@ranzenjs/client 0.3.0 → 0.4.0

package/README.md

@@ -7,8 +7,8 @@ does, keeps the session alive, and reads the portal's apps into plain, typed obj
 bun add @ranzenjs/client
 ```
 
-Runs on Bun and Node 22.1 or newer. It has three small dependencies (htmlparser2, domhandler,
-css-select) and no native code.
+Runs on Bun and Node 22.1 or newer. It has four small dependencies (htmlparser2, domhandler,
+css-select, and hash-wasm for Kurswahl Online) and no native code.
 
 ## Usage
 
@@ -81,6 +81,44 @@ that a session still works, so sign in again when one reports `SESSION_EXPIRED`.
 `maxConcurrency` (default 4) caps parallel requests per connection. Extra calls wait for a free
 slot, and a download frees its slot once the headers arrive.
 
+## Kurswahl Online
+
+Many schools run their course timetable on [Kurswahl Online](https://www.kurswahl-online.de/).
+Its client stands on its own: a school may use it, Schulportal, or both, and neither needs the
+other.
+
+```ts
+import { createKurswahl } from '@ranzenjs/client/kurswahl';
+
+const kurswahl = createKurswahl({ onDrift: (drift) => console.warn('ranzen drift', drift) });
+const schools = await kurswahl.schools(); // [{ id: 'musterschule', name: '…' }, …], no sign-in needed
+const connection = await kurswahl.login({
+	school: 'musterschule',
+	username: 'max.muster',
+	password
+});
+
+const plan = await connection.timetable(); // the general plan, A and B weeks included
+const week = await connection.timetable({ week: '2025-08-25' }); // one week, one rotation
+const rotation = await connection.currentRotation(); // 'A', 'B', or null; this week
+await connection.logout();
+```
+
+Kurswahl lists only the courses the student takes, so treat it as the source of truth for them.
+Each lesson names its course, ISO weekday, period, room and `rotation` (`'A'`, `'B'`, or `null`
+for every week). Teachers come with their short code, which Schulportal uses too, and their
+salutation. Sign-in hashes the password with Argon2 the way the login page does, which takes a few
+seconds of CPU. The week list can still show last school year's dates, so ask
+`currentRotation()` for this week's rotation rather than picking a week by date.
+
+`exportState()`, `restore()`, `keepAlive()`, `keepWarm()` and `dispose()` work as they do for
+Schulportal, with requests one at a time, since each page hands out the next CSRF token. Export
+once the connection is idle, and let one connection at a time use a session.
+
+To line both up, substitution days carry `rotation` next to their `week` label, and each
+substitution has `periodNumbers` (`"3 - 4"` → `[3, 4]`). Break duties such as `"2/3"` or `"MP"`
+have none.
+
 ## Errors
 
 ranzen throws a `RanzenError` with a `code` and a `fault`. The fault says who has to act:

package/dist/apps/substitutions/parse.js

@@ -46,10 +46,12 @@ export function parsePlan(document, drift = ignoreDrift) {
         const entries = rows(table).filter((row) => !isPlaceholder(row));
         const stamp = /(\d{2}\.\d{2}\.\d{4}) um ([01]\d|2[0-3]):([0-5]\d):([0-5]\d)/.exec(text(panel));
         const stampDay = stamp && isoDate(stamp[1]);
+        const week = text(one('.badge.woche', panel)) || null;
         return [
             {
                 date,
-                week: text(one('.badge.woche', panel)) || null,
+                week,
+                rotation: rotation(week, drift),
                 notices: parseNotices(panel),
                 substitutions: entries.map((row) => {
                     const columns = cells(row);
@@ -98,6 +100,7 @@ function substitution(values, date, marked, drift) {
     const entry = {
         date,
         periods: values.Stunde ?? '',
+        periodNumbers: periodNumbers(values.Stunde ?? '', drift),
         classes: null,
         previousClasses: null,
         substitute: null,
@@ -126,6 +129,27 @@ function substitution(values, date, marked, drift) {
     });
     return entry;
 }
+// "A-Woche" or "WA-Woche" → "A".
+function rotation(label, drift) {
+    if (!label)
+        return null;
+    const match = /^W?([AB])-?Woche$/i.exec(label);
+    if (!match)
+        drift('A plan day has an unknown week label.');
+    return match ? match[1].toUpperCase() : null;
+}
+// "3 - 4" → [3, 4]; break duties such as "2/3" (between periods 2 and 3) or "MP" (lunch) hold no lesson.
