adding fredy category

Updated sponsorship section to improve clarity and added support links.

.babelrc

@@ -3,9 +3,7 @@
     [
       "@babel/preset-env",
       {
-        "exclude": [
+        "exclude": ["transform-regenerator"]
-          "transform-regenerator"
-        ]
       }
     ],
     [

.dockerignore

@@ -1,7 +1,47 @@
+# Dependencies (will be installed fresh in container)
 node_modules/
-npm-debug.log
+
-test/
+# Database and config (mounted as volumes)
-conf/
 db/
+conf/
+
+# Git
 .git/
 .github/
+.gitignore
+
+# IDE and editor
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+
+# Testing
+test/
+
+# Documentation
+doc/
+*.md
+!README.md
+
+# Development config files
+.babelrc
+.husky/
+.nvmrc
+.prettierrc
+.prettierignore
+eslint.config.js
+
+# Docker files (not needed inside container)
+Dockerfile
+docker-compose.yml
+docker-test.sh
+.dockerignore
+
+# Logs
+*.log
+npm-debug.log
+
+# Build artifacts (built fresh in container)
+dist/

.eslintrc.cjs

@@ -1,282 +0,0 @@
-module.exports = {
-  env: {
-    es2021: true,
-    node: true,
-    browser: true,
-    mocha: true,
-  },
-  parser: '@babel/eslint-parser',
-  extends: ['eslint:recommended', 'prettier'],
-  plugins: ['react'],
-  globals: {
-    Promise: false,
-    describe: true,
-    after: true,
-    it: true,
-    fetch: true,
-  },
-  parserOptions: {
-    sourceType: 'module',
-  },
-  rules: {
-    eqeqeq: [2, 'allow-null'],
-
-    // ###########################################################
-    // ### Semantics / Performance impacting
-    // ###########################################################
-    // babel inserts `'use strict';` for us
-    strict: 0,
-
-    'no-redeclare': [2, { builtinGlobals: false }],
-
-    // If a class method does not use this, it can safely be made a static function.
-    // http://eslint.org/docs/rules/class-methods-use-this
-    'class-methods-use-this': ['off'],
-
-    // ###########################################################
-    // ### Style
-    // ###########################################################
-    indent: ['off', 2],
-    'linebreak-style': ['error', 'unix'],
-    quotes: ['error', 'single', { avoidEscape: true, allowTemplateLiterals: true }],
-    semi: ['error', 'always'],
-    'no-console': ['error', { allow: ['warn', 'error'] }],
-
-    // ###########################################################
-    // ### React
-    // ###########################################################
-    // Specify whether double or single quotes should be used in JSX attributes
-    // http://eslint.org/docs/rules/jsx-quotes
-    'jsx-quotes': ['error', 'prefer-double'],
-
-    // Prevent missing displayName in a React component definition
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/display-name.md
-    'react/display-name': ['off'],
-
-    // Forbid certain propTypes (any, array, object)
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/forbid-prop-types.md
-    'react/forbid-prop-types': 'off',
-
-    // Validate closing bracket location in JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-closing-bracket-location.md
-    'react/jsx-closing-bracket-location': ['off'],
-
-    // Enforce or disallow spaces inside of curly braces in JSX attributes
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-curly-spacing.md
-    'react/jsx-curly-spacing': ['off'],
-
-    // Enforce event handler naming conventions in JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-handler-names.md
-    'react/jsx-handler-names': [
-      'off',
-      {
-        eventHandlerPrefix: 'handle',
-        eventHandlerPropPrefix: 'on',
-      },
-    ],
-
-    // Validate props indentation in JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-indent-props.md
-    'react/jsx-indent-props': 'off',
-
-    // Validate JSX has key prop when in array or iterator
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-key.md
-    'react/jsx-key': 'off',
-
-    // Limit maximum of props on a single line in JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-max-props-per-line.md
-    'react/jsx-max-props-per-line': ['off'],
-
-    // Prevent usage of .bind() in JSX props
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-bind.md
-    'react/jsx-no-bind': [
-      'error',
-      {
-        ignoreRefs: true,
-        allowArrowFunctions: true,
-        allowBind: false,
-      },
-    ],
-
-    // Prevent duplicate props in JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-duplicate-props.md
-    'react/jsx-no-duplicate-props': ['error', { ignoreCase: true }],
-
-    // Prevent usage of unwrapped JSX strings
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-literals.md
-    'react/jsx-no-literals': 'off',
-
-    // Disallow undeclared variables in JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-undef.md
-    'react/jsx-no-undef': 'error',
-
-    // Enforce PascalCase for user-defined JSX components
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-pascal-case.md
-    'react/jsx-pascal-case': [
-      'error',
-      {
-        allowAllCaps: true,
-        ignore: [],
-      },
-    ],
-
-    // Enforce propTypes declarations alphabetical sorting
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/sort-prop-types.md
-    'react/sort-prop-types': [
-      'off',
-      {
-        ignoreCase: true,
-        callbacksLast: false,
-        requiredFirst: false,
-      },
-    ],
-
-    // Deprecated in favor of react/jsx-sort-props
-    'react/jsx-sort-prop-types': 'off',
-
-    // Enforce props alphabetical sorting
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-sort-props.md
-    'react/jsx-sort-props': 'off',
-
-    // Prevent React to be incorrectly marked as unused
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-uses-react.md
-    'react/jsx-uses-react': 'error',
-
-    // Prevent variables used in JSX to be incorrectly marked as unused
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-uses-vars.md
-    'react/jsx-uses-vars': 'error',
-
-    // Prevent usage of dangerous JSX properties
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-danger.md
-    'react/no-danger': 'warn',
-
-    // Prevent usage of deprecated methods
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-deprecated.md
-    'react/no-deprecated': ['error'],
-
-    // Prevent usage of setState in componentDidMount
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-did-mount-set-state.md
-    'react/no-did-mount-set-state': ['error'],
-
-    // Prevent usage of setState in componentDidUpdate
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-did-update-set-state.md
-    'react/no-did-update-set-state': ['warn'],
-
-    // Prevent direct mutation of this.state
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-direct-mutation-state.md
-    'react/no-direct-mutation-state': 'off',
-
-    // Prevent usage of isMounted
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-is-mounted.md
-    'react/no-is-mounted': 'error',
-
-    // Prevent usage of setState
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-set-state.md
-    'react/no-set-state': 'off',
-
-    // Prevent using string references
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-string-refs.md
-    'react/no-string-refs': 'warn',
-
-    // Prevent usage of unknown DOM property
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-unknown-property.md
-    'react/no-unknown-property': 'error',
-
-    // Prevent missing props validation in a React component definition
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/prop-types.md
-    'react/prop-types': ['error', { ignore: [], customValidators: [], skipUndeclared: true }],
-
-    // Prevent missing React when using JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/react-in-jsx-scope.md
-    'react/react-in-jsx-scope': 'error',
-
-    // Restrict file extensions that may be required
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/require-extension.md
-    // deprecated in favor of import/extensions
-    'react/require-extension': ['off', { extensions: ['.jsx', '.js'] }],
-
-    // Require render() methods to return something
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/require-render-return.md
-    'react/require-render-return': 'error',
-
-    // Prevent extra closing tags for components without children
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/self-closing-comp.md
-    'react/self-closing-comp': 'warn',
-
-    // Enforce component methods order
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/sort-comp.md
-    'react/sort-comp': 'off',
-
-    // Prevent missing parentheses around multilines JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-wrap-multilines.md
-    'react/jsx-wrap-multilines': [
-      'warn',
-      {
-        declaration: true,
-        assignment: true,
-        return: true,
-      },
-    ],
-    'react/wrap-multilines': 'off', // deprecated version
-
-    // Require that the first prop in a JSX element be on a new line when the element is multiline
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-first-prop-new-line.md
-    'react/jsx-first-prop-new-line': ['off'],
-
-    // Enforce spacing around jsx equals signs
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-equals-spacing.md
-    'react/jsx-equals-spacing': ['warn', 'never'],
-
-    // Disallow target="_blank" on links
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-target-blank.md
-    'react/jsx-no-target-blank': 'error',
-
-    // only .jsx files may have JSX
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-filename-extension.md
-    'react/jsx-filename-extension': ['error', { extensions: ['.jsx'] }],
-
-    // prevent accidental JS comments from being injected into JSX as text
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-no-comment-textnodes.md
-    'react/jsx-no-comment-textnodes': 'error',
-    'react/no-comment-textnodes': 'off', // deprecated version
-
-    // disallow using React.render/ReactDOM.render's return value
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-render-return-value.md
-    'react/no-render-return-value': 'error',
-
-    // require a shouldComponentUpdate method, or PureRenderMixin
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/require-optimization.md
-    'react/require-optimization': ['off', { allowDecorators: [] }],
-
-    // warn against using findDOMNode()
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-find-dom-node.md
-    'react/no-find-dom-node': 'warn',
-
-    // Forbid certain props on Components
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/forbid-component-props.md
-    'react/forbid-component-props': ['off', { forbid: [] }],
-
-    // Prevent problem with children and props.dangerouslySetInnerHTML
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-danger-with-children.md
-    'react/no-danger-with-children': 'error',
-
-    // Prevent unused propType definitions
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-unused-prop-types.md
-    'react/no-unused-prop-types': [
-      'warn',
-      {
-        customValidators: [],
-        skipShapeProps: true,
-      },
-    ],
-
-    // Require style prop value be an object or var
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/style-prop-object.md
-    'react/style-prop-object': 'error',
-
-    // Prevent passing of children as props
-    // https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/no-children-prop.md
-    'react/no-children-prop': 'warn',
-
-  },
-};

.gitattributes

@@ -0,0 +1 @@
+test/testFixtures/** linguist-vendored

.github/FUNDING.yml

@@ -1,3 +1,4 @@
 # These are supported funding model platforms
 
 github: [orangecoding]
+ko_fi: orangecoding

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,112 @@
+name: Bug Report
+description: Help us improve Fredy by reporting a bug
+title: "[Bug]: "
+labels: [bug]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Please attach a debug bundle (available since Fredy 22.5.0+)
+
+        Since **Fredy 22.5.0** you can export a debug bundle that contains a system
+        snapshot (`sys.txt`, Fredy version, Node.js version, OS, Docker detection,
+        CPU, memory, sanitized settings) and the full log buffer (`logs.txt`) that
+        Fredy recorded while you reproduced the issue. Attaching it dramatically
+        speeds up triage.
+        Oh and before you ask: I decided against simply putting all logs into the debug
+        due to privacy reasons :)
+
+        **The bundle is only useful when the error is actually inside `logs.txt`.**
+        That means you have to record first, reproduce after:
+
+        1. Log in to Fredy as **admin** and open **Settings → Debug**.
+        2. Click **"Enable debug logging" / "Debug-Logging aktivieren"**. A red banner
+           appears across the whole app while recording is on.
+        3. **Now reproduce the bug.** Trigger the broken job, click the failing
+           button, wait for the failing scrape — whatever it was.
+        4. Come back to **Settings → Debug** and confirm the progress bar moved
+           (i.e. log entries were actually written). If it stayed at 0%, nothing was
+           captured and the bundle won't help us.
+        5. Click **"Download debug information" / "Debug Informationen herunterladen"**
+           and drop the resulting `FredyDebug-*.zip` into the "Screenshots / Logs"
+           field below.
+        6. Optional but recommended: click **"Disable debug logging"** to stop the
+           recording, and **"Delete stored debug logs"** once you have the zip so the
+           database does not keep them around.
+
+        On Fredy versions older than 22.5.0, paste the relevant log lines from your
+        console / Docker / systemd journal manually instead.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: Provide a clear and concise description of the bug.
+      placeholder: e.g. "Fredy crashes when I click on Save."
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: List the steps to reproduce the issue.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What did you expect to happen?
+      placeholder: "It should save without errors."
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: What actually happened?
+      placeholder: "Fredy crashed with error XYZ."
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots / Logs
+      description: |
+        Drop the FredyDebug-*.zip here (see the instructions at the top, available
+        since Fredy 22.5.0) and/or any additional screenshots. If you cannot produce
+        the bundle, paste relevant log lines instead.
+      placeholder: "Drag and drop the FredyDebug-*.zip and any screenshots here."
+    validations:
+      required: false
+
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: |
+        Provide details about your environment. You can copy most of this from
+        sys.txt inside the debug bundle.
+      placeholder: "OS: macOS 15, Browser: Chrome 124, App version: 22.5.0, Docker: yes"
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Add any other context about the problem here.
+      placeholder: "Any other information that might help..."
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,24 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,51 @@
+name: Feature Request
+description: Suggest an improvement or new idea for Fredy
+title: "[Feature]: "
+labels: [enhancement]
+assignees: []
+
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Related Problem
+      description: Is your feature request related to a problem? Describe it clearly.
+      placeholder: "Example: It’s difficult to do X when Y happens..."
+    validations:
+      required: false
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Feature
+      description: Describe the feature you would like to see.
+      placeholder: "I would like Fredy to automatically..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: List any alternative solutions or workarounds you’ve tried or thought about.
+      placeholder: "Instead of this, I also considered..."
+    validations:
+      required: false
+
+  - type: textarea
+    id: benefits
+    attributes:
+      label: Benefits
+      description: Explain how this feature would improve Fredy or it's user experience.
+      placeholder: "This would save users time by..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Add any other context, examples, or screenshots that might help clarify your idea.
+      placeholder: "Any other relevant information..."
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/workflows/check_source.yml

@@ -0,0 +1,26 @@
+name: Check the source code
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+jobs:
+  check_source_code:
+    name: Check the source code
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'yarn'
+
+      - name: Install dependencies
+        run: yarn install
+
+      - name: Check formatting
+        run: yarn format:check
+
+      - name: Lint
+        run: yarn lint

.github/workflows/docker.yml

@@ -1,4 +1,5 @@
 name: Create and publish Docker image
+
 on:
   push:
     branches:
@@ -17,15 +18,24 @@ jobs:
       contents: read
       packages: write
 
-    steps:
+    concurrency:
-      - name: Set up Docker Buildx
+      group: ${{ github.workflow }}-${{ github.ref }}
-        uses: docker/setup-buildx-action@v1
+      cancel-in-progress: true
 
+    steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+        with:
+          platforms: linux/amd64,linux/arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -33,14 +43,56 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v4
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Test container health with docker compose
+      - name: Test container with docker compose
+        run: |
+          echo "Starting container with docker compose..."
+          mkdir -p ./db ./conf && chmod 777 ./db ./conf
+          docker compose up --build -d
+          echo "Waiting for container to be ready (60 seconds for start_period)..."
+          sleep 60
+
+          echo "Monitoring container health for 30 seconds..."
+          SECONDS_ELAPSED=0
+          HEALTH_CHECK_INTERVAL=5
+          TOTAL_DURATION=30
+          
+          while [ $SECONDS_ELAPSED -lt $TOTAL_DURATION ]; do
+            HEALTH_STATUS=$(docker inspect --format='{{.State.Health.Status}}' fredy 2>/dev/null || echo "not_found")
+            CONTAINER_STATUS=$(docker inspect --format='{{.State.Status}}' fredy 2>/dev/null || echo "not_found")
+            echo "[$SECONDS_ELAPSED/$TOTAL_DURATION sec] Container: $CONTAINER_STATUS, Health: $HEALTH_STATUS"
+            
+            # Check if container is not running or unhealthy
+            if [ "$CONTAINER_STATUS" != "running" ]; then
+              echo "Container stopped running! Status: $CONTAINER_STATUS"
+              docker compose logs fredy
+              exit 1
+            fi
+            
+            if [ "$HEALTH_STATUS" = "unhealthy" ]; then
+              echo "Container is unhealthy!"
+              docker compose logs fredy
+              docker inspect --format='{{json .State.Health}}' fredy | jq
+              exit 1
+            fi
+            
+            sleep $HEALTH_CHECK_INTERVAL
+            SECONDS_ELAPSED=$((SECONDS_ELAPSED + HEALTH_CHECK_INTERVAL))
+          done
+
+          docker compose down

.github/workflows/stales.yml

@@ -0,0 +1,21 @@
+name: Close stale issues and PRs
+
+on:
+  schedule:
+    - cron: '0 0 * * *' # Daily
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v7
+        with:
+          days-before-stale: 30
+          days-before-close: 7
+          stale-issue-message: 'This issue has been automatically marked as stale due to inactivity.'
+          stale-pr-message: 'This PR has been automatically marked as stale due to inactivity.'
+          close-issue-message: 'Closing this issue due to prolonged inactivity.'
+          close-pr-message: 'Closing this PR due to prolonged inactivity.'
+          exempt-issue-labels: 'keep-open'
+          exempt-pr-labels: 'keep-open'
+          only: 'pulls'

.github/workflows/test.yml

@@ -1,21 +1,22 @@
 name: Test
 on:
   push:
-    branches:
+    branches: [master]
-      - master
   pull_request:
-    branches:
+    branches: [master]
-      - master
+  schedule:
+    - cron: '0 12 * * *'
+
 jobs:
   test:
-    name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
-      - name: Setup node
+
-        uses: actions/setup-node@v2.5.1
+      - uses: actions/setup-node@v4
         with:
-          node-version: 16
+          node-version: 22
           cache: 'yarn'
+
       - run: yarn install
-      - run: yarn run test
+      - run: yarn test:offline

.gitignore

@@ -1,6 +1,10 @@
 node_modules/
 ui/public/
-db/
+db/*.json
+db/*.db*
 npm-debug.log
 .DS_Store
 .idea
+.vscode
+tools/release/config.json
+.agents

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.prettierignore

@@ -0,0 +1,6 @@
+/ui/public
+/db/
+/conf/
+
+# TODO re-write from scratch or fix all html structure issues
+/lib/notification/emailTemplate/template.hbs

.prettierrc

@@ -0,0 +1,4 @@
+{
+  "singleQuote": true,
+  "printWidth": 120
+}

.travis.yml

@@ -1,2 +0,0 @@
-sudo: false
-language: node_js

CHANGELOG.md

@@ -1,78 +0,0 @@
-Newer release changelog see https://github.com/orangecoding/fredy/releases
-
-------------
-
-###### [V5.5.0]
-- Upgrading dependencies
-- fixing provider
-- allow multiple instances of 1 provider  
-- __BREAKING__: Minimum node version is now 16
-
-###### [V5.4.6]
-- Adding Instana node.js monitoring
-- 
-###### [V5.4.5]
-- Adding Instana node.js monitoring 
-
-###### [V5.4.4]
-- Add support for Immo Südwest Presse (immo.swp.de)
-- Telegram: Use job name instead of ID and link in title
-- Fix race condition if user ID is in session but not in user store
-- Allow visiting the original provider URL
-
-###### [V5.4.3]
-- re-writing readme
-- improving docker build
-- using github's actions to build docker and test automatically
-
-###### [V5.4.2]
-- Fixing prod build
-
-###### [V5.4.1]
-- Upgrading dependencies
-- Provider urls are now automagically been changed to include the correct sort order for search results
-
-```
-Note: It has been an point of confusion since the very beginning of Fredy, that people simply copied the url, but
-did not take care of sorting the search results by date. If this is not done, Fredy will most likely not see the latest
-results, thus cannot report them. This release fixes it by adding the necessary params (or replaces them).
-```
-
-###### [V5.3.0]
-- Upgrading dependencies
-- It's now possible to send mails to multiple receiver using comma separation for MailJet & Sendgrid
-- Fixing Immowelt scraping
-
-###### [V5.2.0]
-- Upgrading dependencies
-- Adding new similarity check layer (Duplicates are being removed now)
-- Adding paging for search results
-
-###### [V5.1.0]
-- Upgrading dependencies
-- NodeJS 12.13 is now the minimum supported version
-- Adding general settings as new configuration page to ui
-- Adding new feature working hours
-
-###### [V5.0.0]
-- Upgrading dependencies
-- NodeJS 12 is now the minimum supported version
-
-###### [V4.0.0]
-Bringing back Immoscout :tada:
-
-###### [V3.0.0]
-This is basically a re-write, your old config file will not be compatible anymore. Please re-created your search jobs
-on the new ui and use the values from your previous config file if needed.
-```
-- We're getting rid of manual config changes, Fredy, now ships with a UI so that it's easy for you to create and edit jobs
-```
-
-###### [V2.0.0]
-```
-- Fredy can now run multiple search job on one instance
-- Changed lot's of the structure of Fredy to make this happen
-[BREAKING CHANGES]
-- The config has been changed, the config of V1.x will not work any longer
-- Sources have been renamed to provider
-```

CLAUDE.md

@@ -0,0 +1,120 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Fredy is a self-hosted real estate finder for Germany. It scrapes German real estate portals (ImmoScout24, Immowelt, Immonet, Kleinanzeigen, WG-Gesucht, etc.), deduplicates results across providers, and sends notifications via Slack, Telegram, Email, Discord, ntfy, etc. It includes a React web UI and a built-in MCP server for LLM access to listings data.
+
+- Node.js >= 22, ESM-only (`"type": "module"`)
+- Default port: 9998, default login: admin / admin
+- SQLite via `better-sqlite3` (synchronous - all DB ops are sync; only network I/O is async)
+
+## Commands
+
+```bash
+# Development
+yarn run start:backend:dev    # nodemon backend
+yarn run start:frontend:dev   # Vite dev server (proxies /api → :9998)
+
+# Production
+yarn run start:backend        # NODE_ENV=production node index.js
+yarn run build:frontend       # vite build → ui/public/
+
+# Tests
+yarn test                     # Live tests (hits actual providers)
+yarn test:offline             # Offline tests using HTML/JSON fixtures (fast, preferred)
+yarn test:download-fixtures   # Re-download fresh provider HTML fixtures
+
+# Single test file
+TEST_MODE=offline npx vitest run test/provider/immoscout.test.js
+
+# Lint / Format
+yarn lint && yarn lint:fix
+yarn format && yarn format:check
+
+# DB migrations
+yarn migratedb
+```
+
+## Architecture
+
+### Core data flow
+
+```
+index.js (startup)
+  ├── runMigrations()
+  ├── getProviders()            # lazily imports lib/provider/*.js
+  ├── similarityCache.init()    # preloads hash cache from DB
+  ├── api.js                    # starts fastify HTTP server
+  └── initJobExecutionService() # registers event-bus listeners + starts scheduler
+
+scheduler (every N minutes) or manual trigger via POST /api/jobs/:id/run
+  └── FredyPipelineExecutioner.execute()
+      1. queryStringMutator(url)           # inject sort-by-date param
+      2. provider.getListings()            # API or Puppeteer+Cheerio
+      3. provider.normalize(listing)       # raw → ParsedListing
+      4. provider.filter(listing)          # blacklist + required fields
+      5. filter to hashes not yet in DB
+      6. provider.fetchDetails()           # optional enrichment
+      7. geocodeAddress()                  # optional lat/lng
+      8. storeListings()
+      9. similarityCache.checkAndAddEntry() # cross-provider dedup
+      10. _filterBySpecs() + _filterByArea()
+      11. notify.send()                    # fan-out to all adapters
+```
+
+### Plugin systems
+
+**Providers** (`lib/provider/*.js`) - each module exports:
+- `metaInformation` - `{ id, name, baseUrl }`
+- `config` - `ProviderConfig` with `requiredFieldNames`, `crawlContainer`, `crawlFields`, `sortByDateParam`, `normalize()`, `filter()`, optional `getListings()`, `fetchDetails()`, `activeTester()`
+- `init(sourceConfig, blacklist)` - called before each job run; providers are **stateful modules** holding mutable `url` and `appliedBlackList` at module scope
+
+**Notification adapters** (`lib/notification/adapter/*.js`) - each exports:
+- `config` - `{ id, name, description, fields }` (drives the UI form)
+- `send({ serviceName, newListings, notificationConfig, jobKey, baseUrl })`
+- Loaded dynamically at startup via `fs.readdirSync`
+
+### Key services
+
+| Service | Location | Notes |
+|---|---|---|
+| Event bus | `lib/services/events/event-bus.js` | Plain `EventEmitter`; events: `jobs:runAll`, `jobs:runOne`, `jobs:status` |
+| SSE broker | `lib/services/sse/sse-broker.js` | Per-userId `Set<ServerResponse>`; heartbeat every 25s; pushes job status to UI |
+| Similarity cache | `lib/services/similarity-check/` | In-memory SHA-256 Set; refreshes hourly; cross-provider dedup by title+price+address |
+| SqliteConnection | `lib/services/storage/SqliteConnection.js` | Singleton, WAL mode; `execute()`, `query()`, `withTransaction()` |
+| Migrations | `lib/services/storage/migrations/` | Numbered JS files each exporting `up(db)`; checksum-tracked in `schema_migrations` |
+| Extractor | `lib/services/extractor/` | Orchestrates Puppeteer + Cheerio; shared browser instance per job |
+
+### Frontend
+
+- React 19 SPA, Vite build → `ui/public/` (served as static by backend)
+- State: Zustand single store with per-domain slices
+- UI library: `@douyinfe/semi-ui`
+- Map: MapLibre GL + `@mapbox/mapbox-gl-draw` + `@turf/boolean-point-in-polygon` for GeoJSON polygon filters
+- In dev: Vite proxies `/api` to `:9998`
+
+### MCP server
+
+Two transports:
+1. **stdio** (`lib/mcp/stdio.js`) - for Claude Desktop/LM Studio; opens its own DB connection (main process need not be running)
+2. **HTTP** (`/api/mcp`) - authenticated via Bearer token (`mcp_token` column in `users` table)
+
+Tools: `list_jobs`, `get_job`, `list_listings`, `get_listing`, `get_current_date_time`. Responses are Markdown via `lib/mcp/mcpNormalizer.js`.
+
+## Key Conventions
+
+- **ESM only** - `import`/`export` everywhere, no CommonJS
+- **JSDoc typedefs** (no TypeScript) in `lib/types/` - `listing.js`, `job.js`, `filter.js`, `providerConfig.js`
+- **Copyright header** required on all `.js` files - enforced by `lint-staged` pre-commit hook via `copyright.js`
+- **`NoNewListingsWarning`** (`lib/errors.js`) is used as control flow to short-circuit the pipeline (not an error)
+- **Test fixtures** in `test/testFixtures/` - HTML/JSON snapshots per provider; `TEST_MODE=offline` mocks `puppeteerExtractor` and global `fetch` via `test/offlineFixtures.js`
+- **`conf/config.json`** is the only runtime config file; created with defaults if missing
+
+## Coding
+- After building the task, run the linter
+- After building the task, run the tests
+- New features must be tested
+- New features must be properly documented with JsDoc
+- You do **not** commit any changes, you do **not** create a new branch unless I told you so

CONTRIBUTING.md

@@ -2,8 +2,8 @@
 
 If you want to contribute, please make sure you've executed the tests.
 
-
 ### How to write new provider?
+
 - create the provider filer under `/lib/provider`
 - create a test under /test and make sure it is running successfully
 
@@ -27,7 +27,7 @@ function applyBlacklist(o) {
 
 const config = {
   url: null,
-    //this is the container wrapping the search listings
+  //this is the container wrapping the search listings
   crawlContainer: '#result-list-stage .item',
   crawlFields: {
     id: '@id',
@@ -57,11 +57,10 @@ exports.metaInformation = {
 };
 
 exports.config = config;
-
 ```
 
-
 ### How to write new notification adapter?
+
 - create the provider filer under `/lib/notification/adapter`
 - create a description of the provider under `/lib/notification/adapter/*.md`. Make sure the name of the md file is equal to the notification adapter
 
@@ -72,50 +71,48 @@ const Slack = require('slack');
 const msg = Slack.chat.postMessage;
 const { markdown2Html } = require('../../services/markdown');
 
-
 //as a parameter, you will always get the serviceName, newListings and all the values, that
 //you have defined exports.config.fields. (This is being used for rendering in the frontend)
 exports.send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
-    const { token, channel } = notificationConfig.find((adapter) => adapter.id === 'slack').fields;
+  const { token, channel } = notificationConfig.find((adapter) => adapter.id === 'slack').fields;
-    return newListings.map((payload) => {
+  return newListings.map((payload) => {
-        //tho whatever needs to be done to send the data to the receiver, make sure the format is human readable
+    //tho whatever needs to be done to send the data to the receiver, make sure the format is human readable
-    });
+  });
 };
 
 exports.config = {
-    id: __filename.slice(__dirname.length + 1, -3),
+  id: __filename.slice(__dirname.length + 1, -3),
-    name: 'someUniqueName, used in the frontend',
+  name: 'someUniqueName, used in the frontend',
-    //this readme is rendered in the frontend to explain how to use this
+  //this readme is rendered in the frontend to explain how to use this
-    readme: markdown2Html('lib/notification/adapter/slack.md'),
+  readme: markdown2Html('lib/notification/adapter/slack.md'),
-    description: 'Some description text rendered on the notification page',
+  description: 'Some description text rendered on the notification page',
-    fields: {
+  fields: {
-        token: {
+    token: {
-            //type can be text/number/boolean
+      //type can be text/number/boolean
-            type: 'text',
+      type: 'text',
-            label: 'Token',
+      label: 'Token',
-            description: 'The token needed to send notifications to slack.',
+      description: 'The token needed to send notifications to slack.',
-        },
-        channel: {
-            type: 'channel',
-            label: 'Channel',
-            description: 'The channel where fredy should send notifications to.',
-        },
     },
+    channel: {
+      type: 'channel',
+      label: 'Channel',
+      description: 'The channel where fredy should send notifications to.',
+    },
+  },
 };
-
 ```
 
 #### Running Tests
-If you've written a new provider you are an awesome person. You know it and I do. If you now write tests for it, you are even more awesome. And who doesn't want to be more awesome right?
 
-To write tests for provider, you need to use Node 8 as the tests are using `async / await`
+If you've written a new provider you are an awesome person. If you now write tests for it, you are even more awesome. And who doesn't want to be more awesome, right?
 
 #### Codestyle
-I'm using Eslint to maintain quote style and quality. Do not skip it...
 
-##### To do before merging:
+I'm using ESLint to maintain quote style and quality. Do not skip it...
 
-- executed tests? (`yarn run test`)
+##### To-do before merging:
-- sure the changes are useful for everybody? Or is it maybe a custom modification just for your case?
+
+- Have you executed the tests? (`yarn test`)
+- Are you sure the changes are useful for everybody? Or is it maybe a custom modification just for your case?
 
