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_save_technical_flow()
+{
+  return bratonien_tools_nc_wizard_save_technical_generic();
+}

include/nc_connector_wizard_user_scope.inc.php

@@ -0,0 +1,499 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_webdav_list(array $state, $path = '')
+{
+  if (empty($state['scan_ok']) || trim((string)$state['base_url']) === '' || trim((string)$state['username']) === '' || (string)$state['_password'] === '')
+  {
+    throw new RuntimeException('Die Nextcloud-Sitzung des Assistenten ist nicht vollständig.');
+  }
+  if (!function_exists('curl_init')) throw new RuntimeException('cURL ist für die Verzeichnisauswahl nicht verfügbar.');
+
+  $path = trim((string)$path, '/');
+  if ($path !== '' && preg_match('#(^|/)\.\.(/|$)#', $path)) throw new RuntimeException('Ungültiger Verzeichnispfad.');
+
+  $segments = $path === '' ? array() : array_map('rawurlencode', explode('/', $path));
+  $user = rawurlencode((string)$state['username']);
+  $url = rtrim((string)$state['base_url'], '/').'/remote.php/dav/files/'.$user.'/'.implode('/', $segments);
+  if (substr($url, -1) !== '/') $url .= '/';
+
+  $body = '<?xml version="1.0"?><d:propfind xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns"><d:prop><d:resourcetype/><d:displayname/><oc:fileid/></d:prop></d:propfind>';
+  $ch = curl_init($url);
+  curl_setopt_array($ch, array(
+    CURLOPT_RETURNTRANSFER=>true,
+    CURLOPT_CUSTOMREQUEST=>'PROPFIND',
+    CURLOPT_POSTFIELDS=>$body,
+    CURLOPT_HTTPHEADER=>array('Depth: 1','Content-Type: application/xml; charset=utf-8'),
+    CURLOPT_HTTPAUTH=>CURLAUTH_BASIC,
+    CURLOPT_USERPWD=>(string)$state['username'].':'.(string)$state['_password'],
+    CURLOPT_CONNECTTIMEOUT=>8,
+    CURLOPT_TIMEOUT=>20,
+  ));
+  $response = curl_exec($ch);
+  $errno = curl_errno($ch);
+  $status = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  if ($response === false || $errno !== 0) throw new RuntimeException('Nextcloud-Verzeichnisse konnten nicht geladen werden.');
+  if ($status === 401 || $status === 403) throw new RuntimeException('Nextcloud hat den Zugriff auf dieses Verzeichnis abgelehnt.');
+  if ($status !== 207) throw new RuntimeException('Nextcloud-Verzeichnisabfrage antwortete mit HTTP '.$status.'.');
+
+  libxml_use_internal_errors(true);
+  $xml = simplexml_load_string((string)$response);
+  if ($xml === false) throw new RuntimeException('Nextcloud hat eine ungültige WebDAV-Antwort geliefert.');
+  $xml->registerXPathNamespace('d', 'DAV:');
+  $xml->registerXPathNamespace('oc', 'http://owncloud.org/ns');
+
+  $children = array();
+  $fileids = array();
+  $current_fileid = 0;
+  $base_path = (string)parse_url($url, PHP_URL_PATH);
+
+  foreach ($xml->xpath('//d:response') as $item)
+  {
+    $item->registerXPathNamespace('d', 'DAV:');
+    $item->registerXPathNamespace('oc', 'http://owncloud.org/ns');
+    $hrefs = $item->xpath('d:href');
+    $collections = $item->xpath('d:propstat/d:prop/d:resourcetype/d:collection');
+    $ids = $item->xpath('d:propstat/d:prop/oc:fileid');
+    if (!$hrefs || !$collections || !$ids) continue;
+
+    $fileid = (int)trim((string)$ids[0]);
+    if ($fileid < 1) continue;
+    $href = rawurldecode((string)$hrefs[0]);
+    $href_path = (string)parse_url($href, PHP_URL_PATH);
+
+    if (rtrim($href_path, '/') === rtrim($base_path, '/'))
+    {
+      $current_fileid = $fileid;
+      continue;
+    }
+
+    $name = basename(rtrim($href_path, '/'));
+    if ($name === '') continue;
+    $child_path = $path === '' ? $name : $path.'/'.$name;
+    $children[$child_path] = $name;
+    $fileids[$child_path] = $fileid;
+  }
+  natcasesort($children);
+
+  if ($current_fileid < 1) throw new RuntimeException('Nextcloud hat für das aktuelle Verzeichnis keine eindeutige Datei-ID geliefert.');
+
+  $parent = '';
+  if ($path !== '')
+  {
+    $parts = explode('/', $path);
+    array_pop($parts);
+    $parent = implode('/', $parts);
+  }
+
+  return array(
+    'current'=>$path,
+    'parent'=>$parent,
+    'children'=>$children,
+    'current_fileid'=>$current_fileid,
+    'fileids'=>$fileids,
+  );
+}
+
+function bratonien_tools_nc_wizard_refresh_directory_state(array &$state, $path = null)
+{
+  if ($path === null) $path = (string)($state['directory_path'] ?? '');
+  $listing = bratonien_tools_nc_wizard_webdav_list($state, $path);
+  $state['directory_path'] = (string)$listing['current'];
+  $state['directory_parent'] = (string)$listing['parent'];
+  $state['directory_children'] = (array)$listing['children'];
+  $state['directory_current_fileid'] = (int)$listing['current_fileid'];
+  $state['directory_fileids'] = (array)$listing['fileids'];
+  if (!isset($state['directory_selected']) || !is_array($state['directory_selected'])) $state['directory_selected'] = array();
+  if (!isset($state['directory_selected_fileids']) || !is_array($state['directory_selected_fileids'])) $state['directory_selected_fileids'] = array();
+}
+
+function bratonien_tools_nc_wizard_generic_db_config(array $state)
+{
+  return array(
+    'host'=>(string)$state['db_host'],
+    'port'=>(string)$state['db_port'],
+    'database'=>(string)$state['db_database'],
+    'user'=>(string)$state['db_user'],
+  );
+}
+
+function bratonien_tools_nc_wizard_verify_generic_data_access(array &$state)
+{
+  $config = bratonien_tools_nc_wizard_generic_db_config($state);
+  $password = (string)$state['_db_password'];
+  if (trim((string)$config['user']) === '' || $password === '') throw new RuntimeException('Die gespeicherte Reader-Verbindung ist unvollständig.');
+
+  bratonien_tools_nc_connector_psql($config, $password, 'SELECT 1');
+  bratonien_tools_nc_connector_psql($config, $password, 'SELECT 1 FROM piwigo_connector_files LIMIT 1');
+  bratonien_tools_nc_connector_psql($config, $password, 'SELECT 1 FROM piwigo_connector_activity LIMIT 1');
+
+  $state['source_view'] = 'piwigo_connector_files';
+  $state['activity_view'] = 'piwigo_connector_activity';
+  $state['source_mode'] = 'selected-fileids';
+  $state['storages'] = array();
+  $state['storage_candidates'] = array();
+  $state['roots'] = array();
+  $state['technical_complete'] = false;
+  $state['technical_stage'] = 'mounts';
+  $state['technical_source'] = 'Generische Reader-Schnittstelle geprüft';
+  $state['technical_error'] = '';
+  $state['directory_selection_ready'] = true;
+}
+
+function bratonien_tools_nc_wizard_known_adapter($storage_id, $source_path)
+{
+  $storage_id = trim((string)$storage_id);
+  $source_path = trim((string)$source_path, '/');
+  $matches = array();
+
+  foreach (bratonien_tools_nc_connector_connections() as $connection)
+  {
+    foreach ((array)($connection['config']['storages'] ?? array()) as $storage)
+    {
+      if ((string)($storage['storage_id'] ?? '') !== $storage_id) continue;
+      $prefix = trim((string)($storage['source_prefix'] ?? ''), '/');
+      if ($prefix !== '' && $source_path !== $prefix && strpos($source_path, $prefix.'/') !== 0) continue;
+      $mount = rtrim(trim((string)($storage['local_mount'] ?? '')), '/');
+      if ($mount === '' || !is_dir($mount) || !is_readable($mount)) continue;
+      $key = $prefix.'|'.$mount;
+      $matches[$key] = array('storage_id'=>$storage_id,'source_prefix'=>$prefix,'local_mount'=>$mount);
+    }
+  }
+
+  if (!$matches) return null;
+  $max = -1;
+  foreach ($matches as $match) $max = max($max, strlen((string)$match['source_prefix']));
+  $best = array_values(array_filter($matches, function($match) use ($max) { return strlen((string)$match['source_prefix']) === $max; }));
+  return count($best) === 1 ? $best[0] : null;
+}
+
+function bratonien_tools_nc_wizard_resolve_selected_roots(array &$state)
+{
+  $selected = isset($state['directory_selected']) && is_array($state['directory_selected']) ? $state['directory_selected'] : array();
+  $selected_fileids = isset($state['directory_selected_fileids']) && is_array($state['directory_selected_fileids']) ? $state['directory_selected_fileids'] : array();
+  if (!$selected) throw new RuntimeException('Bitte mindestens ein Nextcloud-Verzeichnis auswählen.');
+
+  $ids = array();
+  foreach ($selected as $path)
+  {
+    if (!isset($selected_fileids[$path]) || (int)$selected_fileids[$path] < 1) throw new RuntimeException('Für eine Auswahl fehlt die eindeutige Nextcloud-Datei-ID. Bitte das Verzeichnis erneut auswählen.');
+    $ids[(int)$selected_fileids[$path]] = (string)$path;
+  }
+
+  $config = bratonien_tools_nc_wizard_generic_db_config($state);
+  $id_list = implode(',', array_map('intval', array_keys($ids)));
+  $rows = bratonien_tools_nc_connector_psql(
+    $config,
+    (string)$state['_db_password'],
+    "SELECT fileid::text || E'\\t' || storage_id || E'\\t' || COALESCE(source_path, '') FROM piwigo_connector_files WHERE fileid IN (".$id_list.") ORDER BY fileid"
+  );
+
+  $resolved = array();
+  foreach (preg_split('/\r\n|\r|\n/', trim($rows)) as $line)
+  {
+    if ($line === '') continue;
+    $parts = explode("\t", $line, 3);
+    if (count($parts) !== 3 || !ctype_digit($parts[0])) continue;
+    $resolved[(int)$parts[0]] = array('storage_id'=>(string)$parts[1], 'source_path'=>trim((string)$parts[2], '/'));
+  }
+
+  $roots = array();
+  $candidates = array();
+  foreach ($ids as $fileid=>$path)
+  {
+    if (!isset($resolved[$fileid])) throw new RuntimeException('Das ausgewählte Nextcloud-Verzeichnis mit Datei-ID '.$fileid.' konnte nicht mehr aufgelöst werden.');
+    $storage_id = trim((string)$resolved[$fileid]['storage_id']);
+    $source_path = trim((string)$resolved[$fileid]['source_path'], '/');
+    if ($storage_id === '') throw new RuntimeException('Nextcloud hat für Datei-ID '.$fileid.' keine Storage-ID geliefert.');
+
+    $display_name = $path === '' ? ((string)($state['display_name'] ?? '') !== '' ? (string)$state['display_name'] : 'Nextcloud') : basename($path);
+    $roots[] = array(
+      'fileid'=>(int)$fileid,
+      'display_name'=>$display_name,
+      'webdav_path'=>$path,
+      'storage_id'=>$storage_id,
+      'source_path'=>$source_path,
+    );
+
+    $adapter = bratonien_tools_nc_wizard_known_adapter($storage_id, $source_path);
+    if (!$adapter) $adapter = array('storage_id'=>$storage_id,'source_prefix'=>'','local_mount'=>'');
+    $key = $adapter['storage_id'].'|'.$adapter['source_prefix'].'|'.$adapter['local_mount'];
+    $candidates[$key] = $adapter;
+  }
+
+  $state['roots'] = array_values($roots);
+  $state['storage_candidates'] = array_values($candidates);
+  $state['storages'] = $state['storage_candidates'];
+
+  $all_mapped = !empty($state['storage_candidates']);
+  foreach ($state['storage_candidates'] as $candidate)
+  {
+    $mount = rtrim(trim((string)($candidate['local_mount'] ?? '')), '/');
+    if ($mount === '' || !is_dir($mount) || !is_readable($mount)) $all_mapped = false;
+  }
+
+  if ($all_mapped)
+  {
+    $state['technical_complete'] = true;
+    $state['technical_stage'] = 'ready';
+    $state['directory_selection_ready'] = false;
+    return;
+  }
+
+  $state['technical_complete'] = false;
+  $state['technical_stage'] = 'mounts';
+  $state['directory_selection_ready'] = false;
+  $state['mount_prompted'] = true;
+}
+
+function bratonien_tools_nc_wizard_scan_user_scoped()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $host_input = trim((string)($_POST['nc_wizard_host'] ?? $state['host_input']));
+  $username = trim((string)($_POST['nc_wizard_user'] ?? $state['username']));
+  $password = array_key_exists('nc_wizard_password', $_POST) ? (string)$_POST['nc_wizard_password'] : (string)$state['_password'];
+
+  $state['step'] = 1;
+  $state['host_input'] = $host_input;
+  $state['username'] = $username;
+  $state['_password'] = $password;
+  bratonien_tools_nc_wizard_store($state);
+  if ($username === '' || $password === '') throw new RuntimeException('Nextcloud-Benutzer und Passwort werden für den Scan benötigt.');
+
+  $base_url = '';
+  $status_data = null;
+  foreach (bratonien_tools_nc_wizard_candidate_urls($host_input) as $candidate_url)
+  {
+    try
+    {
+      $response = bratonien_tools_nc_wizard_http($candidate_url.'/status.php');
+      if ($response['status'] < 200 || $response['status'] >= 300) continue;
+      $candidate_status = json_decode($response['body'], true);
+      if (!is_array($candidate_status) || empty($candidate_status['installed'])) continue;
+      $base_url = $candidate_url;
+      $status_data = $candidate_status;
+      break;
+    }
+    catch (Throwable $ignored) {}
+  }
+  if ($base_url === '' || !is_array($status_data)) throw new RuntimeException('Unter dieser Adresse konnte keine Nextcloud erreicht werden. HTTP und HTTPS wurden automatisch geprüft.');
+
+  $user_response = bratonien_tools_nc_wizard_http($base_url.'/ocs/v2.php/cloud/user?format=json', $username, $password, array('OCS-APIRequest: true'));
+  if ($user_response['status'] === 401 || $user_response['status'] === 403) throw new RuntimeException('Nextcloud hat Benutzername oder Passwort abgelehnt.');
+  if ($user_response['status'] < 200 || $user_response['status'] >= 300) throw new RuntimeException('Nextcloud ist erreichbar, aber die Anmeldung konnte nicht geprüft werden.');
+
+  $user_data = bratonien_tools_nc_wizard_ocs_data($user_response['body']);
+  $resolved_username = trim((string)($user_data['id'] ?? $username));
+  if ($resolved_username === '') $resolved_username = $username;
+  $url_host = (string)parse_url($base_url, PHP_URL_HOST);
+
+  $state = array_merge($state, array(
+    'step'=>2,'scan_ok'=>true,'base_url'=>$base_url,'host_input'=>$host_input,'username'=>$resolved_username,
+    'display_name'=>(string)($user_data['display-name'] ?? $user_data['displayname'] ?? ''),
+    'version'=>(string)($status_data['versionstring'] ?? $status_data['version'] ?? ''),'product'=>(string)($status_data['productname'] ?? 'Nextcloud'),
+    'users'=>array(),'can_list_users'=>false,'showcase_user'=>$resolved_username,'connection_name'=>$url_host !== '' ? $url_host : 'Nextcloud',
+    'scan_message'=>'Nextcloud wurde erkannt und der Benutzerzugriff wurde bestätigt.','_password'=>$password,
+    'api_status'=>'pending','api_username'=>'','api_error'=>'','db_host'=>strtolower($url_host),'db_port'=>'5432','db_database'=>'nextcloud','db_user'=>'','db_password_set'=>false,'_db_password'=>'',
+    'source_view'=>'piwigo_connector_files','activity_view'=>'piwigo_connector_activity','source_mode'=>'selected-fileids','gallery_root'=>rtrim(PHPWG_ROOT_PATH, '/').'/galleries/nextcloud',
+    'storages'=>array(),'storage_candidates'=>array(),'roots'=>array(),'technical_stage'=>'auto_check','technical_source'=>'Automatische Prüfung','technical_error'=>'','technical_complete'=>false,
+    'directory_selection_ready'=>false,'directory_path'=>'','directory_parent'=>'','directory_children'=>array(),'directory_current_fileid'=>0,'directory_fileids'=>array(),'directory_selected'=>array(),'directory_selected_fileids'=>array(),
+    'database_prompted'=>false,'mount_prompted'=>false,
+  ));
+
+  if (!bratonien_tools_nc_wizard_apply_known_database_profile($state))
+  {
+    $state['technical_stage'] = 'database_details';
+    $state['database_prompted'] = true;
+    $state['technical_source'] = 'Keine bekannte Reader-Verbindung gefunden';
+    $state['technical_error'] = 'Für diese Nextcloud ist noch keine bekannte Datenbank-Reader-Verbindung gespeichert.';
+    bratonien_tools_nc_wizard_store($state);
+    return array('message'=>'Nextcloud wurde gefunden. Für den Datenzugriff wird eine separate Reader-Verbindung benötigt.');
+  }
+
+  try
+  {
+    bratonien_tools_nc_wizard_verify_generic_data_access($state);
+    bratonien_tools_nc_wizard_refresh_directory_state($state, '');
+  }
+  catch (Throwable $e)
+  {
+    $state['technical_complete'] = false;
+    $state['technical_stage'] = 'database_details';
+    $state['database_prompted'] = true;
+    $state['technical_error'] = $e->getMessage().' Die generischen Connector-Views müssen in Nextcloud eingerichtet sein.';
+  }
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($state['technical_stage'] === 'database_details') return array('message'=>'Nextcloud wurde gefunden. Die generische Reader-Schnittstelle konnte noch nicht bestätigt werden.');
+  return array('message'=>'Nextcloud und generischer Datenzugriff wurden bestätigt. Jetzt können die Verzeichnisse des angemeldeten Benutzers gewählt werden.');
+}
+
+function bratonien_tools_nc_wizard_save_technical_generic()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if (empty($state['scan_ok'])) throw new RuntimeException('Bitte zuerst Nextcloud erfolgreich scannen.');
+  if (trim((string)($state['db_user'] ?? '')) === '' || (string)($state['_db_password'] ?? '') === '') bratonien_tools_nc_wizard_apply_known_database_profile($state);
+  if (trim((string)($state['db_user'] ?? '')) === '' || (string)($state['_db_password'] ?? '') === '') throw new RuntimeException('Für diese Nextcloud sind noch keine Datenbank-Reader-Zugangsdaten bekannt.');
+
+  $state['db_host'] = trim((string)($_POST['nc_wizard_db_host'] ?? $state['db_host']));
+  $state['db_port'] = (string)max(1, min(65535, (int)($_POST['nc_wizard_db_port'] ?? $state['db_port'])));
+  $state['db_database'] = trim((string)($_POST['nc_wizard_db_database'] ?? $state['db_database']));
+  if ($state['db_host'] === '' || $state['db_database'] === '') throw new RuntimeException('Die Adresse der Datenbank ist noch unvollständig.');
+
+  try
+  {
+    bratonien_tools_nc_wizard_verify_generic_data_access($state);
+    bratonien_tools_nc_wizard_refresh_directory_state($state, '');
+    bratonien_tools_nc_wizard_store($state);
+    return array('message'=>'Generischer Datenzugriff wurde erfolgreich geprüft. Jetzt können Verzeichnisse ausgewählt werden.');
+  }
+  catch (Throwable $e)
+  {
+    $state['technical_error'] = $e->getMessage();
+    $state['technical_stage'] = 'database_details';
+    $state['database_prompted'] = true;
+    bratonien_tools_nc_wizard_store($state);
+    throw $e;
+  }
+}
+
+function bratonien_tools_nc_wizard_directory_browse()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 2 || (string)$state['technical_stage'] !== 'mounts' || empty($state['directory_selection_ready'])) throw new RuntimeException('Die Verzeichnisauswahl ist in diesem Fenster nicht verfügbar.');
+  $path = trim((string)($_POST['nc_wizard_directory_path'] ?? ''), '/');
+  bratonien_tools_nc_wizard_refresh_directory_state($state, $path);
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Verzeichnis geöffnet.');
+}
+
+function bratonien_tools_nc_wizard_directory_add()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 2 || (string)$state['technical_stage'] !== 'mounts' || empty($state['directory_selection_ready'])) throw new RuntimeException('Die Verzeichnisauswahl ist in diesem Fenster nicht verfügbar.');
+  $path = trim((string)($state['directory_path'] ?? ''), '/');
+  $fileid = (int)($state['directory_current_fileid'] ?? 0);
+  if ($fileid < 1) throw new RuntimeException('Für dieses Verzeichnis fehlt die eindeutige Nextcloud-Datei-ID.');
+  $selected = isset($state['directory_selected']) && is_array($state['directory_selected']) ? $state['directory_selected'] : array();
+  if (!in_array($path, $selected, true)) $selected[] = $path;
+  $state['directory_selected'] = array_values($selected);
+  if (!isset($state['directory_selected_fileids']) || !is_array($state['directory_selected_fileids'])) $state['directory_selected_fileids'] = array();
+  $state['directory_selected_fileids'][$path] = $fileid;
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>$path === '' ? 'Stammverzeichnis ausgewählt.' : 'Verzeichnis hinzugefügt.');
+}
+
+function bratonien_tools_nc_wizard_directory_remove()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 2 || empty($state['directory_selection_ready'])) throw new RuntimeException('Die Verzeichnisauswahl ist in diesem Fenster nicht verfügbar.');
+  $path = trim((string)($_POST['nc_wizard_directory_remove'] ?? ''), '/');
+  $selected = isset($state['directory_selected']) && is_array($state['directory_selected']) ? $state['directory_selected'] : array();
+  $state['directory_selected'] = array_values(array_filter($selected, function($value) use ($path) { return (string)$value !== $path; }));
+  if (isset($state['directory_selected_fileids'][$path])) unset($state['directory_selected_fileids'][$path]);
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Verzeichnis entfernt.');
+}
+
+function bratonien_tools_nc_wizard_save_mounts_server_side()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 2 || (string)$state['technical_stage'] !== 'mounts') throw new RuntimeException('Die Speicher-/Verzeichnisauswahl ist in diesem Fenster nicht verfügbar.');
+
+  if (!empty($state['directory_selection_ready']))
+  {
+    bratonien_tools_nc_wizard_resolve_selected_roots($state);
+    bratonien_tools_nc_wizard_store($state);
+    return array('message'=>!empty($state['technical_complete']) ? 'Verzeichnisse und vorhandene Storage-Adapter wurden übernommen.' : 'Verzeichnisse wurden aufgelöst. Ein neuer Storage-Adapter muss noch zugeordnet werden.');
+  }
+
+  $candidates = isset($state['storage_candidates']) && is_array($state['storage_candidates']) ? $state['storage_candidates'] : array();
+  if (!$candidates) throw new RuntimeException('Es wurden noch keine Speicherorte aus der Verzeichnisauswahl aufgelöst.');
+  $mounts = isset($_POST['nc_wizard_storage_mount']) && is_array($_POST['nc_wizard_storage_mount']) ? $_POST['nc_wizard_storage_mount'] : array();
+
+  foreach ($candidates as $index=>&$candidate)
+  {
+    $mount = rtrim(trim((string)($candidate['local_mount'] ?? '')), '/');
+    if ($mount === '') $mount = rtrim(trim((string)($mounts[$index] ?? '')), '/');
+    if ($mount === '' || $mount[0] !== '/') throw new RuntimeException('Für einen Speicherort fehlt ein gültiger lokaler Pfad.');
+    if (!is_dir($mount) || !is_readable($mount)) throw new RuntimeException('Der angegebene Speicherort ist nicht vorhanden oder nicht lesbar: '.$mount);
+    $candidate['local_mount'] = $mount;
+  }
+  unset($candidate);
+
+  $state['storage_candidates'] = array_values($candidates);
+  $state['storages'] = $state['storage_candidates'];
+  $state['technical_complete'] = true;
+  $state['technical_stage'] = 'ready';
+  $state['technical_error'] = '';
+  $state['directory_selection_ready'] = false;
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Storage-Adapter wurde geprüft. Die Verbindung ist technisch vollständig.');
+}
+
+function bratonien_tools_nc_wizard_select_current_user()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if (empty($state['scan_ok'])) throw new RuntimeException('Bitte zuerst Nextcloud erfolgreich scannen.');
+  if (empty($state['technical_complete'])) throw new RuntimeException('Die Verbindung ist noch nicht vollständig geprüft.');
+  $connection_name = trim((string)($_POST['nc_wizard_connection_name'] ?? $state['connection_name']));
+  if ($connection_name === '') throw new RuntimeException('Bitte einen Namen für die Verbindung angeben.');
+  $state['connection_name'] = $connection_name;
+  $state['showcase_user'] = (string)$state['username'];
+  $state['step'] = 3;
+  $state['api_error'] = '';
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Nextcloud-Benutzer übernommen. Jetzt folgt der Piwigo-API-Zugang.');
+}
+
+function bratonien_tools_nc_wizard_back()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $step = (int)($state['step'] ?? 1);
+  if ($step <= 1) return array('message'=>'Bereits am Anfang des Assistenten.');
+
+  if ($step === 4)
+  {
+    $state['step'] = 3;
+  }
+  elseif ($step === 3)
+  {
+    $state['step'] = 2;
+    $state['technical_complete'] = true;
+    $state['technical_stage'] = 'ready';
+    $state['directory_selection_ready'] = false;
+  }
+  elseif (!empty($state['technical_complete']))
+  {
+    $state['technical_complete'] = false;
+    $state['technical_stage'] = 'mounts';
+    $state['directory_selection_ready'] = true;
+    bratonien_tools_nc_wizard_refresh_directory_state($state);
+  }
+  elseif ((string)($state['technical_stage'] ?? '') === 'mounts' && !empty($state['directory_selection_ready']))
+  {
+    if (!empty($state['database_prompted'])) $state['technical_stage'] = 'database_details'; else $state['step'] = 1;
+    $state['directory_selection_ready'] = false;
+  }
+  elseif ((string)($state['technical_stage'] ?? '') === 'mounts')
+  {
+    $state['directory_selection_ready'] = true;
+    bratonien_tools_nc_wizard_refresh_directory_state($state);
+  }
+  elseif ((string)($state['technical_stage'] ?? '') === 'database_details')
+  {
+    $state['step'] = 1;
+  }
+  else
+  {
+    $state['step'] = 1;
+  }
+
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Ein Fenster zurück.');
+}

include/nc_connector_wizard_webdav_flow.inc.php

@@ -0,0 +1,235 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_wizard_scan_webdav_first()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  $host_input = trim((string)($_POST['nc_wizard_host'] ?? $state['host_input']));
+  $username = trim((string)($_POST['nc_wizard_user'] ?? $state['username']));
+  $password = array_key_exists('nc_wizard_password', $_POST) ? (string)$_POST['nc_wizard_password'] : (string)$state['_password'];
+
+  $state['step'] = 1;
+  $state['host_input'] = $host_input;
+  $state['username'] = $username;
+  $state['_password'] = $password;
+  bratonien_tools_nc_wizard_store($state);
+
+  if ($username === '' || $password === '')
+  {
+    throw new RuntimeException('Nextcloud-Benutzer und Passwort werden für den Scan benötigt.');
+  }
+
+  $base_url = '';
+  $status_data = null;
+  foreach (bratonien_tools_nc_wizard_candidate_urls($host_input) as $candidate_url)
+  {
+    try
+    {
+      $response = bratonien_tools_nc_transport_http($candidate_url.'/status.php');
+      if ($response['status'] < 200 || $response['status'] >= 300) continue;
+      $candidate_status = json_decode($response['body'], true);
+      if (!is_array($candidate_status) || empty($candidate_status['installed'])) continue;
+      $base_url = $candidate_url;
+      $status_data = $candidate_status;
+      break;
+    }
+    catch (Throwable $ignored) {}
+  }
+
+  if ($base_url === '' || !is_array($status_data))
+  {
+    throw new RuntimeException('Unter dieser Adresse konnte keine Nextcloud erreicht werden. HTTP und HTTPS wurden automatisch geprüft.');
+  }
+
+  $user_response = bratonien_tools_nc_transport_http(
+    $base_url.'/ocs/v2.php/cloud/user?format=json',
+    $username,
+    $password,
+    array('OCS-APIRequest: true')
+  );
+  if ($user_response['status'] === 401 || $user_response['status'] === 403)
+  {
+    throw new RuntimeException('Nextcloud hat Benutzername oder Passwort abgelehnt.');
+  }
+  if ($user_response['status'] < 200 || $user_response['status'] >= 300)
+  {
+    throw new RuntimeException('Nextcloud ist erreichbar, aber die Anmeldung konnte nicht geprüft werden.');
+  }
+
+  $user_data = bratonien_tools_nc_wizard_ocs_data($user_response['body']);
+  $resolved_username = trim((string)($user_data['id'] ?? $username));
+  if ($resolved_username === '') $resolved_username = $username;
+  $url_host = (string)parse_url($base_url, PHP_URL_HOST);
+
+  $state = array_merge($state, array(
+    'step'=>2,
+    'scan_ok'=>true,
+    'base_url'=>$base_url,
+    'host_input'=>$host_input,
+    'username'=>$resolved_username,
+    'display_name'=>(string)($user_data['display-name'] ?? $user_data['displayname'] ?? ''),
+    'version'=>(string)($status_data['versionstring'] ?? $status_data['version'] ?? ''),
+    'product'=>(string)($status_data['productname'] ?? 'Nextcloud'),
+    'users'=>array(),
+    'can_list_users'=>false,
+    'showcase_user'=>$resolved_username,
+    'connection_name'=>$url_host !== '' ? $url_host : 'Nextcloud WebDAV',
+    'scan_message'=>'Nextcloud und WebDAV-Zugriff wurden bestätigt.',
+    '_password'=>$password,
+    'source_mode'=>'webdav-placeholder',
+    'transport'=>'webdav',
+    'gallery_root'=>rtrim(PHPWG_ROOT_PATH, '/').'/galleries',
+    'storages'=>array(),
+    'storage_candidates'=>array(),
+    'roots'=>array(),
+    'technical_stage'=>'mounts',
+    'technical_source'=>'WebDAV',
+    'technical_error'=>'',
+    'technical_complete'=>false,
+    'directory_selection_ready'=>true,
+    'directory_path'=>'',
+    'directory_parent'=>'',
+    'directory_children'=>array(),
+    'directory_current_fileid'=>0,
+    'directory_fileids'=>array(),
+    'directory_selected'=>array(),
+    'directory_selected_fileids'=>array(),
+    'database_prompted'=>false,
+    'mount_prompted'=>false,
+    'api_status'=>'pending',
+    'api_username'=>'',
+    'api_error'=>'',
+  ));
+
+  bratonien_tools_nc_transport_refresh_directory_state($state, '');
+  bratonien_tools_nc_wizard_store($state);
+
+  return array('message'=>'Nextcloud und WebDAV wurden bestätigt. Jetzt können die Verzeichnisse des angemeldeten Benutzers ausgewählt werden.');
+}
+
+function bratonien_tools_nc_wizard_save_sources_dispatch()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((string)($state['source_mode'] ?? '') !== 'webdav-placeholder')
+  {
+    return bratonien_tools_nc_wizard_save_mounts_server_side();
+  }
+
+  if ((int)($state['step'] ?? 0) !== 2 || empty($state['directory_selection_ready']))
+  {
+    throw new RuntimeException('Die Verzeichnisauswahl ist in diesem Fenster nicht verfügbar.');
+  }
+
+  $selected = isset($state['directory_selected']) && is_array($state['directory_selected'])
+    ? array_values(array_unique(array_map(function($path) { return trim((string)$path, '/'); }, $state['directory_selected'])))
+    : array();
+  if (!$selected)
+  {
+    throw new RuntimeException('Bitte mindestens ein Nextcloud-Verzeichnis auswählen.');
+  }
+
+  $selected_ids = isset($state['directory_selected_fileids']) && is_array($state['directory_selected_fileids'])
+    ? $state['directory_selected_fileids']
+    : array();
+  $roots = array();
+  foreach ($selected as $path)
+  {
+    $fileid = (int)($selected_ids[$path] ?? 0);
+    if ($fileid < 1)
+    {
+      throw new RuntimeException('Für eine Auswahl fehlt die eindeutige Nextcloud-Datei-ID. Bitte das Verzeichnis erneut auswählen.');
+    }
+    $display_name = $path === ''
+      ? (trim((string)($state['display_name'] ?? '')) !== '' ? trim((string)$state['display_name']) : (string)$state['username'])
+      : basename($path);
+    $roots[] = array(
+      'fileid'=>$fileid,
+      'display_name'=>$display_name,
+      'webdav_path'=>$path,
+    );
+  }
+
+  $state['roots'] = $roots;
+  $state['technical_complete'] = true;
+  $state['technical_stage'] = 'ready';
+  $state['technical_source'] = 'WebDAV-Verzeichnisse ausgewählt';
+  $state['technical_error'] = '';
+  $state['directory_selection_ready'] = false;
+
+  if ((string)($state['editing_mode'] ?? '') === 'migrate')
+  {
+    $editing_id = (int)($state['editing_connection_id'] ?? 0);
+    $connection = $editing_id > 0 ? bratonien_tools_nc_connector_connection($editing_id, true) : null;
+    if (!$connection || (string)$connection['adapter'] !== 'local')
+    {
+      throw new RuntimeException('Die zu migrierende Legacy-Verbindung ist nicht mehr verfügbar.');
+    }
+
+    $migration = bratonien_tools_nc_connector_migration_state($connection);
+    if (empty($migration['ready']))
+    {
+      throw new RuntimeException('Die WebDAV-Migration kann noch nicht abgeschlossen werden. Es fehlen: '.implode(', ', $migration['missing']).'.');
+    }
+
+    $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+    $state['_api_key_id'] = (string)($credentials['api_key_id'] ?? '');
+    $state['_api_key_secret'] = (string)($credentials['api_key_secret'] ?? '');
+    $state['api_status'] = !empty($migration['api_available']) ? 'ok' : 'skipped';
+    $state['api_error'] = '';
+    $state['step'] = 4;
+    bratonien_tools_nc_wizard_store($state);
+
+    return array('message'=>'WebDAV-Quelle wurde übernommen. Mit „Migration starten“ wird jetzt der WebDAV-Nachfolger angelegt; die Legacy-Verbindung bleibt als Fallback erhalten.');
+  }
+
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'WebDAV-Verzeichnisse wurden übernommen. Die Verbindung ist für den nächsten Einrichtungsschritt vorbereitet.');
+}
+
+function bratonien_tools_nc_wizard_finish_dispatch()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((string)($state['source_mode'] ?? '') !== 'webdav-placeholder')
+  {
+    return bratonien_tools_nc_wizard_finish_generic_scope();
+  }
+
+  if ((int)($state['step'] ?? 0) !== 4 || empty($state['technical_complete']))
+  {
+    throw new RuntimeException('Der Assistent ist noch nicht vollständig.');
+  }
+
+  if (array_key_exists('nc_wizard_fallback_user', $_POST)) $state['_fallback_user'] = trim((string)$_POST['nc_wizard_fallback_user']);
+  if (array_key_exists('nc_wizard_fallback_password', $_POST)) $state['_fallback_password'] = (string)$_POST['nc_wizard_fallback_password'];
+  bratonien_tools_nc_wizard_store($state);
+
+  $fallback_user = trim((string)($state['_fallback_user'] ?? ''));
+  $fallback_password = (string)($state['_fallback_password'] ?? '');
+  if (($fallback_user === '') !== ($fallback_password === ''))
+  {
+    throw new RuntimeException('Fallback-Benutzer und Fallback-Passwort müssen entweder beide angegeben oder beide leer gelassen werden.');
+  }
+  if (($state['api_status'] ?? '') !== 'ok' && $fallback_user === '')
+  {
+    throw new RuntimeException('Da die Piwigo-API übersprungen wurde, ist für diese Verbindung ein Fallback-Zugang erforderlich.');
+  }
+
+  if ($fallback_user !== '')
+  {
+    try
+    {
+      bratonien_tools_nc_connector_validate_fallback_credentials($fallback_user, $fallback_password);
+    }
+    catch (Throwable $e)
+    {
+      throw new RuntimeException('Der Piwigo-Fallback wurde nicht gespeichert: '.$e->getMessage());
+    }
+  }
+
+  $result = bratonien_tools_nc_connector_create_webdav_placeholder_from_wizard();
+  unset($_SESSION['bratonien_nc_wizard']);
+  return $result;
+}

include/nc_legacy_reset.inc.php

@@ -0,0 +1,115 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_nc_legacy_remove_tree($path, $allowed_root)
+{
+  $path = rtrim(str_replace('\\', '/', (string)$path), '/');
+  $allowed_root = rtrim(str_replace('\\', '/', (string)$allowed_root), '/');
+  if ($path === '' || $allowed_root === '' || $path === $allowed_root || strpos($path, $allowed_root.'/') !== 0)
+  {
+    return 0;
+  }
+  if (!file_exists($path) && !is_link($path)) return 0;
+
+  if (is_link($path) || is_file($path))
+  {
+    return @unlink($path) ? 1 : 0;
+  }
+
+  $removed = 0;
+  $items = @scandir($path);
+  if (is_array($items))
+  {
+    foreach ($items as $item)
+    {
+      if ($item === '.' || $item === '..') continue;
+      $removed += bratonien_tools_nc_legacy_remove_tree($path.'/'.$item, $allowed_root);
+    }
+  }
+  if (@rmdir($path)) $removed++;
+  return $removed;
+}
+
+function bratonien_tools_nc_legacy_remove_state_files($state_root)
+{
+  $removed = 0;
+  foreach (glob(rtrim($state_root, '/').'/connection-*') ?: array() as $connection_dir)
+  {
+    if (!is_dir($connection_dir)) continue;
+    foreach (array('webdav-map.json', 'webdav-manifest.tsv', 'webdav-shadow-map.json') as $name)
+    {
+      $path = $connection_dir.'/'.$name;
+      if (is_file($path) && @unlink($path)) $removed++;
+    }
+  }
+  return $removed;
+}
+
+function bratonien_tools_nc_reset_legacy_imports()
+{
+  include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
+
+  $ids = array();
+  $result = pwg_query(
+    "SELECT id FROM ".IMAGES_TABLE.
+    " WHERE path LIKE '%nc-webdav-source/connection-%'"
+  );
+  while ($row = pwg_db_fetch_assoc($result))
+  {
+    $ids[] = (int)$row['id'];
+  }
+
+  if ($ids)
+  {
+    delete_elements($ids, false);
+  }
+
+  $data_root = rtrim(PHPWG_ROOT_PATH, '/').'/_data';
+  $tool_root = $data_root.'/bratonien-tools';
+  $removed_files = 0;
+  foreach (array(
+    $tool_root.'/nc-webdav-source',
+    $tool_root.'/nc-webdav-preview',
+    $tool_root.'/nc-webdav-gallery',
+  ) as $generated_root)
+  {
+    $removed_files += bratonien_tools_nc_legacy_remove_tree($generated_root, $data_root);
+  }
+
+  if (defined('PWG_DERIVATIVE_DIR'))
+  {
+    $derivative_root = rtrim(PHPWG_ROOT_PATH.PWG_DERIVATIVE_DIR, '/');
+    foreach (array(
+      $derivative_root.'/_data/bratonien-tools/nc-webdav-source',
+      $derivative_root.'/_data/bratonien-tools/nc-webdav-gallery',
+    ) as $generated_derivative_root)
+    {
+      $removed_files += bratonien_tools_nc_legacy_remove_tree($generated_derivative_root, $derivative_root);
+    }
+  }
+
+  $removed_state_files = bratonien_tools_nc_legacy_remove_state_files($tool_root.'/nc-connector-state');
+
+  if ($ids)
+  {
+    update_category('all');
+    invalidate_user_cache(true);
+  }
+
+  $result = array(
+    'timestamp'=>time(),
+    'removed_image_records'=>count($ids),
+    'removed_generated_entries'=>$removed_files,
+    'removed_state_files'=>$removed_state_files,
+  );
+
+  if (function_exists('conf_update_param'))
+  {
+    conf_update_param('bratonien_nc_legacy_reset_0977', json_encode($result));
+  }
+
+  return $result;
+}

include/nc_productive_ws.inc.php

@@ -18,7 +18,7 @@ function bratonien_tools_register_nc_productive_ws_methods($arr)
         'info' => 'Piwigo storage site to synchronize. Default: 1.',
       ),
     ),
-    'Runs the approved Piwigo filesystem synchronization for the Bratonien NC Connector.',
+    'Synchronizes the NC Connector into the existing Piwigo album hierarchy.',
     null,
     array(
       'admin_only' => true,
@@ -27,104 +27,279 @@ function bratonien_tools_register_nc_productive_ws_methods($arr)
   );
 }
 
+function bratonien_tools_nc_productive_error(&$errors, $path, $type)
+{
+  $errors[] = array(
+    'path' => (string)$path,
+    'type' => (string)$type,
+  );
+}
+
+function bratonien_tools_nc_relative_path($basedir, $path)
+{
+  $basedir = rtrim(str_replace('\\', '/', (string)$basedir), '/');
+  $path = str_replace('\\', '/', (string)$path);
+  if ($path === $basedir) return '';
+  if (strpos($path, $basedir.'/') !== 0)
+  {
+    throw new RuntimeException('WebDAV-Pfad liegt ausserhalb der Connector-Wurzel: '.$path);
+  }
+  return trim(substr($path, strlen($basedir)), '/');
+}
+
+function bratonien_tools_nc_find_album($parent_id, $dir, $name, $excluded_site_id)
+{
+  $where_parent = $parent_id === null ? 'id_uppercat IS NULL' : 'id_uppercat='.(int)$parent_id;
+  $dir_sql = pwg_db_real_escape_string((string)$dir);
+  $name_sql = pwg_db_real_escape_string((string)$name);
+  $query = '
+SELECT id, dir, name
+  FROM '.CATEGORIES_TABLE.'
+  WHERE '.$where_parent.'
+    AND (
+      dir = \''.$dir_sql.'\'
+      OR LOWER(name) = LOWER(\''.$name_sql.'\')
+    )
+  ORDER BY CASE WHEN dir = \''.$dir_sql.'\' THEN 0 ELSE 1 END, id
+  LIMIT 1
+;';
+  $result = pwg_query($query);
+  if (!pwg_db_num_rows($result)) return null;
+  $row = pwg_db_fetch_assoc($result);
+  return (int)$row['id'];
+}
+
+function bratonien_tools_nc_ensure_album_path($relative_dir, $excluded_site_id, array &$cache, array &$created_ids)
+{
+  $relative_dir = trim((string)$relative_dir, '/');
+  if ($relative_dir === '') return null;
+  if (isset($cache[$relative_dir])) return $cache[$relative_dir];
+
+  $parts = explode('/', $relative_dir);
+  $parent_id = null;
+  $path = '';
+  foreach ($parts as $part)
+  {
+    if ($part === '') continue;
+    $path = $path === '' ? $part : $path.'/'.$part;
+    if (isset($cache[$path]))
+    {
+      $parent_id = $cache[$path];
+      continue;
+    }
+
+    $display_name = str_replace('_', ' ', $part);
+    $album_id = bratonien_tools_nc_find_album($parent_id, $part, $display_name, $excluded_site_id);
+    if ($album_id === null)
+    {
+      $created = create_virtual_category($display_name, $parent_id);
+      if (!is_array($created) || empty($created['id']))
+      {
+        $detail = is_array($created) && !empty($created['error']) ? (string)$created['error'] : 'unbekannter Fehler';
+        throw new RuntimeException('Album "'.$display_name.'" konnte nicht angelegt werden: '.$detail);
+      }
+      $album_id = (int)$created['id'];
+      pwg_query('UPDATE '.CATEGORIES_TABLE." SET status='private' WHERE id=".$album_id.' LIMIT 1');
+      add_permission_on_category(array($album_id), get_admins());
+      $created_ids[] = $album_id;
+    }
+
+    $cache[$path] = $album_id;
+    $parent_id = $album_id;
+  }
+
+  return $parent_id;
+}
+
+function bratonien_tools_nc_managed_images($basedir)
+{
+  $prefix = rtrim((string)$basedir, '/').'/';
+  $escaped = pwg_db_real_escape_string(addcslashes($prefix, '_%\\'));
+  $query = "SELECT id, path FROM ".IMAGES_TABLE." WHERE path LIKE '".$escaped."%' ESCAPE '\\\\'";
+  return simple_hash_from_query($query, 'id', 'path');
+}
+
+function bratonien_tools_nc_remove_storage_categories($site_id)
+{
+  // Bestehende Piwigo-Alben gehoeren nicht automatisch dem Connector.
+  // Ohne eindeutige Connector-Eigentumsmarkierung darf hier nichts geloescht werden.
+  return 0;
+}
+
 function bratonien_tools_ws_nc_sync_productive($params, &$service)
 {
-  global $conf, $user, $template, $page;
+  global $conf, $user;
 
   $piwigo_version = defined('PHPWG_VERSION') ? (string)PHPWG_VERSION : '';
   if ($piwigo_version !== '16.4.0')
   {
-    return new PwgError(
-      409,
-      'Bratonien API synchronization is not approved for Piwigo '.$piwigo_version.'. Use the administrator fallback until this Piwigo version has been verified.'
-    );
+    return new PwgError(409, 'Bratonien API synchronization is not approved for Piwigo '.$piwigo_version.'.');
   }
-
   if (empty($conf['enable_synchronization']))
   {
     return new PwgError(403, 'Piwigo filesystem synchronization is disabled.');
   }
 
   $site_id = isset($params['site_id']) ? (int)$params['site_id'] : 1;
-  if ($site_id < 1)
-  {
-    return new PwgError(400, 'Invalid site_id.');
-  }
+  if ($site_id < 1) return new PwgError(400, 'Invalid site_id.');
 
-  $saved_get = $_GET;
-  $saved_post = $_POST;
-  $saved_request_method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : null;
-  $saved_default_status = isset($conf['newcat_default_status']) ? $conf['newcat_default_status'] : null;
-  $output = '';
-  $counts = array();
+  include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
+  include_once(PHPWG_ROOT_PATH.'admin/site_reader_local.php');
+
+  $result = pwg_query('SELECT galleries_url FROM '.SITES_TABLE.' WHERE id='.$site_id.' LIMIT 1');
+  if (!pwg_db_num_rows($result)) return new PwgError(404, 'Piwigo site does not exist.');
+  list($site_url) = pwg_db_fetch_row($result);
+  if (url_is_remote($site_url)) return new PwgError(400, 'Remote Piwigo sites are not supported.');
+
+  $site_reader = new LocalSiteReader($site_url);
+  if (!$site_reader->open()) return new PwgError(500, 'Piwigo could not open the configured local site.');
+
+  $basedir = preg_replace('#/*$#', '', (string)$site_url);
+  $errors = array();
+  $counts = array(
+    'reused_categories'=>0,
+    'new_categories'=>0,
+    'removed_duplicate_categories'=>0,
+    'new_elements'=>0,
+    'del_elements'=>0,
+    'upd_elements'=>0,
+  );
 
   try
   {
-    if (!defined('IN_ADMIN'))
+    list($dbnow) = pwg_db_fetch_row(pwg_query('SELECT NOW()'));
+    $fs_dirs = $site_reader->get_full_directories($basedir);
+    usort($fs_dirs, function($a, $b)
     {
-      define('IN_ADMIN', true);
+      return substr_count((string)$a, '/') <=> substr_count((string)$b, '/');
+    });
+
+    $album_cache = array();
+    $created_ids = array();
+    $dir_to_album = array();
+    foreach ($fs_dirs as $full_dir)
+    {
+      $relative = bratonien_tools_nc_relative_path($basedir, $full_dir);
+      if ($relative === '') continue;
+      $before = count($created_ids);
+      $album_id = bratonien_tools_nc_ensure_album_path($relative, $site_id, $album_cache, $created_ids);
+      if ($album_id !== null)
+      {
+        $dir_to_album[$full_dir] = $album_id;
+        if (count($created_ids) === $before) $counts['reused_categories']++;
+      }
+    }
+    $counts['new_categories'] = count($created_ids);
+
+    $fs = $site_reader->get_elements($basedir);
+    $db_elements = bratonien_tools_nc_managed_images($basedir);
+    $db_by_path = array_flip($db_elements);
+
+    // Nicht-destruktiver Schutz: Bestehende Piwigo-Bilder werden niemals allein
+    // deshalb geloescht, weil sie im aktuellen WebDAV-Scan nicht vorkommen.
+    // Das Entfernen ist erst wieder zulaessig, wenn Connector-Eigentum eindeutig
+    // und verbindungsbezogen gespeichert wird.
+
+    $next_element_id = pwg_db_nextval('id', IMAGES_TABLE);
+    $image_inserts = array();
+    $image_links = array();
+    $new_ids = array();
+    $all_ids = array();
+
+    foreach ($fs as $path=>$file_info)
+    {
+      $dirname = dirname($path);
+      $relative_dir = bratonien_tools_nc_relative_path($basedir, $dirname);
+      $category_id = null;
+      if ($relative_dir !== '')
+      {
+        $category_id = $dir_to_album[$dirname] ?? bratonien_tools_nc_ensure_album_path($relative_dir, $site_id, $album_cache, $created_ids);
+      }
+
+      if (isset($db_by_path[$path]))
+      {
+        // Altbestand niemals umhaengen. Vorhandene Bild-Album-Zuordnungen bleiben
+        // exakt bestehen; der Connector darf nur neue Datensaetze ergaenzen.
+        $all_ids[] = (int)$db_by_path[$path];
+        continue;
+      }
+
+      $filename = basename($path);
+      if (!preg_match($conf['sync_chars_regex'], $filename))
+      {
+        bratonien_tools_nc_productive_error($errors, $path, 'PWG-UPDATE-1');
+        continue;
+      }
+
+      $id = $next_element_id++;
+      $image_inserts[] = array(
+        'id'=>$id,
+        'file'=>$filename,
+        'name'=>get_name_from_file($filename),
+        'date_available'=>$dbnow,
+        'path'=>$path,
+        'representative_ext'=>$file_info['representative_ext'],
+        'storage_category_id'=>null,
+        'added_by'=>(int)$user['id'],
+      );
+      if ($category_id !== null)
+      {
+        $image_links[] = array('image_id'=>$id, 'category_id'=>$category_id);
+      }
+      $new_ids[] = $id;
+      $all_ids[] = $id;
     }
 
