Added CI/CD workflow

feat: add downloadable publication library

.forgejo/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  ci:
+    # This label must point to an isolated runner that has Node.js, Git,
+    # the Docker CLI, and access to a Docker/Podman daemon.
+    runs-on: docker-build
+
+    steps:
+      - name: Check out repository
+        uses: https://data.forgejo.org/actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: https://data.forgejo.org/actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build and test
+        run: npm test
+
+      - name: Build container image
+        run: docker build --tag webstack-author:ci .

Dockerfile

@@ -6,8 +6,8 @@ WORKDIR /app
 # Copy dependency manifests
 COPY package*.json ./
 
-# Install all dependencies
+# Install exactly the dependency versions recorded in package-lock.json
-RUN npm install
+RUN npm ci
 
 # Copy full application codebase
 COPY . .
@@ -23,8 +23,8 @@ WORKDIR /app
 # Copy configuration files
 COPY package*.json ./
 
-# Install only production dependencies (Express, dotenv, @google/genai)
+# Install exactly the locked production dependencies
-RUN npm install --omit=dev
+RUN npm ci --omit=dev
 
 # Copy compiled build resources from builder stage
 COPY --from=builder /app/dist ./dist

README.md

@@ -9,12 +9,19 @@ Technisch besteht die Anwendung aus einem React-/Tailwind-Frontend und einem Exp
 - Mehrere unabhängig konfigurierte Autorenprofile mit eigenen Domains und Themes
 - Biografie, Schlagworte, individuelle Texte und optionale Zusatzsektion mit bis zu drei CTA-Buttons
 - Bücherregal mit Detailansicht, Cover, Kauflink und optionaler Spotify-Playlist
+- Buchreihen mit Serienname und automatisch sortierter Bandnummer
+- getrennte KDP-Links für E-Book und Taschenbuch
+- optionaler, lokal gehosteter PDF-Leseproben-Download pro Buch
+- optionaler Kurzgeschichten- und Download-Bereich mit PDF und ePUB
 - Aktuelle Projekte mit Fortschritt, Markdown-Detailtext, Bild und optionaler Spotify-Playlist
 - Lokaler Bild-Upload über den Adminbereich
 - Verwaltung von Impressum, Datenschutzerklärung und weiteren Rechtstexten
 - Optionale serverseitige Gemini-Unterstützung für Klappentexte
 - Profilabhängige SEO-Metadaten, Open Graph, strukturierte Daten, Sitemap und `robots.txt`
 - Health-Endpunkte, persistente JSON-Datenhaltung und automatische Migrationsbackups
+- optionale Kontaktsektion je Profil für E-Mail, Instagram, Threads und Discord
+- adressierbare und teilbare Buch-/Projektansichten
+- neutrale, nicht indexierbare 404-Seite ohne Hinweise auf andere Profile
 
 ## Trennung der Profile
 
@@ -46,6 +53,7 @@ src/defaultData.ts                 Ausgangsdaten für eine neue Installation
 server.ts                           API, Routing, Sessions, Uploads und SEO
 data/database.json                 Persistente Inhaltsdaten
 data/uploads/                       Lokal hochgeladene Bilder
+data/downloads/                     Lokal hochgeladene PDF-Leseproben
 data/backups/                       Automatische Migrationsbackups
 tests/                              Integrations- und Sicherheitstests
 ```
@@ -133,6 +141,7 @@ Für ein vollständiges Backup sollte der gesamte Ordner `data/` gesichert werde
 ```text
 data/database.json
 data/uploads/
+data/downloads/
 data/backups/
 ```
 
@@ -159,6 +168,30 @@ Im zusätzlichen Textabschnitt eines Profils können bis zu drei CTA-Buttons gep
 
 Die Buttons öffnen das Ziel in einem neuen Tab und werden automatisch mit den Akzentfarben des Profils gestaltet. Auf kleinen Bildschirmen stehen sie untereinander, auf größeren Bildschirmen nebeneinander. Damit können ausgewählte Pseudonyme bewusst miteinander verknüpft werden, ohne dass daraus eine automatische Verlinkung zu weiteren Profilen entsteht.
 
+## Kontakt und Social Media
+
+Jedes Profil kann unabhängig eine Kontakt-E-Mail-Adresse sowie Links zu Instagram, Threads und Discord erhalten. Der Abschnitt erscheint unterhalb des zusätzlichen Textmoduls und zeigt nur tatsächlich gepflegte Angaben. Es gibt bewusst kein serverseitiges Kontaktformular; dadurch entstehen weder Spam-Endpunkt noch zusätzliche gespeicherte Kontaktdaten.
+
+## Buchreihen, KDP-Links und Leseproben
+
+Bücher können optional einem Seriennamen und einer Bandnummer zugeordnet werden. Serien werden im öffentlichen Bücherregal nach Name und Bandnummer sortiert; Einzelbände behalten ihre vorhandene Reihenfolge. Für den Bezug stehen getrennte Links für E-Book und Taschenbuch zur Verfügung. Der historische einzelne Kauflink bleibt für bestehende Daten als E-Book-Fallback kompatibel.
+
+Pro Buch kann im Adminbereich eine PDF-Leseprobe mit maximal 10 MB hochgeladen werden. Der Server prüft Dateiendung, MIME-Uploadformat und PDF-Dateikopf und liefert die Datei als Download mit `nosniff` aus. Ohne hinterlegte Datei erscheint kein Leseproben-Button. PDF-Dateien liegen getrennt von Bildern unter `data/downloads/` und müssen daher in Backups eingeschlossen werden.
+
+## Kurzgeschichten und Downloads
+
+Jedes Profil kann einen eigenen optionalen Download-Bereich pflegen. Einträge bestehen aus Titel, kurzer Markdown-Beschreibung, optionalem Veröffentlichungsdatum, optionalem Bild sowie einer PDF- und/oder ePUB-Datei. Ein Eintrag ohne verfügbare Datei wird öffentlich nicht angezeigt; ohne Einträge verschwinden der gesamte Abschnitt und sein Navigationslink.
+
+Öffentlich erscheinen zunächst höchstens drei Karten. Bei weiteren Einträgen können Besucher mit „Alle Kurzgeschichten anzeigen“ die vollständige Liste einblenden und anschließend wieder einklappen. Die Reihenfolge wird im Adminbereich explizit über Hoch-/Runter-Aktionen gepflegt; neu angelegte Downloads stehen zunächst oben.
+
+PDF und ePUB werden getrennt validiert, lokal unter `data/downloads/` gespeichert und direkt als Download ausgeliefert. Beide Formate sind auf 10 MB begrenzt. Der Server prüft bei PDF den Dateikopf und bei ePUB die ZIP-/ePUB-Struktur. Ersetzte oder gelöschte Dateien werden entfernt, sobald kein veröffentlichter Eintrag mehr auf sie verweist.
+
+## Teilbare Detailansichten
+
+Buch- und Projektmodale besitzen adressierbare URLs über `?book=<id>` beziehungsweise `?project=<id>`. Auf geeigneten Mobilgeräten öffnet „Teilen“ den nativen Teilen-Dialog; andernfalls wird die aktuelle URL in die Zwischenablage kopiert. Die URL enthält nur die ID innerhalb des aktuell aufgerufenen Profils und ermöglicht keinen Zugriff auf andere Profile.
+
+Unbekannte Produktionspfade liefern HTTP 404, `noindex` und eine profilneutrale Fehlerseite. Lokale pfadbasierte Entwicklungsvorschauen bleiben davon unberührt.
+
 ## Spotify und externe Dienste
 
 Spotify-Playlists werden sowohl in Buch- als auch in Projektdetails nach dem Zwei-Klick-Prinzip eingebunden. Beim Öffnen eines Details erscheint zunächst nur ein lokaler Platzhalter. Erst nach einem bewussten Klick auf „Spotify-Player laden“ wird das Spotify-`iframe` erzeugt und eine Verbindung zu Spotify hergestellt.
@@ -167,6 +200,7 @@ Weitere mögliche externe Verbindungen:
 
 - `GEMINI_API_KEY`: Der optionale Admin-Assistent sendet die eingegebenen Buchinformationen serverseitig an die Google-Gemini-API.
 - Kauf- und sonstige Markdown-Links: Erst ein Klick führt zur jeweiligen externen Website.
+- Instagram-, Threads-, Discord- und bewusst gepflegte Profilverlinkungen: Eine Verbindung entsteht erst beim Klick.
 - Externe Bild-URLs: Das System unterstützt sie weiterhin, empfohlen werden jedoch lokal hochgeladene Bilder.
 
 Die Anwendung enthält kein Analytics- oder Tracking-System und lädt keine externen Webfonts. Sie verwendet für Besucher weder `localStorage` noch `sessionStorage`. Der Browser speichert lediglich das notwendige Admin-Sitzungscookie nach einer Anmeldung. Diese Punkte sowie das übliche Logging des Reverse Proxys/Hosters sollten passend zur tatsächlichen Installation in der Datenschutzerklärung beschrieben werden.
@@ -199,6 +233,7 @@ Die Integrationstests verwenden ein temporäres Datenverzeichnis und einen kurzl
 - Revisionskonflikte und serverseitige Inhaltsvalidierung,
 - gültige und manipulierte Bild-Uploads,
 - Löschung unbenutzter sowie Schutz referenzierter Uploads,
+- validierte PDF-/ePUB-Uploads und Schutz referenzierter Download-Dateien,
 - wesentliche Sicherheitsheader.