 _Thanks!_ :heart:

Dockerfile

@@ -1,18 +1,54 @@
-# syntax=docker/dockerfile:1.3
+FROM node:22-slim
-FROM node:16-alpine AS builder
+
-COPY --chown=1000:1000 . /fredy
+# System deps for CloakBrowser + build tools for native modules (better-sqlite3)
-WORKDIR  /fredy
+# fonts-noto-color-emoji and fonts-freefont-ttf are required so canvas fingerprint
-USER 1000
+# hashes match real browsers; missing emoji fonts cause bot detection on Kasada/Akamai.
-RUN yarn install
+RUN apt-get update && apt-get install -y --no-install-recommends \
-RUN yarn run prod
+    curl ca-certificates fonts-liberation libasound2 \
+    libatk-bridge2.0-0 libatk1.0-0 libcups2 libdbus-1-3 \
+    libdrm2 libgbm1 libgtk-3-0 libnspr4 libnss3 \
+    libx11-xcb1 libxcomposite1 libxdamage1 libxrandr2 xdg-utils \
+    fonts-noto-color-emoji fonts-freefont-ttf \
+    python3 make g++ \
+  && rm -rf /var/lib/apt/lists/* \
+  && mkdir -p /db /conf /fredy
+
+WORKDIR /fredy
+
+ENV NODE_ENV=production \
+    IS_DOCKER=true
+
+COPY package.json yarn.lock ./
+
+# Install dependencies and purge build tools (only needed to compile better-sqlite3)
+RUN yarn config set network-timeout 600000 \
+  && yarn --frozen-lockfile \
+  && yarn cache clean
+
+# Pre-download the CloakBrowser stealth Chromium binary (supports x86_64 and arm64)
+RUN node -e "import('cloakbrowser').then(({ensureBinary}) => ensureBinary())"
+
+# Purge build tools now that native modules are compiled
+RUN apt-get purge -y python3 make g++ \
+  && apt-get autoremove -y \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY index.html vite.config.js ./
+COPY ui ./ui
+COPY lib ./lib
+
+RUN yarn build:frontend
+
+COPY index.js ./
+
+RUN ln -s /db /fredy/db \
+  && ln -s /conf /fredy/conf
 
-FROM node:16-alpine
-COPY --from=builder --chown=1000:1000 /fredy /fredy
-RUN mkdir /db /conf && \
-  chown 1000:1000 /db /conf && \
-  ln -s /db /fredy/db && ln -s /conf /fredy/conf
 EXPOSE 9998
-USER 1000
+VOLUME /db
-VOLUME [ "/conf", "/db" ]
+VOLUME /conf
-WORKDIR  /fredy
+
-CMD node index.js --no-daemon
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+  CMD curl -f http://localhost:9998/ || exit 1
+
+CMD ["node", "index.js"]

LICENSE

@@ -1,21 +1,214 @@
-MIT License
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
 
-Copyright (c) 2023 Christian Kellner
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
+1. Definitions.
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
+   "License" shall mean the terms and conditions for use, reproduction,
-copies or substantial portions of the Software.
+   and distribution as defined by Sections 1 through 9 of this document.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   "Licensor" shall mean the copyright owner or entity authorized by
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   the copyright owner that is granting the License.
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   "Legal Entity" shall mean the union of the acting entity and all
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   other entities that control, are controlled by, or are under common
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   control with that entity. For the purposes of this definition,
-SOFTWARE.
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor
+   be liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+
+Additional License Condition – Commons Clause
+
+The Licensed Work is provided under the terms of this license and is also
+subject to the following additional condition ("Commons Clause"):
+
+"License Condition v1.0":
+
+The Licensed Work and its derivative works may not be used by any person or
+organization to Sell the Licensed Work (as defined below).
+
+"Sell" or "Selling" means practicing any or all of the rights granted to you
+under the License to provide to third parties, for a fee or other consideration
+(including without limitation fees for hosting or consulting/support services
+related to the Software), a product or service whose value derives, entirely or
+substantially, from the functionality of the Licensed Work.
+
+A non-exhaustive list of activities considered "Selling" includes:
+- Using the Licensed Work to provide paid hosted services or managed services
+- Distributing the Licensed Work as part of a commercial product or service
+  for which a fee is charged primarily for the value of the Licensed Work
+
+This restriction does not apply to the use of the Licensed Work for internal
+business purposes or non-commercial use.
+
+
+Attribution and Naming Clause
+
+Any derivative work based on this software must include clear and visible
+attribution to the original project "Fredy" and its author(s).
+Derivative works may not be distributed, published, or presented under a
+different name or branding without the explicit written permission of the
+original copyright holder.
+
+
+Copyright (c) 2026 Christian Kellner
+Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause

README.md

@@ -1,117 +1,385 @@
-<img src="https://github.com/orangecoding/fredy/blob/master/doc/logo.png" width="400">  
-
-![Build Status](https://github.com/orangecoding/fredy/actions/workflows/test.yml/badge.svg)
-
-Searching an apartment in Germany can be a frustrating task. Not any longer though, as _Fredy_ will take over and will only notify you once new listings have been found that match your requirements.
-
-_Fredy_ scrapes multiple services (Immonet, Immowelt etc.) and send new listings to you once they become available. The list of available services can easily be extended. For your convenience, _Fredy_ has a UI to help you configure your search jobs.   
-
-If _Fredy_ finds matching results, it will send them to you via Slack, Email, Telegram etc. (More adapters can be configured.) As _Fredy_ stores the listings it has found, new results will not be sent to you twice (and as a side-effect, _Fredy_ can show some statistics). Furthermore, _Fredy_ checks duplicates per scraping so that the same listings are not being sent twice or more when posted on various platforms (which happens more often than one might think).
-
-# Sponsorship [![](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86)](https://github.com/sponsors/orangecoding)    
-If you like my work, consider becoming a sponsor. I'm not expecting anybody to pay for _Fredy_ or any other Open Source Project I'm maintaining, however keep in mind, I'm doing all of this in my spare time :) Thanks.
-
-<img src="https://github.com/orangecoding/fredy/blob/master/doc/jetbrains.png" width="200">   
-
-_Fredy_ is supported by JetBrains under Open Source Support Program
-
-## Usage  
-
-- Make sure to use Node.js 16 or above
-- Run the following commands:
-```ssh
-yarn (or npm install)
-yarn run prod
-yarn run start
-```
-_Fredy_ will start with the default port, set to `9998`. You can access _Fredy_ by opening your browser at `http://localhost:9998`. The default login is `admin`, both for username and password. You should change the password as soon as possible when you plan to run Fredy on a server.
-
-<p align="center">
-  <img alt="Job Configuration" src="https://github.com/orangecoding/fredy/blob/master/doc/screenshot1.png" width="30%">
-&nbsp; &nbsp; &nbsp; &nbsp;
-  <img alt="Job Analytics" src="https://github.com/orangecoding/fredy/blob/master/doc/screenshot_2.png" width="30%">
-&nbsp; &nbsp; &nbsp; &nbsp;  
-  <img alt="Job Overview" width="30%" src="https://github.com/orangecoding/fredy/blob/master/doc/screenshot_3.png">
-</p>
 <p align="center">
 
+<a href="https://fredy.orange-coding.net/">
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://github.com/orangecoding/fredy/blob/master/doc/logo_white.png" width="400">
+  <source media="(prefers-color-scheme: light)" srcset="https://github.com/orangecoding/fredy/blob/master/doc/logo.png" width="400">
+  <img alt="Jetbrains Open Source" src="https://github.com/orangecoding/fredy/blob/master/doc/logo.png">
+</picture>
+</a>
 </p>
 
-## Understanding the fundamentals
+<p align="center">
-There are 3 important parts in Fredy, that you need to understand to leverage the full power of _Fredy_.
+  <a href="https://fredy.orange-coding.net/" target="_blank">Website</a>&nbsp;&nbsp;|&nbsp;&nbsp;
+  <a href="https://fredy-demo.orange-coding.net/" target="_blank">Demo</a>
+</p>
 
-#### Provider
+<p align="center">
-_Fredy_ supports multiple services. Immonet, Immowelt and Ebay are just a few examples. Those services are called providers within _Fredy_. When creating a new job, you can choose one or more providers.
+  <img src="https://github.com/orangecoding/fredy/actions/workflows/test.yml/badge.svg" alt="Tests" />
-A provider contains the URL that points to the search results for the respective service. If you go to immonet.de and search for something, the displayed URL in the browser is what the provider needs to do its magic.
+  <img src="https://github.com/orangecoding/fredy/actions/workflows/docker.yml/badge.svg" alt="Docker" />
-**It is important that you order the search results by date, so that _Fredy_ always picks the latest results first!**
+  <img src="https://github.com/orangecoding/fredy/actions/workflows/check_source.yml/badge.svg" alt="Source" />
+  <img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fghcr-badge.elias.eu.org%2Fapi%2Forangecoding%2Ffredy%2Ffredy&query=%24.downloadCount&label=Docker%20Pulls" alt="Docker Pulls" />
+</p>
 
-#### Adapter
-_Fredy_ supports multiple adapters, such as Slack, SendGrid, Telegram etc. A search job can have as many adapters as supported by _Fredy_. Each adapter needs different configuration values, which you have to provide when using them. A adapter dictactes how the frontend renders by telling the frontend what information it needs in order to send listings to the user.
 
-#### Jobs
-A Job wraps adapters and providers. _Fredy_ runs the configured jobs in a specific interval (can be configured in `/conf/config.json`).
 
-## Creating your first job
+# Fredy 🏡 - Your Self-Hosted Real Estate Finder for Germany
-To create your first job, click on the button "Create New Job" on the job table. The job creation dialog should be self-explanatory, however there is one important thing.
-When configuring providers, before copying the URL from your browser, make sure that you have sorted the results by date to make sure _Fredy_ always picks the latest results first.
 
-## User management
+Finding an apartment or house in Germany can be stressful and
-As an administrator, you can create, edit and remove users from _Fredy_. Be careful, each job is connected to the user that has created the job. If you remove the user, their jobs will also be removed.
+time-consuming.\
+**Fredy** makes it easier: it automatically scrapes **ImmoScout24,
+Immowelt, Immonet, eBay Kleinanzeigen, and WG-Gesucht** and notifies you
+instantly via **Slack, Telegram, Email, ntfy, discord and more** when new
+listings appear.
 
-# Development
+With a modern architecture, Fredy provides a **clean Web UI**, removes
+duplicates across platforms, and stores results so you never see the
+same listing twice.
 
-### Running Fredy in development mode
+------------------------------------------------------------------------
-To run _Fredy_ in development mode, you need to run the backend & frontend separately.
+
-Start the backend with:
+## ✨ Key Features
-```shell
+
-yarn run start
+-   🏠 Scrapes **ImmoScout24, Immowelt, Immonet, eBay Kleinanzeigen,
+    WG-Gesucht**
+-   ⚡ Instant notifications: Slack, Telegram, Email (SendGrid,
+    Mailjet), ntfy, discord 
+-   🔎 Uses the **ImmoScout Mobile API** (reverse engineered)
+-   🌍 Runs anywhere: Docker, Node.js, self-hosted
+-   🖥️ Intuitive **Web UI** to manage searches
+-   🎯 Easy to use thanks to a user-friendly Web UI
+-   🔄 Deduplication across platforms
+-   ⏱️ Customizable search intervals
+
+------------------------------------------------------------------------
+
+## 🤝 Sponsorship [![](https://img.shields.io/static/v1?label=Sponsor&message=❤&logo=GitHub&color=%23fe8e86)](https://github.com/sponsors/orangecoding)
+
+I maintain Fredy and other open-source projects in my free time, if you find it useful, consider supporting the project ❤️
+
+#### Support me on 
+[Ko-Fi](https://ko-fi.com/orangecoding) |  [Github](https://github.com/sponsors/orangecoding)
+----
+
+Fredy is proudly backed by the **JetBrains Open Source Support Program**.   
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://www.jetbrains.com/company/brand/img/logo_jb_dos_3.svg">
+  <source media="(prefers-color-scheme: light)" srcset="https://resources.jetbrains.com/storage/products/company/brand/logos/jetbrains.svg">
+  <img alt="Jetbrains Open Source" src="https://resources.jetbrains.com/storage/products/company/brand/logos/jetbrains.svg">
+</picture>
+
+------------------------------------------------------------------------
+
+## 👨‍🏫 Demo
+You can try out Fredy here: [Fredy Demo](https://fredy-demo.orange-coding.net/)
+
+------------------------------------------------------------------------
+
+## 🚀 Quick Start
+
+### With Docker
+
+> [!NOTE]
+> In order to start Fredy, you must provide a config.json. As a start, use the one in this repo: https://github.com/orangecoding/fredy/blob/master/conf/config.json
+
+``` bash
+docker run -d --name fredy \
+  -v fredy_conf:/conf \
+  -v fredy_db:/db \
+  -p 9998:9998 \
+  ghcr.io/orangecoding/fredy:master
 ```
-For the frontend, run:
+
-```shell
+Logs:
-yarn run dev
+
+``` bash
+docker logs fredy -f
+```
+
+### Manual (Node.js)
+
+-   Requirement: **Node.js 22 or higher**
+-   Install dependencies and start:
+
+``` bash
+yarn
+yarn run start:backend   # in one terminal
+yarn run start:frontend  # in another terminal
+```
+
+👉 Open <http://localhost:9998>
+
+### With Unraid
+
+Should you use [Unraid](https://unraid.net/), you can now install Fredy from the community store :)
+
+**Default Login:**
+- Username: `admin`
+- Password: `admin`
+
+------------------------------------------------------------------------
+
+## 📸 Screenshots
+
+| Fredy Maps View                                  | Dashboard                                               | Found Listings                                                              |
+|--------------------------------------------------|-----------------------------------------------------------------------|-----------------------------------------------------------------------------|
+| ![Screenshot showing Fredy](doc/screenshot1.png) | ![Screenshot showing job configuration in Fredy](doc/screenshot3.png) | ![Screenshot showing found listings in Fredy](doc/screenshot2.png) |
+
+------------------------------------------------------------------------
+
+## 🧩 Core Concepts
+
+Fredy is built around three simple concepts:
+
+### Provider 🌐
+
+A **provider** is a real-estate platform (e.g. ImmoScout24, Immowelt,
+Immonet, eBay Kleinanzeigen, WG-Gesucht).\
+When you create a job, you paste the search URL from the platform into
+Fredy.\
+⚠️ Always make sure the search results are sorted by **date**, so Fredy
+picks up the newest listings first.
+
+### Adapter 📡
+
+An **adapter** is the channel through which Fredy notifies you (Slack,
+Telegram, Email, ntfy, discord ...).\
+Each adapter has its own configuration (e.g. API keys, webhook URLs).\
+You can use multiple adapters at once --- Fredy will send new listings
+through all of them.
+
+### Job 📅
+
+A **job** combines providers and adapters.\
+Example: "Search apartments on ImmoScout24 + Immowelt and send results
+to Slack + Telegram."\
+Jobs run automatically at the interval you configure (see
+`/conf/config.json`).
+
+### MCP Server 🤖
+
+Starting with **V20**, Fredy ships with a built-in **MCP Server **. This allows you to connect Fredy to LLMs (like Claude, ChatGPT, or local models via LM Studio) and query your real estate data using natural language.
+The local LLM can even enrich existing listings by checking the listing online.   
+
+For more information on how to set it up and use it, please refer to the [MCP Readme](lib/mcp/README.md).
+
+------------------------------------------------------------------------
+
+## Immoscout
+
+Immoscout has implemented advanced bot detection. In order to work around this, we are using a reversed engineered version of their mobile api. See [Immoscout Reverse Engineering Documentation](https://github.com/orangecoding/fredy/blob/master/reverse-engineered-immoscout.md)
+
+## 🛡️ Bot Detection & Proxies
+
+Most browser-based providers (immowelt, immonet, kleinanzeigen, ...) are scraped through a hardened headless browser ([CloakBrowser](https://www.npmjs.com/package/cloakbrowser)). It makes the **browser fingerprint** indistinguishable from a real Chrome, which is enough when you run Fredy on a normal home connection.
+
+On a **server / VPS the requests usually originate from a datacenter IP**, and providers behind anti-bot systems (e.g. AWS CloudFront/WAF) block those based on **IP reputation alone**, no matter how perfect the fingerprint is. The typical symptom: it works locally but you get `We have been detected as a bot :-/` on the server.
+
+### The fix: a residential proxy
+
+A **residential proxy** routes Fredy's browser through the internet connection of a real household, so the provider sees a "normal user" IP instead of a datacenter. For German portals, use a **German (DE) residential** (or mobile/4G) proxy. Plain VPNs and **datacenter proxies do not help** here, they share the same bad reputation as your server.
+
+**Configure it** under **Settings → Execution → Proxy URL**. Supported formats:
+
+```
+http://user:pass@host:port
+socks5://user:pass@host:port
+```
+
+Leave the field empty to disable. The proxy applies to all headless-browser providers and takes effect on the next job run (no restart needed). Immoscout uses a separate mobile API and is not affected.
+
+### Where to get a residential proxy
+
+Residential proxies are a paid service (usually billed per GB, Fredy's traffic is small). Well-known providers offering German residential IPs include:
+
+| Provider | Notes |
+|---|---|
+| [IPRoyal](https://iproyal.com) | Pay-as-you-go, no monthly minimum, good for low volume |
+| [Webshare](https://www.webshare.io) | Cheap entry tier, has a small free plan to test with |
+| [Decodo (formerly Smartproxy)](https://decodo.com) | Easy setup, country/city targeting |
+| [SOAX](https://soax.com) | Residential + mobile, fine-grained geo-targeting |
+| [Bright Data](https://brightdata.com) | Largest pool, most features, higher complexity/price |
+| [Oxylabs](https://oxylabs.io) | Enterprise-grade, larger plans |
+
+This is not an endorsement, pick whatever fits your budget. For low-volume use like Fredy, a pay-as-you-go plan (e.g. IPRoyal) or a cheap entry tier (e.g. Webshare) is usually plenty. Make sure to select **Germany** as the proxy location and keep the search interval reasonable (the higher the interval, the less you look like a bot).
+
+## Analytics
+
+Fredy is completely free (and will always remain free). However, it would be a huge help if you’d allow me to collect some analytical data.
+Before you freak out, let me explain...  
+If you agree, Fredy will send a ping once every 6 hours to my internal tracking project (Will be open sourced soon).  
+The data includes: names of active adapters/providers, OS, architecture, Node version, and language. The information is entirely anonymous and helps me understand which adapters/providers are most frequently used.</p>
+
+**Thanks**🤘
+
+## 🐞 Debug Information
+
+Since Fredy **22.5.0** there is a built-in way to capture everything Fredy logs into the
+database for a limited time and download it as a single zip file. This is the recommended
+way to attach diagnostics to a bug report. I decided against simply putting all logs into
+a debug bundle due to privacy reasons!
+
+**How it works**
+
+- Debug logging is **opt-in** and admin-only. As long as it is off, Fredy behaves exactly
+  as before (console output only, nothing in the DB).
+- When you turn it on, every log line (`debug`, `info`, `warn`, `error`) is additionally
+  written into the `debug_logs` SQLite table. The console keeps logging at its usual level.
+- The recorded data is hard-capped at **5 MiB** via a rolling buffer: once the cap is hit,
+  the oldest entries are dropped automatically so the newest ones always survive.
+- The on/off flag is persisted, so debug logging stays on across restarts (and you'll see
+  the warning banner everywhere until you turn it off again).
+
+**Capturing a debug bundle**
+
+1. Open Fredy as an **admin** and go to **Settings → Debug**.
+2. Click **"Enable debug logging" / "Debug-Logging aktivieren"**. A red banner appears on
+   every page while recording is on.
+3. **Reproduce the bug**.
+4. Come back to **Settings → Debug** and check the progress bar, if it stayed at 0 %,
+   nothing was captured.
+5. Click **"Download debug information" / "Debug Informationen herunterladen"**. You get a
+   zip named `YYYY-MM-DD-FredyDebug-<version>.zip` containing two files:
+   - `logs.txt` - every log line captured while recording was on, prefixed with timestamp
+     and level.
+   - `sys.txt` - runtime snapshot (Fredy version, Node.js version, OS, Docker detection,
+     CPU, memory, sanitized settings). Proxy credentials and session secrets are
+     **stripped** before export.
+6. Attach the zip to the bug report.
+7. Optional but recommended: click **"Disable debug logging"** to stop recording, and
+   **"Delete stored debug logs"** once you've sent the zip so the DB does not keep them
+   around.
+
+**What is _not_ included**
+
+- passwords/privacy relevant things
+- Anything that Fredy itself does not pass through its `logger`. If a third-party library
+  writes directly to `process.stderr`, that output stays on the console only.
+
+## 🛠️ Development
+
+### Development Mode
+
+``` bash
+yarn run start:backend:dev
+yarn run start:frontend:dev
 ```
 You should now be able to access _Fredy_ from your browser. Check your Terminal to see what port the frontend is running on.
 