-    $conf['newcat_default_status'] = 'private';
-    $_SERVER['REQUEST_METHOD'] = 'POST';
-    $_GET = array(
-      'page' => 'site_update',
-      'site' => $site_id,
+    if ($image_inserts)
+    {
+      mass_inserts(IMAGES_TABLE, array_keys($image_inserts[0]), $image_inserts);
+      if ($image_links) mass_inserts(IMAGE_CATEGORY_TABLE, array_keys($image_links[0]), $image_links);
+      pwg_activity('photo', $new_ids, 'add', array('sync'=>true));
+      $counts['new_elements'] = count($new_ids);
+    }
+
+    // Bestehende Bilder werden nicht durch den Connector aktualisiert. Nur neu
+    // angelegte Connector-Bilder erhalten die aus der Quelle ermittelten Attribute.
+    $updates = array();
+    foreach ($new_ids as $id)
+    {
+      $path_result = pwg_query('SELECT path FROM '.IMAGES_TABLE.' WHERE id='.(int)$id.' LIMIT 1');
+      if (!pwg_db_num_rows($path_result)) continue;
+      list($path) = pwg_db_fetch_row($path_result);
+      $data = $site_reader->get_element_update_attributes($path);
+      if (!is_array($data)) continue;
+      $data['id'] = (int)$id;
+      $updates[] = $data;
+    }
+    if ($updates)
+    {
+      mass_updates(
+        IMAGES_TABLE,
+        array('primary'=>array('id'), 'update'=>$site_reader->get_update_attributes()),
+        $updates
+      );
+    }
+    $counts['upd_elements'] = count($updates);
+
+    images_integrity();
+    categories_integrity();
+    update_uppercats();
+    update_category('all');
+    update_global_rank();
+    invalidate_user_cache();
+
+    return array(
+      'mode'=>'productive',
+      'piwigo_version'=>$piwigo_version,
+      'site_id'=>$site_id,
+      'site_url'=>$site_url,
+      'counts'=>$counts,
+      'errors'=>$errors,
+      'database_writes'=>array_sum($counts) > 0,
     );
-    $_POST = array(
-      'sync' => 'files',
-      'display_info' => 1,
-      'privacy_level' => 0,
-      'sync_meta' => 1,
-      'simulate' => 0,
-      'subcats-included' => 1,
-      'bratonien_connector' => 1,
-      'submit' => 1,
-    );
-
-    ob_start();
-    include(PHPWG_ROOT_PATH.'admin/site_update.php');
-    $output = (string)ob_get_clean();
   }
-  catch (Throwable $e)
+  catch (Throwable $error)
   {
-    if (ob_get_level() > 0)
-    {
-      ob_end_clean();
-    }
-    return new PwgError(500, 'Piwigo core synchronization failed: '.$e->getMessage());
+    return new PwgError(500, 'Bratonien NC synchronization failed: '.$error->getMessage());
   }
-  finally
-  {
-    $_GET = $saved_get;
-    $_POST = $saved_post;
-    if ($saved_default_status === null)
-    {
-      unset($conf['newcat_default_status']);
-    }
-    else
-    {
-      $conf['newcat_default_status'] = $saved_default_status;
-    }
-    if ($saved_request_method === null)
-    {
-      unset($_SERVER['REQUEST_METHOD']);
-    }
-    else
-    {
-      $_SERVER['REQUEST_METHOD'] = $saved_request_method;
-    }
-  }
-
-  return array(
-    'mode' => 'productive',
-    'approved_piwigo_version' => '16.4.0',
-    'piwigo_version' => $piwigo_version,
-    'site_id' => $site_id,
-    'counts' => is_array($counts) ? $counts : array(),
-    'database_writes' => true,
-    'core_output_bytes' => strlen($output),
-    'username' => isset($user['username']) ? (string)$user['username'] : '',
-    'status' => isset($user['status']) ? (string)$user['status'] : '',
-  );
 }

include/nc_transport.inc.php

@@ -0,0 +1,340 @@
+<?php
+
+function bratonien_tools_nc_transport_host($url)
+{
+  $host = trim((string)parse_url((string)$url, PHP_URL_HOST));
+  if ($host === '') throw new RuntimeException('Die Nextcloud-Adresse enthält keinen gültigen Hostnamen oder keine IP-Adresse.');
+  return trim($host, '[]');
+}
+
+function bratonien_tools_nc_transport_scheme($url)
+{
+  $scheme = strtolower(trim((string)parse_url((string)$url, PHP_URL_SCHEME)));
+  if (!in_array($scheme, array('http','https'), true)) throw new RuntimeException('Nextcloud muss per HTTP oder HTTPS angesprochen werden.');
+  return $scheme;
+}
+
+function bratonien_tools_nc_transport_is_ip($host)
+{
+  return filter_var(trim((string)$host, '[]'), FILTER_VALIDATE_IP) !== false;
+}
+
+function bratonien_tools_nc_transport_public_ip($host)
+{
+  static $cache = array();
+
+  $host = strtolower(trim((string)$host, '[]'));
+  if ($host === '') throw new RuntimeException('Für die Nextcloud-Verbindung fehlt der Hostname.');
+  if (bratonien_tools_nc_transport_is_ip($host)) return $host;
+  if (isset($cache[$host])) return $cache[$host];
+  if (!function_exists('curl_init')) throw new RuntimeException('Der öffentliche DNS-Abgleich benötigt PHP-cURL.');
+
+  $providers = array(
+    array('host'=>'dns.google', 'ips'=>array('8.8.8.8','8.8.4.4'), 'url'=>'https://dns.google/resolve?name='.rawurlencode($host).'&type=A'),
+    array('host'=>'cloudflare-dns.com', 'ips'=>array('1.1.1.1','1.0.0.1'), 'url'=>'https://cloudflare-dns.com/dns-query?name='.rawurlencode($host).'&type=A'),
+  );
+
+  foreach ($providers as $provider)
+  {
+    foreach ($provider['ips'] as $resolver_ip)
+    {
+      $ch = curl_init($provider['url']);
+      $options = array(
+        CURLOPT_RETURNTRANSFER=>true,
+        CURLOPT_FOLLOWLOCATION=>false,
+        CURLOPT_CONNECTTIMEOUT=>5,
+        CURLOPT_TIMEOUT=>10,
+        CURLOPT_HTTPHEADER=>array('Accept: application/dns-json'),
+        CURLOPT_USERAGENT=>'Bratonien-Tools-DNS/0.9.7.1',
+      );
+      if (defined('CURLOPT_RESOLVE'))
+      {
+        $options[CURLOPT_RESOLVE] = array($provider['host'].':443:'.$resolver_ip);
+      }
+      curl_setopt_array($ch, $options);
+      $body = curl_exec($ch);
+      $errno = curl_errno($ch);
+      $status = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+      curl_close($ch);
+      if ($body === false || $errno !== 0 || $status < 200 || $status >= 300) continue;
+
+      $decoded = json_decode((string)$body, true);
+      if (!is_array($decoded) || !isset($decoded['Answer']) || !is_array($decoded['Answer'])) continue;
+      foreach ($decoded['Answer'] as $answer)
+      {
+        if ((int)($answer['type'] ?? 0) !== 1) continue;
+        $ip = trim((string)($answer['data'] ?? ''));
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) continue;
+        return $cache[$host] = $ip;
+      }
+    }
+  }
+
+  throw new RuntimeException('Für '.$host.' konnte keine öffentliche IPv4-Adresse ermittelt werden.');
+}
+
+function bratonien_tools_nc_transport_resolve_entry($url)
+{
+  $scheme = bratonien_tools_nc_transport_scheme($url);
+  $host = bratonien_tools_nc_transport_host($url);
+  if (bratonien_tools_nc_transport_is_ip($host)) return null;
+
+  $port = (int)parse_url((string)$url, PHP_URL_PORT);
+  if ($port < 1) $port = $scheme === 'https' ? 443 : 80;
+  $ip = bratonien_tools_nc_transport_public_ip($host);
+  return $host.':'.$port.':'.$ip;
+}
+
+function bratonien_tools_nc_transport_apply_curl(array &$options, $url)
+{
+  $entry = bratonien_tools_nc_transport_resolve_entry($url);
+  if ($entry !== null)
+  {
+    if (!defined('CURLOPT_RESOLVE')) throw new RuntimeException('Diese cURL-Version unterstützt keine direkte Host-zu-IP-Zuordnung.');
+    $options[CURLOPT_RESOLVE] = array($entry);
+  }
+}
+
+function bratonien_tools_nc_transport_http($url, $username = '', $password = '', array $headers = array())
+{
+  if (!function_exists('curl_init')) throw new RuntimeException('Der Server kann Nextcloud derzeit nicht per HTTP prüfen.');
+
+  $ch = curl_init($url);
+  $options = array(
+    CURLOPT_RETURNTRANSFER=>true,
+    CURLOPT_FOLLOWLOCATION=>true,
+    CURLOPT_MAXREDIRS=>3,
+    CURLOPT_CONNECTTIMEOUT=>8,
+    CURLOPT_TIMEOUT=>15,
+    CURLOPT_HTTPHEADER=>array_merge(array('Accept: application/json'), $headers),
+    CURLOPT_USERAGENT=>'Bratonien-Tools-NC-Wizard/0.9.7.1',
+  );
+  bratonien_tools_nc_transport_apply_curl($options, $url);
+
+  if ($username !== '')
+  {
+    $options[CURLOPT_HTTPAUTH] = CURLAUTH_BASIC;
+    $options[CURLOPT_USERPWD] = $username.':'.$password;
+  }
+
+  curl_setopt_array($ch, $options);
+  $body = curl_exec($ch);
+  $errno = curl_errno($ch);
+  $error = curl_error($ch);
+  $status = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  if ($body === false || $errno !== 0)
+  {
+    throw new RuntimeException('Verbindung fehlgeschlagen'.($error !== '' ? ': '.$error : '.'));
+  }
+
+  return array('status'=>$status, 'body'=>(string)$body);
+}
+
+function bratonien_tools_nc_transport_webdav_list(array $state, $path = '')
+{
+  if (empty($state['scan_ok']) || trim((string)$state['base_url']) === '' || trim((string)$state['username']) === '' || (string)$state['_password'] === '')
+  {
+    throw new RuntimeException('Die Nextcloud-Sitzung des Assistenten ist nicht vollständig.');
+  }
+  if (!function_exists('curl_init')) throw new RuntimeException('cURL ist für die Verzeichnisauswahl nicht verfügbar.');
+
+  $path = trim((string)$path, '/');
+  if ($path !== '' && preg_match('#(^|/)\.\.(/|$)#', $path)) throw new RuntimeException('Ungültiger Verzeichnispfad.');
+
+  $segments = $path === '' ? array() : array_map('rawurlencode', explode('/', $path));
+  $user = rawurlencode((string)$state['username']);
+  $url = rtrim((string)$state['base_url'], '/').'/remote.php/dav/files/'.$user.'/'.implode('/', $segments);
+  if (substr($url, -1) !== '/') $url .= '/';
+
+  $body = '<?xml version="1.0"?><d:propfind xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns"><d:prop><d:resourcetype/><d:displayname/><oc:fileid/></d:prop></d:propfind>';
+  $ch = curl_init($url);
+  $options = array(
+    CURLOPT_RETURNTRANSFER=>true,
+    CURLOPT_CUSTOMREQUEST=>'PROPFIND',
+    CURLOPT_POSTFIELDS=>$body,
+    CURLOPT_HTTPHEADER=>array('Depth: 1','Content-Type: application/xml; charset=utf-8'),
+    CURLOPT_HTTPAUTH=>CURLAUTH_BASIC,
+    CURLOPT_USERPWD=>(string)$state['username'].':'.(string)$state['_password'],
+    CURLOPT_CONNECTTIMEOUT=>8,
+    CURLOPT_TIMEOUT=>20,
+  );
+  bratonien_tools_nc_transport_apply_curl($options, $url);
+  curl_setopt_array($ch, $options);
+  $response = curl_exec($ch);
+  $errno = curl_errno($ch);
+  $error = curl_error($ch);
+  $status = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  if ($response === false || $errno !== 0) throw new RuntimeException('Nextcloud-Verzeichnisse konnten nicht geladen werden'.($error !== '' ? ': '.$error : '.'));
+  if ($status === 401 || $status === 403) throw new RuntimeException('Nextcloud hat den Zugriff auf dieses Verzeichnis abgelehnt.');
+  if ($status !== 207) throw new RuntimeException('Nextcloud-Verzeichnisabfrage antwortete mit HTTP '.$status.'.');
+
+  libxml_use_internal_errors(true);
+  $xml = simplexml_load_string((string)$response);
+  if ($xml === false) throw new RuntimeException('Nextcloud hat eine ungültige WebDAV-Antwort geliefert.');
+  $xml->registerXPathNamespace('d', 'DAV:');
+  $xml->registerXPathNamespace('oc', 'http://owncloud.org/ns');
+
+  $children = array();
+  $fileids = array();
+  $current_fileid = 0;
+  $base_path = (string)parse_url($url, PHP_URL_PATH);
+
+  foreach ($xml->xpath('//d:response') as $item)
+  {
+    $item->registerXPathNamespace('d', 'DAV:');
+    $item->registerXPathNamespace('oc', 'http://owncloud.org/ns');
+    $hrefs = $item->xpath('d:href');
+    $collections = $item->xpath('d:propstat/d:prop/d:resourcetype/d:collection');
+    $ids = $item->xpath('d:propstat/d:prop/oc:fileid');
+    if (!$hrefs || !$collections || !$ids) continue;
+
+    $fileid = (int)trim((string)$ids[0]);
+    if ($fileid < 1) continue;
+    $href = rawurldecode((string)$hrefs[0]);
+    $href_path = (string)parse_url($href, PHP_URL_PATH);
+
+    if (rtrim($href_path, '/') === rtrim($base_path, '/'))
+    {
+      $current_fileid = $fileid;
+      continue;
+    }
+
+    $name = basename(rtrim($href_path, '/'));
+    if ($name === '') continue;
+    $child_path = $path === '' ? $name : $path.'/'.$name;
+    $children[$child_path] = $name;
+    $fileids[$child_path] = $fileid;
+  }
+  natcasesort($children);
+
+  if ($current_fileid < 1) throw new RuntimeException('Nextcloud hat für das aktuelle Verzeichnis keine eindeutige Datei-ID geliefert.');
+
+  $parent = '';
+  if ($path !== '')
+  {
+    $parts = explode('/', $path);
+    array_pop($parts);
+    $parent = implode('/', $parts);
+  }
+
+  return array(
+    'current'=>$path,
+    'parent'=>$parent,
+    'children'=>$children,
+    'current_fileid'=>$current_fileid,
+    'fileids'=>$fileids,
+  );
+}
+
+function bratonien_tools_nc_transport_refresh_directory_state(array &$state, $path = null)
+{
+  if ($path === null) $path = (string)($state['directory_path'] ?? '');
+  $listing = bratonien_tools_nc_transport_webdav_list($state, $path);
+  $state['directory_path'] = (string)$listing['current'];
+  $state['directory_parent'] = (string)$listing['parent'];
+  $state['directory_children'] = (array)$listing['children'];
+  $state['directory_current_fileid'] = (int)$listing['current_fileid'];
+  $state['directory_fileids'] = (array)$listing['fileids'];
+  if (!isset($state['directory_selected']) || !is_array($state['directory_selected'])) $state['directory_selected'] = array();
+  if (!isset($state['directory_selected_fileids']) || !is_array($state['directory_selected_fileids'])) $state['directory_selected_fileids'] = array();
+}
+
+function bratonien_tools_nc_transport_wizard_directory_browse()
+{
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)$state['step'] !== 2 || (string)$state['technical_stage'] !== 'mounts' || empty($state['directory_selection_ready'])) throw new RuntimeException('Die Verzeichnisauswahl ist in diesem Fenster nicht verfügbar.');
+  $path = trim((string)($_POST['nc_wizard_directory_path'] ?? ''), '/');
+  bratonien_tools_nc_transport_refresh_directory_state($state, $path);
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Verzeichnis geöffnet.');
+}
+
+function bratonien_tools_nc_transport_edit_start()
+{
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection) throw new RuntimeException('Connector-Verbindung wurde nicht gefunden.');
+
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $is_webdav = (string)$connection['adapter'] === 'remote'
+    && (string)($config['source_mode'] ?? '') === 'webdav-placeholder';
+  if (!$is_webdav) return bratonien_tools_nc_connector_edit_start();
+
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+  $base_url = trim((string)($config['nextcloud_url'] ?? ''));
+  $username = trim((string)($credentials['nextcloud_user'] ?? ''));
+  if ($username === '') $username = trim((string)($config['nextcloud_access_user'] ?? $config['access_user'] ?? ''));
+  $password = (string)($credentials['nextcloud_password'] ?? '');
+
+  $roots = isset($config['roots']) && is_array($config['roots']) ? array_values($config['roots']) : array();
+  $selected = array();
+  $selected_ids = array();
+  foreach ($roots as $root)
+  {
+    $path = trim((string)($root['webdav_path'] ?? ''), '/');
+    $fileid = (int)($root['fileid'] ?? 0);
+    if ($fileid < 1) continue;
+    $selected[] = $path;
+    $selected_ids[$path] = $fileid;
+  }
+
+  $state = bratonien_tools_nc_wizard_state();
+  $state = array_merge($state, array(
+    'editing_connection_id'=>$id,
+    'editing_adapter'=>(string)$connection['adapter'],
+    'editing_mode'=>'update',
+    'connection_name'=>(string)$connection['name'],
+    'host_input'=>$base_url,
+    'base_url'=>$base_url,
+    'username'=>$username,
+    '_password'=>$password,
+    '_fallback_user'=>(string)($credentials['piwigo_user'] ?? ''),
+    '_fallback_password'=>(string)($credentials['piwigo_password'] ?? ''),
+    '_api_key_id'=>(string)($credentials['api_key_id'] ?? ''),
+    '_api_key_secret'=>(string)($credentials['api_key_secret'] ?? ''),
+    'api_status'=>trim((string)($credentials['api_key_id'] ?? '')) !== '' && trim((string)($credentials['api_key_secret'] ?? '')) !== '' ? 'ok' : 'pending',
+    'roots'=>$roots,
+    'directory_selected'=>$selected,
+    'directory_selected_fileids'=>$selected_ids,
+    'source_mode'=>'webdav-placeholder',
+    'transport'=>'webdav',
+  ));
+
+  if ($base_url !== '' && $username !== '' && $password !== '')
+  {
+    $state['step'] = 2;
+    $state['scan_ok'] = true;
+    $state['technical_stage'] = 'mounts';
+    $state['technical_source'] = 'WebDAV';
+    $state['technical_error'] = '';
+    $state['technical_complete'] = false;
+    $state['directory_selection_ready'] = true;
+    $state['directory_path'] = '';
+    $state['directory_parent'] = '';
+    $state['directory_children'] = array();
+    $state['directory_current_fileid'] = 0;
+
+    try
+    {
+      bratonien_tools_nc_transport_refresh_directory_state($state, '');
+    }
+    catch (Throwable $e)
+    {
+      $state['step'] = 1;
+      $state['scan_ok'] = false;
+      $state['technical_error'] = $e->getMessage();
+    }
+  }
+  else
+  {
+    $state['step'] = 1;
+    $state['scan_ok'] = false;
+  }
+
+  bratonien_tools_nc_wizard_store($state);
+  return array('message'=>'Verbindung #'.$id.' wurde zum Bearbeiten geöffnet.');
+}

include/self_update.inc.php

@@ -14,6 +14,53 @@ function bratonien_tools_current_version()
   return '0.0.0';
 }
 
+function bratonien_tools_self_update_fetch_text($url, &$body, &$details)
+{
+  $body = '';
+  $details = '';
+
+  if (function_exists('curl_init'))
+  {
+    $ch = curl_init($url);
+    curl_setopt_array($ch, array(
+      CURLOPT_RETURNTRANSFER => true,
+      CURLOPT_FOLLOWLOCATION => true,
+      CURLOPT_MAXREDIRS => 3,
+      CURLOPT_CONNECTTIMEOUT => 10,
+      CURLOPT_TIMEOUT => 20,
+      CURLOPT_USERAGENT => 'Bratonien-Tools-Updater/'.bratonien_tools_current_version(),
+      CURLOPT_HTTPHEADER => array('Accept: application/vnd.github+json, text/plain;q=0.9, */*;q=0.8'),
+    ));
+    $response = curl_exec($ch);
+    $errno = curl_errno($ch);
+    $error = curl_error($ch);
+    $http = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    curl_close($ch);
+
+    if ($response === false || $errno !== 0)
+    {
+      $details = 'cURL-Fehler '.$errno.': '.$error;
+      return false;
+    }
+    if ($http < 200 || $http >= 300)
+    {
+      $details = 'HTTP '.$http;
+      return false;
+    }
+
+    $body = (string)$response;
+    return true;
+  }
+
+  if (function_exists('fetchRemote') && fetchRemote($url, $body))
+  {
+    return true;
+  }
+
+  $details = 'Remote-Inhalt konnte nicht geladen werden.';
+  return false;
+}
+
 function bratonien_tools_remote_update_info($force = false)
 {
   $cache_key = 'bratonien_self_update_status';
@@ -28,28 +75,68 @@ function bratonien_tools_remote_update_info($force = false)
   }
 
   $current = bratonien_tools_current_version();
-  $remote_main = '';
-  $ok = function_exists('fetchRemote') && fetchRemote('https://raw.githubusercontent.com/Terranom674/Piwigo_Bratonien_Tools/main/main.inc.php', $remote_main);
-  if (!$ok || !preg_match('/Version:\s*([\w.-]+)/i', (string)$remote_main, $m))
+  $commit_json = '';
+  $details = '';
+  $commit_url = 'https://api.github.com/repos/Terranom674/Piwigo_Bratonien_Tools/commits/main';
+
+  if (!bratonien_tools_self_update_fetch_text($commit_url, $commit_json, $details))
   {
     $data = array(
       'checked_at' => time(),
       'current' => $current,
       'remote' => null,
+      'signature' => null,
+      'main_sha256' => null,
       'update_available' => false,
-      'error' => 'GitHub konnte nicht erreicht oder die Versionsnummer nicht gelesen werden.',
+      'error' => 'GitHub konnte nicht erreicht oder der aktuelle Commit nicht ermittelt werden.'.($details !== '' ? ' Details: '.$details : ''),
     );
   }
   else
   {
-    $remote = trim($m[1]);
-    $data = array(
-      'checked_at' => time(),
-      'current' => $current,
-      'remote' => $remote,
-      'update_available' => version_compare($remote, $current, '>'),
-      'error' => null,
-    );
+    $commit = json_decode($commit_json, true);
+    $signature = is_array($commit) ? strtolower(trim((string)($commit['sha'] ?? ''))) : '';
+    if (!preg_match('/^[a-f0-9]{40}$/', $signature))
+    {
+      $data = array(
+        'checked_at' => time(),
+        'current' => $current,
+        'remote' => null,
+        'signature' => null,
+        'main_sha256' => null,
+        'update_available' => false,
+        'error' => 'GitHub lieferte keine gültige Commit-Signatur für main.',
+      );
+    }
+    else
+    {
+      $remote_main = '';
+      $raw_url = 'https://raw.githubusercontent.com/Terranom674/Piwigo_Bratonien_Tools/'.$signature.'/main.inc.php';
+      if (!bratonien_tools_self_update_fetch_text($raw_url, $remote_main, $details) || !preg_match('/Version:\s*([\w.-]+)/i', (string)$remote_main, $m))
+      {
+        $data = array(
+          'checked_at' => time(),
+          'current' => $current,
+          'remote' => null,
+          'signature' => $signature,
+          'main_sha256' => null,
+          'update_available' => false,
+          'error' => 'Die Plugin-Version des ermittelten GitHub-Commits konnte nicht gelesen werden.'.($details !== '' ? ' Details: '.$details : ''),
+        );
+      }
+      else
+      {
+        $remote = trim($m[1]);
+        $data = array(
+          'checked_at' => time(),
+          'current' => $current,
+          'remote' => $remote,
+          'signature' => $signature,
+          'main_sha256' => hash('sha256', (string)$remote_main),
+          'update_available' => version_compare($remote, $current, '>'),
+          'error' => null,
+        );
+      }
+    }
   }
 
   if (function_exists('conf_update_param'))
@@ -72,16 +159,17 @@ function bratonien_tools_self_update_check()
     throw new RuntimeException($info['error']);
   }
 
+  $signature_label = !empty($info['signature']) ? substr($info['signature'], 0, 12) : 'unbekannt';
   if (!empty($info['update_available']))
   {
     return array(
-      'message' => 'Update verfügbar: '.$info['current'].' → '.$info['remote'].'.',
+      'message' => 'Update verfügbar: '.$info['current'].' → '.$info['remote'].' · Signatur '.$signature_label.'.',
       'self_update' => $info,
     );
   }
 
   return array(
-    'message' => 'Bratonien Tools ist aktuell (Version '.$info['current'].').',
+    'message' => 'Bratonien Tools ist aktuell (Version '.$info['current'].', Signatur '.$signature_label.').',
     'self_update' => $info,
   );
 }
@@ -172,6 +260,23 @@ function bratonien_tools_download_update_archive($url, &$data, &$details)
   return true;
 }
 
+function bratonien_tools_self_update_find_source($extract_dir, $signature)
+{
+  $expected = rtrim($extract_dir, '/').'/Piwigo_Bratonien_Tools-'.$signature;
+  if (is_dir($expected))
+  {
+    return $expected;
+  }
+
+  $candidates = glob(rtrim($extract_dir, '/').'/Piwigo_Bratonien_Tools-*', GLOB_ONLYDIR);
+  if (is_array($candidates) && count($candidates) === 1)
+  {
+    return $candidates[0];
+  }
+
+  return '';
+}
+
 function bratonien_tools_self_update_run()
 {
   global $template;
@@ -202,6 +307,13 @@ function bratonien_tools_self_update_run()
     );
   }
 
+  $signature = strtolower(trim((string)($info['signature'] ?? '')));
+  $expected_main_sha256 = strtolower(trim((string)($info['main_sha256'] ?? '')));
+  if (!preg_match('/^[a-f0-9]{40}$/', $signature) || !preg_match('/^[a-f0-9]{64}$/', $expected_main_sha256))
+  {
+    throw new RuntimeException('Update abgebrochen: Version oder Signatur des Zielstands ist unvollständig.');
+  }
+
   $work_root = rtrim(PHPWG_ROOT_PATH, '/').'/_data/bratonien-updater';
   if (!is_dir($work_root) && !@mkdir($work_root, 0755, true))
   {
@@ -216,7 +328,7 @@ function bratonien_tools_self_update_run()
 
   $zip_data = '';
   $download_details = '';
-  $archive_url = 'https://codeload.github.com/Terranom674/Piwigo_Bratonien_Tools/zip/refs/heads/main';
+  $archive_url = 'https://codeload.github.com/Terranom674/Piwigo_Bratonien_Tools/zip/'.$signature;
   if (!bratonien_tools_download_update_archive($archive_url, $zip_data, $download_details))
   {
     bratonien_tools_self_update_rrmdir($run_dir);
@@ -245,12 +357,12 @@ function bratonien_tools_self_update_run()
   }
   $zip->close();
 
-  $source = $extract_dir.'/Piwigo_Bratonien_Tools-main';
-  $source_main = $source.'/main.inc.php';
-  if (!is_file($source_main))
+  $source = bratonien_tools_self_update_find_source($extract_dir, $signature);
+  $source_main = $source !== '' ? $source.'/main.inc.php' : '';
+  if ($source === '' || !is_file($source_main))
   {
     bratonien_tools_self_update_rrmdir($run_dir);
-    throw new RuntimeException('Das geladene Archiv enthält kein gültiges Bratonien-Tools-Plugin. Erwartet wurde: '.$source_main);
+    throw new RuntimeException('Das geladene Archiv enthält kein gültiges Bratonien-Tools-Plugin für die erwartete Signatur '.substr($signature, 0, 12).'.');
   }
 
   $remote_main = @file_get_contents($source_main);
@@ -259,11 +371,18 @@ function bratonien_tools_self_update_run()
     bratonien_tools_self_update_rrmdir($run_dir);
     throw new RuntimeException('Die geladene Plugin-Version konnte nicht verifiziert werden. main.inc.php fehlt oder enthält keine lesbare Plugin-/Versionsangabe.');
   }
+
   $package_version = trim($vm[1]);
+  $package_main_sha256 = hash('sha256', (string)$remote_main);
+  if (!hash_equals($expected_main_sha256, $package_main_sha256))
+  {
+    bratonien_tools_self_update_rrmdir($run_dir);
+    throw new RuntimeException('Signaturprüfung fehlgeschlagen: Das geladene Paket gehört nicht exakt zum zuvor geprüften GitHub-Stand '.substr($signature, 0, 12).'.');
+  }
   if ($package_version !== $info['remote'])
   {
     bratonien_tools_self_update_rrmdir($run_dir);
-    throw new RuntimeException('Versionsprüfung fehlgeschlagen: Erwartet '.$info['remote'].', erhalten '.$package_version.'.');
+    throw new RuntimeException('Versionsprüfung fehlgeschlagen: Erwartet '.$info['remote'].', erhalten '.$package_version.'; Signatur '.substr($signature, 0, 12).'.');
   }
 
   $plugin_dir = rtrim(BRATONIEN_TOOLS_PATH, '/');
@@ -320,11 +439,13 @@ function bratonien_tools_self_update_run()
     'checked_at' => time(),
     'current' => $package_version,
     'remote' => $package_version,
+    'signature' => $signature,
+    'main_sha256' => $package_main_sha256,
     'update_available' => false,
     'error' => null,
   );
   return array(
-    'message' => 'Bratonien Tools wurde auf Version '.$package_version.' aktualisiert. Backup: '.$backup_dir,
+    'message' => 'Bratonien Tools wurde auf Version '.$package_version.' aktualisiert. Signatur '.substr($signature, 0, 12).'. Backup: '.$backup_dir,
     'self_update' => $updated_info,
   );
 }

include/tool_registry.inc.php

@@ -4,6 +4,17 @@ if (!defined('PHPWG_ROOT_PATH'))
   die('Hacking attempt!');
 }
 
+if (isset($GLOBALS['template']) && is_object($GLOBALS['template']) && method_exists($GLOBALS['template'], 'func_combine_script'))
+{
+  $script_version = function_exists('bratonien_tools_current_version') ? bratonien_tools_current_version() : '0.9.7.1';
+  $GLOBALS['template']->func_combine_script(array(
+    'id'=>'bratonien_nc_connector_edit_v2',
+    'path'=>BRATONIEN_TOOLS_PATH.'js/nc_connector_edit_v2.js',
+    'load'=>'footer',
+    'version'=>$script_version,
+  ));
+}
+
 require_once(BRATONIEN_TOOLS_PATH . 'tools/image_cache.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'tools/watermark.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'tools/watermark_profiles.inc.php');
@@ -17,113 +28,88 @@ require_once(BRATONIEN_TOOLS_PATH . 'include/album_shares.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/album_lock.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_manage.inc.php');
-require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_takeover.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_auth.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_create_api.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_piwigo_api.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_wizard.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_wizard_db_bridge.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_wizard_user_scope.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_wizard_flow.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_connection_scope.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_generic_scope.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_delete_safe.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_webdav.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_wizard_webdav_flow.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_edit.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_transport.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_scheduler.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_system.inc.php');
+
+function bratonien_tools_nc_connector_run_now()
+{
+  $connection_id = isset($_POST['connection_id']) ? max(0, (int)$_POST['connection_id']) : 0;
+  if ($connection_id > 0)
+  {
+    $connection = bratonien_tools_nc_connector_connection($connection_id, false);
+    if (!$connection)
+    {
+      throw new RuntimeException('Die ausgewählte Verbindung existiert nicht.');
+    }
+  }
+  $result = bratonien_tools_nc_scheduler_spawn(true, $connection_id);
+  return array('message'=>(string)($result['message'] ?? ($connection_id > 0 ? 'Abgleich wurde gestartet.' : 'Abgleich für alle Verbindungen wurde gestartet.')));
+}
 
 function bratonien_tools_get_tools()
 {
   return array(
-    'image_cache_clear' => array(
-      'handler' => 'bratonien_tools_clear_image_cache',
-    ),
-    'image_cache_build' => array(
-      'handler' => 'bratonien_tools_start_main_cache_build',
-    ),
-    'image_cache_cancel' => array(
-      'handler' => 'bratonien_tools_cancel_main_cache_build',
-    ),
-    'image_cache_worker_settings' => array(
-      'handler' => 'bratonien_tools_save_cache_worker_settings',
-    ),
-    'watermark_save' => array(
-      'handler' => 'bratonien_tools_save_watermark',
-    ),
-    'watermark_file_delete' => array(
-      'handler' => 'bratonien_tools_delete_watermark_file',
-    ),
-    'watermark_engine' => array(
-      'handler' => 'bratonien_tools_handle_watermark_engine',
-    ),
-    'watermark_profile_save' => array(
-      'handler' => 'bratonien_tools_save_watermark_profile',
-    ),
-    'watermark_profile_delete' => array(
-      'handler' => 'bratonien_tools_delete_watermark_profile',
-    ),
-    'watermark_profile_duplicate' => array(
-      'handler' => 'bratonien_tools_duplicate_watermark_profile',
-    ),
-    'watermark_defaults' => array(
-      'handler' => 'bratonien_tools_save_watermark_defaults',
-    ),
-    'watermark_rule' => array(
-      'handler' => 'bratonien_tools_save_album_rule',
-    ),
-    'public_selection_settings' => array(
-      'handler' => 'bratonien_tools_save_public_selection_settings',
-    ),
-    'asset_upload' => array(
-      'handler' => 'bratonien_tools_upload_asset',
-    ),
-    'asset_delete' => array(
-      'handler' => 'bratonien_tools_delete_asset',
-    ),
-    'asset_upload_limits' => array(
-      'handler' => 'bratonien_tools_save_upload_limits',
-    ),
-    'album_lock_toggle' => array(
-      'handler' => 'bratonien_tools_toggle_album_lock',
-    ),
-    'album_share_create' => array(
-      'handler' => 'bratonien_tools_create_album_share',
-    ),
-    'album_share_regenerate_link' => array(
-      'handler' => 'bratonien_tools_regenerate_album_share_link',
-    ),
-    'album_share_revoke' => array(
-      'handler' => 'bratonien_tools_revoke_album_share',
-    ),
-    'nc_connector_create_local' => array(
-      'handler' => 'bratonien_tools_nc_connector_create_local_api_first',
-    ),
-    'nc_connector_delete' => array(
-      'handler' => 'bratonien_tools_nc_connector_delete',
-    ),
-    'nc_connector_import_legacy' => array(
-      'handler' => 'bratonien_tools_nc_connector_import_legacy',
-    ),
-    'nc_connector_verify' => array(
-      'handler' => 'bratonien_tools_nc_connector_verify_managed',
-    ),
-    'nc_connector_prepare_takeover' => array(
-      'handler' => 'bratonien_tools_nc_connector_prepare_takeover',
-    ),
-    'nc_connector_cancel_takeover' => array(
-      'handler' => 'bratonien_tools_nc_connector_cancel_takeover',
-    ),
-    'nc_connector_piwigo_api_test' => array(
-      'handler' => 'bratonien_tools_nc_connector_piwigo_api_test',
-    ),
-    'nc_connector_piwigo_api_delete' => array(
-      'handler' => 'bratonien_tools_nc_connector_api_delete',
-    ),
-    'nc_connector_fallback_save' => array(
-      'handler' => 'bratonien_tools_nc_connector_fallback_save',
-    ),
-    'nc_connector_fallback_delete' => array(
-      'handler' => 'bratonien_tools_nc_connector_fallback_delete',
-    ),
-    'nc_connector_fallback_once' => array(
-      'handler' => 'bratonien_tools_nc_connector_fallback_once',
-    ),
-    'self_update_check' => array(
-      'handler' => 'bratonien_tools_self_update_check',
-    ),
-    'self_update_run' => array(
-      'handler' => 'bratonien_tools_self_update_run',
-    ),
+    'image_cache_clear' => array('handler' => 'bratonien_tools_clear_image_cache'),
+    'image_cache_build' => array('handler' => 'bratonien_tools_start_main_cache_build'),
+    'image_cache_cancel' => array('handler' => 'bratonien_tools_cancel_main_cache_build'),
+    'image_cache_worker_settings' => array('handler' => 'bratonien_tools_save_cache_worker_settings'),
+    'watermark_save' => array('handler' => 'bratonien_tools_save_watermark'),
+    'watermark_file_delete' => array('handler' => 'bratonien_tools_delete_watermark_file'),
+    'watermark_engine' => array('handler' => 'bratonien_tools_handle_watermark_engine'),
+    'watermark_profile_save' => array('handler' => 'bratonien_tools_save_watermark_profile'),
+    'watermark_profile_delete' => array('handler' => 'bratonien_tools_delete_watermark_profile'),
+    'watermark_profile_duplicate' => array('handler' => 'bratonien_tools_duplicate_watermark_profile'),
+    'watermark_defaults' => array('handler' => 'bratonien_tools_save_watermark_defaults'),
+    'watermark_rule' => array('handler' => 'bratonien_tools_save_album_rule'),
+    'public_selection_settings' => array('handler' => 'bratonien_tools_save_public_selection_settings'),
+    'asset_upload' => array('handler' => 'bratonien_tools_upload_asset'),
+    'asset_delete' => array('handler' => 'bratonien_tools_delete_asset'),
+    'asset_upload_limits' => array('handler' => 'bratonien_tools_save_upload_limits'),
+    'album_lock_toggle' => array('handler' => 'bratonien_tools_toggle_album_lock'),
+    'album_share_create' => array('handler' => 'bratonien_tools_create_album_share'),
+    'album_share_regenerate_link' => array('handler' => 'bratonien_tools_regenerate_album_share_link'),
+    'album_share_revoke' => array('handler' => 'bratonien_tools_revoke_album_share'),
+    'nc_connector_create_webdav_parallel' => array('handler' => 'bratonien_tools_nc_connector_create_webdav_placeholder_from_wizard'),
+    'nc_connector_edit_start' => array('handler' => 'bratonien_tools_nc_transport_edit_start'),
+    'nc_connector_update_local' => array('handler' => 'bratonien_tools_nc_connector_update_local_friendly'),
+    'nc_connector_delete' => array('handler' => 'bratonien_tools_nc_connector_delete_safe'),
+    'nc_connector_update_name' => array('handler' => 'bratonien_tools_nc_connector_update_name'),
+    'nc_connector_update_technical' => array('handler' => 'bratonien_tools_nc_connector_update_technical'),
+    'nc_connector_run_now' => array('handler' => 'bratonien_tools_nc_connector_run_now'),
+    'nc_connector_wizard_scan' => array('handler' => 'bratonien_tools_nc_wizard_scan_webdav_first'),
+    'nc_connector_wizard_save_technical' => array('handler' => 'bratonien_tools_nc_wizard_save_technical_flow'),
+    'nc_connector_wizard_directory_browse' => array('handler' => 'bratonien_tools_nc_transport_wizard_directory_browse'),
+    'nc_connector_wizard_directory_add' => array('handler' => 'bratonien_tools_nc_wizard_directory_add'),
+    'nc_connector_wizard_directory_remove' => array('handler' => 'bratonien_tools_nc_wizard_directory_remove'),
+    'nc_connector_wizard_save_mounts' => array('handler' => 'bratonien_tools_nc_wizard_save_sources_dispatch'),
+    'nc_connector_wizard_select_user' => array('handler' => 'bratonien_tools_nc_wizard_select_current_user'),
+    'nc_connector_wizard_api_test' => array('handler' => 'bratonien_tools_nc_wizard_api_test'),
+    'nc_connector_wizard_api_skip' => array('handler' => 'bratonien_tools_nc_wizard_api_skip'),
+    'nc_connector_wizard_finish' => array('handler' => 'bratonien_tools_nc_wizard_finish_dispatch'),
+    'nc_connector_wizard_back' => array('handler' => 'bratonien_tools_nc_wizard_back'),
+    'nc_connector_wizard_reset' => array('handler' => 'bratonien_tools_nc_wizard_reset'),
+    'nc_connector_verify' => array('handler' => 'bratonien_tools_nc_connector_verify_connection_scoped'),
+    'nc_connector_piwigo_api_test' => array('handler' => 'bratonien_tools_nc_connector_piwigo_api_test'),
+    'nc_connector_piwigo_api_delete' => array('handler' => 'bratonien_tools_nc_connector_api_delete'),
+    'nc_connector_fallback_save' => array('handler' => 'bratonien_tools_nc_connector_fallback_save_scoped'),
+    'nc_connector_fallback_delete' => array('handler' => 'bratonien_tools_nc_connector_fallback_delete_scoped'),
+    'nc_connector_fallback_once' => array('handler' => 'bratonien_tools_nc_connector_fallback_once'),
+    'self_update_check' => array('handler' => 'bratonien_tools_self_update_check'),
+    'self_update_run' => array('handler' => 'bratonien_tools_self_update_run'),
   );
 }
 

include/watermark_engine.inc.php

@@ -8,12 +8,22 @@ require_once(BRATONIEN_TOOLS_PATH . 'include/watermark_base.inc.php');
 
 function bratonien_tools_watermark_engine_enabled()
 {
+  static $initialized = false;
+  static $enabled = false;
+
+  if ($initialized)
+  {
+    return $enabled;
+  }
+
   $config = bratonien_tools_get_watermark_engine_config();
   $enabled = !empty($config['enabled']);
+  $initialized = true;
 
   // Piwigo recalculates use_watermark for custom derivatives from the native
   // watermark file itself. Therefore an active Bratonien engine must keep the
   // native watermark file empty, not only the stored use_watermark flags false.
+  // This initialization is required only once per PHP request.
   if ($enabled)
   {
     bratonien_tools_disable_piwigo_watermarks();

include/watermark_runtime.inc.php

@@ -27,6 +27,72 @@ function bratonien_tools_runtime_category_id()
   return 0;
 }
 
+function bratonien_tools_watermark_album_cover_category($src_image, $category_id=null)
+{
+  static $map = null;
+
+  if ($map === null)
+  {
+    $map = new SplObjectStorage();
+  }
+
+  if (!is_object($src_image))
+  {
+    return 0;
+  }
+
+  if ($category_id !== null)
+  {
+    $category_id = (int)$category_id;
+    if ($category_id > 0)
+    {
+      $map[$src_image] = $category_id;
+    }
+    return $category_id;
+  }
+
+  return $map->contains($src_image) ? (int)$map[$src_image] : 0;
+}
+
+function bratonien_tools_watermark_prepare_album_overview($thumbnails)
+{
+  if (!is_array($thumbnails))
+  {
+    return $thumbnails;
+  }
+
+  foreach ($thumbnails as &$thumbnail)
+  {
+    $category_id = (int)($thumbnail['id'] ?? $thumbnail['ID'] ?? 0);
+    if ($category_id < 1 || empty($thumbnail['representative']['src_image']) || !is_object($thumbnail['representative']['src_image']))
+    {
+      continue;
+    }
+
+    // Ein Repraesentantenbild kann fuer mehrere Alben verwendet werden. Piwigo
+    // reicht in der Albumuebersicht aber nur das SrcImage an get_derivative_url
+    // weiter. Deshalb bekommt jedes Album-Cover eine eigene SrcImage-Instanz,
+    // damit seine konkrete Albumregel erhalten bleibt.
+    $src_image = clone $thumbnail['representative']['src_image'];
+    $thumbnail['representative']['src_image'] = $src_image;
+    bratonien_tools_watermark_album_cover_category($src_image, $category_id);
+  }
+  unset($thumbnail);
+
+  return $thumbnails;
+}
+
+function bratonien_tools_runtime_derivative_category_id($src_image)
+{
+  $category_id = bratonien_tools_runtime_category_id();
+  if ($category_id > 0)
+  {
+    return $category_id;
+  }
+
+  return bratonien_tools_watermark_album_cover_category($src_image);
+}
+
 function bratonien_tools_runtime_effective_rule($category_id)
 {
   static $categories = null;
@@ -230,7 +296,7 @@ function bratonien_tools_filter_derivative_url($url, $params, $src_image, $rel_u
     return $url;
   }
 
-  $rule = bratonien_tools_runtime_effective_rule(bratonien_tools_runtime_category_id());
+  $rule = bratonien_tools_runtime_effective_rule(bratonien_tools_runtime_derivative_category_id($src_image));
   if ($rule['mode'] !== 'profile' || empty($rule['profile_id']))
   {
     return $url;

include/webdav_gallery_runtime.inc.php

@@ -0,0 +1,98 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_webdav_derivative_matches_preview($derivative_path, $params, $image_id)
+{
+  $derivative_path = (string)$derivative_path;
+  $image_id = (int)$image_id;
+  if ($derivative_path === '' || $image_id < 1 || !is_file($derivative_path) || !is_readable($derivative_path)) return false;
+
+  $info = bratonien_tools_webdav_image_source_info($image_id);
+  if (!$info) return false;
+
+  $preview = bratonien_tools_webdav_preview_path($info);
+  if (!$preview || !is_file($preview) || !is_readable($preview)) return false;
+
+  $preview_size = @getimagesize($preview);
+  $derivative_size = @getimagesize($derivative_path);
+  if (!is_array($preview_size) || empty($preview_size[0]) || empty($preview_size[1])) return false;
+  if (!is_array($derivative_size) || empty($derivative_size[0]) || empty($derivative_size[1])) return false;
+
+  try
+  {
+    $expected_size = $params->compute_final_size(array((int)$preview_size[0], (int)$preview_size[1]));
+  }
+  catch (Throwable $e)
+  {
+    return false;
+  }
+
+  if (!is_array($expected_size) || !isset($expected_size[0], $expected_size[1])) return false;
+  if ((int)$derivative_size[0] !== (int)$expected_size[0] || (int)$derivative_size[1] !== (int)$expected_size[1]) return false;
+
+  $preview_mtime = @filemtime($preview) ?: 0;
+  $derivative_mtime = @filemtime($derivative_path) ?: 0;
+  if ($preview_mtime > 0 && $derivative_mtime < $preview_mtime) return false;
+
+  return true;
+}
+
+function bratonien_tools_webdav_ondemand_derivative_url($image_id, $params)
+{
+  $image_id = (int)$image_id;
+  if ($image_id < 1 || !is_object($params)) return null;
+
+  $type = trim((string)($params->type ?? ''));
+  if ($type === '') return null;
+
+  return get_root_url().'plugins/'.BRATONIEN_TOOLS_ID.'/webdav-derivative.php?id='.$image_id.'&type='.rawurlencode($type);
+}
+
+function bratonien_tools_filter_webdav_gallery_derivative_url($url, $params, $src_image, $rel_url)
+{
+  if (!is_object($src_image) || empty($src_image->id) || empty($src_image->rel_path)) return $url;
+
+  $source_path = str_replace('\\', '/', (string)$src_image->rel_path);
+  if (!preg_match('#/nc-webdav-source/connection-[0-9]+/root-[0-9]+/.+$#', $source_path))
+  {
+    return $url;
+  }
+
+  $image_id = (int)$src_image->id;
+  try
+  {
+    $derivative = new DerivativeImage($params, $src_image);
+    if (!$derivative->same_as_source())
+    {
+      $derivative_path = $derivative->get_path();
+      if (bratonien_tools_webdav_derivative_matches_preview($derivative_path, $params, $image_id))
+      {
+        return $url;
+      }
+    }
+  }
+  catch (Throwable $e)
+  {
+    error_log('Bratonien WebDAV derivative lookup #'.$image_id.': '.$e->getMessage());
+  }
+
+  // Auf der Picture-/Fotorama-Seite wird nicht mehr waehrend des HTML-Aufbaus
+  // synchron erzeugt. Fotorama arbeitet lazy: Erst wenn das konkrete Bild in
+  // den Fokus kommt und seine URL abruft, erzeugt dieser Endpoint genau dieses
+  // angeforderte Standard-Derivat aus dem bereits gecachten NC-Preview.
+  $script_name = basename((string)($_SERVER['SCRIPT_NAME'] ?? ''));
+  if ($script_name === 'picture.php')
+  {
+    $ondemand_url = bratonien_tools_webdav_ondemand_derivative_url($image_id, $params);
+    if ($ondemand_url) return $ondemand_url;
+  }
+
+  // Galerie-Fallback: niemals Connector-Platzhalter ausliefern. Solange kein
+  // lokales korrektes Derivat vorliegt, wird das echte vorbereitete NC-Preview
+  // verwendet. Der eigentliche Galerie-Derivattyp wird beim Sync vorgebaut.
+  $preview_url = bratonien_tools_webdav_image_url($image_id, true);
+  return $preview_url ?: $url;
+}

include/webdav_image_runtime.inc.php

@@ -0,0 +1,467 @@
+<?php
+if (!defined('PHPWG_ROOT_PATH'))
+{
+  die('Hacking attempt!');
+}
+
+function bratonien_tools_webdav_image_source_info($image_id)
+{
+  static $cache = array();
+  static $connection_cache = array();
+  static $mapping_cache = array();
+
+  $image_id = (int)$image_id;
+  if ($image_id < 1) return null;
+  if (array_key_exists($image_id, $cache)) return $cache[$image_id];
+
+  $result = pwg_query('SELECT path, coi FROM '.IMAGES_TABLE.' WHERE id='.$image_id.' LIMIT 1');
+  if (!pwg_db_num_rows($result)) return $cache[$image_id] = null;
+  $row = pwg_db_fetch_assoc($result);
+  $path = (string)($row['path'] ?? '');
+  if ($path === '') return $cache[$image_id] = null;
+
+  $absolute = $path;
+  if (strpos($absolute, '/') !== 0)
+  {
+    $absolute = PHPWG_ROOT_PATH.ltrim(preg_replace('#^\\./#', '', $absolute), '/');
+  }
+  $resolved = realpath($absolute);
+  if ($resolved === false) return $cache[$image_id] = null;
+
+  $normalized = str_replace('\\\\', '/', $resolved);
+  if (!preg_match('#/nc-webdav-source/connection-([0-9]+)/root-([0-9]+)/(.*)$#', $normalized, $match))
+  {
+    return $cache[$image_id] = null;
+  }
+
+  $connection_id = (int)$match[1];
+  $root_fileid = (int)$match[2];
+  $relative_path = trim((string)$match[3], '/');
+  if ($relative_path === '') return $cache[$image_id] = null;
+
+  if (!array_key_exists($connection_id, $connection_cache))
+  {
+    $table = defined('BRATONIEN_TOOLS_NC_CONNECTIONS_TABLE')
+      ? BRATONIEN_TOOLS_NC_CONNECTIONS_TABLE
+      : $GLOBALS['prefixeTable'].'bratonien_tools_nc_connections';
+    $connection_result = pwg_query('SELECT config_json FROM `'.$table.'` WHERE id='.$connection_id.' LIMIT 1');
+    if (!pwg_db_num_rows($connection_result))
+    {
+      $connection_cache[$connection_id] = null;
+    }
+    else
+    {
+      $connection_row = pwg_db_fetch_assoc($connection_result);
+      $decoded = json_decode((string)$connection_row['config_json'], true);
+      $connection_cache[$connection_id] = is_array($decoded) ? $decoded : null;
+    }
+  }
+
+  $config = $connection_cache[$connection_id];
+  if (!is_array($config) || (string)($config['source_mode'] ?? '') !== 'webdav-placeholder')
+  {
+    return $cache[$image_id] = null;
+  }
+
+  $root_path = '';
+  $root_found = false;
+  $roots = isset($config['roots']) && is_array($config['roots']) ? $config['roots'] : array();
+  foreach ($roots as $root)
+  {
+    if ((int)($root['fileid'] ?? 0) === $root_fileid)
+    {
+      $root_path = trim((string)($root['webdav_path'] ?? ''), '/');
+      $root_found = true;
+      break;
+    }
+  }
+  if (!$root_found) return $cache[$image_id] = null;
+
+  $root_is_base = $root_path === '';
+  $webdav_path = $root_is_base ? $relative_path : $root_path.'/'.$relative_path;
+  $content_type = '';
+  $size = 0;
+  $etag = '';
+
+  if (!array_key_exists($connection_id, $mapping_cache))
+  {
+    $mapping_cache[$connection_id] = array();
+    $state_dir = rtrim((string)($config['state_dir'] ?? ''), '/');
+    if ($state_dir !== '')
+    {
+      $mapping_file = $state_dir.'/webdav-map.json';
+      if (is_readable($mapping_file))
+      {
+        $mapping = json_decode((string)file_get_contents($mapping_file), true);
+        if (is_array($mapping) && isset($mapping['files']) && is_array($mapping['files']))
+        {
+          $mapping_cache[$connection_id] = $mapping['files'];
+        }
+      }
+    }
+  }
+
+  $entry = $mapping_cache[$connection_id][$resolved] ?? $mapping_cache[$connection_id][$normalized] ?? null;
+  if (is_array($entry) && (string)($entry['kind'] ?? '') === 'file')
+  {
+    $webdav_path = trim((string)($entry['webdav_path'] ?? $webdav_path), '/');
+    $content_type = (string)($entry['content_type'] ?? '');
+    $size = (int)($entry['size'] ?? 0);
+    $etag = (string)($entry['etag'] ?? '');
+  }
+
+  return $cache[$image_id] = array(
+    'image_id'=>$image_id,
+    'connection_id'=>$connection_id,
+    'webdav_path'=>$webdav_path,
+    'root_is_base'=>$root_is_base,
+    'content_type'=>$content_type,
+    'size'=>$size,
+    'etag'=>$etag,
+    'coi'=>$row['coi'] ?? null,
+  );
+}
+
+function bratonien_tools_webdav_image_url($image_id, $preview=false)
+{
+  $info = bratonien_tools_webdav_image_source_info($image_id);
+  if (!$info) return null;
+
+  $url = get_root_url().'plugins/'.BRATONIEN_TOOLS_ID.'/webdav-image.php?id='.(int)$image_id;
+  if ($preview) $url .= '&preview=1';
+  if ($info['etag'] !== '') $url .= '&v='.rawurlencode(substr(sha1($info['etag']), 0, 12));
+  return $url;
+}
+
+function bratonien_tools_webdav_preview_path(array $info)
+{
+  $connection_id = (int)($info['connection_id'] ?? 0);
+  $webdav_path = trim((string)($info['webdav_path'] ?? ''), '/');
+  if ($connection_id < 1 || $webdav_path === '') return null;
+
+  $base = PHPWG_ROOT_PATH.'_data/bratonien-tools/nc-webdav-preview/connection-'.$connection_id.'/'.sha1($webdav_path);
+  foreach (array('jpg', 'png', 'webp') as $ext)
+  {
+    $path = $base.'.'.$ext;
+    if (is_file($path) && is_readable($path)) return $path;
+  }
+  return null;
+}
+
+function bratonien_tools_webdav_preview_content_type($path)
+{
+  $ext = strtolower(pathinfo((string)$path, PATHINFO_EXTENSION));
+  if ($ext === 'png') return 'image/png';
+  if ($ext === 'webp') return 'image/webp';
+  return 'image/jpeg';
+}
+
+function bratonien_tools_webdav_custom_derivative_params($key)
+{
+  if (!class_exists('DerivativeParams') || !class_exists('SizingParams')) return null;
+  $tokens = explode('_', (string)$key);
+  if (!$tokens) return null;
+
+  $token = array_shift($tokens);
+  $crop = 0;
+  $min_size = null;
+  $parse_size = function($value)
+  {
+    $parts = explode('x', (string)$value, 2);
+    if (count($parts) === 1)
+    {
+      $size = max(1, (int)$parts[0]);
+      return array($size, $size);
+    }
+    return array(max(1, (int)$parts[0]), max(1, (int)$parts[1]));
+  };
+
+  if (isset($token[0]) && $token[0] === 's')
+  {
+    $size = $parse_size(substr($token, 1));
+  }
+  elseif (isset($token[0]) && $token[0] === 'e')
+  {
+    $crop = 1;
+    $size = $min_size = $parse_size(substr($token, 1));
+  }
+  else
+  {
+    if (count($tokens) < 2) return null;
+    $size = $parse_size($token);
+    $crop_token = array_shift($tokens);
+    $min_size = $parse_size(array_shift($tokens));
+    $crop = function_exists('char_to_fraction') ? char_to_fraction($crop_token) : 0;
+  }
+
+  $params = new DerivativeParams(new SizingParams($size, $crop, $min_size));
+  if (class_exists('ImageStdParams')) ImageStdParams::apply_global($params);
+  return $params;
+}
+
+function bratonien_tools_webdav_derivative_variants()
+{
+  $variants = array();
+  if (!class_exists('ImageStdParams')) return $variants;
+
+  foreach (ImageStdParams::get_defined_type_map() as $type => $params)
+  {
+    $variants['standard:'.$type] = $params;
+  }
+  foreach (ImageStdParams::$custom as $custom_key => $last_used)
+  {
+    $params = bratonien_tools_webdav_custom_derivative_params($custom_key);
+    if ($params) $variants['custom:'.$custom_key] = $params;
+  }
+  return $variants;
+}
+
+function bratonien_tools_webdav_generate_derivative($params, $src_image, &$detail=null)
+{
+  global $conf;
+
+  $detail = '';
+  if (!is_object($src_image) || empty($src_image->id))
+  {
+    $detail = 'SrcImage fehlt.';
+    return false;
+  }
+
+  $info = bratonien_tools_webdav_image_source_info((int)$src_image->id);
+  if (!$info)
+  {
+    $detail = 'WebDAV-Quellzuordnung fehlt.';
+    return false;
+  }
+
+  $preview = bratonien_tools_webdav_preview_path($info);
+  if (!$preview)
+  {
+    $detail = 'Vorbereitetes WebDAV-Preview fehlt.';
+    return false;
+  }
+
+  $preview_ext = strtolower(pathinfo($preview, PATHINFO_EXTENSION));
+  if (!in_array($preview_ext, array('jpg', 'jpeg', 'png', 'gif'), true))
+  {
+    $detail = 'Preview-Format '.$preview_ext.' ist für die Piwigo-Bildbibliothek nicht sicher nutzbar.';
+    return false;
+  }
+
+  if (!class_exists('DerivativeImage')) require_once(PHPWG_ROOT_PATH.'include/derivative.inc.php');
+  if (!class_exists('pwg_image')) require_once(PHPWG_ROOT_PATH.'admin/include/image.class.php');
+
+  $derivative = new DerivativeImage($params, $src_image);
+  if ($derivative->same_as_source())
+  {
+    $detail = 'Identisch mit Quelle; kein eigenes Derivat erforderlich.';
+    return true;
+  }
+
+  $target = $derivative->get_path();
+  $derivative_root = PHPWG_ROOT_PATH.PWG_DERIVATIVE_DIR;
+  if ($target === '' || strpos($target, $derivative_root) !== 0)
+  {
+    $detail = 'Ungültiger Derivat-Zielpfad: '.$target;
+    return false;
+  }
+
+  $preview_mtime = @filemtime($preview) ?: 0;
+  if (is_file($target) && is_readable($target) && (@filemtime($target) ?: 0) >= max($preview_mtime, (int)($params->last_mod_time ?? 0)))
+  {
+    $detail = 'Bereits vorhanden.';
+    return true;
+  }
+
+  $directory = dirname($target);
+  $dir_ok = function_exists('mkgetdir') ? mkgetdir($directory) : (is_dir($directory) || @mkdir($directory, 0755, true));
+  if (!$dir_ok || !is_dir($directory))
+  {
+    $detail = 'Derivat-Verzeichnis konnte nicht angelegt werden: '.$directory;
+    return false;
+  }
+
+  $image = null;
+  try
+  {
+    $image = new pwg_image($preview);
+    $original_size = array((int)$image->get_width(), (int)$image->get_height());
+    if ($original_size[0] < 1 || $original_size[1] < 1)
+    {
+      $detail = 'Preview-Abmessungen sind ungültig.';
+      return false;
+    }
+
+    $crop_rect = null;
+    $scaled_size = null;
+    $params->sizing->compute($original_size, $info['coi'] ?? null, $crop_rect, $scaled_size);
+
+    if ($crop_rect)
+    {
+      if (!$image->crop($crop_rect->width(), $crop_rect->height(), $crop_rect->l, $crop_rect->t))
+      {
+        $detail = 'Crop fehlgeschlagen.';
+        return false;
+      }
+    }
+
+    $final_size = $original_size;
+    if ($crop_rect)
+    {
+      $final_size = array($crop_rect->width(), $crop_rect->height());
+    }
+    if ($scaled_size)
+    {
+      if (!$image->resize($scaled_size[0], $scaled_size[1]))
+      {
+        $detail = 'Resize fehlgeschlagen.';
+        return false;
+      }
+      $final_size = array((int)$scaled_size[0], (int)$scaled_size[1]);
+    }
+
+    if (!empty($params->sharpen) && !$image->sharpen($params->sharpen))
+    {
+      $detail = 'Sharpen fehlgeschlagen.';
+      return false;
+    }
+
+    if ($params->will_watermark($final_size))
+    {
+      $wm = ImageStdParams::get_watermark();
+      if (!empty($wm->file))
+      {
+        $wm_path = PHPWG_ROOT_PATH.$wm->file;
+        if (!is_file($wm_path) || !is_readable($wm_path))
+        {
+          $detail = 'Wasserzeichen-Datei fehlt: '.$wm_path;
+          return false;
+        }
+
+        $wm_image = new pwg_image($wm_path);
+        try
+        {
+          $wm_size = array((int)$wm_image->get_width(), (int)$wm_image->get_height());
+          if ($final_size[0] < $wm_size[0] || $final_size[1] < $wm_size[1])
+          {
+            $wm_scaling = SizingParams::classic($final_size[0], $final_size[1]);
+            $tmp = null;
+            $wm_scaled = null;
+            $wm_scaling->compute($wm_size, null, $tmp, $wm_scaled);
+            if ($wm_scaled)
+            {
+              $wm_image->resize($wm_scaled[0], $wm_scaled[1]);
+              $wm_size = array((int)$wm_scaled[0], (int)$wm_scaled[1]);
+            }
+          }
+
+          $x = (int)round(($wm->xpos / 100) * ($final_size[0] - $wm_size[0]));
+          $y = (int)round(($wm->ypos / 100) * ($final_size[1] - $wm_size[1]));
+          $image->compose($wm_image, $x, $y, $wm->opacity);
+
+          if ($wm->xrepeat || $wm->yrepeat)
+          {
+            $xpad = $wm_size[0] + max(30, (int)round($wm_size[0] / 4));
+            $ypad = $wm_size[1] + max(30, (int)round($wm_size[1] / 4));
+            for ($i = -$wm->xrepeat; $i <= $wm->xrepeat; $i++)
+            {
+              for ($j = -$wm->yrepeat; $j <= $wm->yrepeat; $j++)
+              {
+                if (!$i && !$j) continue;
+                $x2 = $x + $i * $xpad;
+                $y2 = $y + $j * $ypad;
+                if ($x2 >= 0 && $x2 + $wm_size[0] < $final_size[0] && $y2 >= 0 && $y2 + $wm_size[1] < $final_size[1])
+                {
+                  $image->compose($wm_image, $x2, $y2, $wm->opacity);
+                }
+              }
+            }
+          }
+        }
+        finally
+        {
+          $wm_image->destroy();
+        }
+      }
+    }
+
+    if (isset($conf['derivatives_strip_metadata_threshold']) && $final_size[0] * $final_size[1] < (int)$conf['derivatives_strip_metadata_threshold'])
+    {
+      $image->strip();
+    }
+
+    $quality = (int)ImageStdParams::$quality;
+    if (isset($params->type) && in_array($params->type, array(IMG_3XLARGE, IMG_4XLARGE), true))
+    {
+      $quality = min($quality, 75);
+    }
+    $image->set_compression_quality($quality);
+
+    $written = $image->write($target);
+    if ($written === false)
+    {
+      $detail = 'Bildbibliothek konnte das Derivat nicht schreiben.';
+      return false;
+    }
+  }
+  catch (Throwable $e)
+  {
+    $detail = get_class($e).': '.$e->getMessage();
+    return false;
+  }
+  finally
+  {
+    if (is_object($image)) $image->destroy();
+  }
+
+  @chmod($target, 0644);
+  clearstatcache(true, $target);
+  $size = @getimagesize($target);
+  if (!is_file($target) || !is_readable($target) || !is_array($size) || empty($size[0]) || empty($size[1]))
+  {
+    $detail = 'Derivatdatei wurde nicht gültig erzeugt: '.$target;
+    return false;
+  }
+
+  $detail = 'Erzeugt: '.$target.' ('.$size[0].'x'.$size[1].').';
+  return true;
+}
+
+function bratonien_tools_filter_webdav_src_url($url, $src_image)
+{
+  if (!is_object($src_image) || empty($src_image->id)) return $url;
+  $webdav_url = bratonien_tools_webdav_image_url((int)$src_image->id, false);
+  return $webdav_url ?: $url;
+}
+
+function bratonien_tools_filter_webdav_derivative_url($url, $params, $src_image, $rel_url)
+{
+  if (!is_object($src_image) || empty($src_image->id)) return $url;
+
+  // Hotpath: Bei einem bereits vorbereiteten WebDAV-Derivat keinerlei
+  // Connection-DB oder Mapping-Datei mehr anfassen. Der reale Quellpfad
+  // reicht aus, um Connector-Bilder sicher zu erkennen.
+  $source_path = $src_image->get_path();
+  $resolved_source = $source_path !== '' ? realpath($source_path) : false;
+  if ($resolved_source === false || !preg_match('#/nc-webdav-source/connection-[0-9]+/root-[0-9]+/#', str_replace('\\\\', '/', $resolved_source)))
+  {
+    return $url;
+  }
+
+  try
+  {
+    $derivative = new DerivativeImage($params, $src_image);
+    if (!$derivative->same_as_source())
+    {
+      $path = $derivative->get_path();
+      if ($path !== '' && is_file($path) && is_readable($path)) return $url;
+    }
+  }
+  catch (Throwable $e)
+  {
+    error_log('Bratonien WebDAV derivative lookup #'.(int)$src_image->id.': '.$e->getMessage());
+  }
+
+  $preview_url = bratonien_tools_webdav_image_url((int)$src_image->id, true);
+  return $preview_url ?: $url;
+}

js/admin_tabs.js

@@ -1,6 +1,94 @@
 (function () {
   'use strict';
 