 
 ## Hinweise zur Aktualisierung

server.ts

@@ -5,7 +5,7 @@ import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import dotenv from "dotenv";
 import { GoogleGenAI } from "@google/genai";
 import { defaultAuthorData } from "./src/defaultData.js";
-import { AuthorData, AuthorProfile, CustomSectionLink, PortfolioTheme, PublicAuthorData } from "./src/types.js";
+import { AuthorData, AuthorProfile, CustomSectionLink, DownloadPublication, PortfolioTheme, PublicAuthorData } from "./src/types.js";
 
 dotenv.config();
 
@@ -16,6 +16,7 @@ const PORT = Number.parseInt(process.env.PORT || "3000", 10);
 const DATA_DIR = path.resolve(process.env.DATA_DIR || path.join(process.cwd(), "data"));
 const DATA_FILE = path.join(DATA_DIR, "database.json");
 const BACKUP_DIR = path.join(DATA_DIR, "backups");
+const DOWNLOAD_DIR = path.join(DATA_DIR, "downloads");
 const CURRENT_SCHEMA_VERSION = 2;
 const LEGACY_DEFAULT_IMAGE_URLS = new Set([
   "https://images.unsplash.com/photo-1535713875002-d1d0cf377fde?auto=format&fit=crop&q=80&w=300",
@@ -43,7 +44,10 @@ const GEMINI_MAX_REQUESTS = 20;
 const UPLOAD_WINDOW_MS = 60 * 60 * 1000;
 const UPLOAD_MAX_REQUESTS = 30;
 const MAX_UPLOAD_BYTES = 8 * 1024 * 1024;
+const MAX_PDF_BYTES = 10 * 1024 * 1024;
 const SAFE_UPLOAD_NAME = /^(?!\.)[a-zA-Z0-9._-]+\.(?:jpe?g|png|webp|gif|avif)$/i;
+const SAFE_PDF_NAME = /^(?!\.)[a-zA-Z0-9._-]+\.pdf$/i;
+const SAFE_DOWNLOAD_NAME = /^(?!\.)[a-zA-Z0-9._-]+\.(?:pdf|epub)$/i;
 
 interface SessionRecord {
   expiresAt: number;
@@ -121,6 +125,7 @@ async function createMigrationBackup(rawData: string): Promise<void> {
 async function initDatabase(): Promise<AuthorData> {
   await fs.mkdir(DATA_DIR, { recursive: true });
   await fs.mkdir(path.join(DATA_DIR, "uploads"), { recursive: true });
+  await fs.mkdir(DOWNLOAD_DIR, { recursive: true });
   try {
       const existingData = await fs.readFile(DATA_FILE, "utf-8");
       if (!existingData.trim()) {
@@ -261,7 +266,7 @@ app.use((_req, res, next) => {
   }
   next();
 });
-app.use(express.json({ limit: "12mb" }));
+app.use(express.json({ limit: "15mb" }));
 
 // Initialize Google GenAI if API key exists
 const getGeminiClient = () => {
@@ -530,6 +535,7 @@ function validateProfile(profile: unknown): string | null {
   const value = profile as AuthorProfile;
   if (!Array.isArray(value.books) || value.books.length > 500) return "Die Bücherliste ist ungültig oder zu groß.";
   if (!Array.isArray(value.projects) || value.projects.length > 200) return "Die Projektliste ist ungültig oder zu groß.";
+  if (value.downloads !== undefined && (!Array.isArray(value.downloads) || value.downloads.length > 200)) return "Die Downloadliste ist ungültig oder zu groß.";
   const requiredStrings: Array<[unknown, string, number]> = [
     [value.name, "Name", 200], [value.bio, "Biografie", 50_000],
     [value.heroTitle, "Hero-Titel", 500], [value.heroSubtitle, "Hero-Untertitel", 500],
@@ -540,6 +546,8 @@ function validateProfile(profile: unknown): string | null {
   if (!isSafeContentUrl(value.avatarUrl) || !isSafeContentUrl(value.heroBannerUrl) || !isSafeContentUrl(value.socialImageUrl)) {
     return "Mindestens eine Bild-URL ist ungültig.";
   }
+  if (value.contactEmail && (value.contactEmail.length > 320 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.contactEmail))) return "Die Kontakt-E-Mail-Adresse ist ungültig.";
+  if (!isSafeContentUrl(value.instagramUrl) || !isSafeContentUrl(value.threadsUrl) || !isSafeContentUrl(value.discordUrl)) return "Mindestens ein Social-Media-Link ist ungültig.";
   if (value.fontFamily && !["sans", "serif", "mono"].includes(value.fontFamily)) return "Die Schriftart ist ungültig.";
   for (const project of value.projects) {
     if (!project || typeof project.id !== "string" || typeof project.title !== "string" || project.title.length > 500 ||
@@ -552,11 +560,26 @@ function validateProfile(profile: unknown): string | null {
   for (const book of value.books) {
     if (!book || typeof book.id !== "string" || typeof book.title !== "string" || book.title.length > 500 ||
         typeof book.description !== "string" || book.description.length > 100_000 ||
-        !isSafeContentUrl(book.coverUrl) || !isSafeContentUrl(book.buyLink) || !isSafeContentUrl(book.spotifyPlaylistId, true) ||
+        !isSafeContentUrl(book.coverUrl) || !isSafeContentUrl(book.buyLink) || !isSafeContentUrl(book.ebookLink) || !isSafeContentUrl(book.paperbackLink) ||
+        (book.samplePdfUrl !== undefined && book.samplePdfUrl !== "" && (typeof book.samplePdfUrl !== "string" || !book.samplePdfUrl.startsWith("/downloads/") || !SAFE_PDF_NAME.test(path.basename(book.samplePdfUrl)))) ||
+        !isSafeContentUrl(book.spotifyPlaylistId, true) ||
+        (book.seriesName !== undefined && (typeof book.seriesName !== "string" || book.seriesName.length > 300)) ||
+        (book.seriesNumber !== undefined && book.seriesNumber !== "" && (!Number.isFinite(Number(book.seriesNumber)) || Number(book.seriesNumber) < 0 || Number(book.seriesNumber) > 999)) ||
         (book.genres !== undefined && (!Array.isArray(book.genres) || book.genres.length > 20 || book.genres.some((genre) => typeof genre !== "string" || genre.length > 100)))) {
       return "Mindestens ein Buch enthält ungültige Werte.";
     }
   }
+  for (const download of value.downloads || []) {
+    if (!download || typeof download.id !== "string" || download.id.length > 200 ||
+        typeof download.title !== "string" || !download.title.trim() || download.title.length > 500 ||
+        typeof download.description !== "string" || download.description.length > 50_000 ||
+        !isSafeContentUrl(download.imageUrl) ||
+        (download.pdfUrl !== undefined && download.pdfUrl !== "" && (typeof download.pdfUrl !== "string" || !download.pdfUrl.startsWith("/downloads/") || !SAFE_PDF_NAME.test(path.basename(download.pdfUrl)))) ||
+        (download.epubUrl !== undefined && download.epubUrl !== "" && (typeof download.epubUrl !== "string" || !download.epubUrl.startsWith("/downloads/") || !/\.epub$/i.test(path.basename(download.epubUrl)))) ||
+        (download.publishedAt !== undefined && (typeof download.publishedAt !== "string" || download.publishedAt.length > 50))) {
+      return "Mindestens ein Download enthält ungültige Werte.";
+    }
+  }
   return null;
 }
 
@@ -583,6 +606,11 @@ function isUploadReferenced(url: string): boolean {
   });
 }
 
+function isDownloadReferenced(url: string): boolean {
+  return profileKeys.some((key) => dbCache[key].books.some((book) => book.samplePdfUrl === url) ||
+    (dbCache[key].downloads || []).some((download: DownloadPublication) => download.pdfUrl === url || download.epubUrl === url));
+}
+
 function seoMeta(req: express.Request, scriptNonce?: string): string {
   const key = profileForRequest(req.hostname, req.path);
   const profile = dbCache[key];
@@ -910,6 +938,132 @@ app.delete("/api/admin/uploads/:name", verifySession, verifySameOrigin, async (r
   }
 });
 
+app.post("/api/admin/upload-sample", verifySession, verifySameOrigin, async (req, res) => {
+  const sessionId = res.locals.sessionId as string;
+  const rate = rateRecord(uploadRequests, sessionId, UPLOAD_WINDOW_MS);
+  if (rate.count >= UPLOAD_MAX_REQUESTS) {
+    res.status(429).json({ error: "Das stündliche Upload-Limit ist erreicht." });
+    return;
+  }
+  rate.count += 1;
+  const { fileName, base64Data } = req.body;
+  if (typeof fileName !== "string" || typeof base64Data !== "string" || path.extname(fileName).toLowerCase() !== ".pdf") {
+    res.status(400).json({ error: "Eine PDF-Datei ist erforderlich." });
+    return;
+  }
+  const match = base64Data.match(/^data:application\/pdf;base64,([a-zA-Z0-9+/]+={0,2})$/);
+  if (!match) {
+    res.status(400).json({ error: "Das PDF-Uploadformat ist ungültig." });
+    return;
+  }
+  const buffer = Buffer.from(match[1], "base64");
+  if (buffer.length === 0 || buffer.length > MAX_PDF_BYTES) {
+    res.status(413).json({ error: "Die Leseprobe darf maximal 10 MB groß sein." });
+    return;
+  }
+  if (buffer.subarray(0, 5).toString("ascii") !== "%PDF-") {
+    res.status(415).json({ error: "Die Datei besitzt keinen gültigen PDF-Dateikopf." });
+    return;
+  }
+  try {
+    const generatedName = `${Date.now().toString(36)}-${randomBytes(16).toString("hex")}.pdf`;
+    await fs.writeFile(path.join(DOWNLOAD_DIR, generatedName), buffer, { flag: "wx" });
+    res.status(201).json({ success: true, url: `/downloads/${generatedName}`, size: buffer.length });
+  } catch (error) {
+    console.error("Sample upload failed:", error);
+    res.status(500).json({ error: "Die Leseprobe konnte nicht gespeichert werden." });
+  }
+});
+
+app.post("/api/admin/upload-publication", verifySession, verifySameOrigin, async (req, res) => {
+  const sessionId = res.locals.sessionId as string;
+  const rate = rateRecord(uploadRequests, sessionId, UPLOAD_WINDOW_MS);
+  if (rate.count >= UPLOAD_MAX_REQUESTS) {
+    res.status(429).json({ error: "Das stündliche Upload-Limit ist erreicht." });
+    return;
+  }
+  rate.count += 1;
+  const { fileName, base64Data, format } = req.body;
+  if (typeof fileName !== "string" || typeof base64Data !== "string" || (format !== "pdf" && format !== "epub")) {
+    res.status(400).json({ error: "Dateiname, Datei und Format sind erforderlich." });
+    return;
+  }
+  if (path.extname(fileName).toLowerCase() !== `.${format}`) {
+    res.status(400).json({ error: "Dateiendung und gewähltes Format stimmen nicht überein." });
+    return;
+  }
+  const match = base64Data.match(/^data:(?:[^;]+)?;base64,([a-zA-Z0-9+/]+={0,2})$/);
+  if (!match) {
+    res.status(400).json({ error: "Das Uploadformat ist ungültig." });
+    return;
+  }
+  const buffer = Buffer.from(match[1], "base64");
+  if (buffer.length === 0 || buffer.length > MAX_PDF_BYTES) {
+    res.status(413).json({ error: "Die Datei darf maximal 10 MB groß sein." });
+    return;
+  }
+  const isPdf = buffer.subarray(0, 5).toString("ascii") === "%PDF-";
+  const isEpub = buffer.length > 58 && buffer[0] === 0x50 && buffer[1] === 0x4b && buffer.includes(Buffer.from("application/epub+zip"));
+  if ((format === "pdf" && !isPdf) || (format === "epub" && !isEpub)) {
+    res.status(415).json({ error: `Die Datei besitzt keine gültige ${format.toUpperCase()}-Struktur.` });
+    return;
+  }
+  try {
+    const generatedName = `${Date.now().toString(36)}-${randomBytes(16).toString("hex")}.${format}`;
+    await fs.writeFile(path.join(DOWNLOAD_DIR, generatedName), buffer, { flag: "wx" });
+    res.status(201).json({ success: true, url: `/downloads/${generatedName}`, size: buffer.length, format });
+  } catch (error) {
+    console.error("Publication upload failed:", error);
+    res.status(500).json({ error: "Die Datei konnte nicht gespeichert werden." });
+  }
+});
+