-### Running Tests
+### Run Tests
-To run the tests, run
+
-```shell
+## "Online" tests
+These tests are directly executed against the actual providers.
+``` bash
 yarn run test
 ```
 
-# Architecture
+## "Offline" tests
-![Architecture](/doc/architecture.jpg "Architecture")
+These tests are using the test fixtures instead of the actual providers. Much faster and "good enough" to test the core functionality.
+``` bash
+yarn run test:offline
+```
 
-### Immoscout / Immonet
+## Download new fixtures
-I have added **experimental** support for Immoscout and Immonet. They both are somewhat special, because they have decided to secure their service from bots using Re-Capture. Finding a way around this is barely possible. For _Fredy_ to be able to bypass this check, I'm using a service called [ScrapingAnt](https://scrapingant.com/). The trick is to use a headless browser, rotating proxies and (once successfully validated) to re-send the cookies each time.
+If you have to refresh the fixtures (every once in a while needed because the providers change their code), run this command:
+``` bash
+yarn run download-fixtures
+```
 
-To be able to use Immoscout / Immonet, you need to create an account at ScrapingAnt. Configure the API key in the "General Settings" tab (visible when logged in as administrator).
+## Adding a new language
-The rest will be handled by _Fredy_. Keep in mind, the support is experimental. There might be bugs and you might not always pass the re-capture check, but most of the time it works rather well :)
 
-If you need more than the 1000 API calls allowed per month, I'd suggest opting for a paid account... ScrapingAnt loves OpenSource, therefore they have decided to give all _Fredy_ users a 10% discount by using the code **FREDY10** (Disclaimer: I do not earn any money for recommending their service).
+Fredy's UI is fully multilingual. Translation files live in `ui/src/locales/`. To add a new language, create a single JSON file there, no code changes required.
 
-### Contribution guidelines  
+**Example: `ui/src/locales/fr.json`**
+```json
+{
+  "_meta": {
+    "flag": "🇫🇷",
+    "name": "Français",
+    "locale": "fr-FR",
+    "semiLocale": "fr"
+  },
+  "nav.dashboard": "Tableau de bord",
+  "common.save": "Enregistrer",
+  ...
+}
+```
 
-See [Contributing](https://github.com/orangecoding/fredy/blob/master/CONTRIBUTING.md)
+The `_meta` fields:
 
-# Docker   
+| Field | Description |
-Use the Dockerfile in this repository to build an image.  
+|---|---|
+| `flag` | Unicode flag emoji shown in the language selector |
+| `name` | Display name shown in the language selector |
+| `locale` | BCP 47 locale string used for date and number formatting (e.g. `fr-FR`) |
+| `semiLocale` | Semi UI locale key for component-level strings (date pickers, pagination, etc.) |
 
-Example: `docker build -t fredy/fredy /path/to/your/Dockerfile`  
+> **Important:** `semiLocale` must exactly match a locale filename from the Semi UI locale sources (without the `.js` extension). See the [available Semi UI locales on GitHub](https://github.com/DouyinFE/semi-design/tree/main/packages/semi-ui/locale/source) for the full list of supported keys.
 
-Or use docker-compose:
+After adding the file, rebuild the frontend (`yarn build:frontend` or restart the dev server) and the new language will appear automatically in **Settings → User Settings → Language**.
 
-Example `docker-compose build`
+------------------------------------------------------------------------
 
-Or use the container that will be built automatically.
+## 📐 Architecture
 
-`docker pull ghcr.io/orangecoding/fredy:master`
+``` mermaid
+flowchart TD
+ subgraph Jobs["Jobs"]
+        A1["Job 1"]
+        A2["Job 2"]
+        A3["Job 3"]
+  end
+ subgraph Providers["Providers"]
+        C1["Provider 1"]
+        C2["Provider 2"]
+        C3["Provider 3"]
+  end
+ subgraph NotificationAdapters["Notification Adapters"]
+        F1["Adapter 1"]
+        F2["Adapter 2"]
+  end
 
-## Create & run a container  
+    A1 --> B["FredyPipelineExecutioner"]
+    A2 --> B
+    A3 --> B
+    B --> C1 & C2 & C3
+    C1 --> D["Similarity Check"]
+    C2 --> D
+    C3 --> D
+    D --> E{"Duplicate?"}
+    E -- No --> F1
+    F1 --> F2
+```
 
-Put your config.json into a path of your choice, such as `/path/to/your/conf/`.
+------------------------------------------------------------------------
+## 🤖 Using AI such as Claude Code
+When I started building Fredy, LLMs were still basically the wet dream of a few nerdy scientists.
 
-Example: `docker create --name fredy -v /path/to/your/conf/:/conf -p 9998:9998 fredy/fredy`
+Nowadays, it’s easier than ever to throw a prompt into the LLM of your choice and let 'the AI' build your stuff. I’m not against that. I use Claude Code myself for smaller tasks, and I do think these tools can be really useful.
 
-## Logs  
+That said, I still believe humans should stay in charge. AI is great-ish at writing code, but it still lacks creativity, context, and the ability to see the full picture.
 
-You can browse the logs with  `docker logs fredy -f`.
+So, if you want to contribute to Fredy, using AI tools to get things done is totally fine. Just please don’t stop thinking.
+
+I’ve had one too many PRs full of hallucinated bullshit.
+
+**Thanks ;)**
+
+------------------------------------------------------------------------
+
+## 👐 Contributing
+
+Thanks to everyone who has contributed!
+
+<a href="https://github.com/orangecoding/fredy/graphs/contributors"><img src="https://contrib.rocks/image?repo=orangecoding/fredy" /></a>
+
+See the [Contributing
+Guide](https://github.com/orangecoding/fredy/blob/master/CONTRIBUTING.md).
+
+------------------------------------------------------------------------
+
+## ⭐ Star History
+
+[![Star History
+Chart](https://api.star-history.com/svg?repos=orangecoding/fredy&type=Date)](https://www.star-history.com/#orangecoding/fredy&Date)

conf/config.json

@@ -1 +1 @@
-{"interval":"60","port":9998,"scrapingAnt":{"apiKey":"","proxy":"datacenter"},"workingHours":{"from":"","to":""}}
+{"sqlitepath":"/db"}

copyright.js

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import fs from 'fs/promises';
+import path from 'path';
+
+const COPYRIGHT = `/*
+ * Copyright (c) ${new Date().getFullYear()} by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+`;
+
+async function getAllFiles(dir = '.') {
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  let files = [];
+  for (let entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue;
+      files = files.concat(await getAllFiles(fullPath));
+    } else if (fullPath.endsWith('.js') || fullPath.endsWith('.jsx')) {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
+
+/* eslint-disable no-console */
+async function addCopyright(files) {
+  const oldCopyrightRegex =
+    /^(\/\*\n \* Copyright \(c\) \d{4} by Christian Kellner\.\n \* Licensed under Apache-2.0 with Commons Clause and Attribution\/Naming Clause\n \*\/\n\n)+/;
+  for (let file of files) {
+    try {
+      let content = await fs.readFile(file, 'utf8');
+      const strippedContent = content.replace(oldCopyrightRegex, '');
+      const newContent = COPYRIGHT + strippedContent;
+      if (content !== newContent) {
+        await fs.writeFile(file, newContent);
+        console.log(`Added/Updated copyright in ${file}`);
+      }
+    } catch (err) {
+      console.error(`Error processing ${file}: ${err}`);
+    }
+  }
+}
+/* eslint-enable no-console */
+
+const filesToProcess = process.argv.length > 2 ? process.argv.slice(2) : await getAllFiles();
+await addCopyright(filesToProcess);

doc/Untitled Diagram.drawio

@@ -1,84 +0,0 @@
-<mxfile host="app.diagrams.net" modified="2022-01-29T18:34:51.211Z" agent="5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36" etag="W0jmvptvMSkuHq89hwUy" version="16.5.2" type="github">
-  <diagram id="C5RBs43oDa-KdzZeNtuy" name="Page-1">
-    <mxGraphModel dx="850" dy="907" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
-      <root>
-        <mxCell id="WIyWlLk6GJQsqaUBKTNV-0" />
-        <mxCell id="WIyWlLk6GJQsqaUBKTNV-1" parent="WIyWlLk6GJQsqaUBKTNV-0" />
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-5" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-3" target="WIyWlLk6GJQsqaUBKTNV-7">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="WIyWlLk6GJQsqaUBKTNV-3" value="Job1" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#dae8fc;strokeColor=#6c8ebf;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
-          <mxGeometry x="100" y="50" width="120" height="30" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-7" target="4kAlOAlRylSy7JMoHAEd-2">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-10" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-7" target="4kAlOAlRylSy7JMoHAEd-3">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-11" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="WIyWlLk6GJQsqaUBKTNV-7" target="4kAlOAlRylSy7JMoHAEd-4">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="WIyWlLk6GJQsqaUBKTNV-7" value="FredyRuntime" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#fff2cc;strokeColor=#d6b656;" parent="WIyWlLk6GJQsqaUBKTNV-1" vertex="1">
-          <mxGeometry x="110" y="120" width="360" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-6" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-0" target="WIyWlLk6GJQsqaUBKTNV-7">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-0" value="Job2" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#dae8fc;strokeColor=#6c8ebf;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="230" y="50" width="120" height="30" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-7" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-1" target="WIyWlLk6GJQsqaUBKTNV-7">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-1" value="Job3" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#dae8fc;strokeColor=#6c8ebf;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="360" y="50" width="120" height="30" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-13" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-2" target="4kAlOAlRylSy7JMoHAEd-12">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-2" value="Provider1" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#d5e8d4;strokeColor=#82b366;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="100" y="210" width="120" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-14" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-3">
-          <mxGeometry relative="1" as="geometry">
-            <mxPoint x="290" y="290" as="targetPoint" />
-          </mxGeometry>
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-3" value="Provider2" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#d5e8d4;strokeColor=#82b366;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="230" y="210" width="120" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-15" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-4" target="4kAlOAlRylSy7JMoHAEd-12">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-4" value="Provider3" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#d5e8d4;strokeColor=#82b366;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="360" y="210" width="120" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-17" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-12" target="4kAlOAlRylSy7JMoHAEd-16">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-12" value="Similarity check" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#e1d5e7;strokeColor=#9673a6;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="110" y="290" width="360" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-20" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-16" target="4kAlOAlRylSy7JMoHAEd-18">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-16" value="Found similarity" style="rhombus;whiteSpace=wrap;html=1;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="250" y="360" width="80" height="80" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-21" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" edge="1" parent="WIyWlLk6GJQsqaUBKTNV-1" source="4kAlOAlRylSy7JMoHAEd-18" target="4kAlOAlRylSy7JMoHAEd-19">
-          <mxGeometry relative="1" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-18" value="Notification Adapter1" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#f8cecc;strokeColor=#b85450;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="230" y="460" width="120" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-19" value="Notification Adapter2" style="rounded=1;whiteSpace=wrap;html=1;fontSize=12;glass=0;strokeWidth=1;shadow=0;fillColor=#f8cecc;strokeColor=#b85450;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="230" y="520" width="120" height="40" as="geometry" />
-        </mxCell>
-        <mxCell id="4kAlOAlRylSy7JMoHAEd-22" value="No" style="text;html=1;resizable=0;autosize=1;align=center;verticalAlign=middle;points=[];fillColor=none;strokeColor=none;rounded=0;" vertex="1" parent="WIyWlLk6GJQsqaUBKTNV-1">
-          <mxGeometry x="300" y="440" width="30" height="20" as="geometry" />
-        </mxCell>
-      </root>
-    </mxGraphModel>
-  </diagram>
-</mxfile>

docker-compose.yml

@@ -1,15 +1,26 @@
-version: '3.3'
 services:
   fredy:
     container_name: fredy
-    # build from empty build folder to reduce size of image
     build:
       context: .
       dockerfile: Dockerfile
-    image: fredy/fredy
+    image: ghcr.io/orangecoding/fredy
-    # map existing config and database
+    environment:
+      - NODE_ENV=production
     volumes:
       - ./conf:/conf
       - ./db:/db
     ports:
-        - 9998:9998
+      - "9998:9998"
+    restart: unless-stopped
+    # Resource limits to prevent runaway memory usage from Chromium
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "--show-error", "--max-time", "5", "http://localhost:9998/"]
+      interval: 120s
+      timeout: 10s
+      retries: 3
+      start_period: 30s

docker-test.sh

@@ -0,0 +1,78 @@
+#!/bin/sh
+set -e
+
+# Stop and remove old container if it exists
+if [ "$(docker ps -aq -f name=fredy)" ]; then
+  docker stop fredy || true
+  docker rm fredy || true
+fi
+
+# On Apple Silicon, force linux/amd64 to match production CI and avoid arm64/x86_64
+# Chrome mismatch under Rosetta. On native Linux (amd64 or arm64) let Docker pick naturally. That took me fucking 1 hour to figure out.
+PLATFORM=""
+if [ "$(uname -m)" = "arm64" ] && [ "$(uname -s)" = "Darwin" ]; then
+  PLATFORM="linux/amd64"
+fi
+
+# Build image from local Dockerfile, forcing a fresh build without cache
+if [ -n "$PLATFORM" ]; then
+  docker build --no-cache --platform "$PLATFORM" -t fredy:local .
+else
+  docker build --no-cache -t fredy:local .
+fi
+
+# Run container with volumes and port mapping
+if [ -n "$PLATFORM" ]; then
+  docker run -d --name fredy --platform "$PLATFORM" -v fredy_conf:/conf -v fredy_db:/db -p 9998:9998 fredy:local
+else
+  docker run -d --name fredy -v fredy_conf:/conf -v fredy_db:/db -p 9998:9998 fredy:local
+fi
+
+echo "Waiting for app to be ready..."
+for i in $(seq 1 30); do
+  if docker exec fredy curl -sf http://localhost:9998/ > /dev/null 2>&1; then
+    echo "App is up"
+    break
+  fi
+  if [ "$i" = "30" ]; then
+    echo "App did not come up in time"
+    docker logs fredy
+    exit 1
+  fi
+  sleep 2
+done
+
+# Verify the DB is readable/writable via the API.
+# /api/demo is unauthenticated and reads the settings table - if SQLite is broken this returns an error.
+echo "Testing DB via API (/api/demo)..."
+DEMO_RESPONSE=$(docker exec fredy curl -sf http://localhost:9998/api/demo 2>&1)
+if echo "$DEMO_RESPONSE" | grep -q "demoMode"; then
+  echo "DB is readable (got demoMode from /api/demo)"
+else
+  echo "DB check failed - unexpected response from /api/demo: $DEMO_RESPONSE"
+  docker logs fredy
+  exit 1
+fi
+
+# Verify Chrome launches without crashing.
+# On amd64: Chrome for Testing lives in the puppeteer cache.
+# On arm64: system Chromium is used instead.
+echo "Testing Chrome..."
+CHROME=$(docker exec fredy find /root/.cache/puppeteer /home -name chrome -type f 2>/dev/null | head -1)
+if [ -z "$CHROME" ]; then
+  CHROME=$(docker exec fredy which chromium 2>/dev/null || true)
+fi
+if [ -z "$CHROME" ]; then
+  echo "Chrome/Chromium binary not found"
+  exit 1
+fi
+if docker exec fredy "$CHROME" --headless --no-sandbox --disable-gpu --dump-dom https://example.com 2>&1 | grep -q "<html"; then
+  echo "Chrome works"
+else
+  echo "Chrome failed to render a page"
+  docker exec fredy "$CHROME" --headless --no-sandbox --disable-gpu --dump-dom https://example.com 2>&1 | head -20
+  exit 1
+fi
+
+echo ""
+echo "All checks passed."

eslint.config.js

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+// eslint.config.js
+import js from '@eslint/js';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+import react from 'eslint-plugin-react';
+
+export default [
+  {
+    ignores: ['**/node_modules/**', '**/dist/**', '**/build/**', '**/public/**', 'db/**', 'conf/**'],
+  },
+
+  {
+    files: ['**/*.{js,jsx}'],
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'module',
+      parserOptions: {
+        ecmaFeatures: { jsx: true },
+      },
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+        ...globals.jest,
+        Promise: 'readonly',
+        fetch: 'readonly',
+        describe: 'readonly',
+        after: 'readonly',
+        it: 'readonly',
+        beforeEach: 'readonly',
+        afterEach: 'readonly',
+        vi: 'readonly',
+      },
+    },
+    plugins: { react },
+    settings: { react: { version: 'detect' } },
+    rules: {
+      ...js.configs.recommended.rules,
+      'no-console': ['error', { allow: ['warn', 'error'] }],
+    },
+  },
+
+  prettier,
+];

index.html

@@ -1,16 +1,25 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
-<head>
+  <head>
-    <meta charset="UTF-8"
+    <meta
-          name="viewport"
+      charset="UTF-8"
-          content="user-scalable=no, width=device-width, initial-scale=1, maximum-scale=1">
+      name="viewport"
-    <meta name="google" content="notranslate">
+      content="user-scalable=no, width=device-width, initial-scale=1, maximum-scale=1"
+    />
+    <meta name="google" content="notranslate" />
+      <meta name="mobile-web-app-capable" content="yes">
+      <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
 
-    <title>Fredy</title>
+      <title>Fredy || Real Estate Finder</title>
-</head>
+    <link rel="icon" type="image/png" href="/ui/src/assets/heart.png" />
-<body theme-mode="dark">
+    <link rel="apple-touch-icon" href="/ui/src/assets/heart.png" />
-
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
-<div id="fredy" style="position: absolute;top: 0;left: 0;right: 0;bottom: 0;"></div>
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-</body>
+    <link href="https://fonts.googleapis.com/css2?family=Outfit:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
-<script type="module" src="/ui/src/Index.jsx"></script>
+  </head>
+  <body theme-mode="dark">
+    <div id="fredy" style="position: absolute; top: 0; left: 0; right: 0; bottom: 0"></div>
+  </body>
+  <script type="module" src="/ui/src/Index.jsx"></script>
 </html>
+

index.js

@@ -1,50 +1,84 @@
-import fs from 'fs';
+/*
-import { config } from './lib/utils.js';
+ * Copyright (c) 2026 by Christian Kellner.
-import * as similarityCache from './lib/services/similarity-check/similarityCache.js';
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
-import { setLastJobExecution } from './lib/services/storage/listingsStorage.js';
+ */
-import * as jobStorage from './lib/services/storage/jobStorage.js';
-import FredyRuntime from './lib/FredyRuntime.js';
-import { duringWorkingHoursOrNotSet } from './lib/utils.js';
-import './lib/api/api.js';
-//if db folder does not exist, ensure to create it before loading anything else
-if (!fs.existsSync('./db')) {
-  fs.mkdirSync('./db');
-}
-const path = './lib/provider';
-const provider = fs.readdirSync(path).filter((file) => file.endsWith('.js'));
-//assuming interval is always in minutes
-const INTERVAL = config.interval * 60 * 1000;
-/* eslint-disable no-console */
-console.log(`Started Fredy successfully. Ui can be accessed via http://localhost:${config.port}`);
-/* eslint-enable no-console */
-const fetchedProvider = await Promise.all(
-  provider.filter((provider) => provider.endsWith('.js')).map(async (pro) => import(`${path}/${pro}`))
-);
 
-setInterval(
+import fs from 'fs';
-  (function exec() {
+import { checkIfConfigIsAccessible, getProviders, refreshConfig } from './lib/utils.js';
-    const isDuringWorkingHoursOrNotSet = duringWorkingHoursOrNotSet(config, Date.now());
+import * as similarityCache from './lib/services/similarity-check/similarityCache.js';
-    if (isDuringWorkingHoursOrNotSet) {
+import { runMigrations } from './lib/services/storage/migrations/migrate.js';
-      config.lastRun = Date.now();
+import { ensureDemoUserExists, ensureAdminUserExists } from './lib/services/storage/userStorage.js';
-      jobStorage
+import { initTrackerCron } from './lib/services/crons/tracker-cron.js';
-        .getJobs()
+import logger from './lib/services/logger.js';
-        .filter((job) => job.enabled)
+import { reloadEnabledFromSettings } from './lib/services/debug/debugLogStorage.js';
-        .forEach((job) => {
+import { initActiveCheckerCron } from './lib/services/crons/listing-alive-cron.js';
-          job.provider
+import { initGeocodingCron } from './lib/services/crons/geocoding-cron.js';
-            .filter((p) => fetchedProvider.find((fp) => fp.metaInformation.id === p.id) != null)
+import { getSettings } from './lib/services/storage/settingsStorage.js';
-            .forEach(async (prov) => {
+import SqliteConnection, { computeDbPath } from './lib/services/storage/SqliteConnection.js';
-              const pro = fetchedProvider.find((fp) => fp.metaInformation.id === prov.id);
+import { initJobExecutionService } from './lib/services/jobs/jobExecutionService.js';
-              pro.init(prov, job.blacklist);
+import { ensureValidBinary } from './lib/services/ensureValidBinary.js';
-              await new FredyRuntime(pro.config, job.notificationAdapter, prov.id, job.id, similarityCache).execute();
+
-              setLastJobExecution(job.id);
+// Ensure the CloakBrowser stealth Chromium binary is present and complete before
-            });
+// jobs run.  ensureValidBinary() also detects and auto-heals partial extractions
-        });
+// (e.g. a newer version that was downloaded but only the chrome executable was
-    } else {
+// written) so Chrome never crashes with "Invalid file descriptor to ICU data".
-      /* eslint-disable no-console */
+logger.info('Checking CloakBrowser binary...');
-      console.debug('Working hours set. Skipping as outside of working hours.');
+await ensureValidBinary();
-      /* eslint-enable no-console */
+logger.info('CloakBrowser binary ready.');
-    }
+
-    return exec;
+//in the config, we store the path of the sqlite file, thus we must check if it is available
-  })(),
+const isConfigAccessible = await checkIfConfigIsAccessible();
-  INTERVAL
+await SqliteConnection.init();
-);
+
+// Load configuration before any other startup steps
+await refreshConfig();
+
+if (!isConfigAccessible) {
+  logger.error('Configuration exists, but is not accessible. Please check the file permission');
+  process.exit(1);
+}
+
+// Run DB migrations once at startup and block until finished
+await runMigrations();
+
+const settings = await getSettings();
+
+// Restore the persisted on/off flag for opt-in DB log capture so it survives a
+// Fredy restart. reloadEnabledFromSettings() also (un)wires the logger sink based
+// on the restored flag, so the logger hot path stays cost-free when nobody enabled
+// the feature.
+await reloadEnabledFromSettings();
+
+// Ensure the sqlite directory exists before loading anything else (based on config.sqlitepath)
+const { dir: sqliteDir } = await computeDbPath();
+if (!fs.existsSync(sqliteDir)) {
+  fs.mkdirSync(sqliteDir, { recursive: true });
+}
+
+// Load provider modules once at startup
+const providers = await getProviders();
+
+similarityCache.initSimilarityCache();
+similarityCache.startSimilarityCacheReloader();
+
+//assuming interval is always in minutes
+const INTERVAL = settings.interval * 60 * 1000;
+
+// Initialize API only after migrations completed
+await import('./lib/api/api.js');
+
+if (settings.demoMode) {
+  logger.info('Running in demo mode');
+}
+
+ensureAdminUserExists();
+ensureDemoUserExists();
+await initTrackerCron();
+//do not wait for this to finish, let it run in the background
+initActiveCheckerCron();
+initGeocodingCron();
+
+logger.info(`Started Fredy successfully. Ui can be accessed via http://localhost:${settings.port}`);
+
+// Initialize the lean Job Execution Service (schedules and bus listeners)
+initJobExecutionService({ providers, settings, intervalMs: INTERVAL });

jsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "target": "ESNext",
+    "checkJs": true,
+    "allowJs": true,
+    "noEmit": true,
+    "strict": false
+  },
+  "exclude": ["node_modules", "ui"]
+}

lib/FredyPipelineExecutioner.js

@@ -0,0 +1,454 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { NoNewListingsWarning } from './errors.js';
+import {
+  deleteListingsById,
+  getKnownListingHashesForJobAndProvider,
+  storeListings,
+  updateListingDistance,
+} from './services/storage/listingsStorage.js';
+import { getJob } from './services/storage/jobStorage.js';
+import * as notify from './notification/notify.js';
+import Extractor from './services/extractor/extractor.js';
+import urlModifier from './services/queryStringMutator.js';
+import logger from './services/logger.js';
+import { geocodeAddress } from './services/geocoding/geoCodingService.js';
+import { distanceMeters } from './services/listings/distanceCalculator.js';
+import { getSettings, getUserSettings } from './services/storage/settingsStorage.js';
+import booleanPointInPolygon from '@turf/boolean-point-in-polygon';
+import { formatListing } from './utils/formatListing.js';
+
+/** @import { ParsedListing } from './types/listing.js' */
+/** @import { Job } from './types/job.js' */
+/** @import { ProviderConfig } from './types/providerConfig.js' */
+/** @import { SpecFilter, SpatialFilter } from './types/filter.js' */
+/** @import { SimilarityCache } from './types/similarityCache.js' */
+/** @import { Browser } from './types/browser.js' */
+
+/**
+ * Runtime orchestrator for fetching, normalizing, filtering, deduplicating, storing,
+ * and notifying about new listings from a configured provider.
+ *
+ * The execution flow is:
+ * 1) Prepare provider URL (sorting, etc.)
+ * 2) Extract raw listings from the provider
+ * 3) Normalize listings to the provider schema
+ * 4) Filter out incomplete/blacklisted listings
+ * 5) Identify new listings (vs. previously stored hashes)
+ * 6) Optionally enrich new listings via provider.fetchDetails
+ * 7) Optionally re-apply the provider blacklist using the (now enriched)
+ *    description — only when the user opted in via
+ *    `blacklist_filter_on_provider_details`
+ * 8) Persist new listings
+ * 9) Filter out entries similar to already seen ones
+ * 10) Filter out entries that do not match the job's specFilter
+ * 11) Filter out entries that do not match the job's spatialFilter
+ * 12) Dispatch notifications
+ */
+class FredyPipelineExecutioner {
+  /**
+   * Create a new runtime instance for a single provider/job execution.
+   *
+   * @param {ProviderConfig} providerConfig Provider configuration.
+   * @param {Job} job Job configuration.
+   * @param {string} providerId The ID of the provider currently in use.
+   * @param {SimilarityCache} similarityCache Cache instance for checking similar entries.
+   * @param {Browser} browser Puppeteer browser instance.
+   */
+  constructor(providerConfig, job, providerId, similarityCache, browser) {
+    /** @type {ProviderConfig} */
+    this._providerConfig = providerConfig;
+    /** @type {Object} */
+    this._jobNotificationConfig = job.notificationAdapter;
+    /** @type {string} */
+    this._jobKey = job.id;
+    /** @type {SpecFilter | null} */
+    this._jobSpecFilter = job.specFilter;
+    /** @type {SpatialFilter | null} */
+    this._jobSpatialFilter = job.spatialFilter;
+    /** @type {string} */
+    this._providerId = providerId;
+    /** @type {SimilarityCache} */
+    this._similarityCache = similarityCache;
+    /** @type {Browser} */
+    this._browser = browser;
+  }
+
+  /**
+   * Execute the end-to-end pipeline for a single provider run.
+   *
+   * @returns {Promise<ParsedListing[]|void>} Resolves to the list of new (and similarity-filtered) listings
+   * after notifications have been sent; resolves to void when there are no new listings.
+   */
+  execute() {
+    return Promise.resolve(urlModifier(this._providerConfig.url, this._providerConfig.sortByDateParam))
+      .then(this._providerConfig.getListings?.bind(this) ?? this._getListings.bind(this))
+      .then(this._normalize.bind(this))
+      .then(this._filter.bind(this))
+      .then(this._findNew.bind(this))
+      .then(this._fetchDetails.bind(this))
+      .then(this._filterAfterDetails.bind(this))
+      .then(this._geocode.bind(this))
+      .then(this._save.bind(this))
+      .then(this._calculateDistance.bind(this))
+      .then(this._filterBySimilarListings.bind(this))
+      .then(this._filterBySpecs.bind(this))
+      .then(this._filterByArea.bind(this))
+      .then(this._notify.bind(this))
+      .catch(this._handleError.bind(this));
+  }
+
+  /**
+   * Optionally, enrich new listings with data from their detail pages.
+   * Only called when the provider config defines a `fetchDetails` function.
+   * Fetches are performed sequentially to avoid overloading the provider or
+   * the shared browser instance.
+   *
+   * @param {Listing[]} newListings New listings to enrich.
+   * @returns {Promise<Listing[]>} Resolves with enriched listings.
+   */
+  async _fetchDetails(newListings) {
+    if (typeof this._providerConfig.fetchDetails !== 'function') {
+      return newListings;
+    }
+    const userId = getJob(this._jobKey)?.userId;
+    const enabledProviders = getUserSettings(userId)?.provider_details ?? [];
+    if (!userId || !Array.isArray(enabledProviders) || !enabledProviders.includes(this._providerId)) {
+      return newListings;
+    }
+    const listingsToEnrich = process.env.NODE_ENV === 'test' ? newListings.slice(0, 1) : newListings;
+    const enriched = [];
+    for (const listing of listingsToEnrich) {
+      enriched.push(await this._providerConfig.fetchDetails(listing, this._browser));
+    }
+    return enriched;
+  }
+
+  /**
+   * Geocode new listings.
+   *
+   * @param {ParsedListing[]} newListings New listings to geocode.
+   * @returns {Promise<ParsedListing[]>} Resolves with the listings (potentially with added coordinates).
+   */
+  async _geocode(newListings) {
+    for (const listing of newListings) {
+      if (listing.address) {
+        const coords = await geocodeAddress(listing.address);
+        if (coords && coords.lat !== -1 && coords.lng !== -1) {
+          listing.latitude = coords.lat;
+          listing.longitude = coords.lng;
+        }
+      }
+    }
+    return newListings;
+  }
+
+  /**
+   * Filter listings by area using the provider's area filter if available.
+   * Only filters if areaFilter is set on the provider AND the listing has coordinates.
+   *
+   * @param {ParsedListing[]} newListings New listings to filter by area.
+   * @returns {ParsedListing[]} Resolves with listings that are within the area (or not filtered if no area is set).
+   */
+  _filterByArea(newListings) {
+    const polygonFeatures = this._jobSpatialFilter?.features?.filter((f) => f.geometry?.type === 'Polygon');
+
+    // If no area filter is set, return all listings
+    if (!polygonFeatures?.length) {
+      return newListings;
+    }
+
+    const toDeleteListingByIds = [];
+    // Filter listings by area - keep only those within the polygon
+    const keptListings = newListings.filter((listing) => {
+      // If listing doesn't have coordinates, keep it (don't filter out)
+      if (listing.latitude == null || listing.longitude == null) {
+        return true;
+      }
+
+      // Check if the point is inside the polygons
+      const point = [listing.longitude, listing.latitude]; // GeoJSON format: [lon, lat]
+      const isInPolygon = polygonFeatures.some((feature) => booleanPointInPolygon(point, feature));
+
+      if (!isInPolygon) {
+        toDeleteListingByIds.push(listing.id);
+      }
+
+      return isInPolygon;
+    });
+
+    if (toDeleteListingByIds.length > 0) {
+      deleteListingsById(toDeleteListingByIds);
+    }
+
+    return keptListings;
+  }
+
+  /**
+   * Filter listings based on its specifications (minRooms, minSize, maxPrice).
+   *
+   * @param {ParsedListing[]} newListings New listings to filter.
+   * @returns {ParsedListing[]} Resolves with listings that pass the specification filters.
+   */
+  _filterBySpecs(newListings) {
+    const { minRooms, minSize, maxPrice } = this._jobSpecFilter || {};
+
+    // If no specs are set, return all listings
+    if (!minRooms && !minSize && !maxPrice) {
+      return newListings;
+    }
+
+    const toDeleteListingByIds = [];
+    const keptListings = newListings.filter((listing) => {
+      const filterOut =
+        (minRooms && listing.rooms != null && listing.rooms < minRooms) ||
+        (minSize && listing.size != null && listing.size < minSize) ||
+        (maxPrice && listing.price != null && listing.price > maxPrice);
+
+      if (filterOut) {
+        toDeleteListingByIds.push(listing.id);
+      }
+      return !filterOut;
+    });
+
+    if (toDeleteListingByIds.length > 0) {
+      deleteListingsById(toDeleteListingByIds);
+    }
+
+    return keptListings;
+  }
+
+  /**
+   * Fetch listings from the provider, using the default Extractor flow unless
+   * a provider-specific getListings override is supplied.
+   *
+   * @param {string} url The provider URL to fetch from.
+   * @returns {Promise<ParsedListing[]>} Resolves with an array of listings (empty when none found).
+   */
+  async _getListings(url) {
+    const extractor = new Extractor({ ...this._providerConfig.puppeteerOptions, browser: this._browser });
+    await extractor.execute(url, this._providerConfig.waitForSelector, this._providerId);
+    const listings = extractor.parseResponseText(
+      this._providerConfig.crawlContainer,
+      this._providerConfig.crawlFields,
+      url,
+    );
+    return listings == null ? [] : listings;
+  }
+
+  /**
+   * Normalize raw listings into the provider-specific ParsedListing shape.
+   *
+   * @param {any[]} listings Raw listing entries from the extractor or override.
+   * @returns {ParsedListing[]} Normalized listings.
+   */
+  _normalize(listings) {
+    return listings.map((listing) => this._providerConfig.normalize(listing));
+  }
+
+  /**
+   * Filter out listings that are missing required fields and those rejected by the
+   * provider's blacklist/filter function.
+   *
+   * @param {ParsedListing[]} listings Listings to filter.
+   * @returns {ParsedListing[]} Filtered listings that pass validation and provider filter.
+   */
+  _filter(listings) {
+    const requiredKeys = this._providerConfig.requiredFieldNames;
+    const requireValues = ['id', 'link', 'title'];
+
+    return (
+      listings
+        // this should never filter some listings out, because the normalize function should always extract all fields.