+  function initNcRouteStatus() {
+    var section = document.getElementById('nc-connector');
+    if (!section) return;
+
+    var statusCard = section.querySelector('.bratonien-grid .bratonien-card');
+    if (!statusCard) return;
+
+    var grid = statusCard.querySelector('.bratonien-form-grid');
+    if (!grid) return;
+
+    var routeLabel = document.createElement('span');
+    routeLabel.className = 'bratonien-label';
+    routeLabel.textContent = 'Aktiver Datenweg';
+
+    var routeValue = document.createElement('strong');
+    routeValue.setAttribute('data-nc-route-status', '');
+    routeValue.textContent = 'Noch kein Lauf erfasst';
+
+    var routeTimeLabel = document.createElement('span');
+    routeTimeLabel.className = 'bratonien-label';
+    routeTimeLabel.textContent = 'Datenweg zuletzt';
+
+    var routeTimeValue = document.createElement('strong');
+    routeTimeValue.setAttribute('data-nc-route-time', '');
+    routeTimeValue.textContent = 'Nicht verfügbar';
+
+    grid.appendChild(routeLabel);
+    grid.appendChild(routeValue);
+    grid.appendChild(routeTimeLabel);
+    grid.appendChild(routeTimeValue);
+
+    var detail = document.createElement('p');
+    detail.className = 'bratonien-base-note';
+    detail.setAttribute('data-nc-route-detail', '');
+    detail.textContent = 'Der Datenweg wird nach dem nächsten Connector-Lauf angezeigt.';
+    statusCard.appendChild(detail);
+
+    var basePath = window.location.pathname.replace(/admin\.php.*$/, '');
+    var statusUrl = basePath + '_data/bratonien-tools/nc-connector-status/route-status.json';
+
+    function formatTime(timestamp) {
+      if (!timestamp) return 'Nicht verfügbar';
+      var date = new Date(Number(timestamp) * 1000);
+      if (Number.isNaN(date.getTime())) return 'Nicht verfügbar';
+      return date.toLocaleString('de-DE');
+    }
+
+    function render(data) {
+      var label = data && data.label ? String(data.label) : 'Unbekannt';
+      var route = data && data.route ? String(data.route) : '';
+      routeValue.textContent = label;
+      routeTimeValue.textContent = formatTime(data && data.timestamp);
+
+      if (route === 'webdav') {
+        routeValue.textContent = 'WEBDAV PRIMÄR';
+        detail.textContent = 'Portierung läuft über WebDAV. Legacy wurde in diesem Lauf nicht benutzt.';
+      } else if (route === 'legacy_fallback') {
+        routeValue.textContent = 'LEGACY-FALLBACK AKTIV';
+        detail.textContent = 'WebDAV war nicht erfolgreich. Dieser Lauf wurde über die alte Struktur abgefangen.';
+      } else if (route === 'failed') {
+        routeValue.textContent = 'FEHLER - KEIN ERFOLGREICHER DATENWEG';
+        detail.textContent = data && data.detail ? String(data.detail) : 'WebDAV und Fallback sind fehlgeschlagen.';
+      } else {
+        detail.textContent = data && data.detail ? String(data.detail) : 'Unbekannter Datenweg.';
+      }
+    }
+
+    function refresh() {
+      fetch(statusUrl + '?t=' + Date.now(), {
+        cache: 'no-store',
+        credentials: 'same-origin'
+      })
+        .then(function (response) {
+          if (!response.ok) throw new Error('status unavailable');
+          return response.json();
+        })
+        .then(render)
+        .catch(function () {
+          routeValue.textContent = 'Noch kein Lauf erfasst';
+          routeTimeValue.textContent = 'Nicht verfügbar';
+          detail.textContent = 'Nach dem nächsten Connector-Lauf wird hier WebDAV oder Legacy-Fallback angezeigt.';
+        });
+    }
+
+    refresh();
+    window.setInterval(refresh, 10000);
+  }
+
   function initBratonienTabs() {
     var admin = document.querySelector('.bratonien-admin');
     if (!admin) return;
@@ -113,9 +201,14 @@
     activate(initial, false);
   }
 
-  if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', initBratonienTabs);
-  } else {
+  function init() {
     initBratonienTabs();
+    initNcRouteStatus();
+  }
+
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', init);
+  } else {
+    init();
   }
 })();

js/nc_connector_edit_v2.js

@@ -0,0 +1,236 @@
+(function () {
+  'use strict';
+
+  function ready(callback) {
+    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', callback);
+    else callback();
+  }
+
+  ready(function () {
+    var section = document.getElementById('nc-connector');
+    if (!section) return;
+
+    var tokenInput = section.querySelector('input[name="pwg_token"]');
+    var pwgToken = tokenInput ? tokenInput.value : '';
+
+    var technicalButton = document.getElementById('bratonien-nc-technical-open');
+    if (technicalButton) technicalButton.remove();
+    var technicalCreate = document.getElementById('bratonien-nc-technical-create');
+    if (technicalCreate) technicalCreate.remove();
+
+    var statusHeading = Array.prototype.find.call(section.querySelectorAll('h4'), function (heading) {
+      return heading.textContent.trim() === 'Status';
+    });
+    var statusCard = statusHeading ? statusHeading.closest('.bratonien-card') : null;
+    if (statusCard && pwgToken && !statusCard.querySelector('[data-nc-run-now]')) {
+      var runForm = document.createElement('form');
+      runForm.method = 'post';
+      runForm.className = 'bratonien-actions';
+      runForm.style.marginTop = '1rem';
+      runForm.setAttribute('data-nc-run-now', '1');
+      runForm.innerHTML = '<input type="hidden" name="pwg_token" value="'+escapeHtml(pwgToken)+'">'
+        + '<button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_run_now">Jetzt abgleichen</button>';
+      runForm.addEventListener('submit', function () {
+        var button = runForm.querySelector('button');
+        if (button) {
+          button.disabled = true;
+          button.textContent = 'Abgleich wird gestartet …';
+        }
+      });
+      statusCard.appendChild(runForm);
+    }
+
+    function escapeHtml(value) {
+      return String(value == null ? '' : value).replace(/[&<>"']/g, function (c) {
+        return {'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#039;'}[c];
+      });
+    }
+
+    function loadConnection(id) {
+      return fetch('plugins/bratonien_tools/nc-connector-edit-data.php?connection_id='+encodeURIComponent(id)+'&_='+Date.now(), {
+        credentials:'same-origin', cache:'no-store', headers:{'Accept':'application/json'}
+      }).then(function (response) {
+        return response.json().then(function (data) {
+          if (!response.ok) throw new Error(data.error || ('HTTP '+response.status));
+          return data;
+        });
+      });
+    }
+
+    function createPostForm(label, tool, id) {
+      var form = document.createElement('form');
+      form.method = 'post';
+      form.style.display = 'inline';
+      form.innerHTML = '<input type="hidden" name="pwg_token" value="'+escapeHtml(pwgToken)+'">'
+        + '<input type="hidden" name="connection_id" value="'+escapeHtml(id)+'">'
+        + '<button class="buttonLike" type="submit" name="bratonien_tool" value="'+escapeHtml(tool)+'">'+escapeHtml(label)+'</button>';
+      return form;
+    }
+
+    function dialog() {
+      var node = document.getElementById('bratonien-nc-connection-edit-v2');
+      if (node) return node;
+      node = document.createElement('dialog');
+      node.id = 'bratonien-nc-connection-edit-v2';
+      node.className = 'bratonien-edit-dialog';
+      node.innerHTML = '<div class="bratonien-edit-dialog__body">'
+        + '<div style="display:flex;align-items:flex-start;justify-content:space-between;gap:1rem">'
+        + '<div><h4 style="margin:0">Verbindung bearbeiten</h4><p class="bratonien-base-note" style="margin:.35rem 0 0">Die Einstellungen gelten nur für diese Verbindung.</p></div>'
+        + '<button type="button" class="buttonLike" data-edit-close>Schließen</button></div>'
+        + '<div data-edit-content style="margin-top:1rem"></div></div>';
+      document.body.appendChild(node);
+      node.querySelector('[data-edit-close]').addEventListener('click', function () { node.close(); });
+      node.addEventListener('click', function (event) { if (event.target === node) node.close(); });
+      return node;
+    }
+
+    function storageRow(storage) {
+      storage = storage || {};
+      return '<div class="bratonien-storage-row" data-storage-row>'
+        + '<label>Storage-ID<input name="nc_storage_id[]" value="'+escapeHtml(storage.storage_id || '')+'" required></label>'
+        + '<label>Quellordner<input name="nc_source_prefix[]" value="'+escapeHtml(storage.source_prefix || '')+'" placeholder="optional"></label>'
+        + '<label>Lokaler Speicherpfad<input name="nc_local_mount[]" value="'+escapeHtml(storage.local_mount || '')+'" required></label>'
+        + '<button type="button" class="buttonLike" data-remove-storage>Entfernen</button></div>';
+    }
+
+    function showError(form, data) {
+      var old = form.querySelector('[data-edit-error]');
+      if (old) old.remove();
+      var box = document.createElement('div');
+      box.dataset.editError = '1';
+      box.className = 'bratonien-main-cache__warning';
+      box.style.margin = '0 0 1rem';
+      box.textContent = (data && data.message) ? data.message : 'Die Verbindung konnte nicht gespeichert werden.';
+      form.insertBefore(box, form.firstChild);
+    }
+
+    function submitLocal(form, editDialog) {
+      if (!form.reportValidity()) return;
+      var button = form.querySelector('button[type="submit"]');
+      if (button) button.disabled = true;
+      fetch('plugins/bratonien_tools/nc-connector-edit-save.php', {
+        method:'POST', credentials:'same-origin', cache:'no-store', headers:{'Accept':'application/json'}, body:new FormData(form)
+      }).then(function (response) {
+        return response.json().then(function (data) {
+          if (!response.ok || !data.ok) { showError(form, data); return; }
+          editDialog.close();
+          window.location.reload();
+        });
+      }).catch(function (error) {
+        showError(form, {message:error.message || String(error)});
+      }).finally(function () {
+        if (button) button.disabled = false;
+      });
+    }
+
+    function openLocalEditor(id) {
+      var editDialog = dialog();
+      var content = editDialog.querySelector('[data-edit-content]');
+      content.innerHTML = '<p class="bratonien-base-note">Verbindung wird geladen …</p>';
+      if (typeof editDialog.showModal === 'function') editDialog.showModal();
+      else editDialog.setAttribute('open', 'open');
+
+      loadConnection(id).then(function (data) {
+        if (data.adapter !== 'local') throw new Error('Diese Verbindung wird über den WebDAV-Assistenten bearbeitet.');
+        var legacy = data.legacy || {};
+        var webdav = data.webdav || {};
+        var storages = Array.isArray(legacy.storages) ? legacy.storages : [];
+        var rows = storages.map(storageRow).join('') || storageRow({});
+
+        content.innerHTML = '<form method="post" data-edit-form>'
+          + '<input type="hidden" name="pwg_token" value="'+escapeHtml(pwgToken)+'">'
+          + '<input type="hidden" name="connection_id" value="'+escapeHtml(data.id)+'">'
+          + '<h5>Verbindung</h5><div class="bratonien-form-grid">'
+          + '<label class="bratonien-label">Name</label><input name="connection_name" value="'+escapeHtml(data.name)+'" required>'
+          + '</div>'
+          + '<h5 style="margin-top:1.2rem">Nextcloud</h5><div class="bratonien-form-grid">'
+          + '<label class="bratonien-label">Nextcloud-Adresse</label><input name="nc_nextcloud_url" value="'+escapeHtml(webdav.nextcloud_url || '')+'">'
+          + '<label class="bratonien-label">Nextcloud-Benutzer</label><input name="nc_nextcloud_user" value="'+escapeHtml(webdav.nextcloud_user || '')+'" autocomplete="username">'
+          + '<label class="bratonien-label">Nextcloud-Passwort</label><input name="nc_nextcloud_password" type="password" autocomplete="current-password" placeholder="'+(webdav.has_nextcloud_password ? 'gespeichert – leer = unverändert' : 'noch nicht gespeichert')+'">'
+          + '</div>'
+          + '<h5 style="margin-top:1.2rem">Piwigo-Zugang</h5><div class="bratonien-form-grid">'
+          + '<label class="bratonien-label">API-Schlüssel-ID</label><input name="nc_connection_api_key_id" value="'+escapeHtml(webdav.api_key_id || '')+'" autocomplete="off">'
+          + '<label class="bratonien-label">API-Geheimnis</label><input name="nc_connection_api_key_secret" type="password" autocomplete="new-password" placeholder="'+(webdav.has_api_key_secret ? 'gespeichert – leer = unverändert' : 'noch nicht gespeichert')+'">'
+          + '<label class="bratonien-label">Fallback-Benutzer</label><input name="nc_fallback_user" value="'+escapeHtml(webdav.fallback_user || '')+'" autocomplete="username">'
+          + '<label class="bratonien-label">Fallback-Passwort</label><input name="nc_fallback_password" type="password" autocomplete="current-password" placeholder="'+(webdav.has_fallback_password ? 'gespeichert – leer = unverändert' : 'noch nicht gespeichert')+'">'
+          + '</div>'
+          + '<h5 style="margin-top:1.2rem">Lokaler Connector</h5><div class="bratonien-form-grid">'
+          + '<label class="bratonien-label">Datenbank-Server</label><input name="nc_host" value="'+escapeHtml(legacy.host)+'" required>'
+          + '<label class="bratonien-label">Port</label><input name="nc_port" type="number" min="1" max="65535" value="'+escapeHtml(legacy.port || 5432)+'" required>'
+          + '<label class="bratonien-label">Datenbank</label><input name="nc_database" value="'+escapeHtml(legacy.database)+'" required>'
+          + '<label class="bratonien-label">Reader-Benutzer</label><input name="nc_user" value="'+escapeHtml(legacy.user)+'" required>'
+          + '<label class="bratonien-label">Reader-Passwort</label><input name="nc_db_password" type="password" autocomplete="new-password" placeholder="'+(legacy.has_db_password ? 'gespeichert – leer = unverändert' : 'noch nicht gespeichert')+'">'
+          + '</div>'
+          + '<h5 style="margin-top:1.2rem">Speicherorte</h5><div data-storage-list>'+rows+'</div>'
+          + '<button type="button" class="buttonLike" data-add-storage>Speicherort hinzufügen</button>'
+          + '<details style="margin-top:1rem"><summary>Erweiterte Einstellungen</summary><div class="bratonien-form-grid" style="margin-top:.75rem">'
+          + '<label class="bratonien-label">Source-View</label><input name="nc_source_view" value="'+escapeHtml(legacy.source_view)+'" required>'
+          + '<label class="bratonien-label">Activity-View</label><input name="nc_activity_view" value="'+escapeHtml(legacy.activity_view)+'" required>'
+          + '<label class="bratonien-label">Piwigo-Galerieordner</label><input name="nc_gallery_root" value="'+escapeHtml(legacy.gallery_root)+'" required>'
+          + '<label class="bratonien-label">Ruhezeit (Sek.)</label><input name="nc_quiet_seconds" type="number" min="0" value="'+escapeHtml(legacy.quiet_seconds)+'">'
+          + '<label class="bratonien-label">Maximale Wartezeit (Sek.)</label><input name="nc_max_wait_seconds" type="number" min="60" value="'+escapeHtml(legacy.max_wait_seconds)+'">'
+          + '<label class="bratonien-label">Vollprüfung nach (Sek.)</label><input name="nc_full_sync_seconds" type="number" min="300" value="'+escapeHtml(legacy.full_sync_seconds)+'">'
+          + '</div></details>'
+          + '<div class="bratonien-actions" style="margin-top:1rem"><button class="buttonLike" type="submit">Änderungen prüfen und speichern</button><button class="buttonLike" type="button" data-cancel>Abbrechen</button></div>'
+          + '</form>';
+
+        var form = content.querySelector('[data-edit-form]');
+        form.querySelector('[data-cancel]').addEventListener('click', function () { editDialog.close(); });
+        form.querySelector('[data-add-storage]').addEventListener('click', function () {
+          form.querySelector('[data-storage-list]').insertAdjacentHTML('beforeend', storageRow({}));
+        });
+        form.addEventListener('click', function (event) {
+          var remove = event.target.closest('[data-remove-storage]');
+          if (remove) {
+            var row = remove.closest('[data-storage-row]');
+            if (row) row.remove();
+          }
+        });
+        form.addEventListener('submit', function (event) {
+          event.preventDefault();
+          submitLocal(form, editDialog);
+        });
+      }).catch(function (error) {
+        content.innerHTML = '<p class="bratonien-main-cache__warning"><strong>Bearbeiten nicht möglich:</strong> '+escapeHtml(error.message || String(error))+'</p>';
+      });
+    }
+
+    [].slice.call(section.querySelectorAll('button[value="nc_connector_edit_start"]')).forEach(function (button) {
+      var form = button.closest('form');
+      if (form) form.remove();
+    });
+
+    [].slice.call(section.querySelectorAll('button[value="nc_connector_migrate_start"]')).forEach(function (button) {
+      var form = button.closest('form');
+      if (form) form.remove();
+    });
+
+    [].slice.call(section.querySelectorAll('button[value="nc_connector_delete"]')).forEach(function (deleteButton) {
+      var deleteForm = deleteButton.closest('form');
+      if (!deleteForm || !deleteForm.parentElement) return;
+      var idInput = deleteForm.querySelector('input[name="connection_id"]');
+      if (!idInput) return;
+      var id = idInput.value;
+      var actions = deleteForm.parentElement;
+
+      loadConnection(id).then(function (data) {
+        var edit;
+        if (data.adapter === 'local') {
+          edit = document.createElement('button');
+          edit.type = 'button';
+          edit.className = 'buttonLike';
+          edit.textContent = 'Bearbeiten';
+          edit.addEventListener('click', function () { openLocalEditor(id); });
+        } else {
+          edit = createPostForm('Bearbeiten', 'nc_connector_edit_start', id);
+        }
+        actions.insertBefore(edit, deleteForm);
+      }).catch(function (error) {
+        var info = document.createElement('span');
+        info.className = 'bratonien-main-cache__warning';
+        info.textContent = 'Verbindung konnte nicht geladen werden: '+(error.message || String(error));
+        actions.insertBefore(info, deleteForm);
+      });
+    });
+  });
+})();

main.inc.php

@@ -1,7 +1,7 @@
 <?php
 /*
 Plugin Name: Bratonien Tools
-Version: 0.9.3.20
+Version: 0.9.7.13
 Description: Erweiterbare Administrationswerkzeuge fuer die Bratonien-Piwigo-Installation.
 Plugin URI: https://github.com/Terranom674/Piwigo_Bratonien_Tools
 Author: Bratonien
@@ -16,6 +16,8 @@ define('BRATONIEN_TOOLS_ID', basename(dirname(__FILE__)));
 define('BRATONIEN_TOOLS_PATH', PHPWG_PLUGINS_PATH . BRATONIEN_TOOLS_ID . '/');
 
 require_once(BRATONIEN_TOOLS_PATH . 'include/watermark_runtime.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/webdav_image_runtime.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/webdav_gallery_runtime.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/public_selection.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/picture_navigation.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/batch_titles.inc.php');
@@ -23,11 +25,16 @@ require_once(BRATONIEN_TOOLS_PATH . 'include/album_shares.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_ws.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_orphan_ws.inc.php');
 require_once(BRATONIEN_TOOLS_PATH . 'include/nc_productive_ws.inc.php');
+require_once(BRATONIEN_TOOLS_PATH . 'include/nc_connector_scheduler.inc.php');
 
 add_event_handler('get_admin_plugin_menu_links', 'bratonien_tools_admin_menu');
+add_event_handler('loc_end_index_category_thumbnails', 'bratonien_tools_watermark_prepare_album_overview');
 add_event_handler('get_derivative_url', 'bratonien_tools_filter_derivative_url', EVENT_HANDLER_PRIORITY_NEUTRAL, 4);
+add_event_handler('get_src_image_url', 'bratonien_tools_filter_webdav_src_url', EVENT_HANDLER_PRIORITY_NEUTRAL + 50, 2);
+add_event_handler('get_derivative_url', 'bratonien_tools_filter_webdav_gallery_derivative_url', EVENT_HANDLER_PRIORITY_NEUTRAL + 50, 4);
 add_event_handler('loc_end_element_set_global', 'bratonien_tools_batch_titles_register_action');
 add_event_handler('element_set_global_action', 'bratonien_tools_batch_titles_apply', EVENT_HANDLER_PRIORITY_NEUTRAL, 2);
+add_event_handler('init', 'bratonien_tools_watermark_cache_upgrade', EVENT_HANDLER_PRIORITY_NEUTRAL - 40);
 add_event_handler('init', 'bratonien_tools_prepare_connector_private_import', EVENT_HANDLER_PRIORITY_NEUTRAL - 30);
 add_event_handler('init', 'bratonien_tools_prepare_private_album_permissions', EVENT_HANDLER_PRIORITY_NEUTRAL - 20);
 add_event_handler('init', 'bratonien_tools_preserve_private_album_access', EVENT_HANDLER_PRIORITY_NEUTRAL - 10);
@@ -37,12 +44,6 @@ add_event_handler('ws_add_methods', 'bratonien_tools_register_ws_methods');
 add_event_handler('ws_add_methods', 'bratonien_tools_register_nc_orphan_ws_methods');
 add_event_handler('ws_add_methods', 'bratonien_tools_register_nc_productive_ws_methods');
 
-/**
- * The NC Connector uses Piwigo's native filesystem synchronization for folder
- * shares. Mark only connector-triggered synchronization requests so every new
- * physical album created during that run starts private. The global Piwigo
- * default remains untouched for manual album creation and unrelated imports.
- */
 function bratonien_tools_prepare_connector_private_import()
 {
   global $conf;
@@ -60,12 +61,6 @@ function bratonien_tools_prepare_connector_private_import()
   $conf['newcat_default_status'] = 'private';
 }
 
-/**
- * Piwigo's per-album permissions form rewrites the complete direct-user
- * permission list when an album is saved as private. Add the acting user to
- * that submitted list on the public -> private transition so Piwigo itself
- * persists the permission together with the other selected users.
- */
 function bratonien_tools_prepare_private_album_permissions()
 {
   global $user;

maintain.class.php

@@ -8,6 +8,8 @@ require_once(dirname(__FILE__) . '/include/album_shares.inc.php');
 require_once(dirname(__FILE__) . '/include/database.class.php');
 require_once(dirname(__FILE__) . '/tools/watermark_profiles.inc.php');
 require_once(dirname(__FILE__) . '/include/dependencies.inc.php');
+require_once(dirname(__FILE__) . '/include/nc_connector_scheduler.inc.php');
+require_once(dirname(__FILE__) . '/include/nc_legacy_reset.inc.php');
 
 class bratonien_tools_maintain extends PluginMaintain
 {
@@ -18,9 +20,14 @@ class bratonien_tools_maintain extends PluginMaintain
 
     $dependency_messages = array();
     bratonien_tools_ensure_dependencies($dependency_messages);
+    if (!bratonien_tools_nc_scheduler_install())
+    {
+      $dependency_messages[] = 'Der native NC-Scheduler konnte sein Piwigo-Laufzeitverzeichnis nicht anlegen.';
+    }
 
     if (function_exists('conf_update_param'))
     {
+      conf_update_param('bratonien_nc_scheduler_interval', 60);
       conf_update_param('bratonien_dependency_status', json_encode(array(
         'checked_at' => time(),
         'messages' => $dependency_messages,
@@ -45,6 +52,18 @@ class bratonien_tools_maintain extends PluginMaintain
   public function update($old_version, $new_version, &$errors = array())
   {
     $this->prepare($errors);
+
+    if (version_compare((string)$old_version, '0.9.7.7', '<') && version_compare((string)$new_version, '0.9.7.7', '>='))
+    {
+      try
+      {
+        bratonien_tools_nc_reset_legacy_imports();
+      }
+      catch (Throwable $e)
+      {
+        $errors[] = 'Connector-Altbestand konnte nicht vollständig bereinigt werden: '.$e->getMessage();
+      }
+    }
   }
 
   public function uninstall()

nc-connector-cutover-v2.php

@@ -34,31 +34,18 @@ function fail($message)
 
 function readKeyValueFile($path)
 {
-  if (!is_readable($path))
-  {
-    fail('Konfiguration nicht lesbar: '.$path);
-  }
+  if (!is_readable($path)) fail('Konfiguration nicht lesbar: '.$path);
   $result = array();
   foreach (file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line)
   {
     $line = trim($line);
-    if ($line === '' || $line[0] === '#')
-    {
-      continue;
-    }
-    if (!preg_match('/^([A-Z0-9_]+)=(.*)$/', $line, $matches))
-    {
-      continue;
-    }
+    if ($line === '' || $line[0] === '#') continue;
+    if (!preg_match('/^([A-Z0-9_]+)=(.*)$/', $line, $matches)) continue;
     $value = trim($matches[2]);
     if (strlen($value) >= 2)
     {
-      $first = $value[0];
-      $last = $value[strlen($value)-1];
-      if (($first === '"' && $last === '"') || ($first === "'" && $last === "'"))
-      {
-        $value = substr($value, 1, -1);
-      }
+      $first = $value[0]; $last = $value[strlen($value)-1];
+      if (($first === '"' && $last === '"') || ($first === "'" && $last === "'")) $value = substr($value, 1, -1);
     }
     $result[$matches[1]] = $value;
   }
@@ -67,49 +54,42 @@ function readKeyValueFile($path)
 
 function runCommand(array $command, $allowFailure = false)
 {
-  $spec = array(
-    0 => array('file', '/dev/null', 'r'),
-    1 => array('pipe', 'w'),
-    2 => array('pipe', 'w'),
-  );
+  $spec = array(0=>array('file','/dev/null','r'),1=>array('pipe','w'),2=>array('pipe','w'));
   $process = proc_open($command, $spec, $pipes);
-  if (!is_resource($process))
-  {
-    fail('Prozess konnte nicht gestartet werden: '.implode(' ', $command));
-  }
-  $stdout = stream_get_contents($pipes[1]);
-  $stderr = stream_get_contents($pipes[2]);
-  fclose($pipes[1]);
-  fclose($pipes[2]);
+  if (!is_resource($process)) fail('Prozess konnte nicht gestartet werden: '.implode(' ', $command));
+  $stdout = stream_get_contents($pipes[1]); $stderr = stream_get_contents($pipes[2]);
+  fclose($pipes[1]); fclose($pipes[2]);
   $exit = proc_close($process);
   if ($exit !== 0 && !$allowFailure)
   {
     $detail = trim($stderr) !== '' ? trim($stderr) : trim($stdout);
     fail('Befehl fehlgeschlagen ('.$exit.'): '.implode(' ', $command).($detail !== '' ? "\n".$detail : ''));
   }
-  return array('exit'=>$exit, 'stdout'=>(string)$stdout, 'stderr'=>(string)$stderr);
+  return array('exit'=>$exit,'stdout'=>(string)$stdout,'stderr'=>(string)$stderr);
 }
 
 function decryptConnectorSecret($blob, $hexKey)
 {
-  if (!preg_match('/^[a-f0-9]{64}$/', $hexKey))
-  {
-    fail('Connector-Schluessel ist ungueltig.');
-  }
+  if (!preg_match('/^[a-f0-9]{64}$/', $hexKey)) fail('Connector-Schluessel ist ungueltig.');
   $outer = base64_decode(trim((string)$blob), true);
   $payload = is_string($outer) ? json_decode($outer, true) : null;
-  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1)
-  {
-    fail('Connector-Zugangsdaten haben ein unbekanntes Format.');
-  }
+  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1) fail('Connector-Zugangsdaten haben ein unbekanntes Format.');
   $iv = base64_decode((string)($payload['iv'] ?? ''), true);
   $tag = base64_decode((string)($payload['tag'] ?? ''), true);
   $cipher = base64_decode((string)($payload['data'] ?? ''), true);
   $plain = openssl_decrypt($cipher, 'aes-256-gcm', hex2bin($hexKey), OPENSSL_RAW_DATA, $iv, $tag);
-  if ($plain === false || $plain === '')
+  if ($plain === false || $plain === '') fail('Connector-Zugangsdaten konnten nicht entschluesselt werden.');
+
+  $decoded = json_decode($plain, true);
+  if (is_array($decoded) && array_key_exists('db_password', $decoded))
   {
-    fail('Connector-Zugangsdaten konnten nicht entschluesselt werden.');
+    $password = (string)$decoded['db_password'];
+    if ($password === '') fail('Datenbankpasswort fehlt in den Connector-Zugangsdaten.');
+    return $password;
   }
+
+  // Backward compatibility for older imported connections that stored only
+  // the database password as plaintext inside the encrypted envelope.
   return (string)$plain;
 }
 
@@ -121,16 +101,10 @@ function sqlEscape(mysqli $db, $value)
 function saveTakeoverResult(mysqli $db, $table, $connectionId, array $config, $state, $enabled)
 {
   $json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  if (!is_string($json))
-  {
-    fail('Connector-Status konnte nicht serialisiert werden.');
-  }
+  if (!is_string($json)) fail('Connector-Status konnte nicht serialisiert werden.');
   $now = date('Y-m-d H:i:s');
   $sql = "UPDATE `".$table."` SET takeover_state='".sqlEscape($db, $state)."', enabled=".($enabled ? 1 : 0).", config_json='".sqlEscape($db, $json)."', updated='".sqlEscape($db, $now)."' WHERE id=".(int)$connectionId;
-  if (!$db->query($sql))
-  {
-    fail('Connector-Status konnte nicht gespeichert werden: '.$db->error);
-  }
+  if (!$db->query($sql)) fail('Connector-Status konnte nicht gespeichert werden: '.$db->error);
 }
 
 $legacyTimerWasEnabled = false;
@@ -141,84 +115,43 @@ $config = array();
 
 try
 {
-  if (!is_readable($dbConfig))
-  {
-    fail('Piwigo-Datenbankkonfiguration nicht lesbar: '.$dbConfig);
-  }
-  if (!is_executable($legacyRuntime))
-  {
-    fail('Bestehende Sync-Runtime fehlt: '.$legacyRuntime);
-  }
+  if (!is_readable($dbConfig)) fail('Piwigo-Datenbankkonfiguration nicht lesbar: '.$dbConfig);
+  if (!is_executable($legacyRuntime)) fail('Bestehende Sync-Runtime fehlt: '.$legacyRuntime);
 
-  $conf = array();
-  $prefixeTable = 'piwigo_';
-  require $dbConfig;
-  foreach (array('db_host','db_user','db_password','db_base') as $key)
-  {
-    if (!isset($conf[$key]))
-    {
-      fail('Piwigo-Datenbankkonfiguration enthaelt '.$key.' nicht.');
-    }
-  }
+  $conf = array(); $prefixeTable = 'piwigo_'; require $dbConfig;
+  foreach (array('db_host','db_user','db_password','db_base') as $key) if (!isset($conf[$key])) fail('Piwigo-Datenbankkonfiguration enthaelt '.$key.' nicht.');
 
   $db = new mysqli($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base']);
-  if ($db->connect_errno)
-  {
-    fail('Piwigo-Datenbank nicht erreichbar: '.$db->connect_error);
-  }
+  if ($db->connect_errno) fail('Piwigo-Datenbank nicht erreichbar: '.$db->connect_error);
   $db->set_charset('utf8mb4');
 
   $table = $prefixeTable.'bratonien_tools_nc_connections';
   $result = $db->query("SELECT id, takeover_state, enabled, config_json, secret_blob FROM `".$table."` WHERE id=".$connectionId." LIMIT 1");
-  if (!$result || !$result->num_rows)
-  {
-    fail('Connector-Verbindung #'.$connectionId.' wurde nicht gefunden.');
-  }
+  if (!$result || !$result->num_rows) fail('Connector-Verbindung #'.$connectionId.' wurde nicht gefunden.');
   $row = $result->fetch_assoc();
-  if ((string)$row['takeover_state'] !== 'ready' || (int)$row['enabled'] !== 0)
-  {
-    fail('Connector-Verbindung muss im Zustand ready und deaktiviert sein.');
-  }
+  if ((string)$row['takeover_state'] !== 'ready' || (int)$row['enabled'] !== 0) fail('Connector-Verbindung muss im Zustand ready und deaktiviert sein.');
   $config = json_decode((string)$row['config_json'], true);
-  if (!is_array($config) || empty($config['verification']['ok']))
-  {
-    fail('Connector-Verbindung besitzt keine erfolgreiche Verifikation.');
-  }
+  if (!is_array($config) || empty($config['verification']['ok'])) fail('Connector-Verbindung besitzt keine erfolgreiche Verifikation.');
 
   $keyResult = $db->query("SELECT value FROM `".$prefixeTable."config` WHERE param='bratonien_nc_connector_secret' LIMIT 1");
-  if (!$keyResult || !$keyResult->num_rows)
-  {
-    fail('Connector-Schluessel wurde in Piwigo nicht gefunden.');
-  }
+  if (!$keyResult || !$keyResult->num_rows) fail('Connector-Schluessel wurde in Piwigo nicht gefunden.');
   $keyRow = $keyResult->fetch_assoc();
   $dbPassword = decryptConnectorSecret($row['secret_blob'], (string)$keyRow['value']);
 
   $legacy = readKeyValueFile($legacyConfig);
   $piwigoUser = trim((string)($legacy['PIWIGO_SYNC_USER'] ?? ''));
   $piwigoPasswordFile = trim((string)($legacy['PIWIGO_SYNC_PASSWORD_FILE'] ?? '/etc/piwigo-sync/piwigo-password'));
-  if ($piwigoUser === '' || !is_readable($piwigoPasswordFile))
-  {
-    fail('Legacy-Piwigo-Sync-Zugangsdaten konnten fuer den einmaligen Cutover nicht gelesen werden.');
-  }
+  if ($piwigoUser === '' || !is_readable($piwigoPasswordFile)) fail('Legacy-Piwigo-Sync-Zugangsdaten konnten fuer den einmaligen Cutover nicht gelesen werden.');
   $piwigoPassword = trim((string)file_get_contents($piwigoPasswordFile));
-  if ($piwigoPassword === '')
-  {
-    fail('Legacy-Piwigo-Sync-Passwort ist leer.');
-  }
+  if ($piwigoPassword === '') fail('Legacy-Piwigo-Sync-Passwort ist leer.');
 
   foreach (array('host','port','database','user','source_view','gallery_root','state_dir') as $key)
   {
-    if (!isset($config[$key]) || trim((string)$config[$key]) === '')
-    {
-      fail('Connector-Konfiguration ist unvollstaendig: '.$key.' fehlt.');
-    }
+    if (!isset($config[$key]) || trim((string)$config[$key]) === '') fail('Connector-Konfiguration ist unvollstaendig: '.$key.' fehlt.');
   }
 
   $runtimeDir = '/etc/bratonien-tools/nc-connector';
-  if (!is_dir($runtimeDir) && !mkdir($runtimeDir, 0700, true))
-  {
-    fail('Connector-Laufzeitverzeichnis konnte nicht angelegt werden.');
-  }
+  if (!is_dir($runtimeDir) && !mkdir($runtimeDir, 0700, true)) fail('Connector-Laufzeitverzeichnis konnte nicht angelegt werden.');
   chmod($runtimeDir, 0700);
 
   $base = $runtimeDir.'/connection-'.$connectionId;
@@ -230,16 +163,14 @@ try
 
   file_put_contents($dbPasswordPath, $dbPassword."\n", LOCK_EX);
   file_put_contents($piwigoPasswordPath, $piwigoPassword."\n", LOCK_EX);
-  chmod($dbPasswordPath, 0600);
-  chmod($piwigoPasswordPath, 0600);
+  chmod($dbPasswordPath, 0600); chmod($piwigoPasswordPath, 0600);
 
   $storageLines = array('# storage_id<TAB>source_prefix<TAB>local_mount');
   foreach ((array)($config['storages'] ?? array()) as $storage)
   {
-    $storageLines[] = (string)($storage['storage_id'] ?? '')."\t".(string)($storage['source_prefix'] ?? '')."\t".(string)($storage['local_mount'] ?? '');
+    $storageLines[] = (string)($storage['storage_id'] ?? '')."\t".trim((string)($storage['source_prefix'] ?? ''), '/')."\t".(string)($storage['local_mount'] ?? '');
   }
-  file_put_contents($storagePath, implode("\n", $storageLines)."\n", LOCK_EX);
-  chmod($storagePath, 0600);
+  file_put_contents($storagePath, implode("\n", $storageLines)."\n", LOCK_EX); chmod($storagePath, 0600);
 
   $piwigoRootConfigured = isset($legacy['PIWIGO_ROOT']) && trim((string)$legacy['PIWIGO_ROOT']) !== '' ? trim((string)$legacy['PIWIGO_ROOT']) : $piwigoRoot;
   $lines = array(
@@ -261,8 +192,7 @@ try
     'PIWIGO_SYNC_USER='.$piwigoUser,
     'PIWIGO_SYNC_PASSWORD_FILE='.$piwigoPasswordPath,
   );
-  file_put_contents($configPath, implode("\n", $lines)."\n", LOCK_EX);
-  chmod($configPath, 0600);
+  file_put_contents($configPath, implode("\n", $lines)."\n", LOCK_EX); chmod($configPath, 0600);
 
   $enabledCheck = runCommand(array('systemctl', 'is-enabled', $legacyTimer), true);
   $legacyTimerWasEnabled = $enabledCheck['exit'] === 0;
@@ -274,14 +204,8 @@ try
   do
   {
     $active = runCommand(array('systemctl', 'is-active', '--quiet', 'piwigo-sync.service'), true);
-    if ($active['exit'] !== 0)
-    {
-      break;
-    }
-    if (time() >= $deadline)
-    {
-      fail('Ein laufender Legacy-Sync wurde nach 120 Sekunden nicht beendet.');
-    }
+    if ($active['exit'] !== 0) break;
+    if (time() >= $deadline) fail('Ein laufender Legacy-Sync wurde nach 120 Sekunden nicht beendet.');
     sleep(2);
   }
   while (true);
@@ -295,9 +219,7 @@ try
     fail('Erster Connector-Lauf ist technisch fehlgeschlagen'.($detail !== '' ? ': '.$detail : '.'));
   }
 
-  $runResult = 'no_changes';
-  $statusState = '';
-  $statusMessage = '';
+  $runResult = 'no_changes'; $statusState = ''; $statusMessage = '';
   if (is_readable($statusPath))
   {
     $status = json_decode((string)file_get_contents($statusPath), true);
@@ -306,16 +228,9 @@ try
       $statusState = trim((string)($status['state'] ?? ''));
       $statusMessage = trim((string)($status['message'] ?? ''));
     }
-
     $legacyNoChangeMessage = 'Synchronisierung fehlgeschlagen; bestehende Galerie blieb unverändert';
-    if ($statusState === 'error' && $statusMessage !== $legacyNoChangeMessage)
-    {
-      fail('Erster Connector-Lauf meldete einen technischen Fehler'.($statusMessage !== '' ? ': '.$statusMessage : '.'));
-    }
-    if ($statusState === 'ok')
-    {
-      $runResult = 'changed';
-    }
+    if ($statusState === 'error' && $statusMessage !== $legacyNoChangeMessage) fail('Erster Connector-Lauf meldete einen technischen Fehler'.($statusMessage !== '' ? ': '.$statusMessage : '.'));
+    if ($statusState === 'ok') $runResult = 'changed';
     elseif ($statusState === 'error' && $statusMessage === $legacyNoChangeMessage)
     {
       $runResult = 'no_changes';
@@ -331,28 +246,18 @@ try
   $timerPath = '/etc/systemd/system/'.$newTimer;
   $service = "[Unit]\nDescription=Bratonien NC Connector Sync\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironment=PIWIGO_CONFIG=".$configPath."\nExecStart=".$legacyRuntime."\n\n";
   $timer = "[Unit]\nDescription=Bratonien NC Connector regelmaessig pruefen\n\n[Timer]\nOnBootSec=3min\nOnUnitActiveSec=1min\nRandomizedDelaySec=15s\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n";
-  file_put_contents($servicePath, $service, LOCK_EX);
-  file_put_contents($timerPath, $timer, LOCK_EX);
-  chmod($servicePath, 0644);
-  chmod($timerPath, 0644);
-  $newTimerInstalled = true;
+  file_put_contents($servicePath, $service, LOCK_EX); file_put_contents($timerPath, $timer, LOCK_EX); chmod($servicePath,0644); chmod($timerPath,0644); $newTimerInstalled=true;
 
-  runCommand(array('systemctl', 'daemon-reload'));
-  runCommand(array('systemctl', 'disable', $legacyTimer), true);
-  runCommand(array('systemctl', 'enable', '--now', $newTimer));
+  runCommand(array('systemctl','daemon-reload'));
+  runCommand(array('systemctl','disable',$legacyTimer),true);
+  runCommand(array('systemctl','enable','--now',$newTimer));
 
-  $config['takeover']['cutover_at'] = date('Y-m-d H:i:s');
-  $config['takeover']['legacy_timer_disabled'] = true;
-  $config['takeover']['connector_timer'] = $newTimer;
-  $config['takeover']['runtime'] = 'legacy-runtime-transition';
-  $config['takeover']['first_run'] = array(
-    'state' => 'success',
-    'result' => $runResult,
-    'status_state' => $statusState,
-    'status_message' => $statusMessage,
-    'checked_at' => date('Y-m-d H:i:s'),
-  );
-  saveTakeoverResult($db, $table, $connectionId, $config, 'active', true);
+  $config['takeover']['cutover_at']=date('Y-m-d H:i:s');
+  $config['takeover']['legacy_timer_disabled']=true;
+  $config['takeover']['connector_timer']=$newTimer;
+  $config['takeover']['runtime']='legacy-runtime-transition';
+  $config['takeover']['first_run']=array('state'=>'success','result'=>$runResult,'status_state'=>$statusState,'status_message'=>$statusMessage,'checked_at'=>date('Y-m-d H:i:s'));
+  saveTakeoverResult($db,$table,$connectionId,$config,'active',true);
 
   echo "Cutover erfolgreich.\n";
   echo "Erster Connector-Lauf: ".$runResult."\n";
@@ -365,32 +270,14 @@ catch (Throwable $e)
   {
     try
     {
-      $config['takeover']['first_run'] = array(
-        'state' => 'error',
-        'result' => 'error',
-        'checked_at' => date('Y-m-d H:i:s'),
-        'message' => substr($e->getMessage(), 0, 500),
-      );
-      saveTakeoverResult($db, $table, $connectionId, $config, 'ready', false);
-    }
-    catch (Throwable $ignored)
-    {
+      $config['takeover']['first_run']=array('state'=>'error','result'=>'error','checked_at'=>date('Y-m-d H:i:s'),'message'=>substr($e->getMessage(),0,500));
+      saveTakeoverResult($db,$table,$connectionId,$config,'ready',false);
     }
+    catch (Throwable $ignored){}
   }
-
-  if ($newTimerInstalled)
-  {
-    runCommand(array('systemctl', 'disable', '--now', $newTimer), true);
-  }
-  if ($legacyTimerWasEnabled)
-  {
-    runCommand(array('systemctl', 'enable', '--now', $legacyTimer), true);
-  }
-  else
-  {
-    runCommand(array('systemctl', 'start', $legacyTimer), true);
-  }
-
+  if ($newTimerInstalled) runCommand(array('systemctl','disable','--now',$newTimer),true);
+  if ($legacyTimerWasEnabled) runCommand(array('systemctl','enable','--now',$legacyTimer),true);
+  else runCommand(array('systemctl','start',$legacyTimer),true);
   fwrite(STDERR, "Cutover fehlgeschlagen: ".$e->getMessage()."\n");
   fwrite(STDERR, "Legacy-Timer wurde wieder aktiviert/gestartet.\n");
   exit(1);

nc-connector-edit-data.php

@@ -0,0 +1,93 @@
+<?php
+$piwigo_root = realpath(dirname(__DIR__, 2));
+if ($piwigo_root === false)
+{
+  http_response_code(500);
+  exit;
+}
+define('PHPWG_ROOT_PATH', rtrim($piwigo_root, DIRECTORY_SEPARATOR).DIRECTORY_SEPARATOR);
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store, max-age=0');
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  http_response_code(404);
+  echo json_encode(array('error'=>'Bratonien Tools ist nicht aktiv.'));
+  exit;
+}
+if (!function_exists('is_admin') || !is_admin())
+{
+  http_response_code(403);
+  echo json_encode(array('error'=>'Administratorrechte erforderlich.'));
+  exit;
+}
+
+require_once(BRATONIEN_TOOLS_PATH.'include/nc_connector.inc.php');
+require_once(BRATONIEN_TOOLS_PATH.'include/nc_connector_manage.inc.php');
+require_once(BRATONIEN_TOOLS_PATH.'include/nc_connector_connection_scope.inc.php');
+
+$id = (int)($_GET['connection_id'] ?? 0);
+$connection = bratonien_tools_nc_connector_connection($id, true);
+if (!$connection)
+{
+  http_response_code(404);
+  echo json_encode(array('error'=>'Connector-Verbindung wurde nicht gefunden.'));
+  exit;
+}
+
+$config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+$credentials = array();
+try
+{
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+}
+catch (Throwable $e)
+{
+  $credentials = array();
+}
+
+$storages = array();
+foreach ((array)($config['storages'] ?? array()) as $storage)
+{
+  $storages[] = array(
+    'storage_id'=>(string)($storage['storage_id'] ?? ''),
+    'source_prefix'=>(string)($storage['source_prefix'] ?? ''),
+    'local_mount'=>(string)($storage['local_mount'] ?? ''),
+  );
+}
+
+$payload = array(
+  'id'=>(int)$connection['id'],
+  'name'=>(string)$connection['name'],
+  'adapter'=>(string)$connection['adapter'],
+  'enabled'=>(bool)$connection['enabled'],
+  'takeover_state'=>(string)$connection['takeover_state'],
+  'source_mode'=>(string)($config['source_mode'] ?? ''),
+  'legacy'=>array(
+    'host'=>(string)($config['host'] ?? ''),
+    'port'=>(string)($config['port'] ?? '5432'),
+    'database'=>(string)($config['database'] ?? ''),
+    'user'=>(string)($config['user'] ?? ''),
+    'has_db_password'=>trim((string)($credentials['db_password'] ?? '')) !== '',
+    'source_view'=>(string)($config['source_view'] ?? ''),
+    'activity_view'=>(string)($config['activity_view'] ?? ''),
+    'gallery_root'=>(string)($config['gallery_root'] ?? ''),
+    'quiet_seconds'=>(int)($config['quiet_seconds'] ?? 120),
+    'max_wait_seconds'=>(int)($config['max_wait_seconds'] ?? 900),
+    'full_sync_seconds'=>(int)($config['full_sync_seconds'] ?? 86400),
+    'storages'=>$storages,
+  ),
+  'webdav'=>array(
+    'nextcloud_url'=>(string)($config['nextcloud_url'] ?? ''),
+    'nextcloud_user'=>(string)($credentials['nextcloud_user'] ?? $config['nextcloud_access_user'] ?? $config['access_user'] ?? ''),
+    'has_nextcloud_password'=>(string)($credentials['nextcloud_password'] ?? '') !== '',
+    'api_key_id'=>(string)($credentials['api_key_id'] ?? ''),
+    'has_api_key_secret'=>trim((string)($credentials['api_key_secret'] ?? '')) !== '',
+    'fallback_user'=>(string)($credentials['piwigo_user'] ?? ''),
+    'has_fallback_password'=>(string)($credentials['piwigo_password'] ?? '') !== '',
+  ),
+);
+
+echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

nc-connector-edit-save.php

@@ -0,0 +1,356 @@
+<?php
+$piwigo_root = realpath(dirname(__DIR__, 2));
+if ($piwigo_root === false)
+{
+  http_response_code(500);
+  exit;
+}
+define('PHPWG_ROOT_PATH', rtrim($piwigo_root, DIRECTORY_SEPARATOR).DIRECTORY_SEPARATOR);
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store, max-age=0');
+
+function bratonien_tools_nc_edit_json($status, array $payload)
+{
+  http_response_code((int)$status);
+  echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  exit;
+}
+
+function bratonien_tools_nc_edit_fail($message, array $fields = array(), $stage = '', $detail = '')
+{
+  $visible = trim((string)$message);
+  if ($stage !== '') $visible = 'Bereich: '.$stage.' — '.$visible;
+  if ($detail !== '') $visible .= ' Technische Ursache: '.$detail;
+
+  bratonien_tools_nc_edit_json(422, array(
+    'ok'=>false,
+    'message'=>$visible,
+    'stage'=>(string)$stage,
+    'detail'=>(string)$detail,
+    'fields'=>array_values(array_unique($fields)),
+  ));
+}
+
+function bratonien_tools_nc_edit_probe($url, $username = '', $password = '', array $headers = array())
+{
+  if (!function_exists('curl_init'))
+  {
+    return array('ok'=>false, 'http'=>0, 'errno'=>-1, 'error'=>'cURL ist in PHP nicht verfügbar.', 'body'=>'');
+  }
+
+  $ch = curl_init($url);
+  $options = array(
+    CURLOPT_RETURNTRANSFER=>true,
+    CURLOPT_FOLLOWLOCATION=>true,
+    CURLOPT_MAXREDIRS=>3,
+    CURLOPT_CONNECTTIMEOUT=>8,
+    CURLOPT_TIMEOUT=>15,
+    CURLOPT_HTTPHEADER=>array_merge(array('Accept: application/json'), $headers),
+    CURLOPT_USERAGENT=>'Bratonien-Tools-NC-Editor/'.(function_exists('bratonien_tools_current_version') ? bratonien_tools_current_version() : 'dev'),
+  );
+  if ($username !== '')
+  {
+    $options[CURLOPT_HTTPAUTH] = CURLAUTH_BASIC;
+    $options[CURLOPT_USERPWD] = $username.':'.$password;
+  }
+  curl_setopt_array($ch, $options);
+  $body = curl_exec($ch);
+  $errno = curl_errno($ch);
+  $error = curl_error($ch);
+  $http = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  return array(
+    'ok'=>$body !== false && $errno === 0,
+    'http'=>$http,
+    'errno'=>$errno,
+    'error'=>$error,
+    'body'=>$body === false ? '' : (string)$body,
+  );
+}
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  bratonien_tools_nc_edit_json(404, array('ok'=>false, 'message'=>'Bratonien Tools ist nicht aktiv.', 'fields'=>array()));
+}
+if (!function_exists('is_admin') || !is_admin())
+{
+  bratonien_tools_nc_edit_json(403, array('ok'=>false, 'message'=>'Administratorrechte erforderlich.', 'fields'=>array()));
+}
+if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST')
+{
+  bratonien_tools_nc_edit_json(405, array('ok'=>false, 'message'=>'Nur POST ist erlaubt.', 'fields'=>array()));
+}
+
+try
+{
+  check_pwg_token();
+  require_once(BRATONIEN_TOOLS_PATH.'include/tool_registry.inc.php');
+
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection)
+  {
+    bratonien_tools_nc_edit_fail('Die zu bearbeitende Verbindung wurde nicht gefunden.', array(), 'Verbindung');
+  }
+
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+
+  $nextcloud_input = trim((string)($_POST['nc_nextcloud_url'] ?? ($config['nextcloud_url'] ?? '')));
+  $nextcloud_user = trim((string)($_POST['nc_nextcloud_user'] ?? ($credentials['nextcloud_user'] ?? '')));
+  $submitted_nc_password = (string)($_POST['nc_nextcloud_password'] ?? '');
+  $nextcloud_password = $submitted_nc_password !== '' ? $submitted_nc_password : (string)($credentials['nextcloud_password'] ?? '');
+
+  $has_any_nextcloud = $nextcloud_input !== '' || $nextcloud_user !== '' || $nextcloud_password !== '';
+  if ($has_any_nextcloud)
+  {
+    $missing = array();
+    if ($nextcloud_input === '') $missing[] = 'nc_nextcloud_url';
+    if ($nextcloud_user === '') $missing[] = 'nc_nextcloud_user';
+    if ($nextcloud_password === '') $missing[] = 'nc_nextcloud_password';
+    if ($missing)
+    {
+      bratonien_tools_nc_edit_fail(
+        'Die WebDAV-Daten sind unvollständig. Adresse, Benutzer und Passwort werden gemeinsam benötigt.',
+        $missing,
+        'Nextcloud / WebDAV'
+      );
+    }
+
+    try
+    {
+      $candidate_urls = bratonien_tools_nc_wizard_candidate_urls($nextcloud_input);
+    }
+    catch (Throwable $e)
+    {
+      bratonien_tools_nc_edit_fail($e->getMessage(), array('nc_nextcloud_url'), 'Nextcloud / WebDAV');
+    }
+
+    $nextcloud_url = '';
+    $last_probe = null;
+    $last_status_url = '';
+    foreach ($candidate_urls as $candidate_url)
+    {
+      $status_url = $candidate_url.'/status.php';
+      $probe = bratonien_tools_nc_edit_probe($status_url);
+      $last_probe = $probe;
+      $last_status_url = $status_url;
+
+      if (!$probe['ok'] || $probe['http'] < 200 || $probe['http'] >= 300)
+      {
+        continue;
+      }
+
+      $status = json_decode($probe['body'], true);
+      if (!is_array($status) || empty($status['installed']))
+      {
+        continue;
+      }
+
+      $nextcloud_url = $candidate_url;
+      break;
+    }
+
+    if ($nextcloud_url === '')
+    {
+      $attempts = array();
+      foreach ($candidate_urls as $candidate_url)
+      {
+        $attempts[] = $candidate_url.'/status.php';
+      }
+      if (is_array($last_probe) && !$last_probe['ok'])
+      {
+        $technical = $last_probe['errno'] >= 0
+          ? 'cURL '.$last_probe['errno'].($last_probe['error'] !== '' ? ': '.$last_probe['error'] : '')
+          : $last_probe['error'];
+        bratonien_tools_nc_edit_fail(
+          'Die Nextcloud-Adresse ist vom Piwigo-Server aus nicht erreichbar. Ohne angegebenes Protokoll wurden HTTPS und HTTP geprüft.',
+          array('nc_nextcloud_url'),
+          'Nextcloud / WebDAV – Erreichbarkeit',
+          $technical.' · Geprüft: '.implode(' ; ', $attempts)
+        );
+      }
+
+      bratonien_tools_nc_edit_fail(
+        'Unter der angegebenen Adresse wurde keine erreichbare installierte Nextcloud gefunden. Ohne angegebenes Protokoll wurden HTTPS und HTTP geprüft.',
+        array('nc_nextcloud_url'),
+        'Nextcloud / WebDAV – Erkennung',
+        'Geprüft: '.implode(' ; ', $attempts).($last_probe ? ' · Letzter HTTP-Status: '.$last_probe['http'] : '')
+      );
+    }
+
+    $_POST['nc_nextcloud_url'] = $nextcloud_url;
+
+    $user_url = $nextcloud_url.'/ocs/v2.php/cloud/user?format=json';
+    $user_probe = bratonien_tools_nc_edit_probe($user_url, $nextcloud_user, $nextcloud_password, array('OCS-APIRequest: true'));
+    if (!$user_probe['ok'])
+    {
+      $technical = $user_probe['errno'] >= 0
+        ? 'cURL '.$user_probe['errno'].($user_probe['error'] !== '' ? ': '.$user_probe['error'] : '')
+        : $user_probe['error'];
+      bratonien_tools_nc_edit_fail(
+        'Die Nextcloud-Anmeldung konnte technisch nicht geprüft werden.',
+        array('nc_nextcloud_url','nc_nextcloud_user','nc_nextcloud_password'),
+        'Nextcloud / WebDAV – Anmeldung',
+        $technical.' · Ziel: '.$user_url
+      );
+    }
+    if ($user_probe['http'] === 401 || $user_probe['http'] === 403)
+    {
+      bratonien_tools_nc_edit_fail(
+        'Nextcloud hat Benutzername oder Passwort abgelehnt.',
+        array('nc_nextcloud_user','nc_nextcloud_password'),
+        'Nextcloud / WebDAV – Anmeldung',
+        'HTTP '.$user_probe['http']
+      );
+    }
+    if ($user_probe['http'] < 200 || $user_probe['http'] >= 300)
+    {
+      bratonien_tools_nc_edit_fail(
+        'Nextcloud ist erreichbar, aber die Benutzerprüfung wurde vom Server abgelehnt.',
+        array('nc_nextcloud_user','nc_nextcloud_password'),
+        'Nextcloud / WebDAV – Anmeldung',
+        'HTTP '.$user_probe['http'].' · Ziel: '.$user_url
+      );
+    }
+    try
+    {
+      bratonien_tools_nc_wizard_ocs_data($user_probe['body']);
+    }
+    catch (Throwable $e)
+    {
+      bratonien_tools_nc_edit_fail(
+        'Nextcloud antwortet auf die Benutzerprüfung, die Antwort ist aber nicht gültig: '.$e->getMessage(),
+        array('nc_nextcloud_user','nc_nextcloud_password'),
+        'Nextcloud / WebDAV – Anmeldung'
+      );
+    }
+  }
+
+  $api_key_id = trim((string)($_POST['nc_connection_api_key_id'] ?? ($credentials['api_key_id'] ?? '')));
+  $submitted_api_secret = trim((string)($_POST['nc_connection_api_key_secret'] ?? ''));
+  $api_key_secret = $submitted_api_secret !== '' ? $submitted_api_secret : trim((string)($credentials['api_key_secret'] ?? ''));
+  if (($api_key_id === '') !== ($api_key_secret === ''))
+  {
+    $missing = $api_key_id === '' ? array('nc_connection_api_key_id') : array('nc_connection_api_key_secret');
+    bratonien_tools_nc_edit_fail(
+      'API-Schlüssel-ID und API-Geheimnis müssen gemeinsam vollständig sein.',
+      $missing,
+      'Piwigo API'
+    );
+  }
+  if ($api_key_id !== '')
+  {
+    try
+    {
+      bratonien_tools_nc_connector_validate_scoped_api($api_key_id, $api_key_secret);
+    }
+    catch (Throwable $e)
+    {
+      bratonien_tools_nc_edit_fail(
+        'Der Piwigo-API-Zugang konnte nicht bestätigt werden: '.$e->getMessage(),
+        array('nc_connection_api_key_id','nc_connection_api_key_secret'),
+        'Piwigo API'
+      );
+    }
+  }
+
+  $fallback_user = trim((string)($_POST['nc_fallback_user'] ?? ($credentials['piwigo_user'] ?? '')));
+  $submitted_fallback_password = (string)($_POST['nc_fallback_password'] ?? '');
+  $fallback_password = $submitted_fallback_password !== '' ? $submitted_fallback_password : (string)($credentials['piwigo_password'] ?? '');
+  if (($fallback_user === '') !== ($fallback_password === ''))
+  {
+    bratonien_tools_nc_edit_fail(
+      'Fallback-Benutzer und Fallback-Passwort müssen gemeinsam vollständig sein.',
+      array('nc_fallback_user','nc_fallback_password'),
+      'Piwigo-Fallback'
+    );
+  }
+  if ($fallback_user !== '')
+  {
+    try
+    {
+      bratonien_tools_nc_connector_validate_fallback_credentials($fallback_user, $fallback_password);
+    }
+    catch (Throwable $e)
+    {
+      bratonien_tools_nc_edit_fail(
+        'Der Piwigo-Fallback wurde abgelehnt: '.$e->getMessage(),
+        array('nc_fallback_user','nc_fallback_password'),
+        'Piwigo-Fallback'
+      );
+    }
+  }
+
+  $result = bratonien_tools_nc_connector_update_local_friendly();
+
+  if (array_key_exists('nc_fallback_user', $_POST) || array_key_exists('nc_fallback_password', $_POST))
+  {
+    $updated = bratonien_tools_nc_connector_connection($id, true);
+    if (!$updated) throw new RuntimeException('Die Verbindung konnte nach dem Speichern nicht erneut geladen werden.');
+    $updated_credentials = bratonien_tools_nc_connector_scoped_secret($updated);
+    $updated_credentials['piwigo_user'] = $fallback_user;
+    $updated_credentials['piwigo_password'] = $fallback_password;
+    bratonien_tools_nc_connector_store_scoped_secret($id, $updated, $updated_credentials);
+  }
+
+  bratonien_tools_nc_edit_json(200, array(
+    'ok'=>true,
+    'message'=>(string)($result['message'] ?? 'Verbindung wurde gespeichert.'),
+    'fields'=>array(),
+  ));
+}
+catch (Throwable $e)
+{
+  $message = trim($e->getMessage());
+  if ($message === '') $message = 'Die Verbindung konnte nicht gespeichert werden.';
+
+  $fields = array();
+  $stage = 'Verbindung';
+  $add = function($name) use (&$fields)
+  {
+    if (!in_array($name, $fields, true)) $fields[] = $name;
+  };
+
+  if (stripos($message, 'Name') !== false && stripos($message, 'Datenbankname') === false) $add('connection_name');
+  if (stripos($message, 'Datenbank-Server') !== false) { $add('nc_host'); $stage = 'Legacy-Datenbank'; }
+  if (stripos($message, 'Datenbank-Port') !== false) { $add('nc_port'); $stage = 'Legacy-Datenbank'; }
+  if (stripos($message, 'Datenbankname') !== false) { $add('nc_database'); $stage = 'Legacy-Datenbank'; }
+  if (stripos($message, 'Reader-Benutzer') !== false) { $add('nc_user'); $stage = 'Legacy-Datenbank'; }
+  if (stripos($message, 'Datenbankpasswort') !== false) { $add('nc_db_password'); $stage = 'Legacy-Datenbank'; }
+  if (stripos($message, 'Storage-ID') !== false) { $add('nc_storage_id[]'); $stage = 'Speicherorte'; }
+  if (stripos($message, 'lokaler Pfad') !== false || stripos($message, 'Speicherort') !== false) { $add('nc_local_mount[]'); $stage = 'Speicherorte'; }
+  if (stripos($message, 'Galerieordner') !== false) { $add('nc_gallery_root'); $stage = 'Erweiterte Legacy-Einstellungen'; }
+  if (stripos($message, 'Datenbankansichten') !== false || stripos($message, 'Source-View') !== false) { $add('nc_source_view'); $stage = 'Erweiterte Legacy-Einstellungen'; }
+  if (stripos($message, 'Datenbankansichten') !== false || stripos($message, 'Activity-View') !== false) { $add('nc_activity_view'); $stage = 'Erweiterte Legacy-Einstellungen'; }
+
+  if (stripos($message, 'Nextcloud') !== false)
+  {
+    $stage = 'Nextcloud / WebDAV';
+    if (stripos($message, 'Adresse') !== false) $add('nc_nextcloud_url');
+    if (stripos($message, 'Benutzer') !== false) $add('nc_nextcloud_user');
+    if (stripos($message, 'Passwort') !== false) $add('nc_nextcloud_password');
+  }
+  if (stripos($message, 'API') !== false)
+  {
+    $stage = 'Piwigo API';
+    $add('nc_connection_api_key_id');
+    $add('nc_connection_api_key_secret');
+  }
+  if (stripos($message, 'Fallback') !== false)
+  {
+    $stage = 'Piwigo-Fallback';
+    $add('nc_fallback_user');
+    $add('nc_fallback_password');
+  }
+
+  bratonien_tools_nc_edit_fail(
+    $message,
+    $fields,
+    $stage,
+    'Interne Prüfung: '.get_class($e)
+  );
+}

nc-connector-install.php

@@ -25,82 +25,56 @@ $stateRoot = '/var/lib/bratonien-tools/nc-connector';
 $servicePath = '/etc/systemd/system/bratonien-nc-connector.service';
 $timerPath = '/etc/systemd/system/bratonien-nc-connector.timer';
 