+app.delete("/api/admin/samples/:name", verifySession, verifySameOrigin, async (req, res) => {
+  const name = req.params.name;
+  if (!SAFE_PDF_NAME.test(name) || path.basename(name) !== name) {
+    res.status(400).json({ error: "Ungültiger Dateiname." });
+    return;
+  }
+  const url = `/downloads/${name}`;
+  if (isDownloadReferenced(url)) {
+    res.status(409).json({ error: "Die Leseprobe wird noch von einem Buch verwendet." });
+    return;
+  }
+  try {
+    await fs.unlink(path.join(DOWNLOAD_DIR, name));
+    res.json({ success: true });
+  } catch (error: any) {
+    if (error?.code === "ENOENT") {
+      res.status(404).json({ error: "Die Leseprobe wurde nicht gefunden." });
+      return;
+    }
+    res.status(500).json({ error: "Die Leseprobe konnte nicht gelöscht werden." });
+  }
+});
+
+app.delete("/api/admin/publications/:name", verifySession, verifySameOrigin, async (req, res) => {
+  const name = req.params.name;
+  if (!SAFE_DOWNLOAD_NAME.test(name) || path.basename(name) !== name) {
+    res.status(400).json({ error: "Ungültiger Dateiname." });
+    return;
+  }
+  const url = `/downloads/${name}`;
+  if (isDownloadReferenced(url)) {
+    res.status(409).json({ error: "Die Datei wird noch in einem veröffentlichten Eintrag verwendet." });
+    return;
+  }
+  try {
+    await fs.unlink(path.join(DOWNLOAD_DIR, name));
+    res.json({ success: true });
+  } catch (error: any) {
+    if (error?.code === "ENOENT") {
+      res.status(404).json({ error: "Die Datei wurde nicht gefunden." });
+      return;
+    }
+    res.status(500).json({ error: "Die Datei konnte nicht gelöscht werden." });
+  }
+});
+
 // Configure Vite middleware or static serve
 async function startServer() {
   // Serve the dynamic uploads directory statically
@@ -931,6 +1085,23 @@ async function startServer() {
       res.setHeader("X-Content-Type-Options", "nosniff");
     },
   }));
+  app.use("/downloads", (req, res, next) => {
+    const requestedName = path.basename(req.path);
+    if (!SAFE_DOWNLOAD_NAME.test(requestedName)) {
+      res.status(404).end();
+      return;
+    }
+    next();
+  });
+  app.use("/downloads", express.static(DOWNLOAD_DIR, {
+    dotfiles: "deny",
+    fallthrough: false,
+    setHeaders: (res, filePath) => {
+      res.setHeader("Content-Type", filePath.toLowerCase().endsWith(".epub") ? "application/epub+zip" : "application/pdf");
+      res.setHeader("Content-Disposition", `attachment; filename="${path.basename(filePath)}"`);
+      res.setHeader("X-Content-Type-Options", "nosniff");
+    },
+  }));
 
   if (process.env.NODE_ENV !== "production") {
     const { createServer: createViteServer } = await import("vite");
@@ -959,9 +1130,14 @@ async function startServer() {
 
     app.use(express.static(distPath, { index: false }));
     app.get("*", (req: express.Request, res: express.Response) => {
-      const html = indexTemplate.replace("<!-- SEO_META -->\n    <title>Autoren-Portfolio</title>", seoMeta(req, res.locals.scriptNonce));
+      const isKnownRoute = req.path === "/" || req.path === "/admin" || req.path.startsWith("/admin/");
+      const meta = isKnownRoute
+        ? seoMeta(req, res.locals.scriptNonce)
+        : '<title>Seite nicht gefunden</title>\n    <meta name="robots" content="noindex, nofollow, noarchive" />';
+      const html = indexTemplate.replace("<!-- SEO_META -->\n    <title>Autoren-Portfolio</title>", meta);
       if (req.path.startsWith("/admin")) res.setHeader("X-Robots-Tag", "noindex, nofollow, noarchive");
-      res.type("html").send(html);
+      if (!isKnownRoute) res.setHeader("X-Robots-Tag", "noindex, nofollow, noarchive");
+      res.status(isKnownRoute ? 200 : 404).type("html").send(html);
     });
   }
 

src/App.tsx

@@ -82,6 +82,20 @@ export default function App() {
     );
   }
 
+  const isLocalPreview = ["localhost", "127.0.0.1"].includes(window.location.hostname);
+  if (currentPath !== "/" && !isLocalPreview) {
+    return (
+      <div className="min-h-screen bg-slate-950 text-slate-100 flex items-center justify-center p-4">
+        <div className="max-w-md rounded-2xl border border-slate-800 bg-slate-900 p-8 text-center space-y-4">
+          <p className="text-xs font-mono uppercase tracking-widest text-slate-500">404</p>
+          <h1 className="text-2xl font-bold">Seite nicht gefunden</h1>
+          <p className="text-sm text-slate-400">Die angeforderte Seite ist nicht verfügbar.</p>
+          <a href="/" className="inline-flex rounded-xl bg-slate-100 px-4 py-2 text-sm font-semibold text-slate-950">Zur Startseite</a>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <Suspense fallback={<LoadingScreen />}>
       <PortfolioPage data={publicData.profile} legalDocuments={publicData.legalDocuments} theme={publicData.theme} />

src/api/adminApi.ts

@@ -38,4 +38,12 @@ export const adminApi = {
     request<{ success: true; url: string }>("/api/admin/upload-file", jsonPost({ fileName, base64Data })),
   deleteUpload: (name: string) =>
     request<{ success: true }>(`/api/admin/uploads/${encodeURIComponent(name)}`, { method: "DELETE" }),
+  uploadSample: (fileName: string, base64Data: string) =>
+    request<{ success: true; url: string }>("/api/admin/upload-sample", jsonPost({ fileName, base64Data })),
+  deleteSample: (name: string) =>
+    request<{ success: true }>(`/api/admin/samples/${encodeURIComponent(name)}`, { method: "DELETE" }),
+  uploadPublication: (fileName: string, base64Data: string, format: "pdf" | "epub") =>
+    request<{ success: true; url: string }>("/api/admin/upload-publication", jsonPost({ fileName, base64Data, format })),
+  deletePublication: (name: string) =>
+    request<{ success: true }>(`/api/admin/publications/${encodeURIComponent(name)}`, { method: "DELETE" }),
 };

src/components/AdminPanel.tsx

@@ -5,10 +5,12 @@ import {
   Save, Plus, Trash2, Edit2, Check, RefreshCw, Sparkles,
   BookOpen, Compass, Clipboard, Eye, Music, LogOut, ArrowLeftRight,
   Palette, Type, Image as ImageIcon, Globe, Tag,
-  Scale, ShieldCheck, FileText, CheckSquare, Square, Copy, ArrowRight
+  Scale, ShieldCheck, FileText, CheckSquare, Square, Copy, ArrowRight, Download
 } from "lucide-react";
 import ImagePicker from "./ImagePicker";
 import AdminLogin from "./admin/AdminLogin";
+import SamplePdfPicker from "./admin/SamplePdfPicker";
+import DownloadsManager from "./admin/DownloadsManager";
 import { adminApi, AdminApiError } from "../api/adminApi";
 
 interface AdminPanelProps {
@@ -29,7 +31,7 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
   const [activeProfile, setActiveProfile] = useState<"scifi" | "erotica" | "clara" | "renee">("scifi");
 
   // Sub-tab selection state ("profile" | "texts" | "design" | "books" | "projects" | "legal")
-  const [activeTab, setActiveTab] = useState<"profile" | "texts" | "design" | "books" | "projects" | "legal">("profile");
+  const [activeTab, setActiveTab] = useState<"profile" | "texts" | "design" | "books" | "projects" | "downloads" | "legal">("profile");
 
   // Editing forms state
   const [editingBookId, setEditingBookId] = useState<string | null>(null);
@@ -238,6 +240,7 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
 
     const parsedGenres = genreInputRaw.split(",").map(g => g.trim()).filter(Boolean);
     let updatedBooks = [...profile.books];
+    const previousSample = editingBookId && editingBookId !== "new" ? profile.books.find((book) => book.id === editingBookId)?.samplePdfUrl : undefined;
 
     // If current book is marked as spotlight, clear spotlight flag on all other books
     if (bookForm.isSpotlight) {
@@ -253,6 +256,11 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
         description: bookForm.description || "",
         publishedYear: bookForm.publishedYear || new Date().getFullYear(),
         buyLink: bookForm.buyLink || "",
+        ebookLink: bookForm.ebookLink || bookForm.buyLink || "",
+        paperbackLink: bookForm.paperbackLink || "",
+        samplePdfUrl: bookForm.samplePdfUrl || "",
+        seriesName: bookForm.seriesName || "",
+        seriesNumber: bookForm.seriesNumber || "",
         spotifyPlaylistId: bookForm.spotifyPlaylistId || "",
         genres: parsedGenres,
         isSpotlight: !!bookForm.isSpotlight,
@@ -275,6 +283,11 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
     setLoading(true);
     try {
       await persistProfile(activeProfile, updatedProfile);
+      const savedSample = updatedBooks.find((book) => book.id === editingBookId || (editingBookId === "new" && book === updatedBooks.at(-1)))?.samplePdfUrl;
+      if (previousSample && previousSample !== savedSample) {
+        const name = previousSample.split("/").pop();
+        if (name) adminApi.deleteSample(name).catch(() => undefined);
+      }
       setEditingBookId(null);
       setBookForm({});
     } catch (err) {
@@ -287,11 +300,14 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
   const handleDeleteBook = async (bookId: string) => {
     if (!authorData || !profile || !confirm("Möchten Sie dieses Buch aus dem Bücherregal löschen?")) return;
 
+    const removedSample = profile.books.find((book) => book.id === bookId)?.samplePdfUrl;
     const updatedBooks = profile.books.filter(b => b.id !== bookId);
     const updatedProfile = { ...profile, books: updatedBooks };
     setLoading(true);
     try {
       await persistProfile(activeProfile, updatedProfile);
+      const name = removedSample?.split("/").pop();
+      if (name) adminApi.deleteSample(name).catch(() => undefined);
     } catch (err) {
       showNotice(err instanceof AdminApiError ? err.message : "Netzwerkfehler.");
     } finally {
@@ -548,6 +564,13 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                 <BookOpen className="w-4 h-4" />
                 <span>Bücherregal ({profile.books.length})</span>
               </button>
+              <button
+                onClick={() => setActiveTab("downloads")}
+                className={`px-3 py-2.5 rounded-xl text-left text-xs font-bold transition-all flex items-center gap-2 cursor-pointer ${activeTab === "downloads" ? "bg-slate-800 border-l-4 border-indigo-500 text-white" : "text-slate-400 hover:bg-slate-800/40 hover:text-white"}`}
+              >
+                <Download className="w-4 h-4" />
+                <span>Downloads ({(profile.downloads || []).length})</span>
+              </button>
               <button
                 onClick={() => { setActiveTab("legal"); setEditingLegalId(null); setLegalForm({}); }}
                 className={`px-3 py-2.5 rounded-xl text-left text-xs font-bold transition-all flex items-center gap-2 cursor-pointer ${activeTab === "legal" ? "bg-slate-800 border-l-4 border-indigo-500 text-white" : "text-slate-400 hover:bg-slate-800/40 hover:text-white"}`}