+        .filter((item) => requiredKeys.every((key) => key in item))
+        // Drop listings missing a required identifying field *before* the provider
+        // filter runs, so provider filter functions never have to defend against a
+        // null id/link/title.
+        .filter((item) => requireValues.every((key) => item[key] != null))
+        // TODO: move blacklist filter to this file, so it will handle for all providers in same way.
+        .filter(this._providerConfig.filter)
+    );
+  }
+
+  /**
+   * Re-apply the provider's blacklist filter after `_fetchDetails` has had a
+   * chance to enrich the listings (e.g., load the full description from the
+   * detail page). The initial `_filter` step only sees the truncated snippet
+   * exposed on the search results page, so a blacklisted term that lives
+   * deeper in the listing's full description would otherwise slip through.
+   *
+   * Opt-in: gated by the user setting `blacklist_filter_on_provider_details`.
+   * The full detail description tends to contain a lot of boilerplate (legal,
+   * exposé contact info, generic marketing copy) which can accidentally match
+   * a blacklist term and remove otherwise relevant listings. Users who want
+   * the stricter behavior must enable the setting explicitly.
+   *
+   * Throws {@link NoNewListingsWarning} when all listings are filtered out
+   * so the rest of the pipeline (save + notify) is short-circuited.
+   *
+   * @param {ParsedListing[]} listings Enriched listings to re-filter.
+   * @returns {ParsedListing[]} Listings that still pass the provider's filter.
+   * @throws {NoNewListingsWarning} When every listing is filtered out.
+   */
+  _filterAfterDetails(listings) {
+    if (typeof this._providerConfig.filter !== 'function') {
+      return listings;
+    }
+    const userId = getJob(this._jobKey)?.userId;
+    const enabled = getUserSettings(userId)?.blacklist_filter_on_provider_details === true;
+    if (!enabled) {
+      return listings;
+    }
+    const kept = listings.filter(this._providerConfig.filter);
+    const removed = listings.length - kept.length;
+    if (removed > 0) {
+      logger.debug(
+        `Re-filter after detail enrichment removed ${removed} listing(s) by blacklist (Provider: '${this._providerId}')`,
+      );
+    }
+    if (kept.length === 0) {
+      throw new NoNewListingsWarning();
+    }
+    return kept;
+  }
+
+  /**
+   * Determine which listings are new by comparing their IDs against stored hashes.
+   *
+   * @param {ParsedListing[]} listings Listings to evaluate for novelty.
+   * @returns {ParsedListing[]} New listings not seen before.
+   * @throws {NoNewListingsWarning} When no new listings are found.
+   */
+  _findNew(listings) {
+    logger.debug(`Checking ${listings.length} listings for new entries (Provider: '${this._providerId}')`);
+    const knownHashes = new Set(getKnownListingHashesForJobAndProvider(this._jobKey, this._providerId) || []);
+
+    const newListings = listings.filter((o) => !knownHashes.has(o.id));
+    if (newListings.length === 0) {
+      throw new NoNewListingsWarning();
+    }
+    return newListings;
+  }
+
+  /**
+   * Send notifications for new listings using the configured notification adapter(s).
+   *
+   * @param {ParsedListing[]} newListings New listings to notify about.
+   * @returns {Promise<ParsedListing[]>} Resolves to the provided listings after notifications complete.
+   * @throws {NoNewListingsWarning} When there are no listings to notify about.
+   */
+  async _notify(newListings) {
+    if (newListings.length === 0) {
+      throw new NoNewListingsWarning();
+    }
+    const formattedListings = newListings.map(formatListing);
+    const settings = await getSettings();
+    const baseUrl = settings?.baseUrl ?? '';
+    const sendNotifications = notify.send(
+      this._providerId,
+      formattedListings,
+      this._jobNotificationConfig,
+      this._jobKey,
+      baseUrl,
+    );
+    return Promise.all(sendNotifications).then(() => newListings);
+  }
+
+  /**
+   * Persist new listings and pass them through.
+   *
+   * @param {ParsedListing[]} newListings Listings to store.
+   * @returns {ParsedListing[]} The same listings, unchanged.
+   */
+  _save(newListings) {
+    logger.debug(`Storing ${newListings.length} new listings (Provider: '${this._providerId}')`);
+    storeListings(this._jobKey, this._providerId, newListings);
+    return newListings;
+  }
+
+  /**
+   * Calculate distance for new listings.
+   *
+   * @param {ParsedListing[]} listings
+   * @returns {ParsedListing[]}
+   * @private
+   */
+  _calculateDistance(listings) {
+    if (listings.length === 0) return [];
+
+    const job = getJob(this._jobKey);
+    const userId = job?.userId;
+
+    if (userId == null || typeof userId !== 'string') {
+      logger.debug('Skipping distance calculation: userId is missing or invalid');
+      return listings;
+    }
+
+    const userSettings = getUserSettings(userId);
+    const homeAddress = userSettings?.home_address;
+
+    if (!homeAddress || !homeAddress.coords) {
+      return listings;
+    }
+
+    const { lat, lng } = homeAddress.coords;
+    for (const listing of listings) {
+      if (listing.latitude != null && listing.longitude != null) {
+        const dist = distanceMeters(lat, lng, listing.latitude, listing.longitude);
+        updateListingDistance(listing.id, dist);
+        listing.distance_to_destination = dist;
+      }
+    }
+    return listings;
+  }
+
+  /**
+   * Remove listings that are similar to already known entries according to the similarity cache.
+   * Adds the remaining listings to the cache.
+   *
+   * @param {ParsedListing[]} listings Listings to filter by similarity.
+   * @returns {ParsedListing[]} Listings considered unique enough to keep.
+   */
+  _filterBySimilarListings(listings) {
+    const filteredIds = [];
+    const keptListings = listings.filter((listing) => {
+      const similar = this._similarityCache.checkAndAddEntry({
+        title: listing.title,
+        address: listing.address,
+        price: listing.price,
+      });
+      if (similar) {
+        logger.debug(
+          `Filtering similar entry for title '${listing.title}' and address '${listing.address}' (Provider: '${this._providerId}')`,
+        );
+        filteredIds.push(listing.id);
+      }
+      return !similar;
+    });
+
+    if (filteredIds.length > 0) {
+      deleteListingsById(filteredIds);
+    }
+
+    return keptListings;
+  }
+
+  /**
+   * Handle errors occurring in the pipeline, logging levels depending on type.
+   *
+   * @param {Error} err Error instance thrown by previous steps.
+   * @returns {void}
+   */
+  _handleError(err) {
+    if (err.name === 'NoNewListingsWarning') {
+      logger.debug(`No new listings found (Provider: '${this._providerId}').`);
+    } else {
+      logger.error(err);
+    }
+  }
+}
+
+export default FredyPipelineExecutioner;

lib/FredyRuntime.js

@@ -1,131 +0,0 @@
-import { NoNewListingsWarning } from './errors.js';
-import { setKnownListings, getKnownListings } from './services/storage/listingsStorage.js';
-import * as notify from './notification/notify.js';
-import xray from './services/scraper.js';
-import * as scrapingAnt from './services/scrapingAnt.js';
-import urlModifier from './services/queryStringMutator.js';
-class FredyRuntime {
-  /**
-   *
-   * @param providerConfig the config for the specific provider, we're going to query at the moment
-   * @param notificationConfig the config for all notifications
-   * @param providerId the id of the provider currently in use
-   * @param jobKey key of the job that is currently running (from within the config)
-   * @param similarityCache cache instance holding values to check for similarity of entries
-   */
-  constructor(providerConfig, notificationConfig, providerId, jobKey, similarityCache) {
-    this._providerConfig = providerConfig;
-    this._notificationConfig = notificationConfig;
-    this._providerId = providerId;
-    this._jobKey = jobKey;
-    this._similarityCache = similarityCache;
-  }
-  execute() {
-    return (
-      //modify the url to make sure search order is correctly set
-      Promise.resolve(urlModifier(this._providerConfig.url, this._providerConfig.sortByDateParam))
-        //scraping the site and try finding new listings
-        .then(this._getListings.bind(this))
-        //bring them in a proper form (dictated by the provider)
-        .then(this._normalize.bind(this))
-        //filter listings with stuff tagged by the blacklist of the provider
-        .then(this._filter.bind(this))
-        //check if new listings available. if so proceed
-        .then(this._findNew.bind(this))
-        //store everything in db
-        .then(this._save.bind(this))
-        //check for similar listings. if found, remove them before notifying
-        .then(this._filterBySimilarListings.bind(this))
-        //notify the user using the configured notification adapter
-        .then(this._notify.bind(this))
-        //if an error occurred on the way, handle it here.
-        .catch(this._handleError.bind(this))
-    );
-  }
-  _getListings(url) {
-    return new Promise((resolve, reject) => {
-      const id = this._providerId;
-      if (scrapingAnt.needScrapingAnt(id) && !scrapingAnt.isScrapingAntApiKeySet()) {
-        const error = 'Immoscout or Immonet can only be used with if you have set an apikey for scrapingAnt.';
-        /* eslint-disable no-console */
-        console.log(error);
-        /* eslint-enable no-console */
-        reject(error);
-        return;
-      }
-      const u = scrapingAnt.needScrapingAnt(id) ? scrapingAnt.transformUrlForScrapingAnt(url, id) : url;
-      try {
-        if (this._providerConfig.paginate != null) {
-          xray(u, this._providerConfig.crawlContainer, [this._providerConfig.crawlFields])
-            //the first 2 pages should be enough here
-            .limit(2)
-            .paginate(this._providerConfig.paginate)
-            .then((listings) => {
-              resolve(listings == null ? [] : listings);
-            })
-            .catch((err) => {
-              reject(err);
-              console.error(err);
-            });
-        } else {
-          xray(u, this._providerConfig.crawlContainer, [this._providerConfig.crawlFields])
-            .then((listings) => {
-              resolve(listings == null ? [] : listings);
-            })
-            .catch((err) => {
-              reject(err);
-              console.error(err);
-            });
-        }
-      } catch (error) {
-        reject(error);
-        console.error(error);
-      }
-    });
-  }
-  _normalize(listings) {
-    return listings.map(this._providerConfig.normalize);
-  }
-  _filter(listings) {
-    return listings.filter(this._providerConfig.filter);
-  }
-  _findNew(listings) {
-    const newListings = listings.filter((o) => getKnownListings(this._jobKey, this._providerId)[o.id] == null);
-    if (newListings.length === 0) {
-      throw new NoNewListingsWarning();
-    }
-    return newListings;
-  }
-  _notify(newListings) {
-    if (newListings.length === 0) {
-      throw new NoNewListingsWarning();
-    }
-    const sendNotifications = notify.send(this._providerId, newListings, this._notificationConfig, this._jobKey);
-    return Promise.all(sendNotifications).then(() => newListings);
-  }
-  _save(newListings) {
-    const currentListings = getKnownListings(this._jobKey, this._providerId) || {};
-    newListings.forEach((listing) => {
-      currentListings[listing.id] = Date.now();
-    });
-    setKnownListings(this._jobKey, this._providerId, currentListings);
-    return newListings;
-  }
-  _filterBySimilarListings(listings) {
-    const filteredList = listings.filter((listing) => {
-      const similar = this._similarityCache.hasSimilarEntries(this._jobKey, listing.title);
-      if (similar) {
-        /* eslint-disable no-console */
-        console.debug(`Filtering similar entry for job with id ${this._jobKey} with title: `, listing.title);
-        /* eslint-enable no-console */
-      }
-      return !similar;
-    });
-    filteredList.forEach((filter) => this._similarityCache.addCacheEntry(this._jobKey, filter.title));
-    return filteredList;
-  }
-  _handleError(err) {
-    if (err.name !== 'NoNewListingsWarning') console.error(err);
-  }
-}
-export default FredyRuntime;

lib/TRACKING_POIS.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+export const TRACKING_POIS = {
+  DISTANCE_ADDRESS_ENTERED: 'DISTANCE_ADDRESS_ENTERED',
+  WELCOME_FINISHED: 'WELCOME_FINISHED',
+  WELCOME_SKIPPED: 'WELCOME_SKIPPED',
+  JOBS_TABLE_VIEW: 'JOBS_TABLE_VIEW',
+  LISTING_TABLE_VIEW: 'LISTING_TABLE_VIEW',
+  BASE_URL_SETTING: 'BASE_URL_SETTING',
+  SET_PROXY_SETTING: 'SET_PROXY_SETTING',
+  DETECTED_AS_BOT: 'DETECTED_AS_BOT',
+  NOTES_CREATE: 'NOTES_CREATE',
+  USING_LISTING_STATUS: 'USING_LISTING_STATUS',
+  CHANGE_LANGUAGE: 'CHANGE_LANGUAGE',
+};

lib/api/api.js

@@ -1,36 +1,114 @@
-import { notificationAdapterRouter } from './routes/notificationAdapterRouter.js';
+/*
-import { authInterceptor, cookieSession, adminInterceptor } from './security.js';
+ * Copyright (c) 2026 by Christian Kellner.
-import { generalSettingsRouter } from './routes/generalSettingsRoute.js';
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
-import { analyticsRouter } from './routes/analyticsRouter.js';
+ */
-import { providerRouter } from './routes/providerRouter.js';
+
-import { loginRouter } from './routes/loginRoute.js';
+import Fastify from 'fastify';
-import { config } from '../utils.js';
+import fastifyHelmet from '@fastify/helmet';
-import { userRouter } from './routes/userRoute.js';
+import fastifyCookie from '@fastify/cookie';
-import { jobRouter } from './routes/jobRouter.js';
+import fastifySession from '@fastify/session';
-import bodyParser from 'body-parser';
+import fastifyStatic from '@fastify/static';
-import restana from 'restana';
-import files from 'serve-static';
 import path from 'path';
 import { getDirName } from '../utils.js';
-const service = restana();
+import { getSettings, getOrCreateSessionSecret } from '../services/storage/settingsStorage.js';
-const staticService = files(path.join(getDirName(), '../ui/public'));
+import logger from '../services/logger.js';
-const PORT = config.port || 9998;
+import { authHook, adminHook } from './security.js';
 
-service.use(bodyParser.json());
+import loginPlugin from './routes/loginRoute.js';
-service.use(cookieSession());
+import demoPlugin from './routes/demoRouter.js';
-service.use(staticService);
+import jobPlugin from './routes/jobRouter.js';
-service.use('/api/admin', authInterceptor());
+import versionPlugin from './routes/versionRouter.js';
-service.use('/api/jobs', authInterceptor());
+import listingsPlugin from './routes/listingsRouter.js';
-// /admin can only be accessed when user is having admin permissions
+import dashboardPlugin from './routes/dashboardRouter.js';
-service.use('/api/admin', adminInterceptor());
+import userSettingsPlugin from './routes/userSettingsRoute.js';
-service.use('/api/jobs/notificationAdapter', notificationAdapterRouter);
+import trackingPlugin from './routes/trackingRoute.js';
-service.use('/api/admin/generalSettings', generalSettingsRouter);
+import generalSettingsPlugin from './routes/generalSettingsRoute.js';
-service.use('/api/jobs/provider', providerRouter);
+import backupPlugin from './routes/backupRouter.js';
-service.use('/api/jobs/insights', analyticsRouter);
+import debugPlugin, { registerDebugPublicProbe } from './routes/debugRouter.js';
-service.use('/api/admin/users', userRouter);
+import userPlugin from './routes/userRoute.js';
-service.use('/api/jobs', jobRouter);
+import notificationAdapterPlugin from './routes/notificationAdapterRouter.js';
-service.use('/api/login', loginRouter);
+import providerPlugin from './routes/providerRouter.js';
-/* eslint-disable no-console */
+import { registerMcpRoutes } from '../mcp/mcpHttpRoute.js';
-service.start(PORT).then(() => {
+
-  console.info(`Started API service on port ${PORT}`);
+const PORT = (await getSettings()).port || 9998;
+const sessionSecret = await getOrCreateSessionSecret();
+const SESSION_MAX_AGE = 2 * 60 * 60 * 1000;
+
+const fastify = Fastify({
+  logger: false,
+  bodyLimit: 50 * 1024 * 1024, // 50 MB for backup uploads
 });
+
+// Security headers (CSP disabled to avoid breaking the SPA)
+await fastify.register(fastifyHelmet, { contentSecurityPolicy: false });
+
+// Cookie + session (in-memory store, signed cookie)
+await fastify.register(fastifyCookie);
+await fastify.register(fastifySession, {
+  secret: sessionSecret,
+  cookieName: 'fredy-admin-session',
+  cookie: {
+    maxAge: SESSION_MAX_AGE,
+    httpOnly: true,
+    secure: false,
+    sameSite: 'lax',
+  },
+  saveUninitialized: false,
+});
+
+// Serve the React SPA from ui/public/
+await fastify.register(fastifyStatic, {
+  root: path.join(getDirName(), '../ui/public'),
+  wildcard: false,
+});
+
+// Public routes - no auth required
+fastify.register(loginPlugin, { prefix: '/api/login' });
+fastify.register(demoPlugin, { prefix: '/api/demo' });
+
+// User-authenticated routes
+fastify.register(async (app) => {
+  app.addHook('preHandler', authHook);
+  app.register(jobPlugin, { prefix: '/api/jobs' });
+  app.register(notificationAdapterPlugin, { prefix: '/api/jobs/notificationAdapter' });
+  app.register(providerPlugin, { prefix: '/api/jobs/provider' });
+  app.register(versionPlugin, { prefix: '/api/version' });
+  app.register(listingsPlugin, { prefix: '/api/listings' });
+  app.register(dashboardPlugin, { prefix: '/api/dashboard' });
+  app.register(userSettingsPlugin, { prefix: '/api/user/settings' });
+  app.register(trackingPlugin, { prefix: '/api/tracking' });
+  app.register(generalSettingsPlugin, { prefix: '/api/admin/generalSettings' });
+  // The lightweight /api/debug/active probe used by the app-wide red banner. Lives
+  // here (under authHook, NOT adminHook) so non-admin users also see the warning
+  // banner when an admin has enabled the feature, without exposing the rest of the
+  // settings payload.
+  app.register(
+    async (sub) => {
+      registerDebugPublicProbe(sub);
+    },
+    { prefix: '/api/debug' },
+  );
+});
+
+// Admin-only routes
+fastify.register(async (app) => {
+  app.addHook('preHandler', authHook);
+  app.addHook('preHandler', adminHook);
+  app.register(backupPlugin, { prefix: '/api/admin/backup' });
+  app.register(debugPlugin, { prefix: '/api/admin/debug' });
+  app.register(userPlugin, { prefix: '/api/admin/users' });
+});
+
+// MCP Streamable HTTP (Bearer token auth - no session)
+registerMcpRoutes(fastify);
+
+// SPA fallback - serve index.html for all non-API GET requests
+fastify.setNotFoundHandler((request, reply) => {
+  if (!request.url.startsWith('/api/')) {
+    return reply.sendFile('index.html');
+  }
+  return reply.code(404).send({ error: 'Not found' });
+});
+
+await fastify.listen({ port: PORT, host: '0.0.0.0' });
+logger.debug(`Started API service on port ${PORT}`);

lib/api/routes/analyticsRouter.js

@@ -1,10 +0,0 @@
-import restana from 'restana';
-import * as listingStorage from '../../services/storage/listingsStorage.js';
-const service = restana();
-const analyticsRouter = service.newRouter();
-analyticsRouter.get('/:jobId', async (req, res) => {
-  const { jobId } = req.params;
-  res.body = listingStorage.getListingProviderDataForAnalytics(jobId) || {};
-  res.send();
-});
-export { analyticsRouter };

lib/api/routes/backupRouter.js

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import {
+  buildBackupFileName,
+  createBackupZip,
+  precheckRestore,
+  restoreFromZip,
+} from '../../services/storage/backupRestoreService.js';
+import { getSettings } from '../../services/storage/settingsStorage.js';
+import { isAdmin } from '../security.js';
+
+const DEMO_MODE_ERROR = 'Backup and restore are not available in demo mode.';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function backupPlugin(fastify) {
+  // Parse raw binary uploads as Buffer
+  fastify.addContentTypeParser(
+    ['application/zip', 'application/octet-stream'],
+    { parseAs: 'buffer' },
+    (req, body, done) => done(null, body),
+  );
+
+  fastify.get('/', async (request, reply) => {
+    const settings = await getSettings();
+    if (settings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: DEMO_MODE_ERROR });
+    }
+    const zipBuffer = await createBackupZip();
+    const fileName = await buildBackupFileName();
+    reply.header('Content-Type', 'application/zip');
+    reply.header('Content-Disposition', `attachment; filename="${fileName}"`);
+    return reply.send(zipBuffer);
+  });
+
+  fastify.post('/restore', async (request, reply) => {
+    const settings = await getSettings();
+    if (settings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: DEMO_MODE_ERROR });
+    }
+    const { dryRun = 'false', force = 'false' } = request.query || {};
+    const doDryRun = String(dryRun) === 'true';
+    const doForce = String(force) === 'true';
+    const body = request.body; // Buffer from addContentTypeParser
+
+    if (doDryRun) {
+      return precheckRestore(body);
+    }
+
+    try {
+      return restoreFromZip(body, { force: doForce });
+    } catch (e) {
+      return reply.code(400).send({
+        message: e?.message || 'Restore failed',
+        details: e?.payload || null,
+      });
+    }
+  });
+}

lib/api/routes/dashboardRouter.js

@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import * as jobStorage from '../../services/storage/jobStorage.js';
+import { getListingsKpisForJobIds, getProviderDistributionForJobIds } from '../../services/storage/listingsStorage.js';
+import { getSettings } from '../../services/storage/settingsStorage.js';
+import { isAdmin } from '../security.js';
+
+function getAccessibleJobs(request) {
+  const currentUser = request.session.currentUser;
+  const admin = isAdmin(request);
+  return jobStorage
+    .getJobs()
+    .filter((job) => admin || job.userId === currentUser || job.shared_with_user.includes(currentUser));
+}
+
+function cap(val) {
+  return String(val).charAt(0).toUpperCase() + String(val).slice(1);
+}
+
+/**
+ * Compute the most recent job trigger timestamp across the given jobs.
+ *
+ * Returns `null` when none of the jobs has ever been triggered. The value is
+ * persisted per-job via `jobs.last_run_at`, so the dashboard reflects the
+ * scope visible to the current user (own + shared, or all for admins) rather
+ * than a process-wide in-memory value.
+ *
+ * @param {Array<{lastRunAt?: number|null}>} jobs
+ * @returns {number|null}
+ */
+function computeLastRun(jobs) {
+  let lastRun = null;
+  for (const job of jobs) {
+    const ts = job.lastRunAt;
+    if (typeof ts === 'number' && (lastRun == null || ts > lastRun)) {
+      lastRun = ts;
+    }
+  }
+  return lastRun;
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function dashboardPlugin(fastify) {
+  fastify.get('/', async (request) => {
+    const jobs = getAccessibleJobs(request);
+    const settings = await getSettings();
+
+    const totalJobs = jobs.length;
+    const totalListings = jobs.reduce((sum, j) => sum + (j.numberOfFoundListings || 0), 0);
+    const jobIds = jobs.map((j) => j.id);
+    const { numberOfActiveListings, medianPriceOfListings } = getListingsKpisForJobIds(jobIds);
+
+    const providerPieRaw = getProviderDistributionForJobIds(jobIds);
+    const providerPie = Array.isArray(providerPieRaw)
+      ? {
+          labels: providerPieRaw.map((p) => cap(p.type)),
+          values: providerPieRaw.map((p) => Number(p.value) || 0),
+        }
+      : providerPieRaw && typeof providerPieRaw === 'object'
+        ? {
+            labels: Array.isArray(providerPieRaw.labels) ? providerPieRaw.labels : [],
+            values: Array.isArray(providerPieRaw.values) ? providerPieRaw.values : [],
+          }
+        : { labels: [], values: [] };
+
+    const lastRun = computeLastRun(jobs);
+
+    return {
+      general: {
+        interval: settings.interval,
+        lastRun,
+        nextRun: lastRun == null ? 0 : lastRun + settings.interval * 60000,
+      },
+      kpis: {
+        totalJobs,
+        totalListings,
+        numberOfActiveListings,
+        medianPriceOfListings,
+      },
+      pie: providerPie,
+    };
+  });
+}

lib/api/routes/debugRouter.js

@@ -0,0 +1,93 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import {
+  isEnabled,
+  enableDebugLogging,
+  disableDebugLogging,
+  getCurrentSize,
+  getMaxSize,
+  hasAnyLogs,
+  wasEverEnabled,
+  clearAllDebugLogs,
+} from '../../services/debug/debugLogStorage.js';
+import { buildDebugBundleFileName, buildDebugBundleZip } from '../../services/debug/debugBundleService.js';
+import { getSettings } from '../../services/storage/settingsStorage.js';
+
+/**
+ * Build the JSON status payload returned by /status and after each enable/disable.
+ * @returns {Promise<{enabled:boolean, size:number, max:number, hasLogs:boolean, everEnabled:boolean}>}
+ */
+async function buildStatus() {
+  return {
+    enabled: isEnabled(),
+    size: await getCurrentSize(),
+    max: getMaxSize(),
+    hasLogs: hasAnyLogs(),
+    everEnabled: await wasEverEnabled(),
+  };
+}
+
+/**
+ * Register the lightweight /active probe used by the app-wide red banner. Exposed
+ * to every authenticated user (not just admins) so non-admin users see the warning
+ * banner too. Returns only a single boolean so it cannot be repurposed to leak any
+ * other state.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export async function registerDebugPublicProbe(fastify) {
+  fastify.get('/active', async () => ({ enabled: isEnabled() }));
+}
+
+/**
+ * Admin-only debug logging endpoints.
+ *
+ * Routes (all relative to the registered prefix /api/admin/debug):
+ *   GET    /status          → current feature status (used by the UI polling).
+ *   POST   /enable          → turn debug logging on. Body: { clearPrevious?:boolean }.
+ *   POST   /disable         → turn debug logging off (existing logs are kept on disk).
+ *   GET    /download        → ZIP with logs.txt + sys.txt. 409 when the feature has
+ *                              never been enabled OR there are no logs to export.
+ *   DELETE /logs            → drop every stored debug log row (does NOT change the
+ *                              enabled flag — useful to free space while keeping
+ *                              recording on).
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function debugPlugin(fastify) {
+  fastify.get('/status', async () => buildStatus());
+
+  fastify.post('/enable', async (request) => {
+    const clearPrevious = request.body?.clearPrevious === true;
+    await enableDebugLogging({ clearPrevious });
+    return buildStatus();
+  });
+
+  fastify.post('/disable', async () => {
+    await disableDebugLogging();
+    return buildStatus();
+  });
+
+  fastify.delete('/logs', async () => {
+    clearAllDebugLogs();
+    return buildStatus();
+  });
+
+  fastify.get('/download', async (request, reply) => {
+    const ever = await wasEverEnabled();
+    if (!ever || !hasAnyLogs()) {
+      return reply.code(409).send({
+        error: 'Debug logging has never produced any data on this Fredy installation.',
+      });
+    }
+    const settings = await getSettings();
+    const zipBuffer = await buildDebugBundleZip({ settings });
+    const fileName = await buildDebugBundleFileName();
+    reply.header('Content-Type', 'application/zip');
+    reply.header('Content-Disposition', `attachment; filename="${fileName}"`);
+    return reply.send(zipBuffer);
+  });
+}

lib/api/routes/demoRouter.js

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { getSettings } from '../../services/storage/settingsStorage.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function demoPlugin(fastify) {
+  fastify.get('/', async () => {
+    const settings = await getSettings();
+    return { demoMode: settings.demoMode };
+  });
+}

lib/api/routes/generalSettingsRoute.js

@@ -1,21 +1,56 @@
-import restana from 'restana';
+/*
-import { config, getDirName } from '../../utils.js';
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { getDirName } from '../../utils.js';
 import fs from 'fs';
-const service = restana();
+import { ensureDemoUserExists } from '../../services/storage/userStorage.js';
-const generalSettingsRouter = service.newRouter();
+import logger from '../../services/logger.js';
-generalSettingsRouter.get('/', async (req, res) => {
+import { getSettings, upsertSettings } from '../../services/storage/settingsStorage.js';
-  res.body = Object.assign({}, config);
+import { isAdmin } from '../security.js';
-  res.send();
+import { trackPoi } from '../../services/tracking/Tracker.js';
-});
+import { TRACKING_POIS } from '../../TRACKING_POIS.js';
-generalSettingsRouter.post('/', async (req, res) => {
+
-  const settings = req.body;
+/**
-  try {
+ * @param {import('fastify').FastifyInstance} fastify
-    fs.writeFileSync(`${getDirName()}/../conf/config.json`, JSON.stringify(settings));
+ */
-  } catch (err) {
+export default async function generalSettingsPlugin(fastify) {
-    console.error(err);
+  fastify.get('/', async () => {
-    res.send(new Error('Error while trying to write settings.'));
+    return Object.assign({}, await getSettings());
-    return;
+  });
-  }
+
-  res.send();
+  fastify.post('/', async (request, reply) => {
-});
+    const { sqlitepath, ...appSettings } = request.body || {};
-export { generalSettingsRouter };
+    if (typeof appSettings.baseUrl === 'string') {
+      appSettings.baseUrl = appSettings.baseUrl.trim().replace(/\/$/, '');
+    }
+    const localSettings = await getSettings();
+
+    if (!isAdmin(request)) {
+      const reason = localSettings.demoMode
+        ? 'In demo mode, it is not allowed to change these settings.'
+        : 'Only admins can change these settings.';
+      return reply.code(403).send({ error: reason });
+    }
+
+    try {
+      if (typeof sqlitepath !== 'undefined') {
+        fs.writeFileSync(`${getDirName()}/../conf/config.json`, JSON.stringify({ sqlitepath }));
+      }
+
+      upsertSettings(appSettings);
+      ensureDemoUserExists();
+      if (appSettings.baseUrl != null) {
+        await trackPoi(TRACKING_POIS.BASE_URL_SETTING);
+      }
+      if (appSettings.proxyUrl != null) {
+        await trackPoi(TRACKING_POIS.SET_PROXY_SETTING);
+      }
+    } catch (err) {
+      logger.error(err);
+      return reply.code(500).send({ error: 'Error while trying to write settings.' });
+    }
+    return reply.send();
+  });
+}

lib/api/routes/jobRouter.js

@@ -1,105 +1,251 @@
-import restana from 'restana';
+/*
-import fetch from 'node-fetch';
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import * as jobStorage from '../../services/storage/jobStorage.js';
 import * as userStorage from '../../services/storage/userStorage.js';
-import * as immoscoutProvider from '../../provider/immoscout.js';
-import { config } from '../../utils.js';
 import { isAdmin } from '../security.js';
-const service = restana();
+import logger from '../../services/logger.js';
-const jobRouter = service.newRouter();
+import { bus } from '../../services/events/event-bus.js';
-function doesJobBelongsToUser(job, req) {
+import { isRunning as isJobRunning } from '../../services/jobs/run-state.js';
-  const userId = req.session.currentUser;
+import { addClient as addSseClient, removeClient } from '../../services/sse/sse-broker.js';
-  if (userId == null) {
+import { getSettings } from '../../services/storage/settingsStorage.js';
-    return false;
+
-  }
+const DEMO_JOB_NAME = 'Demo-Job';
+
+function doesJobBelongsToUser(job, request) {
+  const userId = request.session.currentUser;
+  if (userId == null) return false;
   const user = userStorage.getUser(userId);
-  if (user == null) {
+  if (user == null) return false;
-    return false;
+  return user.isAdmin || job.userId === user.id;
-  }
-  return user.isAdmin || job.userId === job.userId;
 }
-jobRouter.get('/', async (req, res) => {
+
-  const isUserAdmin = isAdmin(req);
+/**
-  //show only the jobs which belongs to the user (or all of the user is an admin)
+ * @param {import('fastify').FastifyInstance} fastify
-  res.body = jobStorage.getJobs().filter((job) => isUserAdmin || job.userId === req.session.currentUser);
+ */
-  res.send();
+export default async function jobPlugin(fastify) {
-});
+  fastify.get('/', async (request) => {
-jobRouter.get('/processingTimes', async (req, res) => {
+    const isUserAdmin = isAdmin(request);
-  let scrapingAntData = null;
+    return jobStorage
-  if (config.scrapingAnt.apiKey != null && config.scrapingAnt.apiKey.length > 0) {
+      .getJobs({ includeDisabled: true })
-    try {
+      .filter(
-      const response = await fetch(`https://api.scrapingant.com/v2/usage?x-api-key=${config.scrapingAnt.apiKey}`);
+        (job) =>
-      scrapingAntData = await response.json();
+          isUserAdmin ||
-    } catch (Exception) {
+          job.userId === request.session.currentUser ||
-      console.error('Could not query plan data from scraping ant.', Exception);
+          job.shared_with_user.includes(request.session.currentUser),
+      )
+      .map((job) => ({
+        ...job,
+        running: isJobRunning(job.id),
+        isOnlyShared:
+          !isUserAdmin &&
+          job.userId !== request.session.currentUser &&
+          job.shared_with_user.includes(request.session.currentUser),
+      }));
+  });
+
+  fastify.get('/data', async (request) => {
+    const {
+      page,
+      pageSize = 50,
+      activityFilter,
+      sortfield = null,
+      sortdir = 'asc',
+      freeTextFilter,
+    } = request.query || {};
+
+    const toBool = (v) => {
+      if (v === true || v === 'true' || v === 1 || v === '1') return true;
+      if (v === false || v === 'false' || v === 0 || v === '0') return false;
+      return null;
+    };
+    const normalizedActivity = toBool(activityFilter);
+
+    const queryResult = jobStorage.queryJobs({
+      page: page ? parseInt(page, 10) : 1,
+      pageSize: pageSize ? parseInt(pageSize, 10) : 50,
+      freeTextFilter: freeTextFilter || null,
+      activityFilter: normalizedActivity,
+      sortField: sortfield || null,
+      sortDir: sortdir === 'desc' ? 'desc' : 'asc',
+      userId: request.session.currentUser,
+      isAdmin: isAdmin(request),
+    });
+
+    const isUserAdmin = isAdmin(request);
+    queryResult.result = queryResult.result.map((job) => ({
+      ...job,
+      running: isJobRunning(job.id),
+      isOnlyShared:
+        !isUserAdmin &&
+        job.userId !== request.session.currentUser &&
+        job.shared_with_user.includes(request.session.currentUser),
+    }));
+
+    return queryResult;
+  });
+
+  // Server-Sent Events for real-time job status updates
+  fastify.get('/events', async (request, reply) => {
+    const userId = request.session?.currentUser;
+    if (userId == null) {
+      return reply.code(401).send({ message: 'Unauthorized' });
     }
-  }
+
-  res.body = {
+    reply.hijack();
-    interval: config.interval,
+    const raw = reply.raw;
-    lastRun: config.lastRun || null,
+    raw.setHeader('Content-Type', 'text/event-stream');
-    scrapingAntData,
+    raw.setHeader('Cache-Control', 'no-cache');
-  };
+    raw.setHeader('Connection', 'keep-alive');
-  res.send();
+
-});
+    try {
-jobRouter.post('/', async (req, res) => {
+      raw.write(': connected\n\n');
-  const { provider, notificationAdapter, name, blacklist = [], jobId, enabled } = req.body;
+      addSseClient(userId, raw);
-  if (
+      const onClose = () => removeClient(userId, raw);