-function fail_install($message)
-{
-  throw new RuntimeException($message);
-}
+function fail_install($message) { throw new RuntimeException($message); }
 
 function run_install(array $command, $allowFailure = false)
 {
-  $spec = array(
-    0 => array('file', '/dev/null', 'r'),
-    1 => array('pipe', 'w'),
-    2 => array('pipe', 'w'),
-  );
+  $spec = array(0=>array('file','/dev/null','r'),1=>array('pipe','w'),2=>array('pipe','w'));
   $process = proc_open($command, $spec, $pipes);
-  if (!is_resource($process))
-  {
-    fail_install('Prozess konnte nicht gestartet werden: '.implode(' ', $command));
-  }
+  if (!is_resource($process)) fail_install('Prozess konnte nicht gestartet werden: '.implode(' ', $command));
   $stdout = stream_get_contents($pipes[1]);
   $stderr = stream_get_contents($pipes[2]);
-  fclose($pipes[1]);
-  fclose($pipes[2]);
+  fclose($pipes[1]); fclose($pipes[2]);
   $exit = proc_close($process);
   if ($exit !== 0 && !$allowFailure)
   {
     $detail = trim($stderr) !== '' ? trim($stderr) : trim($stdout);
     fail_install('Befehl fehlgeschlagen ('.$exit.'): '.implode(' ', $command).($detail !== '' ? "\n".$detail : ''));
   }
-  return array('exit'=>$exit, 'stdout'=>(string)$stdout, 'stderr'=>(string)$stderr);
+  return array('exit'=>$exit,'stdout'=>(string)$stdout,'stderr'=>(string)$stderr);
 }
 
 function decrypt_install_credentials($blob, $hexKey)
 {
-  if (!preg_match('/^[a-f0-9]{64}$/', $hexKey))
-  {
-    fail_install('Connector-Schluessel ist ungueltig.');
-  }
+  if (!preg_match('/^[a-f0-9]{64}$/', $hexKey)) fail_install('Connector-Schluessel ist ungueltig.');
   $outer = base64_decode(trim((string)$blob), true);
   $payload = is_string($outer) ? json_decode($outer, true) : null;
-  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1)
-  {
-    fail_install('Connector-Zugangsdaten haben ein unbekanntes Format.');
-  }
+  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1) fail_install('Connector-Zugangsdaten haben ein unbekanntes Format.');
   $iv = base64_decode((string)($payload['iv'] ?? ''), true);
   $tag = base64_decode((string)($payload['tag'] ?? ''), true);
   $cipher = base64_decode((string)($payload['data'] ?? ''), true);
   $plain = openssl_decrypt($cipher, 'aes-256-gcm', hex2bin($hexKey), OPENSSL_RAW_DATA, $iv, $tag);
-  if ($plain === false || $plain === '')
-  {
-    fail_install('Connector-Zugangsdaten konnten nicht entschluesselt werden.');
-  }
+  if ($plain === false || $plain === '') fail_install('Connector-Zugangsdaten konnten nicht entschluesselt werden.');
   $decoded = json_decode($plain, true);
-  if (!is_array($decoded) || empty($decoded['db_password']) || empty($decoded['piwigo_user']) || empty($decoded['piwigo_password']))
+  if (!is_array($decoded))
   {
-    fail_install('Fuer eine native Aktivierung muessen Datenbank- und Piwigo-Zugangsdaten vollstaendig gespeichert sein.');
+    return array('db_password'=>$plain,'piwigo_user'=>'','piwigo_password'=>'');
   }
-  return $decoded;
+  if (empty($decoded['db_password'])) fail_install('Datenbankpasswort fehlt in den Connector-Zugangsdaten.');
+  return array(
+    'db_password'=>(string)$decoded['db_password'],
+    'piwigo_user'=>(string)($decoded['piwigo_user'] ?? ''),
+    'piwigo_password'=>(string)($decoded['piwigo_password'] ?? ''),
+  );
 }
 
-function sql_install(mysqli $db, $value)
-{
-  return $db->real_escape_string((string)$value);
-}
+function sql_install(mysqli $db, $value) { return $db->real_escape_string((string)$value); }
 
 try
 {
-  if (!is_readable($dbConfig))
-  {
-    fail_install('Piwigo-Datenbankkonfiguration nicht lesbar: '.$dbConfig);
-  }
-  $conf = array();
-  $prefixeTable = 'piwigo_';
-  require $dbConfig;
-  foreach (array('db_host','db_user','db_password','db_base') as $key)
-  {
-    if (!isset($conf[$key])) fail_install('Piwigo-Datenbankkonfiguration enthaelt '.$key.' nicht.');
-  }
+  if (!is_readable($dbConfig)) fail_install('Piwigo-Datenbankkonfiguration nicht lesbar: '.$dbConfig);
+  $conf = array(); $prefixeTable = 'piwigo_'; require $dbConfig;
+  foreach (array('db_host','db_user','db_password','db_base') as $key) if (!isset($conf[$key])) fail_install('Piwigo-Datenbankkonfiguration enthaelt '.$key.' nicht.');
 
   $db = new mysqli($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base']);
   if ($db->connect_errno) fail_install('Piwigo-Datenbank nicht erreichbar: '.$db->connect_error);
@@ -111,29 +85,27 @@ try
   if (!$result || !$result->num_rows) fail_install('Connector-Verbindung #'.$id.' wurde nicht gefunden.');
   $row = $result->fetch_assoc();
   if ((string)$row['adapter'] !== 'local') fail_install('Native Aktivierung ist derzeit nur fuer lokale Verbindungen verfuegbar.');
-  if ((string)$row['takeover_state'] !== 'verified' || (int)$row['enabled'] !== 0)
-  {
-    fail_install('Die Verbindung muss zuerst erfolgreich verifiziert und deaktiviert sein.');
-  }
+  if ((string)$row['takeover_state'] !== 'verified' || (int)$row['enabled'] !== 0) fail_install('Die Verbindung muss zuerst erfolgreich verifiziert und deaktiviert sein.');
 
   $config = json_decode((string)$row['config_json'], true);
   if (!is_array($config) || empty($config['verification']['ok'])) fail_install('Erfolgreiche Verifikation fehlt.');
-  foreach (array('host','port','database','user','source_view','activity_view','gallery_root') as $key)
-  {
-    if (trim((string)($config[$key] ?? '')) === '') fail_install('Connector-Konfiguration ist unvollstaendig: '.$key.' fehlt.');
-  }
+  foreach (array('host','port','database','user','source_view','activity_view','gallery_root') as $key) if (trim((string)($config[$key] ?? '')) === '') fail_install('Connector-Konfiguration ist unvollstaendig: '.$key.' fehlt.');
 
   $keyResult = $db->query("SELECT value FROM `".$prefixeTable."config` WHERE param='bratonien_nc_connector_secret' LIMIT 1");
   if (!$keyResult || !$keyResult->num_rows) fail_install('Connector-Schluessel wurde in Piwigo nicht gefunden.');
-  $keyRow = $keyResult->fetch_assoc();
-  $credentials = decrypt_install_credentials((string)$row['secret_blob'], (string)$keyRow['value']);
+  $credentials = decrypt_install_credentials((string)$row['secret_blob'], (string)$keyResult->fetch_assoc()['value']);
+
+  $apiAvailable = false;
+  $apiResult = $db->query("SELECT value FROM `".$prefixeTable."config` WHERE param='bratonien_nc_piwigo_api' LIMIT 1");
+  if ($apiResult && $apiResult->num_rows) $apiAvailable = trim((string)$apiResult->fetch_assoc()['value']) !== '';
+  $fallbackAvailable = $credentials['piwigo_user'] !== '' && $credentials['piwigo_password'] !== '';
+  if (!$apiAvailable && !$fallbackAvailable) fail_install('Weder Piwigo-API noch Fallback-Zugang sind gespeichert.');
 
   $stateDir = $stateRoot.'/connection-'.$id;
   $statusFile = $stateDir.'/connector-status.json';
   if (!is_dir($configDir) && !mkdir($configDir, 0700, true)) fail_install('Konfigurationsverzeichnis konnte nicht angelegt werden.');
   if (!is_dir($stateDir) && !mkdir($stateDir, 0750, true)) fail_install('State-Verzeichnis konnte nicht angelegt werden.');
-  chmod($configDir, 0700);
-  chmod($stateDir, 0750);
+  chmod($configDir, 0700); chmod($stateDir, 0750);
 
   $base = $configDir.'/connection-'.$id;
   $dbPasswordPath = $base.'.db-password';
@@ -141,19 +113,26 @@ try
   $storagePath = $base.'.storages.tsv';
   $configPath = $base.'.conf';
 
-  file_put_contents($dbPasswordPath, (string)$credentials['db_password']."\n", LOCK_EX);
-  file_put_contents($piwigoPasswordPath, (string)$credentials['piwigo_password']."\n", LOCK_EX);
-  chmod($dbPasswordPath, 0600);
-  chmod($piwigoPasswordPath, 0600);
+  file_put_contents($dbPasswordPath, (string)$credentials['db_password']."\n", LOCK_EX); chmod($dbPasswordPath, 0600);
+  if ($fallbackAvailable)
+  {
+    file_put_contents($piwigoPasswordPath, (string)$credentials['piwigo_password']."\n", LOCK_EX); chmod($piwigoPasswordPath, 0600);
+  }
+  else
+  {
+    @unlink($piwigoPasswordPath);
+  }
 
-  $storageLines = array('# storage_id<TAB>source_prefix<TAB>local_mount');
+  $storageLines = array('# storage_id<TAB>source_prefix<TAB>local_mount<TAB>include_prefix');
   foreach ((array)($config['storages'] ?? array()) as $storage)
   {
-    $storageLines[] = (string)($storage['storage_id'] ?? '')."\t".(string)($storage['source_prefix'] ?? '')."\t".(string)($storage['local_mount'] ?? '');
+    $storageLines[] = (string)($storage['storage_id'] ?? '')."\t"
+      .trim((string)($storage['source_prefix'] ?? ''), '/')."\t"
+      .(string)($storage['local_mount'] ?? '')."\t"
+      .trim((string)($storage['include_prefix'] ?? ''), '/');
   }
   if (count($storageLines) === 1) fail_install('Keine Storage-Zuordnungen gespeichert.');
-  file_put_contents($storagePath, implode("\n", $storageLines)."\n", LOCK_EX);
-  chmod($storagePath, 0600);
+  file_put_contents($storagePath, implode("\n", $storageLines)."\n", LOCK_EX); chmod($storagePath, 0600);
 
   $lines = array(
     'PIWIGO_ROOT='.$piwigoRoot,
@@ -172,44 +151,32 @@ try
     'MAX_WAIT_SECONDS='.(int)($config['max_wait_seconds'] ?? 900),
     'FULL_SYNC_SECONDS='.(int)($config['full_sync_seconds'] ?? 86400),
     'PIWIGO_SYNC_ENABLED=1',
-    'PIWIGO_SYNC_USER='.(string)$credentials['piwigo_user'],
-    'PIWIGO_SYNC_PASSWORD_FILE='.$piwigoPasswordPath,
   );
-  file_put_contents($configPath, implode("\n", $lines)."\n", LOCK_EX);
-  chmod($configPath, 0600);
+  if ($fallbackAvailable)
+  {
+    $lines[] = 'PIWIGO_SYNC_USER='.(string)$credentials['piwigo_user'];
+    $lines[] = 'PIWIGO_SYNC_PASSWORD_FILE='.$piwigoPasswordPath;
+  }
+  file_put_contents($configPath, implode("\n", $lines)."\n", LOCK_EX); chmod($configPath, 0600);
 
   echo "Teste Verbindung mit Plugin-Runtime...\n";
   $test = run_install(array('env', 'PIWIGO_CONFIG='.$configPath, 'bash', $pluginRoot.'/runtime/sync.sh'), true);
   if ($test['exit'] !== 0)
   {
-    @unlink($configPath);
-    @unlink($storagePath);
-    @unlink($dbPasswordPath);
-    @unlink($piwigoPasswordPath);
+    @unlink($configPath); @unlink($storagePath); @unlink($dbPasswordPath); @unlink($piwigoPasswordPath);
     $detail = trim($test['stderr']) !== '' ? trim($test['stderr']) : trim($test['stdout']);
     fail_install('Runtime-Test fehlgeschlagen'.($detail !== '' ? ': '.$detail : '.'));
   }
 
   $service = "[Unit]\nDescription=Bratonien NC Connector Sync\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nExecStart=/usr/bin/env bash ".$pluginRoot."/runtime/run-all.sh\n\n";
   $timer = "[Unit]\nDescription=Bratonien NC Connector regelmaessig pruefen\n\n[Timer]\nOnBootSec=3min\nOnUnitActiveSec=1min\nRandomizedDelaySec=15s\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n";
-  file_put_contents($servicePath, $service, LOCK_EX);
-  file_put_contents($timerPath, $timer, LOCK_EX);
-  chmod($servicePath, 0644);
-  chmod($timerPath, 0644);
+  file_put_contents($servicePath, $service, LOCK_EX); file_put_contents($timerPath, $timer, LOCK_EX); chmod($servicePath,0644); chmod($timerPath,0644);
 
-  $config['state_dir'] = $stateDir;
-  $config['status_file'] = $statusFile;
-  $config['runtime'] = array('mode'=>'plugin-runtime', 'config'=>$configPath);
-  $json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-  $now = date('Y-m-d H:i:s');
-  if (!$db->query("UPDATE `".$table."` SET enabled=1, takeover_state='active', config_json='".sql_install($db, $json)."', updated='".sql_install($db, $now)."' WHERE id=".$id))
-  {
-    fail_install('Connector-Status konnte nicht gespeichert werden: '.$db->error);
-  }
-
-  run_install(array('systemctl', 'daemon-reload'));
-  run_install(array('systemctl', 'enable', '--now', 'bratonien-nc-connector.timer'));
+  $config['state_dir']=$stateDir;$config['status_file']=$statusFile;$config['runtime']=array('mode'=>'plugin-runtime','config'=>$configPath);
+  $json=json_encode($config,JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);$now=date('Y-m-d H:i:s');
+  if (!$db->query("UPDATE `".$table."` SET enabled=1, takeover_state='active', config_json='".sql_install($db,$json)."', updated='".sql_install($db,$now)."' WHERE id=".$id)) fail_install('Connector-Status konnte nicht gespeichert werden: '.$db->error);
 
+  run_install(array('systemctl','daemon-reload')); run_install(array('systemctl','enable','--now','bratonien-nc-connector.timer'));
   echo "Aktivierung erfolgreich.\n";
   echo "Verbindung #".$id." verwendet jetzt den nativen Bratonien-Tools-State unter ".$stateDir.".\n";
   echo "Der gemeinsame Connector-Timer verarbeitet alle installierten connection-*.conf Dateien.\n";

nc-connector-source-picker-start.php

@@ -0,0 +1,104 @@
+<?php
+$piwigo_root = realpath(dirname(__DIR__, 2));
+if ($piwigo_root === false)
+{
+  http_response_code(500);
+  exit;
+}
+define('PHPWG_ROOT_PATH', rtrim($piwigo_root, DIRECTORY_SEPARATOR).DIRECTORY_SEPARATOR);
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store, max-age=0');
+
+function bratonien_tools_nc_source_picker_json($status, array $payload)
+{
+  http_response_code((int)$status);
+  echo json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  exit;
+}
+
+function bratonien_tools_nc_source_picker_fail($message, array $fields = array())
+{
+  bratonien_tools_nc_source_picker_json(422, array(
+    'ok'=>false,
+    'message'=>(string)$message,
+    'fields'=>array_values(array_unique($fields)),
+  ));
+}
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  bratonien_tools_nc_source_picker_json(404, array('ok'=>false, 'message'=>'Bratonien Tools ist nicht aktiv.', 'fields'=>array()));
+}
+if (!function_exists('is_admin') || !is_admin())
+{
+  bratonien_tools_nc_source_picker_json(403, array('ok'=>false, 'message'=>'Administratorrechte erforderlich.', 'fields'=>array()));
+}
+if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST')
+{
+  bratonien_tools_nc_source_picker_json(405, array('ok'=>false, 'message'=>'Nur POST ist erlaubt.', 'fields'=>array()));
+}
+
+try
+{
+  check_pwg_token();
+  require_once(BRATONIEN_TOOLS_PATH.'include/tool_registry.inc.php');
+
+  $id = (int)($_POST['connection_id'] ?? 0);
+  $connection = bratonien_tools_nc_connector_connection($id, true);
+  if (!$connection)
+  {
+    bratonien_tools_nc_source_picker_fail('Die zu bearbeitende Verbindung wurde nicht gefunden.');
+  }
+  if ((string)$connection['adapter'] !== 'local')
+  {
+    bratonien_tools_nc_source_picker_fail('Die automatische Migrationsauswahl ist nur für die bestehende Legacy-Verbindung vorgesehen.');
+  }
+
+  $config = isset($connection['config']) && is_array($connection['config']) ? $connection['config'] : array();
+  $credentials = bratonien_tools_nc_connector_scoped_secret($connection);
+
+  $base_url = trim((string)($config['nextcloud_url'] ?? ''));
+  $username = trim((string)($credentials['nextcloud_user'] ?? ''));
+  $password = (string)($credentials['nextcloud_password'] ?? '');
+
+  $missing = array();
+  if ($base_url === '') $missing[] = 'nc_nextcloud_url';
+  if ($username === '') $missing[] = 'nc_nextcloud_user';
+  if ($password === '') $missing[] = 'nc_nextcloud_password';
+  if ($missing)
+  {
+    bratonien_tools_nc_source_picker_fail(
+      'Für die automatische Ordnerauswahl müssen Nextcloud-Adresse, Benutzer und Passwort gespeichert sein.',
+      $missing
+    );
+  }
+
+  bratonien_tools_nc_connector_prepare_webdav_wizard_from_connection($connection, 'migrate');
+
+  $state = bratonien_tools_nc_wizard_state();
+  if ((int)($state['step'] ?? 0) !== 2 || empty($state['scan_ok']) || empty($state['directory_selection_ready']))
+  {
+    $detail = trim((string)($state['technical_error'] ?? ''));
+    bratonien_tools_nc_source_picker_fail(
+      $detail !== '' ? 'Die Nextcloud-Ordner konnten nicht geladen werden: '.$detail : 'Die Nextcloud-Ordner konnten nicht geladen werden.',
+      array('nc_nextcloud_url','nc_nextcloud_user','nc_nextcloud_password')
+    );
+  }
+
+  bratonien_tools_nc_source_picker_json(200, array(
+    'ok'=>true,
+    'message'=>'Nextcloud-Ordner wurden geladen. Die Auswahl wird geöffnet.',
+    'fields'=>array(),
+  ));
+}
+catch (Throwable $e)
+{
+  $message = trim($e->getMessage());
+  if ($message === '') $message = 'Die Nextcloud-Ordnerauswahl konnte nicht vorbereitet werden.';
+  bratonien_tools_nc_source_picker_fail(
+    $message,
+    array('nc_nextcloud_url','nc_nextcloud_user','nc_nextcloud_password')
+  );
+}

nc-connector-status.php

@@ -0,0 +1,132 @@
+<?php
+$piwigo_root = realpath(dirname(__DIR__, 2));
+if ($piwigo_root === false)
+{
+  http_response_code(500);
+  exit;
+}
+define('PHPWG_ROOT_PATH', rtrim($piwigo_root, DIRECTORY_SEPARATOR).DIRECTORY_SEPARATOR);
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store, max-age=0');
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  http_response_code(404);
+  echo json_encode(array('state'=>'unavailable','message'=>'Bratonien Tools ist nicht aktiv.'));
+  exit;
+}
+if (!function_exists('is_admin') || !is_admin())
+{
+  http_response_code(403);
+  echo json_encode(array('state'=>'forbidden','message'=>'Administratorrechte erforderlich.'));
+  exit;
+}
+
+$dir = PHPWG_ROOT_PATH.'_data/bratonien-tools/nc-connector-status';
+$latest = array(
+  'state'=>'idle',
+  'message'=>'Noch kein Connector-Status verfügbar.',
+  'timestamp'=>0,
+  'last_run_label'=>'Nicht verfügbar',
+  'next_run_timestamp'=>0,
+  'next_run_label'=>'Nicht verfügbar',
+  'auth_mode'=>'',
+  'api'=>array('state'=>'not_run','message'=>''),
+  'fallback'=>array('state'=>'not_run','message'=>''),
+  'error_detail'=>'',
+  'route'=>'',
+  'route_label'=>'Noch kein Datenweg erfasst',
+  'route_timestamp'=>0,
+  'route_time_label'=>'Nicht verfügbar',
+  'route_detail'=>'',
+);
+
+if (is_dir($dir))
+{
+  foreach (glob($dir.'/connection-*.json') ?: array() as $file)
+  {
+    if (!is_readable($file))
+    {
+      continue;
+    }
+    $decoded = json_decode((string)@file_get_contents($file), true);
+    if (!is_array($decoded))
+    {
+      continue;
+    }
+    if ((int)($decoded['timestamp'] ?? 0) >= (int)$latest['timestamp'])
+    {
+      $latest = array_merge($latest, $decoded);
+      $latest['connection_file'] = basename($file);
+    }
+  }
+
+  $route_file = $dir.'/route-status.json';
+  if (is_readable($route_file))
+  {
+    $route = json_decode((string)@file_get_contents($route_file), true);
+    if (is_array($route))
+    {
+      $route_name = (string)($route['route'] ?? '');
+      $route_timestamp = (int)($route['timestamp'] ?? 0);
+      $route_label = (string)($route['label'] ?? '');
+
+      if ($route_name === 'webdav')
+      {
+        $route_label = 'WEBDAV PRIMÄR';
+      }
+      elseif ($route_name === 'legacy_fallback')
+      {
+        $route_label = 'LEGACY-FALLBACK AKTIV';
+      }
+      elseif ($route_name === 'failed')
+      {
+        $route_label = 'FEHLER - KEIN ERFOLGREICHER DATENWEG';
+      }
+      elseif ($route_label === '')
+      {
+        $route_label = 'UNBEKANNTER DATENWEG';
+      }
+
+      $route_detail = trim((string)($route['detail'] ?? ''));
+      $latest['route'] = $route_name;
+      $latest['route_label'] = $route_label;
+      $latest['route_timestamp'] = $route_timestamp;
+      $latest['route_time_label'] = $route_timestamp > 0 ? date('d.m.Y H:i:s', $route_timestamp) : 'Nicht verfügbar';
+      $latest['route_detail'] = $route_detail;
+
+      $base_message = trim((string)($latest['message'] ?? ''));
+      $message_parts = array($route_label);
+      if ($route_name !== 'webdav' && $route_detail !== '')
+      {
+        $message_parts[] = $route_detail;
+      }
+      if ($base_message !== '')
+      {
+        $message_parts[] = $base_message;
+      }
+      $latest['message'] = implode(' · ', $message_parts);
+    }
+  }
+}
+
+if ((int)$latest['timestamp'] > 0)
+{
+  $latest['last_run_label'] = date('d.m.Y H:i:s', (int)$latest['timestamp']);
+}
+
+$system_file = BRATONIEN_TOOLS_PATH.'include/nc_connector_system.inc.php';
+if (is_readable($system_file))
+{
+  include_once($system_file);
+  if (function_exists('bratonien_tools_nc_connector_system_status'))
+  {
+    $system = bratonien_tools_nc_connector_system_status(array());
+    $latest['next_run_timestamp'] = (int)($system['next_run_timestamp'] ?? 0);
+    $latest['next_run_label'] = (string)($system['next_run_label'] ?? 'Nicht verfügbar');
+  }
+}
+
+echo json_encode($latest, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

runtime/build-webdav-media.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+CONFIG_FILE="${PIWIGO_CONFIG:-}"
+[[ -n "$CONFIG_FILE" && -r "$CONFIG_FILE" ]] || { echo "WebDAV-Konfiguration fehlt: ${CONFIG_FILE:-<leer>}" >&2; exit 1; }
+
+# shellcheck source=/dev/null
+source "$CONFIG_FILE"
+
+: "${PIWIGO_ROOT:?PIWIGO_ROOT fehlt}"
+: "${CONNECTION_ID:?CONNECTION_ID fehlt}"
+: "${WEBDAV_BASE_URL:?WEBDAV_BASE_URL fehlt}"
+: "${WEBDAV_USER:?WEBDAV_USER fehlt}"
+: "${WEBDAV_PASSWORD_FILE:?WEBDAV_PASSWORD_FILE fehlt}"
+: "${WEBDAV_MAPPING_FILE:?WEBDAV_MAPPING_FILE fehlt}"
+: "${STATE_DIR:?STATE_DIR fehlt}"
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+LOCK_FILE="$STATE_DIR/webdav-media.lock"
+mkdir -p -- "$STATE_DIR"
+exec 9>"$LOCK_FILE"
+flock -n 9 || exit 0
+
+PREVIEW_CACHE="$PIWIGO_ROOT/_data/bratonien-tools/nc-webdav-preview/connection-$CONNECTION_ID"
+
+php "$SCRIPT_DIR/lib/precache-webdav-previews.php" \
+    --mapping="$WEBDAV_MAPPING_FILE" \
+    --base-url="$WEBDAV_BASE_URL" \
+    --user="$WEBDAV_USER" \
+    --password-file="$WEBDAV_PASSWORD_FILE" \
+    --cache-dir="$PREVIEW_CACHE"
+
+php "$SCRIPT_DIR/lib/build-webdav-derivatives.php" \
+    --piwigo-root="$PIWIGO_ROOT" \
+    --connection-id="$CONNECTION_ID"

runtime/cleanup-stale.php

@@ -0,0 +1,86 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+$pluginRoot = dirname(__DIR__);
+$piwigoRoot = dirname($pluginRoot, 2);
+$dbConfig = $piwigoRoot.'/local/config/database.inc.php';
+$configDir = '/etc/bratonien-tools/nc-connector';
+$stateRoot = '/var/lib/bratonien-tools/nc-connector';
+
+function cleanup_fail($message)
+{
+  fwrite(STDERR, $message."\n");
+  exit(1);
+}
+
+function cleanup_tree($path)
+{
+  $path = rtrim((string)$path, '/');
+  if ($path === '' || $path === '/' || !file_exists($path)) return;
+  if (is_link($path) || is_file($path))
+  {
+    @unlink($path);
+    return;
+  }
+  $items = @scandir($path);
+  if (!is_array($items)) return;
+  foreach ($items as $item)
+  {
+    if ($item === '.' || $item === '..') continue;
+    cleanup_tree($path.'/'.$item);
+  }
+  @rmdir($path);
+}
+
+if (!is_readable($dbConfig)) cleanup_fail('Piwigo-Datenbankkonfiguration ist nicht lesbar.');
+$conf = array();
+$prefixeTable = 'piwigo_';
+require $dbConfig;
+foreach (array('db_host','db_user','db_password','db_base') as $key)
+{
+  if (!isset($conf[$key])) cleanup_fail('Piwigo-Datenbankkonfiguration ist unvollstaendig: '.$key);
+}
+
+$db = new mysqli($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base']);
+if ($db->connect_errno) cleanup_fail('Piwigo-Datenbank ist nicht erreichbar: '.$db->connect_error);
+$db->set_charset('utf8mb4');
+
+$table = $prefixeTable.'bratonien_tools_nc_connections';
+$escapedTable = $db->real_escape_string($table);
+$exists = $db->query("SHOW TABLES LIKE '{$escapedTable}'");
+if (!$exists) cleanup_fail('Connector-Tabelle konnte nicht geprüft werden: '.$db->error);
+if ($exists->num_rows === 0) exit(0);
+
+$activeIds = array();
+$result = $db->query("SELECT id FROM `{$table}`");
+if (!$result) cleanup_fail('Connector-Verbindungen konnten nicht gelesen werden: '.$db->error);
+while ($row = $result->fetch_assoc())
+{
+  $activeIds[(int)$row['id']] = true;
+}
+
+if (!is_dir($configDir)) exit(0);
+foreach (glob($configDir.'/connection-*.conf') ?: array() as $configPath)
+{
+  if (!preg_match('/connection-([0-9]+)\.conf$/', $configPath, $matches)) continue;
+  $id = (int)$matches[1];
+  if (isset($activeIds[$id])) continue;
+
+  echo "NC Connector: entferne verwaiste Laufzeitdateien fuer Verbindung {$id}.\n";
+  foreach (array('.conf','.db-password','.piwigo-password','.storages.tsv','.roots.tsv') as $suffix)
+  {
+    @unlink($configDir.'/connection-'.$id.$suffix);
+  }
+  cleanup_tree($stateRoot.'/connection-'.$id);
+
+  $statusDir = rtrim($piwigoRoot, '/').'/_data/bratonien-tools/nc-connector-status';
+  @unlink($statusDir.'/connection-'.$id.'.json');
+  @unlink($statusDir.'/deleted-'.$id);
+}
+
+exit(0);

runtime/cleanup-webdav-piwigo.php

@@ -0,0 +1,169 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+$pluginRoot = dirname(__DIR__);
+$piwigoRoot = dirname($pluginRoot, 2);
+define('PHPWG_ROOT_PATH', rtrim($piwigoRoot, '/').'/');
+
+$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+$_SERVER['SERVER_ADDR'] = '127.0.0.1';
+$_SERVER['SERVER_NAME'] = 'localhost';
+$_SERVER['HTTP_HOST'] = 'localhost';
+$_SERVER['SERVER_PORT'] = '80';
+$_SERVER['REQUEST_METHOD'] = 'GET';
+$_SERVER['REQUEST_URI'] = '/';
+$_SERVER['SCRIPT_NAME'] = '/plugins/bratonien_tools/runtime/cleanup-webdav-piwigo.php';
+$_SERVER['PHP_SELF'] = $_SERVER['SCRIPT_NAME'];
+$_SERVER['QUERY_STRING'] = '';
+$_SERVER['HTTPS'] = 'off';
+
+require_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+require_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
+
+function bratonien_cleanup_tree($path, $allowed_root)
+{
+  $path = rtrim((string)$path, '/');
+  $allowed_root = rtrim((string)$allowed_root, '/');
+  if ($path === '' || $allowed_root === '' || strpos($path, $allowed_root.'/') !== 0 || !file_exists($path)) return;
+
+  if (is_link($path) || is_file($path))
+  {
+    @unlink($path);
+    return;
+  }
+
+  $items = @scandir($path);
+  if (!is_array($items)) return;
+  foreach ($items as $item)
+  {
+    if ($item === '.' || $item === '..') continue;
+    bratonien_cleanup_tree($path.'/'.$item, $allowed_root);
+  }
+  @rmdir($path);
+}
+
+function bratonien_webdav_site_images($site_id)
+{
+  $rows = array();
+  $query = '
+SELECT DISTINCT i.id, i.path, i.representative_ext
+  FROM '.IMAGES_TABLE.' AS i
+  LEFT JOIN '.CATEGORIES_TABLE.' AS sc ON sc.id = i.storage_category_id
+  LEFT JOIN '.IMAGE_CATEGORY_TABLE.' AS ic ON ic.image_id = i.id
+  LEFT JOIN '.CATEGORIES_TABLE.' AS vc ON vc.id = ic.category_id
+  WHERE sc.site_id = '.(int)$site_id.' OR vc.site_id = '.(int)$site_id.'
+;';
+  $result = pwg_query($query);
+  while ($row = pwg_db_fetch_assoc($result))
+  {
+    $row['id'] = (int)$row['id'];
+    $rows[$row['id']] = $row;
+  }
+  return $rows;
+}
+
+try
+{
+  $connection_table = function_exists('bratonien_tools_nc_connector_table')
+    ? bratonien_tools_nc_connector_table()
+    : $GLOBALS['prefixeTable'].'bratonien_tools_nc_connections';
+
+  $active = array();
+  $exists = pwg_query("SHOW TABLES LIKE '".pwg_db_real_escape_string($connection_table)."'");
+  if (pwg_db_num_rows($exists))
+  {
+    $result = pwg_query("SELECT id FROM `".$connection_table."`");
+    while ($row = pwg_db_fetch_assoc($result))
+    {
+      $active[(int)$row['id']] = true;
+    }
+  }
+
+  $site_prefix = './_data/bratonien-tools/nc-webdav-gallery/connection-';
+  $result = pwg_query(
+    "SELECT id, galleries_url FROM ".SITES_TABLE.
+    " WHERE galleries_url LIKE '".pwg_db_real_escape_string($site_prefix)."%'"
+  );
+
+  $removed_sites = 0;
+  $removed_images = 0;
+  while ($site = pwg_db_fetch_assoc($result))
+  {
+    $site_id = (int)$site['id'];
+    $site_url = (string)$site['galleries_url'];
+    if (!preg_match('#^\./_data/bratonien-tools/nc-webdav-gallery/connection-([0-9]+)/$#', $site_url, $match)) continue;
+
+    $connection_id = (int)$match[1];
+    if ($connection_id < 1 || isset($active[$connection_id])) continue;
+
+    $images = bratonien_webdav_site_images($site_id);
+    foreach ($images as $row)
+    {
+      try
+      {
+        delete_element_derivatives($row);
+      }
+      catch (Throwable $e)
+      {
+        fwrite(STDERR, 'WebDAV-Cleanup: Derivate von Bild #'.(int)$row['id'].' konnten nicht vollständig entfernt werden: '.$e->getMessage()."\n");
+      }
+    }
+
+    delete_site($site_id);
+
+    if ($images)
+    {
+      $ids = array_keys($images);
+      $remaining = query2array(
+        'SELECT id FROM '.IMAGES_TABLE.' WHERE id IN ('.implode(',', array_map('intval', $ids)).')',
+        null,
+        'id'
+      );
+      if ($remaining)
+      {
+        delete_elements(array_map('intval', $remaining), false);
+      }
+    }
+
+    $removed_sites++;
+    $removed_images += count($images);
+    echo 'NC WebDAV: entferne verwaiste Piwigo-Site '.$site_id.' für gelöschte Verbindung '.$connection_id.".\n";
+
+    $gallery_root = PHPWG_ROOT_PATH.'_data/bratonien-tools/nc-webdav-gallery';
+    $source_root = PHPWG_ROOT_PATH.'_data/bratonien-tools/nc-webdav-source';
+    $preview_root = PHPWG_ROOT_PATH.'_data/bratonien-tools/nc-webdav-preview';
+    bratonien_cleanup_tree($gallery_root.'/connection-'.$connection_id, $gallery_root);
+    bratonien_cleanup_tree($source_root.'/connection-'.$connection_id, $source_root);
+    bratonien_cleanup_tree($preview_root.'/connection-'.$connection_id, $preview_root);
+
+    $state_root = '/var/lib/bratonien-tools/nc-connector';
+    bratonien_cleanup_tree($state_root.'/connection-'.$connection_id, $state_root);
+
+    foreach (glob('/etc/bratonien-tools/nc-connector/webdav-connection-'.$connection_id.'.*') ?: array() as $file)
+    {
+      @unlink($file);
+    }
+
+    $status_root = PHPWG_ROOT_PATH.'_data/bratonien-tools/nc-connector-status';
+    @unlink($status_root.'/connection-'.$connection_id.'.json');
+    @unlink($status_root.'/deleted-'.$connection_id);
+  }
+
+  if ($removed_sites > 0)
+  {
+    invalidate_user_cache(true);
+  }
+
+  echo 'NC WebDAV Piwigo-Cleanup: sites='.$removed_sites.' bilder='.$removed_images."\n";
+  exit(0);
+}
+catch (Throwable $e)
+{
+  fwrite(STDERR, 'NC WebDAV Piwigo-Cleanup: '.$e->getMessage()."\n");
+  exit(1);
+}

runtime/lib/activity_gate.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Debounce Nextcloud activity and request a periodic safety reconciliation."""
+"""Debounce Nextcloud activity for one connector scope."""
 
 from __future__ import annotations
 
@@ -7,21 +7,31 @@ import argparse
 import hashlib
 import json
 import os
+import re
 import subprocess
 import sys
 import tempfile
 import time
 from pathlib import Path
 
+IDENTIFIER = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$")
+
+
+def validate_view(name: str) -> str:
+    value = str(name).strip()
+    if not IDENTIFIER.fullmatch(value):
+        raise ValueError(f"invalid SQL view name: {value!r}")
+    return value
+
+
+def sql_literal(value: str) -> str:
+    return "'" + str(value).replace("'", "''") + "'"
+
 
 def load(path: Path) -> dict[str, object]:
     defaults: dict[str, object] = {
-        "processed": 0,
-        "observed": 0,
-        "pending_since": 0,
-        "last_change": 0,
-        "last_full": 0,
-        "source_signature": "",
+        "processed": 0, "observed": 0, "pending_since": 0,
+        "last_change": 0, "last_full": 0, "source_signature": "",
     }
     if not path.exists():
         return defaults
@@ -48,18 +58,31 @@ def save(path: Path, state: dict[str, object]) -> None:
 def query(args: argparse.Namespace, sql: str) -> str:
     env = os.environ.copy()
     env["PGPASSWORD"] = args.password_file.read_text(encoding="utf-8").strip()
-    command = ["psql", "-XAt", "-h", args.host, "-p", str(args.port), "-U", args.user, "-d", args.database, "-c", sql]
+    command = [
+        "psql", "-XAt", "-h", args.host, "-p", str(args.port),
+        "-U", args.user, "-d", args.database, "-v", "ON_ERROR_STOP=1", "-c", sql,
+    ]
     return subprocess.run(command, env=env, check=True, text=True, capture_output=True).stdout
 
 
+def user_where(args: argparse.Namespace) -> str:
+    if not args.access_user:
+        return ""
+    return " WHERE lower(access_user) = lower(" + sql_literal(args.access_user) + ")"
+
+
 def latest(args: argparse.Namespace) -> int:
-    return int(query(args, f"SELECT COALESCE(MAX(activity_id), 0) FROM {args.view}").strip())
+    view = validate_view(args.view)
+    return int(query(args, f"SELECT COALESCE(MAX(activity_id), 0) FROM {view}{user_where(args)}").strip())
 
 
 def source_signature(args: argparse.Namespace) -> str:
+    if args.roots_config:
+        return hashlib.sha256(args.roots_config.read_bytes()).hexdigest()
     if not args.source_view:
         return ""
-    payload = query(args, f"SELECT share_id, display_name, storage_id, source_path FROM {args.source_view} ORDER BY share_id")
+    view = validate_view(args.source_view)
+    payload = query(args, f"SELECT share_id, display_name, storage_id, source_path FROM {view}{user_where(args)} ORDER BY share_id")
     return hashlib.sha256(payload.encode("utf-8")).hexdigest()
 
 
@@ -72,24 +95,26 @@ def main() -> int:
     parser.add_argument("--database", required=True)
     parser.add_argument("--user", required=True)
     parser.add_argument("--password-file", required=True, type=Path)
-    parser.add_argument("--view", default="piwigo_showcase_activity")
+    parser.add_argument("--view", required=True)
     parser.add_argument("--source-view", default="")
+    parser.add_argument("--roots-config", type=Path)
+    parser.add_argument("--access-user", default="")
     parser.add_argument("--quiet", type=int, default=120)
     parser.add_argument("--max-wait", type=int, default=900)
     parser.add_argument("--full-after", type=int, default=86400)
     args = parser.parse_args()
-
     try:
+        validate_view(args.view)
+        if args.source_view:
+            validate_view(args.source_view)
         state = load(args.state)
         now = int(time.time())
         current = latest(args)
         current_source = source_signature(args)
-
         if args.action == "commit":
             state.update(processed=current, observed=current, pending_since=0, last_change=0, last_full=now, source_signature=current_source)
             save(args.state, state)
             return 0
-
         if not int(state["last_full"]):
             return 0
         if current_source and current_source != str(state["source_signature"]):

runtime/lib/build-webdav-derivatives.php

@@ -0,0 +1,273 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+const BRATONIEN_WEBDAV_DERIVATIVE_BUILDER_VERSION = '0.9.7.8';
+
+$options = getopt('', array('piwigo-root:', 'connection-id:'));
+$piwigo_root = rtrim((string)($options['piwigo-root'] ?? ''), '/');
+$connection_id = (int)($options['connection-id'] ?? 0);
+if ($piwigo_root === '' || $connection_id < 1)
+{
+  fwrite(STDERR, "Parameter --piwigo-root und --connection-id werden benoetigt.\n");
+  exit(1);
+}
+if (!is_dir($piwigo_root))
+{
+  fwrite(STDERR, "Piwigo-Root wurde nicht gefunden.\n");
+  exit(1);
+}
+
+define('PHPWG_ROOT_PATH', $piwigo_root.'/');
+$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
+$_SERVER['SERVER_ADDR'] = '127.0.0.1';
+$_SERVER['SERVER_NAME'] = 'localhost';
+$_SERVER['HTTP_HOST'] = 'localhost';
+$_SERVER['SERVER_PORT'] = '80';
+$_SERVER['REQUEST_METHOD'] = 'GET';
+$_SERVER['REQUEST_URI'] = '/';
+$_SERVER['SCRIPT_NAME'] = '/plugins/bratonien_tools/runtime/lib/build-webdav-derivatives.php';
+$_SERVER['PHP_SELF'] = $_SERVER['SCRIPT_NAME'];
+$_SERVER['QUERY_STRING'] = '';
+$_SERVER['HTTP_USER_AGENT'] = 'Bratonien-WebDAV-Derivative-Builder/'.BRATONIEN_WEBDAV_DERIVATIVE_BUILDER_VERSION;
+$_SERVER['HTTPS'] = 'off';
+
+require_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+require_once(PHPWG_ROOT_PATH.'include/derivative.inc.php');
+require_once(PHPWG_ROOT_PATH.'admin/include/image.class.php');
+
+if (!function_exists('bratonien_tools_webdav_image_source_info') || !function_exists('bratonien_tools_webdav_generate_derivative'))
+{
+  fwrite(STDERR, "Bratonien WebDAV-Bildruntime ist nicht aktiv.\n");
+  exit(1);
+}
+
+function bratonien_tools_webdav_modus_config()
+{
+  global $conf;
+
+  $modus = $conf['modus_theme'] ?? array();
+  if (is_string($modus) && $modus !== '')
+  {
+    $decoded = @unserialize($modus);
+    if (is_array($decoded)) $modus = $decoded;
+  }
+  if (!is_array($modus)) $modus = array();
+
+  return array_merge(
+    array(
+      'index_photo_deriv'=>'2small',
+      'index_photo_deriv_hdpi'=>'xsmall',
+    ),
+    $modus
+  );
+}
+
+function bratonien_tools_webdav_gallery_base_params()
+{
+  $modus = bratonien_tools_webdav_modus_config();
+  $type = trim((string)($modus['index_photo_deriv'] ?? '2small'));
+  $params = $type !== '' ? @ImageStdParams::get_by_type($type) : null;
+  if ($params) return $params;
+
+  $params = ImageStdParams::get_by_type(IMG_THUMB);
+  if (!$params)
+  {
+    throw new RuntimeException('Piwigo-Galeriederivat ist nicht konfiguriert.');
+  }
+  return $params;
+}
+
+function bratonien_tools_webdav_modus_gallery_params(SrcImage $src, $base_params)
+{
+  $row_height = (int)$base_params->max_height();
+  $candidates = array($base_params);
+
+  foreach (ImageStdParams::get_defined_type_map() as $params)
+  {
+    if (
+      $params->max_height() > $row_height
+      && $params->sizing->max_crop == $base_params->sizing->max_crop
+    )
+    {
+      $candidates[] = $params;
+      if (count($candidates) === 3) break;
+    }
+  }
+
+  $selected = $base_params;
+  foreach ($candidates as $params)
+  {
+    $selected = $params;
+    $probe = new DerivativeImage($params, $src);
+    $size = $probe->get_size();
+    if ((int)$size[1] >= $row_height - 2) break;
+  }
+
+  return $selected;
+}
+
+try
+{
+  $gallery_base_params = bratonien_tools_webdav_gallery_base_params();
+  $gallery_base_type = (string)$gallery_base_params->type;
+
+  $images = 0;
+  $generated_or_ready = 0;
+  $identity = 0;
+  $metadata_repaired = 0;
+  $legacy_derivatives_rebuilt = 0;
+  $errors = 0;
+  $error_lines = array();
+  $variant_counts = array();
+
+  $result = pwg_query('SELECT * FROM '.IMAGES_TABLE.' ORDER BY id');
+  while ($row = pwg_db_fetch_assoc($result))
+  {
+    $image_id = (int)$row['id'];
+    $info = bratonien_tools_webdav_image_source_info($image_id);
+    if (!$info || (int)$info['connection_id'] !== $connection_id) continue;
+
+    $images++;
+    $preview = bratonien_tools_webdav_preview_path($info);
+    if (!$preview)
+    {
+      $errors++;
+      $error_lines[] = 'Bild #'.$image_id.': vorbereitetes WebDAV-Preview fehlt.';
+      continue;
+    }
+
+    $preview_ext = strtolower(pathinfo($preview, PATHINFO_EXTENSION));
+    if (!in_array($preview_ext, array('jpg', 'jpeg', 'png', 'gif'), true))
+    {
+      $errors++;
+      $error_lines[] = 'Bild #'.$image_id.': Preview-Format '.$preview_ext.' ist nicht Piwigo-kompatibel; Precache muss neu erzeugt werden.';
+      continue;
+    }
+
+    $size = @getimagesize($preview);
+    if (!is_array($size) || empty($size[0]) || empty($size[1]))
+    {
+      $errors++;
+      $error_lines[] = 'Bild #'.$image_id.': Preview ist kein lesbares Bild: '.$preview;
+      continue;
+    }
+
+    $preview_width = (int)$size[0];
+    $preview_height = (int)$size[1];
+    if ((int)($row['width'] ?? 0) !== $preview_width || (int)($row['height'] ?? 0) !== $preview_height || (int)($row['rotation'] ?? 0) !== 0)
+    {
+      pwg_query(
+        'UPDATE '.IMAGES_TABLE.
+        ' SET width='.$preview_width.', height='.$preview_height.', rotation=0'.
+        ' WHERE id='.$image_id
+      );
+      $row['width'] = $preview_width;
+      $row['height'] = $preview_height;
+      $row['rotation'] = 0;
+      $metadata_repaired++;
+    }
+
+    $src = new SrcImage($row);
+    try
+    {
+      $gallery_params = bratonien_tools_webdav_modus_gallery_params($src, $gallery_base_params);
+      $variant = (string)$gallery_params->type;
+      if ($variant === '') $variant = 'custom';
+      $variant_counts[$variant] = ($variant_counts[$variant] ?? 0) + 1;
+
+      $probe = new DerivativeImage($gallery_params, $src);
+      if ($probe->same_as_source())
+      {
+        $identity++;
+        continue;
+      }
+
+      $target = $probe->get_path();
+      if ($target !== '' && is_file($target) && is_readable($target))
+      {
+        $expected_size = $gallery_params->compute_final_size(array($preview_width, $preview_height));
+        $existing_size = @getimagesize($target);
+        if (
+          is_array($expected_size)
+          && isset($expected_size[0], $expected_size[1])
+          && is_array($existing_size)
+          && isset($existing_size[0], $existing_size[1])
+          && ((int)$existing_size[0] !== (int)$expected_size[0] || (int)$existing_size[1] !== (int)$expected_size[1])
+        )
+        {
+          if (!@unlink($target))
+          {
+            $errors++;
+            $error_lines[] = 'Bild #'.$image_id.' Galerie: falsches Alt-Derivat konnte nicht entfernt werden: '.$target;
+            continue;
+          }
+          $legacy_derivatives_rebuilt++;
+        }
+      }
+
+      $detail = '';
+      if (bratonien_tools_webdav_generate_derivative($gallery_params, $src, $detail))
+      {
+        $generated_or_ready++;
+      }
+      else
+      {
+        $errors++;
+        $error_lines[] = 'Bild #'.$image_id.' Galerie: '.($detail !== '' ? $detail : 'Galeriederivat konnte nicht erzeugt werden.');
+      }
+    }
+    catch (Throwable $e)
+    {
+      $errors++;
+      $error_lines[] = 'Bild #'.$image_id.' Galerie: '.get_class($e).': '.$e->getMessage();
+    }
+  }
+
+  if ($metadata_repaired > 0)
+  {
+    update_category('all');
+    invalidate_user_cache(true);
+  }
+
+  if ($errors > 0)
+  {
+    foreach (array_slice($error_lines, 0, 30) as $line)
+    {
+      fwrite(STDERR, $line."\n");
+    }
+    if (count($error_lines) > 30)
+    {
+      fwrite(STDERR, 'Weitere Fehler: '.(count($error_lines) - 30)."\n");
+    }
+  }
+
+  ksort($variant_counts);
+  $variant_parts = array();
+  foreach ($variant_counts as $type=>$count)
+  {
+    $variant_parts[] = $type.':'.$count;
+  }
+
+  echo 'WebDAV-Derivative-Builder: version='.BRATONIEN_WEBDAV_DERIVATIVE_BUILDER_VERSION.
+    ' bilder='.$images.
+    ' varianten_pro_bild=1'.
+    ' modus_basis='.$gallery_base_type.
+    ' modus_varianten='.implode(',', $variant_parts).
+    ' bereit='.$generated_or_ready.
+    ' identisch='.$identity.
+    ' metadaten_repariert='.$metadata_repaired.
+    ' alt_derivate_neu='.$legacy_derivatives_rebuilt.
+    ' fehler='.$errors."\n";
+
+  exit($errors > 0 ? 1 : 0);
+}
+catch (Throwable $e)
+{
+  fwrite(STDERR, 'WebDAV-Derivate: '.get_class($e).': '.$e->getMessage()."\n");
+  exit(1);
+}

runtime/lib/build_manifest.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Resolve Nextcloud view rows through explicitly configured storage mounts."""
+"""Resolve Nextcloud share rows through configured storage adapters."""
 
 from __future__ import annotations
 
@@ -7,32 +7,53 @@ import argparse
 import csv
 import json
 import os
+import re
 import subprocess
 import sys
 import tempfile
 from pathlib import Path, PurePosixPath
 
+IDENTIFIER = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$")
 
-def read_config(path: Path) -> dict[str, tuple[str, Path]]:
-    result: dict[str, tuple[str, Path]] = {}
+
+def validate_view(name: str) -> str:
+    value = str(name).strip()
+    if not IDENTIFIER.fullmatch(value):
+        raise ValueError(f"invalid SQL view name: {value!r}")
+    return value
+
+
+def sql_literal(value: str) -> str:
+    return "'" + str(value).replace("'", "''") + "'"
+
+
+def read_config(path: Path) -> dict[str, list[tuple[str, Path, str]]]:
+    result: dict[str, list[tuple[str, Path, str]]] = {}
     with path.open(encoding="utf-8") as handle:
         for number, line in enumerate(handle, 1):
             line = line.rstrip("\n")
             if not line or line.startswith("#"):
                 continue
             fields = line.split("\t")
-            if len(fields) != 3:
-                raise ValueError(f"{path}:{number}: expected storage_id, source_prefix and local_mount")
-            storage_id, prefix, mount = fields
-            result[storage_id] = (prefix.strip("/"), Path(mount))
+            if len(fields) not in {3, 4}:
+                raise ValueError(f"{path}:{number}: expected storage_id, source_prefix, local_mount and optional include_prefix")
+            storage_id, prefix, mount = fields[:3]
+            include_prefix = fields[3] if len(fields) == 4 else ""
+            storage_id = storage_id.strip()
+            prefix = prefix.strip("/")
+            include_prefix = include_prefix.strip("/")
+            if not storage_id:
+                raise ValueError(f"{path}:{number}: storage_id is empty")
+            if ".." in PurePosixPath(prefix).parts or ".." in PurePosixPath(include_prefix).parts:
+                raise ValueError(f"{path}:{number}: unsafe prefix")
+            result.setdefault(storage_id, []).append((prefix, Path(mount), include_prefix))
     return result
 
 
 def run_query(args: argparse.Namespace, env: dict[str, str], sql: str) -> subprocess.CompletedProcess[str]:
     command = [
-        "psql", "-X", "-A", "-F", "\t", "-t",
-        "-h", args.host, "-p", str(args.port), "-U", args.user, "-d", args.database,
-        "-c", sql,
+        "psql", "-X", "-A", "-F", "\t", "-t", "-v", "ON_ERROR_STOP=1",
+        "-h", args.host, "-p", str(args.port), "-U", args.user, "-d", args.database, "-c", sql,
     ]
     return subprocess.run(command, env=env, check=False, text=True, capture_output=True)
 