@@ -651,7 +674,7 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                     <p className="text-xs text-slate-500">Diese drei Kacheln erscheinen unter der Biografie. Sie können die Kategoriename (z.B. GENRE, TONALITÄT, FOKUS) und den zugehörigen Inhalt frei anpassen.</p>
                   </div>
 
-                  <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+                  <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
                     {/* Schlagwort 1 */}
                     <div className="p-3 bg-slate-950 border border-slate-800 rounded-xl space-y-2">
                       <div className="text-xs font-semibold text-amber-400 uppercase flex items-center gap-1">
@@ -836,6 +859,35 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                     </div>
                   </div>
                 </div>
+
+                {/* Contact Section */}
+                <div className="md:col-span-2 border-t border-slate-800/80 pt-6 mt-2 space-y-4">
+                  <div>
+                    <h4 className="text-sm font-bold text-white flex items-center gap-2">
+                      <Globe className="w-4 h-4 text-emerald-400" />
+                      <span>Kontakt & Social Media</span>
+                    </h4>
+                    <p className="text-xs text-slate-500">Der Kontaktabschnitt erscheint unter dem zusätzlichen Textmodul. Es werden ausschließlich ausgefüllte Angaben angezeigt.</p>
+                  </div>
+                  <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+                    <div className="space-y-1">
+                      <label className="text-xs font-mono text-slate-400 uppercase">E-Mail-Adresse</label>
+                      <input type="email" value={profile.contactEmail || ""} onChange={(event) => updateProfileField("contactEmail", event.target.value)} placeholder="kontakt@autorin.de" className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                    </div>
+                    <div className="space-y-1">
+                      <label className="text-xs font-mono text-slate-400 uppercase">Instagram-Profil</label>
+                      <input type="url" value={profile.instagramUrl || ""} onChange={(event) => updateProfileField("instagramUrl", event.target.value)} placeholder="https://www.instagram.com/…" className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                    </div>
+                    <div className="space-y-1">
+                      <label className="text-xs font-mono text-slate-400 uppercase">Threads-Profil</label>
+                      <input type="url" value={profile.threadsUrl || ""} onChange={(event) => updateProfileField("threadsUrl", event.target.value)} placeholder="https://www.threads.net/@…" className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                    </div>
+                    <div className="space-y-1">
+                      <label className="text-xs font-mono text-slate-400 uppercase">Discord-Einladung / Community</label>
+                      <input type="url" value={profile.discordUrl || ""} onChange={(event) => updateProfileField("discordUrl", event.target.value)} placeholder="https://discord.gg/…" className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                    </div>
+                  </div>
+                </div>
               </div>
             </div>
           )}
@@ -1386,6 +1438,7 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                         setBookForm({
                           title: "", subtitle: "", coverUrl: "", description: "",
                           publishedYear: new Date().getFullYear(), buyLink: "",
+                          ebookLink: "", paperbackLink: "", samplePdfUrl: "", seriesName: "", seriesNumber: "",
                           spotifyPlaylistId: "", genres: [], isSpotlight: false, spotlightBadge: ""
                         });
                         setGenreInputRaw("");
@@ -1521,6 +1574,14 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                           className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm"
                         />
                       </div>
+                      <div className="space-y-1">
+                        <label className="text-xs font-mono text-slate-400 uppercase">Serienname (optional)</label>
+                        <input type="text" value={bookForm.seriesName || ""} onChange={(event) => setBookForm({ ...bookForm, seriesName: event.target.value })} placeholder="z.B. Arche-Chroniken" className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                      </div>
+                      <div className="space-y-1">
+                        <label className="text-xs font-mono text-slate-400 uppercase">Bandnummer (optional)</label>
+                        <input type="number" min="0" max="999" step="1" value={bookForm.seriesNumber || ""} onChange={(event) => setBookForm({ ...bookForm, seriesNumber: event.target.value })} placeholder="1" className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                      </div>
                       <div className="space-y-1">
                         <label className="text-xs font-mono text-slate-400 uppercase font-bold text-white">Cover-Bild</label>
                         <ImagePicker
@@ -1543,16 +1604,20 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                       <div className="space-y-1">
                         <label className="text-xs font-mono text-slate-400 uppercase flex items-center gap-1">
                           <Eye className="w-3.5 h-3.5" />
-                          <span>Buy-Link / Shop-Link (z.B. Amazon, Thalia)</span>
+                          <span>KDP-Link: E-Book</span>
                         </label>
                         <input
-                          type="text"
+                          type="url"
-                          value={bookForm.buyLink || ""}
+                          value={bookForm.ebookLink || bookForm.buyLink || ""}
-                          onChange={(e) => setBookForm({ ...bookForm, buyLink: e.target.value })}
+                          onChange={(e) => setBookForm({ ...bookForm, ebookLink: e.target.value, buyLink: "" })}
                           placeholder="https://..."
                           className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm"
                         />
                       </div>
+                      <div className="space-y-1">
+                        <label className="text-xs font-mono text-slate-400 uppercase flex items-center gap-1"><BookOpen className="w-3.5 h-3.5" /><span>KDP-Link: Taschenbuch</span></label>
+                        <input type="url" value={bookForm.paperbackLink || ""} onChange={(event) => setBookForm({ ...bookForm, paperbackLink: event.target.value })} placeholder="https://..." className="w-full px-3 py-2 bg-slate-950 border border-slate-800 rounded-xl text-white outline-none focus:border-indigo-500 text-sm" />
+                      </div>
                       <div className="space-y-1">
                         <label className="text-xs font-mono text-slate-400 uppercase flex items-center gap-1">
                           <Music className="w-3.5 h-3.5" />
@@ -1578,6 +1643,10 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
                         />
                         <p className="text-[10px] text-slate-500">Trennen Sie mehrere Genres einfach durch Kommas.</p>
                       </div>
+                      <div className="space-y-1 md:col-span-2">
+                        <label className="text-xs font-mono text-slate-400 uppercase">PDF-Leseprobe (optional)</label>
+                        <SamplePdfPicker value={bookForm.samplePdfUrl || ""} onChange={(url) => setBookForm({ ...bookForm, samplePdfUrl: url })} />
+                      </div>
 
                       {/* Buch-Klappentext Synopsis / Description */}
                       <div className="space-y-1 md:col-span-2">
@@ -1698,6 +1767,25 @@ export default function AdminPanel({ onLogout }: AdminPanelProps) {
             </div>
           )}
 
+          {activeTab === "downloads" && (
+            <DownloadsManager
+              downloads={profile.downloads || []}
+              title={profile.downloadsTitle || "Kurzgeschichten & Downloads"}
+              subtitle={profile.downloadsSubtitle || "Kostenlose Geschichten zum Herunterladen."}
+              loading={loading}
+              onError={(message) => showNotice(message)}
+              onSave={async (downloads, downloadsTitle, downloadsSubtitle) => {
+                setLoading(true);
+                try {
+                  await persistProfile(activeProfile, { ...profile, downloads, downloadsTitle, downloadsSubtitle });
+                  showNotice("Download-Bereich gespeichert.", "success");
+                } finally {
+                  setLoading(false);
+                }
+              }}
+            />
+          )}
+
           {/* TAB: LEGAL DOCUMENTS (IMPRESSUM & DATENSCHUTZ) */}
           {activeTab === "legal" && (
             <div className="p-6 md:p-8 space-y-8">

src/components/PortfolioPage.tsx

@@ -1,7 +1,7 @@
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import Markdown from "react-markdown";
 import { Book, Project, AuthorProfile, LegalDocument, PortfolioTheme } from "../types";
-import { BookOpen, Star, HelpCircle, Award, Compass, ArrowRight, ExternalLink, Moon } from "lucide-react";
+import { BookOpen, Star, HelpCircle, Award, Compass, ArrowRight, ExternalLink, Moon, Mail, Instagram, AtSign, Share2, FileText, MessageCircle, Download, ChevronDown, ChevronUp } from "lucide-react";
 import SpotlightSection from "./SpotlightSection";
 import LegalModal from "./LegalModal";
 import ProjectDetailMedia from "./ProjectDetailMedia";
@@ -35,6 +35,8 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
   const [selectedProject, setSelectedProject] = useState<Project | null>(null);
   const [legalModalOpen, setLegalModalOpen] = useState(false);
   const [activeLegalId, setActiveLegalId] = useState<string | null>(null);
+  const [shareNotice, setShareNotice] = useState("");
+  const [showAllDownloads, setShowAllDownloads] = useState(false);
 
   const relevantLegalDocs = legalDocuments;
 
@@ -49,6 +51,63 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
     const url = safeExternalUrl(link.url);
     return link.label.trim() && url ? [{ label: link.label.trim(), url }] : [];
   });
+  const displayedBooks = data.books.map((book, index) => ({ book, index })).sort((left, right) => {
+    if (!left.book.seriesName && !right.book.seriesName) return left.index - right.index;
+    if (!left.book.seriesName) return 1;
+    if (!right.book.seriesName) return -1;
+    const seriesComparison = left.book.seriesName.localeCompare(right.book.seriesName, "de");