-    provider.find((p) => p.id === immoscoutProvider.metaInformation.id) != null &&
+      request.raw.on('close', onClose);
-    (config.scrapingAnt.apiKey == null || config.scrapingAnt.apiKey.length === 0)
+    } catch (e) {
-  ) {
+      logger.error('Error establishing SSE connection', e);
-    res.send(
+      try {
-      new Error('To use Immoscout as provider, you need to configure ScrapingAnt first. Please check the readme.')
+        raw.end();
-    );
+      } catch {
-    return;
+        /* noop */
-  }
+      }
-  try {
+    }
-    jobStorage.upsertJob({
+  });
-      userId: req.session.currentUser,
+
-      jobId,
+  fastify.post('/startAll', async (request, reply) => {
-      enabled,
+    try {
-      name,
+      const userId = request.session.currentUser;
-      blacklist,
+      bus.emit('jobs:runAll', { userId });
+      return reply.code(202).send({ message: 'Run all accepted' });
+    } catch (err) {
+      logger.error('Failed to trigger startAll', err);
+      return reply.code(500).send({ message: 'Unexpected error' });
+    }
+  });
+
+  fastify.post('/:jobId/run', async (request, reply) => {
+    const { jobId } = request.params;
+    try {
+      const job = jobStorage.getJob(jobId);
+      if (!job) {
+        return reply.code(404).send({ message: 'Job not found' });
+      }
+      if (!doesJobBelongsToUser(job, request)) {
+        return reply.code(403).send({ message: 'You are trying to run a job that is not associated to your user' });
+      }
+      if (isJobRunning(jobId)) {
+        return reply.code(409).send({ message: 'Job is already running' });
+      }
+      bus.emit('jobs:runOne', { jobId });
+      return reply.code(202).send({ message: 'Job run accepted' });
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ message: 'Unexpected error triggering job' });
+    }
+  });
+
+  fastify.post('/', async (request, reply) => {
+    const {
       provider,
       notificationAdapter,
-    });
+      name,
-  } catch (error) {
+      blacklist = [],
-    res.send(new Error(error));
+      jobId,
-    console.error(error);
+      enabled,
-  }
+      shareWithUsers = [],
-  res.send();
+      spatialFilter = null,
-});
+      specFilter = null,
-jobRouter.delete('', async (req, res) => {
+    } = request.body;
-  const { jobId } = req.body;
+    const settings = await getSettings();
-  try {
+    try {
-    const job = jobStorage.getJob(jobId);
+      const jobFromDb = jobStorage.getJob(jobId);
-    if (!doesJobBelongsToUser(job, req)) {
+
-      res.send(new Error('You are trying to remove a job that is not associated to your user'));
+      if (jobFromDb && !doesJobBelongsToUser(jobFromDb, request)) {
-    } else {
+        return reply.code(403).send({ error: 'You are trying to change a job that is not associated to your user.' });
-      jobStorage.removeJob(jobId);
+      }
-    }
+
-  } catch (error) {
+      if (settings.demoMode && !isAdmin(request) && jobFromDb && jobFromDb.name === DEMO_JOB_NAME) {
-    res.send(new Error(error));
+        return reply.code(403).send({ error: 'Sorry, but you cannot change the Status of our Demo Job ;)' });
-    console.error(error);
+      }
-  }
+
-  res.send();
+      jobStorage.upsertJob({
-});
+        userId: request.session.currentUser,
-jobRouter.put('/:jobId/status', async (req, res) => {
-  const { status } = req.body;
-  const { jobId } = req.params;
-  try {
-    const job = jobStorage.getJob(jobId);
-    if (!doesJobBelongsToUser(job, req)) {
-      res.send(new Error('You are trying change a job that is not associated to your user'));
-    } else {
-      jobStorage.setJobStatus({
         jobId,
-        status,
+        enabled,
+        name,
+        blacklist,
+        provider,
+        notificationAdapter,
+        shareWithUsers,
+        spatialFilter,
+        specFilter,
       });
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ error: error.message });
     }
-  } catch (error) {
+    return reply.send();
-    res.send(new Error(error));
+  });
-    console.error(error);
+
-  }
+  fastify.delete('/', async (request, reply) => {
-  res.send();
+    const { jobId } = request.body;
-});
+    const settings = await getSettings();
-export { jobRouter };
+    try {
+      const job = jobStorage.getJob(jobId);
+      if (!job) {
+        return reply.code(404).send({ error: 'Job not found' });
+      }
+      if (settings.demoMode && !isAdmin(request) && job.name === DEMO_JOB_NAME) {
+        return reply.code(403).send({ error: 'Sorry, but you cannot remove the Demo Job ;)' });
+      }
+
+      if (!doesJobBelongsToUser(job, request)) {
+        return reply.code(403).send({ error: 'You are trying to remove a job that is not associated to your user' });
+      }
+      jobStorage.removeJob(jobId);
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ error: error.message });
+    }
+    return reply.send();
+  });
+
+  fastify.put('/:jobId/status', async (request, reply) => {
+    const { status } = request.body;
+    const { jobId } = request.params;
+    const settings = await getSettings();
+    try {
+      const job = jobStorage.getJob(jobId);
+      if (!job) {
+        return reply.code(404).send({ error: 'Job not found' });
+      }
+
+      if (settings.demoMode && !isAdmin(request) && job.name === DEMO_JOB_NAME) {
+        return reply.code(403).send({ error: 'Sorry, but you cannot change the Status of our Demo Job ;)' });
+      }
+
+      if (!doesJobBelongsToUser(job, request)) {
+        return reply.code(403).send({ error: 'You are trying change a job that is not associated to your user' });
+      }
+      jobStorage.setJobStatus({ jobId, status });
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ error: error.message });
+    }
+    return reply.send();
+  });
+
+  fastify.get('/shareableUserList', async (request) => {
+    const currentUser = request.session.currentUser;
+    const users = userStorage.getUsers(false);
+    return users
+      .filter((user) => !user.isAdmin && user.id !== currentUser)
+      .map((user) => ({
+        id: user.id,
+        name: user.username,
+      }));
+  });
+}

lib/api/routes/listingsRouter.js

@@ -0,0 +1,215 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import * as listingStorage from '../../services/storage/listingsStorage.js';
+import * as watchListStorage from '../../services/storage/watchListStorage.js';
+import { isAdmin as isAdminFn } from '../security.js';
+import logger from '../../services/logger.js';
+import { nullOrEmpty } from '../../utils.js';
+import { getJob } from '../../services/storage/jobStorage.js';
+import { getSettings } from '../../services/storage/settingsStorage.js';
+import { trackPoi } from '../../services/tracking/Tracker.js';
+import { TRACKING_POIS } from '../../TRACKING_POIS.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function listingsPlugin(fastify) {
+  fastify.get('/table', async (request) => {
+    const {
+      page,
+      pageSize = 50,
+      activityFilter,
+      jobNameFilter,
+      providerFilter,
+      watchListFilter,
+      statusFilter,
+      hiddenOnly,
+      sortfield = null,
+      sortdir = 'asc',
+      freeTextFilter,
+    } = request.query || {};
+
+    const toBool = (v) => {
+      if (v === true || v === 'true' || v === 1 || v === '1') return true;
+      if (v === false || v === 'false' || v === 0 || v === '0') return false;
+      return null;
+    };
+    const normalizedActivity = toBool(activityFilter);
+    const normalizedWatch = toBool(watchListFilter);
+    const normalizedHidden = toBool(hiddenOnly) === true;
+    const allowedStatuses = ['applied', 'rejected', 'accepted', 'none'];
+    const normalizedStatus =
+      typeof statusFilter === 'string' && allowedStatuses.includes(statusFilter.toLowerCase())
+        ? statusFilter.toLowerCase()
+        : undefined;
+
+    let jobFilter = null;
+    let jobIdFilter = null;
+    if (!nullOrEmpty(jobNameFilter)) {
+      const job = getJob(jobNameFilter);
+      jobFilter = job != null ? job.name : null;
+      jobIdFilter = job != null ? job.id : null;
+    }
+
+    return listingStorage.queryListings({
+      page: page ? parseInt(page, 10) : 1,
+      pageSize: pageSize ? parseInt(pageSize, 10) : 50,
+      freeTextFilter: freeTextFilter || null,
+      activityFilter: normalizedActivity,
+      jobNameFilter: jobFilter,
+      jobIdFilter: jobIdFilter,
+      providerFilter,
+      watchListFilter: normalizedWatch,
+      statusFilter: normalizedStatus,
+      hiddenOnly: normalizedHidden,
+      sortField: sortfield || null,
+      sortDir: sortdir === 'desc' ? 'desc' : 'asc',
+      userId: request.session.currentUser,
+      isAdmin: isAdminFn(request),
+    });
+  });
+
+  fastify.get('/map', async (request) => {
+    const { jobId } = request.query || {};
+    return listingStorage.getListingsForMap({
+      jobId: nullOrEmpty(jobId) ? null : jobId,
+      userId: request.session.currentUser,
+      isAdmin: isAdminFn(request),
+    });
+  });
+
+  fastify.get('/:listingId', async (request, reply) => {
+    const { listingId } = request.params;
+    const listing = listingStorage.getListingById(listingId, request.session.currentUser, isAdminFn(request));
+    if (!listing) {
+      return reply.code(404).send({ message: 'Listing not found' });
+    }
+    return listing;
+  });
+
+  fastify.post('/watch', async (request, reply) => {
+    try {
+      const { listingId } = request.body || {};
+      const userId = request.session?.currentUser;
+      if (!listingId || !userId) {
+        return reply.code(400).send({ message: 'listingId or user not provided' });
+      }
+      watchListStorage.toggleWatch(listingId, userId);
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ message: 'Failed to toggle watch' });
+    }
+    return reply.send();
+  });
+
+  fastify.post('/:listingId/notes', async (request, reply) => {
+    const { listingId } = request.params || {};
+    const { notes } = request.body || {};
+    const userId = request.session?.currentUser;
+    if (!listingId || !userId) {
+      return reply.code(400).send({ message: 'listingId or user not provided' });
+    }
+    try {
+      const changes = listingStorage.setListingNotes(listingId, typeof notes === 'string' ? notes : null);
+      if (changes === 0) {
+        return reply.code(404).send({ message: 'Listing not found' });
+      }
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ message: 'Failed to update listing notes' });
+    }
+
+    await trackPoi(TRACKING_POIS.NOTES_CREATE);
+    return reply.send();
+  });
+
+  fastify.post('/:listingId/status', async (request, reply) => {
+    const { listingId } = request.params || {};
+    const { status } = request.body || {};
+    const userId = request.session?.currentUser;
+    if (!listingId || !userId) {
+      return reply.code(400).send({ message: 'listingId or user not provided' });
+    }
+    const allowed = ['applied', 'rejected', 'accepted'];
+    const normalized = status == null ? null : String(status).toLowerCase();
+    if (normalized != null && !allowed.includes(normalized)) {
+      return reply.code(400).send({ message: `Invalid status: ${status}` });
+    }
+    try {
+      const changes = listingStorage.setListingStatus(listingId, normalized);
+      await trackPoi(TRACKING_POIS.USING_LISTING_STATUS);
+      if (changes === 0) {
+        return reply.code(404).send({ message: 'Listing not found' });
+      }
+      if (normalized != null) {
+        watchListStorage.ensureWatch(listingId, userId);
+      }
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ message: 'Failed to update listing status' });
+    }
+    return reply.send();
+  });
+
+  fastify.delete('/job', async (request, reply) => {
+    const { jobId, hardDelete = false } = request.body;
+    const settings = await getSettings();
+    try {
+      if (settings.demoMode && !isAdminFn(request)) {
+        return reply.code(403).send({ error: 'Sorry, but you cannot remove listings in demo mode ;)' });
+      }
+      const job = getJob(jobId);
+      if (!job) {
+        return reply.code(404).send({ error: 'Job not found' });
+      }
+      const userId = request.session.currentUser;
+      if (!isAdminFn(request) && job.userId !== userId && !job.shared_with_user.includes(userId)) {
+        return reply
+          .code(403)
+          .send({ error: 'You are trying to remove listings for a job that is not associated to your user' });
+      }
+      listingStorage.deleteListingsByJobId(jobId, hardDelete);
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ error: error.message });
+    }
+    return reply.send();
+  });
+
+  fastify.delete('/', async (request, reply) => {
+    const { ids, hardDelete = false } = request.body;
+    const settings = await getSettings();
+    try {
+      if (settings.demoMode && !isAdminFn(request)) {
+        return reply.code(403).send({ error: 'Sorry, but you cannot remove listings in demo mode ;)' });
+      }
+      if (Array.isArray(ids) && ids.length > 0) {
+        listingStorage.deleteListingsById(ids, hardDelete);
+      }
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ error: error.message });
+    }
+    return reply.send();
+  });
+
+  fastify.post('/restore', async (request, reply) => {
+    const { ids } = request.body || {};
+    const settings = await getSettings();
+    try {
+      if (settings.demoMode && !isAdminFn(request)) {
+        return reply.code(403).send({ error: 'Sorry, but you cannot restore listings in demo mode ;)' });
+      }
+      if (Array.isArray(ids) && ids.length > 0) {
+        listingStorage.restoreListingsById(ids);
+      }
+    } catch (error) {
+      logger.error(error);
+      return reply.code(500).send({ error: error.message });
+    }
+    return reply.send();
+  });
+}

lib/api/routes/loginRoute.js

@@ -1,40 +1,82 @@
-import restana from 'restana';
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import * as userStorage from '../../services/storage/userStorage.js';
 import * as hasher from '../../services/security/hash.js';
-const service = restana();
+import { trackDemoAccessed } from '../../services/tracking/Tracker.js';
-const loginRouter = service.newRouter();
+import logger from '../../services/logger.js';
-loginRouter.get('/user', async (req, res) => {
+import { getSettings } from '../../services/storage/settingsStorage.js';
-  const currentUserId = req.session.currentUser;
+
-  const currentUser = currentUserId == null ? null : userStorage.getUser(currentUserId);
+const MAX_LOGIN_ATTEMPTS = 10;
-  if (currentUser == null) {
+const LOGIN_WINDOW_MS = 15 * 60 * 1000;
-    res.body = {};
+const loginAttempts = new Map();
-  } else {
+
-    res.body = {
+function getClientIp(request) {
+  const forwarded = request.headers['x-forwarded-for'];
+  return (forwarded ? forwarded.split(',')[0] : request.socket?.remoteAddress) || 'unknown';
+}
+
+function isRateLimited(ip) {
+  const now = Date.now();
+  for (const [key, rec] of loginAttempts) {
+    if (now - rec.firstAttempt > LOGIN_WINDOW_MS) loginAttempts.delete(key);
+  }
+  const record = loginAttempts.get(ip);
+  if (!record || now - record.firstAttempt > LOGIN_WINDOW_MS) {
+    loginAttempts.set(ip, { count: 1, firstAttempt: now });
+    return false;
+  }
+  record.count++;
+  return record.count > MAX_LOGIN_ATTEMPTS;
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function loginPlugin(fastify) {
+  fastify.get('/user', async (request) => {
+    const currentUserId = request.session?.currentUser;
+    const currentUser = currentUserId == null ? null : userStorage.getUser(currentUserId);
+    if (currentUser == null) {
+      return {};
+    }
+    return {
       userId: currentUser.id,
       isAdmin: currentUser.isAdmin,
     };
-  }
+  });
-  res.send();
+
-});
+  fastify.post('/', async (request, reply) => {
-loginRouter.post('/', async (req, res) => {
+    const ip = getClientIp(request);
-  const { username, password } = req.body;
+    if (isRateLimited(ip)) {
-  const user = userStorage.getUsers(true).find((user) => user.username === username);
+      logger.error(`Login rate limit exceeded for IP ${ip}`);
-  if (user == null) {
+      return reply.code(429).send();
-    res.send(401);
+    }
-    return;
+    const settings = await getSettings();
-  }
+    const { username, password } = request.body;
-  if (user.password === hasher.hash(password)) {
+    const user = userStorage.getUsers(true).find((u) => u.username === username);
-    req.session.currentUser = user.id;
+    if (user == null) {
-    userStorage.setLastLoginToNow({ userId: user.id });
+      return reply.code(401).send();
-    res.send(200);
+    }
-    return;
+    if (user.password === hasher.hash(password)) {
-  } else {
+      if (settings.demoMode) {
-    console.error(`User ${username} tried to login, but password was wrong.`);
+        await trackDemoAccessed();
-  }
+      }
-  res.send(401);
+      request.session.currentUser = user.id;
-});
+      request.session.createdAt = Date.now();
-loginRouter.post('/logout', async (req, res) => {
+      loginAttempts.delete(ip);
-  req.session = null;
+      userStorage.setLastLoginToNow({ userId: user.id });
-  res.send(200);
+      return reply.code(200).send();
-});
+    } else {
-export { loginRouter };
+      logger.error(`User ${username} tried to login, but password was wrong.`);
+    }
+    return reply.code(401).send();
+  });
+
+  fastify.post('/logout', async (request, reply) => {
+    await request.session.destroy();
+    return reply.code(200).send();
+  });
+}

lib/api/routes/notificationAdapterRouter.js

@@ -1,51 +1,112 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import fs from 'fs';
-import restana from 'restana';
+import logger from '../../services/logger.js';
-const service = restana();
+
-const notificationAdapterRouter = service.newRouter();
 const notificationAdapterList = fs.readdirSync('./lib//notification/adapter').filter((file) => file.endsWith('.js'));
 const notificationAdapter = await Promise.all(
   notificationAdapterList.map(async (pro) => {
     return await import(`../../notification/adapter/${pro}`);
-  })
+  }),
 );
-notificationAdapterRouter.post('/try', async (req, res) => {
+
-  const { id, fields } = req.body;
+/**
-  const adapter = notificationAdapter.find((adapter) => adapter.config.id === id);
+ * @param {import('fastify').FastifyInstance} fastify
-  if (adapter == null) {
+ */
-    res.send(404);
+export default async function notificationAdapterPlugin(fastify) {
-  }
+  fastify.get('/', async () => {
-  const notificationConfig = [];
+    return notificationAdapter.map((adapter) => adapter.config).filter(Boolean);
-  const notificationObject = {};
-  Object.keys(fields).forEach((key) => {
-    notificationObject[key] = fields[key].value;
   });
-  notificationConfig.push({
+
-    fields: { ...notificationObject },
+  fastify.post('/try', async (request, reply) => {
-    enabled: true,
+    const { id, fields } = request.body;
-    id,
+    const adapter = notificationAdapter.find((adapter) => adapter.config.id === id);
-  });
+    if (adapter == null) {
-  try {
+      return reply.code(404).send();
-    await adapter.send({
+    }
-      serviceName: 'TestCall',
+    const notificationConfig = [];
-      newListings: [
+    const notificationObject = {};
-        {
+    Object.keys(fields).forEach((key) => {
-          price: '42 €',
+      notificationObject[key] = fields[key].value;
-          title: 'This is a test listing',
-          address: 'some address',
-          size: '666 2m',
-          link: 'https://www.orange-coding.net',
-        },
-      ],
-      notificationConfig,
-      jobKey: 'TestJob',
     });
-    res.send();
+    notificationConfig.push({
-  } catch (Exception) {
+      fields: { ...notificationObject },
-    res.send(new Error(Exception));
+      enabled: true,
-  }
+      id,
-});
+    });
-notificationAdapterRouter.get('/', async (req, res) => {
+    try {
-  res.body = notificationAdapter.map((adapter) => adapter.config);
+      await adapter.send({
-  res.send();
+        serviceName: 'TestCall',
-});
+        newListings: [
-export { notificationAdapterRouter };
+          {
+            address: 'Heidestrasse 17, 51147 Köln',
+            description: exampleDescription,
+            id: '1',
+            imageUrl: 'https://placehold.co/600x400/png',
+            price: '1.000 €',
+            size: '76 m²',
+            title: 'Stilvolle gepflegte 3-Raum-Wohnung mit gehobener Innenausstattung',
+            url: 'https://www.orange-coding.net',
+          },
+        ],
+        notificationConfig,
+        jobKey: 'TestJob',
+      });
+      return reply.send();
+    } catch (Exception) {
+      logger.error('Error during notification adapter test:', Exception);
+      return reply.code(500).send({ error: String(Exception) });
+    }
+  });
+}
+
+const exampleDescription = `
+Wohnungstyp: Etagenwohnung
+Nutzfläche: 76 m²
+Etage: 2 von 3
+Schlafzimmer: 1
+Badezimmer: 1
+Bezugsfrei ab: 1.4.2026
+Haustiere: Nein
+Garage/Stellplatz: Tiefgarage
+Anzahl Garage/Stellplatz: 1
+Kaltmiete (zzgl. Nebenkosten): 1.000 €
+Preis/m²: 13,16 €/m²
+Nebenkosten: 230 €
+Heizkosten in Nebenkosten enthalten: Ja
+Gesamtmiete: 1.230 €
+Kaution: 3.000,00
+Preis pro Parkfläche: 60 €
+Baujahr: 2000
+Objektzustand: Modernisiert
+Qualität der Ausstattung: Gehoben
+Heizungsart: Fernwärme
+Energieausweistyp: Verbrauchsausweis
+Energieausweis: liegt vor
+Endenergieverbrauch: 72 kWh/(m²∙a)
+Baujahr laut Energieausweis: 2000
+
+Diese moderne 3-Zimmer-Wohnung liegt direkt neben einem Park und nur wenige Minuten von der S-Bahn-Haltestelle entfernt. Das Stadtzentrum sowie Freizeiteinrichtungen sind 1,5 km entfernt.
+
+Die Wohnung ist ideal für Paare oder kleine Familien geeignet.
+
+Ausstattung:
+- neuer hochwertiger Bodenbelag (Holzoptik) in allen Räumen außer Bad/Küche
+- sonniger Balkon (Süd)
+- Tiefgaragenstellplatz
+- Kellerabteil
+- gepflegtes Mehrfamilienhaus
+
+Die Küche ist vom Mieter nach eigenen Wünschen einzurichten.
+
+Vermietung direkt vom Eigentümer - provisionsfrei!
+
+Lage:
+• Park: 1 Minute zu Fuß
+• S-Bahn Station: 2 Minuten zu Fuß
+• Supermärkte, Restaurants, täglicher Bedarf in der Nähe
+• Gute Anbindung Richtung Großstadt und Flughafen
+`;

lib/api/routes/providerRouter.js

@@ -1,15 +1,18 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import fs from 'fs';
-import restana from 'restana';
+
-const service = restana();
-const providerRouter = service.newRouter();
 const providerList = fs.readdirSync('./lib/provider').filter((file) => file.endsWith('.js'));
-const provider = await Promise.all(
+const providers = await Promise.all(providerList.map(async (pro) => import(`../../provider/${pro}`)));
-  providerList.map(async (pro) => {
+
-    return await import(`../../provider/${pro}`);
+/**
-  })
+ * @param {import('fastify').FastifyInstance} fastify
-);
+ */
-providerRouter.get('/', async (req, res) => {
+export default async function providerPlugin(fastify) {
-  res.body = provider.map((p) => p.metaInformation);
+  fastify.get('/', async () => {
-  res.send();
+    return providers.map((p) => p.metaInformation);
-});
+  });
-export { providerRouter };
+}

lib/api/routes/trackingRoute.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { trackPoi } from '../../services/tracking/Tracker.js';
+import { TRACKING_POIS } from '../../TRACKING_POIS.js';
+import logger from '../../services/logger.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function trackingPlugin(fastify) {
+  fastify.get('/trackingPois', async () => {
+    return TRACKING_POIS;
+  });
+
+  fastify.post('/poi', async (request, reply) => {
+    const { poi } = request.body;
+    if (!poi) {
+      return reply.code(400).send({ error: 'Feature name is required' });
+    }
+    try {
+      await trackPoi(poi);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error tracking feature', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+}

lib/api/routes/userRoute.js

@@ -1,63 +1,75 @@
-import restana from 'restana';
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import * as userStorage from '../../services/storage/userStorage.js';
 import * as jobStorage from '../../services/storage/jobStorage.js';
-const service = restana();
+import { getSettings } from '../../services/storage/settingsStorage.js';
-const userRouter = service.newRouter();
+import { isAdmin as isAdminUser } from '../security.js';
+
 function checkIfAnyAdminAfterRemovingUser(userIdToBeRemoved, allUser) {
   return allUser.filter((user) => user.id !== userIdToBeRemoved && user.isAdmin).length > 0;
 }
-function checkIfUserToBeRemovedIsLoggedIn(userIdToBeRemoved, req) {
+
-  return req.session.currentUser === userIdToBeRemoved;
+function checkIfUserToBeRemovedIsLoggedIn(userIdToBeRemoved, request) {
+  return request.session.currentUser === userIdToBeRemoved;
 }
+
 const nullOrEmpty = (str) => str == null || str.length === 0;
-userRouter.get('/', async (req, res) => {
+
-  res.body = userStorage.getUsers(false);
+/**
-  res.send();
+ * @param {import('fastify').FastifyInstance} fastify
-});
+ */
-userRouter.get('/:userId', async (req, res) => {
+export default async function userPlugin(fastify) {
-  const { userId } = req.params;
+  fastify.get('/', async () => {
-  res.body = userStorage.getUser(userId);
+    return userStorage.getUsers(false);
-  res.send();
-});
-userRouter.delete('/', async (req, res) => {
-  const { userId } = req.body;
-  const allUser = userStorage.getUsers(false);
-  if (!checkIfAnyAdminAfterRemovingUser(userId, allUser)) {
-    res.send(new Error('You are trying to remove the last admin user. This is prohibited.'));
-    return;
-  }
-  if (checkIfUserToBeRemovedIsLoggedIn(userId, req)) {
-    res.send(new Error('You are trying to remove yourself. This is prohibited.'));
-    return;
-  }
-  //TODO: Remove also analytics
-  jobStorage.removeJobsByUserId(userId);
-  userStorage.removeUser(userId);
-  res.send();
-});
-userRouter.post('/', async (req, res) => {
-  const { username, password, password2, isAdmin, userId } = req.body;
-  if (password !== password2) {
-    res.send(new Error('Passwords does not match'));
-    return;
-  }
-  if (nullOrEmpty(username) || nullOrEmpty(password) || nullOrEmpty(password2)) {
-    res.send(new Error('Username and password are mandatory.'));
-    return;
-  }
-  const allUser = userStorage.getUsers(false);
-  if (!isAdmin && !checkIfAnyAdminAfterRemovingUser(userId, allUser)) {
-    res.send(
-      new Error('You cannot change the admin flag for this user as otherwise, there is no other user in the system')
-    );
-    return;
-  }
-  userStorage.upsertUser({
-    userId,
-    username,
-    password,
-    isAdmin,
   });
-  res.send();
+
-});
+  fastify.get('/:userId', async (request) => {
-export { userRouter };
+    const { userId } = request.params;
+    return userStorage.getUser(userId);
+  });
+
+  fastify.delete('/', async (request, reply) => {
+    const settings = await getSettings();
+    if (settings.demoMode && !isAdminUser(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to remove user.' });
+    }
+
+    const { userId } = request.body;
+    const allUser = userStorage.getUsers(false);
+    if (!checkIfAnyAdminAfterRemovingUser(userId, allUser)) {
+      return reply.code(400).send({ error: 'You are trying to remove the last admin user. This is prohibited.' });
+    }
+    if (checkIfUserToBeRemovedIsLoggedIn(userId, request)) {
+      return reply.code(400).send({ error: 'You are trying to remove yourself. This is prohibited.' });
+    }
+    jobStorage.removeJobsByUserId(userId);
+    userStorage.removeUser(userId);
+    return reply.send();
+  });
+
+  fastify.post('/', async (request, reply) => {
+    const settings = await getSettings();
+    if (settings.demoMode && !isAdminUser(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to change or add user.' });
+    }
+
+    const { username, password, password2, isAdmin, userId } = request.body;
+    if (password !== password2) {
+      return reply.code(400).send({ error: 'Passwords do not match.' });
+    }
+    if (nullOrEmpty(username) || nullOrEmpty(password) || nullOrEmpty(password2)) {
+      return reply.code(400).send({ error: 'Username and password are mandatory.' });
+    }
+    const allUser = userStorage.getUsers(false);
+    if (!isAdmin && !checkIfAnyAdminAfterRemovingUser(userId, allUser)) {
+      return reply.code(400).send({
+        error: 'You cannot change the admin flag for this user as otherwise, there is no other user in the system',
+      });
+    }
+    userStorage.upsertUser({ userId, username, password, isAdmin });
+    return reply.send();
+  });
+}

lib/api/routes/userSettingsRoute.js

@@ -0,0 +1,211 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { getSettings, getUserSettings, upsertSettings } from '../../services/storage/settingsStorage.js';
+import { isAdmin } from '../security.js';
+import { resetGeocoordinatesAndDistanceForUser } from '../../services/storage/listingsStorage.js';
+import { geocodeAddress } from '../../services/geocoding/geoCodingService.js';
+import { autocompleteAddress } from '../../services/geocoding/autocompleteService.js';
+import { trackPoi } from '../../services/tracking/Tracker.js';
+import { TRACKING_POIS } from '../../TRACKING_POIS.js';
+import logger from '../../services/logger.js';
+import { runGeoCordTask } from '../../services/crons/geocoding-cron.js';
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function userSettingsPlugin(fastify) {
+  fastify.get('/', async (request) => {
+    const userId = request.session.currentUser;
+    return getUserSettings(userId);
+  });
+
+  fastify.get('/autocomplete', async (request, reply) => {
+    const { q } = request.query;
+    try {
+      const results = await autocompleteAddress(q);
+      return results;
+    } catch (error) {
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/home-address', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { home_address } = request.body;
+    const settings = await getSettings();
+
+    if (settings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to change the home address.' });
+    }
+
+    try {
+      if (home_address) {
+        await trackPoi(TRACKING_POIS.DISTANCE_ADDRESS_ENTERED);
+        const coords = await geocodeAddress(home_address);
+        if (coords && coords.lat !== -1) {
+          upsertSettings({ home_address: { address: home_address, coords } }, userId);
+          resetGeocoordinatesAndDistanceForUser(userId);
+          runGeoCordTask();
+          return { success: true, coords };
+        } else {
+          return reply.code(400).send({ error: 'Could not geocode address' });
+        }
+      } else {
+        upsertSettings({ home_address: null }, userId);
+        return { success: true };
+      }
+    } catch (error) {
+      logger.error('Error updating home address settings', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/news-hash', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { news_hash } = request.body;
+
+    const globalSettings = await getSettings();
+    if (globalSettings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to change settings.' });
+    }
+
+    try {
+      upsertSettings({ news_hash }, userId);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating news hash', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/provider-details', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { provider_details } = request.body;
+
+    const globalSettings = await getSettings();
+    if (globalSettings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to change settings.' });
+    }
+
+    if (!Array.isArray(provider_details)) {
+      return reply.code(400).send({ error: 'provider_details must be an array of provider ids.' });
+    }
+
+    try {
+      upsertSettings({ provider_details }, userId);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating provider details setting', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/blacklist-filter-on-details', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { blacklist_filter_on_provider_details } = request.body;
+
+    const globalSettings = await getSettings();
+    if (globalSettings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to change settings.' });
+    }
+
+    if (typeof blacklist_filter_on_provider_details !== 'boolean') {
+      return reply.code(400).send({ error: 'blacklist_filter_on_provider_details must be a boolean.' });
+    }
+
+    try {
+      upsertSettings({ blacklist_filter_on_provider_details }, userId);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating blacklist-filter-on-details setting', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/listings-view-mode', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { listings_view_mode } = request.body;
+
+    if (listings_view_mode !== 'grid' && listings_view_mode !== 'table') {
+      return reply.code(400).send({ error: 'listings_view_mode must be "grid" or "table".' });
+    }
+
+    if (listings_view_mode === 'table') {
+      await trackPoi(TRACKING_POIS.LISTING_TABLE_VIEW);
+    }
+
+    try {
+      upsertSettings({ listings_view_mode }, userId);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating listings view mode setting', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/jobs-view-mode', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { jobs_view_mode } = request.body;
+
+    if (jobs_view_mode !== 'grid' && jobs_view_mode !== 'table') {
+      return reply.code(400).send({ error: 'jobs_view_mode must be "grid" or "table".' });
+    }
+
+    if (jobs_view_mode === 'table') {
+      await trackPoi(TRACKING_POIS.JOBS_TABLE_VIEW);
+    }
+
+    try {
+      upsertSettings({ jobs_view_mode }, userId);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating jobs view mode setting', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/listing-deletion-preference', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { listing_deletion_preference } = request.body;
+
+    const globalSettings = await getSettings();
+    if (globalSettings.demoMode && !isAdmin(request)) {
+      return reply.code(403).send({ error: 'In demo mode, it is not allowed to change settings.' });
+    }
+
+    if (listing_deletion_preference == null) {
+      return reply.code(400).send({ error: 'listing_deletion_preference is required.' });
+    }
+
+    const { skipPrompt, hardDelete } = listing_deletion_preference;
+
+    try {
+      upsertSettings({ listing_deletion_preference: { skipPrompt, hardDelete } }, userId);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating listing deletion preference', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+
+  fastify.post('/language', async (request, reply) => {
+    const userId = request.session.currentUser;
+    const { language } = request.body;
+
+    if (typeof language !== 'string' || language.trim() === '') {
+      return reply.code(400).send({ error: 'language must be a non-empty string.' });
+    }
+
+    try {
+      upsertSettings({ language }, userId);
+      await trackPoi(TRACKING_POIS.CHANGE_LANGUAGE);
+      return { success: true };
+    } catch (error) {
+      logger.error('Error updating language setting', error);
+      return reply.code(500).send({ error: error.message });
+    }
+  });
+}

lib/api/routes/versionRouter.js

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import fetch from 'node-fetch';
+import { getPackageVersion } from '../../utils.js';
+import semver from 'semver';
+
+async function getCurrentVersionFromGithub() {