@@ -41,22 +62,22 @@ def query_rows(args: argparse.Namespace) -> list[list[str]]:
     password = args.password_file.read_text(encoding="utf-8").strip()
     env = os.environ.copy()
     env["PGPASSWORD"] = password
-
-    modern_sql = f"SELECT share_id, item_type, display_name, storage_id, source_path FROM {args.view} ORDER BY share_id"
+    view = validate_view(args.view)
+    where = ""
+    if args.access_user:
+        where = " WHERE lower(access_user) = lower(" + sql_literal(args.access_user) + ")"
+    modern_sql = f"SELECT share_id, item_type, display_name, storage_id, source_path FROM {view}{where} ORDER BY share_id"
     completed = run_query(args, env, modern_sql)
     if completed.returncode == 0:
         return list(csv.reader(completed.stdout.splitlines(), delimiter="\t"))
-
-    # Existing installations may still expose the original four-column view.
-    # Keep them usable and derive folder/file from the resolved source path.
+    if args.access_user:
+        raise RuntimeError(completed.stderr.strip() or "Nextcloud user-filtered source query failed")
     if "item_type" not in completed.stderr or "does not exist" not in completed.stderr:
         raise RuntimeError(completed.stderr.strip() or "Nextcloud source view query failed")
-
-    legacy_sql = f"SELECT share_id, display_name, storage_id, source_path FROM {args.view} ORDER BY share_id"
+    legacy_sql = f"SELECT share_id, display_name, storage_id, source_path FROM {view} ORDER BY share_id"
     completed = run_query(args, env, legacy_sql)
     if completed.returncode != 0:
         raise RuntimeError(completed.stderr.strip() or "legacy Nextcloud source view query failed")
-
     rows: list[list[str]] = []
     for row in csv.reader(completed.stdout.splitlines(), delimiter="\t"):
         if len(row) == 4:
@@ -74,86 +95,100 @@ def contained_join(root: Path, relative: str) -> Path:
     return root.joinpath(*parts)
 
 
+def matches_prefix(path: str, prefix: str) -> bool:
+    return not prefix or path == prefix or path.startswith(prefix + "/")
+
+
+def resolve_adapter(adapters: dict[str, list[tuple[str, Path, str]]], storage_id: str, source_path: str) -> tuple[str, Path, str] | None:
+    relative = source_path.strip("/")
+    matches: list[tuple[str, Path, str]] = []
+    for prefix, mount, include_prefix in adapters.get(storage_id, []):
+        if not matches_prefix(relative, prefix):
+            continue
+        mapped_relative = relative[len(prefix):].lstrip("/") if prefix else relative
+        if not matches_prefix(mapped_relative, include_prefix):
+            continue
+        matches.append((prefix, mount, include_prefix))
+    if not matches:
+        return None
+    matches.sort(key=lambda item: (len(item[0]), len(item[2])), reverse=True)
+    best_score = (len(matches[0][0]), len(matches[0][2]))
+    best = {(item[0], str(item[1]), item[2]): item for item in matches if (len(item[0]), len(item[2])) == best_score}
+    if len(best) != 1:
+        raise RuntimeError(f"storage adapter is ambiguous for {storage_id}")
+    return next(iter(best.values()))
+
+
 def build(args: argparse.Namespace) -> dict[str, object]:
+    validate_view(args.view)
     adapters = read_config(args.storage_config)
     rows = query_rows(args)
     if not rows and not args.allow_empty:
-        raise RuntimeError("Nextcloud returned no Showcase shares; refusing an empty manifest")
-
+        raise RuntimeError("Nextcloud returned no matching sources; refusing an empty manifest")
     manifest: list[str] = []
     errors: list[str] = []
     folder_count = 0
     file_count = 0
-
     for row in rows:
         if len(row) != 5:
             errors.append(f"invalid database row with {len(row)} columns")
             continue
-
         share_id, item_type, display_name, storage_id, source_path = row
         item_type = item_type.strip().lower()
-        if item_type and item_type not in {"folder", "file"}:
-            errors.append(f"share {share_id}: unsupported item_type {item_type!r}")
-            continue
-
-        adapter = adapters.get(storage_id)
-        if not adapter:
-            errors.append(f"share {share_id}: unknown storage {storage_id}")
-            continue
-
-        prefix, mount = adapter
         relative = source_path.strip("/")
+        if item_type and item_type not in {"folder", "file"}:
+            errors.append(f"source {share_id}: unsupported item_type {item_type!r}")
+            continue
+        try:
+            adapter = resolve_adapter(adapters, storage_id, relative)
+        except RuntimeError as error:
+            errors.append(f"source {share_id}: {error}")
+            continue
+        if not adapter:
+            continue
+        prefix, mount, _include_prefix = adapter
         if prefix:
-            expected = prefix + "/"
-            if relative != prefix and not relative.startswith(expected):
-                errors.append(f"share {share_id}: path does not match configured prefix")
-                continue
             relative = relative[len(prefix):].lstrip("/")
-
         source = contained_join(mount, relative)
         if not mount.is_mount():
-            errors.append(f"share {share_id}: storage mount unavailable: {mount}")
+            errors.append(f"source {share_id}: storage mount unavailable: {mount}")
             continue
-
         if not item_type:
             if source.is_dir():
                 item_type = "folder"
             elif source.is_file():
                 item_type = "file"
             else:
-                errors.append(f"share {share_id}: source unavailable: {source}")
+                errors.append(f"source {share_id}: source unavailable: {source}")
                 continue
-
         if item_type == "folder":
             if not source.is_dir():
-                errors.append(f"share {share_id}: source directory unavailable: {source}")
+                errors.append(f"source {share_id}: source directory unavailable: {source}")
                 continue
             folder_count += 1
         else:
             if not source.is_file():
-                errors.append(f"share {share_id}: source file unavailable: {source}")
+                errors.append(f"source {share_id}: source file unavailable: {source}")
                 continue
             file_count += 1
-
+        if any(char in display_name for char in ("\t", "\n", "\r")):
+            errors.append(f"source {share_id}: display name contains unsupported control characters")
+            continue
+        source_text = str(source)
+        if any(char in source_text for char in ("\t", "\n", "\r")):
+            errors.append(f"source {share_id}: source path contains unsupported control characters")
+            continue
         manifest.append(f"{share_id}\t{item_type}\t{display_name.lstrip('/')}\t{source}")
-
     if errors:
         raise RuntimeError("; ".join(errors))
-    if len(manifest) != len(rows):
-        raise RuntimeError("not all Showcase shares could be resolved")
-
+    if not manifest and rows and not args.allow_empty:
+        raise RuntimeError("no Nextcloud sources match the configured storage adapters")
     args.output.parent.mkdir(parents=True, exist_ok=True)
     with tempfile.NamedTemporaryFile("w", encoding="utf-8", dir=args.output.parent, delete=False) as handle:
         handle.write("\n".join(manifest) + ("\n" if manifest else ""))
         temporary = Path(handle.name)
     temporary.replace(args.output)
-
-    return {
-        "shares": len(manifest),
-        "folders": folder_count,
-        "files": file_count,
-        "manifest": str(args.output),
-    }
+    return {"sources": len(manifest), "folders": folder_count, "files": file_count, "manifest": str(args.output)}
 
 
 def main() -> int:
@@ -163,7 +198,8 @@ def main() -> int:
     parser.add_argument("--database", required=True)
     parser.add_argument("--user", required=True)
     parser.add_argument("--password-file", required=True, type=Path)
-    parser.add_argument("--view", default="piwigo_showcase_sources")
+    parser.add_argument("--view", required=True)
+    parser.add_argument("--access-user", default="")
     parser.add_argument("--storage-config", required=True, type=Path)
     parser.add_argument("--output", required=True, type=Path)
     parser.add_argument("--allow-empty", action="store_true")

runtime/lib/build_selected_manifest.py

@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+"""Build a manifest from WebDAV-authorized Nextcloud file IDs.
+
+The selected roots are resolved through a generic Nextcloud file view and then
+mapped through configured storage adapters. No user name, path layout or storage
+protocol is assumed here.
+"""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import os
+import re
+import subprocess
+import sys
+import tempfile
+from pathlib import Path, PurePosixPath
+
+IDENTIFIER = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?$")
+
+
+def validate_view(name: str) -> str:
+    value = str(name).strip()
+    if not IDENTIFIER.fullmatch(value):
+        raise ValueError(f"invalid SQL view name: {value!r}")
+    return value
+
+
+def safe_relative(value: str) -> str:
+    value = str(value).strip("/")
+    if ".." in PurePosixPath(value).parts:
+        raise ValueError(f"unsafe relative path: {value!r}")
+    return value
+
+
+def read_roots(path: Path) -> dict[int, str]:
+    roots: dict[int, str] = {}
+    with path.open(encoding="utf-8") as handle:
+        for number, raw in enumerate(handle, 1):
+            line = raw.rstrip("\n")
+            if not line or line.startswith("#"):
+                continue
+            fields = line.split("\t")
+            if len(fields) != 2:
+                raise ValueError(f"{path}:{number}: expected fileid and display_name")
+            fileid_text, display_name = fields
+            if not fileid_text.isdigit() or int(fileid_text) < 1:
+                raise ValueError(f"{path}:{number}: invalid fileid")
+            if any(char in display_name for char in ("\t", "\n", "\r")):
+                raise ValueError(f"{path}:{number}: invalid display name")
+            roots[int(fileid_text)] = display_name or f"Element_{fileid_text}"
+    if not roots:
+        raise ValueError("no selected Nextcloud roots configured")
+    return roots
+
+
+def read_adapters(path: Path) -> dict[str, list[tuple[str, Path]]]:
+    result: dict[str, list[tuple[str, Path]]] = {}
+    with path.open(encoding="utf-8") as handle:
+        for number, raw in enumerate(handle, 1):
+            line = raw.rstrip("\n")
+            if not line or line.startswith("#"):
+                continue
+            fields = line.split("\t")
+            if len(fields) not in {3, 4}:
+                raise ValueError(f"{path}:{number}: expected storage_id, source_prefix, local_mount and optional include_prefix")
+            storage_id, source_prefix, local_mount = fields[:3]
+            storage_id = storage_id.strip()
+            source_prefix = safe_relative(source_prefix)
+            mount = Path(local_mount)
+            if not storage_id:
+                raise ValueError(f"{path}:{number}: empty storage_id")
+            if not mount.is_absolute():
+                raise ValueError(f"{path}:{number}: local_mount must be absolute")
+            result.setdefault(storage_id, []).append((source_prefix, mount))
+    if not result:
+        raise ValueError("no storage adapters configured")
+    return result
+
+
+def matches_prefix(path: str, prefix: str) -> bool:
+    return not prefix or path == prefix or path.startswith(prefix + "/")
+
+
+def resolve_adapter(adapters: dict[str, list[tuple[str, Path]]], storage_id: str, source_path: str) -> tuple[str, Path]:
+    relative = safe_relative(source_path)
+    matches = [(prefix, mount) for prefix, mount in adapters.get(storage_id, []) if matches_prefix(relative, prefix)]
+    if not matches:
+        raise RuntimeError(f"no storage adapter configured for {storage_id}")
+    matches.sort(key=lambda item: len(item[0]), reverse=True)
+    best_length = len(matches[0][0])
+    best = {(prefix, str(mount)): (prefix, mount) for prefix, mount in matches if len(prefix) == best_length}
+    if len(best) != 1:
+        raise RuntimeError(f"storage adapter is ambiguous for {storage_id}")
+    return next(iter(best.values()))
+
+
+def query_rows(args: argparse.Namespace, roots: dict[int, str]) -> dict[int, tuple[str, str]]:
+    password = args.password_file.read_text(encoding="utf-8").strip()
+    env = os.environ.copy()
+    env["PGPASSWORD"] = password
+    ids = ",".join(str(fileid) for fileid in sorted(roots))
+    view = validate_view(args.view)
+    sql = f"SELECT fileid, storage_id, source_path FROM {view} WHERE fileid IN ({ids}) ORDER BY fileid"
+    command = [
+        "psql", "-X", "-A", "-F", "\t", "-t", "-v", "ON_ERROR_STOP=1",
+        "-h", args.host, "-p", str(args.port), "-U", args.user, "-d", args.database, "-c", sql,
+    ]
+    completed = subprocess.run(command, env=env, check=False, text=True, capture_output=True)
+    if completed.returncode != 0:
+        raise RuntimeError(completed.stderr.strip() or "Nextcloud file view query failed")
+    result: dict[int, tuple[str, str]] = {}
+    for row in csv.reader(completed.stdout.splitlines(), delimiter="\t"):
+        if len(row) != 3 or not row[0].isdigit():
+            raise RuntimeError("invalid row returned by Nextcloud file view")
+        result[int(row[0])] = (row[1], row[2])
+    missing = sorted(set(roots) - set(result))
+    if missing:
+        raise RuntimeError("selected Nextcloud file IDs are no longer resolvable: " + ", ".join(map(str, missing)))
+    return result
+
+
+def contained_join(root: Path, relative: str) -> Path:
+    relative = safe_relative(relative)
+    candidate = root.joinpath(*PurePosixPath(relative).parts) if relative else root
+    root_real = root.resolve()
+    candidate_real = candidate.resolve()
+    try:
+        candidate_real.relative_to(root_real)
+    except ValueError as error:
+        raise ValueError(f"resolved source escapes configured mount: {candidate}") from error
+    return candidate
+
+
+def build(args: argparse.Namespace) -> dict[str, object]:
+    roots = read_roots(args.roots_config)
+    adapters = read_adapters(args.storage_config)
+    rows = query_rows(args, roots)
+    manifest: list[str] = []
+
+    for fileid, display_name in roots.items():
+        storage_id, source_path = rows[fileid]
+        prefix, mount = resolve_adapter(adapters, storage_id, source_path)
+        if not mount.is_mount():
+            raise RuntimeError(f"storage mount unavailable: {mount}")
+        relative = safe_relative(source_path)
+        if prefix:
+            relative = relative[len(prefix):].lstrip("/")
+        source = contained_join(mount, relative)
+        if source.is_dir():
+            item_type = "folder"
+        elif source.is_file():
+            item_type = "file"
+        else:
+            raise RuntimeError(f"selected source unavailable: {source}")
+        if any(char in str(source) for char in ("\t", "\n", "\r")):
+            raise ValueError("resolved source path contains unsupported control characters")
+        manifest.append(f"fileid:{fileid}\t{item_type}\t{display_name}\t{source}")
+
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.NamedTemporaryFile("w", encoding="utf-8", dir=args.output.parent, delete=False) as handle:
+        handle.write("\n".join(manifest) + "\n")
+        temporary = Path(handle.name)
+    temporary.replace(args.output)
+    return {"roots": len(manifest), "manifest": str(args.output)}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--host", required=True)
+    parser.add_argument("--port", type=int, default=5432)
+    parser.add_argument("--database", required=True)
+    parser.add_argument("--user", required=True)
+    parser.add_argument("--password-file", required=True, type=Path)
+    parser.add_argument("--view", required=True)
+    parser.add_argument("--storage-config", required=True, type=Path)
+    parser.add_argument("--roots-config", required=True, type=Path)
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args()
+    try:
+        print(json.dumps(build(args), ensure_ascii=False))
+    except Exception as error:
+        print(f"selected-manifest: {error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

runtime/lib/build_webdav_placeholder_source.py

@@ -0,0 +1,359 @@
+#!/usr/bin/env python3
+"""Build a placeholder-backed local source tree from Nextcloud WebDAV.
+
+This creates only tiny placeholder files plus a metadata mapping; no Nextcloud
+original media is downloaded. The authenticated Nextcloud user is never used as
+an album name.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import getpass
+import json
+import os
+import shutil
+import socket
+import ssl
+import sys
+import tempfile
+import urllib.error
+import urllib.parse
+import urllib.request
+import xml.etree.ElementTree as ET
+from contextlib import contextmanager
+from pathlib import Path, PurePosixPath
+
+DAV = "DAV:"
+OC = "http://owncloud.org/ns"
+SUPPORTED_IMAGE_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".webp"}
+PLACEHOLDER = base64.b64decode("R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==")
+
+
+def fail(message: str) -> None:
+    raise RuntimeError(message)
+
+
+def validate_relative(value: str) -> str:
+    value = str(value).strip("/")
+    parts = PurePosixPath(value).parts
+    if ".." in parts:
+        raise ValueError(f"unsafe WebDAV path: {value!r}")
+    return value
+
+
+def quote_path(value: str) -> str:
+    value = validate_relative(value)
+    return "/".join(urllib.parse.quote(part, safe="") for part in PurePosixPath(value).parts)
+
+
+def safe_local_name(name: str) -> str:
+    if not name or name in {".", ".."} or "/" in name or "\x00" in name:
+        raise ValueError(f"unsafe remote name: {name!r}")
+    return name
+
+
+@contextmanager
+def pinned_resolution(host: str, ip: str):
+    host = host.strip("[]").lower()
+    ip = ip.strip("[]")
+    if not host or not ip or host == ip:
+        yield
+        return
+
+    original = socket.getaddrinfo
+
+    def resolve(name, port, family=0, type=0, proto=0, flags=0):
+        normalized = str(name).strip("[]").lower()
+        if normalized == host:
+            return original(ip, port, family, type, proto, flags)
+        return original(name, port, family, type, proto, flags)
+
+    socket.getaddrinfo = resolve
+    try:
+        yield
+    finally:
+        socket.getaddrinfo = original
+
+
+class WebDavClient:
+    def __init__(self, base_url: str, user: str, password: str, timeout: int = 30, connect_ip: str = "") -> None:
+        self.base_url = base_url.rstrip("/")
+        parsed = urllib.parse.urlparse(self.base_url)
+        if parsed.scheme not in {"http", "https"} or not parsed.hostname:
+            fail("Nextcloud base URL must use HTTP or HTTPS and contain a host")
+        self.host = parsed.hostname.strip("[]")
+        self.connect_ip = connect_ip.strip("[]") or self.host
+        self.user = user
+        self.password = password
+        self.timeout = timeout
+        token = base64.b64encode(f"{user}:{password}".encode("utf-8")).decode("ascii")
+        self.auth_header = f"Basic {token}"
+        self.context = ssl.create_default_context()
+
+    def collection_url(self, relative: str) -> str:
+        user = urllib.parse.quote(self.user, safe="")
+        suffix = quote_path(relative)
+        url = f"{self.base_url}/remote.php/dav/files/{user}/"
+        if suffix:
+            url += suffix + "/"
+        return url
+
+    def list_collection(self, relative: str) -> tuple[dict[str, object], list[dict[str, object]]]:
+        relative = validate_relative(relative)
+        url = self.collection_url(relative)
+        body = (
+            '<?xml version="1.0"?>'
+            '<d:propfind xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">'
+            '<d:prop><d:displayname/><d:resourcetype/><d:getcontenttype/>'
+            '<d:getcontentlength/><d:getetag/><oc:fileid/></d:prop></d:propfind>'
+        ).encode("utf-8")
+        request = urllib.request.Request(url, data=body, method="PROPFIND")
+        request.add_header("Authorization", self.auth_header)
+        request.add_header("Depth", "1")
+        request.add_header("Content-Type", "application/xml; charset=utf-8")
+        try:
+            with pinned_resolution(self.host, self.connect_ip):
+                with urllib.request.urlopen(request, timeout=self.timeout, context=self.context) as response:
+                    status = response.status
+                    payload = response.read()
+        except urllib.error.HTTPError as error:
+            if error.code in {401, 403}:
+                fail("Nextcloud rejected the WebDAV credentials or directory access")
+            fail(f"Nextcloud PROPFIND failed with HTTP {error.code}")
+        except urllib.error.URLError as error:
+            fail(f"Nextcloud WebDAV is unreachable: {error.reason}")
+        if status != 207:
+            fail(f"Nextcloud PROPFIND returned HTTP {status}")
+
+        base_path = urllib.parse.unquote(urllib.parse.urlparse(url).path).rstrip("/")
+        current: dict[str, object] | None = None
+        children: list[dict[str, object]] = []
+        try:
+            root = ET.fromstring(payload)
+        except ET.ParseError as error:
+            raise RuntimeError("Nextcloud returned invalid WebDAV XML") from error
+
+        for response in root.findall(f"{{{DAV}}}response"):
+            href = response.findtext(f"{{{DAV}}}href", default="")
+            href_path = urllib.parse.unquote(urllib.parse.urlparse(href).path).rstrip("/")
+            prop = None
+            for propstat in response.findall(f"{{{DAV}}}propstat"):
+                status_text = propstat.findtext(f"{{{DAV}}}status", default="")
+                if " 200 " in status_text:
+                    prop = propstat.find(f"{{{DAV}}}prop")
+                    if prop is not None:
+                        break
+            if prop is None:
+                continue
+            display = prop.findtext(f"{{{DAV}}}displayname", default="")
+            fileid_text = prop.findtext(f"{{{OC}}}fileid", default="").strip()
+            resource_type = prop.find(f"{{{DAV}}}resourcetype")
+            is_dir = resource_type is not None and resource_type.find(f"{{{DAV}}}collection") is not None
+            item = {
+                "display_name": display,
+                "fileid": int(fileid_text) if fileid_text.isdigit() else 0,
+                "is_dir": is_dir,
+                "content_type": prop.findtext(f"{{{DAV}}}getcontenttype", default=""),
+                "size": int(prop.findtext(f"{{{DAV}}}getcontentlength", default="0") or 0),
+                "etag": prop.findtext(f"{{{DAV}}}getetag", default="").strip('"'),
+            }
+            if href_path == base_path:
+                current = item
+                continue
+            if display:
+                children.append(item)
+        if current is None or int(current.get("fileid", 0)) < 1:
+            fail(f"Nextcloud returned no stable fileid for {relative or '/'}")
+        return current, children
+
+
+def link_placeholder(seed: Path, target: Path) -> None:
+    target.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        os.link(seed, target)
+    except OSError:
+        target.write_bytes(PLACEHOLDER)
+
+
+def build_root(client: WebDavClient, remote_root: str, local_root: Path, seed: Path, mapping: dict[str, dict[str, object]]) -> tuple[int, int, int]:
+    files = 0
+    folders = 0
+    skipped = 0
+    stack: list[tuple[str, Path]] = [(validate_relative(remote_root), local_root)]
+    visited: set[str] = set()
+
+    while stack:
+        remote_dir, local_dir = stack.pop()
+        if remote_dir in visited:
+            continue
+        visited.add(remote_dir)
+        current, children = client.list_collection(remote_dir)
+        local_dir.mkdir(parents=True, exist_ok=True)
+        folders += 1
+        mapping[str(local_dir)] = {
+            "kind": "folder",
+            "fileid": int(current["fileid"]),
+            "webdav_path": remote_dir,
+            "display_name": str(current.get("display_name", "")),
+        }
+
+        for child in children:
+            name = safe_local_name(str(child["display_name"]))
+            child_remote = name if remote_dir == "" else f"{remote_dir}/{name}"
+            child_local = local_dir / name
+            if bool(child["is_dir"]):
+                stack.append((child_remote, child_local))
+                continue
+            extension = Path(name).suffix.lower()
+            if extension not in SUPPORTED_IMAGE_EXTENSIONS:
+                skipped += 1
+                continue
+            link_placeholder(seed, child_local)
+            files += 1
+            mapping[str(child_local)] = {
+                "kind": "file",
+                "fileid": int(child.get("fileid", 0)),
+                "webdav_path": child_remote,
+                "display_name": name,
+                "content_type": str(child.get("content_type", "")),
+                "size": int(child.get("size", 0)),
+                "etag": str(child.get("etag", "")),
+            }
+    return files, folders, skipped
+
+
+def atomic_json(path: Path, payload: object) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.NamedTemporaryFile("w", encoding="utf-8", dir=path.parent, delete=False) as handle:
+        json.dump(payload, handle, ensure_ascii=False, indent=2, sort_keys=True)
+        handle.write("\n")
+        temporary = Path(handle.name)
+    temporary.replace(path)
+
+
+def atomic_text(path: Path, text: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.NamedTemporaryFile("w", encoding="utf-8", dir=path.parent, delete=False) as handle:
+        handle.write(text)
+        temporary = Path(handle.name)
+    temporary.replace(path)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--base-url", required=True)
+    parser.add_argument("--connect-ip", default="", help="IP address used for the TCP connection while preserving the URL host for HTTP Host and TLS SNI")
+    parser.add_argument("--user", required=True)
+    parser.add_argument("--password-file", type=Path)
+    parser.add_argument("--root", action="append", required=True, help="WebDAV path relative to the authenticated user's files root")
+    parser.add_argument("--source-dir", required=True, type=Path)
+    parser.add_argument("--manifest", required=True, type=Path)
+    parser.add_argument("--mapping", required=True, type=Path)
+    parser.add_argument("--timeout", type=int, default=30)
+    args = parser.parse_args()
+
+    try:
+        if args.password_file:
+            password = args.password_file.read_text(encoding="utf-8").rstrip("\r\n")
+        else:
+            password = getpass.getpass("Nextcloud password: ")
+        if not password:
+            fail("Nextcloud password is empty")
+
+        source_dir = args.source_dir.resolve()
+        staging = source_dir.with_name(f".{source_dir.name}.next")
+        previous = source_dir.with_name(f".{source_dir.name}.previous")
+        seed = source_dir.parent / ".bratonien-webdav-placeholder.gif"
+        source_dir.parent.mkdir(parents=True, exist_ok=True)
+        seed.write_bytes(PLACEHOLDER)
+        os.chmod(seed, 0o644)
+        if staging.exists():
+            shutil.rmtree(staging)
+        staging.mkdir(parents=True)
+
+        client = WebDavClient(args.base_url, args.user, password, max(1, args.timeout), args.connect_ip)
+        mapping: dict[str, dict[str, object]] = {}
+        manifest: list[str] = []
+        total_files = total_folders = total_skipped = 0
+        used_fileids: set[int] = set()
+
+        for remote_root_raw in args.root:
+            remote_root = validate_relative(remote_root_raw)
+            current, root_children = client.list_collection(remote_root)
+            fileid = int(current["fileid"])
+            if fileid in used_fileids:
+                fail(f"duplicate selected Nextcloud root fileid: {fileid}")
+            used_fileids.add(fileid)
+            local_name = f"root-{fileid}"
+            local_root = staging / local_name
+            files, folders, skipped = build_root(client, remote_root, local_root, seed, mapping)
+            total_files += files
+            total_folders += folders
+            total_skipped += skipped
+
+            if remote_root == "":
+                for child in sorted(root_children, key=lambda item: str(item.get("display_name", "")).casefold()):
+                    name = safe_local_name(str(child.get("display_name", "")))
+                    child_fileid = int(child.get("fileid", 0))
+                    if child_fileid < 1:
+                        fail(f"Nextcloud returned no stable fileid for root child {name!r}")
+                    child_path = source_dir / local_name / name
+                    if bool(child.get("is_dir")):
+                        manifest.append(f"webdav:{child_fileid}\tfolder\t{name}\t{child_path}")
+                    elif Path(name).suffix.lower() in SUPPORTED_IMAGE_EXTENSIONS:
+                        manifest.append(f"webdav:{child_fileid}\tfile\t{name}\t{child_path}")
+                continue
+
+            display = str(current.get("display_name", "")).strip() or PurePosixPath(remote_root).name
+            manifest.append(f"webdav:{fileid}\tfolder\t{display}\t{source_dir / local_name}")
+
+        if previous.exists():
+            shutil.rmtree(previous)
+        if source_dir.exists():
+            source_dir.rename(previous)
+        try:
+            staging.rename(source_dir)
+        except Exception:
+            if source_dir.exists():
+                shutil.rmtree(source_dir)
+            if previous.exists():
+                previous.rename(source_dir)
+            raise
+        if previous.exists():
+            shutil.rmtree(previous)
+
+        final_mapping: dict[str, dict[str, object]] = {}
+        staging_text = str(staging)
+        source_text = str(source_dir)
+        for path, data in mapping.items():
+            final_path = source_text + path[len(staging_text):] if path.startswith(staging_text) else path
+            final_mapping[final_path] = data
+
+        atomic_text(args.manifest, "\n".join(manifest) + "\n")
+        atomic_json(args.mapping, {
+            "version": 1,
+            "base_url": args.base_url.rstrip("/"),
+            "connect_ip": client.connect_ip,
+            "user": args.user,
+            "files": final_mapping,
+        })
+        print(json.dumps({
+            "roots": len(args.root),
+            "files": total_files,
+            "folders": total_folders,
+            "skipped": total_skipped,
+            "connect_ip": client.connect_ip,
+            "source_dir": str(source_dir),
+            "manifest": str(args.manifest),
+            "mapping": str(args.mapping),
+        }, ensure_ascii=False))
+        return 0
+    except Exception as error:
+        print(f"webdav-placeholder: {error}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

runtime/lib/piwigo-sync.php

@@ -11,6 +11,35 @@ function fail_sync($message)
   throw new RuntimeException($message);
 }
 
+function http_error_detail($body)
+{
+  $body = trim((string)$body);
+  if ($body === '') return '';
+
+  $decoded = json_decode($body, true);
+  if (is_array($decoded))
+  {
+    $detail = (string)($decoded['message'] ?? $decoded['err'] ?? '');
+    if ($detail !== '') return $detail;
+  }
+
+  if (function_exists('simplexml_load_string'))
+  {
+    $previous = libxml_use_internal_errors(true);
+    $xml = simplexml_load_string($body);
+    libxml_clear_errors();
+    libxml_use_internal_errors($previous);
+    if ($xml !== false)
+    {
+      $detail = trim((string)($xml->message ?? $xml->err ?? ''));
+      if ($detail !== '') return $detail;
+    }
+  }
+
+  $plain = trim(preg_replace('/\s+/', ' ', strip_tags($body)));
+  return $plain === '' ? '' : mb_substr($plain, 0, 500);
+}
+
 function http_request($url, array $fields, array $headers = array(), $cookie_file = null)
 {
   $ch = curl_init($url);
@@ -21,12 +50,9 @@ function http_request($url, array $fields, array $headers = array(), $cookie_fil
     CURLOPT_CONNECTTIMEOUT => 10,
     CURLOPT_TIMEOUT => 900,
     CURLOPT_FOLLOWLOCATION => false,
-    CURLOPT_USERAGENT => 'Bratonien-NC-Connector/0.9.3.19',
+    CURLOPT_USERAGENT => 'Bratonien-NC-Connector',
   );
-  if ($headers)
-  {
-    $options[CURLOPT_HTTPHEADER] = $headers;
-  }
+  if ($headers) $options[CURLOPT_HTTPHEADER] = $headers;
   if ($cookie_file !== null)
   {
     $options[CURLOPT_COOKIEJAR] = $cookie_file;
@@ -39,41 +65,29 @@ function http_request($url, array $fields, array $headers = array(), $cookie_fil
   $http = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
   curl_close($ch);
 
-  if ($body === false || $errno !== 0)
-  {
-    fail_sync('HTTP-Aufruf fehlgeschlagen: '.$error);
-  }
+  if ($body === false || $errno !== 0) fail_sync('HTTP-Aufruf fehlgeschlagen: '.$error);
   if ($http < 200 || $http >= 300)
   {
-    fail_sync('HTTP-Aufruf antwortete mit Status '.$http.'.');
+    $detail = http_error_detail((string)$body);
+    fail_sync('HTTP-Aufruf antwortete mit Status '.$http.($detail !== '' ? ': '.$detail : '.'));
   }
-
   return (string)$body;
 }
 
 function xml_value_sync(SimpleXMLElement $node)
 {
   $children = $node->children();
-  if (count($children) === 0)
-  {
-    return (string)$node;
-  }
+  if (count($children) === 0) return (string)$node;
   $result = array();
   foreach ($children as $name => $child)
   {
     $value = xml_value_sync($child);
     if (array_key_exists($name, $result))
     {
-      if (!is_array($result[$name]) || !array_is_list($result[$name]))
-      {
-        $result[$name] = array($result[$name]);
-      }
+      if (!is_array($result[$name]) || !array_is_list($result[$name])) $result[$name] = array($result[$name]);
       $result[$name][] = $value;
     }
-    else
-    {
-      $result[$name] = $value;
-    }
+    else $result[$name] = $value;
   }
   return $result;
 }
@@ -83,34 +97,22 @@ function decode_ws($body)
   $decoded = json_decode((string)$body, true);
   if (!is_array($decoded))
   {
-    if (!function_exists('simplexml_load_string'))
-    {
-      fail_sync('Piwigo lieferte XML, aber SimpleXML ist nicht verfuegbar.');
-    }
+    if (!function_exists('simplexml_load_string')) fail_sync('Piwigo lieferte XML, aber SimpleXML ist nicht verfuegbar.');
     $previous = libxml_use_internal_errors(true);
     $xml = simplexml_load_string((string)$body);
     libxml_clear_errors();
     libxml_use_internal_errors($previous);
-    if ($xml === false || $xml->getName() !== 'rsp')
-    {
-      fail_sync('Piwigo lieferte weder gueltiges JSON noch eine gueltige XML-Webservice-Antwort.');
-    }
+    if ($xml === false || $xml->getName() !== 'rsp') fail_sync('Piwigo lieferte weder gueltiges JSON noch eine gueltige XML-Webservice-Antwort.');
     $decoded = array('stat'=>(string)$xml['stat']);
     foreach ($xml->children() as $name => $child)
     {
       $value = xml_value_sync($child);
       if (array_key_exists($name, $decoded))
       {
-        if (!is_array($decoded[$name]) || !array_is_list($decoded[$name]))
-        {
-          $decoded[$name] = array($decoded[$name]);
-        }
+        if (!is_array($decoded[$name]) || !array_is_list($decoded[$name])) $decoded[$name] = array($decoded[$name]);
         $decoded[$name][] = $value;
       }
-      else
-      {
-        $decoded[$name] = $value;
-      }
+      else $decoded[$name] = $value;
     }
   }
   if (($decoded['stat'] ?? '') !== 'ok')
@@ -118,116 +120,123 @@ function decode_ws($body)
     $message = (string)($decoded['message'] ?? $decoded['err'] ?? 'Piwigo-Aufruf wurde abgelehnt.');
     fail_sync($message);
   }
-
-  if (array_key_exists('result', $decoded))
-  {
-    return $decoded['result'];
-  }
-
+  if (array_key_exists('result', $decoded)) return $decoded['result'];
   unset($decoded['stat']);
   return $decoded;
 }
 
 function decrypt_blob($blob, $hex_key)
 {
-  if (!preg_match('/^[a-f0-9]{64}$/', (string)$hex_key))
-  {
-    fail_sync('Connector-Schluessel ist ungueltig.');
-  }
+  if (!preg_match('/^[a-f0-9]{64}$/', (string)$hex_key)) fail_sync('Connector-Schluessel ist ungueltig.');
   $outer = base64_decode(trim((string)$blob), true);
   $payload = is_string($outer) ? json_decode($outer, true) : null;
-  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1)
-  {
-    fail_sync('Gespeicherte Zugangsdaten haben ein unbekanntes Format.');
-  }
+  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1) fail_sync('Gespeicherte Zugangsdaten haben ein unbekanntes Format.');
   $iv = base64_decode((string)($payload['iv'] ?? ''), true);
   $tag = base64_decode((string)($payload['tag'] ?? ''), true);
   $cipher = base64_decode((string)($payload['data'] ?? ''), true);
   $plain = openssl_decrypt($cipher, 'aes-256-gcm', hex2bin($hex_key), OPENSSL_RAW_DATA, $iv, $tag);
-  if ($plain === false)
-  {
-    fail_sync('Gespeicherte Zugangsdaten konnten nicht entschluesselt werden.');
-  }
+  if ($plain === false) fail_sync('Gespeicherte Zugangsdaten konnten nicht entschluesselt werden.');
   return (string)$plain;
 }
 
+function ensure_webdav_site(mysqli $db, $prefixeTable, $piwigo_root, array $connection_config, $connection_id)
+{
+  if ((string)($connection_config['source_mode'] ?? '') !== 'webdav-placeholder') return 1;
+
+  $gallery_root = rtrim((string)($connection_config['parallel_gallery_root'] ?? ''), '/');
+  if ($gallery_root === '') fail_sync('WebDAV-Galeriewurzel fehlt in der Verbindungskonfiguration.');
+  $piwigo_root = rtrim((string)$piwigo_root, '/');
+  if (strpos($gallery_root, $piwigo_root.'/') !== 0)
+  {
+    fail_sync('WebDAV-Galeriewurzel liegt ausserhalb der Piwigo-Installation.');
+  }
+  if (!is_dir($gallery_root)) fail_sync('WebDAV-Galeriewurzel existiert nicht: '.$gallery_root);
+
+  $relative = ltrim(substr($gallery_root, strlen($piwigo_root)), '/');
+  if ($relative === '') fail_sync('WebDAV-Galeriewurzel darf nicht dem Piwigo-Hauptverzeichnis entsprechen.');
+  $site_url = './'.rtrim($relative, '/').'/';
+  $escaped = $db->real_escape_string($site_url);
+  $result = $db->query("SELECT id FROM `{$prefixeTable}sites` WHERE galleries_url='{$escaped}' LIMIT 1");
+  if (!$result) fail_sync('Piwigo-Site konnte nicht gelesen werden: '.$db->error);
+  if ($result->num_rows)
+  {
+    return (int)$result->fetch_assoc()['id'];
+  }
+
+  if (!$db->query("INSERT INTO `{$prefixeTable}sites` (galleries_url) VALUES ('{$escaped}')"))
+  {
+    fail_sync('Piwigo-Site fuer WebDAV-Verbindung #'.$connection_id.' konnte nicht angelegt werden: '.$db->error);
+  }
+  $site_id = (int)$db->insert_id;
+  if ($site_id < 1) fail_sync('Piwigo-Site fuer WebDAV-Verbindung #'.$connection_id.' erhielt keine gueltige ID.');
+  return $site_id;
+}
+
 try
 {
   $options = getopt('', array('piwigo-root:', 'connection-id:', 'base-url:'));
   $piwigo_root = rtrim((string)($options['piwigo-root'] ?? ''), '/');
   $connection_id = (int)($options['connection-id'] ?? 0);
   $base_url = rtrim((string)($options['base-url'] ?? 'http://127.0.0.1'), '/');
-
-  if ($piwigo_root === '' || $connection_id < 1)
-  {
-    fail_sync('Parameter --piwigo-root und --connection-id werden benoetigt.');
-  }
-  if (!function_exists('curl_init'))
-  {
-    fail_sync('PHP-cURL ist nicht verfuegbar.');
-  }
+  if ($piwigo_root === '' || $connection_id < 1) fail_sync('Parameter --piwigo-root und --connection-id werden benoetigt.');
+  if (!function_exists('curl_init')) fail_sync('PHP-cURL ist nicht verfuegbar.');
 
   $db_config = $piwigo_root.'/local/config/database.inc.php';
-  if (!is_readable($db_config))
-  {
-    fail_sync('Piwigo-Datenbankkonfiguration ist nicht lesbar.');
-  }
-
+  if (!is_readable($db_config)) fail_sync('Piwigo-Datenbankkonfiguration ist nicht lesbar.');
   $conf = array();
   $prefixeTable = 'piwigo_';
   require $db_config;
-  foreach (array('db_host','db_user','db_password','db_base') as $key)
-  {
-    if (!isset($conf[$key]))
-    {
-      fail_sync('Piwigo-Datenbankkonfiguration ist unvollstaendig: '.$key);
-    }
-  }
+  foreach (array('db_host','db_user','db_password','db_base') as $key) if (!isset($conf[$key])) fail_sync('Piwigo-Datenbankkonfiguration ist unvollstaendig: '.$key);
 
   $db = new mysqli($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base']);
-  if ($db->connect_errno)
-  {
-    fail_sync('Piwigo-Datenbank ist nicht erreichbar: '.$db->connect_error);
-  }
+  if ($db->connect_errno) fail_sync('Piwigo-Datenbank ist nicht erreichbar: '.$db->connect_error);
   $db->set_charset('utf8mb4');
 
   $key_result = $db->query("SELECT value FROM `{$prefixeTable}config` WHERE param='bratonien_nc_connector_secret' LIMIT 1");
-  if (!$key_result || !$key_result->num_rows)
-  {
-    fail_sync('Connector-Schluessel wurde nicht gefunden.');
-  }
+  if (!$key_result || !$key_result->num_rows) fail_sync('Connector-Schluessel wurde nicht gefunden.');
   $hex_key = (string)$key_result->fetch_assoc()['value'];
 
+  $connection_table = $prefixeTable.'bratonien_tools_nc_connections';
+  $connection_result = $db->query('SELECT config_json, secret_blob FROM `'.$connection_table.'` WHERE id='.$connection_id.' LIMIT 1');
+  if (!$connection_result || !$connection_result->num_rows) fail_sync('Connector-Verbindung #'.$connection_id.' wurde nicht gefunden.');
+  $connection_row = $connection_result->fetch_assoc();
+  $connection_config = json_decode((string)$connection_row['config_json'], true);
+  if (!is_array($connection_config)) $connection_config = array();
+  $connection_plain = decrypt_blob((string)$connection_row['secret_blob'], $hex_key);
+  $connection_credentials = json_decode($connection_plain, true);
+  if (!is_array($connection_credentials)) $connection_credentials = array();
+
+  $site_id = ensure_webdav_site($db, $prefixeTable, $piwigo_root, $connection_config, $connection_id);
+
   $api = array('key_id'=>'', 'key_secret'=>'');
-  $api_result = $db->query("SELECT value FROM `{$prefixeTable}config` WHERE param='bratonien_nc_piwigo_api' LIMIT 1");
-  if ($api_result && $api_result->num_rows)
+  $connection_scoped = (string)($connection_config['piwigo_auth'] ?? '') === 'connection-scoped' || array_key_exists('api_enabled', $connection_config);
+  if ($connection_scoped)
   {
-    $api_blob = (string)$api_result->fetch_assoc()['value'];
-    if ($api_blob !== '')
+    if (!empty($connection_config['api_enabled']))
     {
-      $api_plain = decrypt_blob($api_blob, $hex_key);
-      $api_decoded = json_decode($api_plain, true);
-      if (is_array($api_decoded))
+      $api['key_id'] = trim((string)($connection_credentials['api_key_id'] ?? ''));
+      $api['key_secret'] = trim((string)($connection_credentials['api_key_secret'] ?? ''));
+    }
+  }
+  else
+  {
+    $api_result = $db->query("SELECT value FROM `{$prefixeTable}config` WHERE param='bratonien_nc_piwigo_api' LIMIT 1");
+    if ($api_result && $api_result->num_rows)
+    {
+      $api_blob = (string)$api_result->fetch_assoc()['value'];
+      if ($api_blob !== '')
       {
-        $api['key_id'] = (string)($api_decoded['key_id'] ?? '');
-        $api['key_secret'] = (string)($api_decoded['key_secret'] ?? '');
+        $api_plain = decrypt_blob($api_blob, $hex_key);
+        $api_decoded = json_decode($api_plain, true);
+        if (is_array($api_decoded))
+        {
+          $api['key_id'] = (string)($api_decoded['key_id'] ?? '');
+          $api['key_secret'] = (string)($api_decoded['key_secret'] ?? '');
+        }
       }
     }
   }
 
-  $connection_table = $prefixeTable.'bratonien_tools_nc_connections';
-  $connection_result = $db->query('SELECT secret_blob FROM `'.$connection_table.'` WHERE id='.$connection_id.' LIMIT 1');
-  if (!$connection_result || !$connection_result->num_rows)
-  {
-    fail_sync('Connector-Verbindung #'.$connection_id.' wurde nicht gefunden.');
-  }
-  $connection_blob = (string)$connection_result->fetch_assoc()['secret_blob'];
-  $connection_plain = decrypt_blob($connection_blob, $hex_key);
-  $connection_credentials = json_decode($connection_plain, true);
-  if (!is_array($connection_credentials))
-  {
-    $connection_credentials = array();
-  }
   $fallback_user = (string)($connection_credentials['piwigo_user'] ?? '');
   $fallback_password = (string)($connection_credentials['piwigo_password'] ?? '');
 
@@ -241,19 +250,15 @@ try
         'Accept: application/json, text/xml;q=0.9',
         'Content-Type: application/x-www-form-urlencoded',
       );
-      decode_ws(http_request(
-        $base_url.'/ws.php?format=json',
-        array('method'=>'bratonien.nc.syncProductive', 'site_id'=>1),
-        $headers
-      ));
-      $orphan = decode_ws(http_request(
-        $base_url.'/ws.php?format=json',
-        array('method'=>'bratonien.nc.syncOrphans', 'site_id'=>1, 'simulate'=>0),
-        $headers
-      ));
+      decode_ws(http_request($base_url.'/ws.php?format=json', array('method'=>'bratonien.nc.syncProductive', 'site_id'=>$site_id), $headers));
+      $orphan = decode_ws(http_request($base_url.'/ws.php?format=json', array('method'=>'bratonien.nc.syncOrphans', 'site_id'=>$site_id, 'simulate'=>0), $headers));
+      if ($site_id !== 1)
+      {
+        decode_ws(http_request($base_url.'/ws.php?format=json', array('method'=>'bratonien.nc.syncOrphans', 'site_id'=>1, 'simulate'=>0), $headers));
+      }
       $added = (int)($orphan['added_orphans'] ?? 0);
       $deleted = (int)($orphan['deleted_orphans'] ?? 0);
-      echo "Piwigo-Synchronisierung per API erfolgreich\n";
+      echo "Piwigo-Synchronisierung per API erfolgreich (Site $site_id)\n";
       echo "Piwigo-Orphans synchronisiert: +$added / -$deleted\n";
       exit(0);
     }
@@ -265,56 +270,47 @@ try
   }
   else
   {
-    $api_error = 'Keine gespeicherten API-Zugangsdaten.';
+    $api_error = $connection_scoped ? 'Fuer diese Verbindung ist keine API konfiguriert.' : 'Keine gespeicherten API-Zugangsdaten.';
     fwrite(STDERR, "Piwigo-API nicht nutzbar: ".$api_error."\n");
   }
 
-  if ($fallback_user === '' || $fallback_password === '')
-  {
-    fail_sync('Kein gespeicherter Benutzername/Passwort-Fallback vorhanden.');
-  }
+  if ($fallback_user === '' || $fallback_password === '') fail_sync('Kein gespeicherter Benutzername/Passwort-Fallback fuer diese Verbindung vorhanden.');
 
   $cookie_file = tempnam(sys_get_temp_dir(), 'br-nc-sync-');
-  if ($cookie_file === false)
-  {
-    fail_sync('Temporare Piwigo-Sitzung konnte nicht angelegt werden.');
-  }
+  if ($cookie_file === false) fail_sync('Temporare Piwigo-Sitzung konnte nicht angelegt werden.');
 
   try
   {
+    decode_ws(http_request($base_url.'/ws.php?format=json', array('method'=>'pwg.session.login', 'username'=>$fallback_user, 'password'=>$fallback_password), array(), $cookie_file));
+
+    // Der Fallback darf keinen zweiten Strukturpfad benutzen. Auch mit
+    // Benutzer/Passwort wird exakt derselbe Bratonien-Sync wie mit API-Key
+    // ausgefuehrt. Dadurch werden alte technische WebDAV-Kategorien entfernt
+    // und vorhandene Piwigo-Alben wiederverwendet.
     decode_ws(http_request(
       $base_url.'/ws.php?format=json',
-      array('method'=>'pwg.session.login', 'username'=>$fallback_user, 'password'=>$fallback_password),
+      array('method'=>'bratonien.nc.syncProductive', 'site_id'=>$site_id),
       array(),
       $cookie_file
     ));
-
-    http_request(
-      $base_url.'/admin.php?page=site_update&site=1',
-      array(
-        'sync'=>'files',
-        'display_info'=>1,
-        'privacy_level'=>0,
-        'sync_meta'=>1,
-        'simulate'=>0,
-        'subcats-included'=>1,
-        'bratonien_connector'=>1,
-        'submit'=>1,
-      ),
-      array(),
-      $cookie_file
-    );
-
     $orphan = decode_ws(http_request(
       $base_url.'/ws.php?format=json',
-      array('method'=>'bratonien.nc.syncOrphans', 'site_id'=>1, 'simulate'=>0),
+      array('method'=>'bratonien.nc.syncOrphans', 'site_id'=>$site_id, 'simulate'=>0),
       array(),
       $cookie_file
     ));
+    if ($site_id !== 1)
+    {
+      decode_ws(http_request(
+        $base_url.'/ws.php?format=json',
+        array('method'=>'bratonien.nc.syncOrphans', 'site_id'=>1, 'simulate'=>0),
+        array(),
+        $cookie_file
+      ));
+    }
     $added = (int)($orphan['added_orphans'] ?? 0);
     $deleted = (int)($orphan['deleted_orphans'] ?? 0);
-
-    echo "Piwigo-Datenbanksynchronisierung per Benutzername/Passwort-Fallback erfolgreich\n";
+    echo "Piwigo-Datenbanksynchronisierung per Benutzername/Passwort-Fallback erfolgreich (Site $site_id)\n";
     echo "Piwigo-Orphans synchronisiert: +$added / -$deleted\n";
   }
   finally

runtime/lib/precache-webdav-previews.php

@@ -0,0 +1,294 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+require_once(dirname(__DIR__, 2).'/include/nc_transport.inc.php');
+
+const BRATONIEN_WEBDAV_PREVIEW_VERSION = 2;
+const BRATONIEN_WEBDAV_PREVIEW_MAX_EDGE = 4096;
+const BRATONIEN_WEBDAV_PREVIEW_JPEG_QUALITY = 88;
+
+function fail_preview($message)
+{
+  throw new RuntimeException($message);
+}
+
+function quote_webdav_path($path)
+{
+  $parts = array_values(array_filter(explode('/', trim((string)$path, '/')), 'strlen'));
+  return implode('/', array_map('rawurlencode', $parts));
+}
+
+function fetch_remote_blob($url, $user, $password)
+{
+  $ch = curl_init($url);
+  $options = array(
+    CURLOPT_RETURNTRANSFER => true,
+    CURLOPT_FOLLOWLOCATION => false,
+    CURLOPT_CONNECTTIMEOUT => 10,
+    CURLOPT_TIMEOUT => 120,
+    CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
+    CURLOPT_USERPWD => $user.':'.$password,
+    CURLOPT_FAILONERROR => false,
+    CURLOPT_USERAGENT => 'Bratonien-Tools-WebDAV-Precache/0.9.7.1',
+  );
+  bratonien_tools_nc_transport_apply_curl($options, $url);
+  curl_setopt_array($ch, $options);
+  $body = curl_exec($ch);
+  $errno = curl_errno($ch);
+  $error = curl_error($ch);
+  $http = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  if ($body === false || $errno !== 0) fail_preview('WebDAV-Bild konnte nicht geladen werden: '.$error);
+  if ($http < 200 || $http >= 300) fail_preview('WebDAV-Bild antwortete mit HTTP '.$http.'.');
+  if ($body === '') fail_preview('WebDAV-Bild ist leer.');
+  return (string)$body;
+}
+
+function preview_extension_for_entry(array $entry)
+{
+  $content_type = strtolower(trim((string)($entry['content_type'] ?? '')));
+  $path = strtolower((string)($entry['webdav_path'] ?? ''));
+  if ($content_type === 'image/png' || preg_match('/\.png$/', $path))
+  {
+    return 'png';
+  }
+  return 'jpg';
+}
+
+function preview_target_for_entry($cache_dir, $key, array $entry)
+{
+  return $cache_dir.'/'.$key.'.'.preview_extension_for_entry($entry);
+}
+
+function remove_other_preview_format($cache_dir, $key, $keep_target)
+{
+  foreach (array('jpg', 'png', 'webp') as $ext)
+  {
+    $candidate = $cache_dir.'/'.$key.'.'.$ext;
+    if ($candidate !== $keep_target && is_file($candidate)) @unlink($candidate);
+  }
+}
+
+function write_preview_imagick($blob, $target, $extension)
+{
+  $image = new Imagick();
+  try
+  {
+    $image->readImageBlob($blob);
+    if (method_exists($image, 'autoOrientImage')) @$image->autoOrientImage();
+    $image->setIteratorIndex(0);
+    $image->thumbnailImage(BRATONIEN_WEBDAV_PREVIEW_MAX_EDGE, BRATONIEN_WEBDAV_PREVIEW_MAX_EDGE, true, true);
+    $image->stripImage();
+
+    if ($extension === 'png')
+    {
+      $image->setImageFormat('png');
+    }
+    else
+    {
+      $image->setImageBackgroundColor('white');
+      if (method_exists($image, 'mergeImageLayers'))
+      {
+        $image = $image->mergeImageLayers(Imagick::LAYERMETHOD_FLATTEN);
+      }
+      $image->setImageFormat('jpeg');
+      $image->setImageCompression(Imagick::COMPRESSION_JPEG);
+      $image->setImageCompressionQuality(BRATONIEN_WEBDAV_PREVIEW_JPEG_QUALITY);
+      $image->setInterlaceScheme(Imagick::INTERLACE_PLANE);
+    }
+
+    if (!$image->writeImage($target)) fail_preview('Imagick konnte das Preview nicht schreiben.');
+  }
+  finally
+  {
+    $image->clear();
+    $image->destroy();
+  }
+}
+
+function write_preview_gd($blob, $target, $extension)
+{
+  $source = @imagecreatefromstring($blob);
+  if (!$source) fail_preview('GD konnte das Bild nicht dekodieren.');
+
+  try
+  {
+    $width = imagesx($source);
+    $height = imagesy($source);
+    if ($width < 1 || $height < 1) fail_preview('Bildabmessungen sind ungültig.');
+
+    $scale = min(1, BRATONIEN_WEBDAV_PREVIEW_MAX_EDGE / $width, BRATONIEN_WEBDAV_PREVIEW_MAX_EDGE / $height);
+    $target_width = max(1, (int)round($width * $scale));
+    $target_height = max(1, (int)round($height * $scale));
+    $preview = imagecreatetruecolor($target_width, $target_height);
+    if (!$preview) fail_preview('GD konnte die Preview-Arbeitsfläche nicht anlegen.');
+
+    try
+    {
+      if ($extension === 'png')
+      {
+        imagealphablending($preview, false);
+        imagesavealpha($preview, true);
+        $transparent = imagecolorallocatealpha($preview, 0, 0, 0, 127);
+        imagefilledrectangle($preview, 0, 0, $target_width, $target_height, $transparent);
+      }
+      else
+      {
+        $white = imagecolorallocate($preview, 255, 255, 255);
+        imagefilledrectangle($preview, 0, 0, $target_width, $target_height, $white);
+      }
+
+      if (!imagecopyresampled($preview, $source, 0, 0, 0, 0, $target_width, $target_height, $width, $height))
+      {
+        fail_preview('GD konnte das Preview nicht skalieren.');
+      }
+
+      $written = $extension === 'png'
+        ? imagepng($preview, $target, 6)
+        : imagejpeg($preview, $target, BRATONIEN_WEBDAV_PREVIEW_JPEG_QUALITY);
+      if (!$written) fail_preview('GD konnte das Preview nicht schreiben.');
+    }
+    finally
+    {
+      imagedestroy($preview);
+    }
+  }
+  finally
+  {
+    imagedestroy($source);
+  }
+}
+
+function write_preview($blob, $target, $extension)
+{
+  $dir = dirname($target);
+  if (!is_dir($dir) && !mkdir($dir, 0755, true) && !is_dir($dir)) fail_preview('Preview-Verzeichnis konnte nicht angelegt werden.');
+
+  if (class_exists('Imagick'))
+  {
+    write_preview_imagick($blob, $target, $extension);
+  }
+  elseif (function_exists('imagecreatefromstring') && function_exists('imagejpeg') && function_exists('imagepng'))
+  {
+    write_preview_gd($blob, $target, $extension);
+  }
+  else
+  {
+    fail_preview('Weder Imagick noch GD ist für die Preview-Erzeugung verfügbar.');
+  }
+
+  clearstatcache(true, $target);
+  $size = @getimagesize($target);
+  if (!is_array($size) || empty($size[0]) || empty($size[1]) || !is_file($target) || filesize($target) < 64)
+  {
+    @unlink($target);
+    fail_preview('Das erzeugte Preview ist ungültig.');
+  }
+  @chmod($target, 0644);
+}
+
+try
+{
+  $options = getopt('', array('mapping:', 'base-url:', 'user:', 'password-file:', 'cache-dir:'));
+  $mapping_file = (string)($options['mapping'] ?? '');
+  $base_url = rtrim((string)($options['base-url'] ?? ''), '/');
+  $user = trim((string)($options['user'] ?? ''));
+  $password_file = (string)($options['password-file'] ?? '');
+  $cache_dir = rtrim((string)($options['cache-dir'] ?? ''), '/');
+
+  if ($mapping_file === '' || !is_readable($mapping_file)) fail_preview('WebDAV-Mapping ist nicht lesbar.');
+  if ($base_url === '' || $user === '' || $password_file === '' || !is_readable($password_file) || $cache_dir === '') fail_preview('Preview-Parameter sind unvollständig.');
+  if (!function_exists('curl_init')) fail_preview('PHP-cURL ist nicht verfügbar.');
+
+  $password = rtrim((string)file_get_contents($password_file), "\r\n");
+  if ($password === '') fail_preview('Nextcloud-Passwort fehlt.');
+
+  $mapping = json_decode((string)file_get_contents($mapping_file), true);
+  if (!is_array($mapping) || !isset($mapping['files']) || !is_array($mapping['files'])) fail_preview('WebDAV-Mapping ist ungültig.');
+
+  if (!is_dir($cache_dir) && !mkdir($cache_dir, 0755, true) && !is_dir($cache_dir)) fail_preview('Preview-Cache konnte nicht angelegt werden.');
+  @chmod($cache_dir, 0755);
+
+  $state_file = $cache_dir.'/state.json';
+  $old_state = array();
+  if (is_readable($state_file))
+  {
+    $decoded = json_decode((string)file_get_contents($state_file), true);
+    if (is_array($decoded)) $old_state = $decoded;
+  }
+
+  $new_state = array();
+  $generated = 0;
+  $cached = 0;
+  $errors = 0;
+
+  foreach ($mapping['files'] as $entry)
+  {
+    if (!is_array($entry) || (string)($entry['kind'] ?? '') !== 'file') continue;
+    $webdav_path = trim((string)($entry['webdav_path'] ?? ''), '/');
+    if ($webdav_path === '') continue;
+
+    $etag = (string)($entry['etag'] ?? '');
+    $key = sha1($webdav_path);
+    $target = preview_target_for_entry($cache_dir, $key, $entry);
+    $extension = pathinfo($target, PATHINFO_EXTENSION);
+    $new_state[$key] = array(
+      'path' => $webdav_path,
+      'etag' => $etag,
+      'format' => $extension,
+      'version' => BRATONIEN_WEBDAV_PREVIEW_VERSION,
+    );
+
+    $old = $old_state[$key] ?? null;
+    if (
+      is_file($target)
+      && is_array($old)
+      && (string)($old['etag'] ?? '') === $etag
+      && (string)($old['format'] ?? '') === $extension
+      && (int)($old['version'] ?? 0) === BRATONIEN_WEBDAV_PREVIEW_VERSION
+    )
+    {
+      $cached++;
+      continue;
+    }
+
+    try
+    {
+      $url = $base_url.'/remote.php/dav/files/'.rawurlencode($user).'/'.quote_webdav_path($webdav_path);
+      $blob = fetch_remote_blob($url, $user, $password);
+      write_preview($blob, $target, $extension);
+      remove_other_preview_format($cache_dir, $key, $target);
+      $generated++;
+    }
+    catch (Throwable $e)
+    {
+      $errors++;
+      fwrite(STDERR, $webdav_path.': '.$e->getMessage()."\n");
+    }
+  }
+
+  foreach (glob($cache_dir.'/*') ?: array() as $file)
+  {
+    if (!is_file($file) || basename($file) === 'state.json') continue;
+    $name = basename($file);
+    if (!preg_match('/^([a-f0-9]{40})\.(jpg|png|webp)$/', $name, $m)) continue;
+    if (!isset($new_state[$m[1]])) @unlink($file);
+  }
+
+  file_put_contents($state_file, json_encode($new_state, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT)."\n", LOCK_EX);
+  @chmod($state_file, 0644);
+
+  echo 'WebDAV-Previews: erzeugt='.$generated.' vorhanden='.$cached.' fehler='.$errors."\n";
+  exit($errors > 0 ? 1 : 0);
+}
+catch (Throwable $e)
+{
+  fwrite(STDERR, 'WebDAV-Preview-Cache: '.$e->getMessage()."\n");
+  exit(1);
+}

runtime/lib/resolve-nextcloud-target.php

@@ -0,0 +1,24 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+require_once(dirname(__DIR__, 2).'/include/nc_transport.inc.php');
+
+try
+{
+  if ($argc !== 2) throw new RuntimeException('Aufruf: resolve-nextcloud-target.php <nextcloud-url>');
+  $url = rtrim(trim((string)$argv[1]), '/');
+  bratonien_tools_nc_transport_scheme($url);
+  $host = bratonien_tools_nc_transport_host($url);
+  echo bratonien_tools_nc_transport_public_ip($host)."\n";
+  exit(0);
+}
+catch (Throwable $e)
+{
+  fwrite(STDERR, $e->getMessage()."\n");
+  exit(1);
+}

runtime/lib/shadow_tree.py

@@ -56,12 +56,7 @@ def load_manifest(path: Path) -> list[dict[str, str]]:
             share_id, item_type, display_name, source_path = fields
             if item_type not in {"folder", "file"}:
                 raise ValueError(f"{path}:{line_number}: unsupported item_type {item_type!r}")
-            entries.append({
-                "share_id": share_id,
-                "item_type": item_type,
-                "display_name": display_name,
-                "source_path": source_path,
-            })
+            entries.append({"share_id": share_id, "item_type": item_type, "display_name": display_name, "source_path": source_path})
     return entries
 