+    return seriesComparison || Number(left.book.seriesNumber || 0) - Number(right.book.seriesNumber || 0) || left.index - right.index;
+  }).map(({ book }) => book);
+  const availableDownloads = (data.downloads || []).filter((entry) => entry.pdfUrl || entry.epubUrl);
+  const visibleDownloads = showAllDownloads ? availableDownloads : availableDownloads.slice(0, 3);
+
+  const syncDetailFromUrl = () => {
+    const params = new URLSearchParams(window.location.search);
+    setSelectedBook(data.books.find((book) => book.id === params.get("book")) || null);
+    setSelectedProject(data.projects.find((project) => project.id === params.get("project")) || null);
+  };
+
+  useEffect(() => {
+    syncDetailFromUrl();
+    window.addEventListener("popstate", syncDetailFromUrl);
+    return () => window.removeEventListener("popstate", syncDetailFromUrl);
+  }, [data]);
+
+  const openDetail = (kind: "book" | "project", id: string) => {
+    const url = new URL(window.location.href);
+    url.search = "";
+    url.searchParams.set(kind, id);
+    window.history.pushState({}, "", url);
+    syncDetailFromUrl();
+  };
+
+  const closeDetail = () => {
+    const url = new URL(window.location.href);
+    url.search = "";
+    window.history.replaceState({}, "", url);
+    setSelectedBook(null);
+    setSelectedProject(null);
+  };
+
+  const shareDetail = async (title: string) => {
+    try {
+      if (navigator.share) await navigator.share({ title, url: window.location.href });
+      else {
+        await navigator.clipboard.writeText(window.location.href);
+        setShareNotice("Link wurde kopiert.");
+        window.setTimeout(() => setShareNotice(""), 3000);
+      }
+    } catch (error) {
+      if (error instanceof DOMException && error.name === "AbortError") return;
+      setShareNotice("Der Link konnte nicht kopiert werden.");
+    }
+  };
+
+  const toggleDownloads = () => {
+    const isCollapsing = showAllDownloads;
+    setShowAllDownloads((current) => !current);
+    if (isCollapsing) window.requestAnimationFrame(() => document.getElementById("downloads")?.scrollIntoView({ behavior: "smooth", block: "start" }));
+  };
 
   return (
     <div
@@ -117,6 +176,11 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
             >
               🪐 {data.booksTitle || "Bücherregal"}
             </a>
+            {availableDownloads.length > 0 && (
+              <a href="#downloads" className="px-4 py-2 rounded-full border border-slate-800 bg-slate-900/60 hover:border-cyan-400 hover:text-cyan-400 transition-all text-slate-300 uppercase tracking-wider">
+                ⬇ {data.downloadsTitle || "Downloads"}
+              </a>
+            )}
           </nav>
         </div>
       </header>
@@ -215,7 +279,7 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
             {data.projects.map((project) => (
               <button
                 key={project.id}
-                onClick={() => setSelectedProject(project)}
+                onClick={() => openDetail("project", project.id)}
                 className="p-6 border rounded-xl transition-all duration-300 flex flex-col text-left w-full justify-between group cursor-pointer hover:scale-[1.01] focus:outline-none shadow-lg"
                 style={{ backgroundColor: cardBgColor, borderColor: `${accentColor}25` }}
               >
@@ -277,10 +341,10 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
           </div>
 
           <div className="grid grid-cols-2 sm:grid-cols-3 md:grid-cols-4 gap-6 justify-items-center">
-            {data.books.map((book) => (
+            {displayedBooks.map((book) => (
               <button
                 key={book.id}
-                onClick={() => setSelectedBook(book)}
+                onClick={() => openDetail("book", book.id)}
                 className="group relative focus:outline-none text-left w-full max-w-[210px] aspect-[2/3] rounded-xl overflow-hidden border hover:border-cyan-400 transition-all duration-300 hover:shadow-xl cursor-pointer"
                 style={{ backgroundColor: cardBgColor, borderColor: `${accentColor}30` }}
               >
@@ -294,6 +358,7 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
 
                 <div className="absolute inset-x-0 bottom-0 bg-gradient-to-t from-slate-950 via-slate-950/90 to-transparent p-4 opacity-80 group-hover:opacity-100 transition-all duration-350 z-20">
                   <p className="text-white text-xs font-bold truncate">{book.title}</p>
+                  {book.seriesName && <p className="text-[9px] text-slate-300 truncate">{book.seriesName}{book.seriesNumber !== undefined && book.seriesNumber !== "" ? ` · Band ${book.seriesNumber}` : ""}</p>}
                   <p className="text-[10px] font-mono mt-0.5" style={{ color: accentColor }}>Details anzeigen <ArrowRight className="inline-block w-2.5 h-2.5 ml-0.5" /></p>
                 </div>
               </button>
@@ -301,6 +366,38 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
           </div>
         </section>
 
+        {availableDownloads.length > 0 && (
+          <section id="downloads" className="space-y-8 scroll-mt-6">
+            <div className="border-b border-slate-800 pb-4">
+              <h2 className="flex items-center gap-3 text-3xl font-bold tracking-tight text-white"><Download className="h-7 w-7" style={{ color: accentColor }} /><span>{data.downloadsTitle || "Kurzgeschichten & Downloads"}</span></h2>
+              {data.downloadsSubtitle && <p className="mt-1 text-sm text-slate-400">{data.downloadsSubtitle}</p>}
+            </div>
+            <div id="download-grid" className="grid grid-cols-1 gap-6 md:grid-cols-2 xl:grid-cols-3">
+              {visibleDownloads.map((entry) => (
+                <article key={entry.id} className="flex flex-col overflow-hidden rounded-2xl border shadow-lg" style={{ backgroundColor: cardBgColor, borderColor: `${accentColor}30` }}>
+                  {entry.imageUrl && <img src={entry.imageUrl} alt={`Motiv zu ${entry.title}`} className="block h-auto w-full" loading="lazy" referrerPolicy="no-referrer" />}
+                  <div className="flex flex-1 flex-col p-6">
+                    {entry.publishedAt && <p className="mb-2 text-[10px] font-mono uppercase tracking-widest text-slate-500">{entry.publishedAt}</p>}
+                    <h3 className="text-xl font-bold text-white">{entry.title}</h3>
+                    {entry.description && <div className="mt-3 flex-1 text-sm leading-relaxed text-slate-300 markdown-body"><Markdown>{entry.description}</Markdown></div>}
+                    <div className="mt-6 flex flex-col gap-2 sm:flex-row">
+                      {entry.pdfUrl && <a href={entry.pdfUrl} className="inline-flex flex-1 items-center justify-center gap-2 rounded-xl border px-4 py-2.5 text-xs font-bold text-white hover:bg-white/10" style={{ borderColor: `${accentColor}60` }}><FileText className="h-4 w-4" /><span>PDF</span><Download className="h-3.5 w-3.5" /></a>}
+                      {entry.epubUrl && <a href={entry.epubUrl} className="inline-flex flex-1 items-center justify-center gap-2 rounded-xl border px-4 py-2.5 text-xs font-bold text-white hover:bg-white/10" style={{ borderColor: `${secondaryColor}60` }}><BookOpen className="h-4 w-4" /><span>ePUB</span><Download className="h-3.5 w-3.5" /></a>}
+                    </div>
+                  </div>
+                </article>
+              ))}
+            </div>
+            {availableDownloads.length > 3 && (
+              <div className="text-center">
+                <button type="button" onClick={toggleDownloads} aria-expanded={showAllDownloads} aria-controls="download-grid" className="inline-flex items-center gap-2 rounded-xl border border-slate-700 bg-slate-900 px-5 py-3 text-sm font-semibold text-white hover:bg-slate-800">
+                  {showAllDownloads ? <><ChevronUp className="h-4 w-4" /><span>Weniger anzeigen</span></> : <><ChevronDown className="h-4 w-4" /><span>Alle Kurzgeschichten anzeigen ({availableDownloads.length})</span></>}
+                </button>
+              </div>
+            )}
+          </section>
+        )}
+
         {/* Section 4: Custom Highlight Section if present */}
         {(data.customSectionTitle || data.customSectionContent || customSectionLinks.length > 0) && (
           <section className="p-8 rounded-2xl border relative overflow-hidden" style={{ backgroundColor: cardBgColor, borderColor: `${accentColor}30` }}>
@@ -355,15 +452,46 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
           </section>
         )}
 
+        {(data.contactEmail || data.instagramUrl || data.threadsUrl || data.discordUrl) && (
+          <section className="rounded-2xl border p-8 text-center" style={{ backgroundColor: cardBgColor, borderColor: `${secondaryColor}35` }}>
+            <h2 className="text-2xl font-bold text-white">Kontakt & Social Media</h2>
+            <p className="mt-2 text-sm text-slate-400">Weitere Neuigkeiten, Einblicke und Kontaktmöglichkeiten.</p>
+            <div className="mt-6 flex flex-col sm:flex-row sm:flex-wrap justify-center gap-3">
+              {data.contactEmail && (
+                <a href={`mailto:${data.contactEmail}`} className="inline-flex items-center justify-center gap-2 rounded-xl border px-5 py-3 text-sm font-semibold text-white transition-colors hover:bg-white/10" style={{ borderColor: `${accentColor}60` }}>
+                  <Mail className="h-4 w-4" /><span>E-Mail</span>
+                </a>
+              )}
+              {safeExternalUrl(data.instagramUrl || "") && (
+                <a href={safeExternalUrl(data.instagramUrl || "")!} target="_blank" rel="noopener noreferrer" className="inline-flex items-center justify-center gap-2 rounded-xl border px-5 py-3 text-sm font-semibold text-white transition-colors hover:bg-white/10" style={{ borderColor: `${accentColor}60` }}>
+                  <Instagram className="h-4 w-4" /><span>Instagram</span>
+                </a>
+              )}
+              {safeExternalUrl(data.threadsUrl || "") && (
+                <a href={safeExternalUrl(data.threadsUrl || "")!} target="_blank" rel="noopener noreferrer" className="inline-flex items-center justify-center gap-2 rounded-xl border px-5 py-3 text-sm font-semibold text-white transition-colors hover:bg-white/10" style={{ borderColor: `${accentColor}60` }}>
+                  <AtSign className="h-4 w-4" /><span>Threads</span>
+                </a>
+              )}
+              {safeExternalUrl(data.discordUrl || "") && (
+                <a href={safeExternalUrl(data.discordUrl || "")!} target="_blank" rel="noopener noreferrer" className="inline-flex items-center justify-center gap-2 rounded-xl border px-5 py-3 text-sm font-semibold text-white transition-colors hover:bg-white/10" style={{ borderColor: `${accentColor}60` }}>