+  const raw = await fetch('https://api.github.com/repos/orangecoding/fredy/releases/latest');
+  const data = await raw.json();
+  const localFredyVersion = await getPackageVersion();
+  if (data.tag_name == null || semver.gte(localFredyVersion, data.tag_name)) {
+    return null;
+  }
+  return {
+    newVersion: true,
+    version: data.tag_name,
+    url: data.html_url,
+    body: data.body,
+    localFredyVersion,
+  };
+}
+
+/**
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export default async function versionPlugin(fastify) {
+  fastify.get('/', async () => {
+    const versionPayload = await getCurrentVersionFromGithub();
+    const localFredyVersion = await getPackageVersion();
+    return versionPayload ?? { newVersion: false, localFredyVersion };
+  });
+}

lib/api/security.js

@@ -1,47 +1,53 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import * as userStorage from '../services/storage/userStorage.js';
-import cookieSession from 'cookie-session';
+
-import { nanoid } from 'nanoid';
+const SESSION_MAX_AGE = 2 * 60 * 60 * 1000; // 2 hours
-const unauthorized = (res) => {
+
-  return res.send(401);
+/**
-};
+ * Returns true when the request has no valid, non-expired session.
-const isUnauthorized = (req) => {
+ * @param {import('fastify').FastifyRequest} request
-  return req.session.currentUser == null;
+ * @returns {boolean}
-};
+ */
-const isAdmin = (req) => {
+export function isUnauthorized(request) {
-  if (!isUnauthorized(req)) {
+  if (!request.session?.currentUser) return true;
-    const user = userStorage.getUser(req.session.currentUser);
+  if (Date.now() - (request.session.createdAt || 0) > SESSION_MAX_AGE) return true;
-    return user != null && user.isAdmin;
-  }
   return false;
-};
+}
-const authInterceptor = () => {
+
-  return (req, res, next) => {
+/**
-    if (isUnauthorized(req)) {
+ * Returns true when the session belongs to an admin user.
-      return unauthorized(res);
+ * @param {import('fastify').FastifyRequest} request
-    } else {
+ * @returns {boolean}
-      next();
+ */
-    }
+export function isAdmin(request) {
-  };
+  if (isUnauthorized(request)) return false;
-};
+  const user = userStorage.getUser(request.session.currentUser);
-const adminInterceptor = () => {
+  return user != null && user.isAdmin;
-  return (req, res, next) => {
+}
-    if (!isAdmin(req)) {
+
-      return unauthorized(res);
+/**
-    } else {
+ * Fastify preHandler hook - rejects unauthenticated requests with 401.
-      next();
+ * @param {import('fastify').FastifyRequest} request
-    }
+ * @param {import('fastify').FastifyReply} reply
-  };
+ */
-};
+export async function authHook(request, reply) {
-const cookieSession$0 = (userId) => {
+  if (isUnauthorized(request)) {
-  return cookieSession({
+    reply.code(401).send();
-    name: 'fredy-admin-session',
+  }
-    keys: ['fredy', 'super', 'fancy', 'key', nanoid()],
+}
-    userId,
+
-    maxAge: 8 * 60 * 60 * 1000, // 8 hours
+/**
-  });
+ * Fastify preHandler hook - rejects non-admin requests with 401.
-};
+ * Apply after authHook.
-export { cookieSession$0 as cookieSession };
+ * @param {import('fastify').FastifyRequest} request
-export { adminInterceptor };
+ * @param {import('fastify').FastifyReply} reply
-export { authInterceptor };
+ */
-export { isUnauthorized };
+export async function adminHook(request, reply) {
-export { isAdmin };
+  if (!isAdmin(request)) {
+    reply.code(401).send();
+  }
+}

lib/defaultConfig.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+export const DEFAULT_CONFIG = {
+  // Default path for sqlite storage directory. Interpreted relative to project root.
+  sqlitepath: '/db',
+};

lib/errors.js

@@ -1,3 +1,8 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 class ExtendableError extends Error {
   constructor(message) {
     super(message);

lib/mcp/README.md

@@ -0,0 +1,323 @@
+ # Fredy MCP Server
+
+The Fredy MCP Server exposes your real estate jobs and listings data to LLM clients. It supports two transports:
+
+- **Stdio**: for local LLM clients (Claude Desktop, LM Studio, llm-cli, mcp-cli, etc.)
+- **Streamable HTTP**: for remote LLM clients (ChatGPT, cloud-hosted agents, etc.)
+
+## Authentication
+
+All MCP access is **token-based** based. Every Fredy user is automatically assigned a **permanent, non-expiring MCP token** when their account is created. This token is a secret and should be treated like a password.
+
+### Where to find your token
+
+MCP tokens are displayed in the **User Management** list (Admin → Users). Each user's token is shown in the **"MCP Token"** column.
+
+> **Important:** MCP tokens never expire. They are permanent secrets tied to each user account. If a token is compromised, you must change the token! If you chose to use a token from an admin account, the LLM can query information from ALL jobs/listings. 
+
+## Available Tools
+
+| Tool | Description                                                                    |
+|------|--------------------------------------------------------------------------------|
+| `list_jobs` | List real estate search jobs with pagination and text filtering                |
+| `get_job` | Get detailed information about a specific job                                  |
+| `list_listings` | Search and list real estate listings with pagination, text search, and filters |
+| `get_listing` | Get full details of a single listing                                           |
+| `get_current_date_time` | Gets the current date/time for the llm to be used                              |
+
+### Tool Details
+
+#### list_jobs
+- `page` (number, optional) – Page number (default: 1)
+- `pageSize` (number, optional) – Results per page (default: 50, max: 1000). Use pagination to fetch more.
+- `filter` (string, optional) – Free-text filter on job name
+
+Response: markdown table with columns ID, Name, Enabled, Active Listings. Includes summary and pagination info.
+
+#### get_job
+- `jobId` (string, required) – The job ID to retrieve
+
+#### list_listings
+- `page` (number, optional) – Page number (default: 1)
+- `pageSize` (number, optional) – Results per page (default: 50, max: 1000). Use pagination to fetch more.
+- `filter` (string, optional) – Free-text search across title, address, provider, link
+- `jobId` (string, optional) – Filter listings by job ID
+- `activeOnly` (boolean, optional) – When true, only show active listings
+- `provider` (string, optional) – Filter by provider name
+- `createdAfter` (number, optional) – Only include listings created at or after this unix timestamp in milliseconds (e.g. `1772008362564`). Useful for queries like "give me all listings from today".
+- `createdBefore` (number, optional) – Only include listings created at or before this unix timestamp in milliseconds (e.g. `1772008362564`).
+- `minPrice` (number, optional) – Only include listings with price >= this value (e.g. `500`). Numeric, no currency symbol.
+- `maxPrice` (number, optional) – Only include listings with price <= this value (e.g. `1500`). Numeric, no currency symbol.
+- `sortField` (string, optional) – Sort by: created_at, price, size, provider, title, is_active
+- `sortDir` (string, optional) – Sort direction: asc or desc
+
+Response: markdown table with columns ID, Title, Address, Price, Size, Provider, Active, Created, Job. Includes summary and pagination info. Use `get_listing` for full details.
+
+> **Note:** All timestamps are **unix timestamps in milliseconds** (e.g. `1772008362564`), not seconds.
+
+#### get_listing
+- `listingId` (string, required) – The listing ID to retrieve
+
+## Usage with Local LLM (stdio transport)
+
+The stdio transport communicates over stdin/stdout and is ideal for local LLM tools.
+
+### Quick Start
+
+```bash
+MCP_TOKEN=fredy_<your-token> node mcp/stdio.js
+# or
+MCP_TOKEN=fredy_<your-token> yarn mcp:stdio
+```
+
+### Testing with MCP Inspector
+
+The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) lets you interactively test your MCP server in a browser UI.
+
+```bash
+npx @modelcontextprotocol/inspector -e MCP_TOKEN=fredy_<your-token> -- node mcp/stdio.js
+```
+
+Once the inspector is running, open the URL shown in your terminal (usually `http://localhost:6274`). You can then:
+1. Click **Connect** to establish the stdio connection
+2. Go to the **Tools** tab to see all available tools
+3. Select a tool, fill in parameters, and click **Run** to test it
+
+### LM Studio Configuration
+
+[LM Studio](https://lmstudio.ai/) supports MCP servers natively, allowing your local LLM to access Fredy's jobs and listings data.
+
+#### Setup
+
+1. Open **LM Studio** and load a model that supports tool use (e.g., Qwen 2.5, Llama 3.1, Mistral, etc.)
+2. In the right side  under **Integrations** click on "# install" and "edit mcp.json"
+3. Edit the LM Studio MCP config file directly (`~/.lmstudio/config/mcp.json` or via the UI export):
+
+   ```json
+   {
+     "mcpServers": {
+       "fredy": {
+         "command": "node",
+         "args": ["/absolute/path/to/fredy/mcp/stdio.js"],
+         "env": {
+           "MCP_TOKEN": "fredy_<your-token>"
+         }
+       }
+     }
+   }
+   ```
+
+4. Toggle the server **on**: LM Studio will spawn the stdio process and connect
+5. You should see the Fredy tools appear as available tools
+
+#### Suggestion on LLM
+After testing numerous LLM's, I got the best results with Qwen 3.5 or Qwen 2.5.. E.g. `Qwen2.5-14B-Instruct-1M-8bit`.
+
+#### Usage
+
+Once connected, simply ask your LLM about your real estate data in natural language:
+
+- *"Show me all my active search jobs"*
+- *"List the latest listings from my Berlin apartment search"*
+- *"Get details for listing XYZ"*
+- *"What are the cheapest listings across all my jobs?"*
+
+The LLM will automatically call the appropriate Fredy MCP tools and present the results.
+
+> **Tip:** Make sure Fredy is running and the database is accessible before starting the MCP server in LM Studio. The stdio transport initializes its own database connection, so Fredy's main process does not need to be running, but the database file must exist and be up-to-date (migrations applied).
+
+### Claude Desktop Configuration
+
+[Claude Desktop](https://claude.ai/download) supports MCP servers natively via its developer settings.
+
+#### Setup
+
+1. Open **Claude Desktop**
+2. Go to **Settings → Developer → Edit Config** - this opens the `claude_desktop_config.json` file
+3. Add the `fredy` server to the `mcpServers` object:
+
+   ```json
+   {
+     "mcpServers": {
+       "fredy": {
+         "command": "/opt/homebrew/opt/node@22/bin/node",
+         "args": ["/absolute/path/to/fredy/lib/mcp/stdio.js"],
+         "env": {
+           "MCP_TOKEN": "fredy_<your-token>"
+         }
+       }
+     }
+   }
+   ```
+
+   Replace `/absolute/path/to/fredy` with the actual path on your machine (e.g. `/Users/you/dev/fredy`).
+
+   > **Important:** Claude Desktop launches with a restricted `PATH` and often cannot find `node` by name. Always use the **full absolute path** to the node binary. Find yours by running `which node` in a terminal. Common locations:
+   > - Homebrew (default): `/opt/homebrew/bin/node`
+   > - Homebrew (versioned, e.g. node@22): `/opt/homebrew/opt/node@22/bin/node`
+   > - nvm: `/Users/<you>/.nvm/versions/node/<version>/bin/node`
+
+4. Save the file and **restart Claude Desktop**
+5. You should see a hammer icon (🔨) in the chat input - click it to confirm the Fredy tools are listed
+
+#### Usage
+
+Once connected, simply ask Claude about your real estate data:
+
+- *"Show me all my active search jobs"*
+- *"List the latest listings from my Berlin apartment search"*
+- *"What are the cheapest apartments added this week?"*
+
+Claude will automatically call the appropriate Fredy MCP tools.
+
+> **Note:** Fredy's main web process does not need to be running - the stdio transport opens its own database connection directly. But the SQLite database file must exist and migrations must have been applied.
+
+---
+
+## Usage with Remote LLM (Streamable HTTP transport)
+
+The HTTP transport is automatically available when Fredy is running. It uses the MCP Streamable HTTP protocol at:
+
+```
+POST   /api/mcp   – JSON-RPC messages (initialize, tool calls)
+GET    /api/mcp   – SSE stream for server-initiated notifications
+DELETE /api/mcp   – Terminate session
+```
+
+### Authentication
+
+All requests must include the token as a Bearer token:
+
+```
+Authorization: Bearer fredy_<your-token>
+```
+
+### Example: Initialize a session
+
+```bash
+curl -X POST http://localhost:9998/api/mcp \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer fredy_<your-token>" \
+  -d '{
+    "jsonrpc": "2.0",
+    "id": 1,
+    "method": "initialize",
+    "params": {
+      "protocolVersion": "2025-03-26",
+      "capabilities": {},
+      "clientInfo": { "name": "test-client", "version": "1.0.0" }
+    }
+  }'
+```
+
+### Example: Call a tool
+
+```bash
+curl -X POST http://localhost:9998/api/mcp \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer fredy_<your-token>" \
+  -H "Mcp-Session-Id: <session-id-from-init-response>" \
+  -d '{
+    "jsonrpc": "2.0",
+    "id": 2,
+    "method": "tools/call",
+    "params": {
+      "name": "list_jobs",
+      "arguments": { "page": 1, "pageSize": 10 }
+    }
+  }'
+```
+
+## Security
+
+- Every user is automatically assigned a permanent MCP token at account creation – **tokens never expire**
+- Tokens are cryptographically random (256-bit) and prefixed with `fredy_`
+- Each token is scoped to a single user – the LLM can only access that user's data
+- Non-admin users only see their own jobs and jobs shared with them
+- Tokens are stored in the `mcp_token` column of the `users` table
+- Tokens are deleted automatically when the owning user is removed
+- The `/api/mcp` endpoint uses Bearer token auth (independent of cookie-session)
+- Treat MCP tokens like passwords – do not share them publicly
+
+## Response Format
+
+All tool responses use **markdown** instead of JSON for maximum LLM readability and token efficiency:
+
+- **List responses** (list_jobs, list_listings) use markdown tables with a summary line and pagination footer
+- **Detail responses** (get_job, get_listing) use markdown key-value lists
+- **Error responses** include the tool name and error message
+
+Example list response:
+
+```
+**Tool:** list_listings | **Status:** OK
+
+Found **85** listing(s). Showing page 1 of 2 (50 on this page). More pages available - use page=2 to continue.
+
+| ID | Title | Address | Price | Size | Provider | Active | Created | Job |
+|----|-------|---------|-------|------|----------|--------|---------|-----|
+| abc123 | Nice flat | Berlin | 1200 | 70 | immoscout | yes | 2026-02-25 10:30:00 | My Search |
+| ... | ... | ... | ... | ... | ... | ... | ... | ... |
+
+Use **get_listing** with an ID for full details (description, link, image).
+
+**Page:** 1/2 | **Has more:** yes
+```
+
+Example detail response:
+
+```
+**Tool:** get_listing | **Status:** OK
+
+### Listing: Nice flat
+
+- **ID:** abc123
+- **Title:** Nice flat
+- **Address:** Berlin
+- **Price:** 1200
+- **Size:** 70
+- **Provider:** immoscout
+- **Link:** https://...
+- **Active:** yes
+- **Created:** 2026-02-25 10:30:00
+```
+
+Markdown is used because it is significantly more token-efficient than JSON (~40-60% fewer tokens for tabular data) and natively understood by all LLMs.
+
+## Architecture
+
+```
+┌─────────────────┐     stdio      ┌──────────────┐
+│  Local LLM      │◄──────────────►│  mcp/stdio.js│
+│  (LM Studio,    │                │  (transport)  │
+│   Claude, etc.) │                │               │
+└─────────────────┘                └──────┬───────┘
+                                          │
+┌─────────────────┐  Streamable HTTP ┌────┴────────┐
+│  Remote LLM     │◄───────────────►│  /api/mcp    │
+│                 │  (Bearer token) │  (transport)  │
+└─────────────────┘                 └──────┬───────┘
+                                           │
+                                ┌──────────┴──────────┐
+                                │  mcpAuthentication  │
+                                │  (token validation, │
+                                │   access control)   │
+                                └──────────┬──────────┘
+                                           │
+                                  ┌────────┴────────┐
+                                  │  mcpAdapter.js  │
+                                  │  (tool routing  │
+                                  │   + data fetch) │
+                                  └────────┬────────┘
+                                           │
+                                  ┌────────┴────────┐
+                                  │ mcpNormalizer.js│
+                                  │ (markdown       │
+                                  │  formatting)    │
+                                  └────────┬────────┘
+                                           │
+                                    ┌──────┴───────┐
+                                    │  Fredy DB    │
+                                    │  (SQLite)    │
+                                    └──────────────┘
+```

lib/mcp/mcpAdapter.js

@@ -0,0 +1,355 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { queryJobs, getJob } from '../services/storage/jobStorage.js';
+import { queryListings, getListingById } from '../services/storage/listingsStorage.js';
+import { authenticateToolCall, checkJobAccess } from './mcpAuthentication.js';
+import {
+  normalizeListJobs,
+  normalizeGetJob,
+  normalizeListListings,
+  normalizeGetListing,
+  normalizeError,
+} from './mcpNormalizer.js';
+
+/**
+ * Create a configured MCP server instance with all Fredy tools registered.
+ *
+ * The adapter fetches raw data from storage and delegates response formatting
+ * to the normalizer layer (mcpNormalizer.js) which produces a consistent
+ * { ok, summary, data, meta } envelope for every tool response.
+ *
+ * Each tool call requires a userId (resolved from the MCP token before invocation).
+ * Tools respect user scoping: non-admin users only see their own jobs/listings.
+ *
+ * @returns {McpServer}
+ */
+export function createMcpServer() {
+  const server = new McpServer(
+    {
+      name: 'fredy-mcp',
+      version: '1.0.0',
+    },
+    {
+      capabilities: {
+        tools: {},
+      },
+      instructions:
+        'Fredy MCP Server – query real estate jobs and listings. ' +
+        'All timestamps are unix timestamps in milliseconds (e.g. 1772008362564). ' +
+        'Use list_jobs to browse jobs, get_job for details, ' +
+        'list_listings to search listings (supports time filters like createdAfter/createdBefore), ' +
+        'and get_listing for full details of a single listing. ' +
+        'Responses are formatted as markdown with a summary, data (tables for lists, key-value for details), and pagination info. ' +
+        'Always present results to the user as soon as you have them - do NOT call the tool again unless you need additional pages or different data.',
+    },
+  );
+
+  // ── list_jobs ───────────────────────────────────────────────────────
+  server.tool(
+    'list_jobs',
+    'List real estate search jobs for the authenticated user. ' +
+      'Returns up to 50 jobs per page by default. Use pagination (page parameter) to fetch more. ' +
+      'Check meta.hasMore to know if there are additional pages.',
+    {
+      page: z.number().optional().describe('Page number (default: 1)'),
+      pageSize: z
+        .number()
+        .optional()
+        .describe('Results per page (default: 50, max: 1000). Start with the default and paginate if needed.'),
+      filter: z.string().optional().describe('Free-text filter on job name'),
+    },
+    async ({ page, pageSize, filter }, extra) => {
+      const { user, error } = authenticateToolCall(extra, 'list_jobs');
+      if (error) return normalizeError(error, 'list_jobs');
+
+      const safePage = page ?? 1;
+      const safePageSize = pageSize ?? 50;
+
+      const result = queryJobs({
+        page: safePage,
+        pageSize: safePageSize,
+        freeTextFilter: filter,
+        userId: user.id,
+        isAdmin: user.isAdmin,
+      });
+
+      return normalizeListJobs(result, { page: safePage, pageSize: safePageSize });
+    },
+  );
+
+  // ── get_job ─────────────────────────────────────────────────────────
+  server.tool(
+    'get_job',
+    'Get detailed information about a specific job by its ID.',
+    {
+      jobId: z.string().describe('The job ID to retrieve'),
+    },
+    async ({ jobId }, extra) => {
+      const { user, error } = authenticateToolCall(extra, 'get_job');
+      if (error) return normalizeError(error, 'get_job');
+
+      const job = getJob(jobId);
+      if (!job) {
+        return normalizeError('Job not found.', 'get_job');
+      }
+
+      if (!checkJobAccess(user, job)) {
+        return normalizeError('Access denied.', 'get_job');
+      }
+
+      return normalizeGetJob(job);
+    },
+  );
+
+  // ── list_listings ───────────────────────────────────────────────────
+  server.tool(
+    'list_listings',
+    'Search and list real estate listings. Returns up to 50 listings per page by default. ' +
+      'Use pagination (page parameter) to fetch more. Check meta.hasMore in the response. ' +
+      'Supports text search, time filtering, and various filters. ' +
+      'All timestamps are unix timestamps in milliseconds (e.g. 1772008362564). ' +
+      'Use createdAfter/createdBefore to filter by time, e.g. "give me all listings from today". ' +
+      'Use get_listing to get full details (description, link, image) for a specific listing.',
+    {
+      page: z.number().optional().describe('Page number (default: 1)'),
+      pageSize: z
+        .number()
+        .optional()
+        .describe('Results per page (default: 50, max: 1000). Start with the default and paginate if needed.'),
+      filter: z.string().optional().describe('Free-text search across title, address, provider, link'),
+      jobId: z.string().optional().describe('Filter listings by job ID'),
+      activeOnly: z.boolean().optional().describe('When true, only show active listings'),
+      provider: z.string().optional().describe('Filter by provider name'),
+      createdAfter: z
+        .number()
+        .optional()
+        .describe(
+          'Only include listings created at or after this unix timestamp in milliseconds (e.g. 1772008362564). Useful for queries like "listings from today".',
+        ),
+      createdBefore: z
+        .number()
+        .optional()
+        .describe(
+          'Only include listings created at or before this unix timestamp in milliseconds (e.g. 1772008362564).',
+        ),
+      minPrice: z
+        .number()
+        .optional()
+        .describe(
+          'Only include listings with price >= this value (e.g. 500). Price is a numeric value (no currency symbol).',
+        ),
+      maxPrice: z
+        .number()
+        .optional()
+        .describe(
+          'Only include listings with price <= this value (e.g. 1500). Price is a numeric value (no currency symbol).',
+        ),
+      sortField: z.string().optional().describe('Sort by: created_at, price, size, provider, title, is_active'),
+      sortDir: z.string().optional().describe('Sort direction: asc or desc'),
+      status: z
+        .enum(['applied', 'rejected', 'accepted', 'none'])
+        .optional()
+        .describe(
+          'Filter by user-set status. "applied", "rejected", or "accepted" return only listings with that status; "none" returns only listings without a status set.',
+        ),
+    },
+    async (
+      {
+        page,
+        pageSize,
+        filter,
+        jobId,
+        activeOnly,
+        provider,
+        createdAfter,
+        createdBefore,
+        minPrice,
+        maxPrice,
+        sortField,
+        sortDir,
+        status,
+      },
+      extra,
+    ) => {
+      const { user, error } = authenticateToolCall(extra, 'list_listings');
+      if (error) return normalizeError(error, 'list_listings');
+
+      const safePage = page ?? 1;
+      const safePageSize = pageSize ?? 50;
+
+      const result = queryListings({
+        page: safePage,
+        pageSize: safePageSize,
+        freeTextFilter: filter,
+        jobIdFilter: jobId,
+        activityFilter: activeOnly === true ? true : activeOnly === false ? false : undefined,
+        providerFilter: provider,
+        createdAfter: createdAfter ?? null,
+        createdBefore: createdBefore ?? null,
+        minPrice: minPrice ?? null,
+        maxPrice: maxPrice ?? null,
+        sortField: sortField ?? null,
+        sortDir: sortDir ?? 'desc',
+        statusFilter: status,
+        userId: user.id,
+        isAdmin: user.isAdmin,
+      });
+
+      return normalizeListListings(result, { page: safePage, pageSize: safePageSize });
+    },
+  );
+
+  // ── get_listing ─────────────────────────────────────────────────────
+  server.tool(
+    'get_listing',
+    'Get full details of a single listing by its ID.',
+    {
+      listingId: z.string().describe('The listing ID to retrieve'),
+    },
+    async ({ listingId }, extra) => {
+      const { user, error } = authenticateToolCall(extra, 'get_listing');
+      if (error) return normalizeError(error, 'get_listing');
+
+      const listing = getListingById(listingId, user.id, user.isAdmin);
+      if (!listing) {
+        return normalizeError('Listing not found or access denied.', 'get_listing');
+      }
+
+      return normalizeGetListing(listing);
+    },
+  );
+
+  // ── get_photo_for_listing ─────────────────────────────────────────────────────
+  server.tool(
+    'get_photo_for_listing',
+    'Fetch and return the photo of a listing by its ID as an image for vision analysis.',
+    {
+      listingId: z.string().describe('The listing ID whose photo to fetch'),
+    },
+    async ({ listingId }, extra) => {
+      const { user, error } = authenticateToolCall(extra, 'get_photo_for_listing');
+      if (error) return normalizeError(error, 'get_photo_for_listing');
+
+      const listing = getListingById(listingId, user.id, user.isAdmin);
+      if (!listing) {
+        return normalizeError('Listing not found or access denied.', 'get_photo_for_listing');
+      }
+
+      const imageUrl = listing.image_url;
+      if (!imageUrl) {
+        return normalizeError('No image available for this listing.', 'get_photo_for_listing');
+      }
+
+      const SUPPORTED_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/gif', 'image/webp']);
+
+      let response;
+      try {
+        response = await fetch(imageUrl, {
+          signal: AbortSignal.timeout(10_000),
+          headers: {
+            'User-Agent':
+              'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+            Accept: 'image/jpeg,image/png,image/webp,image/gif,image/*,*/*',
+          },
+        });
+      } catch (fetchErr) {
+        return normalizeError(`Failed to fetch image: ${fetchErr.message}`, 'get_photo_for_listing');
+      }
+
+      if (!response.ok) {
+        return normalizeError(
+          `Image fetch returned HTTP ${response.status}. Image URL: ${imageUrl}`,
+          'get_photo_for_listing',
+        );
+      }
+
+      const contentType = response.headers.get('content-type') ?? '';
+      const headerMimeType = contentType.split(';')[0].trim().toLowerCase();
+
+      let buffer;
+      try {
+        buffer = await response.arrayBuffer();
+      } catch (readErr) {
+        return normalizeError(`Failed to read image body: ${readErr.message}`, 'get_photo_for_listing');
+      }
+
+      const bytes = new Uint8Array(buffer);
+
+      if (bytes.length < 12) {
+        return normalizeError(
+          `Downloaded file is too small to determine image type. Image URL: ${imageUrl}`,
+          'get_photo_for_listing',
+        );
+      }
+
+      let resolvedMime;
+
+      if (SUPPORTED_MIME_TYPES.has(headerMimeType)) {
+        resolvedMime = headerMimeType;
+      } else {
+        if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+          resolvedMime = 'image/jpeg';
+        } else if (
+          bytes[0] === 0x89 &&
+          bytes[1] === 0x50 &&
+          bytes[2] === 0x4e &&
+          bytes[3] === 0x47 &&
+          bytes[4] === 0x0d &&
+          bytes[5] === 0x0a &&
+          bytes[6] === 0x1a &&
+          bytes[7] === 0x0a
+        ) {
+          resolvedMime = 'image/png';
+        } else if (bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38) {
+          resolvedMime = 'image/gif';
+        } else if (
+          bytes[0] === 0x52 &&
+          bytes[1] === 0x49 &&
+          bytes[2] === 0x46 &&
+          bytes[3] === 0x46 &&
+          bytes[8] === 0x57 &&
+          bytes[9] === 0x45 &&
+          bytes[10] === 0x42 &&
+          bytes[11] === 0x50
+        ) {
+          resolvedMime = 'image/webp';
+        } else {
+          return normalizeError(
+            `Image format not supported by vision models (header: ${headerMimeType || 'unknown'}). Image URL: ${imageUrl}`,
+            'get_photo_for_listing',
+          );
+        }
+      }
+
+      const base64 = Buffer.from(buffer).toString('base64');
+
+      return {
+        content: [
+          {
+            type: 'image',
+            data: base64,
+            mimeType: resolvedMime,
+          },
+        ],
+      };
+    },
+  );
+
+  // ── get_current_date_ime ─────────────────────────────────────────────────────
+  server.tool('get_current_date_time', 'Returns the current date and time.', {}, () => {
+    return {
+      content: [{ type: 'text', text: `Timestring: ${new Date().toLocaleString()}, MS since 1970: ${Date.now()}` }],
+    };
+  });
+
+  return server;
+}

lib/mcp/mcpAuthentication.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+/**
+ * MCP Authentication Layer
+ *
+ * Centralizes all authentication and authorization logic for MCP tool calls
+ * and HTTP requests. Ensures consistent access control across all transports.
+ */
+
+import { getUser, validateMcpToken } from '../services/storage/userStorage.js';
+
+/**
+ * Authenticate an MCP tool call by extracting and validating the user from authInfo.
+ *
+ * @param {{ authInfo?: { userId?: string } }} extra - The extra context passed by the MCP SDK.
+ * @returns {{ user: object|null, error: string|null }}
+ *   - On success: { user: <userObject>, error: null }
+ *   - On failure: { user: null, error: <errorMessage> }
+ */
+export function authenticateToolCall(extra) {
+  const userId = extra?.authInfo?.userId;
+  if (!userId) {
+    return { user: null, error: 'Authentication required. Please provide a valid MCP API token.' };
+  }
+
+  const user = getUser(userId);
+  if (!user) {
+    return { user: null, error: 'Authentication required. Please provide a valid MCP API token.' };
+  }
+
+  return { user, error: null };
+}
+
+/**
+ * Check whether a user has access to a specific job.
+ * Admins have access to all jobs. Non-admins can only access their own jobs
+ * or jobs explicitly shared with them.
+ *
+ * @param {object} user - The authenticated user object.
+ * @param {object} job - The job object from storage.
+ * @returns {boolean} True if the user is allowed to access this job.
+ */
+export function checkJobAccess(user, job) {
+  if (user.isAdmin) return true;
+  if (job.userId === user.id) return true;
+  if (Array.isArray(job.shared_with_user) && job.shared_with_user.includes(user.id)) return true;
+  return false;
+}
+
+/**
+ * Authenticate an HTTP request by extracting and validating the Bearer token
+ * from the Authorization header.
+ *
+ * @param {import('http').IncomingMessage} req
+ * @returns {{ userId: string } | null} The authenticated user info, or null if invalid.
+ */
+export function authenticateRequest(req) {
+  const authHeader = req.headers['authorization'] || '';
+  if (!authHeader.startsWith('Bearer ')) return null;
+  const token = authHeader.slice(7).trim();
+  if (!token) return null;
+  return validateMcpToken(token);
+}

lib/mcp/mcpHttpRoute.js

@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createMcpServer } from './mcpAdapter.js';
+import { authenticateRequest } from './mcpAuthentication.js';
+import logger from '../services/logger.js';
+import crypto from 'crypto';
+
+/**
+ * Active transports keyed by session id.
+ * @type {Map<string, { server: McpServer, transport: StreamableHTTPServerTransport }>}
+ */
+const sessions = new Map();
+
+/**
+ * @param {string|undefined} sessionId
+ * @param {{ userId: string }} auth
+ */
+function getOrCreateSession(sessionId, auth) {
+  if (sessionId && sessions.has(sessionId)) {
+    return sessions.get(sessionId);
+  }
+
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: () => crypto.randomUUID(),
+    onsessioninitialized: (sid) => {
+      sessions.set(sid, entry);
+      logger.debug(`MCP session created: ${sid}`);
+    },
+  });
+
+  const server = createMcpServer();
+  const entry = { server, transport, userId: auth.userId };
+
+  transport.onclose = () => {
+    const sid = transport.sessionId;
+    if (sid) {
+      sessions.delete(sid);
+      logger.debug(`MCP session closed: ${sid}`);
+    }
+  };
+
+  return entry;
+}
+
+/**
+ * Register MCP Streamable HTTP routes on a fastify instance.
+ *
+ * POST /api/mcp  – JSON-RPC messages
+ * GET  /api/mcp  – SSE stream for server-initiated notifications
+ * DELETE /api/mcp – session termination
+ *
+ * All endpoints require a valid Bearer token in the Authorization header.
+ *
+ * @param {import('fastify').FastifyInstance} fastify
+ */
+export function registerMcpRoutes(fastify) {
+  fastify.post('/api/mcp', async (request, reply) => {
+    const auth = authenticateRequest(request.raw);
+    if (!auth) {
+      return reply.code(401).send({ error: 'Unauthorized. Provide a valid Bearer token.' });
+    }
+
+    const sessionId = request.raw.headers['mcp-session-id'];
+    const { server, transport } = getOrCreateSession(sessionId, auth);
+
+    if (!transport.onmessage) {
+      await server.connect(transport);
+    }
+
+    request.raw.auth = { userId: auth.userId };
+
+    reply.hijack();
+    await transport.handleRequest(request.raw, reply.raw, request.body);
+  });
+
+  fastify.get('/api/mcp', async (request, reply) => {
+    const auth = authenticateRequest(request.raw);
+    if (!auth) {
+      return reply.code(401).send({ error: 'Unauthorized. Provide a valid Bearer token.' });
+    }
+
+    const sessionId = request.raw.headers['mcp-session-id'];
+    if (!sessionId || !sessions.has(sessionId)) {
+      return reply.code(400).send({ error: 'Invalid or missing session. Send an initialize request first.' });
+    }
+
+    const { transport } = sessions.get(sessionId);
+    reply.hijack();
+    await transport.handleRequest(request.raw, reply.raw);
+  });
+
+  fastify.delete('/api/mcp', async (request, reply) => {
+    const auth = authenticateRequest(request.raw);
+    if (!auth) {
+      return reply.code(401).send({ error: 'Unauthorized. Provide a valid Bearer token.' });
+    }
+
+    const sessionId = request.raw.headers['mcp-session-id'];
+    if (!sessionId || !sessions.has(sessionId)) {
+      return reply.code(404).send({ error: 'Session not found.' });
+    }
+
+    const { transport } = sessions.get(sessionId);
+    await transport.close();
+    sessions.delete(sessionId);
+    return { ok: true };
+  });
+
+  logger.debug('MCP Streamable HTTP endpoint registered at /api/mcp');
+}

lib/mcp/mcpNormalizer.js

@@ -0,0 +1,184 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+/**
+ * MCP Response Normalizer
+ *