 
@@ -87,8 +82,7 @@ def preferred_target(source_key: str, raw_name: str, parent_target: Path, old_ma
 def mirror_directory(source: Path, target: Path, source_key: str, target_key: Path, old_map: dict[str, str], new_map: dict[str, str]) -> None:
     target.mkdir(parents=True, exist_ok=True)
     used: set[str] = set()
-    children = sorted(source.iterdir(), key=lambda item: (item.name.casefold(), item.name))
-    for child in children:
+    for child in sorted(source.iterdir(), key=lambda item: (item.name.casefold(), item.name)):
         if child.is_symlink():
             continue
         child_source_key = f"{source_key}/{child.name}"
@@ -103,51 +97,68 @@ def mirror_directory(source: Path, target: Path, source_key: str, target_key: Pa
             child_target.symlink_to(child.resolve())
 
 
+def remove_tree(path: Path) -> None:
+    if path.is_symlink() or path.is_file():
+        path.unlink(missing_ok=True)
+    elif path.exists():
+        shutil.rmtree(path)
+
+
 def build(manifest: Path, destination: Path, state_file: Path) -> None:
     entries = load_manifest(manifest)
     old_map = load_map(state_file)
     new_map: dict[str, str] = {}
     staging = destination.with_name(f".{destination.name}.next")
     previous = destination.with_name(f".{destination.name}.previous")
+    state_staging = state_file.with_suffix(state_file.suffix + ".next")
 
-    if staging.exists():
-        shutil.rmtree(staging)
+    remove_tree(staging)
+    remove_tree(previous)
+    if state_staging.exists():
+        state_staging.unlink()
     staging.mkdir(parents=True)
 
-    used_roots: set[str] = set()
-    for entry in sorted(entries, key=lambda item: (item["display_name"].casefold(), item["share_id"])):
-        source = Path(entry["source_path"])
-        source_key = f"share:{entry['share_id']}"
-        preferred = preferred_target(source_key, entry["display_name"], Path("."), old_map)
-        is_file_share = entry["item_type"] == "file"
-        root_name = unique_name(preferred, used_roots, is_file_share)
-        root_key = Path(root_name)
-        new_map[source_key] = root_key.as_posix()
+    try:
+        used_roots: set[str] = set()
+        for entry in sorted(entries, key=lambda item: (item["display_name"].casefold(), item["share_id"])):
+            source = Path(entry["source_path"])
+            source_key = f"share:{entry['share_id']}"
+            preferred = preferred_target(source_key, entry["display_name"], Path("."), old_map)
+            is_file_share = entry["item_type"] == "file"
+            root_name = unique_name(preferred, used_roots, is_file_share)
+            root_key = Path(root_name)
+            new_map[source_key] = root_key.as_posix()
+            if is_file_share:
+                if not source.is_file():
+                    raise FileNotFoundError(f"source is not a readable file: {source}")
+                (staging / root_name).symlink_to(source.resolve())
+            else:
+                if not source.is_dir():
+                    raise FileNotFoundError(f"source is not a readable directory: {source}")
+                mirror_directory(source, staging / root_name, source_key, root_key, old_map, new_map)
 
-        if is_file_share:
-            if not source.is_file():
-                raise FileNotFoundError(f"source is not a readable file: {source}")
-            (staging / root_name).symlink_to(source.resolve())
-            continue
+        state_staging.parent.mkdir(parents=True, exist_ok=True)
+        with state_staging.open("w", encoding="utf-8") as handle:
+            json.dump(new_map, handle, ensure_ascii=False, indent=2, sort_keys=True)
+            handle.write("\n")
 
-        if not source.is_dir():
-            raise FileNotFoundError(f"source is not a readable directory: {source}")
-        mirror_directory(source, staging / root_name, source_key, root_key, old_map, new_map)
-
-    state_staging = state_file.with_suffix(state_file.suffix + ".next")
-    state_staging.parent.mkdir(parents=True, exist_ok=True)
-    with state_staging.open("w", encoding="utf-8") as handle:
-        json.dump(new_map, handle, ensure_ascii=False, indent=2, sort_keys=True)
-        handle.write("\n")
-
-    if previous.exists():
-        shutil.rmtree(previous)
-    if destination.exists():
-        destination.rename(previous)
-    staging.rename(destination)
-    state_staging.replace(state_file)
-    if previous.exists():
-        shutil.rmtree(previous)
+        had_destination = destination.exists()
+        if had_destination:
+            destination.rename(previous)
+        try:
+            staging.rename(destination)
+            state_staging.replace(state_file)
+        except Exception:
+            remove_tree(destination)
+            if had_destination and previous.exists():
+                previous.rename(destination)
+            raise
+        remove_tree(previous)
+    except Exception:
+        remove_tree(staging)
+        if state_staging.exists():
+            state_staging.unlink()
+        raise
 
 
 def main() -> int:

runtime/native-runner.php

@@ -0,0 +1,108 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+$options = getopt('', array('connection-id::'));
+$connectionId = isset($options['connection-id']) ? (int)$options['connection-id'] : 0;
+
+$pluginRoot = dirname(__DIR__);
+$piwigoRoot = dirname($pluginRoot, 2);
+$base = rtrim($piwigoRoot, '/').'/_data/bratonien-tools';
+$schedulerDir = $base.'/nc-connector-scheduler';
+$stateFile = $schedulerDir.'/state.json';
+$runtimeDir = $base.'/nc-connector-runtime';
+$stateRoot = $base.'/nc-connector-state';
+
+function native_scheduler_state($path)
+{
+  if (!is_readable($path)) return array();
+  $decoded = json_decode((string)@file_get_contents($path), true);
+  return is_array($decoded) ? $decoded : array();
+}
+
+function native_scheduler_write($path, array $state)
+{
+  $json = json_encode($state, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+  if (!is_string($json)) return false;
+  $tmp = $path.'.tmp';
+  if (@file_put_contents($tmp, $json."\n", LOCK_EX) === false) return false;
+  @chmod($tmp, 0640);
+  return @rename($tmp, $path);
+}
+
+foreach (array($schedulerDir, $runtimeDir, $stateRoot) as $dir)
+{
+  if (!is_dir($dir) && !@mkdir($dir, 0750, true) && !is_dir($dir))
+  {
+    fwrite(STDERR, "Runtime-Verzeichnis konnte nicht angelegt werden: {$dir}\n");
+    exit(1);
+  }
+}
+
+$state = native_scheduler_state($stateFile);
+$state['enabled'] = true;
+$state['mode'] = 'piwigo-native';
+$state['state'] = 'running';
+$state['message'] = $connectionId > 0 ? 'NC-Abgleich für Verbindung #'.$connectionId.' läuft.' : 'NC-Abgleich läuft.';
+$state['started_at'] = time();
+$state['timestamp'] = time();
+$state['connection_id'] = $connectionId;
+native_scheduler_write($stateFile, $state);
+
+$env = $_ENV;
+$env['PATH'] = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+$env['BRATONIEN_NC_NATIVE'] = '1';
+$env['BRATONIEN_NC_PIWIGO_ROOT'] = $piwigoRoot;
+$env['BRATONIEN_NC_CONFIG_DIR'] = $runtimeDir;
+$env['BRATONIEN_NC_STATE_ROOT'] = $stateRoot;
+$env['BRATONIEN_NC_CONNECTION_ID'] = (string)$connectionId;
+$env['LC_ALL'] = 'C';
+$env['LANG'] = 'C';
+
+$bash = is_executable('/usr/bin/bash') ? '/usr/bin/bash' : '/bin/bash';
+$command = array($bash, $pluginRoot.'/runtime/run-all.sh');
+$spec = array(
+  0=>array('file','/dev/null','r'),
+  1=>array('pipe','w'),
+  2=>array('pipe','w'),
+);
+$process = @proc_open($command, $spec, $pipes, null, $env);
+$stdout = '';
+$stderr = '';
+$exit = 1;
+if (is_resource($process))
+{
+  $stdout = (string)stream_get_contents($pipes[1]);
+  $stderr = (string)stream_get_contents($pipes[2]);
+  fclose($pipes[1]);
+  fclose($pipes[2]);
+  $exit = proc_close($process);
+}
+else
+{
+  $stderr = 'run-all.sh konnte nicht gestartet werden.';
+}
+
+$state = native_scheduler_state($stateFile);
+$state['enabled'] = true;
+$state['mode'] = 'piwigo-native';
+$state['state'] = $exit === 0 ? 'success' : 'error';
+$state['message'] = $exit === 0
+  ? ($connectionId > 0 ? 'NC-Abgleich für Verbindung #'.$connectionId.' erfolgreich abgeschlossen.' : 'NC-Abgleich erfolgreich abgeschlossen.')
+  : ($connectionId > 0 ? 'NC-Abgleich für Verbindung #'.$connectionId.' fehlgeschlagen.' : 'NC-Abgleich fehlgeschlagen.');
+$state['timestamp'] = time();
+$state['finished_at'] = time();
+$state['exit_code'] = $exit;
+$state['connection_id'] = $connectionId;
+$state['stdout'] = trim($stdout);
+$state['stderr'] = trim($stderr);
+if (empty($state['next_due']) || (int)$state['next_due'] < time())
+{
+  $state['next_due'] = time() + 60;
+}
+native_scheduler_write($stateFile, $state);
+exit($exit === 0 ? 0 : 1);

runtime/reconcile-webdav.php

@@ -0,0 +1,259 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+function fail_webdav_reconcile($message)
+{
+  throw new RuntimeException($message);
+}
+
+function decrypt_webdav_credentials($blob, $hexKey)
+{
+  if (!preg_match('/^[a-f0-9]{64}$/', (string)$hexKey)) fail_webdav_reconcile('Connector-Schluessel ist ungueltig.');
+  $outer = base64_decode(trim((string)$blob), true);
+  $payload = is_string($outer) ? json_decode($outer, true) : null;
+  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1) fail_webdav_reconcile('Connector-Zugangsdaten haben ein unbekanntes Format.');
+  $iv = base64_decode((string)($payload['iv'] ?? ''), true);
+  $tag = base64_decode((string)($payload['tag'] ?? ''), true);
+  $cipher = base64_decode((string)($payload['data'] ?? ''), true);
+  $plain = openssl_decrypt($cipher, 'aes-256-gcm', hex2bin($hexKey), OPENSSL_RAW_DATA, $iv, $tag);
+  if ($plain === false || $plain === '') fail_webdav_reconcile('Connector-Zugangsdaten konnten nicht entschluesselt werden.');
+  $decoded = json_decode($plain, true);
+  if (!is_array($decoded)) fail_webdav_reconcile('WebDAV-Verbindung besitzt kein kompatibles Secret-Format.');
+  return array(
+    'nextcloud_user'=>(string)($decoded['nextcloud_user'] ?? ''),
+    'nextcloud_password'=>(string)($decoded['nextcloud_password'] ?? ''),
+  );
+}
+
+function webdav_shell_value($value)
+{
+  return escapeshellarg((string)$value);
+}
+
+function webdav_remove_generated_tree($path, $allowedRoot)
+{
+  $path = rtrim((string)$path, '/');
+  $allowedRoot = rtrim((string)$allowedRoot, '/');
+  if ($path === '' || $allowedRoot === '' || strpos($path, $allowedRoot.'/') !== 0 || !file_exists($path)) return;
+  if (is_link($path) || is_file($path))
+  {
+    @unlink($path);
+    return;
+  }
+  $items = scandir($path);
+  if (is_array($items))
+  {
+    foreach ($items as $item)
+    {
+      if ($item === '.' || $item === '..') continue;
+      webdav_remove_generated_tree($path.'/'.$item, $allowedRoot);
+    }
+  }
+  @rmdir($path);
+}
+
+function webdav_source_fingerprint($baseUrl, $user, array $roots)
+{
+  $normalized = array();
+  foreach ($roots as $root)
+  {
+    $normalized[] = array(
+      'fileid'=>(int)($root['fileid'] ?? 0),
+      'path'=>trim((string)($root['webdav_path'] ?? ''), '/'),
+    );
+  }
+  usort($normalized, function($a, $b)
+  {
+    $cmp = $a['fileid'] <=> $b['fileid'];
+    return $cmp !== 0 ? $cmp : strcmp($a['path'], $b['path']);
+  });
+  return hash('sha256', strtolower(rtrim((string)$baseUrl, '/'))."\n".strtolower(trim((string)$user))."\n".json_encode($normalized));
+}
+
+$pluginRoot = dirname(__DIR__);
+$piwigoRoot = dirname($pluginRoot, 2);
+$dbConfig = $piwigoRoot.'/local/config/database.inc.php';
+$nativeMode = getenv('BRATONIEN_NC_NATIVE') === '1';
+$configDir = trim((string)getenv('BRATONIEN_NC_CONFIG_DIR'));
+if ($configDir === '') $configDir = $nativeMode ? rtrim($piwigoRoot, '/').'/_data/bratonien-tools/nc-connector-runtime' : '/etc/bratonien-tools/nc-connector';
+$stateRoot = trim((string)getenv('BRATONIEN_NC_STATE_ROOT'));
+if ($stateRoot === '') $stateRoot = $nativeMode ? rtrim($piwigoRoot, '/').'/_data/bratonien-tools/nc-connector-state' : '/var/lib/bratonien-tools/nc-connector';
+$publicSourceRoot = rtrim($piwigoRoot, '/').'/_data/bratonien-tools/nc-webdav-source';
+$publicGalleryRoot = rtrim($piwigoRoot, '/').'/_data/bratonien-tools/nc-webdav-gallery';
+$legacyGalleryRoot = rtrim($piwigoRoot, '/').'/galleries';
+
+try
+{
+  if (!is_readable($dbConfig)) fail_webdav_reconcile('Piwigo-Datenbankkonfiguration ist nicht lesbar: '.$dbConfig);
+  $conf = array();
+  $prefixeTable = 'piwigo_';
+  require $dbConfig;
+  foreach (array('db_host','db_user','db_password','db_base') as $key)
+  {
+    if (!isset($conf[$key])) fail_webdav_reconcile('Piwigo-Datenbankkonfiguration ist unvollstaendig: '.$key);
+  }
+
+  $db = new mysqli($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base']);
+  if ($db->connect_errno) fail_webdav_reconcile('Piwigo-Datenbank ist nicht erreichbar: '.$db->connect_error);
+  $db->set_charset('utf8mb4');
+
+  $keyResult = $db->query("SELECT value FROM `{$prefixeTable}config` WHERE param='bratonien_nc_connector_secret' LIMIT 1");
+  if (!$keyResult || !$keyResult->num_rows) fail_webdav_reconcile('Connector-Schluessel wurde nicht gefunden.');
+  $hexKey = trim((string)$keyResult->fetch_assoc()['value']);
+
+  $table = $prefixeTable.'bratonien_tools_nc_connections';
+  $rows = $db->query("SELECT id,name,adapter,config_json,secret_blob FROM `{$table}` ORDER BY id DESC");
+  if (!$rows) fail_webdav_reconcile('Connector-Verbindungen konnten nicht gelesen werden: '.$db->error);
+
+  foreach (array($configDir, $stateRoot, $publicSourceRoot, $publicGalleryRoot) as $dir)
+  {
+    if (!is_dir($dir) && !mkdir($dir, $dir === $configDir ? 0700 : 0750, true)) fail_webdav_reconcile('Runtime-Verzeichnis konnte nicht angelegt werden: '.$dir);
+  }
+  @chmod($configDir, 0700);
+  @chmod($stateRoot, 0750);
+  @chmod($publicSourceRoot, 0755);
+  @chmod($publicGalleryRoot, 0755);
+
+  $known = array();
+  $seenFingerprints = array();
+
+  while ($row = $rows->fetch_assoc())
+  {
+    $id = (int)$row['id'];
+    $config = json_decode((string)$row['config_json'], true);
+    if (!is_array($config)) $config = array();
+    if ((string)$row['adapter'] !== 'remote') continue;
+    if ((string)($config['source_mode'] ?? '') !== 'webdav-placeholder') continue;
+
+    try
+    {
+      $baseUrl = rtrim(trim((string)($config['nextcloud_url'] ?? '')), '/');
+      $roots = isset($config['roots']) && is_array($config['roots']) ? $config['roots'] : array();
+      if ($baseUrl === '') fail_webdav_reconcile('Nextcloud-Adresse fehlt.');
+      if (!$roots) fail_webdav_reconcile('Keine WebDAV-Wurzeln gespeichert.');
+
+      $credentials = decrypt_webdav_credentials((string)$row['secret_blob'], $hexKey);
+      $user = trim($credentials['nextcloud_user']);
+      $password = $credentials['nextcloud_password'];
+      if ($user === '' || $password === '') fail_webdav_reconcile('Nextcloud-Zugangsdaten fehlen.');
+
+      $fingerprint = webdav_source_fingerprint($baseUrl, $user, $roots);
+      if (isset($seenFingerprints[$fingerprint]))
+      {
+        fwrite(STDERR, "NC WebDAV #{$id}: identische Quelle bereits durch Verbindung #".$seenFingerprints[$fingerprint]." abgedeckt; doppelte Runtime wird unterdrueckt.\n");
+        foreach (glob($configDir.'/webdav-connection-'.$id.'.*') ?: array() as $stale) @unlink($stale);
+        webdav_remove_generated_tree($legacyGalleryRoot.'/bratonien-webdav-'.$id, $legacyGalleryRoot);
+        webdav_remove_generated_tree($publicGalleryRoot.'/connection-'.$id, $publicGalleryRoot);
+        continue;
+      }
+      $seenFingerprints[$fingerprint] = $id;
+      $known[$id] = true;
+
+      $stateDir = $nativeMode ? $stateRoot.'/connection-'.$id : rtrim((string)($config['state_dir'] ?? ''), '/');
+      if ($stateDir === '') $stateDir = $stateRoot.'/connection-'.$id;
+      if (!is_dir($stateDir) && !mkdir($stateDir, 0750, true)) fail_webdav_reconcile('State-Verzeichnis konnte nicht angelegt werden.');
+      @chmod($stateDir, 0750);
+
+      $legacyDefault = $legacyGalleryRoot.'/bratonien-webdav-'.$id;
+      $galleryRoot = rtrim((string)($config['parallel_gallery_root'] ?? ''), '/');
+      if ($galleryRoot === '' || $galleryRoot === $legacyDefault || strpos($galleryRoot, $legacyGalleryRoot.'/bratonien-webdav-') === 0)
+      {
+        $galleryRoot = $publicGalleryRoot.'/connection-'.$id;
+      }
+      if (!is_dir($galleryRoot) && !mkdir($galleryRoot, 0755, true)) fail_webdav_reconcile('WebDAV-Galeriebereich konnte nicht angelegt werden.');
+      @chmod($galleryRoot, 0755);
+      webdav_remove_generated_tree($legacyDefault, $legacyGalleryRoot);
+
+      $sourceDir = $publicSourceRoot.'/connection-'.$id;
+      if (!is_dir($sourceDir) && !mkdir($sourceDir, 0755, true)) fail_webdav_reconcile('WebDAV-Platzhalterquelle konnte nicht angelegt werden.');
+      @chmod($sourceDir, 0755);
+
+      $base = $configDir.'/webdav-connection-'.$id;
+      $passwordPath = $base.'.nextcloud-password';
+      $rootsPath = $base.'.roots.tsv';
+      $configPath = $base.'.conf';
+      $statusFile = $stateDir.'/connector-status.json';
+      $mappingFile = $stateDir.'/webdav-map.json';
+      $manifestFile = $stateDir.'/webdav-manifest.tsv';
+      $shadowMapFile = $stateDir.'/webdav-shadow-map.json';
+
+      file_put_contents($passwordPath, $password."\n", LOCK_EX);
+      @chmod($passwordPath, 0600);
+
+      $rootLines = array('# webdav_path<TAB>display_name');
+      foreach ($roots as $root)
+      {
+        $path = trim((string)($root['webdav_path'] ?? ''), '/');
+        $display = trim((string)($root['display_name'] ?? ''));
+        $runtimePath = $path === '' ? '/' : $path;
+        if ($display === '' || preg_match('/[\t\r\n]/', $runtimePath.$display)) fail_webdav_reconcile('Eine gespeicherte WebDAV-Wurzel ist ungueltig.');
+        $rootLines[] = $runtimePath."\t".$display;
+      }
+      file_put_contents($rootsPath, implode("\n", $rootLines)."\n", LOCK_EX);
+      @chmod($rootsPath, 0600);
+
+      $lines = array(
+        'PIWIGO_ROOT='.webdav_shell_value($piwigoRoot),
+        'CONNECTION_ID='.$id,
+        'SOURCE_MODE=webdav-placeholder',
+        'WEBDAV_BASE_URL='.webdav_shell_value($baseUrl),
+        'WEBDAV_USER='.webdav_shell_value($user),
+        'WEBDAV_PASSWORD_FILE='.webdav_shell_value($passwordPath),
+        'WEBDAV_ROOTS_FILE='.webdav_shell_value($rootsPath),
+        'WEBDAV_SOURCE_DIR='.webdav_shell_value($sourceDir),
+        'WEBDAV_MAPPING_FILE='.webdav_shell_value($mappingFile),
+        'MANIFEST='.webdav_shell_value($manifestFile),
+        'SHADOW_MAP_FILE='.webdav_shell_value($shadowMapFile),
+        'GALLERY_ROOT='.webdav_shell_value($galleryRoot),
+        'STATE_DIR='.webdav_shell_value($stateDir),
+        'STATUS_FILE='.webdav_shell_value($statusFile),
+        'PIWIGO_SYNC_ENABLED=1',
+      );
+      file_put_contents($configPath, implode("\n", $lines)."\n", LOCK_EX);
+      @chmod($configPath, 0600);
+
+      unset($config['migration'], $config['parallel_test']);
+      $config['state_dir'] = $stateDir;
+      $config['status_file'] = $statusFile;
+      $config['parallel_gallery_root'] = $galleryRoot;
+      $config['source_fingerprint'] = $fingerprint;
+      $config['runtime'] = array(
+        'mode'=>$nativeMode ? 'piwigo-native-webdav' : 'webdav',
+        'config'=>$configPath,
+        'piwigo_sync_enabled'=>true,
+        'reconciled_at'=>date('Y-m-d H:i:s'),
+      );
+      $json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+      if (!is_string($json)) fail_webdav_reconcile('WebDAV-Runtime-Konfiguration konnte nicht serialisiert werden.');
+      $escaped = $db->real_escape_string($json);
+      if (!$db->query("UPDATE `{$table}` SET config_json='{$escaped}' WHERE id={$id} AND adapter='remote' LIMIT 1"))
+      {
+        fail_webdav_reconcile('WebDAV-Runtime-Status konnte nicht gespeichert werden: '.$db->error);
+      }
+    }
+    catch (Throwable $e)
+    {
+      fwrite(STDERR, "NC WebDAV #{$id}: ".$e->getMessage()."\n");
+    }
+  }
+
+  foreach (glob($configDir.'/webdav-connection-*.conf') ?: array() as $path)
+  {
+    if (!preg_match('/webdav-connection-([0-9]+)\.conf$/', $path, $match)) continue;
+    $id = (int)$match[1];
+    if (isset($known[$id])) continue;
+    foreach (glob($configDir.'/webdav-connection-'.$id.'.*') ?: array() as $stale) @unlink($stale);
+  }
+
+  exit(0);
+}
+catch (Throwable $e)
+{
+  fwrite(STDERR, "NC WebDAV Reconcile: ".$e->getMessage()."\n");
+  exit(1);
+}

runtime/reconcile.php

@@ -0,0 +1,336 @@
+#!/usr/bin/env php
+<?php
+if (PHP_SAPI !== 'cli')
+{
+  fwrite(STDERR, "CLI only\n");
+  exit(1);
+}
+
+function fail_reconcile($message)
+{
+  throw new RuntimeException($message);
+}
+
+function decrypt_reconcile($blob, $hexKey)
+{
+  if (!preg_match('/^[a-f0-9]{64}$/', (string)$hexKey)) fail_reconcile('Connector-Schluessel ist ungueltig.');
+  $outer = base64_decode(trim((string)$blob), true);
+  $payload = is_string($outer) ? json_decode($outer, true) : null;
+  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1) fail_reconcile('Connector-Zugangsdaten haben ein unbekanntes Format.');
+  $iv = base64_decode((string)($payload['iv'] ?? ''), true);
+  $tag = base64_decode((string)($payload['tag'] ?? ''), true);
+  $cipher = base64_decode((string)($payload['data'] ?? ''), true);
+  $plain = openssl_decrypt($cipher, 'aes-256-gcm', hex2bin($hexKey), OPENSSL_RAW_DATA, $iv, $tag);
+  if ($plain === false || $plain === '') fail_reconcile('Connector-Zugangsdaten konnten nicht entschluesselt werden.');
+  $decoded = json_decode($plain, true);
+  if (!is_array($decoded))
+  {
+    return array('db_password'=>$plain,'piwigo_user'=>'','piwigo_password'=>'','api_key_id'=>'','api_key_secret'=>'');
+  }
+  return array(
+    'db_password'=>(string)($decoded['db_password'] ?? ''),
+    'piwigo_user'=>(string)($decoded['piwigo_user'] ?? ''),
+    'piwigo_password'=>(string)($decoded['piwigo_password'] ?? ''),
+    'api_key_id'=>(string)($decoded['api_key_id'] ?? ''),
+    'api_key_secret'=>(string)($decoded['api_key_secret'] ?? ''),
+  );
+}
+
+function encrypt_reconcile(array $credentials, $hexKey)
+{
+  $plain = json_encode(array(
+    'v'=>2,
+    'db_password'=>(string)$credentials['db_password'],
+    'piwigo_user'=>(string)$credentials['piwigo_user'],
+    'piwigo_password'=>(string)$credentials['piwigo_password'],
+    'api_key_id'=>(string)$credentials['api_key_id'],
+    'api_key_secret'=>(string)$credentials['api_key_secret'],
+  ), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($plain)) fail_reconcile('Connector-Zugangsdaten konnten nicht serialisiert werden.');
+  $iv = random_bytes(12);
+  $tag = '';
+  $cipher = openssl_encrypt($plain, 'aes-256-gcm', hex2bin($hexKey), OPENSSL_RAW_DATA, $iv, $tag);
+  if ($cipher === false) fail_reconcile('Connector-Zugangsdaten konnten nicht verschluesselt werden.');
+  return base64_encode(json_encode(array(
+    'v'=>1,
+    'iv'=>base64_encode($iv),
+    'tag'=>base64_encode($tag),
+    'data'=>base64_encode($cipher),
+  )));
+}
+
+function write_runtime_status($piwigoRoot, $id, $stateDir, $message)
+{
+  $payload = json_encode(array(
+    'state'=>'error',
+    'message'=>'Runtime-Vorbereitung fehlgeschlagen',
+    'timestamp'=>time(),
+    'auth_mode'=>'failed',
+    'api'=>array('state'=>'not_run','message'=>''),
+    'fallback'=>array('state'=>'not_run','message'=>''),
+    'error_detail'=>(string)$message,
+  ), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+  if (!is_string($payload)) return;
+  $targets = array(rtrim($piwigoRoot, '/').'/_data/bratonien-tools/nc-connector-status/connection-'.$id.'.json');
+  if ($stateDir !== '') $targets[] = rtrim($stateDir, '/').'/connector-status.json';
+  foreach ($targets as $target)
+  {
+    $dir = dirname($target);
+    if (!is_dir($dir)) @mkdir($dir, 0755, true);
+    @file_put_contents($target, $payload."\n", LOCK_EX);
+    @chmod($target, 0644);
+  }
+}
+
+function sql_reconcile(mysqli $db, $value)
+{
+  return $db->real_escape_string((string)$value);
+}
+
+function nextcloud_view_available(array $config, $password, $view)
+{
+  if (!preg_match('/^[A-Za-z_][A-Za-z0-9_]*$/', (string)$view)) return false;
+  $spec = array(0=>array('file','/dev/null','r'),1=>array('pipe','w'),2=>array('pipe','w'));
+  $command = array(
+    'psql','-XAt','-v','ON_ERROR_STOP=1',
+    '-h',(string)$config['host'],'-p',(string)$config['port'],'-U',(string)$config['user'],'-d',(string)$config['database'],
+    '-c','SELECT 1 FROM '.$view.' LIMIT 1'
+  );
+  $env = $_ENV;
+  $env['PGPASSWORD'] = (string)$password;
+  $process = @proc_open($command, $spec, $pipes, null, $env);
+  if (!is_resource($process)) return false;
+  stream_get_contents($pipes[1]);
+  stream_get_contents($pipes[2]);
+  fclose($pipes[1]); fclose($pipes[2]);
+  return proc_close($process) === 0;
+}
+
+function configured_access_user(array $config)
+{
+  foreach (array('access_user','nextcloud_access_user','showcase_user') as $key)
+  {
+    $value = trim((string)($config[$key] ?? ''));
+    if ($value !== '') return $value;
+  }
+  return '';
+}
+
+$pluginRoot = dirname(__DIR__);
+$piwigoRoot = dirname($pluginRoot, 2);
+$dbConfig = $piwigoRoot.'/local/config/database.inc.php';
+$configDir = '/etc/bratonien-tools/nc-connector';
+$stateRoot = '/var/lib/bratonien-tools/nc-connector';
+
+try
+{
+  if (!is_readable($dbConfig)) fail_reconcile('Piwigo-Datenbankkonfiguration ist nicht lesbar: '.$dbConfig);
+  $conf = array();
+  $prefixeTable = 'piwigo_';
+  require $dbConfig;
+  foreach (array('db_host','db_user','db_password','db_base') as $key)
+  {
+    if (!isset($conf[$key])) fail_reconcile('Piwigo-Datenbankkonfiguration ist unvollstaendig: '.$key);
+  }
+
+  $db = new mysqli($conf['db_host'], $conf['db_user'], $conf['db_password'], $conf['db_base']);
+  if ($db->connect_errno) fail_reconcile('Piwigo-Datenbank ist nicht erreichbar: '.$db->connect_error);
+  $db->set_charset('utf8mb4');
+
+  $keyResult = $db->query("SELECT value FROM `{$prefixeTable}config` WHERE param='bratonien_nc_connector_secret' LIMIT 1");
+  if (!$keyResult || !$keyResult->num_rows) fail_reconcile('Connector-Schluessel wurde nicht gefunden.');
+  $hexKey = trim((string)$keyResult->fetch_assoc()['value']);
+
+  $table = $prefixeTable.'bratonien_tools_nc_connections';
+  $rows = $db->query("SELECT id,name,adapter,enabled,takeover_state,config_json,secret_blob FROM `{$table}` ORDER BY id");
+  if (!$rows) fail_reconcile('Connector-Verbindungen konnten nicht gelesen werden: '.$db->error);
+
+  if (!is_dir($configDir) && !mkdir($configDir, 0700, true)) fail_reconcile('Runtime-Konfigurationsverzeichnis konnte nicht angelegt werden.');
+  chmod($configDir, 0700);
+
+  while ($row = $rows->fetch_assoc())
+  {
+    $id = (int)$row['id'];
+    $config = json_decode((string)$row['config_json'], true);
+    if (!is_array($config)) $config = array();
+    $stateDir = rtrim((string)($config['state_dir'] ?? ''), '/');
+    if ($stateDir === '') $stateDir = $stateRoot.'/connection-'.$id;
+
+    try
+    {
+      if ((string)$row['adapter'] !== 'local') continue;
+      $isActive = (int)$row['enabled'] === 1 && (string)$row['takeover_state'] === 'active';
+      $accessUser = configured_access_user($config);
+      $wizardConnection = (string)($config['origin'] ?? '') === 'native'
+        && trim((string)($config['nextcloud_url'] ?? '')) !== ''
+        && $accessUser !== '';
+      $verification = isset($config['verification']) && is_array($config['verification']) ? $config['verification'] : null;
+      $verificationFailed = is_array($verification) && empty($verification['ok']);
+      if (!$isActive && (!$wizardConnection || $verificationFailed)) continue;
+
+      foreach (array('host','port','database','user','source_view','activity_view','gallery_root') as $key)
+      {
+        if (trim((string)($config[$key] ?? '')) === '') fail_reconcile('Konfiguration unvollstaendig: '.$key.' fehlt.');
+      }
+      $storages = isset($config['storages']) && is_array($config['storages']) ? $config['storages'] : array();
+      if (!$storages) fail_reconcile('Keine Storage-Zuordnungen gespeichert.');
+
+      $credentials = decrypt_reconcile((string)$row['secret_blob'], $hexKey);
+      if ($credentials['db_password'] === '') fail_reconcile('Datenbankpasswort fehlt.');
+
+      $sourceMode = trim((string)($config['source_mode'] ?? ''));
+      if ($sourceMode === 'user-filesystem')
+      {
+        @unlink($configDir.'/connection-'.$id.'.conf');
+        fail_reconcile('Diese Verbindung verwendet den verworfenen experimentellen Benutzerpfad-Modus. Bitte die Verbindung mit dem aktuellen Assistenten neu anlegen.');
+      }
+
+      if ($sourceMode === '' || $sourceMode === 'legacy-view')
+      {
+        $canMigrate = $accessUser !== ''
+          && nextcloud_view_available($config, $credentials['db_password'], 'piwigo_connector_shares')
+          && nextcloud_view_available($config, $credentials['db_password'], 'piwigo_connector_activity');
+        if ($canMigrate)
+        {
+          $sourceMode = 'user-shares';
+          $config['source_mode'] = $sourceMode;
+          $config['source_view'] = 'piwigo_connector_shares';
+          $config['activity_view'] = 'piwigo_connector_activity';
+          $config['access_user'] = $accessUser;
+          $config['nextcloud_access_user'] = $accessUser;
+          unset($config['showcase_user']);
+          echo "NC Connector: Verbindung #{$id} auf generische benutzergefilterte Quellen migriert.\n";
+        }
+        else
+        {
+          $sourceMode = 'legacy-view';
+          $config['source_mode'] = $sourceMode;
+        }
+      }
+
+      if (!in_array($sourceMode, array('legacy-view','user-shares','selected-fileids'), true)) fail_reconcile('Unbekannter Quellenmodus: '.$sourceMode);
+      if ($sourceMode !== 'legacy-view' && $accessUser === '') fail_reconcile('Für die verbindungsbezogene Quelle fehlt der Nextcloud-Benutzer.');
+
+      $roots = isset($config['roots']) && is_array($config['roots']) ? $config['roots'] : array();
+      if ($sourceMode === 'selected-fileids' && !$roots) fail_reconcile('Für die Verbindung sind keine ausgewählten Nextcloud-Datei-IDs gespeichert.');
+
+      if (!$isActive && !array_key_exists('api_enabled', $config))
+      {
+        $hasFallback = $credentials['piwigo_user'] !== '' && $credentials['piwigo_password'] !== '';
+        if (!$hasFallback) fail_reconcile('Die Verbindung besitzt weder einen eigenen API-Zugang noch einen eigenen Fallback.');
+        $credentials['api_key_id'] = '';
+        $credentials['api_key_secret'] = '';
+        $config['piwigo_auth'] = 'connection-scoped';
+        $config['api_enabled'] = false;
+        $row['secret_blob'] = encrypt_reconcile($credentials, $hexKey);
+      }
+
+      $connectionScoped = (string)($config['piwigo_auth'] ?? '') === 'connection-scoped' || array_key_exists('api_enabled', $config);
+      if ($connectionScoped)
+      {
+        $apiAvailable = !empty($config['api_enabled']) && $credentials['api_key_id'] !== '' && $credentials['api_key_secret'] !== '';
+        $fallbackAvailable = $credentials['piwigo_user'] !== '' && $credentials['piwigo_password'] !== '';
+        if (!$apiAvailable && !$fallbackAvailable) fail_reconcile('Kein verbindungseigener Piwigo-Zugang gespeichert.');
+      }
+
+      if (!is_dir($stateDir) && !mkdir($stateDir, 0750, true)) fail_reconcile('State-Verzeichnis konnte nicht angelegt werden.');
+      chmod($stateDir, 0750);
+
+      $base = $configDir.'/connection-'.$id;
+      $dbPasswordPath = $base.'.db-password';
+      $piwigoPasswordPath = $base.'.piwigo-password';
+      $storagePath = $base.'.storages.tsv';
+      $rootsPath = $base.'.roots.tsv';
+      $configPath = $base.'.conf';
+      $statusFile = $stateDir.'/connector-status.json';
+
+      file_put_contents($dbPasswordPath, $credentials['db_password']."\n", LOCK_EX);
+      chmod($dbPasswordPath, 0600);
+
+      $fallbackAvailable = $credentials['piwigo_user'] !== '' && $credentials['piwigo_password'] !== '';
+      if ($fallbackAvailable)
+      {
+        file_put_contents($piwigoPasswordPath, $credentials['piwigo_password']."\n", LOCK_EX);
+        chmod($piwigoPasswordPath, 0600);
+      }
+      else @unlink($piwigoPasswordPath);
+
+      $storageLines = array('# storage_id<TAB>source_prefix<TAB>local_mount<TAB>include_prefix');
+      foreach ($storages as $storage)
+      {
+        $storageLines[] = (string)($storage['storage_id'] ?? '')."\t"
+          .trim((string)($storage['source_prefix'] ?? ''), '/')."\t"
+          .(string)($storage['local_mount'] ?? '')."\t"
+          .trim((string)($storage['include_prefix'] ?? ''), '/');
+      }
+      file_put_contents($storagePath, implode("\n", $storageLines)."\n", LOCK_EX);
+      chmod($storagePath, 0600);
+
+      if ($sourceMode === 'selected-fileids')
+      {
+        $rootLines = array('# fileid<TAB>display_name');
+        foreach ($roots as $root)
+        {
+          $fileid = (int)($root['fileid'] ?? 0);
+          $display = trim((string)($root['display_name'] ?? ''));
+          if ($fileid < 1 || $display === '' || preg_match('/[\t\r\n]/', $display)) fail_reconcile('Eine gespeicherte Nextcloud-Quelle ist ungueltig.');
+          $rootLines[] = $fileid."\t".$display;
+        }
+        file_put_contents($rootsPath, implode("\n", $rootLines)."\n", LOCK_EX);
+        chmod($rootsPath, 0600);
+      }
+      else @unlink($rootsPath);
+
+      $lines = array(
+        'PIWIGO_ROOT='.$piwigoRoot,
+        'GALLERY_ROOT='.(string)$config['gallery_root'],
+        'STATE_DIR='.$stateDir,
+        'STATUS_FILE='.$statusFile,
+        'NC_DB_HOST='.(string)$config['host'],
+        'NC_DB_PORT='.(string)$config['port'],
+        'NC_DB_NAME='.(string)$config['database'],
+        'NC_DB_USER='.(string)$config['user'],
+        'NC_DB_VIEW='.(string)$config['source_view'],
+        'NC_ACTIVITY_VIEW='.(string)$config['activity_view'],
+        'NC_DB_PASSWORD_FILE='.$dbPasswordPath,
+        'STORAGE_CONFIG='.$storagePath,
+        'SOURCE_MODE='.$sourceMode,
+        'QUIET_SECONDS='.(int)($config['quiet_seconds'] ?? 120),
+        'MAX_WAIT_SECONDS='.(int)($config['max_wait_seconds'] ?? 900),
+        'FULL_SYNC_SECONDS='.(int)($config['full_sync_seconds'] ?? 86400),
+        'PIWIGO_SYNC_ENABLED=1',
+      );
+      if ($sourceMode !== 'legacy-view') $lines[] = 'ACCESS_USER='.escapeshellarg($accessUser);
+      if ($sourceMode === 'selected-fileids') $lines[] = 'ROOTS_CONFIG='.$rootsPath;
+      if ($fallbackAvailable)
+      {
+        $lines[] = 'PIWIGO_SYNC_USER='.$credentials['piwigo_user'];
+        $lines[] = 'PIWIGO_SYNC_PASSWORD_FILE='.$piwigoPasswordPath;
+      }
+      file_put_contents($configPath, implode("\n", $lines)."\n", LOCK_EX);
+      chmod($configPath, 0600);
+
+      $config['state_dir'] = $stateDir;
+      $config['status_file'] = $statusFile;
+      $config['runtime'] = array('mode'=>'shared-runner','config'=>$configPath,'reconciled_at'=>date('Y-m-d H:i:s'));
+      $json = json_encode($config, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+      if (!is_string($json)) fail_reconcile('Connector-Konfiguration konnte nicht serialisiert werden.');
+      $now = date('Y-m-d H:i:s');
+      $sql = "UPDATE `{$table}` SET enabled=1,takeover_state='active',config_json='".sql_reconcile($db,$json)."',secret_blob='".sql_reconcile($db,$row['secret_blob'])."',updated='".sql_reconcile($db,$now)."' WHERE id=".$id;
+      if (!$db->query($sql)) fail_reconcile('Runtime-Status konnte nicht gespeichert werden: '.$db->error);
+      if (!$isActive) echo "NC Connector: Verbindung #{$id} ({$row['name']}) automatisch in die gemeinsame Runtime uebernommen.\n";
+    }
+    catch (Throwable $e)
+    {
+      write_runtime_status($piwigoRoot, $id, $stateDir, $e->getMessage());
+      fwrite(STDERR, "NC Connector #{$id}: ".$e->getMessage()."\n");
+    }
+  }
+
+  exit(0);
+}
+catch (Throwable $e)
+{
+  fwrite(STDERR, "NC Connector Reconcile: ".$e->getMessage()."\n");
+  exit(1);
+}

runtime/run-all.sh

@@ -1,22 +1,194 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-CONFIG_DIR="/etc/bratonien-tools/nc-connector"
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+PIWIGO_ROOT_DEFAULT="${BRATONIEN_NC_PIWIGO_ROOT:-$(cd -- "$SCRIPT_DIR/../../.." && pwd)}"
+CONFIG_DIR="${BRATONIEN_NC_CONFIG_DIR:-/etc/bratonien-tools/nc-connector}"
+NATIVE_MODE="${BRATONIEN_NC_NATIVE:-0}"
+TARGET_CONNECTION_ID="${BRATONIEN_NC_CONNECTION_ID:-0}"
+GLOBAL_LOCK_DIR="${PIWIGO_ROOT_DEFAULT%/}/_data/bratonien-tools/nc-connector-scheduler"
+GLOBAL_LOCK_FILE="$GLOBAL_LOCK_DIR/worker.lock"
+mkdir -p -- "$GLOBAL_LOCK_DIR"
+exec 8>"$GLOBAL_LOCK_FILE"
+if ! flock -n 8; then
+    echo "NC Connector: ein Lauf ist bereits aktiv."
+    exit 0
+fi
 shopt -s nullglob
-configs=("$CONFIG_DIR"/connection-*.conf)
 
-if [[ ${#configs[@]} -eq 0 ]]; then
-    echo "Keine aktiven NC-Connector-Verbindungen konfiguriert."
+if [[ ! "$TARGET_CONNECTION_ID" =~ ^[0-9]+$ ]]; then
+    echo "NC Connector: ungültige Ziel-Verbindungs-ID: $TARGET_CONNECTION_ID" >&2
+    exit 1
+fi
+
+read_config_value() {
+    local key="$1"
+    local file="$2"
+    local value
+    value="$(sed -n "s/^${key}=//p" "$file" | tail -n 1)"
+    value="${value%\"}"
+    value="${value#\"}"
+    value="${value%\'}"
+    value="${value#\'}"
+    printf '%s' "$value"
+}
+
+write_route_status() {
+    local route="$1"
+    local label="$2"
+    local detail="$3"
+    local success="$4"
+    [[ -n "${ROUTE_STATUS_FILE:-}" ]] || return 0
+    mkdir -p -- "$(dirname -- "$ROUTE_STATUS_FILE")"
+    php -r '
+      $payload = array(
+        "timestamp" => time(),
+        "route" => (string)$argv[2],
+        "label" => (string)$argv[3],
+        "detail" => (string)$argv[4],
+        "fallback_used" => false,
+        "success" => $argv[5] === "1"
+      );
+      $json = json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);
+      if (!is_string($json) || file_put_contents($argv[1], $json.PHP_EOL, LOCK_EX) === false) exit(1);
+      @chmod($argv[1], 0644);
+    ' "$ROUTE_STATUS_FILE" "$route" "$label" "$detail" "$success"
+}
+
+if [[ "$NATIVE_MODE" != "1" ]]; then
+    php "$SCRIPT_DIR/reconcile.php"
+fi
+php "$SCRIPT_DIR/reconcile-webdav.php"
+php "$SCRIPT_DIR/cleanup-webdav-piwigo.php"
+if [[ "$NATIVE_MODE" != "1" ]]; then
+    php "$SCRIPT_DIR/cleanup-stale.php"
+fi
+
+configs=("$CONFIG_DIR"/connection-*.conf)
+webdav_configs=("$CONFIG_DIR"/webdav-connection-*.conf)
+
+if [[ ${#configs[@]} -eq 0 && ${#webdav_configs[@]} -eq 0 ]]; then
+    echo "Keine NC-Connector-Verbindungen konfiguriert."
     exit 0
 fi
 
-result=0
-for config in "${configs[@]}"; do
-    echo "NC Connector: $(basename "$config")"
-    if ! env PIWIGO_CONFIG="$config" bash "$SCRIPT_DIR/sync.sh"; then
-        result=1
+route_piwigo_root=""
+for candidate in "${webdav_configs[@]}" "${configs[@]}"; do
+    [[ -f "$candidate" ]] || continue
+    candidate_id="$(read_config_value CONNECTION_ID "$candidate")"
+    if [[ "$TARGET_CONNECTION_ID" -gt 0 && "$candidate_id" != "$TARGET_CONNECTION_ID" ]]; then
+        continue
+    fi
+    route_piwigo_root="$(read_config_value PIWIGO_ROOT "$candidate")"
+    [[ -n "$route_piwigo_root" ]] && break
+done
+[[ -n "$route_piwigo_root" ]] || route_piwigo_root="$PIWIGO_ROOT_DEFAULT"
+ROUTE_STATUS_FILE="${route_piwigo_root%/}/_data/bratonien-tools/nc-connector-status/route-status.json"
+
+failure_count=0
+webdav_count=0
+local_count=0
+summary_parts=()
+matched_count=0
+
+for config in "${webdav_configs[@]}"; do
+    [[ -f "$config" ]] || continue
+    name="$(basename "$config")"
+    connection_id="$(read_config_value CONNECTION_ID "$config")"
+    if [[ ! "$connection_id" =~ ^[0-9]+$ ]] || [[ "$connection_id" -lt 1 ]]; then
+        echo "NC Connector: $name besitzt keine gueltige Verbindungs-ID." >&2
+        failure_count=$((failure_count + 1))
+        summary_parts+=("$name: ungueltige Verbindungs-ID")
+        continue
+    fi
+    if [[ "$TARGET_CONNECTION_ID" -gt 0 && "$connection_id" != "$TARGET_CONNECTION_ID" ]]; then
+        continue
+    fi
+
+    matched_count=$((matched_count + 1))
+    webdav_count=$((webdav_count + 1))
+    echo "NC Connector WebDAV #$connection_id: $name"
+    output=""
+    if output="$(env PIWIGO_CONFIG="$config" bash "$SCRIPT_DIR/sync-webdav.sh" 2>&1)"; then
+        [[ -z "$output" ]] || printf '%s\n' "$output"
+        summary_parts+=("WebDAV #$connection_id erfolgreich")
+    else
+        code=$?
+        [[ -z "$output" ]] || printf '%s\n' "$output" >&2
+        failure_count=$((failure_count + 1))
+        summary_parts+=("WebDAV #$connection_id fehlgeschlagen (Exit $code)")
     fi
 done
 