+                  <MessageCircle className="h-4 w-4" /><span>Discord</span>
+                </a>
+              )}
+            </div>
+          </section>
+        )}
+
       </main>
 
+      {shareNotice && <div role="status" aria-live="polite" className="fixed bottom-5 left-1/2 z-[70] -translate-x-1/2 rounded-xl border border-slate-700 bg-slate-900 px-4 py-2 text-sm text-white shadow-xl">{shareNotice}</div>}
+
       {/* Book details modular interface modal */}
       {selectedBook && (
-        <AccessibleModal titleId="book-detail-title" onClose={() => setSelectedBook(null)}>
+        <AccessibleModal titleId="book-detail-title" onClose={closeDetail}>
 
               {/* Close Button */}
               <button
-                onClick={() => setSelectedBook(null)}
+                onClick={closeDetail}
                 className="absolute top-4 right-4 text-slate-400 hover:text-white hover:bg-slate-800/80 px-2.5 py-1 rounded-md text-xs font-mono border border-slate-800 transition-all cursor-pointer"
               >
                 SCHLIESSEN [ESC]
@@ -381,17 +509,11 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
                       referrerPolicy="no-referrer"
                     />
                   </div>
-                  {selectedBook.buyLink && (
+                  <div className="mt-6 w-full max-w-[260px] space-y-2">
-                    <a
+                    {(selectedBook.ebookLink || selectedBook.buyLink) && <a href={selectedBook.ebookLink || selectedBook.buyLink} target="_blank" rel="noopener noreferrer" className="w-full py-3 text-center bg-gradient-to-r from-cyan-500 to-indigo-600 text-slate-950 font-bold rounded-xl flex items-center justify-center gap-2 text-sm"><span>E-Book</span><ExternalLink className="w-4 h-4" /></a>}
-                      href={selectedBook.buyLink}
+                    {selectedBook.paperbackLink && <a href={selectedBook.paperbackLink} target="_blank" rel="noopener noreferrer" className="w-full py-3 text-center border border-cyan-700 bg-slate-950 text-white font-bold rounded-xl flex items-center justify-center gap-2 text-sm"><span>Taschenbuch</span><ExternalLink className="w-4 h-4" /></a>}
-                      target="_blank"
+                    {selectedBook.samplePdfUrl && <a href={selectedBook.samplePdfUrl} className="w-full py-3 text-center border border-slate-700 bg-slate-800 text-white font-bold rounded-xl flex items-center justify-center gap-2 text-sm"><FileText className="w-4 h-4" /><span>Leseprobe (PDF)</span></a>}
-                      rel="noopener noreferrer"
+                  </div>
-                      className="mt-6 w-full max-w-[260px] py-3 text-center bg-gradient-to-r from-cyan-500 to-indigo-600 hover:from-cyan-400 hover:to-indigo-500 text-slate-950 font-bold font-sans rounded-xl flex items-center justify-center gap-2 transition-all hover:scale-[1.02] shadow-[0_4px_12px_rgba(6,182,212,0.3)] text-sm"
-                    >
-                      <span>Zum Buch</span>
-                      <ExternalLink className="w-4 h-4" />
-                    </a>
-                  )}
                 </div>
 
                 {/* Book Details */}
@@ -417,6 +539,11 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
                         {selectedBook.subtitle}
                       </h4>
                     )}
+                    {selectedBook.seriesName && (
+                      <p className="text-sm font-semibold" style={{ color: accentColor }}>{selectedBook.seriesName}{selectedBook.seriesNumber !== undefined && selectedBook.seriesNumber !== "" ? ` · Band ${selectedBook.seriesNumber}` : ""}</p>
+                    )}
+
+                    <button type="button" onClick={() => shareDetail(selectedBook.title)} className="inline-flex w-fit items-center gap-2 rounded-lg border border-slate-700 px-3 py-2 text-xs text-slate-300 hover:bg-slate-800"><Share2 className="h-4 w-4" /><span>Teilen / Link kopieren</span></button>
 
                     <div className="h-px bg-indigo-950" />
 
@@ -439,11 +566,11 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
 
       {/* Project details modular modal */}
       {selectedProject && (
-        <AccessibleModal titleId="project-detail-title" onClose={() => setSelectedProject(null)} maxWidthClass="sm:max-w-5xl">
+        <AccessibleModal titleId="project-detail-title" onClose={closeDetail} maxWidthClass="sm:max-w-5xl">
 
               {/* Close Button */}
               <button
-                onClick={() => setSelectedProject(null)}
+                onClick={closeDetail}
                 className="absolute top-4 right-4 text-slate-400 hover:text-white hover:bg-slate-800/80 px-2.5 py-1 rounded-md text-xs font-mono border border-slate-800 transition-all cursor-pointer"
               >
                 SCHLIESSEN [ESC]
@@ -463,6 +590,8 @@ export default function PortfolioPage({ data, legalDocuments = [], theme }: Port
                   {selectedProject.title}
                 </h3>
 
+                <button type="button" onClick={() => shareDetail(selectedProject.title)} className="inline-flex w-fit items-center gap-2 rounded-lg border border-slate-700 px-3 py-2 text-xs text-slate-300 hover:bg-slate-800"><Share2 className="h-4 w-4" /><span>Teilen / Link kopieren</span></button>
+
                 <div className="h-px bg-indigo-950" />
 
                 <div className="space-y-2">

src/components/SpotlightSection.tsx

@@ -101,23 +101,29 @@ export default function SpotlightSection({
               </div>
             </div>
 
-            {book.buyLink && (
+            {(book.ebookLink || book.buyLink) && (
               <a
-                href={book.buyLink}
+                href={book.ebookLink || book.buyLink}
                 target="_blank"
                 rel="noopener noreferrer"
                 className="w-full max-w-[260px] py-3 px-4 rounded-xl font-bold text-xs uppercase tracking-wider transition-all duration-300 flex items-center justify-center gap-2 shadow-lg cursor-pointer hover:scale-[1.02]"
                 style={{ backgroundColor: accentColor, color: "#000" }}
               >
                 <ShoppingBag className="w-4 h-4" />
-                <span>{isFuture ? "Jetzt vorbestellen" : "Jetzt im Handel"}</span>
+                <span>{isFuture ? "E-Book vorbestellen" : "E-Book"}</span>
                 <ExternalLink className="w-3.5 h-3.5 ml-auto opacity-70" />
               </a>
             )}
+            {book.paperbackLink && (
+              <a href={book.paperbackLink} target="_blank" rel="noopener noreferrer" className="w-full max-w-[260px] py-3 px-4 rounded-xl border border-slate-700 bg-slate-900 text-white font-bold text-xs uppercase tracking-wider flex items-center justify-center gap-2 hover:bg-slate-800">
+                <ShoppingBag className="w-4 h-4" /><span>Taschenbuch</span><ExternalLink className="w-3.5 h-3.5 ml-auto opacity-70" />
+              </a>
+            )}
           </div>
 
           {/* Details column */}
           <div className="md:col-span-8 space-y-5">
+            {book.seriesName && <p className="text-xs font-semibold uppercase tracking-widest" style={{ color: accentColor }}>{book.seriesName}{book.seriesNumber !== undefined && book.seriesNumber !== "" ? ` · Band ${book.seriesNumber}` : ""}</p>}
             <div className="flex flex-wrap items-center gap-2">
               <span
                 className="px-3 py-1 rounded-full text-xs font-mono font-bold tracking-wide uppercase border flex items-center gap-1.5 shadow-sm"

src/components/admin/DownloadsManager.tsx

@@ -0,0 +1,123 @@
+import { useEffect, useState } from "react";
+import { ArrowDown, ArrowUp, Edit2, Plus, Save, Trash2 } from "lucide-react";
+import type { DownloadPublication } from "../../types";
+import { adminApi } from "../../api/adminApi";
+import ImagePicker from "../ImagePicker";
+import PublicationFilePicker from "./PublicationFilePicker";
+
+interface DownloadsManagerProps {
+  downloads: DownloadPublication[];
+  title: string;
+  subtitle: string;
+  loading: boolean;
+  onSave: (downloads: DownloadPublication[], title: string, subtitle: string) => Promise<void>;
+  onError: (message: string) => void;
+}
+
+const emptyForm = (): Partial<DownloadPublication> => ({ title: "", description: "", imageUrl: "", pdfUrl: "", epubUrl: "", publishedAt: "" });
+
+async function deleteUnreferencedFiles(urls: Array<string | undefined>) {
+  await Promise.all(urls.filter(Boolean).map(async (url) => {
+    const name = url!.split("/").pop();
+    if (name) await adminApi.deletePublication(name).catch(() => undefined);
+  }));
+}
+
+export default function DownloadsManager({ downloads, title, subtitle, loading, onSave, onError }: DownloadsManagerProps) {
+  const [sectionTitle, setSectionTitle] = useState(title);
+  const [sectionSubtitle, setSectionSubtitle] = useState(subtitle);
+  const [editingId, setEditingId] = useState<string | null>(null);
+  const [form, setForm] = useState<Partial<DownloadPublication>>(emptyForm());
+
+  useEffect(() => setSectionTitle(title), [title]);
+  useEffect(() => setSectionSubtitle(subtitle), [subtitle]);
+
+  const persist = async (nextDownloads: DownloadPublication[]) => {
+    try {
+      await onSave(nextDownloads, sectionTitle, sectionSubtitle);
+    } catch (error) {
+      onError(error instanceof Error ? error.message : "Die Downloads konnten nicht gespeichert werden.");
+      throw error;
+    }
+  };
+
+  const saveEntry = async () => {
+    if (!form.title?.trim()) {
+      onError("Bitte einen Titel für den Download eintragen.");
+      return;
+    }
+    if (!form.pdfUrl && !form.epubUrl) {
+      onError("Bitte mindestens eine PDF- oder ePUB-Datei hochladen.");
+      return;
+    }
+    const previous = editingId && editingId !== "new" ? downloads.find((item) => item.id === editingId) : undefined;
+    const entry: DownloadPublication = {
+      id: editingId === "new" ? `download_${Date.now()}` : editingId!,
+      title: form.title.trim(),
+      description: form.description || "",
+      imageUrl: form.imageUrl || "",
+      pdfUrl: form.pdfUrl || "",
+      epubUrl: form.epubUrl || "",
+      publishedAt: form.publishedAt || "",
+    };
+    const next = editingId === "new" ? [entry, ...downloads] : downloads.map((item) => item.id === editingId ? entry : item);
+    await persist(next);
+    await deleteUnreferencedFiles([
+      previous?.pdfUrl && previous.pdfUrl !== entry.pdfUrl ? previous.pdfUrl : undefined,
+      previous?.epubUrl && previous.epubUrl !== entry.epubUrl ? previous.epubUrl : undefined,
+    ]);
+    setEditingId(null);
+    setForm(emptyForm());
+  };
+
+  const remove = async (entry: DownloadPublication) => {
+    if (!confirm(`„${entry.title}“ wirklich löschen?`)) return;