+ * Transforms raw adapter data into LLM-friendly markdown responses.
+ * Markdown is significantly better than JSON for LLM consumption because:
+ * - LLMs are trained extensively on markdown text
+ * - Markdown tables are ~40-60% more token-efficient than JSON arrays
+ * - Less syntactic noise (no quotes, brackets, commas around every value)
+ * - Natively readable and structured
+ *
+ * Each response follows a consistent structure:
+ * 1. Status line (OK/ERROR + tool name)
+ * 2. Summary (human-readable description)
+ * 3. Data (markdown table for lists, key-value for single items)
+ * 4. Pagination info (for list responses)
+ */
+
+/**
+ * Wrap a markdown string as an MCP text content result.
+ * @param {string} markdown
+ * @param {boolean} [isError=false]
+ * @returns {{ content: Array, isError?: boolean }}
+ */
+function toMcpResponse(markdown, isError = false) {
+  const result = {
+    content: [{ type: 'text', text: markdown }],
+  };
+  if (isError) result.isError = true;
+  return result;
+}
+
+/**
+ * Format a unix timestamp (ms) as a human-readable date string.
+ * @param {number|null|undefined} ts
+ * @returns {string}
+ */
+function formatDate(ts) {
+  if (ts == null) return '–';
+  return new Date(ts)
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d{3}Z$/, '');
+}
+
+/**
+ * Escape pipe characters in table cell values.
+ * @param {*} val
+ * @returns {string}
+ */
+function cell(val) {
+  if (val == null) return '–';
+  return String(val).replace(/\|/g, '\\|').replace(/\n/g, ' ');
+}
+
+/**
+ * Normalize a list_jobs response.
+ * @param {{ totalNumber: number, page: number, result: object[] }} queryResult
+ * @param {{ page: number, pageSize: number }} params
+ * @returns {{ content: Array }}
+ */
+export function normalizeListJobs(queryResult, { page, pageSize }) {
+  const maxPage = Math.max(1, Math.ceil(queryResult.totalNumber / pageSize));
+  const hasMore = page < maxPage;
+  const jobs = queryResult.result;
+
+  let md = `**Tool:** list_jobs | **Status:** OK\n\n`;
+  md += `Found **${queryResult.totalNumber}** job(s). Showing page ${page} of ${maxPage} (${jobs.length} on this page).`;
+  if (hasMore) md += ` More pages available - use page=${page + 1} to continue.`;
+  md += '\n\n';
+
+  if (jobs.length > 0) {
+    md += `| ID | Name | Enabled | Active Listings |\n`;
+    md += `|----|------|---------|----------------|\n`;
+    for (const j of jobs) {
+      md += `| ${cell(j.id)} | ${cell(j.name)} | ${j.enabled ? 'yes' : 'no'} | ${j.numberOfFoundListings ?? 0} |\n`;
+    }
+  } else {
+    md += `No jobs found.\n`;
+  }
+
+  md += `\n**Page:** ${page}/${maxPage} | **Has more:** ${hasMore ? 'yes' : 'no'}`;
+  return toMcpResponse(md);
+}
+
+/**
+ * Normalize a get_job response.
+ * @param {object} job - The job object from storage.
+ * @returns {{ content: Array }}
+ */
+export function normalizeGetJob(job) {
+  const providers = (job.provider ?? []).map((p) => p.id || p);
+
+  let md = `**Tool:** get_job | **Status:** OK\n\n`;
+  md += `### Job: ${job.name || job.id}\n\n`;
+  md += `- **ID:** ${job.id}\n`;
+  md += `- **Name:** ${job.name || '–'}\n`;
+  md += `- **Enabled:** ${job.enabled ? 'yes' : 'no'}\n`;
+  md += `- **Active Listings:** ${job.numberOfFoundListings ?? 0}\n`;
+  md += `- **Providers:** ${providers.length > 0 ? providers.join(', ') : '–'}\n`;
+  md += `- **Blacklist:** ${(job.blacklist ?? []).length > 0 ? job.blacklist.join(', ') : '–'}\n`;
+
+  return toMcpResponse(md);
+}
+
+/**
+ * Normalize a list_listings response.
+ * @param {{ totalNumber: number, page: number, result: object[] }} queryResult
+ * @param {{ page: number, pageSize: number }} params
+ * @returns {{ content: Array }}
+ */
+export function normalizeListListings(queryResult, { page, pageSize }) {
+  const maxPage = Math.max(1, Math.ceil(queryResult.totalNumber / pageSize));
+  const hasMore = page < maxPage;
+  const listings = queryResult.result;
+
+  let md = `**Tool:** list_listings | **Status:** OK\n\n`;
+  md += `Found **${queryResult.totalNumber}** listing(s). Showing page ${page} of ${maxPage} (${listings.length} on this page).`;
+  if (hasMore) md += ` More pages available - use page=${page + 1} to continue.`;
+  md += '\n\n';
+
+  if (listings.length > 0) {
+    md += `| ID | Title | Address | Price | Size | Provider | Active | Status | Created | Job |\n`;
+    md += `|----|-------|---------|-------|------|----------|--------|--------|---------|-----|\n`;
+    for (const l of listings) {
+      md += `| ${cell(l.id)} | ${cell(l.title)} | ${cell(l.address)} | ${cell(l.price)} | ${cell(l.size)} | ${cell(l.provider)} | ${l.is_active ? 'yes' : 'no'} | ${cell(l.status?.status)} | ${formatDate(l.created_at)} | ${cell(l.job_name)} |\n`;
+    }
+    md += `\nUse **get_listing** with an ID for full details (description, link, image).\n`;
+  } else {
+    md += `No listings found.\n`;
+  }
+
+  md += `\n**Page:** ${page}/${maxPage} | **Has more:** ${hasMore ? 'yes' : 'no'}`;
+  return toMcpResponse(md);
+}
+
+/**
+ * Normalize a get_listing response.
+ * @param {object} listing - The listing object from storage.
+ * @returns {{ content: Array }}
+ */
+export function normalizeGetListing(listing) {
+  let md = `**Tool:** get_listing | **Status:** OK\n\n`;
+  md += `### Listing: ${listing.title || listing.id}\n\n`;
+  md += `- **ID:** ${listing.id}\n`;
+  md += `- **Title:** ${listing.title || '–'}\n`;
+  md += `- **Description:** ${listing.description || '–'}\n`;
+  md += `- **Address:** ${listing.address || '–'}\n`;
+  md += `- **Price:** ${listing.price ?? '–'}\n`;
+  md += `- **Size:** ${listing.size ?? '–'}\n`;
+  md += `- **Provider:** ${listing.provider || '–'}\n`;
+  md += `- **Link:** ${listing.link || '–'}\n`;
+  md += `- **Image:** ${listing.image_url || '–'}\n`;
+  md += `- **Active:** ${listing.is_active ? 'yes' : 'no'}\n`;
+  md += `- **Status:** ${listing.status?.status || '–'}\n`;
+  if (listing.status?.setAt) {
+    md += `- **Status set at:** ${formatDate(listing.status.setAt)}\n`;
+  }
+  md += `- **Created:** ${formatDate(listing.created_at)}\n`;
+  md += `- **Job:** ${listing.job_name || '–'}\n`;
+  if (listing.latitude != null && listing.longitude != null) {
+    md += `- **Location:** ${listing.latitude}, ${listing.longitude}\n`;
+  }
+  if (listing.distance_to_destination != null) {
+    md += `- **Distance to destination:** ${listing.distance_to_destination}\n`;
+  }
+
+  return toMcpResponse(md);
+}
+
+/**
+ * Normalize an error response.
+ * @param {string} message - The error message.
+ * @param {string} [tool] - Optional tool name for context.
+ * @returns {{ content: Array, isError: boolean }}
+ */
+export function normalizeError(message, tool) {
+  const md = `**Tool:** ${tool ?? 'unknown'} | **Status:** ERROR\n\n${message}`;
+  return toMcpResponse(md, true);
+}

lib/mcp/stdio.js

@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+/**
+ * Fredy MCP Server – stdio transport
+ *
+ * Launches the MCP server over stdin/stdout so that local LLM clients
+ * (e.g. Claude Desktop, llm-cli, mcp-cli) can connect directly.
+ *
+ * Usage:
+ *   MCP_TOKEN=fredy_<your-token> node mcp/stdio.js
+ *
+ * The MCP_TOKEN environment variable must contain a valid Fredy MCP token.
+ * Each user has a permanent, non-expiring token shown in the user management list.
+ */
+import { fileURLToPath } from 'url';
+import path from 'path';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import SqliteConnection from '../services/storage/SqliteConnection.js';
+import { runMigrations } from '../services/storage/migrations/migrate.js';
+import { createMcpServer } from './mcpAdapter.js';
+import { validateMcpToken } from '../services/storage/userStorage.js';
+
+// Ensure cwd is the project root so that relative DB/config paths resolve correctly
+// (LM Studio and other MCP hosts may spawn this process from an arbitrary directory)
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+process.chdir(path.resolve(__dirname, '..', '..'));
+
+// Initialize the database (required for standalone usage)
+await SqliteConnection.init();
+await runMigrations();
+
+const token = process.env.MCP_TOKEN;
+if (!token) {
+  process.stderr.write('Error: MCP_TOKEN environment variable is required.\n');
+  process.stderr.write('Each user has a permanent MCP token shown in the user management list.\n');
+  process.exit(1);
+}
+
+const auth = validateMcpToken(token);
+if (!auth) {
+  process.stderr.write('Error: Invalid MCP_TOKEN. Token not found or user no longer exists.\n');
+  process.exit(1);
+}
+
+const mcpServer = createMcpServer();
+
+// Wrap the stdio transport to inject authInfo into every message
+const transport = new StdioServerTransport();
+
+// Patch: the MCP SDK passes authInfo through the transport's onmessage extra param.
+// For stdio we inject the resolved user from the token.
+const patchedTransport = new Proxy(transport, {
+  set(target, prop, value) {
+    if (prop === 'onmessage') {
+      target.onmessage = (message, extra) => {
+        value(message, { ...extra, authInfo: { userId: auth.userId } });
+      };
+      return true;
+    }
+    target[prop] = value;
+    return true;
+  },
+  get(target, prop) {
+    return target[prop];
+  },
+});
+
+await mcpServer.connect(patchedTransport);
+process.stderr.write('Fredy MCP Server running on stdio\n');

lib/notification/adapter/apprise.js

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { markdown2Html } from '../../services/markdown.js';
+import { getJob } from '../../services/storage/jobStorage.js';
+import fetch from 'node-fetch';
+
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const { server } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
+  const job = getJob(jobKey);
+  const jobName = job == null ? jobKey : job.name;
+  const promises = newListings.map((newListing) => {
+    const title = `${jobName} at ${serviceName}: ${newListing.title}`;
+    const fredyLine = baseUrl && newListing.id ? `\nOpen in Fredy: ${baseUrl}/#/listings/listing/${newListing.id}` : '';
+    const message = `Address: ${newListing.address}\nSize: ${newListing.size}\nPrice: ${newListing.price}\nLink: ${newListing.link}${fredyLine}`;
+    return fetch(server, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        body: message,
+        title: title,
+      }),
+    });
+  });
+  return Promise.all(promises);
+};
+export const config = {
+  id: 'apprise',
+  name: 'Apprise',
+  readme: markdown2Html('lib/notification/adapter/apprise.md'),
+  description: 'Fredy will send new listings to your Apprise instance.',
+  fields: {
+    server: {
+      type: 'text',
+      label: 'Server',
+      description: 'The server URL to send the notification to.',
+    },
+  },
+};

lib/notification/adapter/apprise.md

@@ -0,0 +1,8 @@
+### Apprise Adapter
+
+Use [Apprise](https://github.com/caronc/apprise-api#installation) to forward notifications to many different services.
+
+Quick start:
+- Set up an Apprise API instance (see the installation guide linked above).
+- Configure your preferred notification service(s) within Apprise.
+- In Fredy, point the Apprise adapter to your Apprise API endpoint.

lib/notification/adapter/console.js

@@ -1,8 +1,22 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import { markdown2Html } from '../../services/markdown.js';
 
-export const send = ({ serviceName, newListings, jobKey }) => {
+export const send = ({ serviceName, newListings, jobKey, baseUrl }) => {
   /* eslint-disable no-console */
-  return [Promise.resolve(console.info(`Found entry from service ${serviceName}, Job: ${jobKey}:`, newListings))];
+  const fredyLinks = baseUrl ? newListings.map((l) => `${baseUrl}/#/listings/listing/${l.id}`).join(', ') : null;
+  return [
+    Promise.resolve(
+      console.info(
+        `Found entry from service ${serviceName}, Job: ${jobKey}:`,
+        newListings,
+        ...(fredyLinks ? [`Open in Fredy: ${fredyLinks}`] : []),
+      ),
+    ),
+  ];
   /* eslint-enable no-console */
 };
 export const config = {

lib/notification/adapter/console.md

@@ -1,4 +1,3 @@
 ### Console Adapter
 
-The console adapter prints everything found by Fredy into the console (not sending any notifications to you). This can be useful when you want to check if your search
+The console adapter prints everything found by Fredy to the console (it does not send notifications). This is useful to verify that your search criteria work as expected before enabling a real notification service.
-criteria meet the expectations.

lib/notification/adapter/discord_webhook.js

@@ -0,0 +1,145 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import fetch from 'node-fetch';
+import { getJob } from '../../services/storage/jobStorage.js';
+import { markdown2Html } from '../../services/markdown.js';
+import { normalizeImageUrl } from '../../utils.js';
+import logger from '../../services/logger.js';
+
+/**
+ * Generates an idempotent decimal color code. The input string-based color code is
+ * generated using the djb2 hash algorithm.
+ *
+ * @param {string} str - Input string as color code base
+ * @returns {number} Generated decimal color code (0 - 16777215)
+ */
+const generateColorFromString = (str) => {
+  let hash = 5381; // initial value
+  const input = String(str);
+
+  for (let i = 0; i < input.length; i++) {
+    // hash * 33 + charCode
+    hash = (hash << 5) + hash + input.charCodeAt(i);
+    // Ensure the hash is 32 bit
+    hash |= 0;
+  }
+
+  let positiveHash = hash >>> 0;
+  const maxColorValue = 16777215;
+  const colorDecimal = positiveHash % maxColorValue;
+
+  return colorDecimal;
+};
+
+/**
+ * Creates an embed per listing
+ * (-> see https://birdie0.github.io/discord-webhooks-guide/structure/embeds.html).
+ *
+ * @param {string} jobKey - Key of job (used to set embed color)
+ * @param {object} listing - Object holding listing details
+ * @param baseUrl
+ * @returns {object} Discord webhook embed
+ */
+const buildEmbed = (jobKey, listing, baseUrl) => {
+  const maxTitleLength = 252; // Max embed title length is 256 characters
+  let title = String(listing.title ?? 'N/A');
+  if (title.length > maxTitleLength) {
+    title = title.substring(0, maxTitleLength) + '...';
+  }
+
+  const fields = [
+    {
+      name: 'Price',
+      value: String(listing.price ?? 'n/a'),
+      inline: true,
+    },
+    {
+      name: 'Size',
+      value: listing?.size?.replace(/2m/g, 'm²') ?? 'n/a',
+      inline: true,
+    },
+    {
+      name: 'Address',
+      value: String(listing.address ?? 'n/a'),
+      inline: true,
+    },
+  ];
+
+  if (baseUrl && listing.id) {
+    fields.push({
+      name: 'Open in Fredy',
+      value: `[Open in Fredy](${baseUrl}/#/listings/listing/${listing.id})`,
+      inline: false,
+    });
+  }
+
+  const embed = {
+    title: title,
+    color: generateColorFromString(jobKey),
+    url: listing.link,
+    fields,
+  };
+
+  if (listing.image) {
+    embed.image = {
+      url: normalizeImageUrl(listing.image),
+    };
+  }
+
+  return embed;
+};
+
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const adapter = notificationConfig.find((adapter) => adapter.id === config.id);
+  const webhookUrl = adapter?.fields?.webhookUrl;
+  if (!webhookUrl || newListings.length === 0) return Promise.resolve([]);
+
+  const job = getJob(jobKey);
+  const jobName = job?.name || jobKey;
+
+  const embeds = newListings.map((listing) => buildEmbed(jobKey, listing, baseUrl));
+
+  const maxEmbedsPerMessage = 10; // Discord only allows up to 10 embeds
+  const webhookPromises = [];
+
+  for (let i = 0; i < embeds.length; i += maxEmbedsPerMessage) {
+    // Send multiple Discord messages with up to 10 embeds per message
+    const embedChunk = embeds.slice(i, i + maxEmbedsPerMessage);
+
+    const content = i === 0 ? `*${jobName}:* ${serviceName} found **${newListings.length}** new listings.` : '';
+    const body = JSON.stringify({
+      content: content,
+      embeds: embedChunk,
+    });
+
+    const fetchPromise = fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body,
+    }).catch((error) => {
+      logger.error(`Error sending Discord webhook for chunk starting at ${i}:`, error);
+      return Promise.reject(new Error(`Webhook failed: ${error.message}`));
+    });
+
+    webhookPromises.push(fetchPromise);
+  }
+
+  return Promise.allSettled(webhookPromises);
+};
+
+export const config = {
+  id: 'discord_webhook',
+  name: 'Discord Webhook',
+  readme: markdown2Html('lib/notification/adapter/discord_webhook.md'),
+  description: 'Fredy will send new listings to the Discord channel of your choice.',
+  fields: {
+    webhookUrl: {
+      type: 'text',
+      label: 'Webhook URL',
+      description: 'The URL of the Discord webhook to send messages to.',
+    },
+  },
+};

lib/notification/adapter/discord_webhook.md

@@ -0,0 +1,8 @@
+### Discord Webhook Adapter
+
+Use a Discord channel webhook to receive notifications.
+
+Quick start:
+- Create a webhook in your target Discord channel. See the "Intro to Webhooks" guide on the Discord support site: https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks
+- Copy the generated webhook URL.
+- In Fredy, configure the Discord adapter with this webhook URL.

lib/notification/adapter/http.js

@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { markdown2Html } from '../../services/markdown.js';
+
+const mapListing = (listing, baseUrl) => ({
+  address: listing.address,
+  description: listing.description,
+  id: listing.id,
+  imageUrl: listing.image,
+  price: listing.price,
+  size: listing.size,
+  title: listing.title,
+  url: listing.link,
+  fredyUrl: baseUrl && listing.id ? `${baseUrl}/#/listings/listing/${listing.id}` : null,
+});
+
+export const send = async ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const { authToken, endpointUrl, selfSignedCerts } = notificationConfig.find((a) => a.id === config.id).fields;
+
+  const listings = newListings.map((l) => mapListing(l, baseUrl));
+  const body = {
+    jobId: jobKey,
+    timestamp: new Date().toISOString(),
+    provider: serviceName,
+    listings,
+  };
+
+  const headers = {
+    'Content-Type': 'application/json',
+  };
+  if (authToken != null) {
+    headers['Authorization'] = `Bearer ${authToken}`;
+  }
+
+  let fetchOptions = {
+    method: 'POST',
+    headers,
+    timeout: 10000,
+    body: JSON.stringify(body),
+  };
+
+  if (selfSignedCerts === true) {
+    fetchOptions.dispatcher = new (await import('undici')).Agent({
+      connect: { rejectUnauthorized: false },
+    });
+  }
+
+  return fetch(endpointUrl, fetchOptions);
+};
+
+export const config = {
+  id: 'http',
+  name: 'HTTP',
+  readme: markdown2Html('lib/notification/adapter/http.md'),
+  description: 'Fredy will send a generic HTTP POST request.',
+  fields: {
+    endpointUrl: {
+      description: "Your application's endpoint URL.",
+      label: 'Endpoint URL',
+      type: 'text',
+    },
+    selfSignedCerts: {
+      label: 'Self-signed certificates',
+      type: 'boolean',
+    },
+    authToken: {
+      description: "Your application's auth token, if required by your endpoint.",
+      label: 'Auth token (optional)',
+      optional: true,
+      type: 'text',
+    },
+  },
+};

lib/notification/adapter/http.md

@@ -0,0 +1,43 @@
+### HTTP Adapter
+
+This is a generic adapter for sending notifications via HTTP requests.
+You can leverage this adapter to integrate with various webhooks or APIs that accept HTTP requests. (e.g. Supabase
+Functions, a Node.js server, etc.)
+
+HTTP adapter supports a `authToken` field, which can be used to include an authorization token in the request headers.
+Your token would be included as a Bearer token in the `Authorization` header, which is a common method for securing API requests.
+
+Request Details:
+<details>
+Request Method: POST  
+
+Headers:
+
+```
+Content Type: `application/json`
+Authorization: Bearer {your-optional-auth-token}
+```
+
+Body:
+
+```json
+{
+  "jobId": "mg1waX4RHmIzL5NDYtYp-",
+  "provider": "immoscout",
+  "timestamp": "2024-06-15T12:34:56Z",
+  "listings": [
+    {
+      "address": "Str. 123, Bielefeld, Germany",
+      "description": "Möbliert: Einziehen & wohlfühlen: Neu möbliert.",
+      "id": "123456789",
+      "imageUrl": "https://<target-url>.com/listings/123456789.jpg",
+      "price": "1.240 €",
+      "size": "38 m²",
+      "title": "Schöne 1-Zimmer-Wohnung in Bielefeld",
+      "url": "https://<target-url>.com/listings/123456789"
+    }
+  ]
+}
+```
+
+</details>

lib/notification/adapter/mailJet.js

@@ -1,43 +1,119 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import mailjet from 'node-mailjet';
 import path from 'path';
 import fs from 'fs';
 import Handlebars from 'handlebars';
+import fetch from 'node-fetch';
 import { markdown2Html } from '../../services/markdown.js';
-import { getDirName } from '../../utils.js';
+import { getDirName, normalizeImageUrl } from '../../utils.js';
+import logger from '../../services/logger.js';
+
 const __dirname = getDirName();
 const template = fs.readFileSync(path.resolve(__dirname + '/notification/emailTemplate/template.hbs'), 'utf8');
 const emailTemplate = Handlebars.compile(template);
-export const send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
+
+const guessMime = (url) => {
+  const lower = url.split('?')[0].toLowerCase();
+  if (lower.endsWith('.png')) return 'image/png';
+  if (lower.endsWith('.gif')) return 'image/gif';
+  return 'image/jpeg';
+};
+
+const toBase64 = async (url) => {
+  try {
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`Fetch failed with status ${res.status} for URL: ${url}`);
+    const ab = await res.arrayBuffer();
+    return Buffer.from(ab).toString('base64');
+  } catch (error) {
+    logger.error(`Error fetching image from ${url}:`, error.message);
+    throw error;
+  }
+};
+
+const mapListingsWithCid = async (serviceName, jobKey, listings, baseUrl) => {
+  const out = [];
+  const attachments = [];
+
+  for (let i = 0; i < listings.length; i++) {
+    const l = listings[i] || {};
+    const imgUrl = normalizeImageUrl(l.image);
+
+    const item = {
+      title: l.title || '',
+      link: l.link || '',
+      address: l.address || '',
+      size: l.size || '',
+      price: l.price || '',
+      serviceName,
+      jobKey,
+      hasImage: false,
+      imageCid: '',
+      fredyUrl: baseUrl && l.id ? `${baseUrl}/#/listings/listing/${l.id}` : null,
+    };
+
+    if (imgUrl) {
+      try {
+        const base64 = await toBase64(imgUrl);
+        const cid = `listing-${i}`;
+        attachments.push({
+          ContentType: guessMime(imgUrl),
+          Filename: `listing-${i}.${imgUrl.split('.').pop().split('?')[0] || 'jpg'}`,
+          Base64Content: base64,
+          ContentID: cid,
+        });
+        item.hasImage = true;
+        item.imageCid = cid;
+      } catch (error) {
+        logger.warn(`Skipping image for listing ${i} due to error: ${error.message}`);
+      }
+    }
+
+    out.push(item);
+  }
+
+  return { listings: out, attachments };
+};
+
+export const send = async ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
   const { apiPublicKey, apiPrivateKey, receiver, from } = notificationConfig.find(
     (adapter) => adapter.id === config.id,
   ).fields;
+
   const to = receiver
     .trim()
     .split(',')
-    .map((r) => ({
+    .map((r) => ({ Email: r.trim() }))
-      Email: r.trim(),
+    .filter((r) => r.Email.length > 0);
-    }));
+
+  const { listings, attachments } = await mapListingsWithCid(serviceName, jobKey, newListings, baseUrl);
+
+  const html = emailTemplate({
+    serviceName: `Job: (${jobKey}) | Service: ${serviceName}`,
+    numberOfListings: listings.length,
+    listings,
+  });
+
   return mailjet
     .apiConnect(apiPublicKey, apiPrivateKey)
     .post('send', { version: 'v3.1' })
     .request({
       Messages: [
         {
-          From: {
+          From: { Email: from, Name: 'Fredy' },
-            Email: from,
-            Name: 'Fredy',
-          },
           To: to,
-          Subject: `Fredy found ${newListings.length} new listings for ${serviceName}`,
+          Subject: `Fredy found ${listings.length} new listing(s) for ${serviceName}`,
-          HTMLPart: emailTemplate({
+          HTMLPart: html,
-            serviceName: `Job: (${jobKey}) | Service: ${serviceName}`,
+          InlinedAttachments: attachments,
-            numberOfListings: newListings.length,
-            listings: newListings,
-          }),
         },
       ],
     });
 };
+
 export const config = {
   id: 'mailjet',
   name: 'MailJet',

lib/notification/adapter/mailJet.md

@@ -1,8 +1,8 @@
-### MailJet Adapter
+### Mailjet Adapter
 
-To use [MailJet](https://mailjet.com), you need to create an account. You'll need to decided from which email address you want Fredy to send from.  
+To use [Mailjet](https://mailjet.com), create an account and decide which email address Fredy should send from.
 
-E.g. if you use yourGmailAccount@gmail.com, you have to add this to MailJet and verify it as well.     
+For example, if you use yourGmailAccount@gmail.com, add and verify this address in Mailjet.
-The given public/private api keys are needed in order to use MailJet with Fredy. Fredy will use the same template, it is using for SendGrid.
+Provide your public/private API keys in Fredy's configuration. Fredy uses the same email template as for SendGrid.
 
-If this email should be sent to multiple receiver use a comma separator (some@email.com, someOther@email.com). 
+To send to multiple recipients, separate email addresses with commas (e.g., some@email.com, someOther@email.com).

lib/notification/adapter/mattermost.js

@@ -1,22 +1,32 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import { markdown2Html } from '../../services/markdown.js';
 import { getJob } from '../../services/storage/jobStorage.js';
 import fetch from 'node-fetch';
-export const send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
   const { webhook, channel } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
   const job = getJob(jobKey);
   const jobName = job == null ? jobKey : job.name;
   let message = `### *${jobName}* (${serviceName}) found **${newListings.length}** new listings:\n\n`;
-  message += `| Title | Address | Size | Price |\n|:----|:----|:----|:----|\n`;
+  message += `| Title | Address | Size | Price |${baseUrl ? ' Open in Fredy |' : ''}\n|:----|:----|:----|:----|${baseUrl ? ':----|\n' : '\n'}`;
-  message += newListings.map(
+  message += newListings.map((o) => {
-    (o) => `| [${o.title}](${o.link}) | ` + [o.address, o.size.replace(/2m/g, '$m^2$'), o.price].join(' | ') + ' |\n',
+    const fredyCell = baseUrl && o.id ? ` [Open in Fredy](${baseUrl}/#/listings/listing/${o.id}) |` : '';
-  );
+    return (
+      `| [${o.title}](${o.link}) | ` +
+      [o.address, o.size.replace(/2m/g, '$m^2$'), o.price].join(' | ') +
+      ` |${fredyCell}\n`
+    );
+  });
   return fetch(webhook, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: {
+    body: JSON.stringify({
       channel: channel,
       text: message,
-    },
+    }),
   });
 };
 export const config = {

lib/notification/adapter/mattermost.md

@@ -1,5 +1,8 @@
 ### Mattermost Adapter
 
-For Mattermost, you need to create a incoming webhook. This is pretty easy. Please visit the steps in the  [developer docs](https://docs.mattermost.com/developer/webhooks-incoming.html) and follow the instructions.
+Receive notifications in Mattermost via an incoming webhook.
 
-As a result, you get the webhook URL for configuration in fredy. In addition, the target channel must be defined.
+Quick start:
+- Create an incoming webhook following the Mattermost developer docs: https://docs.mattermost.com/developer/webhooks-incoming.html
+- Copy the webhook URL.
+- In Fredy, configure the Mattermost adapter with this URL and the target channel.

lib/notification/adapter/ntfy.js

@@ -1,30 +1,63 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import { markdown2Html } from '../../services/markdown.js';
 import { getJob } from '../../services/storage/jobStorage.js';
 import fetch from 'node-fetch';
+import { normalizeImageUrl } from '../../utils.js';
 
-export const send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
   const { priority, server, topic } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
   const job = getJob(jobKey);
   const jobName = job == null ? jobKey : job.name;
+
   const promises = newListings.map((newListing) => {
-    const message = `Address: ${newListing.address} Size: ${newListing.size.replace(/2m/g, '$m^2$')} Price: ${
+    const fredyLine = baseUrl && newListing.id ? `\nOpen in Fredy: ${baseUrl}/#/listings/listing/${newListing.id}` : '';
-      newListing.price
+    const message = `
-    }`;
+Address: ${newListing.address}
-    return fetch(server, {
+Size: ${newListing.size == null ? 'N/A' : newListing.size.replace(/2m/g, '$m^2$')}
+Price: ${newListing.price}
+Link: ${newListing.link}${fredyLine}`;
+
+    const sanitizeHeaderValue = (value) =>
+      String(value ?? '')
+        .replace(/[\r\n]+/g, ' ')
+        .replace(/[^\x20-\x7E]/g, ' ')
+        .trim();
+
+    const headers = {
+      Title: sanitizeHeaderValue(newListing.title),
+      Priority: sanitizeHeaderValue(priority),
+      Tags: sanitizeHeaderValue(`${serviceName},${jobName}`),
+      Click: sanitizeHeaderValue(newListing.link),
+    };
+
+    if (newListing.image && typeof newListing.image === 'string') {
+      headers.Attach = normalizeImageUrl(newListing.image);
+    }
+
+    return fetch(`${server}/${topic}`, {
       method: 'POST',
-      body: JSON.stringify({
+      headers,
-        topic: topic,
+      body: message,
-        message: message,
+    })
-        title: newListing.title,
+      .then((res) => {
-        tags: [serviceName, jobName],
+        if (!res.ok) {
-        priority: parseInt(priority),
+          throw new Error(`Ntfy message could not be sent. Status code: ${res.status}`);
-        click: newListing.link,
+        }
-      }),
+        return res.text();
-    });
+      })
+      .catch((error) => {
+        // Ensure we reject with an Error object and prevent unhandled rejections
+        throw error instanceof Error ? error : new Error(String(error));
+      });
   });
 
   return Promise.all(promises);
 };
+
 export const config = {
   id: 'ntfy',
   name: 'ntfy',

lib/notification/adapter/ntfy.md

@@ -1,5 +1,8 @@
 ### ntfy Adapter
 
-For ntfy, you need to create a topic on your preferred ntfy instance. This is pretty easy. Please visit the steps in the  [docs](https://docs.ntfy.sh/publish/) and follow the instructions.
+Send push notifications using an ntfy topic.
 
-As a result, you get the URL for configuration in fredy. In addition, the priority must be defined.
+Quick start:
+- Create or choose a topic on your preferred ntfy instance (see docs: https://docs.ntfy.sh/publish/).
+- Copy the publish URL for that topic.
+- In Fredy, configure the ntfy adapter with the topic URL and set a priority.

lib/notification/adapter/pushover.js

@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { markdown2Html } from '../../services/markdown.js';
+import { getJob } from '../../services/storage/jobStorage.js';
+import fetch from 'node-fetch';
+
+export const send = async ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const { token, user, device } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
+  const job = getJob(jobKey);
+  const jobName = job == null ? jobKey : job.name;
+
+  const results = await Promise.all(
+    newListings.map(async (newListing) => {
+      const title = `${jobName} at ${serviceName}: ${newListing.title}`;
+      const fredyLine =
+        baseUrl && newListing.id ? `\nOpen in Fredy: ${baseUrl}/#/listings/listing/${newListing.id}` : '';
+      const message = `Address: ${newListing.address}\nSize: ${newListing.size}\nPrice: ${newListing.price}\nLink: ${newListing.link}${fredyLine}`;
+
+      const form = new FormData();
+      form.append('token', token);
+      form.append('user', user);
+      form.append('title', title);
+      form.append('message', message);
+      if (device) form.append('device', device);
+
+      // Try to attach image if available
+      if (newListing.image && typeof newListing.image === 'string') {
+        try {
+          const imgRes = await fetch(newListing.image);
+          if (imgRes.ok) {
+            const ab = await imgRes.arrayBuffer();
+            form.append('attachment', new Blob([ab]), 'image.jpg');
+          }
+        } catch {
+          // fail silently, just skip the image
+        }
+      }
+
+      const res = await fetch('https://api.pushover.net/1/messages.json', {
+        method: 'POST',
+        body: form,
+      });
+
+      return res.json();
+    }),
+  );
+
+  // Collect errors
+  const errors = results
+    .map((r) => (r.errors && r.errors.length > 0 ? r.errors.join(', ') : null))
+    .filter((e) => e !== null);
+
+  if (errors.length > 0) {
+    return Promise.reject(errors.join('; '));
+  }
+
+  return results;
+};
+
+export const config = {
+  id: 'pushover',
+  name: 'Pushover',
+  readme: markdown2Html('lib/notification/adapter/pushover.md'),
+  description: 'Fredy will send new listings to your mobile using Pushover.',
+  fields: {
+    token: {
+      type: 'text',
+      label: 'API token',
+      description: "Your application's API token.",
+    },
+    user: {
+      type: 'text',
+      label: 'User key',
+      description: 'Your user/group key.',
+    },
+    device: {
+      type: 'text',
+      label: 'Device name',
+      description:
+        'The device name to send your notification to. Messages may be addressed to multiple specific devices by joining them with a comma.',
+    },
+  },
+};

lib/notification/adapter/pushover.md

@@ -0,0 +1,8 @@
+### Pushover Adapter
+
+Use Pushover to receive push notifications on your devices.
+
+Setup:
+- Follow Pushover's getting-started guide: https://support.pushover.net/i7-what-is-pushover-and-how-do-i-use-it
+- Create an application and obtain your User Key and API Token.
+- In Fredy, configure the Pushover adapter with both values.

lib/notification/adapter/resend.js

@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { Resend } from 'resend';
+import path from 'path';
+import fs from 'fs';
+import Handlebars from 'handlebars';
+import { markdown2Html } from '../../services/markdown.js';
+import { getDirName, normalizeImageUrl } from '../../utils.js';
+
+const __dirname = getDirName();
+const template = fs.readFileSync(path.resolve(__dirname + '/notification/emailTemplate/template.hbs'), 'utf8');
+const emailTemplate = Handlebars.compile(template);
+
+const mapListings = (serviceName, jobKey, listings, baseUrl) =>
+  listings.map((l) => {
+    const image = normalizeImageUrl(l.image);
+    return {
+      title: l.title || '',
+      link: l.link || '',
+      address: l.address || '',
+      size: l.size || '',
+      price: l.price || '',
+      image,
+      hasImage: Boolean(image),
+      fredyUrl: baseUrl && l.id ? `${baseUrl}/#/listings/listing/${l.id}` : null,
+      serviceName,
+      jobKey,
+    };
+  });
+
+export const send = async ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const { apiKey, receiver, from } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
+
+  const to = receiver
+    .trim()
+    .split(',')
+    .map((r) => r.trim())
+    .filter(Boolean);
+
+  const resend = new Resend(apiKey);
+
+  const listings = mapListings(serviceName, jobKey, newListings, baseUrl);
+
+  const html = emailTemplate({
+    serviceName: `Job: (${jobKey}) | Service: ${serviceName}`,
+    numberOfListings: listings.length,