-exit "$result"
+if [[ "$NATIVE_MODE" != "1" ]]; then
+    for config in "${configs[@]}"; do
+        [[ -f "$config" ]] || continue
+        name="$(basename "$config")"
+        connection_id="0"
+        if [[ "$name" =~ ^connection-([0-9]+)\.conf$ ]]; then
+            connection_id="${BASH_REMATCH[1]}"
+        fi
+        if [[ "$connection_id" -lt 1 ]]; then
+            echo "NC Connector: $name besitzt keine gueltige Verbindungs-ID." >&2
+            failure_count=$((failure_count + 1))
+            summary_parts+=("$name: ungueltige Verbindungs-ID")
+            continue
+        fi
+        if [[ "$TARGET_CONNECTION_ID" -gt 0 && "$connection_id" != "$TARGET_CONNECTION_ID" ]]; then
+            continue
+        fi
+
+        matched_count=$((matched_count + 1))
+        piwigo_root="$(read_config_value PIWIGO_ROOT "$config")"
+        [[ -n "$piwigo_root" ]] || piwigo_root="$PIWIGO_ROOT_DEFAULT"
+        tombstone_dir="${piwigo_root%/}/_data/bratonien-tools/nc-connector-status"
+        if [[ -f "$tombstone_dir/deleted-$connection_id" ]]; then
+            echo "NC Connector: Verbindung $connection_id wurde geloescht; Laufzeitdateien werden entfernt."
+            rm -f -- "$CONFIG_DIR/connection-$connection_id.conf" \
+                "$CONFIG_DIR/connection-$connection_id.db-password" \
+                "$CONFIG_DIR/connection-$connection_id.piwigo-password" \
+                "$CONFIG_DIR/connection-$connection_id.storages.tsv" \
+                "$CONFIG_DIR/connection-$connection_id.roots.tsv"
+            rm -f -- "$tombstone_dir/deleted-$connection_id"
+            continue
+        fi
+
+        local_count=$((local_count + 1))
+        echo "NC Connector Local #$connection_id: $name"
+        if env PIWIGO_CONFIG="$config" bash "$SCRIPT_DIR/sync.sh"; then
+            summary_parts+=("Local #$connection_id erfolgreich")
+        else
+            failure_count=$((failure_count + 1))
+            summary_parts+=("Local #$connection_id fehlgeschlagen")
+        fi
+    done
+fi
+
+if [[ "$TARGET_CONNECTION_ID" -gt 0 && "$matched_count" -eq 0 ]]; then
+    write_route_status "failed" "FEHLER - Verbindung #$TARGET_CONNECTION_ID" "Keine Laufzeitkonfiguration für Verbindung #$TARGET_CONNECTION_ID gefunden." "0"
+    echo "NC Connector: keine Laufzeitkonfiguration für Verbindung #$TARGET_CONNECTION_ID gefunden." >&2
+    exit 1
+fi
+
+summary_detail="$(IFS='; '; printf '%s' "${summary_parts[*]}")"
+[[ -n "$summary_detail" ]] || summary_detail="Keine Verbindung wurde ausgefuehrt."
+
+if [[ "$failure_count" -eq 0 ]]; then
+    if [[ "$webdav_count" -gt 0 && "$local_count" -gt 0 ]]; then
+        route="mixed"
+        label="WebDAV + Local"
+    elif [[ "$webdav_count" -gt 0 ]]; then
+        route="webdav"
+        label="WebDAV"
+    else
+        route="local"
+        label="Local"
+    fi
+    write_route_status "$route" "$label" "$summary_detail" "1"
+    echo "NC Connector: angeforderte Verbindung wurde erfolgreich verarbeitet."
+    exit 0
+fi
+
+write_route_status "failed" "FEHLER - angeforderte Verbindung" "$summary_detail" "0"
+echo "NC Connector: die angeforderte Verbindung ist fehlgeschlagen." >&2
+exit 1

runtime/sync-webdav.sh

@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+CONFIG_FILE="${PIWIGO_CONFIG:-}"
+[[ -n "$CONFIG_FILE" && -r "$CONFIG_FILE" ]] || { echo "WebDAV-Konfiguration fehlt: ${CONFIG_FILE:-<leer>}" >&2; exit 1; }
+
+# shellcheck source=/dev/null
+source "$CONFIG_FILE"
+
+: "${PIWIGO_ROOT:?PIWIGO_ROOT fehlt}"
+: "${CONNECTION_ID:?CONNECTION_ID fehlt}"
+: "${WEBDAV_BASE_URL:?WEBDAV_BASE_URL fehlt}"
+: "${WEBDAV_USER:?WEBDAV_USER fehlt}"
+: "${WEBDAV_PASSWORD_FILE:?WEBDAV_PASSWORD_FILE fehlt}"
+: "${WEBDAV_ROOTS_FILE:?WEBDAV_ROOTS_FILE fehlt}"
+: "${WEBDAV_SOURCE_DIR:?WEBDAV_SOURCE_DIR fehlt}"
+: "${WEBDAV_MAPPING_FILE:?WEBDAV_MAPPING_FILE fehlt}"
+: "${MANIFEST:?MANIFEST fehlt}"
+: "${SHADOW_MAP_FILE:?SHADOW_MAP_FILE fehlt}"
+: "${GALLERY_ROOT:?GALLERY_ROOT fehlt}"
+: "${STATE_DIR:?STATE_DIR fehlt}"
+: "${STATUS_FILE:?STATUS_FILE fehlt}"
+
+[[ "${SOURCE_MODE:-}" == "webdav-placeholder" ]] || { echo "Falscher SOURCE_MODE: ${SOURCE_MODE:-<leer>}" >&2; exit 1; }
+[[ -r "$WEBDAV_PASSWORD_FILE" ]] || { echo "Nextcloud-Passwortdatei fehlt." >&2; exit 1; }
+[[ -r "$WEBDAV_ROOTS_FILE" ]] || { echo "WebDAV-Wurzeln fehlen." >&2; exit 1; }
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+LOCK_FILE="$STATE_DIR/webdav-sync.lock"
+mkdir -p -- "$STATE_DIR"
+exec 9>"$LOCK_FILE"
+flock -n 9 || exit 0
+
+write_status() {
+    local state="$1" message="$2" detail="${3:-}" auth_mode="${4:-webdav}" api_state="${5:-not_run}" api_message="${6:-}" fallback_state="${7:-not_run}" fallback_message="${8:-}"
+    python3 - "$STATUS_FILE" "$PIWIGO_ROOT" "$CONNECTION_ID" "$state" "$message" "$detail" "$auth_mode" "$api_state" "$api_message" "$fallback_state" "$fallback_message" <<'PY'
+import json, os, sys, tempfile, time
+(status_file, piwigo_root, connection_id, state, message, detail, auth_mode,
+ api_state, api_message, fallback_state, fallback_message) = sys.argv[1:]
+payload = {
+    "state": state,
+    "message": message,
+    "timestamp": int(time.time()),
+    "auth_mode": auth_mode,
+    "api": {"state": api_state, "message": api_message},
+    "fallback": {"state": fallback_state, "message": fallback_message},
+    "error_detail": detail if state == "error" else "",
+}
+public_file = os.path.join(piwigo_root.rstrip('/'), '_data', 'bratonien-tools', 'nc-connector-status', f'connection-{connection_id}.json')
+for target in (status_file, public_file):
+    directory = os.path.dirname(target)
+    os.makedirs(directory, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(dir=directory)
+    with os.fdopen(fd, 'w', encoding='utf-8') as handle:
+        json.dump(payload, handle, ensure_ascii=False)
+        handle.write('\n')
+    os.chmod(temporary, 0o644)
+    os.replace(temporary, target)
+PY
+}
+
+failure() {
+    local code="$1" command="$2" line="$3"
+    trap - ERR
+    write_status error "WebDAV-Shadow-Tree fehlgeschlagen" "Exit-Code: $code; Zeile: $line; Befehl: $command"
+    exit "$code"
+}
+trap 'failure $? "$BASH_COMMAND" "$LINENO"' ERR
+
+ROOT_ARGS=()
+while IFS=$'\t' read -r path display_name; do
+    [[ -z "$path" || "$path" == \#* ]] && continue
+    ROOT_ARGS+=(--root "$path")
+done < "$WEBDAV_ROOTS_FILE"
+
+[[ ${#ROOT_ARGS[@]} -gt 0 ]] || { write_status error "Keine WebDAV-Wurzeln konfiguriert"; exit 1; }
+
+WEBDAV_CONNECT_IP="$(php "$SCRIPT_DIR/lib/resolve-nextcloud-target.php" "$WEBDAV_BASE_URL")"
+[[ -n "$WEBDAV_CONNECT_IP" ]] || { write_status error "Nextcloud-Zieladresse konnte nicht ermittelt werden"; exit 1; }
+
+python3 "$SCRIPT_DIR/lib/build_webdav_placeholder_source.py" \
+    --base-url "$WEBDAV_BASE_URL" \
+    --connect-ip "$WEBDAV_CONNECT_IP" \
+    --user "$WEBDAV_USER" \
+    --password-file "$WEBDAV_PASSWORD_FILE" \
+    "${ROOT_ARGS[@]}" \
+    --source-dir "$WEBDAV_SOURCE_DIR" \
+    --manifest "$MANIFEST" \
+    --mapping "$WEBDAV_MAPPING_FILE"
+
+python3 "$SCRIPT_DIR/lib/shadow_tree.py" \
+    --manifest "$MANIFEST" \
+    --destination "$GALLERY_ROOT" \
+    --state "$SHADOW_MAP_FILE"
+
+trap - ERR
+
+if [[ "${PIWIGO_SYNC_ENABLED:-0}" == "1" ]]; then
+    PIWIGO_OUTPUT=""
+    PIWIGO_EXIT=0
+    if PIWIGO_OUTPUT="$(php "$SCRIPT_DIR/lib/piwigo-sync.php" \
+        --piwigo-root="$PIWIGO_ROOT" \
+        --connection-id="$CONNECTION_ID" \
+        --base-url="http://127.0.0.1" 2>&1)"; then
+        PIWIGO_EXIT=0
+    else
+        PIWIGO_EXIT=$?
+    fi
+    [[ -z "$PIWIGO_OUTPUT" ]] || printf '%s\n' "$PIWIGO_OUTPUT"
+
+    if [[ "$PIWIGO_EXIT" -ne 0 ]]; then
+        DETAIL="Exit-Code: $PIWIGO_EXIT"
+        if [[ -n "$PIWIGO_OUTPUT" ]]; then
+            DETAIL+="; Ausgabe: $(printf '%s\n' "$PIWIGO_OUTPUT" | tail -n 12 | tr '\n' ' ' | sed 's/[[:space:]]\+/ /g; s/^[[:space:]]//; s/[[:space:]]$//')"
+        fi
+
+        if grep -qi 'Invalid username/password' <<<"$PIWIGO_OUTPUT"; then
+            write_status error \
+                "Piwigo-Fallback fehlgeschlagen: Benutzername oder Passwort ist ungültig" \
+                "$DETAIL" \
+                "fallback" \
+                "not_configured" \
+                "Für diese Verbindung ist keine nutzbare API konfiguriert" \
+                "error" \
+                "Piwigo hat Benutzername oder Passwort des Fallback-Zugangs abgelehnt"
+        elif grep -qi 'Kein gespeicherter Benutzername/Passwort-Fallback\|Kein verbindungseigener Piwigo-Zugang' <<<"$PIWIGO_OUTPUT"; then
+            write_status error \
+                "Piwigo-Zugang fehlt: API und Fallback sind nicht nutzbar" \
+                "$DETAIL" \
+                "failed" \
+                "not_configured" \
+                "Für diese Verbindung ist keine nutzbare API konfiguriert" \
+                "not_configured" \
+                "Kein vollständiger Fallback-Zugang gespeichert"
+        else
+            write_status error "Piwigo-Synchronisierung des WebDAV-Shadow-Trees fehlgeschlagen" "$DETAIL"
+        fi
+        exit "$PIWIGO_EXIT"
+    fi
+
+    if [[ "${BRATONIEN_NC_NATIVE:-0}" == "1" ]]; then
+        if command -v timeout >/dev/null 2>&1; then
+            if ! timeout 30m env PIWIGO_CONFIG="$CONFIG_FILE" bash "$SCRIPT_DIR/build-webdav-media.sh"; then
+                write_status error "Bildaufbereitung ist fehlgeschlagen oder hat das 30-Minuten-Limit erreicht"
+                exit 1
+            fi
+        elif ! env PIWIGO_CONFIG="$CONFIG_FILE" bash "$SCRIPT_DIR/build-webdav-media.sh"; then
+            write_status error "Bildaufbereitung ist fehlgeschlagen"
+            exit 1
+        fi
+    else
+        MEDIA_UNIT="bratonien-nc-media-${CONNECTION_ID}-$(date +%s)"
+        if ! systemd-run \
+            --quiet \
+            --collect \
+            --unit="$MEDIA_UNIT" \
+            --property=RuntimeMaxSec=30min \
+            --setenv="PIWIGO_CONFIG=$CONFIG_FILE" \
+            /usr/bin/env bash "$SCRIPT_DIR/build-webdav-media.sh"; then
+            write_status error "Bildaufbereitung konnte nicht im Hintergrund gestartet werden"
+            exit 1
+        fi
+    fi
+
+    if grep -q 'Piwigo-Synchronisierung per API erfolgreich' <<<"$PIWIGO_OUTPUT"; then
+        write_status ok \
+            "WebDAV eingelesen und Piwigo synchronisiert; Bildaufbereitung abgeschlossen" \
+            "" \
+            "api" \
+            "ok" \
+            "Piwigo-API erfolgreich" \
+            "not_needed" \
+            "Fallback wurde nicht benötigt"
+    elif grep -q 'Piwigo-Datenbanksynchronisierung per Benutzername/Passwort-Fallback erfolgreich' <<<"$PIWIGO_OUTPUT"; then
+        write_status ok \
+            "WebDAV eingelesen und Piwigo über Fallback synchronisiert; Bildaufbereitung abgeschlossen" \
+            "" \
+            "fallback" \
+            "not_used" \
+            "API war nicht nutzbar" \
+            "ok" \
+            "Benutzername/Passwort-Fallback erfolgreich"
+    else
+        write_status ok "WebDAV eingelesen und Piwigo synchronisiert; Bildaufbereitung abgeschlossen"
+    fi
+else
+    write_status ok "WebDAV eingelesen; Piwigo-Synchronisierung ist für diese Verbindung deaktiviert"
+fi

runtime/sync.sh

@@ -5,12 +5,27 @@ CONFIG_FILE="${PIWIGO_CONFIG:-/etc/bratonien-tools/nc-connector/connection-1.con
 [[ -r "$CONFIG_FILE" ]] || { echo "Konfiguration fehlt: $CONFIG_FILE" >&2; exit 1; }
 
 PIWIGO_SYNC_OVERRIDE_VALUE="${PIWIGO_SYNC_OVERRIDE-}"
-
 # shellcheck source=/dev/null
 source "$CONFIG_FILE"
 
-NC_ACTIVITY_VIEW="${NC_ACTIVITY_VIEW:-piwigo_showcase_activity}"
-NC_DB_VIEW="${NC_DB_VIEW:-piwigo_showcase_sources}"
+: "${NC_ACTIVITY_VIEW:?NC_ACTIVITY_VIEW fehlt}"
+: "${NC_DB_VIEW:?NC_DB_VIEW fehlt}"
+SOURCE_MODE="${SOURCE_MODE:-legacy-view}"
+ACCESS_USER="${ACCESS_USER:-}"
+ROOTS_CONFIG="${ROOTS_CONFIG:-}"
+
+case "$SOURCE_MODE" in
+    legacy-view|user-shares|selected-fileids) ;;
+    *) echo "Unbekannter SOURCE_MODE: $SOURCE_MODE" >&2; exit 1 ;;
+esac
+if [[ "$SOURCE_MODE" != "legacy-view" && -z "$ACCESS_USER" ]]; then
+    echo "ACCESS_USER fehlt fuer die verbindungsbezogene Datenquelle." >&2
+    exit 1
+fi
+if [[ "$SOURCE_MODE" == "selected-fileids" && ( -z "$ROOTS_CONFIG" || ! -r "$ROOTS_CONFIG" ) ]]; then
+    echo "ROOTS_CONFIG fehlt fuer die ausgewaehlten Nextcloud-Quellen." >&2
+    exit 1
+fi
 
 if [[ -n "$PIWIGO_SYNC_OVERRIDE_VALUE" ]]; then
     case "$PIWIGO_SYNC_OVERRIDE_VALUE" in
@@ -37,46 +52,101 @@ if [[ -z "$CONNECTION_ID" ]]; then
     fi
 fi
 
+PUBLIC_STATUS_DIR="${PIWIGO_ROOT%/}/_data/bratonien-tools/nc-connector-status"
+PUBLIC_STATUS_FILE="$PUBLIC_STATUS_DIR/connection-$CONNECTION_ID.json"
+install -d -m 0755 "${PIWIGO_ROOT%/}/_data/bratonien-tools" "$PUBLIC_STATUS_DIR"
+
 exec 9>"$LOCK_FILE"
 flock -n 9 || exit 0
 
+AUTH_MODE=""
+API_STATE="not_run"
+API_MESSAGE=""
+FALLBACK_STATE="not_run"
+FALLBACK_MESSAGE=""
+ERROR_DETAIL=""
+ERROR_STAGE="Vorbereitung"
+ERROR_MESSAGE="Synchronisierung fehlgeschlagen"
+
+compact_output() {
+    tail -n 8 | tr '\n' ' ' | sed 's/[[:space:]]\+/ /g; s/^[[:space:]]//; s/[[:space:]]$//'
+}
+
 write_status() {
     local state="$1" message="$2"
-    python3 - "$STATUS_FILE" "$state" "$message" <<'PY'
+    local error_detail="$ERROR_DETAIL"
+    [[ "$state" == "error" ]] || error_detail=""
+    python3 - "$STATUS_FILE" "$PUBLIC_STATUS_FILE" "$state" "$message" "$AUTH_MODE" "$API_STATE" "$API_MESSAGE" "$FALLBACK_STATE" "$FALLBACK_MESSAGE" "$error_detail" <<'PY'
 import json, os, sys, tempfile, time
-path, state, message = sys.argv[1:]
-os.makedirs(os.path.dirname(path), exist_ok=True)
-payload = {"state": state, "message": message, "timestamp": int(time.time())}
-fd, temporary = tempfile.mkstemp(dir=os.path.dirname(path))
-with os.fdopen(fd, "w", encoding="utf-8") as handle:
-    json.dump(payload, handle, ensure_ascii=False)
-    handle.write("\n")
-os.chmod(temporary, 0o644)
-os.replace(temporary, path)
+(path, public_path, state, message, auth_mode, api_state, api_message,
+ fallback_state, fallback_message, error_detail) = sys.argv[1:]
+payload = {
+    "state": state,
+    "message": message,
+    "timestamp": int(time.time()),
+    "auth_mode": auth_mode,
+    "api": {"state": api_state, "message": api_message},
+    "fallback": {"state": fallback_state, "message": fallback_message},
+    "error_detail": error_detail,
+}
+
+def write_json(target):
+    os.makedirs(os.path.dirname(target), exist_ok=True)
+    fd, temporary = tempfile.mkstemp(dir=os.path.dirname(target))
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        json.dump(payload, handle, ensure_ascii=False)
+        handle.write("\n")
+    os.chmod(temporary, 0o644)
+    os.replace(temporary, target)
+
+write_json(path)
+write_json(public_path)
 PY
 }
 
 failure() {
-    write_status error "Synchronisierung fehlgeschlagen; bestehende Galerie blieb unverändert"
+    local exit_code="${1:-1}"
+    local failed_command="${2:-unbekannt}"
+    local failed_line="${3:-?}"
+    trap - ERR
+    if [[ -z "$ERROR_DETAIL" ]]; then
+        ERROR_DETAIL="Schritt: $ERROR_STAGE. Exit-Code: $exit_code. Zeile: $failed_line. Fehlgeschlagener Befehl: $failed_command"
+    fi
+    write_status error "$ERROR_MESSAGE"
+    exit "$exit_code"
 }
-trap failure ERR
+trap 'failure $? "$BASH_COMMAND" "$LINENO"' ERR
 
+run_stage() {
+    local stage="$1" message="$2"
+    shift 2
+    local output="" exit_code=0
+    ERROR_STAGE="$stage"
+    ERROR_MESSAGE="$message"
+    if output="$("$@" 2>&1)"; then exit_code=0; else exit_code=$?; fi
+    [[ -z "$output" ]] || printf '%s\n' "$output"
+    if [[ "$exit_code" -ne 0 ]]; then
+        ERROR_DETAIL="Schritt: $stage. Exit-Code: $exit_code."
+        [[ -z "$output" ]] || ERROR_DETAIL+=" Ausgabe: $(printf '%s\n' "$output" | compact_output)"
+        trap - ERR
+        write_status error "$message"
+        exit "$exit_code"
+    fi
+}
+
+ERROR_STAGE="Lokalen Zustand prüfen"
+ERROR_MESSAGE="Lokaler Connector-Zustand konnte nicht geprüft werden"
 NEEDS_LOCAL_REPAIR=0
 if [[ ! -s "$MAP_FILE" ]]; then
     NEEDS_LOCAL_REPAIR=1
 else
     set +e
     python3 - "$MAP_FILE" "$GALLERY_ROOT" <<'PY'
-import json
-import sys
+import json, sys
 from pathlib import Path
-
 mapping = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
 gallery = Path(sys.argv[2])
-roots = [
-    target for source, target in mapping.items()
-    if source.startswith("share:") and "/" not in source
-]
+roots = [target for source, target in mapping.items() if source.startswith("share:") and "/" not in source]
 raise SystemExit(0 if roots and all((gallery / target).is_dir() for target in roots) else 1)
 PY
     ROOTS_INTACT=$?
@@ -92,46 +162,109 @@ if [[ "$NEEDS_LOCAL_REPAIR" == "0" && "${PIWIGO_SYNC_ENABLED:-0}" == "1" ]]; the
     [[ "$PIWIGO_ALBUMS_INTACT" == "0" ]] || NEEDS_LOCAL_REPAIR=1
 fi
 
+GATE_ARGS=(
+    --state "$ACTIVITY_STATE" --host "$NC_DB_HOST" --port "$NC_DB_PORT"
+    --database "$NC_DB_NAME" --user "$NC_DB_USER" --password-file "$NC_DB_PASSWORD_FILE"
+    --view "$NC_ACTIVITY_VIEW" --source-view "$NC_DB_VIEW"
+    --quiet "$QUIET_SECONDS" --max-wait "$MAX_WAIT_SECONDS" --full-after "$FULL_SYNC_SECONDS"
+)
+if [[ "$SOURCE_MODE" != "legacy-view" ]]; then GATE_ARGS+=(--access-user "$ACCESS_USER"); fi
+if [[ "$SOURCE_MODE" == "selected-fileids" ]]; then GATE_ARGS+=(--roots-config "$ROOTS_CONFIG"); fi
+
 if [[ "$NEEDS_LOCAL_REPAIR" == "1" ]]; then
     GATE_RESULT=0
 else
-    if python3 "$SCRIPT_DIR/lib/activity_gate.py" check \
-        --state "$ACTIVITY_STATE" --host "$NC_DB_HOST" --port "$NC_DB_PORT" \
-        --database "$NC_DB_NAME" --user "$NC_DB_USER" --password-file "$NC_DB_PASSWORD_FILE" \
-        --view "$NC_ACTIVITY_VIEW" --source-view "$NC_DB_VIEW" \
-        --quiet "$QUIET_SECONDS" --max-wait "$MAX_WAIT_SECONDS" --full-after "$FULL_SYNC_SECONDS"; then
-        GATE_RESULT=0
-    else
-        GATE_RESULT=$?
-    fi
+    ERROR_STAGE="Nextcloud-Aktivitaet pruefen"
+    ERROR_MESSAGE="Nextcloud-Aktivitaet konnte nicht geprueft werden"
+    if GATE_OUTPUT="$(python3 "$SCRIPT_DIR/lib/activity_gate.py" check "${GATE_ARGS[@]}" 2>&1)"; then GATE_RESULT=0; else GATE_RESULT=$?; fi
+    [[ -z "$GATE_OUTPUT" ]] || printf '%s\n' "$GATE_OUTPUT"
 fi
 
 if [[ "$GATE_RESULT" == "3" ]]; then
     trap - ERR
-    write_status ok "Keine Änderungen gefunden"
+    write_status ok "Keine Aenderungen gefunden"
     exit 0
 fi
-[[ "$GATE_RESULT" == "0" ]] || exit "$GATE_RESULT"
-
-python3 "$SCRIPT_DIR/lib/build_manifest.py" \
-    --host "$NC_DB_HOST" --port "$NC_DB_PORT" --database "$NC_DB_NAME" --user "$NC_DB_USER" \
-    --password-file "$NC_DB_PASSWORD_FILE" --view "$NC_DB_VIEW" \
-    --storage-config "$STORAGE_CONFIG" --output "$MANIFEST"
-
-python3 "$SCRIPT_DIR/lib/shadow_tree.py" \
-    --manifest "$MANIFEST" --destination "$GALLERY_ROOT" --state "$MAP_FILE"
-
-if [[ "${PIWIGO_SYNC_ENABLED:-0}" == "1" ]]; then
-    php "$SCRIPT_DIR/lib/piwigo-sync.php" \
-        --piwigo-root="$PIWIGO_ROOT" \
-        --connection-id="$CONNECTION_ID" \
-        --base-url="http://127.0.0.1"
+if [[ "$GATE_RESULT" != "0" ]]; then
+    ERROR_DETAIL="Schritt: Nextcloud-Aktivitaet pruefen. Exit-Code: $GATE_RESULT."
+    [[ -z "${GATE_OUTPUT:-}" ]] || ERROR_DETAIL+=" Ausgabe: $(printf '%s\n' "$GATE_OUTPUT" | compact_output)"
+    trap - ERR
+    write_status error "Nextcloud-Aktivitaet konnte nicht geprueft werden"
+    exit "$GATE_RESULT"
 fi
 
-python3 "$SCRIPT_DIR/lib/activity_gate.py" commit \
-    --state "$ACTIVITY_STATE" --host "$NC_DB_HOST" --port "$NC_DB_PORT" \
-    --database "$NC_DB_NAME" --user "$NC_DB_USER" --password-file "$NC_DB_PASSWORD_FILE" \
+if [[ "$SOURCE_MODE" == "selected-fileids" ]]; then
+    run_stage "Ausgewaehlte Nextcloud-Quellen aufloesen" "Ausgewaehlte Nextcloud-Quellen konnten nicht aufgeloest werden" \
+        python3 "$SCRIPT_DIR/lib/build_selected_manifest.py" \
+        --host "$NC_DB_HOST" --port "$NC_DB_PORT" --database "$NC_DB_NAME" --user "$NC_DB_USER" \
+        --password-file "$NC_DB_PASSWORD_FILE" --view "$NC_DB_VIEW" \
+        --storage-config "$STORAGE_CONFIG" --roots-config "$ROOTS_CONFIG" --output "$MANIFEST"
+else
+    MANIFEST_ARGS=(
+        --host "$NC_DB_HOST" --port "$NC_DB_PORT" --database "$NC_DB_NAME" --user "$NC_DB_USER"
+        --password-file "$NC_DB_PASSWORD_FILE" --view "$NC_DB_VIEW"
+        --storage-config "$STORAGE_CONFIG" --output "$MANIFEST"
+    )
+    if [[ "$SOURCE_MODE" == "user-shares" ]]; then MANIFEST_ARGS+=(--access-user "$ACCESS_USER"); fi
+    run_stage "Nextcloud-Dateiliste lesen" "Dateiliste aus Nextcloud konnte nicht erstellt werden" \
+        python3 "$SCRIPT_DIR/lib/build_manifest.py" "${MANIFEST_ARGS[@]}"
+fi
+
+run_stage "Lokalen Galeriebaum aktualisieren" "Lokaler Galeriebaum konnte nicht aktualisiert werden" \
+    python3 "$SCRIPT_DIR/lib/shadow_tree.py" --manifest "$MANIFEST" --destination "$GALLERY_ROOT" --state "$MAP_FILE"
+
+if [[ "${PIWIGO_SYNC_ENABLED:-0}" == "1" ]]; then
+    ERROR_STAGE="Piwigo synchronisieren"
+    ERROR_MESSAGE="Piwigo-Synchronisierung fehlgeschlagen"
+    if PIWIGO_OUTPUT="$(php "$SCRIPT_DIR/lib/piwigo-sync.php" --piwigo-root="$PIWIGO_ROOT" --connection-id="$CONNECTION_ID" --base-url="http://127.0.0.1" 2>&1)"; then PIWIGO_EXIT=0; else PIWIGO_EXIT=$?; fi
+    printf '%s\n' "$PIWIGO_OUTPUT"
+
+    if grep -q 'Piwigo-Synchronisierung per API erfolgreich' <<<"$PIWIGO_OUTPUT"; then
+        AUTH_MODE="api"; API_STATE="ok"; API_MESSAGE="API-Synchronisierung erfolgreich"
+        FALLBACK_STATE="not_needed"; FALLBACK_MESSAGE="Fallback wurde nicht benoetigt"
+    else
+        API_LINE="$(grep -m1 '^Piwigo-API nicht nutzbar:' <<<"$PIWIGO_OUTPUT" || true)"
+        API_STATE="error"
+        if [[ -n "$API_LINE" ]]; then API_MESSAGE="${API_LINE#Piwigo-API nicht nutzbar: }"; else API_MESSAGE="API-Synchronisierung war nicht erfolgreich"; fi
+        if grep -q 'Piwigo-Datenbanksynchronisierung per Benutzername/Passwort-Fallback erfolgreich' <<<"$PIWIGO_OUTPUT"; then
+            AUTH_MODE="fallback"; FALLBACK_STATE="ok"; FALLBACK_MESSAGE="Benutzername/Passwort-Fallback erfolgreich"
+        elif [[ "$PIWIGO_EXIT" -ne 0 ]]; then
+            AUTH_MODE="failed"; FALLBACK_STATE="error"; FALLBACK_MESSAGE="$(tail -n 1 <<<"$PIWIGO_OUTPUT")"
+        fi
+    fi
+    if [[ "$PIWIGO_EXIT" -ne 0 ]]; then
+        ERROR_DETAIL="Schritt: Piwigo synchronisieren. Exit-Code: $PIWIGO_EXIT. Ausgabe: $(printf '%s\n' "$PIWIGO_OUTPUT" | compact_output)"
+        trap - ERR
+        write_status error "Piwigo-Synchronisierung fehlgeschlagen"
+        exit "$PIWIGO_EXIT"
+    fi
+fi
+
+COMMIT_ARGS=(
+    --state "$ACTIVITY_STATE" --host "$NC_DB_HOST" --port "$NC_DB_PORT"
+    --database "$NC_DB_NAME" --user "$NC_DB_USER" --password-file "$NC_DB_PASSWORD_FILE"
     --view "$NC_ACTIVITY_VIEW" --source-view "$NC_DB_VIEW"
+)
+if [[ "$SOURCE_MODE" != "legacy-view" ]]; then COMMIT_ARGS+=(--access-user "$ACCESS_USER"); fi
+if [[ "$SOURCE_MODE" == "selected-fileids" ]]; then COMMIT_ARGS+=(--roots-config "$ROOTS_CONFIG"); fi
+
+ERROR_STAGE="Aktivitaetsstand speichern"
+ERROR_MESSAGE="Aktivitaetsstand konnte nicht gespeichert werden"
+if COMMIT_OUTPUT="$(python3 "$SCRIPT_DIR/lib/activity_gate.py" commit "${COMMIT_ARGS[@]}" 2>&1)"; then COMMIT_EXIT=0; else COMMIT_EXIT=$?; fi
+[[ -z "$COMMIT_OUTPUT" ]] || printf '%s\n' "$COMMIT_OUTPUT"
+if [[ "$COMMIT_EXIT" -ne 0 ]]; then
+    ERROR_DETAIL="Schritt: Aktivitaetsstand speichern. Exit-Code: $COMMIT_EXIT."
+    [[ -z "$COMMIT_OUTPUT" ]] || ERROR_DETAIL+=" Ausgabe: $(printf '%s\n' "$COMMIT_OUTPUT" | compact_output)"
+    trap - ERR
+    write_status error "Aktivitaetsstand konnte nicht gespeichert werden"
+    exit "$COMMIT_EXIT"
+fi
 
 trap - ERR
-write_status ok "Synchronisierung erfolgreich"
+if [[ "$AUTH_MODE" == "fallback" ]]; then
+    write_status warning "Synchronisierung erfolgreich ueber Fallback; API war nicht nutzbar"
+elif [[ "$AUTH_MODE" == "api" ]]; then
+    write_status ok "Synchronisierung erfolgreich ueber API"
+else
+    write_status ok "Synchronisierung erfolgreich"
+fi

template/admin_tabs.tpl

@@ -9,11 +9,15 @@
 .bratonien-tab-panel { width:100%; max-width:none; margin-left:0 !important; margin-right:0 !important; }
 .bratonien-tab-panel[hidden] { display:none !important; }
 .bratonien-card { margin-left:0; margin-right:0; }
-@media (max-width:760px) { .bratonien-tabs{gap:5px}.bratonien-tab{border-bottom:1px solid rgba(255,255,255,.16);border-radius:4px;margin-bottom:0;padding:9px 11px} }
+.bratonien-edit-dialog { width:min(920px,calc(100vw - 3rem)); max-height:88vh; overflow:auto; background:#444; color:inherit; border:1px solid #777; border-radius:4px; padding:0; box-shadow:0 18px 60px rgba(0,0,0,.55); }
+.bratonien-edit-dialog::backdrop { background:rgba(0,0,0,.55); }
+.bratonien-edit-dialog__body { padding:1.25rem 1.5rem; }
+.bratonien-storage-row { display:grid; grid-template-columns:minmax(120px,.7fr) minmax(150px,1fr) minmax(240px,1.5fr) auto; gap:.5rem; align-items:end; margin:.5rem 0; }
+.bratonien-storage-row label { display:flex; flex-direction:column; gap:.25rem; }
+.bratonien-storage-row input { width:100%; box-sizing:border-box; }
+@media (max-width:760px) { .bratonien-tabs{gap:5px}.bratonien-tab{border-bottom:1px solid rgba(255,255,255,.16);border-radius:4px;margin-bottom:0;padding:9px 11px}.bratonien-storage-row{grid-template-columns:1fr} }
 </style>
-
 <div id="bratonien-tabs-anchor"></div>
-
 <script>
 (function () {
   'use strict';
@@ -27,69 +31,239 @@
       { id:'wartung', label:'Wartung / Cache' },
       { id:'system', label:'System & Updates' }
     ];
-    var panels = [];
-    definitions.forEach(function (d) {
-      var ids=d.sections||[d.id], elements=[];
+    var panels=[];
+    definitions.forEach(function(d){
+      var ids=d.sections||[d.id],elements=[];
       ids.forEach(function(id){var el=document.getElementById(id);if(el){el.classList.add('bratonien-tab-panel');elements.push(el);}});
-      if (!elements.length) return;
-      panels.push({definition:d,elements:elements});
-    });
-    if (!panels.length) return;
-
-    var anchor = document.getElementById('bratonien-tabs-anchor');
-    if (!anchor) return;
-    var tabs = document.createElement('div');
-    tabs.className = 'bratonien-tabs';
-    tabs.setAttribute('role','tablist');
-    tabs.setAttribute('aria-label','Bratonien Tools Bereiche');
-
-    panels.forEach(function (item) {
-      var b = document.createElement('button');
-      b.type='button';
-      b.className='bratonien-tab';
-      b.id='bratonien-tab-'+item.definition.id;
-      b.dataset.tab=item.definition.id;
-      b.setAttribute('role','tab');
-      b.textContent=item.definition.label;
-      tabs.appendChild(b);
-      item.elements.forEach(function(el){el.setAttribute('role','tabpanel');el.setAttribute('aria-labelledby',b.id);});
+      if(elements.length)panels.push({definition:d,elements:elements});
     });
+    if(!panels.length)return;
+    var anchor=document.getElementById('bratonien-tabs-anchor');if(!anchor)return;
+    var tabs=document.createElement('div');tabs.className='bratonien-tabs';tabs.setAttribute('role','tablist');tabs.setAttribute('aria-label','Bratonien Tools Bereiche');
+    panels.forEach(function(item){var b=document.createElement('button');b.type='button';b.className='bratonien-tab';b.id='bratonien-tab-'+item.definition.id;b.dataset.tab=item.definition.id;b.setAttribute('role','tab');b.textContent=item.definition.label;tabs.appendChild(b);item.elements.forEach(function(el){el.setAttribute('role','tabpanel');el.setAttribute('aria-labelledby',b.id);});});
     anchor.replaceWith(tabs);
+    function activate(id,remember){var valid=false;panels.forEach(function(item){var active=item.definition.id===id;item.elements.forEach(function(el){el.hidden=!active;});var b=tabs.querySelector('[data-tab="'+item.definition.id+'"]');if(b){b.classList.toggle('is-active',active);b.setAttribute('aria-selected',active?'true':'false');b.tabIndex=active?0:-1;}if(active)valid=true;});if(!valid)return activate(panels[0].definition.id,remember);if(remember!==false){try{localStorage.setItem('bratonien-tools-active-tab',id);}catch(e){}}}
+    tabs.addEventListener('click',function(e){var b=e.target.closest('.bratonien-tab');if(b)activate(b.dataset.tab);});
+    tabs.addEventListener('keydown',function(e){if(e.key!=='ArrowLeft'&&e.key!=='ArrowRight')return;var buttons=[].slice.call(tabs.querySelectorAll('.bratonien-tab'));var i=buttons.indexOf(document.activeElement);if(i<0)return;e.preventDefault();i+=e.key==='ArrowRight'?1:-1;if(i>=buttons.length)i=0;if(i<0)i=buttons.length-1;buttons[i].focus();activate(buttons[i].dataset.tab);});
+    var initial='',hash=location.hash?location.hash.slice(1):'';panels.forEach(function(item){if(item.definition.id===hash||(item.definition.sections||[]).indexOf(hash)!==-1)initial=item.definition.id;});if(!initial){try{initial=localStorage.getItem('bratonien-tools-active-tab')||'';}catch(e){}}if(!panels.some(function(i){return i.definition.id===initial;}))initial=panels[0].definition.id;activate(initial,false);
+  }
 
-    function activate(id, remember) {
-      var valid=false;
-      panels.forEach(function (item) {
-        var active=item.definition.id===id;
-        item.elements.forEach(function(el){el.hidden=!active;});
-        var b=tabs.querySelector('[data-tab="'+item.definition.id+'"]');
-        if (b) {
-          b.classList.toggle('is-active',active);
-          b.setAttribute('aria-selected',active?'true':'false');
-          b.tabIndex=active?0:-1;
-        }
-        if (active) valid=true;
-      });
-      if (!valid) return activate(panels[0].definition.id,remember);
-      if (remember!==false) { try { localStorage.setItem('bratonien-tools-active-tab',id); } catch(e) {} }
+  function initNCWizardLifecycle(){
+    var section=document.getElementById('nc-connector');if(!section)return;
+    var dialog=document.getElementById('bratonien-nc-wizard-dialog');
+    var openButton=document.getElementById('bratonien-nc-wizard-open');
+    var closeButton=document.getElementById('bratonien-nc-wizard-close');
+    var storageKey='bratonienNcWizardOpen';
+    var modeKey='bratonienNcWizardMode';
+    var resetBusy=false;
+
+    function token(){var input=section.querySelector('input[name="pwg_token"]');return input?input.value:'';}
+    function setOpen(value){try{if(value)sessionStorage.setItem(storageKey,'1');else sessionStorage.removeItem(storageKey);}catch(e){}}
+    function mode(){try{return sessionStorage.getItem(modeKey)||'';}catch(e){return '';}}
+    function clearMode(){try{sessionStorage.removeItem(modeKey);}catch(e){}}
+    function applyMode(){
+      if(!dialog)return;
+      var current=mode();
+      var heading=dialog.querySelector('h4');
+      var finish=dialog.querySelector('button[value="nc_connector_wizard_finish"]');
+      if(current==='edit'){
+        if(heading)heading.textContent='Verbindung bearbeiten';
+        if(finish)finish.textContent='Änderungen speichern';
+      }else if(current==='migrate'){
+        if(heading)heading.textContent='Auf WebDAV migrieren';
+        if(finish)finish.textContent='Migration starten';
+      }else{
+        if(heading)heading.textContent='Neue Verbindung';
+        if(finish)finish.textContent='Verbindung anlegen';
+      }
+    }
+    function showWizard(){
+      setOpen(true);applyMode();
+      if(!dialog)return;
+      if(typeof dialog.showModal==='function'&&!dialog.open)dialog.showModal();
+      else dialog.setAttribute('open','open');
+    }
+    function resetServer(){
+      var pwgToken=token();
+      if(!pwgToken)return Promise.reject(new Error('CSRF token missing'));
+      var body=new URLSearchParams();body.set('pwg_token',pwgToken);body.set('bratonien_tool','nc_connector_wizard_reset');
+      return fetch(window.location.href,{method:'POST',credentials:'same-origin',cache:'no-store',headers:{'Content-Type':'application/x-www-form-urlencoded;charset=UTF-8'},body:body.toString()});
+    }
+    function closeAfterReset(){
+      if(resetBusy)return;resetBusy=true;setOpen(false);clearMode();
+      resetServer().catch(function(){}).finally(function(){resetBusy=false;if(dialog){if(typeof dialog.close==='function'&&dialog.open)dialog.close();else dialog.removeAttribute('open');}});
     }
 
-    tabs.addEventListener('click',function(e){ var b=e.target.closest('.bratonien-tab'); if(b) activate(b.dataset.tab); });
-    tabs.addEventListener('keydown',function(e){
-      if(e.key!=='ArrowLeft'&&e.key!=='ArrowRight') return;
-      var buttons=[].slice.call(tabs.querySelectorAll('.bratonien-tab'));
-      var i=buttons.indexOf(document.activeElement); if(i<0) return;
-      e.preventDefault(); i += e.key==='ArrowRight'?1:-1; if(i>=buttons.length)i=0; if(i<0)i=buttons.length-1;
-      buttons[i].focus(); activate(buttons[i].dataset.tab);
-    });
-
-    var initial='';
-    var hash=location.hash?location.hash.slice(1):'';
-    panels.forEach(function(item){if(item.definition.id===hash||(item.definition.sections||[]).indexOf(hash)!==-1)initial=item.definition.id;});
-    if(!initial){ try { initial=localStorage.getItem('bratonien-tools-active-tab')||''; } catch(e){} }
-    if(!panels.some(function(i){return i.definition.id===initial})) initial=panels[0].definition.id;
-    activate(initial,false);
+    if(openButton){
+      openButton.addEventListener('click',function(event){
+        event.preventDefault();event.stopImmediatePropagation();clearMode();showWizard();
+      },true);
+    }
+    if(closeButton){
+      closeButton.addEventListener('click',function(event){event.preventDefault();event.stopImmediatePropagation();closeAfterReset();},true);
+    }
+    if(dialog){
+      dialog.addEventListener('cancel',function(event){event.preventDefault();event.stopImmediatePropagation();closeAfterReset();},true);
+      dialog.addEventListener('click',function(event){if(event.target===dialog){event.preventDefault();event.stopImmediatePropagation();closeAfterReset();}},true);
+      [].slice.call(dialog.querySelectorAll('form[data-bratonien-wizard-form]')).forEach(function(form){
+        form.addEventListener('submit',function(event){
+          var submitter=event.submitter;
+          setOpen(true);
+          if(submitter&&submitter.hasAttribute('data-bratonien-wizard-end')){
+            setOpen(false);
+            if(submitter.value==='nc_connector_wizard_reset')clearMode();
+          }
+        },true);
+      });
+      try{if(sessionStorage.getItem(storageKey)==='1')showWizard();}catch(e){}
+      applyMode();
+    }
   }
-  if(document.readyState==='loading') document.addEventListener('DOMContentLoaded',initBratonienTabs); else initBratonienTabs();
+
+  function initNCConnectionEditing(){
+    var section=document.getElementById('nc-connector');if(!section)return;
+    var modeKey='bratonienNcWizardMode';
+    var pwgTokenInput=section.querySelector('input[name="pwg_token"]');
+    var pwgToken=pwgTokenInput?pwgTokenInput.value:'';
+
+    function setMode(value){try{sessionStorage.setItem(modeKey,value);}catch(e){}}
+    function makePostButton(label,tool,id,modeValue){
+      var form=document.createElement('form');form.method='post';form.style.display='inline';
+      var token=document.createElement('input');token.type='hidden';token.name='pwg_token';token.value=pwgToken;form.appendChild(token);
+      var connection=document.createElement('input');connection.type='hidden';connection.name='connection_id';connection.value=String(id);form.appendChild(connection);
+      var button=document.createElement('button');button.type='submit';button.className='buttonLike';button.name='bratonien_tool';button.value=tool;button.textContent=label;
+      if(modeValue)form.addEventListener('submit',function(){setMode(modeValue);});
+      form.appendChild(button);return form;
+    }
+    function escapeHtml(value){return String(value==null?'':value).replace(/[&<>"']/g,function(c){return {'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#039;'}[c];});}
+    function localEditorDialog(){
+      var dialog=document.getElementById('bratonien-nc-local-edit-dialog');
+      if(dialog)return dialog;
+      dialog=document.createElement('dialog');dialog.id='bratonien-nc-local-edit-dialog';dialog.className='bratonien-edit-dialog';
+      dialog.innerHTML='<div class="bratonien-edit-dialog__body"><div style="display:flex;align-items:center;justify-content:space-between;gap:1rem"><div><h4 style="margin:0">Verbindung bearbeiten</h4><p class="bratonien-base-note" style="margin:.35rem 0 0">Bestehende Legacy-Verbindung. Änderungen werden in derselben Verbindung gespeichert.</p></div><button type="button" class="buttonLike" data-local-edit-close>Schließen</button></div><div data-local-edit-content style="margin-top:1rem"></div></div>';
+      document.body.appendChild(dialog);
+      dialog.querySelector('[data-local-edit-close]').addEventListener('click',function(){dialog.close();});
+      dialog.addEventListener('click',function(event){if(event.target===dialog)dialog.close();});
+      return dialog;
+    }
+    function storageRow(storage){
+      return '<div class="bratonien-storage-row" data-storage-row>'+
+        '<label>Storage-ID<input name="nc_storage_id[]" value="'+escapeHtml(storage.storage_id||'')+'" required></label>'+
+        '<label>Quellordner<input name="nc_source_prefix[]" value="'+escapeHtml(storage.source_prefix||'')+'" placeholder="optional"></label>'+
+        '<label>Lokaler Speicherpfad<input name="nc_local_mount[]" value="'+escapeHtml(storage.local_mount||'')+'" required></label>'+
+        '<button type="button" class="buttonLike" data-remove-storage>Entfernen</button></div>';
+    }
+    function openLocalEditor(id){
+      var dialog=localEditorDialog();
+      var content=dialog.querySelector('[data-local-edit-content]');
+      content.innerHTML='<p class="bratonien-base-note">Verbindung wird geladen …</p>';
+      if(typeof dialog.showModal==='function')dialog.showModal();else dialog.setAttribute('open','open');
+      fetch('plugins/bratonien_tools/nc-connector-edit-data.php?connection_id='+encodeURIComponent(id)+'&_='+Date.now(),{credentials:'same-origin',cache:'no-store',headers:{'Accept':'application/json'}})
+        .then(function(response){return response.json().then(function(data){if(!response.ok)throw new Error(data.error||('HTTP '+response.status));return data;});})
+        .then(function(data){
+          if(data.adapter!=='local')throw new Error('Diese Verbindung ist keine Legacy-Verbindung.');
+          var legacy=data.legacy||{};var storages=Array.isArray(legacy.storages)?legacy.storages:[];
+          var rows=storages.map(storageRow).join('');
+          if(!rows)rows=storageRow({});
+          content.innerHTML='<form method="post" data-local-edit-form>'+
+            '<input type="hidden" name="pwg_token" value="'+escapeHtml(pwgToken)+'">'+
+            '<input type="hidden" name="connection_id" value="'+escapeHtml(data.id)+'">'+
+            '<div class="bratonien-form-grid">'+
+              '<label class="bratonien-label">Name</label><input name="connection_name" value="'+escapeHtml(data.name)+'" required>'+
+              '<label class="bratonien-label">Datenbank-Server</label><input name="nc_host" value="'+escapeHtml(legacy.host)+'" required>'+
+              '<label class="bratonien-label">Port</label><input name="nc_port" type="number" min="1" max="65535" value="'+escapeHtml(legacy.port||5432)+'" required>'+
+              '<label class="bratonien-label">Datenbank</label><input name="nc_database" value="'+escapeHtml(legacy.database)+'" required>'+
+              '<label class="bratonien-label">Reader-Benutzer</label><input name="nc_user" value="'+escapeHtml(legacy.user)+'" required>'+
+              '<label class="bratonien-label">Reader-Passwort</label><input name="nc_db_password" type="password" autocomplete="new-password" placeholder="leer = unverändert">'+
+            '</div>'+
+            '<h5 style="margin-top:1rem">Speicherorte</h5><p class="bratonien-base-note">Jeder Speicherort wird einzeln bearbeitet. Es ist kein Pipe-/Textformat erforderlich.</p><div data-storage-list>'+rows+'</div><button type="button" class="buttonLike" data-add-storage>Speicherort hinzufügen</button>'+
+            '<details style="margin-top:1rem"><summary>Erweiterte Legacy-Einstellungen</summary><div class="bratonien-form-grid" style="margin-top:.75rem">'+
+              '<label class="bratonien-label">Source-View</label><input name="nc_source_view" value="'+escapeHtml(legacy.source_view)+'" required>'+
+              '<label class="bratonien-label">Activity-View</label><input name="nc_activity_view" value="'+escapeHtml(legacy.activity_view)+'" required>'+
+              '<label class="bratonien-label">Piwigo-Galerieordner</label><input name="nc_gallery_root" value="'+escapeHtml(legacy.gallery_root)+'" required>'+
+              '<label class="bratonien-label">Ruhezeit (Sek.)</label><input name="nc_quiet_seconds" type="number" min="0" value="'+escapeHtml(legacy.quiet_seconds)+'">'+
+              '<label class="bratonien-label">Maximale Wartezeit (Sek.)</label><input name="nc_max_wait_seconds" type="number" min="60" value="'+escapeHtml(legacy.max_wait_seconds)+'">'+
+              '<label class="bratonien-label">Vollprüfung nach (Sek.)</label><input name="nc_full_sync_seconds" type="number" min="300" value="'+escapeHtml(legacy.full_sync_seconds)+'">'+
+            '</div></details>'+
+            '<div class="bratonien-actions" style="margin-top:1rem"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_update_local">Änderungen speichern</button><button class="buttonLike" type="button" data-local-edit-cancel>Abbrechen</button></div></form>';
+          var form=content.querySelector('[data-local-edit-form]');
+          form.querySelector('[data-local-edit-cancel]').addEventListener('click',function(){dialog.close();});
+          form.querySelector('[data-add-storage]').addEventListener('click',function(){form.querySelector('[data-storage-list]').insertAdjacentHTML('beforeend',storageRow({}));});
+          form.addEventListener('click',function(event){var remove=event.target.closest('[data-remove-storage]');if(remove){var row=remove.closest('[data-storage-row]');if(row)row.remove();}});
+        })
+        .catch(function(error){content.innerHTML='<p class="bratonien-main-cache__warning"><strong>Bearbeiten nicht möglich:</strong> '+escapeHtml(error.message||String(error))+'</p>';});
+    }
+
+    [].slice.call(section.querySelectorAll('button[value="nc_connector_edit_start"]')).forEach(function(button){var form=button.closest('form');if(form)form.remove();});
+
+    [].slice.call(section.querySelectorAll('button[value="nc_connector_delete"]')).forEach(function(deleteButton){
+      var deleteForm=deleteButton.closest('form');var card=deleteButton.closest('details');if(!deleteForm||!card)return;
+      var idInput=deleteForm.querySelector('input[name="connection_id"]');if(!idInput)return;var id=idInput.value;
+      var actions=deleteForm.parentElement;if(!actions)return;
+      var text=card.textContent||'';var isLocal=text.indexOf('bestehende Legacy-Konfiguration')!==-1;
+      if(isLocal){
+        var edit=document.createElement('button');edit.type='button';edit.className='buttonLike';edit.textContent='Bearbeiten';edit.addEventListener('click',function(){openLocalEditor(id);});actions.insertBefore(edit,deleteForm);
+        actions.insertBefore(makePostButton('Auf WebDAV migrieren','nc_connector_migrate_start',id,'migrate'),deleteForm);
+      }else{
+        actions.insertBefore(makePostButton('Bearbeiten','nc_connector_edit_start',id,'edit'),deleteForm);
+      }
+    });
+  }
+
+  function initNCConnectorPolling(){
+    var section=document.getElementById('nc-connector');if(!section)return;
+    var endpoint='plugins/bratonien_tools/nc-connector-status.php';
+    var pollTimer=null;
+
+    function valueNodeForLabel(labelText){
+      var labels=[].slice.call(section.querySelectorAll('.bratonien-label'));
+      for(var i=0;i<labels.length;i++){
+        if((labels[i].textContent||'').trim()===labelText){
+          var node=labels[i].nextElementSibling;
+          return node&&node.tagName==='STRONG'?node:null;
+        }
+      }
+      return null;
+    }
+
+    function lastResultValueNode(){
+      var notes=[].slice.call(section.querySelectorAll('.bratonien-base-note'));
+      for(var i=0;i<notes.length;i++){
+        var text=(notes[i].textContent||'').trim();
+        if(text.indexOf('Letztes Ergebnis:')===0){
+          return notes[i].querySelector('strong');
+        }
+      }
+      return null;
+    }
+
+    var lastRunNode=valueNodeForLabel('Letzter Lauf');
+    var nextRunNode=valueNodeForLabel('Nächster Lauf');
+    var lastResultNode=lastResultValueNode();
+
+    function render(data){
+      if(lastRunNode&&typeof data.last_run_label==='string'&&data.last_run_label!=='')lastRunNode.textContent=data.last_run_label;
+      if(nextRunNode&&typeof data.next_run_label==='string'&&data.next_run_label!=='')nextRunNode.textContent=data.next_run_label;
+      if(lastResultNode&&typeof data.message==='string'&&data.message!=='')lastResultNode.textContent=data.message;
+    }
+
+    function poll(){
+      fetch(endpoint+'?_='+Date.now(),{credentials:'same-origin',cache:'no-store',headers:{'Accept':'application/json'}})
+        .then(function(response){if(!response.ok)throw new Error('HTTP '+response.status);return response.json();})
+        .then(render)
+        .catch(function(){});
+    }
+
+    function schedule(){
+      if(pollTimer)window.clearInterval(pollTimer);
+      pollTimer=window.setInterval(poll,5000);
+    }
+
+    poll();schedule();
+  }
+
+  function initAll(){initBratonienTabs();initNCWizardLifecycle();initNCConnectionEditing();initNCConnectorPolling();}
+  if(document.readyState==='loading')document.addEventListener('DOMContentLoaded',initAll);else initAll();
 })();
 </script>
 {/literal}

template/nc_connector_admin.tpl

@@ -1,222 +1,351 @@
 <section class="bratonien-section" id="nc-connector">
   <h3>NC Connector</h3>
-  <p class="bratonien-section__intro">Bratonien Tools verwaltet die Nextcloud-Anbindung und den regelmäßigen Piwigo-Abgleich.</p>
+  <p class="bratonien-section__intro">Verbindet Nextcloud mit Piwigo und hält freigegebene Bilder automatisch aktuell.</p>
 
   {assign var=nc_system_available value=isset($NC_CONNECTOR.system)}
 
   <div class="bratonien-grid">
     <div class="bratonien-card">
-      <h4>Connector-Status</h4>
+      <h4>Status</h4>
       <div class="bratonien-form-grid">
-        <span class="bratonien-label">Phase</span><strong>{$NC_CONNECTOR.phase|escape:html}</strong>
-        <span class="bratonien-label">Connector-Verbindungen</span><strong>{$NC_CONNECTOR.connection_count|escape:html}</strong>
-        <span class="bratonien-label">Timer aktiv</span><strong>{if $nc_system_available && $NC_CONNECTOR.system.timer_active}Ja{else}Nein{/if}</strong>
-        <span class="bratonien-label">Timer aktiviert</span><strong>{if $nc_system_available && $NC_CONNECTOR.system.timer_enabled}Ja{else}Nein{/if}</strong>
-        <span class="bratonien-label">Letzter Lauf</span><strong>{if $nc_system_available}{$NC_CONNECTOR.system.last_run_label|escape:html}{else}Nicht verfügbar{/if}</strong>
-        <span class="bratonien-label">Nächster Lauf</span><strong>{if $nc_system_available}{$NC_CONNECTOR.system.next_run_label|escape:html}{else}Nicht verfügbar{/if}</strong>
+        <span class="bratonien-label">Verbindungen</span><strong>{$NC_CONNECTOR.connection_count|escape:html}</strong>
+        <span class="bratonien-label">Automatischer Abgleich</span><strong>{if $nc_system_available && $NC_CONNECTOR.system.timer_active && $NC_CONNECTOR.system.timer_enabled}Aktiv{else}Nicht aktiv{/if}</strong>
+        <span class="bratonien-label">Letzter Lauf</span><strong data-nc-last-run>{if $nc_system_available}{$NC_CONNECTOR.system.last_run_label|escape:html}{else}Nicht verfügbar{/if}</strong>
+        <span class="bratonien-label">Nächster Lauf</span><strong data-nc-next-run>{if $nc_system_available}{$NC_CONNECTOR.system.next_run_label|escape:html}{else}Nicht verfügbar{/if}</strong>
       </div>
-      {if $nc_system_available && $NC_CONNECTOR.system.last_run_message}
-        <p class="bratonien-base-note">Letztes Ergebnis: <strong>{$NC_CONNECTOR.system.last_run_message|escape:html}</strong></p>
-      {/if}
+      {if $nc_system_available && $NC_CONNECTOR.system.last_run_message}<p class="bratonien-base-note">Letztes Ergebnis: <strong>{$NC_CONNECTOR.system.last_run_message|escape:html}</strong></p>{/if}
+      {if $nc_system_available && $NC_CONNECTOR.system.last_run_api_state == 'error'}<p class="bratonien-main-cache__warning"><strong>API:</strong> {$NC_CONNECTOR.system.last_run_api_message|escape:html}</p>{/if}
+      {if $nc_system_available && $NC_CONNECTOR.system.last_run_fallback_state == 'error'}<p class="bratonien-main-cache__warning"><strong>Fallback:</strong> {$NC_CONNECTOR.system.last_run_fallback_message|escape:html}</p>{/if}
+      {if $nc_system_available && $NC_CONNECTOR.system.last_run_error_detail}<details><summary>Technische Fehlerdetails</summary><p class="bratonien-main-cache__warning">{$NC_CONNECTOR.system.last_run_error_detail|escape:html}</p></details>{/if}
     </div>
 