+    await persist(downloads.filter((item) => item.id !== entry.id));
+    await deleteUnreferencedFiles([entry.pdfUrl, entry.epubUrl]);
+  };
+
+  const move = async (index: number, direction: -1 | 1) => {
+    const target = index + direction;
+    if (target < 0 || target >= downloads.length) return;
+    const next = [...downloads];
+    [next[index], next[target]] = [next[target], next[index]];
+    await persist(next);
+  };
+
+  if (editingId) {
+    return (
+      <div className="space-y-5 rounded-2xl border border-slate-800 bg-slate-900 p-6">
+        <h2 className="text-lg font-bold text-white">{editingId === "new" ? "Neuen Download anlegen" : "Download bearbeiten"}</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <div className="space-y-1 md:col-span-2"><label className="text-xs font-mono uppercase text-slate-400">Titel</label><input value={form.title || ""} onChange={(event) => setForm({ ...form, title: event.target.value })} className="w-full rounded-xl border border-slate-800 bg-slate-950 px-3 py-2 text-white" /></div>
+          <div className="space-y-1 md:col-span-2"><label className="text-xs font-mono uppercase text-slate-400">Kurze Beschreibung</label><textarea rows={4} value={form.description || ""} onChange={(event) => setForm({ ...form, description: event.target.value })} className="w-full rounded-xl border border-slate-800 bg-slate-950 px-3 py-2 text-white" /></div>
+          <div className="space-y-1"><label className="text-xs font-mono uppercase text-slate-400">Veröffentlichungsdatum (optional)</label><input type="date" value={form.publishedAt || ""} onChange={(event) => setForm({ ...form, publishedAt: event.target.value })} className="w-full rounded-xl border border-slate-800 bg-slate-950 px-3 py-2 text-white" /></div>
+          <div className="space-y-1"><label className="text-xs font-mono uppercase text-slate-400">Optionales Bild</label><ImagePicker value={form.imageUrl || ""} onChange={(url) => setForm({ ...form, imageUrl: url })} label="Download-Bild" /></div>
+          <div className="space-y-1"><label className="text-xs font-mono uppercase text-slate-400">PDF-Datei</label><PublicationFilePicker format="pdf" value={form.pdfUrl || ""} onChange={(url) => setForm({ ...form, pdfUrl: url })} /></div>
+          <div className="space-y-1"><label className="text-xs font-mono uppercase text-slate-400">ePUB-Datei</label><PublicationFilePicker format="epub" value={form.epubUrl || ""} onChange={(url) => setForm({ ...form, epubUrl: url })} /></div>
+        </div>
+        <div className="flex gap-3 border-t border-slate-800 pt-4"><button type="button" disabled={loading} onClick={saveEntry} className="rounded-lg bg-emerald-600 px-4 py-2 text-xs font-bold text-white"><Save className="mr-1 inline h-4 w-4" />Speichern</button><button type="button" onClick={() => { setEditingId(null); setForm(emptyForm()); }} className="rounded-lg bg-slate-800 px-4 py-2 text-xs text-slate-300">Abbrechen</button></div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="space-y-6">
+      <div className="space-y-4 rounded-2xl border border-slate-800 bg-slate-900 p-6">
+        <div className="flex flex-wrap items-center justify-between gap-3"><div><h2 className="text-lg font-bold text-white">Kurzgeschichten & Downloads</h2><p className="text-xs text-slate-400">Die ersten drei Einträge werden öffentlich sofort angezeigt.</p></div><button type="button" onClick={() => { setEditingId("new"); setForm(emptyForm()); }} className="rounded-lg bg-emerald-600 px-4 py-2 text-xs font-bold text-white"><Plus className="mr-1 inline h-4 w-4" />Neuer Download</button></div>
+        <div className="grid grid-cols-1 gap-3 md:grid-cols-2"><div><label className="text-xs font-mono uppercase text-slate-400">Abschnittstitel</label><input value={sectionTitle} onChange={(event) => setSectionTitle(event.target.value)} className="mt-1 w-full rounded-xl border border-slate-800 bg-slate-950 px-3 py-2 text-white" /></div><div><label className="text-xs font-mono uppercase text-slate-400">Untertitel</label><input value={sectionSubtitle} onChange={(event) => setSectionSubtitle(event.target.value)} className="mt-1 w-full rounded-xl border border-slate-800 bg-slate-950 px-3 py-2 text-white" /></div></div>
+        <button type="button" disabled={loading} onClick={() => persist(downloads)} className="rounded-lg bg-indigo-600 px-4 py-2 text-xs font-bold text-white">Überschriften speichern</button>
+      </div>
+      <div className="space-y-3">
+        {downloads.length === 0 && <p className="rounded-xl border border-dashed border-slate-800 p-8 text-center text-sm text-slate-500">Noch keine Downloads hinterlegt.</p>}
+        {downloads.map((entry, index) => (
+          <div key={entry.id} className="flex items-center gap-4 rounded-xl border border-slate-800 bg-slate-900 p-4">
+            {entry.imageUrl && <img src={entry.imageUrl} alt="" className="h-16 w-16 rounded-lg object-cover" />}
+            <div className="min-w-0 flex-1"><h3 className="truncate font-bold text-white">{entry.title}</h3><p className="line-clamp-1 text-xs text-slate-400">{entry.description}</p><p className="mt-1 text-[10px] text-slate-500">{entry.pdfUrl ? "PDF " : ""}{entry.epubUrl ? "ePUB" : ""}</p></div>
+            <div className="flex items-center gap-1"><button type="button" disabled={index === 0} onClick={() => move(index, -1)} className="p-2 text-slate-400 disabled:opacity-20" aria-label="Nach oben"><ArrowUp className="h-4 w-4" /></button><button type="button" disabled={index === downloads.length - 1} onClick={() => move(index, 1)} className="p-2 text-slate-400 disabled:opacity-20" aria-label="Nach unten"><ArrowDown className="h-4 w-4" /></button><button type="button" onClick={() => { setEditingId(entry.id); setForm(entry); }} className="p-2 text-slate-400 hover:text-white" aria-label="Bearbeiten"><Edit2 className="h-4 w-4" /></button><button type="button" onClick={() => remove(entry)} className="p-2 text-rose-400" aria-label="Löschen"><Trash2 className="h-4 w-4" /></button></div>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}

src/components/admin/PublicationFilePicker.tsx

@@ -0,0 +1,62 @@
+import { useRef, useState } from "react";
+import { FileText, Loader2, Trash2, Upload } from "lucide-react";
+import { adminApi, AdminApiError } from "../../api/adminApi";
+
+interface PublicationFilePickerProps {
+  format: "pdf" | "epub";
+  value: string;
+  onChange: (url: string) => void;
+}
+
+export default function PublicationFilePicker({ format, value, onChange }: PublicationFilePickerProps) {
+  const inputRef = useRef<HTMLInputElement>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState("");
+
+  const upload = (file?: File) => {
+    if (!file) return;
+    if (!file.name.toLowerCase().endsWith(`.${format}`)) {
+      setError(`Bitte eine ${format.toUpperCase()}-Datei auswählen.`);
+      return;
+    }
+    if (file.size > 10 * 1024 * 1024) {
+      setError("Die Datei darf maximal 10 MB groß sein.");
+      return;
+    }
+    setLoading(true);
+    setError("");
+    const reader = new FileReader();
+    reader.onload = async () => {
+      try {
+        const result = await adminApi.uploadPublication(file.name, String(reader.result), format);
+        onChange(result.url);
+      } catch (uploadError) {
+        setError(uploadError instanceof AdminApiError ? uploadError.message : "Upload fehlgeschlagen.");
+      } finally {
+        setLoading(false);
+      }
+    };
+    reader.onerror = () => {
+      setError("Die Datei konnte nicht gelesen werden.");
+      setLoading(false);
+    };
+    reader.readAsDataURL(file);
+  };
+
+  return (
+    <div className="space-y-2 rounded-xl border border-slate-800 bg-slate-950/50 p-3">
+      <input ref={inputRef} type="file" accept={format === "pdf" ? "application/pdf,.pdf" : "application/epub+zip,.epub"} className="hidden" onChange={(event) => upload(event.target.files?.[0])} />
+      {value ? (
+        <div className="flex items-center justify-between gap-2">
+          <span className="min-w-0 truncate text-xs text-slate-300"><FileText className="mr-1 inline h-4 w-4" />{value.split("/").pop()}</span>
+          <button type="button" onClick={() => onChange("")} className="p-1.5 text-slate-400 hover:text-rose-400" aria-label={`${format.toUpperCase()} entfernen`}><Trash2 className="h-4 w-4" /></button>
+        </div>
+      ) : (
+        <button type="button" disabled={loading} onClick={() => inputRef.current?.click()} className="flex w-full items-center justify-center gap-2 rounded-lg bg-indigo-600 px-3 py-2 text-xs font-semibold text-white hover:bg-indigo-500 disabled:opacity-60">
+          {loading ? <Loader2 className="h-4 w-4 animate-spin" /> : <Upload className="h-4 w-4" />}<span>{format.toUpperCase()} hochladen</span>
+        </button>
+      )}
+      {error && <p role="alert" className="text-xs text-rose-400">{error}</p>}
+    </div>
+  );
+}

src/components/admin/SamplePdfPicker.tsx

@@ -0,0 +1,68 @@
+import { useRef, useState } from "react";
+import { FileText, Loader2, Trash2, Upload } from "lucide-react";
+import { adminApi, AdminApiError } from "../../api/adminApi";
+
+interface SamplePdfPickerProps {
+  value: string;
+  onChange: (url: string) => void;
+}
+
+export default function SamplePdfPicker({ value, onChange }: SamplePdfPickerProps) {
+  const inputRef = useRef<HTMLInputElement>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState("");
+
+  const upload = (file?: File) => {
+    if (!file) return;
+    if (file.type !== "application/pdf" || !file.name.toLowerCase().endsWith(".pdf")) {
+      setError("Bitte eine PDF-Datei auswählen.");
+      return;
+    }
+    if (file.size > 10 * 1024 * 1024) {
+      setError("Die Leseprobe darf maximal 10 MB groß sein.");
+      return;
+    }
+    setLoading(true);
+    setError("");
+    const reader = new FileReader();
+    reader.onload = async () => {
+      try {
+        const result = await adminApi.uploadSample(file.name, String(reader.result));
+        onChange(result.url);
+      } catch (uploadError) {
+        setError(uploadError instanceof AdminApiError ? uploadError.message : "Upload fehlgeschlagen.");
+      } finally {
+        setLoading(false);
+      }
+    };
+    reader.onerror = () => {
+      setError("Die Datei konnte nicht gelesen werden.");
+      setLoading(false);
+    };
+    reader.readAsDataURL(file);
+  };
+
+  return (
+    <div className="space-y-2 rounded-xl border border-slate-800 bg-slate-950/50 p-3">
+      <input ref={inputRef} type="file" accept="application/pdf,.pdf" className="hidden" onChange={(event) => upload(event.target.files?.[0])} />
+      {value ? (
+        <div className="flex items-center justify-between gap-3">
+          <div className="min-w-0 flex items-center gap-2 text-xs text-slate-300">