+    listings,
+  });
+
+  const { error } = await resend.emails.send({
+    from,
+    to,
+    subject: `Fredy found ${listings.length} new listing(s) for ${serviceName}`,
+    html,
+  });
+
+  if (!error) {
+    return Promise.resolve();
+  } else {
+    return Promise.reject(error.message);
+  }
+};
+
+export const config = {
+  id: 'resend',
+  name: 'Resend',
+  description: 'Resend is being used to send new listings via mail.',
+  readme: markdown2Html('lib/notification/adapter/resend.md'),
+  fields: {
+    apiKey: {
+      type: 'text',
+      label: 'Api Key',
+      description: 'The Resend API key used to send emails.',
+    },
+    receiver: {
+      type: 'email',
+      label: 'Receiver Email',
+      description: 'Comma-separated email addresses Fredy will send notifications to.',
+    },
+    from: {
+      type: 'email',
+      label: 'Sender Email',
+      description: 'The verified email address or domain you send from in Resend.',
+    },
+  },
+};

lib/notification/adapter/resend.md

@@ -0,0 +1,17 @@
+### Resend Adapter
+
+Resend is a modern email delivery service that Fredy can use to send notifications.
+
+Setup:
+- Create a Resend account: https://resend.com/
+- Create an API key and add it to Fredy's configuration.
+- Choose the sender address (e.g., you@yourdomain.com). Verify the domain (https://resend.com/domains/) in Resend before using it.
+- Optional for local testing: you can use `onboarding@resend.dev`, but Resend may restrict who you can send to when using test domains.
+
+Multiple recipients:
+- Separate email addresses with commas (e.g., some@email.com, someOther@email.com).
+
+Notes & Troubleshooting:
+- Ensure the `from` address is verified or belongs to a verified domain in Resend.
+- If emails don't arrive, check your spam folder and Resend dashboard logs.
+- The template displays listing images via their public URLs; make sure images are reachable.

lib/notification/adapter/sendGrid.js

@@ -1,24 +1,59 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import sgMail from '@sendgrid/mail';
 import { markdown2Html } from '../../services/markdown.js';
-export const send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
+import { normalizeImageUrl } from '../../utils.js';
+
+const mapListings = (serviceName, jobKey, listings, baseUrl) =>
+  listings.map((l) => {
+    const image = normalizeImageUrl(l.image);
+    return {
+      title: l.title || '',
+      link: l.link || '',
+      address: l.address || '',
+      size: l.size || '',
+      price: l.price || '',
+      image,
+      hasImage: Boolean(image),
+      // optional plain text snippet
+      snippet: [l.address, l.price, l.size].filter(Boolean).join(' | '),
+      fredyUrl: baseUrl && l.id ? `${baseUrl}/#/listings/listing/${l.id}` : null,
+      serviceName,
+      jobKey,
+    };
+  });
+
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
   const { apiKey, receiver, from, templateId } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
+
   sgMail.setApiKey(apiKey);
+
+  const to = receiver
+    .trim()
+    .split(',')
+    .map((r) => r.trim())
+    .filter(Boolean);
+
+  const listings = mapListings(serviceName, jobKey, newListings, baseUrl);
+
   const msg = {
     templateId,
-    to: receiver
+    to,
-      .trim()
-      .split(',')
-      .map((r) => r.trim()),
     from,
     subject: `Job ${jobKey} | Service ${serviceName} found ${newListings.length} new listing(s)`,
     dynamic_template_data: {
       serviceName: `Job: (${jobKey}) | Service: ${serviceName}`,
       numberOfListings: newListings.length,
-      listings: newListings,
+      listings,
     },
   };
+
   return sgMail.send(msg);
 };
+
 export const config = {
   id: 'sendgrid',
   name: 'SendGrid',

lib/notification/adapter/sendGrid.md

@@ -1,10 +1,12 @@
 ### SendGrid Adapter
 
+SendGrid is an email delivery service with a generous free tier, which is more than enough for Fredy.
 
-SendGrid is a free email service (free as in "you cannot send more than 100(Sendgrid) and 200(Mailjet) emails a day"), which is more than enough for Fredy.
+Setup:
+- Create a SendGrid account: https://sendgrid.com/
+- Decide which email address Fredy should send from (e.g., yourGmailAccount@gmail.com), add it to SendGrid, and complete the verification.
+- Create an API key and add it to Fredy's configuration.
+- Create a Dynamic Template in SendGrid. You can copy the template from `/lib/notification/emailTemplate/template.hbs`.
 
-To use [SendGrid](https://sendgrid.com/), you need to create an account. You'll need to decided from which email address you want Fredy to send from. E.g. if you use yourGmailAccount@gmail.com, you have to add this to sendgrid and verify it as well.     
+Sending to multiple recipients:
-
+- Separate email addresses with commas (e.g., some@email.com, someOther@email.com).
-Lastly you have to create an api-key and feed it into Fredy's config, as well as creating a new dynamic template. For this new template, I recommend copying and pasting the code from the one I have provided under `/lib/notification/emailTemplate/template.hbs`.
-
-If this email should be sent to multiple receiver use a comma separator (some@email.com, someOther@email.com).

lib/notification/adapter/slack.js

@@ -1,43 +1,73 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import Slack from 'slack';
 import { markdown2Html } from '../../services/markdown.js';
-const msg = Slack.chat.postMessage;
+import { normalizeImageUrl } from '../../utils.js';
-export const send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
+
-  const { token, channel } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
+const buildBlocks = (serviceName, jobKey, p, baseUrl) => {
-  return newListings.map((payload) =>
+  const blocks = [
-    msg({
+    {
-      token,
+      type: 'header',
-      channel,
+      text: { type: 'plain_text', text: `New Listing from ${serviceName} (${jobKey})`, emoji: false },
-      text: `*(${serviceName} - ${jobKey})* - ${payload.title}`,
+    },
-      attachments: [
+    {
-        {
+      type: 'section',
-          fallback: payload.title,
+      text: { type: 'mrkdwn', text: `*<${p.link}|${p.title}>*` },
-          color: '#36a64f',
+    },
-          title: 'Link to Exposé',
+    {
-          title_link: payload.link,
+      type: 'section',
-          fields: [
+      fields: [
-            {
+        { type: 'mrkdwn', text: `*Price*\n${p.price ?? 'n/a'}` },
-              title: 'Price',
+        { type: 'mrkdwn', text: `*Size*\n${p.size ?? 'n/a'}` },
-              value: payload.price,
+        { type: 'mrkdwn', text: `*Address*\n${p.address ?? 'n/a'}` },
-              short: false,
-            },
-            {
-              title: 'Size',
-              value: payload.size,
-              short: false,
-            },
-            {
-              title: 'Address',
-              value: payload.address,
-              short: false,
-            },
-          ],
-          footer: 'Powered by Fredy',
-          ts: new Date().getTime() / 1000,
-        },
       ],
-    }),
+    },
+  ];
+
+  const img = normalizeImageUrl(p.image);
+  if (img) {
+    blocks.push({
+      type: 'image',
+      image_url: img,
+      alt_text: p.title || 'listing image',
+    });
+  }
+
+  if (baseUrl && p.id) {
+    blocks.push({
+      type: 'section',
+      text: { type: 'mrkdwn', text: `<${baseUrl}/#/listings/listing/${p.id}|Open in Fredy>` },
+    });
+  }
+
+  blocks.push({
+    type: 'context',
+    elements: [{ type: 'mrkdwn', text: 'Powered by Fredy' }],
+  });
+
+  return blocks;
+};
+
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const { token, channel } = notificationConfig.find((a) => a.id === config.id).fields;
+
+  return Promise.allSettled(
+    newListings.map((p) =>
+      Slack.chat.postMessage({
+        token,
+        channel,
+        text: `${serviceName} ${jobKey}: ${p.title}`,
+        blocks: buildBlocks(serviceName, jobKey, p, baseUrl),
+        unfurl_links: false,
+        unfurl_media: false,
+      }),
+    ),
   );
 };
+
 export const config = {
   id: 'slack',
   name: 'Slack',

lib/notification/adapter/slack.md

@@ -1,6 +1,5 @@
-### Slack Adapter
+### Slack Adapter (Legacy)
 
+*IMPORTANT:*
+This legacy adapter is outdated and kept only for backward compatibility. Please use the Slack adapter with webhooks instead.
 
-In order to use [Slack](https://slack.com), you need to create an account. When done, you need to create a new App in your workspace. Give it the permission `chat:write:bot` and `chat:write:user`.  
- 
-Now you need to create a user token and a channel. Make sure the bot is installed to this channel. 

lib/notification/adapter/slack_with_webhooks.js

@@ -0,0 +1,91 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import fetch from 'node-fetch';
+import { markdown2Html } from '../../services/markdown.js';
+import { normalizeImageUrl } from '../../utils.js';
+
+const buildBlocks = (serviceName, jobKey, p, baseUrl) => {
+  const blocks = [
+    {
+      type: 'header',
+      text: { type: 'plain_text', text: `New Listing from ${serviceName} (${jobKey})`, emoji: false },
+    },
+    {
+      type: 'section',
+      text: { type: 'mrkdwn', text: `*<${p.link}|${p.title}>*` },
+    },
+    {
+      type: 'section',
+      fields: [
+        { type: 'mrkdwn', text: `*Price*\n${p.price ?? 'n/a'}` },
+        { type: 'mrkdwn', text: `*Size*\n${p.size ?? 'n/a'}` },
+        { type: 'mrkdwn', text: `*Address*\n${p.address ?? 'n/a'}` },
+      ],
+    },
+  ];
+
+  const img = normalizeImageUrl(p.image);
+  if (img) {
+    blocks.push({
+      type: 'image',
+      image_url: img,
+      alt_text: p.title || 'listing image',
+    });
+  }
+
+  if (baseUrl && p.id) {
+    blocks.push({
+      type: 'section',
+      text: { type: 'mrkdwn', text: `<${baseUrl}/#/listings/listing/${p.id}|Open in Fredy>` },
+    });
+  }
+
+  blocks.push({
+    type: 'context',
+    elements: [{ type: 'mrkdwn', text: 'Powered by Fredy' }],
+  });
+
+  return blocks;
+};
+
+const postJson = (url, body) =>
+  fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
+
+export const send = ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const adapter = notificationConfig.find((a) => a.id === config.id);
+  const webhookUrl = adapter?.fields?.webhookUrl;
+  if (!webhookUrl) return Promise.resolve([]);
+
+  const promises = newListings.map((p) => {
+    const body = JSON.stringify({
+      text: `${serviceName} ${jobKey}: ${p.title}`,
+      blocks: buildBlocks(serviceName, jobKey, p, baseUrl),
+      unfurl_links: false,
+      unfurl_media: false,
+    });
+    return postJson(webhookUrl, body);
+  });
+
+  return Promise.allSettled(promises);
+};
+
+export const config = {
+  id: 'slack_with_webhooks',
+  name: 'Slack with Webhooks',
+  readme: markdown2Html('lib/notification/adapter/slack_with_webhooks.md'),
+  description: 'Fredy will send new listings to the slack channel of your choice..',
+  fields: {
+    webhookUrl: {
+      type: 'text',
+      label: 'Webhook-Url',
+      description: 'The Url of the Webhook to send messages to.',
+    },
+  },
+};

lib/notification/adapter/slack_with_webhooks.md

@@ -0,0 +1,10 @@
+### Slack Adapter (Webhooks)
+
+*IMPORTANT:*
+This is the recommended Slack adapter. The old Slack adapter is unmaintained and kept only for backward compatibility.
+
+Setup:
+- Create a Slack account and workspace if you don't have one: https://slack.com
+- Create a channel where you want to receive notifications.
+- Add the Incoming Webhooks integration to that channel and copy the Webhook URL.
+- In Fredy, configure the Slack Webhook adapter with this URL.

lib/notification/adapter/smtp.js

@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import nodemailer from 'nodemailer';
+import path from 'path';
+import fs from 'fs';
+import Handlebars from 'handlebars';
+import { markdown2Html } from '../../services/markdown.js';
+import { getDirName, normalizeImageUrl } from '../../utils.js';
+
+const __dirname = getDirName();
+const template = fs.readFileSync(path.resolve(__dirname + '/notification/emailTemplate/template.hbs'), 'utf8');
+const emailTemplate = Handlebars.compile(template);
+
+const mapListings = (serviceName, jobKey, listings, baseUrl) =>
+  listings.map((l) => {
+    const image = normalizeImageUrl(l.image);
+    return {
+      title: l.title || '',
+      link: l.link || '',
+      address: l.address || '',
+      size: l.size || '',
+      price: l.price || '',
+      image,
+      hasImage: Boolean(image),
+      fredyUrl: baseUrl && l.id ? `${baseUrl}/#/listings/listing/${l.id}` : null,
+      serviceName,
+      jobKey,
+    };
+  });
+
+export const send = async ({ serviceName, newListings, notificationConfig, jobKey, baseUrl }) => {
+  const { host, port, secure, username, password, receiver, from } = notificationConfig.find(
+    (adapter) => adapter.id === config.id,
+  ).fields;
+
+  const to = receiver
+    .trim()
+    .split(',')
+    .map((r) => r.trim())
+    .filter(Boolean);
+
+  const transporter = nodemailer.createTransport({
+    host,
+    port: Number(port),
+    secure: secure === 'true',
+    auth: {
+      user: username,
+      pass: password,
+    },
+  });
+
+  const listings = mapListings(serviceName, jobKey, newListings, baseUrl);
+
+  const html = emailTemplate({
+    serviceName: `Job: (${jobKey}) | Service: ${serviceName}`,
+    numberOfListings: listings.length,
+    listings,
+  });
+
+  return transporter.sendMail({
+    from,
+    to: to.join(','),
+    subject: `Fredy found ${listings.length} new listing(s) for ${serviceName}`,
+    html,
+  });
+};
+
+export const config = {
+  id: 'smtp',
+  name: 'SMTP',
+  description: 'Send notifications via any SMTP server using Nodemailer.',
+  readme: markdown2Html('lib/notification/adapter/smtp.md'),
+  fields: {
+    host: {
+      type: 'text',
+      label: 'SMTP Host',
+      description: 'The hostname of the SMTP server (e.g., smtp.gmail.com).',
+    },
+    port: {
+      type: 'text',
+      label: 'SMTP Port',
+      description: 'The port of the SMTP server (e.g., 587 for STARTTLS, 465 for SSL).',
+    },
+    secure: {
+      type: 'text',
+      label: 'Secure (SSL/TLS)',
+      description: 'Set to "true" for port 465 (SSL). Leave empty or "false" for STARTTLS on port 587.',
+    },
+    username: {
+      type: 'text',
+      label: 'Username',
+      description: 'The username for SMTP authentication.',
+    },
+    password: {
+      type: 'text',
+      label: 'Password',
+      description: 'The password (or app password) for SMTP authentication.',
+    },
+    receiver: {
+      type: 'text',
+      label: 'Receiver Email(s)',
+      description: 'Comma-separated email addresses Fredy will send notifications to.',
+    },
+    from: {
+      type: 'email',
+      label: 'Sender Email',
+      description: 'The email address Fredy sends from.',
+    },
+  },
+};

lib/notification/adapter/smtp.md

@@ -0,0 +1,23 @@
+### SMTP Adapter
+
+Send notifications through any SMTP server using [Nodemailer](https://nodemailer.com/).
+This works with Gmail, Outlook, self-hosted mail servers, or any provider that supports SMTP.
+
+Setup:
+
+- Provide the SMTP host and port of your mail server.
+- For **SSL/TLS** (port 465), set Secure to `true`.
+- For **STARTTLS** (port 587), leave Secure empty or set it to `false`.
+- Enter the username and password for authentication. For Gmail, use an [App Password](https://support.google.com/accounts/answer/185833).
+- Set the sender email address (must be allowed by your SMTP server).
+
+Multiple recipients:
+
+- Separate email addresses with commas (e.g., `some@email.com`, `someOther@email.com`).
+
+Common SMTP settings:
+
+- **Gmail** - `smtp.gmail.com`, port 587, secure: false
+- **Outlook** - `smtp.office365.com`, port 587, secure: false
+- **Yahoo** - `smtp.mail.yahoo.com`, port 465, secure: true
+- **Gmx** - `mail.gmx.net`, port 587, secure: true

lib/notification/adapter/sqlite.js

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
+import { markdown2Html } from '../../services/markdown.js';
+import Database from 'better-sqlite3';
+import path from 'path';
+import fs from 'fs';
+
+export const send = ({ serviceName, newListings, jobKey, notificationConfig }) => {
+  const sqliteConfig = notificationConfig.find((adapter) => adapter.id === config.id);
+  const dbPath = sqliteConfig?.fields?.dbPath || 'db/listings.db';
+
+  const dbDir = path.dirname(dbPath);
+  if (!fs.existsSync(dbDir)) {
+    fs.mkdirSync(dbDir, { recursive: true });
+  }
+
+  const db = new Database(dbPath);
+  const fields = [
+    'serviceName',
+    'jobKey',
+    'id',
+    'size',
+    'rooms',
+    'price',
+    'address',
+    'title',
+    'link',
+    'description',
+    'image',
+  ];
+  db.prepare(`CREATE TABLE IF NOT EXISTS listing (${fields.join(' TEXT, ')} TEXT);`).run();
+  const insert = db.prepare(`INSERT INTO listing (${fields.join(', ')}) VALUES (@${fields.join(', @')})`);
+  newListings.map((listing) => {
+    let insertListing = {};
+    fields.map((field) => {
+      insertListing[field] = listing[field];
+    });
+    insertListing.serviceName = serviceName;
+    insertListing.jobKey = jobKey;
+    insert.run(insertListing);
+  });
+  return Promise.resolve();
+};
+export const config = {
+  id: 'sqlite',
+  name: 'SQLite',
+  description: 'This adapter stores listings in a local SQLite 3 database.',
+  fields: {
+    dbPath: {
+      type: 'text',
+      label: 'Database Path',
+      description:
+        'Path to the SQLite database file (e.g., db/listings.db). If not specified, defaults to db/listings.db',
+      placeholder: 'db/listings.db',
+    },
+  },
+  readme: markdown2Html('lib/notification/adapter/sqlite.md'),
+};

lib/notification/adapter/sqlite.md

@@ -0,0 +1,21 @@
+### SQLite Adapter
+
+This adapter stores search results in an SQLite database. By default, the database is located at `db/listings.db`, but you can configure a custom location. The file can be used for analysis later.
+
+The table contains the following columns (all stored as `TEXT`):
+
+```json
+[
+  "serviceName",
+  "jobKey",
+  "id",
+  "size",
+  "rooms",
+  "price",
+  "address",
+  "title",
+  "link",
+  "description",
+  "image"
+]
+```

lib/notification/adapter/telegram.js

@@ -1,63 +1,282 @@
+/*
+ * Copyright (c) 2026 by Christian Kellner.
+ * Licensed under Apache-2.0 with Commons Clause and Attribution/Naming Clause
+ */
+
 import { markdown2Html } from '../../services/markdown.js';
 import { getJob } from '../../services/storage/jobStorage.js';
 import fetch from 'node-fetch';
-const MAX_ENTITIES_PER_CHUNK = 8;
+import pThrottle from 'p-throttle';
-const RATE_LIMIT_INTERVAL = 1010;
+import { normalizeImageUrl } from '../../utils.js';
+import logger from '../../services/logger.js';
+import { shouldUseMultipart, buildPhotoFormData } from './telegramPhotoUploader.js';
+
+const RATE_LIMIT_INTERVAL = 1000;
+const THROTTLE_MAX_IDLE_MS = RATE_LIMIT_INTERVAL + 2000;
+const chatThrottleMap = new Map();
+
 /**
- * splitting an array into chunks because Telegram only allows for messages up to
+ * Removes stale throttled call entries to keep memory bounded.
- * 4096 chars, thus we have to split messages into chunks
+ * An entry is stale when no API call has fired for longer than THROTTLE_MAX_IDLE_MS.
- * @param inputArray
- * @param perChunk
  */
-const arrayChunks = (inputArray, perChunk) =>
+function cleanupOldThrottles() {
-  inputArray.reduce((all, one, i) => {
+  const now = Date.now();
-    const ch = Math.floor(i / perChunk);
+  for (const [chatId, chatThrottle] of chatThrottleMap.entries()) {
-    all[ch] = [].concat(all[ch] || [], one);
+    if (now - chatThrottle.lastUsedAt > THROTTLE_MAX_IDLE_MS) chatThrottleMap.delete(chatId);
-    return all;
+  }
-  }, []);
-function shorten(str, len = 30) {
-  return str.length > len ? str.substring(0, len) + '...' : str;
 }
-export const send = ({ serviceName, newListings, notificationConfig, jobKey }) => {
+
-  const { token, chatId } = notificationConfig.find((adapter) => adapter.id === config.id).fields;
+/**
-  const job = getJob(jobKey);
+ * Return a throttled wrapper for a chatId to limit Telegram API calls.
-  const jobName = job == null ? jobKey : job.name;
+ * Uses p-throttle with 1 request per RATE_LIMIT_INTERVAL per chat.
-  //we have to split messages into chunk, because otherwise messages are going to become too big and will fail
+ * `lastUsedAt` is refreshed on every actual API call so that the idle window
-  const chunks = arrayChunks(newListings, MAX_ENTITIES_PER_CHUNK);
+ * starts from the last fired call, not from when send() was invoked.
-  const promises = chunks.map((chunk) => {
+ *
-    let message = `<i>${jobName}</i> (${serviceName}) found <b>${newListings.length}</b> new listings:\n\n`;
+ * @param {string|number} chatId
-    message += chunk.map(
+ * @param {Function} call - async function (endpoint: string, body: any) => Promise<Response>
-      (o) =>
+ * @returns {Function}
-        `<a href='${o.link}'><b>${shorten(o.title.replace(/\*/g, ''), 45).trim()}</b></a>\n` +
+ */
-        [o.address, o.price, o.size].join(' | ') +
+function getThrottled(chatId, call) {
-        '\n\n',
+  cleanupOldThrottles();
-    );
+  const existing = chatThrottleMap.get(chatId);
-    /**
+  if (existing) {
-     * This is to not break the rate limit. It is to only send 1 message per second
+    existing.lastUsedAt = Date.now();
-     */
+    return existing.throttled;
-    return new Promise((resolve, reject) => {
+  }
-      setTimeout(() => {
+  const entry = { lastUsedAt: Date.now(), throttled: null };
-        fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
+  chatThrottleMap.set(chatId, entry);
-          method: 'post',
+  entry.throttled = pThrottle({ limit: 1, interval: RATE_LIMIT_INTERVAL })(async (endpoint, body) => {
-          body: JSON.stringify({
+    const e = chatThrottleMap.get(chatId);
-            chat_id: chatId,
+    if (e) e.lastUsedAt = Date.now();
-            text: message,
+    return call(endpoint, body);
-            parse_mode: 'HTML',
+  });
-            disable_web_page_preview: true,
+  return entry.throttled;
-          }),
+}
-          headers: { 'Content-Type': 'application/json' },
+
-        })
+/**
-          .then(() => {
+ * Shorten a string to a maximum length with an ellipsis suffix.
-            resolve();
+ * @param {string} str
-          })
+ * @param {number} [len=90]
-          .catch(() => {
+ * @returns {string}
-            reject();
+ */
-          });
+function shorten(str, len = 90) {
-      }, RATE_LIMIT_INTERVAL);
+  if (!str) return '';
+  return str.length > len ? str.substring(0, len).trim() + '...' : str;
+}
+
+/**
+ * Escape basic HTML entities for Telegram HTML parse mode.
+ * @param {string} [s='']
+ * @returns {string}
+ */
+function escapeHtml(s = '') {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+/**
+ * Build a Telegram HTML-formatted message body.
+ * Suitable for both sendMessage (uncapped) and sendPhoto captions (caller must slice to 1024).
+ *
+ * @param {string} jobName
+ * @param {string} serviceName
+ * @param {Object} o - Listing object
+ * @param {string} [baseUrl]
+ * @returns {string}
+ */
+function buildHtmlBody(jobName, serviceName, o, baseUrl) {
+  const title = shorten((o.title || '').replace(/\*/g, ''), 90);
+  const meta = [o.address, o.price, o.size].filter(Boolean).join(' | ');
+  const fredyLink =
+    baseUrl && o.id ? `\n<a href='${escapeHtml(`${baseUrl}/#/listings/listing/${o.id}`)}'>Open in Fredy</a>` : '';
+  return (
+    `<i>${escapeHtml(jobName)}</i> (${escapeHtml(serviceName)})\n` +
+    `<a href='${escapeHtml(o.link || '')}'><b>${escapeHtml(title)}</b></a>\n` +
+    `${escapeHtml(meta)}${fredyLink}`
+  );
+}
+
+/**
+ * Build a plain-text Telegram photo caption (max 4096 characters).
+ * Meta appears before the link so the most relevant info is visible within the cap.
+ *
+ * @param {string} jobName
+ * @param {string} serviceName
+ * @param {Object} o - Listing object
+ * @param {string} [baseUrl]
+ * @returns {string}
+ */
+function buildPlainCaption(jobName, serviceName, o, baseUrl) {
+  const title = shorten((o.title || '').replace(/\*/g, ''), 90);
+  const meta = [o.address, o.price, o.size].filter(Boolean).join(' | ');
+  const fredyLine = baseUrl && o.id ? `\nOpen in Fredy: ${baseUrl}/#/listings/listing/${o.id}` : '';
+  return `${jobName} (${serviceName})\n${title}\n${meta}\n\n${o.link || ''}${fredyLine}`.slice(0, 4096);
+}
+
+/**
+ * Build a plain-text Telegram message body.
+ * Link appears early so it is tappable without scrolling.
+ *
+ * @param {string} jobName
+ * @param {string} serviceName
+ * @param {Object} o - Listing object
+ * @param {string} [baseUrl]
+ * @returns {string}
+ */
+function buildPlainText(jobName, serviceName, o, baseUrl) {
+  const title = shorten((o.title || '').replace(/\*/g, ''), 90);
+  const meta = [o.address, o.price, o.size].filter(Boolean).join(' | ');
+  const fredyLine = baseUrl && o.id ? `\nOpen in Fredy: ${baseUrl}/#/listings/listing/${o.id}` : '';
+  return `${jobName} (${serviceName})\n${title}\n${o.link || ''}\n${meta}${fredyLine}`;
+}
+
+/**
+ * Create the raw Telegram API caller for a given bot token.
+ * Handles JSON and multipart (FormData) bodies.
+ *
+ * @param {string} token - Telegram bot token.
+ * @param {string} jobName - Used in error messages.
+ * @returns {(endpoint: string, body: object|FormData) => Promise<Response>}
+ */
+function makeTelegramCaller(token, jobName) {
+  return async function (endpoint, body) {
+    const isFormData = body instanceof FormData;
+    const opts = isFormData
+      ? { method: 'post', body }
+      : { method: 'post', body: JSON.stringify(body), headers: { 'Content-Type': 'application/json' } };
+    const res = await fetch(`https://api.telegram.org/bot${token}/${endpoint}`, opts);
+    if (!res.ok) {
+      const errorBody = await res.text();
+      throw new Error(`API error for '${jobName}'. '${endpoint}' returned ${errorBody}`);
+    }
+    return res;
+  };
+}
+
+/**
+ * Send a single listing to a single Telegram chat, with photo-then-text fallback.
+ *
+ * @param {Function} throttledCall - Throttled Telegram API caller for this chat.
+ * @param {Object} listing - Listing object.
+ * @param {string|number} chatId
+ * @param {Object} opts
+ * @param {string} opts.jobName
+ * @param {string} opts.serviceName
+ * @param {string} opts.baseUrl
+ * @param {boolean} opts.plainText
+ * @param {number|undefined} opts.message_thread_id
+ * @returns {Promise<void>}
+ */
+async function sendListingToChat(
+  throttledCall,
+  listing,
+  chatId,
+  { jobName, serviceName, baseUrl, plainText, message_thread_id },
+) {
+  const img = normalizeImageUrl(listing.image);
+
+  const textPayload = {
+    chat_id: chatId,
+    text: plainText
+      ? buildPlainText(jobName, serviceName, listing, baseUrl)
+      : buildHtmlBody(jobName, serviceName, listing, baseUrl),
+    ...(plainText ? {} : { parse_mode: 'HTML' }),
+    disable_web_page_preview: true,
+    ...(message_thread_id ? { message_thread_id } : {}),
+  };
+
+  if (!img) {
+    return throttledCall('sendMessage', textPayload).catch((e) => {
+      logger.error(`Error sending message to Telegram: ${e.message}`);
+    });
+  }
+
+  const caption = plainText
+    ? buildPlainCaption(jobName, serviceName, listing, baseUrl)
+    : buildHtmlBody(jobName, serviceName, listing, baseUrl).slice(0, 1024);
+  const parseMode = plainText ? undefined : 'HTML';
+
+  // .webp URLs (Immowelt/Cloudimage) fail Telegram's URL-based sendPhoto with
+  // "failed to get HTTP URL content". Upload the bytes via multipart instead.
+  const photoCall = shouldUseMultipart(img)
+    ? buildPhotoFormData({ chatId, imageUrl: img, caption, parseMode, messageThreadId: message_thread_id }).then((fd) =>
+        throttledCall('sendPhoto', fd),
+      )
+    : throttledCall('sendPhoto', {
+        chat_id: chatId,
+        photo: img,
+        caption,
+        ...(parseMode ? { parse_mode: parseMode } : {}),
+        ...(message_thread_id ? { message_thread_id } : {}),
+      });
+
+  return photoCall.catch(async (e) => {
+    logger.warn(`Error sending photo to Telegram and use a fallback: ${e.message}`);
+    return throttledCall('sendMessage', textPayload).catch((e) => {
+      logger.error(`Error sending message to Telegram: ${e.message}`);
+      throw e;
     });
   });
-  return Promise.all(promises);
+}
+
+/**
+ * Send new listings to Telegram.
+ * - Respects per-chat Telegram rate limits using a lightweight throttle cache.
+ * - Falls back to sendMessage when sendPhoto fails or image is missing.
+ *
+ * @param {Object} params
+ * @param {string} params.serviceName - Name of the crawler/service producing the listings.
+ * @param {Array<Object>} params.newListings - Array of new listing objects.
+ * @param {Array<Object>} params.notificationConfig - Notification adapters configuration array.
+ * @param {string} params.jobKey - Storage job key to resolve the human readable job name.
+ * @returns {Promise<Array<Response>>} Promise resolving when all send operations complete.
+ */
+export const send = ({ serviceName, newListings = [], notificationConfig, jobKey, baseUrl }) => {
+  const adapterCfg = notificationConfig.find((adapter) => adapter.id === config.id);
+  if (!adapterCfg || !adapterCfg.fields) {
+    throw new Error(`Telegram adapter configuration missing for job '${jobKey || ''}'`);
+  }
+  const { token, chatId, messageThreadId, plainText } = adapterCfg.fields;
+  if (!token || !chatId) {
+    throw new Error("Telegram 'token' and 'chatId' must be provided in notification config");
+  }
+
+  const chatIds = String(chatId)
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  // Optional Telegram topic/thread support (supergroups)
+  let message_thread_id;
+  if (messageThreadId !== undefined && messageThreadId !== null && `${messageThreadId}`.trim() !== '') {
+    const n = Number(messageThreadId);
+    if (Number.isInteger(n) && n > 0) {
+      message_thread_id = n;
+    } else {
+      logger.warn(
+        `Telegram adapter: 'messageThreadId' is invalid ('${messageThreadId}'). It must be a positive integer. Ignoring.`,
+      );
+    }
+  }
+
+  const job = getJob(jobKey);
+  const jobName = job == null ? jobKey : job.name;
+
+  if (!Array.isArray(newListings) || newListings.length === 0) return Promise.resolve([]);
+
+  const allPromises = chatIds.flatMap((id) => {
+    const caller = makeTelegramCaller(token, jobName);
+    const throttledCall = getThrottled(id, caller);
+    const opts = { jobName, serviceName, baseUrl, plainText, message_thread_id };
+    return newListings.map((listing) => sendListingToChat(throttledCall, listing, id, opts));
+  });
+
+  return Promise.all(allPromises);
 };
+
+/**
+ * Telegram notification adapter configuration schema.
+ * @type {{id:string,name:string,readme:string,description:string,fields:{token:{type:string,label:string,description:string},chatId:{type:string,label:string,description:string},messageThreadId?:{type:string,label:string,description:string}}}}
+ */
 export const config = {
   id: 'telegram',
   name: 'Telegram',
@@ -72,7 +291,21 @@ export const config = {
     chatId: {
       type: 'chatId',
       label: 'Chat Id',
-      description: 'The chat id to send messages to you.',
+      description:
+        'The chat ID to send messages to. Separate multiple IDs with commas to notify several recipients (e.g. 123456789, 987654321).',
+    },
+    messageThreadId: {
+      type: 'text',
+      optional: true,
+      label: 'Message Thread Id (optional)',
+      description:
+        'Optional: The topic/thread id within a supergroup to post into (Telegram message_thread_id). Provide a positive integer.',
+    },
+    plainText: {
+      type: 'boolean',
+      optional: true,
+      label: 'Send as plain text',
+      description: 'Send messages as plain text instead of HTML formatted.',
     },
   },
 };

lib/notification/adapter/telegram.md

@@ -1,13 +1,57 @@
 ### Telegram Adapter
 
+Use this adapter to send notifications to Telegram via a bot. You will need:
+- A Telegram Bot token (from BotFather)
+- A chat ID (where messages will be sent)
+- Optionally: a thread ID if you want to post into a specific forum topic in a group
 
-For Telegram, you need to create a Bot. This is pretty easy. Open [this](https://telegram.me/BotFather) url on your smartphone and follow the instructions.
+#### Create a bot
+Create a bot with BotFather: open https://telegram.me/BotFather on your phone or in Telegram Desktop and follow the instructions to get your bot token.
 
-A telegram bot is not allowed to send messages directly to a user, you as a user need to first contact the bot to get a chatId.        
+#### Getting the chat ID
-After the user has send a message to your bot the first time, you can gather the chatId like this:   
+A Telegram bot cannot message a user first; you must create a conversation (or add the bot to a group/channel) so Telegram assigns a chat the bot can access.
 
+Steps:
+1. Start a chat with your bot in Telegram (or add the bot to your group/supergroup/channel) and send any message.
+2. Fetch recent updates from the Bot API:
+   ```
+   curl -X GET "https://api.telegram.org/bot{YOUR_TELEGRAM_TOKEN}/getUpdates"
+   ```
+3. In the JSON response, find the message that you just sent and read `message.chat.id`. That value is your `chatId`.
+   - Private chats: `chat.id` is a positive number
+   - Groups/supergroups: `chat.id` is a negative number
+
+**Multiple recipients:** To notify several users individually, enter a comma-separated list of chat IDs in the Chat Id field, e.g. `123456789, 987654321`. Each recipient receives the same messages and gets its own independent rate-limit window. This avoids having to create a group and add the bot to it.
+
+Keep your bot token secret. If `getUpdates` returns an empty list, send a new message and try again, or make sure your bot’s privacy settings allow it to see group messages when used in groups.
+
+#### Getting the thread ID (this is optional to be used for forum topics)
+If you want messages to appear inside a specific forum topic of a supergroup with Topics enabled, you also need a thread ID. In the Telegram Bot API this is called `message_thread_id`.
+
+When you need it:
+- Required only for supergroups with Topics enabled when targeting a topic
+- Not used for private chats, basic groups without Topics, or channels
+
+Steps to obtain it:
+1. In your supergroup, enable Topics (Group settings → Manage group → Topics → Enable). Now add a new topic.
+2. Add your created bot to the topic. (Click on the bot and on "Add to group")
+3. Open the desired topic (or create a new one) and send any message inside that topic.
+4. Call `getUpdates` again:
+   ```
+   curl -X GET "https://api.telegram.org/bot{YOUR_TELEGRAM_TOKEN}/getUpdates"
+   ```
+4. In the update for the message you sent inside the topic, read `message.message_thread_id`. That number is your `threadId` for this topic.
+
+Example (truncated):
 ```
-curl -X GET https://api.telegram.org/bot{YOUR_TELEGRAM_TOKEN}/getUpdates  
+{
+  "message": {
+    "chat": { "id": -1001234567890, "type": "supergroup" },
+    "message_thread_id": 42,
+    "text": "hello from the topic"
+  }
+}
 ```
+Use `chat.id` as `chatId` and `message_thread_id` as `threadId` in your configuration.
 
-A more detailed list of instructions can be found here [https://core.telegram.org/bots#botfather](https://core.telegram.org/bots#botfather)
+More details about bots and BotFather: https://core.telegram.org/bots#botfather