     <div class="bratonien-card">
-      <h4>Runtime</h4>
-      <p class="bratonien-base-note">Neue Verbindungen verwenden direkt die Plugin-Runtime und einen eigenen State unter <code>/var/lib/bratonien-tools/nc-connector/connection-ID</code>.</p>
-      {if $nc_system_available && !$NC_CONNECTOR.system.legacy_runtime_exists && !$NC_CONNECTOR.system.legacy_config_exists && !$NC_CONNECTOR.system.legacy_service_exists && !$NC_CONNECTOR.system.legacy_timer_exists}
-        <p class="bratonien-base-note">Legacy-Bestand: <strong>vollständig entfernt</strong>.</p>
-      {/if}
-    </div>
-
-    <div class="bratonien-card" style="grid-column:1/-1">
-      <h4>Piwigo API – bevorzugter Sync-Zugang</h4>
-      <p class="bratonien-base-note">Der NC Connector versucht bei jedem produktiven Lauf zuerst die Piwigo-API. Ein erfolgreich geprüfter API-Key wird verschlüsselt gespeichert. Die produktive API-Synchronisierung ist ausdrücklich an die im Plugin freigegebene Piwigo-Version gebunden. Ist diese Version nicht freigegeben oder die API nicht nutzbar, darf nur der Benutzername/Passwort-Fallback übernehmen.</p>
-      <form method="post">
-        <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-        <div class="bratonien-form-grid">
-          <label class="bratonien-label" for="nc_piwigo_api_key_id">API-Schlüssel-ID</label>
-          <input id="nc_piwigo_api_key_id" name="nc_piwigo_api_key_id" type="text" autocomplete="off" placeholder="pkid-..." required>
-          <label class="bratonien-label" for="nc_piwigo_api_key_secret">API-Geheimnis</label>
-          <input id="nc_piwigo_api_key_secret" name="nc_piwigo_api_key_secret" type="password" autocomplete="off" required>
-        </div>
-        <div class="bratonien-actions">
-          <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_piwigo_api_test">API prüfen und speichern</button>
-          <button class="buttonLike bratonien-delete-button" type="submit" name="bratonien_tool" value="nc_connector_piwigo_api_delete" formnovalidate onclick="return confirm('Gespeicherte Piwigo-API-Zugangsdaten wirklich löschen?');">Gespeicherte API löschen</button>
-        </div>
-      </form>
-
-      {if isset($NC_CONNECTOR.piwigo_api_test) && $NC_CONNECTOR.piwigo_api_test}
-        <hr>
-        <h5>Prüfergebnis</h5>
-        <div class="bratonien-form-grid">
-          <span class="bratonien-label">Benutzer</span><strong>{$NC_CONNECTOR.piwigo_api_test.username|escape:html}</strong>
-          <span class="bratonien-label">Piwigo-Status</span><strong>{$NC_CONNECTOR.piwigo_api_test.status|escape:html}</strong>
-          <span class="bratonien-label">Administrator/Webmaster</span><strong>{if $NC_CONNECTOR.piwigo_api_test.admin}Ja{else}Nein{/if}</strong>
-          <span class="bratonien-label">Sichtbare API-Methoden</span><strong>{$NC_CONNECTOR.piwigo_api_test.method_count|escape:html}</strong>
-          <span class="bratonien-label">Bratonien-Sync-API</span><strong>{if $NC_CONNECTOR.piwigo_api_test.sync_api_detected}Bereit{else}Nicht bereit{/if}</strong>
-        </div>
-        <p class="bratonien-base-note"><strong>Bewertung:</strong> {$NC_CONNECTOR.piwigo_api_test.conclusion|escape:html}</p>
-      {/if}
-    </div>
-
-    <div class="bratonien-card" style="grid-column:1/-1">
-      <h4>Benutzername/Passwort-Fallback</h4>
-      <p class="bratonien-base-note">Dieser Zugang wird nur verwendet, wenn die bevorzugte API nicht genutzt werden kann. Zugangsdaten können einmalig für einen manuellen Fallback verwendet, verschlüsselt dauerhaft hinterlegt oder vollständig gelöscht werden.</p>
-      {if $NC_CONNECTOR.connection_count > 0}
-        <form method="post">
-          <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-          <div class="bratonien-form-grid">
-            <label class="bratonien-label" for="nc_fallback_connection">Verbindung</label>
-            <select id="nc_fallback_connection" name="connection_id" required>
-              {foreach from=$NC_CONNECTOR.connections item=connection}
-                <option value="{$connection.id|escape:html}">{$connection.name|escape:html}</option>
-              {/foreach}
-            </select>
-            <label class="bratonien-label" for="nc_fallback_user">Piwigo-Benutzer</label>
-            <input id="nc_fallback_user" name="nc_fallback_user" type="text" autocomplete="username">
-            <label class="bratonien-label" for="nc_fallback_password">Piwigo-Passwort</label>
-            <input id="nc_fallback_password" name="nc_fallback_password" type="password" autocomplete="current-password">
-          </div>
-          <div class="bratonien-actions">
-            <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_fallback_once">Einmalig verwenden</button>
-            <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_fallback_save">Fest speichern</button>
-            <button class="buttonLike bratonien-delete-button" type="submit" name="bratonien_tool" value="nc_connector_fallback_delete" formnovalidate onclick="return confirm('Gespeicherten Benutzername/Passwort-Fallback wirklich löschen?');">Gespeicherten Fallback löschen</button>
-          </div>
-        </form>
-      {else}
-        <p class="bratonien-base-note">Noch keine Connector-Verbindung vorhanden.</p>
-      {/if}
-    </div>
-
-    <div class="bratonien-card" style="grid-column:1/-1">
-      <h4>Neue lokale Verbindung</h4>
-      <form method="post">
-        <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-        <div class="bratonien-form-grid">
-          <label class="bratonien-label" for="nc_name">Name</label><input id="nc_name" name="nc_name" type="text" required>
-          <label class="bratonien-label" for="nc_host">PostgreSQL-Host</label><input id="nc_host" name="nc_host" type="text" required>
-          <label class="bratonien-label" for="nc_port">PostgreSQL-Port</label><input id="nc_port" name="nc_port" type="number" min="1" max="65535" value="5432" required>
-          <label class="bratonien-label" for="nc_database">Datenbank</label><input id="nc_database" name="nc_database" type="text" value="nextcloud" required>
-          <label class="bratonien-label" for="nc_user">Reader-Benutzer</label><input id="nc_user" name="nc_user" type="text" required>
-          <label class="bratonien-label" for="nc_db_password">Reader-Passwort</label><input id="nc_db_password" name="nc_db_password" type="password" autocomplete="new-password" required>
-          <label class="bratonien-label" for="nc_source_view">Source-View</label><input id="nc_source_view" name="nc_source_view" type="text" value="piwigo_showcase_sources" required>
-          <label class="bratonien-label" for="nc_activity_view">Activity-View</label><input id="nc_activity_view" name="nc_activity_view" type="text" value="piwigo_showcase_activity" required>
-          <label class="bratonien-label" for="nc_gallery_root">Piwigo-Galeriepfad</label><input id="nc_gallery_root" name="nc_gallery_root" type="text" placeholder="/var/www/piwigo/galleries/nextcloud" required>
-          <label class="bratonien-label" for="nc_piwigo_user">Piwigo-Fallback-Benutzer</label><input id="nc_piwigo_user" name="nc_piwigo_user" type="text" required>
-          <label class="bratonien-label" for="nc_piwigo_password">Piwigo-Fallback-Passwort</label><input id="nc_piwigo_password" name="nc_piwigo_password" type="password" autocomplete="new-password" required>
-          <label class="bratonien-label" for="nc_quiet_seconds">Ruhezeit</label><input id="nc_quiet_seconds" name="nc_quiet_seconds" type="number" min="0" value="120">
-          <label class="bratonien-label" for="nc_max_wait_seconds">Maximale Wartezeit</label><input id="nc_max_wait_seconds" name="nc_max_wait_seconds" type="number" min="60" value="900">
-          <label class="bratonien-label" for="nc_full_sync_seconds">Vollprüfung nach</label><input id="nc_full_sync_seconds" name="nc_full_sync_seconds" type="number" min="300" value="86400">
-        </div>
-        <p><label for="nc_storages"><strong>Storage-Zuordnungen</strong></label></p>
-        <p class="bratonien-base-note">Eine Zeile pro Storage: <code>storage_id | source_prefix | /lokaler/mount</code></p>
-        <textarea id="nc_storages" name="nc_storages" rows="4" style="width:100%" required></textarea>
-        <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_create_local">Verbindung anlegen</button></p>
-      </form>
-    </div>
-
-    <div class="bratonien-card" style="grid-column:1/-1">
-      <h4>Connector-Verbindungen</h4>
-      {if $NC_CONNECTOR.connection_count > 0}
-        <table class="table2">
-          <thead>
-            <tr>
-              <th>Name</th>
-              <th>Adapter</th>
-              <th>Host</th>
-              <th>Quelle</th>
-              <th>Storages</th>
-              <th>Status</th>
-              <th>Aktion</th>
-            </tr>
-          </thead>
-          <tbody>
-          {foreach from=$NC_CONNECTOR.connections item=connection}
-            <tr>
-              <td>{$connection.name|escape:html}</td>
-              <td>{$connection.adapter|escape:html}</td>
-              <td>{if $connection.host}{$connection.host|escape:html}{else}—{/if}</td>
-              <td>{if $connection.source_view}{$connection.source_view|escape:html}{else}—{/if}</td>
-              <td>{$connection.storage_count|escape:html}</td>
-              <td>{$connection.takeover_state|escape:html}{if $connection.enabled} · aktiv{/if}</td>
-              <td>
-                {if $connection.takeover_state == 'active'}
-                  <code>php /var/www/piwigo/plugins/bratonien_tools/nc-connector-disable.php {$connection.id|escape:html}</code>
-                {elseif $connection.takeover_state == 'verified' && isset($connection.config.origin) && $connection.config.origin == 'native'}
-                  <code>php /var/www/piwigo/plugins/bratonien_tools/nc-connector-install.php {$connection.id|escape:html}</code>
-                  <form method="post" class="bratonien-actions">
-                    <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-                    <input type="hidden" name="connection_id" value="{$connection.id|escape:html}">
-                    <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_verify">Erneut prüfen</button>
-                  </form>
-                {elseif $connection.takeover_state == 'ready'}
-                  <form method="post" class="bratonien-actions">
-                    <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-                    <input type="hidden" name="connection_id" value="{$connection.id|escape:html}">
-                    <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_cancel_takeover">Vorbereitung zurücknehmen</button>
-                  </form>
-                {elseif $connection.takeover_state == 'verified' && !$connection.enabled}
-                  <form method="post" class="bratonien-actions">
-                    <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-                    <input type="hidden" name="connection_id" value="{$connection.id|escape:html}">
-                    <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_prepare_takeover">Übergabe vorbereiten</button>
-                  </form>
-                {elseif $connection.adapter == 'local' && !$connection.enabled}
-                  <form method="post" class="bratonien-actions">
-                    <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-                    <input type="hidden" name="connection_id" value="{$connection.id|escape:html}">
-                    <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_verify">Verbindung prüfen</button>
-                  </form>
-                  <form method="post" class="bratonien-actions">
-                    <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
-                    <input type="hidden" name="connection_id" value="{$connection.id|escape:html}">
-                    <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_delete">Löschen</button>
-                  </form>
-                {else}
-                  —
-                {/if}
-              </td>
-            </tr>
-            {if $connection.verification_checks|@count > 0}
-              <tr>
-                <td colspan="7">
-                  <strong>Letzte Verifikation{if $connection.verified_at} · {$connection.verified_at|escape:html}{/if}</strong>
-                  <ul>
-                    {foreach from=$connection.verification_checks item=check}
-                      <li>{if $check.ok}✓{else}✗{/if} <strong>{$check.name|escape:html}:</strong> {$check.detail|escape:html}</li>
-                    {/foreach}
-                  </ul>
-                  {if $connection.takeover_state == 'active'}
-                    <p class="bratonien-base-note"><strong>Connector aktiv.</strong> State: <code>{$connection.config.state_dir|escape:html}</code></p>
-                  {elseif $connection.takeover_state == 'verified' && isset($connection.config.origin) && $connection.config.origin == 'native'}
-                    <p class="bratonien-base-note">Verifiziert. Der angezeigte Root-Befehl richtet Runtime-Konfiguration, State-Verzeichnis und gemeinsamen systemd-Timer ein und führt vor der Aktivierung einen Testlauf aus.</p>
-                  {/if}
-                </td>
-              </tr>
-            {/if}
-          {/foreach}
-          </tbody>
-        </table>
-      {else}
-        <p>Noch keine Verbindung in der Connector-Verwaltung.</p>
-      {/if}
-    </div>
-
-    <div class="bratonien-card">
-      <h4>Sync-Zustand</h4>
-      <div class="bratonien-form-grid">
-        <span class="bratonien-label">Connector-Timer</span><strong>{if $nc_system_available && $NC_CONNECTOR.system.timer_active}Aktiv{else}Nicht aktiv{/if}</strong>
-        <span class="bratonien-label">Letzter Lauf</span><strong>{if $nc_system_available}{$NC_CONNECTOR.system.last_run_label|escape:html}{else}Nicht verfügbar{/if}</strong>
-        <span class="bratonien-label">Nächster Lauf</span><strong>{if $nc_system_available}{$NC_CONNECTOR.system.next_run_label|escape:html}{else}Nicht verfügbar{/if}</strong>
+      <h4>Neue Verbindung</h4>
+      <p class="bratonien-base-note">Für die normale Einrichtung empfehlen wir den Assistenten.</p>
+      <div class="bratonien-actions">
+        <button class="buttonLike" type="button" id="bratonien-nc-wizard-open">Mit Assistent anlegen</button>
+        <button class="buttonLike" type="button" id="bratonien-nc-technical-open">Ohne Assistent anlegen</button>
       </div>
-      {if $nc_system_available && $NC_CONNECTOR.system.last_run_message}
-        <p class="bratonien-base-note">{$NC_CONNECTOR.system.last_run_message|escape:html}</p>
-      {/if}
-    </div>
-
-    <div class="bratonien-card">
-      <h4>Neuinstallation</h4>
-      <p class="bratonien-base-note">Eine frische Installation benötigt keinen Legacy-Sync. Ablauf: Verbindung anlegen → prüfen → Root-Aktivierung ausführen. Danach arbeitet ausschließlich die Plugin-Runtime.</p>
     </div>
   </div>
+
+  <dialog id="bratonien-nc-wizard-dialog" style="width:min(980px,calc(100vw - 3rem));max-height:88vh;overflow:auto;background:#444;color:inherit;border:1px solid #777;border-radius:4px;padding:0;box-shadow:0 18px 60px rgba(0,0,0,.55)">
+    <div style="padding:1.25rem 1.5rem">
+      <div style="display:flex;align-items:center;justify-content:space-between;gap:1rem;margin-bottom:1rem">
+        <div>
+          <h4 style="margin:0">Neue Verbindung</h4>
+          <p class="bratonien-base-note" style="margin:.35rem 0 0"><strong>
+            {if $NC_CONNECTOR.wizard.step == 1}
+              Anmeldung
+            {elseif $NC_CONNECTOR.wizard.step == 2 && $NC_CONNECTOR.wizard.technical_stage == 'database_details'}
+              Datenbank prüfen
+            {elseif $NC_CONNECTOR.wizard.step == 2 && $NC_CONNECTOR.wizard.technical_stage == 'mounts' && !$NC_CONNECTOR.wizard.directory_selection_ready}
+              Speicher zuordnen
+            {elseif $NC_CONNECTOR.wizard.step == 2 && $NC_CONNECTOR.wizard.technical_stage == 'mounts' && $NC_CONNECTOR.wizard.directory_selection_ready}
+              Verzeichnisse auswählen
+            {elseif $NC_CONNECTOR.wizard.step == 2 && $NC_CONNECTOR.wizard.technical_complete}
+              Verbindung benennen
+            {elseif $NC_CONNECTOR.wizard.step == 3}
+              Piwigo-API
+            {elseif $NC_CONNECTOR.wizard.step == 4}
+              Abschluss
+            {else}
+              Einrichtung
+            {/if}
+          </strong></p>
+        </div>
+        <button class="buttonLike" type="button" id="bratonien-nc-wizard-close">Schließen</button>
+      </div>
+
+      {if $NC_CONNECTOR.wizard.step == 1}
+        <p class="bratonien-base-note">Adresse und Zugang reichen für den ersten Scan. Der Assistent prüft den erreichbaren Web-Zugang automatisch.</p>
+        <form method="post" data-bratonien-wizard-form>
+          <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+          <div class="bratonien-form-grid">
+            <label class="bratonien-label" for="nc_wizard_host">Nextcloud-Adresse</label>
+            <input id="nc_wizard_host" name="nc_wizard_host" type="text" placeholder="cloud.example.de" value="{$NC_CONNECTOR.wizard.host_input|escape:html}" required>
+            <label class="bratonien-label" for="nc_wizard_user">Benutzer</label>
+            <input id="nc_wizard_user" name="nc_wizard_user" type="text" autocomplete="username" value="{$NC_CONNECTOR.wizard.username|escape:html}" required>
+            <label class="bratonien-label" for="nc_wizard_password">Passwort</label>
+            <input id="nc_wizard_password" name="nc_wizard_password" type="password" autocomplete="current-password" value="{$NC_CONNECTOR.wizard._password|escape:html}" required>
+          </div>
+          <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_scan">Verbinden und scannen</button></p>
+        </form>
+
+      {elseif $NC_CONNECTOR.wizard.step == 2}
+        <p class="bratonien-base-note"><strong>Nextcloud wurde gefunden.</strong> Für den Datenzugriff wird die bekannte Reader-Verbindung verwendet. Verzeichnisse werden ausschließlich mit dem angemeldeten Nextcloud-Benutzer gelesen.</p>
+        <div class="bratonien-form-grid">
+          <span class="bratonien-label">Adresse</span><strong>{$NC_CONNECTOR.wizard.base_url|escape:html}</strong>
+          <span class="bratonien-label">Version</span><strong>{if $NC_CONNECTOR.wizard.version}{$NC_CONNECTOR.wizard.version|escape:html}{else}Nicht gemeldet{/if}</strong>
+          <span class="bratonien-label">Angemeldet als</span><strong>{$NC_CONNECTOR.wizard.username|escape:html}{if $NC_CONNECTOR.wizard.display_name} · {$NC_CONNECTOR.wizard.display_name|escape:html}{/if}</strong>
+        </div>
+
+        {if $NC_CONNECTOR.wizard.technical_stage == 'database_details'}
+          <hr>
+          <h5>Datenbank-Adresse prüfen</h5>
+          <p class="bratonien-base-note">Die bekannte Reader-Verbindung konnte mit der gespeicherten Adresse nicht bestätigt werden.</p>
+          {if $NC_CONNECTOR.wizard.technical_error}<details><summary>Technische Details</summary><p class="bratonien-main-cache__warning">{$NC_CONNECTOR.wizard.technical_error|escape:html}</p></details>{/if}
+          <form method="post" data-bratonien-wizard-form>
+            <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+            <div class="bratonien-form-grid">
+              <label class="bratonien-label">Datenbank-Adresse</label><input name="nc_wizard_db_host" type="text" value="{$NC_CONNECTOR.wizard.db_host|escape:html}" required>
+              <label class="bratonien-label">Port</label><input name="nc_wizard_db_port" type="number" min="1" max="65535" value="{$NC_CONNECTOR.wizard.db_port|escape:html}" required>
+              <label class="bratonien-label">Datenbank</label><input name="nc_wizard_db_database" type="text" value="{$NC_CONNECTOR.wizard.db_database|escape:html}" required>
+            </div>
+            <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_save_technical">Erneut prüfen</button></p>
+          </form>
+
+        {elseif $NC_CONNECTOR.wizard.technical_stage == 'mounts'}
+          <hr>
+          {if $NC_CONNECTOR.wizard.directory_selection_ready}
+            <h5>Verzeichnisse auswählen</h5>
+            <p class="bratonien-base-note">Es werden nur Verzeichnisse angezeigt, auf die <strong>{$NC_CONNECTOR.wizard.username|escape:html}</strong> in Nextcloud Zugriff hat. Mehrere Verzeichnisse können hinzugefügt werden. Bleibt die Auswahl leer, wird automatisch das Stammverzeichnis verwendet.</p>
+
+            <div class="bratonien-form-grid">
+              <span class="bratonien-label">Ausgewählt</span>
+              <div>
+                {if $NC_CONNECTOR.wizard.directory_selected|@count > 0}
+                  {foreach from=$NC_CONNECTOR.wizard.directory_selected item=selected_path}
+                    <form method="post" class="bratonien-actions" style="margin:.25rem 0" data-bratonien-wizard-form>
+                      <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+                      <input type="hidden" name="nc_wizard_directory_remove" value="{$selected_path|escape:html}">
+                      <strong style="flex:1">{if $selected_path}{$selected_path|escape:html}{else}Stammverzeichnis{/if}</strong>
+                      <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_directory_remove">Entfernen</button>
+                    </form>
+                  {/foreach}
+                {else}
+                  <span class="bratonien-base-note">Keine Auswahl – Stammverzeichnis wird verwendet.</span>
+                {/if}
+              </div>
+
+              <span class="bratonien-label">Aktueller Ordner</span><strong>/{if $NC_CONNECTOR.wizard.directory_path}{$NC_CONNECTOR.wizard.directory_path|escape:html}{/if}</strong>
+            </div>
+
+            <div class="bratonien-actions" style="margin:.75rem 0">
+              <form method="post" data-bratonien-wizard-form>
+                <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+                <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_directory_add">Diesen Ordner hinzufügen</button>
+              </form>
+              {if $NC_CONNECTOR.wizard.directory_path}
+                <form method="post" data-bratonien-wizard-form>
+                  <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+                  <input type="hidden" name="nc_wizard_directory_path" value="{$NC_CONNECTOR.wizard.directory_parent|escape:html}">
+                  <button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_directory_browse">Eine Ebene hoch</button>
+                </form>
+              {/if}
+            </div>
+
+            <div style="margin:.75rem 0">
+              {if $NC_CONNECTOR.wizard.directory_children|@count > 0}
+                {foreach from=$NC_CONNECTOR.wizard.directory_children item=directory_name key=directory_path}
+                  <form method="post" style="margin:.3rem 0" data-bratonien-wizard-form>
+                    <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+                    <input type="hidden" name="nc_wizard_directory_path" value="{$directory_path|escape:html}">
+                    <button class="buttonLike" style="width:100%;text-align:left" type="submit" name="bratonien_tool" value="nc_connector_wizard_directory_browse">📁 {$directory_name|escape:html}</button>
+                  </form>
+                {/foreach}
+              {else}
+                <p class="bratonien-base-note">Keine Unterordner vorhanden.</p>
+              {/if}
+            </div>
+
+            <form method="post" data-bratonien-wizard-form>
+              <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+              {foreach from=$NC_CONNECTOR.wizard.storage_candidates item=storage key=storage_index}
+                <input type="hidden" name="nc_wizard_storage_mount[{$storage_index|escape:html}]" value="{$storage.local_mount|escape:html}">
+              {/foreach}
+              <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_save_mounts">Verzeichnisse übernehmen</button></p>
+            </form>
+          {else}
+            <h5>Speicherort bestätigen</h5>
+            <p class="bratonien-base-note">Die Datenquelle wurde gefunden. Ein technischer Speicherort konnte nicht automatisch zugeordnet werden.</p>
+            <form method="post" data-bratonien-wizard-form>
+              <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+              <div class="bratonien-form-grid">
+                {foreach from=$NC_CONNECTOR.wizard.storage_candidates item=storage key=storage_index}
+                  <span class="bratonien-label">Speicher {$storage_index+1}</span>
+                  {if $storage.local_mount}
+                    <strong>Automatisch erkannt</strong>
+                    <input type="hidden" name="nc_wizard_storage_mount[{$storage_index|escape:html}]" value="{$storage.local_mount|escape:html}">
+                  {else}
+                    <input name="nc_wizard_storage_mount[{$storage_index|escape:html}]" type="text" placeholder="Eingebundener Speicherpfad" required>
+                  {/if}
+                {/foreach}
+              </div>
+              <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_save_mounts">Speicher prüfen</button></p>
+            </form>
+          {/if}
+
+        {elseif $NC_CONNECTOR.wizard.technical_complete}
+          <hr>
+          <h5>Verbindung benennen</h5>
+          <p class="bratonien-base-note">Diese Verbindung verwendet ausschließlich den in Schritt 1 angemeldeten Nextcloud-Benutzer.</p>
+          <form method="post" data-bratonien-wizard-form>
+            <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+            <div class="bratonien-form-grid">
+              <label class="bratonien-label" for="nc_wizard_connection_name">Name der Verbindung</label><input id="nc_wizard_connection_name" name="nc_wizard_connection_name" type="text" value="{$NC_CONNECTOR.wizard.connection_name|escape:html}" required>
+              <span class="bratonien-label">Nextcloud-Benutzer</span><strong>{$NC_CONNECTOR.wizard.username|escape:html}</strong>
+            </div>
+            <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_select_user">Weiter</button></p>
+          </form>
+        {/if}
+
+        <div class="bratonien-actions" style="margin-top:1rem">
+          <form method="post" data-bratonien-wizard-form><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_back">Zurück</button></form>
+          <form method="post" data-bratonien-wizard-form><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_reset" data-bratonien-wizard-end>Neu beginnen</button></form>
+        </div>
+
+      {elseif $NC_CONNECTOR.wizard.step == 3}
+        <p class="bratonien-base-note"><strong>Nextcloud ist vorbereitet.</strong> Jetzt wird der bevorzugte Piwigo-Zugang geprüft.</p>
+        {if $NC_CONNECTOR.wizard.api_error}<p class="bratonien-main-cache__warning"><strong>API-Test fehlgeschlagen:</strong> {$NC_CONNECTOR.wizard.api_error|escape:html}</p>{/if}
+        <form method="post" data-bratonien-wizard-form>
+          <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+          <div class="bratonien-form-grid">
+            <label class="bratonien-label" for="nc_wizard_api_key_id">API-Schlüssel-ID</label><input id="nc_wizard_api_key_id" name="nc_wizard_api_key_id" type="text" autocomplete="off" value="{$NC_CONNECTOR.wizard._api_key_id|escape:html}" placeholder="leer = bereits gespeicherten Zugang testen">
+            <label class="bratonien-label" for="nc_wizard_api_key_secret">API-Geheimnis</label><input id="nc_wizard_api_key_secret" name="nc_wizard_api_key_secret" type="password" autocomplete="off" value="{$NC_CONNECTOR.wizard._api_key_secret|escape:html}" placeholder="leer = bereits gespeicherten Zugang testen">
+          </div>
+          <div class="bratonien-actions"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_api_test">API testen</button><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_api_skip" formnovalidate>Überspringen</button></div>
+        </form>
+        <form method="post" style="margin-top:1rem" data-bratonien-wizard-form><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_back">Zurück</button></form>
+
+      {elseif $NC_CONNECTOR.wizard.step == 4}
+        <p class="bratonien-base-note"><strong>Fast fertig.</strong> Die Verbindung wurde noch nicht angelegt. Erst der letzte Button übernimmt die Einstellungen.</p>
+        <div class="bratonien-form-grid">
+          <span class="bratonien-label">Verbindung</span><strong>{$NC_CONNECTOR.wizard.connection_name|escape:html}</strong>
+          <span class="bratonien-label">Nextcloud</span><strong>{$NC_CONNECTOR.wizard.base_url|escape:html}</strong>
+          <span class="bratonien-label">Nextcloud-Benutzer</span><strong>{$NC_CONNECTOR.wizard.username|escape:html}</strong>
+          <span class="bratonien-label">Piwigo-API</span><strong>{if $NC_CONNECTOR.wizard.api_status == 'ok'}Erfolgreich geprüft{else}Übersprungen{/if}</strong>
+        </div>
+        <hr>
+        <h5>Fallback</h5>
+        {if $NC_CONNECTOR.wizard.api_status == 'ok'}<p class="bratonien-base-note">Optional. Wird nur verwendet, falls die API später nicht verfügbar ist.</p>{else}<p class="bratonien-main-cache__warning">Ohne API ist ein Fallback-Zugang erforderlich.</p>{/if}
+        <form method="post" data-bratonien-wizard-form>
+          <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+          <div class="bratonien-form-grid">
+            <label class="bratonien-label" for="nc_wizard_fallback_user">Piwigo-Benutzer</label><input id="nc_wizard_fallback_user" name="nc_wizard_fallback_user" type="text" autocomplete="username" value="{$NC_CONNECTOR.wizard._fallback_user|escape:html}"{if $NC_CONNECTOR.wizard.api_status != 'ok'} required{/if}>
+            <label class="bratonien-label" for="nc_wizard_fallback_password">Piwigo-Passwort</label><input id="nc_wizard_fallback_password" name="nc_wizard_fallback_password" type="password" autocomplete="current-password" value="{$NC_CONNECTOR.wizard._fallback_password|escape:html}"{if $NC_CONNECTOR.wizard.api_status != 'ok'} required{/if}>
+          </div>
+          <div class="bratonien-actions"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_finish" data-bratonien-wizard-end>Verbindung anlegen</button><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_reset" formnovalidate data-bratonien-wizard-end>Abbrechen</button></div>
+        </form>
+        <form method="post" style="margin-top:1rem" data-bratonien-wizard-form><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_wizard_back">Zurück</button></form>
+      {/if}
+    </div>
+  </dialog>
+
+  <details id="bratonien-nc-technical-create" class="bratonien-card" style="margin-top:1.5rem">
+    <summary style="display:none">Ohne Assistent anlegen</summary>
+    <h4>Technische Einrichtung</h4>
+    <p class="bratonien-main-cache__warning">Nur verwenden, wenn die technische Zuordnung bekannt ist. Falsche Pfade können die Synchronisierung auf den falschen Datenbestand richten.</p>
+    <form method="post">
+      <input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}">
+      <div class="bratonien-form-grid">
+        <label class="bratonien-label">Name</label><input name="nc_name" type="text" required>
+        <label class="bratonien-label">PostgreSQL-Host</label><input name="nc_host" type="text" required>
+        <label class="bratonien-label">PostgreSQL-Port</label><input name="nc_port" type="number" min="1" max="65535" value="5432" required>
+        <label class="bratonien-label">Datenbank</label><input name="nc_database" type="text" value="nextcloud" required>
+        <label class="bratonien-label">Reader-Benutzer</label><input name="nc_user" type="text" required>
+        <label class="bratonien-label">Reader-Passwort</label><input name="nc_db_password" type="password" autocomplete="new-password" required>
+        <label class="bratonien-label">Source-View</label><input name="nc_source_view" type="text" value="piwigo_showcase_sources" required>
+        <label class="bratonien-label">Activity-View</label><input name="nc_activity_view" type="text" value="piwigo_showcase_activity" required>
+        <label class="bratonien-label">Piwigo-Galeriepfad</label><input name="nc_gallery_root" type="text" placeholder="/var/www/piwigo/galleries/nextcloud" required>
+        <label class="bratonien-label">Fallback-Benutzer</label><input name="nc_piwigo_user" type="text">
+        <label class="bratonien-label">Fallback-Passwort</label><input name="nc_piwigo_password" type="password" autocomplete="new-password">
+        <label class="bratonien-label">Ruhezeit</label><input name="nc_quiet_seconds" type="number" min="0" value="120">
+        <label class="bratonien-label">Maximale Wartezeit</label><input name="nc_max_wait_seconds" type="number" min="60" value="900">
+        <label class="bratonien-label">Vollprüfung nach</label><input name="nc_full_sync_seconds" type="number" min="300" value="86400">
+      </div>
+      <p><strong>Storage-Zuordnungen</strong></p><p class="bratonien-base-note">Format: Storage-ID | optionales Quellpräfix | lokaler Speicherpfad</p><textarea name="nc_storages" rows="4" style="width:100%" required></textarea>
+      <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_create_local">Verbindung anlegen</button></p>
+    </form>
+  </details>
+
+  <div class="bratonien-card" style="margin-top:1.5rem">
+    <h4>Bestehende Verbindungen</h4>
+    {if $NC_CONNECTOR.connection_count > 0}
+      {foreach from=$NC_CONNECTOR.connections item=connection}
+        <details style="margin:.6rem 0">
+          <summary><strong>{$connection.display_name|escape:html}</strong> · {if $connection.enabled}aktiv{else}{$connection.takeover_state|escape:html}{/if}{if isset($connection.last_sync) && ($connection.last_sync.state == 'error' || $connection.last_sync.state == 'warning')} · Laufzeitproblem{/if}</summary>
+          <div style="padding:.75rem 0">
+            <form method="post" class="bratonien-actions"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><input type="hidden" name="connection_id" value="{$connection.id|escape:html}"><input name="connection_name" type="text" value="{$connection.name|escape:html}" required><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_update_name">Name speichern</button></form>
+            <div class="bratonien-actions" style="margin-top:.6rem">
+              {if $connection.adapter == 'local' && !$connection.enabled}<form method="post"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><input type="hidden" name="connection_id" value="{$connection.id|escape:html}"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_verify">Verbindung prüfen</button></form>{/if}
+              <form method="post"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><input type="hidden" name="connection_id" value="{$connection.id|escape:html}"><button class="buttonLike bratonien-delete-button" type="submit" name="bratonien_tool" value="nc_connector_delete" onclick="return confirm('Verbindung wirklich löschen? Die Verbindung wird sofort aus Bratonien Tools entfernt und beim nächsten Connector-Lauf auch aus der Laufzeit entfernt. Bilder in Nextcloud oder Piwigo werden nicht gelöscht.');">Löschen</button></form>
+            </div>
+            {if isset($connection.last_sync) && $connection.last_sync.timestamp > 0}
+              <p class="bratonien-base-note"><strong>Letzter Abgleich:</strong> {$connection.last_sync.label|escape:html} · {$connection.last_sync.message|escape:html}</p>
+              {if $connection.last_sync.state == 'error'}<p class="bratonien-main-cache__warning"><strong>Laufzeitfehler:</strong> {$connection.last_sync.message|escape:html}</p>{/if}
+              {if $connection.last_sync.state == 'warning'}<p class="bratonien-main-cache__warning"><strong>Laufzeitwarnung:</strong> {$connection.last_sync.message|escape:html}</p>{/if}
+              {if $connection.last_sync.api_state == 'error'}<p class="bratonien-main-cache__warning"><strong>API:</strong> {$connection.last_sync.api_message|escape:html}</p>{/if}
+              {if $connection.last_sync.fallback_state == 'error'}<p class="bratonien-main-cache__warning"><strong>Fallback:</strong> {$connection.last_sync.fallback_message|escape:html}</p>{/if}
+              {if $connection.last_sync.error_detail}<details><summary>Technische Laufzeitdetails</summary><p class="bratonien-main-cache__warning">{$connection.last_sync.error_detail|escape:html}</p></details>{/if}
+            {else}
+              <p class="bratonien-base-note"><strong>Laufzeit:</strong> Noch kein Laufstatus für diese Verbindung vorhanden.</p>
+            {/if}
+            {if isset($connection.config.api_enabled)}
+              <p class="bratonien-base-note"><strong>Piwigo-Zugang dieser Verbindung:</strong> {if $connection.config.api_enabled}eigene API{elseif $connection.fallback_stored}Fallback{else}kein Zugang gespeichert{/if}</p>
+            {else}
+              <p class="bratonien-base-note"><strong>Piwigo-Zugang:</strong> bestehende Legacy-Konfiguration</p>
+            {/if}
+            {if $connection.verification_checks|@count > 0}<details><summary>Letzte Prüfung</summary><ul>{foreach from=$connection.verification_checks item=check}<li>{if $check.ok}✓{else}✗{/if} {$check.name|escape:html}: {$check.detail|escape:html}</li>{/foreach}</ul></details>{/if}
+            <details style="margin-top:.75rem"><summary>Technische Einstellungen</summary>
+              {if $connection.enabled || $connection.takeover_state == 'active'}<p class="bratonien-main-cache__warning">Aktive Verbindungen können technisch nicht geändert werden.</p>{else}
+                <p class="bratonien-main-cache__warning">Nur ändern, wenn die technische Zuordnung bekannt ist.</p>
+                <form method="post"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><input type="hidden" name="connection_id" value="{$connection.id|escape:html}">
+                  <div class="bratonien-form-grid">
+                    <label class="bratonien-label">PostgreSQL-Host</label><input name="nc_host" type="text" value="{$connection.config.host|escape:html}" required>
+                    <label class="bratonien-label">Port</label><input name="nc_port" type="number" min="1" max="65535" value="{$connection.config.port|escape:html}" required>
+                    <label class="bratonien-label">Datenbank</label><input name="nc_database" type="text" value="{$connection.config.database|escape:html}" required>
+                    <label class="bratonien-label">Reader-Benutzer</label><input name="nc_user" type="text" value="{$connection.config.user|escape:html}" required>
+                    <label class="bratonien-label">Reader-Passwort</label><input name="nc_db_password" type="password" placeholder="leer = unverändert">
+                    <label class="bratonien-label">Source-View</label><input name="nc_source_view" type="text" value="{$connection.config.source_view|escape:html}" required>
+                    <label class="bratonien-label">Activity-View</label><input name="nc_activity_view" type="text" value="{$connection.config.activity_view|escape:html}" required>
+                    <label class="bratonien-label">Piwigo-Galeriepfad</label><input name="nc_gallery_root" type="text" value="{$connection.config.gallery_root|escape:html}" required>
+                    <label class="bratonien-label">Ruhezeit</label><input name="nc_quiet_seconds" type="number" min="0" value="{$connection.config.quiet_seconds|escape:html}">
+                    <label class="bratonien-label">Maximale Wartezeit</label><input name="nc_max_wait_seconds" type="number" min="60" value="{$connection.config.max_wait_seconds|escape:html}">
+                    <label class="bratonien-label">Vollprüfung nach</label><input name="nc_full_sync_seconds" type="number" min="300" value="{$connection.config.full_sync_seconds|escape:html}">
+                  </div>
+                  <p><strong>Storage-Zuordnungen</strong></p><p class="bratonien-base-note">Format: Storage-ID | optionales Quellpräfix | lokaler Speicherpfad</p><textarea name="nc_storages" rows="4" style="width:100%" required>{$connection.storage_text|escape:html}</textarea>
+                  <p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_update_technical">Technische Einstellungen speichern</button></p>
+                </form>
+              {/if}
+            </details>
+          </div>
+        </details>
+      {/foreach}
+    {else}<p class="bratonien-base-note">Noch keine Verbindung vorhanden.</p>{/if}
+  </div>
+
+  <details class="bratonien-card" style="margin-top:1.5rem"><summary>Erweiterte Piwigo-Zugänge</summary>
+    <h4>Piwigo API</h4>
+    <form method="post"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><div class="bratonien-form-grid"><label class="bratonien-label">API-Schlüssel-ID</label><input name="nc_piwigo_api_key_id" type="text" autocomplete="off" required><label class="bratonien-label">API-Geheimnis</label><input name="nc_piwigo_api_key_secret" type="password" autocomplete="off" required></div><div class="bratonien-actions"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_piwigo_api_test">API prüfen und speichern</button><button class="buttonLike bratonien-delete-button" type="submit" name="bratonien_tool" value="nc_connector_piwigo_api_delete" formnovalidate>Gespeicherte API löschen</button></div></form>
+    <h4 style="margin-top:1rem">Fallback speichern</h4>
+    {if $NC_CONNECTOR.connection_count > 0}<form method="post"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><div class="bratonien-form-grid"><label class="bratonien-label">Verbindung</label><select name="connection_id" required>{foreach from=$NC_CONNECTOR.connections item=connection}<option value="{$connection.id|escape:html}">{$connection.name|escape:html}</option>{/foreach}</select><label class="bratonien-label">Piwigo-Benutzer</label><input name="nc_fallback_user" type="text" autocomplete="username"><label class="bratonien-label">Piwigo-Passwort</label><input name="nc_fallback_password" type="password" autocomplete="current-password"></div><div class="bratonien-actions"><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_fallback_save">Fallback speichern</button><button class="buttonLike bratonien-delete-button" type="submit" name="bratonien_tool" value="nc_connector_fallback_delete" formnovalidate>Fallback löschen</button></div></form>{/if}
+    <h4 style="margin-top:1rem">Einmaliger Fallback-Test</h4>
+    <p class="bratonien-base-note">Verwendet die eingegebenen Piwigo-Zugangsdaten einmalig und speichert sie nicht.</p>
+    <form method="post"><input type="hidden" name="pwg_token" value="{$PWG_TOKEN|escape:html}"><div class="bratonien-form-grid"><label class="bratonien-label">Piwigo-Benutzer</label><input name="nc_fallback_user" type="text" required><label class="bratonien-label">Piwigo-Passwort</label><input name="nc_fallback_password" type="password" required></div><p><button class="buttonLike" type="submit" name="bratonien_tool" value="nc_connector_fallback_once">Einmalig testen</button></p></form>
+  </details>
+
+{literal}
+<script>
+(function(){
+  var dialog=document.getElementById('bratonien-nc-wizard-dialog');
+  var openButton=document.getElementById('bratonien-nc-wizard-open');
+  var closeButton=document.getElementById('bratonien-nc-wizard-close');
+  var technicalButton=document.getElementById('bratonien-nc-technical-open');
+  var technical=document.getElementById('bratonien-nc-technical-create');
+  var key='bratonienNcWizardOpen';
+  function openWizard(){try{sessionStorage.setItem(key,'1');}catch(e){} if(typeof dialog.showModal==='function'&&!dialog.open)dialog.showModal();else dialog.setAttribute('open','open');}
+  function closeWizard(){try{sessionStorage.removeItem(key);}catch(e){} if(typeof dialog.close==='function')dialog.close();else dialog.removeAttribute('open');}
+  if(openButton&&dialog)openButton.addEventListener('click',openWizard);
+  if(closeButton&&dialog)closeButton.addEventListener('click',closeWizard);
+  if(dialog){
+    dialog.addEventListener('cancel',function(){try{sessionStorage.removeItem(key);}catch(e){}});
+    dialog.addEventListener('click',function(e){if(e.target===dialog)closeWizard();});
+    dialog.querySelectorAll('form[data-bratonien-wizard-form]').forEach(function(form){form.addEventListener('submit',function(e){var s=e.submitter;try{if(s&&s.hasAttribute('data-bratonien-wizard-end'))sessionStorage.removeItem(key);else sessionStorage.setItem(key,'1');}catch(x){}});});
+    try{if(sessionStorage.getItem(key)==='1')openWizard();}catch(e){}
+  }
+  if(technicalButton&&technical)technicalButton.addEventListener('click',function(){technical.open=!technical.open;if(technical.open)technical.scrollIntoView(true);});
+})();
+</script>
+{/literal}
 </section>

tools/album_rules.inc.php

@@ -61,6 +61,7 @@ function bratonien_tools_save_album_rule()
     )));
   }
 
+  bratonien_tools_clear_watermark_cache();
   return array('message'=>'Albumregel gespeichert.');
 }
 
@@ -93,7 +94,34 @@ function bratonien_tools_resolve_album_rule($category_id, array $categories, arr
     $by_id[(int)$category['id']] = $category;
   }
 
-  $current = (int)$category_id;
+  $category_id = (int)$category_id;
+  $root = $by_id[$category_id] ?? null;
+  $is_private = $root && isset($root['status']) && $root['status'] === 'private';
+
+  if ($is_private)
+  {
+    if (isset($rules[$category_id]))
+    {
+      $rule = $rules[$category_id];
+      if ($rule['mode'] === 'disabled')
+      {
+        return array('mode'=>'disabled','profile_id'=>null,'source'=>'album');
+      }
+      if ($rule['mode'] === 'profile')
+      {
+        return array('mode'=>'profile','profile_id'=>(int)$rule['profile_id'],'source'=>'album');
+      }
+    }
+
+    $profile_id = $defaults['private_profile'] ?? null;
+    if (empty($profile_id))
+    {
+      return array('mode'=>'disabled','profile_id'=>null,'source'=>'global');
+    }
+    return array('mode'=>'profile','profile_id'=>(int)$profile_id,'source'=>'global');
+  }
+
+  $current = $category_id;
   $visited = array();
 
   while ($current > 0 && isset($by_id[$current]) && !isset($visited[$current]))
@@ -116,10 +144,7 @@ function bratonien_tools_resolve_album_rule($category_id, array $categories, arr
     $current = (int)($by_id[$current]['id_uppercat'] ?? 0);
   }
 
-  $root = $by_id[(int)$category_id] ?? null;
-  $is_private = $root && isset($root['status']) && $root['status'] === 'private';
-  $profile_id = $is_private ? ($defaults['private_profile'] ?? null) : ($defaults['public_profile'] ?? null);
-
+  $profile_id = $defaults['public_profile'] ?? null;
   if (empty($profile_id))
   {
     return array('mode'=>'disabled','profile_id'=>null,'source'=>'global');

tools/watermark_profiles.inc.php

@@ -128,6 +128,7 @@ function bratonien_tools_save_watermark_profile()
     mass_inserts($table, array_keys($data), array($data));
   }
 
+  bratonien_tools_clear_watermark_cache();
   return array('message'=>'Wasserzeichenprofil gespeichert.');
 }
 
@@ -158,6 +159,7 @@ function bratonien_tools_delete_watermark_profile()
   }
 
   pwg_query('DELETE FROM '.bratonien_tools_table('watermark_profiles').' WHERE id='.$id);
+  bratonien_tools_clear_watermark_cache();
   return array('message'=>'Wasserzeichenprofil geloescht.');
 }
 
@@ -174,6 +176,7 @@ function bratonien_tools_duplicate_watermark_profile()
   $profile['name'] .= ' (Kopie)';
   $profile['created'] = date('Y-m-d H:i:s');
   mass_inserts(bratonien_tools_table('watermark_profiles'), array_keys($profile), array($profile));
+  bratonien_tools_clear_watermark_cache();
 
   return array('message'=>'Wasserzeichenprofil dupliziert.');
 }

tools/watermark_settings.inc.php

@@ -4,6 +4,59 @@ if (!defined('PHPWG_ROOT_PATH'))
   die('Hacking attempt!');
 }
 
+function bratonien_tools_watermark_cache_dir()
+{
+  return PHPWG_ROOT_PATH.PWG_DERIVATIVE_DIR.'bratonien-watermark';
+}
+
+function bratonien_tools_remove_tree($path)
+{
+  $path = rtrim((string)$path, DIRECTORY_SEPARATOR);
+  if ($path === '' || !file_exists($path)) return;
+
+  if (is_file($path) || is_link($path))
+  {
+    @unlink($path);
+    return;
+  }
+
+  foreach (scandir($path) ?: array() as $entry)
+  {
+    if ($entry === '.' || $entry === '..') continue;
+    bratonien_tools_remove_tree($path.DIRECTORY_SEPARATOR.$entry);
+  }
+  @rmdir($path);
+}
+
+function bratonien_tools_clear_watermark_cache()
+{
+  $dir = bratonien_tools_watermark_cache_dir();
+  $derivative_root = realpath(PHPWG_ROOT_PATH.PWG_DERIVATIVE_DIR);
+  $parent = realpath(dirname($dir));
+
+  if ($derivative_root === false || $parent === false || $parent !== $derivative_root)
+  {
+    throw new RuntimeException('Wasserzeichen-Cachepfad ist ungueltig.');
+  }
+
+  if (is_dir($dir))
+  {
+    bratonien_tools_remove_tree($dir);
+  }
+}
+
+function bratonien_tools_watermark_cache_upgrade()
+{
+  $version = '0.9.7.13';
+  if ((string)conf_get_param('bratonien_watermark_cache_version', '') === $version)
+  {
+    return;
+  }
+
+  bratonien_tools_clear_watermark_cache();
+  conf_update_param('bratonien_watermark_cache_version', $version);
+}
+
 function bratonien_tools_get_watermark_defaults()
 {
   $defaults = conf_get_param('bratonien_watermark_defaults', null);
@@ -40,6 +93,7 @@ function bratonien_tools_save_watermark_defaults()
   );
 
   conf_update_param('bratonien_watermark_defaults', json_encode($config));
+  bratonien_tools_clear_watermark_cache();
 
   return array('message'=>'Globale Wasserzeichenregeln gespeichert.');
 }

webdav-derivative.php

@@ -0,0 +1,144 @@
+<?php
+define('PHPWG_ROOT_PATH', '../../');
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  define('BRATONIEN_TOOLS_ID', basename(__DIR__));
+  define('BRATONIEN_TOOLS_PATH', PHPWG_ROOT_PATH.'plugins/'.BRATONIEN_TOOLS_ID.'/');
+}
+
+require_once(BRATONIEN_TOOLS_PATH.'include/webdav_image_runtime.inc.php');
+require_once(BRATONIEN_TOOLS_PATH.'include/webdav_gallery_runtime.inc.php');
+
+function bratonien_tools_webdav_derivative_abort($status, $message)
+{
+  http_response_code((int)$status);
+  header('Content-Type: text/plain; charset=utf-8');
+  header('Cache-Control: no-store');
+  echo $message;
+  exit;
+}
+
+function bratonien_tools_webdav_derivative_fallback($image_id)
+{
+  $url = bratonien_tools_webdav_image_url((int)$image_id, false);
+  if (!$url)
+  {
+    bratonien_tools_webdav_derivative_abort(404, 'WebDAV-Bildquelle ist nicht verfuegbar.');
+  }
+
+  header('Cache-Control: no-store');
+  header('Location: '.$url, true, 302);
+  exit;
+}
+
+$image_id = (int)($_GET['id'] ?? 0);
+$type = trim((string)($_GET['type'] ?? ''));
+if ($image_id < 1 || $type === '')
+{
+  bratonien_tools_webdav_derivative_abort(400, 'Bild-ID oder Derivattyp fehlt.');
+}
+
+$permission_condition = get_sql_condition_FandF(array('forbidden_categories'=>'category_id'), null, true);
+$access_result = pwg_query('SELECT 1 FROM '.IMAGE_CATEGORY_TABLE.' WHERE image_id='.$image_id.' AND '.$permission_condition.' LIMIT 1');
+if (!pwg_db_num_rows($access_result))
+{
+  bratonien_tools_webdav_derivative_abort(403, 'Kein Zugriff auf dieses Bild.');
+}
+
+if (!class_exists('ImageStdParams') || !class_exists('DerivativeImage') || !class_exists('SrcImage'))
+{
+  require_once(PHPWG_ROOT_PATH.'include/derivative.inc.php');
+}
+
+$params = @ImageStdParams::get_by_type($type);
+if (!$params)
+{
+  bratonien_tools_webdav_derivative_abort(404, 'Unbekannter Piwigo-Derivattyp.');
+}
+
+$result = pwg_query('SELECT * FROM '.IMAGES_TABLE.' WHERE id='.$image_id.' LIMIT 1');
+if (!pwg_db_num_rows($result))
+{
+  bratonien_tools_webdav_derivative_abort(404, 'Bild wurde nicht gefunden.');
+}
+$row = pwg_db_fetch_assoc($result);
+$src = new SrcImage($row);
+$info = bratonien_tools_webdav_image_source_info($image_id);
+if (!$info)
+{
+  bratonien_tools_webdav_derivative_abort(404, 'Keine WebDAV-Quelle fuer dieses Bild gefunden.');
+}
+
+$preview = bratonien_tools_webdav_preview_path($info);
+if (!$preview || !is_file($preview) || !is_readable($preview))
+{
+  // Altbestand kann noch keinen vorbereiteten Preview-Cache besitzen. Der
+  // fokussierte Fotorama-Request darf dann nicht mit 404 enden, weil Fotorama
+  // den fehlgeschlagenen Frame sonst nicht erneut laedt. Stattdessen wird nur
+  // fuer dieses angeforderte Bild auf die echte WebDAV-Quelle ausgewichen.
+  bratonien_tools_webdav_derivative_fallback($image_id);
+}
+
+$derivative = new DerivativeImage($params, $src);
+if ($derivative->same_as_source())
+{
+  // Niemals die lokale Connector-Platzhalterquelle ausliefern.
+  bratonien_tools_webdav_derivative_fallback($image_id);
+}
+
+$target = $derivative->get_path();
+if ($target === '')
+{
+  bratonien_tools_webdav_derivative_fallback($image_id);
+}
+
+if (!bratonien_tools_webdav_derivative_matches_preview($target, $params, $image_id))
+{
+  if (is_file($target))
+  {
+    @unlink($target);
+    clearstatcache(true, $target);
+  }
+
+  $detail = '';
+  if (!bratonien_tools_webdav_generate_derivative($params, $src, $detail))
+  {
+    error_log('Bratonien WebDAV on-demand derivative #'.$image_id.' type='.$type.': '.$detail);
+    bratonien_tools_webdav_derivative_fallback($image_id);
+  }
+}
+
+if (!bratonien_tools_webdav_derivative_matches_preview($target, $params, $image_id))
+{
+  bratonien_tools_webdav_derivative_fallback($image_id);
+}
+
+$size = @filesize($target);
+$mtime = @filemtime($target) ?: time();
+$etag = sha1($target.'|'.$mtime.'|'.($size ?: 0));
+$extension = strtolower(pathinfo($target, PATHINFO_EXTENSION));
+$content_type = 'image/jpeg';
+if ($extension === 'png') $content_type = 'image/png';
+elseif ($extension === 'gif') $content_type = 'image/gif';
+elseif ($extension === 'webp') $content_type = 'image/webp';
+
+header('Content-Type: '.$content_type);
+if ($size !== false) header('Content-Length: '.(string)$size);
+header('ETag: "'.$etag.'"');
+header('Last-Modified: '.gmdate('D, d M Y H:i:s', $mtime).' GMT');
+header('Cache-Control: private, max-age=86400, must-revalidate');
+header('X-Content-Type-Options: nosniff');
+
+$client_etag = trim((string)($_SERVER['HTTP_IF_NONE_MATCH'] ?? ''), " \t\r\n\"");
+if ($client_etag !== '' && hash_equals($etag, $client_etag))
+{
+  http_response_code(304);
+  exit;
+}
+
+if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'HEAD')
+{
+  readfile($target);
+}

webdav-image.php

@@ -0,0 +1,175 @@
+<?php
+define('PHPWG_ROOT_PATH', '../../');
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  define('BRATONIEN_TOOLS_ID', basename(__DIR__));
+  define('BRATONIEN_TOOLS_PATH', PHPWG_ROOT_PATH.'plugins/'.BRATONIEN_TOOLS_ID.'/');
+}
+require_once(BRATONIEN_TOOLS_PATH.'include/webdav_image_runtime.inc.php');
+require_once(BRATONIEN_TOOLS_PATH.'include/nc_transport.inc.php');
+
+function bratonien_tools_webdav_image_abort($status, $message)
+{
+  http_response_code((int)$status);
+  header('Content-Type: text/plain; charset=utf-8');
+  header('Cache-Control: no-store');
+  echo $message;
+  exit;
+}
+
+function bratonien_tools_webdav_image_decrypt_secret($blob, $hex_key)
+{
+  $hex_key = trim((string)$hex_key);
+  if (!preg_match('/^[a-f0-9]{64}$/', $hex_key)) return null;
+  $outer = base64_decode(trim((string)$blob), true);
+  $payload = is_string($outer) ? json_decode($outer, true) : null;
+  if (!is_array($payload) || (int)($payload['v'] ?? 0) !== 1) return null;
+  $iv = base64_decode((string)($payload['iv'] ?? ''), true);
+  $tag = base64_decode((string)($payload['tag'] ?? ''), true);
+  $cipher = base64_decode((string)($payload['data'] ?? ''), true);
+  if (!is_string($iv) || !is_string($tag) || !is_string($cipher)) return null;
+  $plain = openssl_decrypt($cipher, 'aes-256-gcm', hex2bin($hex_key), OPENSSL_RAW_DATA, $iv, $tag);
+  if ($plain === false) return null;
+  $decoded = json_decode((string)$plain, true);
+  return is_array($decoded) ? $decoded : null;
+}
+
+function bratonien_tools_webdav_image_quote_path($path)
+{
+  $parts = array_values(array_filter(explode('/', trim((string)$path, '/')), 'strlen'));
+  return implode('/', array_map('rawurlencode', $parts));
+}
+
+$image_id = (int)($_GET['id'] ?? 0);
+if ($image_id < 1) bratonien_tools_webdav_image_abort(400, 'Bild-ID fehlt.');
+
+$permission_condition = get_sql_condition_FandF(array('forbidden_categories'=>'category_id'), null, true);
+$access_result = pwg_query('SELECT 1 FROM '.IMAGE_CATEGORY_TABLE.' WHERE image_id='.$image_id.' AND '.$permission_condition.' LIMIT 1');
+if (!pwg_db_num_rows($access_result)) bratonien_tools_webdav_image_abort(403, 'Kein Zugriff auf dieses Bild.');
+
+$source = bratonien_tools_webdav_image_source_info($image_id);
+if (!$source) bratonien_tools_webdav_image_abort(404, 'Keine WebDAV-Quelle für dieses Bild gefunden.');
+
+if (!empty($_GET['preview']))
+{
+  $preview = bratonien_tools_webdav_preview_path($source);
+  if ($preview)
+  {
+    $mtime = @filemtime($preview) ?: time();
+    $etag = sha1($preview.'|'.$mtime.'|'.(@filesize($preview) ?: 0));
+    header('Content-Type: '.bratonien_tools_webdav_preview_content_type($preview));
+    header('Content-Length: '.(string)filesize($preview));
+    header('ETag: "'.$etag.'"');
+    header('Cache-Control: private, max-age=86400, must-revalidate');
+    header('X-Content-Type-Options: nosniff');
+    $client_etag = trim((string)($_SERVER['HTTP_IF_NONE_MATCH'] ?? ''), " \t\r\n\"");
+    if ($client_etag !== '' && hash_equals($etag, $client_etag))
+    {
+      http_response_code(304);
+      exit;
+    }
+    if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'HEAD') readfile($preview);
+    exit;
+  }
+}
+
+$table = $GLOBALS['prefixeTable'].'bratonien_tools_nc_connections';
+$result = pwg_query('SELECT config_json, secret_blob FROM `'.$table.'` WHERE id='.(int)$source['connection_id'].' LIMIT 1');
+if (!pwg_db_num_rows($result)) bratonien_tools_webdav_image_abort(404, 'WebDAV-Verbindung nicht gefunden.');
+$row = pwg_db_fetch_assoc($result);
+$config = json_decode((string)$row['config_json'], true);
+if (!is_array($config)) bratonien_tools_webdav_image_abort(500, 'WebDAV-Konfiguration ist ungültig.');
+
+$key_result = pwg_query("SELECT value FROM ".$GLOBALS['prefixeTable']."config WHERE param='bratonien_nc_connector_secret' LIMIT 1");
+if (!pwg_db_num_rows($key_result)) bratonien_tools_webdav_image_abort(500, 'Connector-Schlüssel fehlt.');
+$key_row = pwg_db_fetch_assoc($key_result);
+$credentials = bratonien_tools_webdav_image_decrypt_secret((string)$row['secret_blob'], (string)$key_row['value']);
+if (!is_array($credentials)) bratonien_tools_webdav_image_abort(500, 'WebDAV-Zugangsdaten konnten nicht gelesen werden.');
+
+$base_url = rtrim((string)($config['nextcloud_url'] ?? ''), '/');
+$user = trim((string)($credentials['nextcloud_user'] ?? ''));
+$password = (string)($credentials['nextcloud_password'] ?? '');
+$webdav_path = trim((string)$source['webdav_path'], '/');
+if ($base_url === '' || $user === '' || $password === '' || $webdav_path === '')
+{
+  bratonien_tools_webdav_image_abort(500, 'WebDAV-Bildquelle ist unvollständig.');
+}
+
+$etag = trim((string)($source['etag'] ?? ''));
+if ($etag !== '')
+{
+  header('ETag: "'.str_replace('"', '', $etag).'"');
+  $client_etag = trim((string)($_SERVER['HTTP_IF_NONE_MATCH'] ?? ''), " \t\r\n\"");
+  if ($client_etag !== '' && hash_equals($etag, $client_etag))
+  {
+    http_response_code(304);
+    exit;
+  }
+}
+header('Cache-Control: private, max-age=300, must-revalidate');
+header('X-Content-Type-Options: nosniff');
+
+$url = $base_url.'/remote.php/dav/files/'.rawurlencode($user).'/'.bratonien_tools_webdav_image_quote_path($webdav_path);
+$ch = curl_init($url);
+$options = array(
+  CURLOPT_FOLLOWLOCATION => false,
+  CURLOPT_CONNECTTIMEOUT => 10,
+  CURLOPT_TIMEOUT => 120,
+  CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
+  CURLOPT_USERPWD => $user.':'.$password,
+  CURLOPT_RETURNTRANSFER => false,
+  CURLOPT_FAILONERROR => false,
+  CURLOPT_USERAGENT => 'Bratonien-Tools-WebDAV-Image/0.9.7.1',
+  CURLOPT_HEADERFUNCTION => function($ch, $line)
+  {
+    $length = strlen($line);
+    $trimmed = trim($line);
+    if ($trimmed === '') return $length;
+    if (preg_match('#^HTTP/\S+\s+([0-9]{3})#i', $trimmed, $m))
+    {
+      http_response_code((int)$m[1]);
+      return $length;
+    }
+    $colon = strpos($line, ':');
+    if ($colon === false) return $length;
+    $name = strtolower(trim(substr($line, 0, $colon)));
+    $value = trim(substr($line, $colon + 1));
+    if (in_array($name, array('content-type','content-length','content-range','accept-ranges','last-modified'), true))
+    {
+      header($name.': '.$value, true);
+    }
+    return $length;
+  },
+  CURLOPT_WRITEFUNCTION => function($ch, $data)
+  {
+    echo $data;
+    return strlen($data);
+  },
+);
+bratonien_tools_nc_transport_apply_curl($options, $url);
+if (!empty($_SERVER['HTTP_RANGE']))
+{
+  $range = trim((string)$_SERVER['HTTP_RANGE']);
+  if (preg_match('/^bytes=(.+)$/i', $range, $m)) $options[CURLOPT_RANGE] = $m[1];
+}
+if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'HEAD')
+{
+  $options[CURLOPT_NOBODY] = true;
+}
+curl_setopt_array($ch, $options);
+$ok = curl_exec($ch);
+$errno = curl_errno($ch);
+$http = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
+curl_close($ch);
+
+if ($ok === false || $errno !== 0)
+{
+  if (!headers_sent()) bratonien_tools_webdav_image_abort(502, 'Nextcloud-Bild konnte nicht geladen werden.');
+  exit;
+}
+if ($http < 200 || $http >= 400)
+{
+  exit;
+}