+            <FileText className="h-4 w-4 shrink-0 text-rose-400" />
+            <span className="truncate">{value.split("/").pop()}</span>
+          </div>
+          <button type="button" onClick={() => onChange("")} className="p-1.5 text-slate-400 hover:text-rose-400" aria-label="Leseprobe aus dem Buch entfernen">
+            <Trash2 className="h-4 w-4" />
+          </button>
+        </div>
+      ) : (
+        <button type="button" disabled={loading} onClick={() => inputRef.current?.click()} className="flex w-full items-center justify-center gap-2 rounded-lg bg-indigo-600 px-3 py-2 text-xs font-semibold text-white hover:bg-indigo-500 disabled:opacity-60">
+          {loading ? <Loader2 className="h-4 w-4 animate-spin" /> : <Upload className="h-4 w-4" />}
+          <span>{loading ? "Leseprobe wird hochgeladen…" : "PDF-Leseprobe hochladen"}</span>
+        </button>
+      )}
+      <p className="text-[10px] text-slate-500">PDF, maximal 10 MB. Ohne Datei erscheint kein Download.</p>
+      {error && <p className="text-xs text-rose-400" role="alert">{error}</p>}
+    </div>
+  );
+}

src/types.ts

@@ -16,6 +16,11 @@ export interface Book {
   description: string;
   publishedYear: number | string; // Accepts year (2026) or full date string (15.10.2026, Herbst 2026)
   buyLink?: string;
+  ebookLink?: string;
+  paperbackLink?: string;
+  samplePdfUrl?: string;
+  seriesName?: string;
+  seriesNumber?: number | string;
   spotifyPlaylistId?: string; // Just the playlist ID (e.g., "47R6ZAdk7Xf6M4i9mR0fP1")
   genres?: string[];
   isSpotlight?: boolean; // Highlighted as spotlight / new release
@@ -27,6 +32,16 @@ export interface CustomSectionLink {
   url: string;
 }
 
+export interface DownloadPublication {
+  id: string;
+  title: string;
+  description: string;
+  imageUrl?: string;
+  pdfUrl?: string;
+  epubUrl?: string;
+  publishedAt?: string;
+}
+
 export interface AuthorProfile {
   name: string;
   bio: string;
@@ -38,6 +53,13 @@ export interface AuthorProfile {
   customSectionTitle?: string;
   customSectionContent?: string;
   customSectionLinks?: CustomSectionLink[];
+  contactEmail?: string;
+  instagramUrl?: string;
+  threadsUrl?: string;
+  discordUrl?: string;
+  downloads?: DownloadPublication[];
+  downloadsTitle?: string;
+  downloadsSubtitle?: string;
 
   // Domain & Path Routing
   customDomain?: string; // e.g., "annieslone.de, annie-slone.de"

tests/server.test.mjs

@@ -119,6 +119,13 @@ test("production hardening and public routing", async (t) => {
       response = await fetch(`${baseUrl}/api/admin/author-data`, { headers: { cookie } });
       assert.equal(response.status, 200);
       const adminData = await response.json();
+      adminData.erotica.contactEmail = "kontakt@example.test";
+      adminData.erotica.instagramUrl = "https://instagram.com/example-author";
+      adminData.erotica.discordUrl = "https://discord.gg/example-author";
+      adminData.erotica.books[0].seriesName = "Beispiel-Reihe";
+      adminData.erotica.books[0].seriesNumber = 1;
+      adminData.erotica.books[0].ebookLink = "https://amazon.example/ebook";
+      adminData.erotica.books[0].paperbackLink = "https://amazon.example/paperback";
       adminData.erotica.customSectionLinks = [
         { label: "Zum befreundeten Pseudonym", url: "https://example-pseudonym.test/" },
       ];
@@ -159,6 +166,10 @@ test("production hardening and public routing", async (t) => {
       assert.deepEqual(publicData.profile.customSectionLinks, [
         { label: "Zum befreundeten Pseudonym", url: "https://example-pseudonym.test/" },
       ]);
+      assert.equal(publicData.profile.contactEmail, "kontakt@example.test");
+      assert.equal(publicData.profile.discordUrl, "https://discord.gg/example-author");
+      assert.equal(publicData.profile.books[0].seriesName, "Beispiel-Reihe");
+      assert.equal(publicData.profile.books[0].seriesNumber, 1);
       assert.equal(publicResponse.body.includes("Clara Finch"), false);
       assert.equal(publicResponse.body.includes("Renee Heart"), false);
       assert.equal(publicResponse.body.includes("Daniel Hesse"), false);
@@ -188,6 +199,65 @@ test("production hardening and public routing", async (t) => {
       response = await upload("wrong.jpg", validPng);
       assert.equal(response.status, 415);
 
+      const validPdf = `data:application/pdf;base64,${Buffer.from("%PDF-1.4\n%%EOF").toString("base64")}`;
+      response = await fetch(`${baseUrl}/api/admin/upload-sample`, {
+        method: "POST",
+        headers: { "content-type": "application/json", origin: baseUrl, cookie },
+        body: JSON.stringify({ fileName: "leseprobe.pdf", base64Data: validPdf }),
+      });
+      assert.equal(response.status, 201);
+      const sample = await response.json();
+      assert.match(sample.url, /^\/downloads\/[a-z0-9-]+\.pdf$/);
+      response = await fetch(`${baseUrl}${sample.url}`);
+      assert.equal(response.status, 200);
+      assert.match(response.headers.get("content-disposition") || "", /attachment/);
+
+      response = await fetch(`${baseUrl}/api/admin/upload-publication`, {
+        method: "POST",
+        headers: { "content-type": "application/json", origin: baseUrl, cookie },
+        body: JSON.stringify({ fileName: "geschichte.pdf", base64Data: validPdf, format: "pdf" }),
+      });
+      assert.equal(response.status, 201);
+      const publicationPdf = await response.json();
+      const epubBuffer = Buffer.concat([Buffer.from([0x50, 0x4b, 0x03, 0x04]), Buffer.alloc(60), Buffer.from("application/epub+zip")]);
+      response = await fetch(`${baseUrl}/api/admin/upload-publication`, {
+        method: "POST",
+        headers: { "content-type": "application/json", origin: baseUrl, cookie },
+        body: JSON.stringify({ fileName: "geschichte.epub", base64Data: `data:application/epub+zip;base64,${epubBuffer.toString("base64")}`, format: "epub" }),
+      });
+      assert.equal(response.status, 201);
+      const publicationEpub = await response.json();
+      response = await fetch(`${baseUrl}${publicationEpub.url}`);
+      assert.equal(response.status, 200);
+      assert.equal(response.headers.get("content-type"), "application/epub+zip");
+
+      adminData.erotica.books[0].samplePdfUrl = sample.url;
+      adminData.erotica.downloadsTitle = "Kostenlose Geschichten";
+      adminData.erotica.downloads = [{
+        id: "download_test",
+        title: "Testgeschichte",
+        description: "Eine kurze Beschreibung.",
+        imageUrl: "",
+        pdfUrl: publicationPdf.url,
+        epubUrl: publicationEpub.url,
+        publishedAt: "2026-08-18",
+      }];
+      response = await fetch(`${baseUrl}/api/admin/save-profile`, {
+        method: "POST",
+        headers: { "content-type": "application/json", origin: baseUrl, cookie },
+        body: JSON.stringify({ profileKey: "erotica", profileData: adminData.erotica, expectedRevision: firstSave.revision }),
+      });
+      assert.equal(response.status, 200);
+      const sampleSave = await response.json();
+      const downloadPublicResponse = await getWithHost(`${baseUrl}/api/author-data`, "annieslone.de");
+      const downloadPublicData = JSON.parse(downloadPublicResponse.body);
+      assert.equal(downloadPublicData.profile.downloads[0].title, "Testgeschichte");
+      assert.equal(downloadPublicData.profile.downloads[0].epubUrl, publicationEpub.url);
+      response = await fetch(`${baseUrl}/api/admin/samples/${path.basename(sample.url)}`, { method: "DELETE", headers: { origin: baseUrl, cookie } });
+      assert.equal(response.status, 409);
+      response = await fetch(`${baseUrl}/api/admin/publications/${path.basename(publicationEpub.url)}`, { method: "DELETE", headers: { origin: baseUrl, cookie } });
+      assert.equal(response.status, 409);
+
       response = await fetch(`${baseUrl}${uploaded.url}`);
       assert.equal(response.status, 200);
       assert.equal(response.headers.get("x-content-type-options"), "nosniff");
@@ -197,7 +267,7 @@ test("production hardening and public routing", async (t) => {
       response = await fetch(`${baseUrl}/api/admin/save-profile`, {
         method: "POST",
         headers: { "content-type": "application/json", origin: baseUrl, cookie },
-        body: JSON.stringify({ profileKey: "erotica", profileData: adminData.erotica, expectedRevision: firstSave.revision }),
+        body: JSON.stringify({ profileKey: "erotica", profileData: adminData.erotica, expectedRevision: sampleSave.revision }),
       });
       assert.equal(response.status, 200);
       const referencedSave = await response.json();
@@ -209,6 +279,8 @@ test("production hardening and public routing", async (t) => {
       assert.equal(response.status, 409);
 
       adminData.erotica.avatarUrl = "";
+      adminData.erotica.books[0].samplePdfUrl = "";
+      adminData.erotica.downloads = [];
       response = await fetch(`${baseUrl}/api/admin/save-profile`, {
         method: "POST",
         headers: { "content-type": "application/json", origin: baseUrl, cookie },
@@ -223,6 +295,12 @@ test("production hardening and public routing", async (t) => {
       assert.equal(response.status, 200);
       response = await fetch(`${baseUrl}${uploaded.url}`);
       assert.equal(response.status, 404);
+      response = await fetch(`${baseUrl}/api/admin/samples/${path.basename(sample.url)}`, { method: "DELETE", headers: { origin: baseUrl, cookie } });
+      assert.equal(response.status, 200);
+      response = await fetch(`${baseUrl}/api/admin/publications/${path.basename(publicationPdf.url)}`, { method: "DELETE", headers: { origin: baseUrl, cookie } });
+      assert.equal(response.status, 200);
+      response = await fetch(`${baseUrl}/api/admin/publications/${path.basename(publicationEpub.url)}`, { method: "DELETE", headers: { origin: baseUrl, cookie } });
+      assert.equal(response.status, 200);
 
       response = await fetch(`${baseUrl}/api/admin/logout`, { method: "POST", headers: { origin: baseUrl, cookie } });
       assert.equal(response.status, 200);
@@ -243,6 +321,12 @@ test("production hardening and public routing", async (t) => {
       response = await fetch(`${baseUrl}/`);
       assert.equal(response.headers.get("x-frame-options"), "DENY");
       assert.ok(response.headers.get("content-security-policy"));
+      response = await fetch(`${baseUrl}/does-not-exist`);
+      assert.equal(response.status, 404);
+      assert.match(response.headers.get("x-robots-tag") || "", /noindex/);
+      const notFoundBody = await response.text();
+      assert.match(notFoundBody, /Seite nicht gefunden/);
+      assert.equal(notFoundBody.includes("Daniel Hesse"), false);
     } finally {
       await stopServer(child);
       await rm(dataDir, { recursive: true, force: true });