+function periodNumbers(label, drift) {
+    const range = /^(\d{1,2})\.?(?:\s*[-–]\s*(\d{1,2})\.?)?$/.exec(label.trim());
+    const first = Number(range?.[1]);
+    const last = Number(range?.[2] ?? range?.[1]);
+    if (range && last >= first)
+        return Array.from({ length: last - first + 1 }, (_, i) => first + i);
+    if (!/^(?:\d{1,2}\s*\/\s*\d{1,2}|MP)$/i.test(label.trim())) {
+        drift('A substitution has periods in an unknown format.');
+    }
+    return [];
+}
 // An empty day is one cell spanning the table, e.g. "Keine Einträge!".
 function isPlaceholder(row) {
     const [only, ...rest] = cells(row);

package/dist/apps/substitutions/types.d.ts

@@ -1,8 +1,15 @@
+import type { Rotation } from '../../rotation.js';
+export type { Rotation };
 export interface Substitution {
     /** ISO calendar date. */
     date: string;
-    /** As shown by the portal, e.g. "3 - 4". */
+    /** As shown by the portal, e.g. "3 - 4", "2/3" or "MP". */
     periods: string;
+    /**
+     * The lesson periods, e.g. [3, 4] for "3 - 4". Empty for break duties such as "2/3"
+     * (between periods 2 and 3) or "MP" (lunch break), and for labels ranzen cannot read.
+     */
+    periodNumbers: number[];
     classes: string | null;
     previousClasses: string | null;
     substitute: string | null;
@@ -27,8 +34,10 @@ export interface Notice {
 }
 export interface Day {
     date: string;
-    /** The school's week label, e.g. "A-Woche". */
+    /** The school's week label, e.g. "A-Woche" or "WA-Woche". */
     week: string | null;
+    /** The week label as A/B rotation; null without a label or for one ranzen cannot read. */
+    rotation: Rotation | null;
     notices: Notice[];
     substitutions: Substitution[];
     /** Local portal time, e.g. "2026-10-16T11:58:40". */

package/dist/kurswahl/connection.d.ts

@@ -0,0 +1,34 @@
+import type { Drift } from '../app.js';
+import type { SignalOption } from '../connection.js';
+import type { KurswahlAccount, KurswahlSession } from './session.js';
+import type { Rotation, Timetable } from './types.js';
+export interface TimetableOptions extends SignalOption {
+    /** First day of a week the portal offers, as ISO date, e.g. "2025-08-25"; omit for the general plan. */
+    week?: string;
+}
+/** One signed-in Kurswahl session. Save it with exportState(), end it with logout(). */
+export declare class KurswahlConnection {
+    #private;
+    constructor(session: KurswahlSession, onDrift?: (drift: Drift) => void);
+    get account(): KurswahlAccount;
+    /**
+     * The personal timetable. The general plan lists every lesson, both rotations included;
+     * a dated week shows only the lessons of that week's rotation.
+     */
+    timetable({ week, signal }?: TimetableOptions): Promise<Timetable>;
+    /**
+     * This week's rotation, read from the plan Kurswahl shows by default, which is the current week.
+     * Null when that week has no A/B lessons, e.g. for a student without alternating courses.
+     */
+    currentRotation({ signal }?: SignalOption): Promise<Rotation | null>;
+    /** Extends the session; throws SESSION_EXPIRED once Kurswahl has ended it. */
+    keepAlive({ signal }?: SignalOption): Promise<void>;
+    /** Pings Kurswahl on an interval, as its pages do; stops on dispose() or a lasting failure. */
+    keepWarm(intervalMs?: number): void;
+    /** Cookies, CSRF token and identity; never the password. Store it encrypted. */
+    exportState(): string;
+    /** Stops keepWarm() and cancels pending requests; the session stays valid for restore(). */
+    dispose(): void;
+    /** Leaves through the logout link, then disposes. */
+    logout({ signal }?: SignalOption): Promise<void>;
+}

package/dist/kurswahl/connection.js

@@ -0,0 +1,126 @@
+import { fail, isRanzenError, layoutChanged } from '../errors.js';
+import { positive } from '../util.js';
+import { parseHtml } from '../html.js';
+import { isGeneralPlan, parseTimetable, timetableDatabase } from './parse.js';
+import { writeKurswahlState } from './state.js';
+/** One signed-in Kurswahl session. Save it with exportState(), end it with logout(). */
+export class KurswahlConnection {
+    #session;
+    #onDrift;
+    #drifted = new Set();
+    #heartbeat;
+    #beating = false;
+    constructor(session, onDrift) {
+        this.#session = session;
+        this.#onDrift = onDrift;
+    }
+    get account() {
+        return this.#session.account;
+    }
+    /**
+     * The personal timetable. The general plan lists every lesson, both rotations included;
+     * a dated week shows only the lessons of that week's rotation.
+     */
+    async timetable({ week, signal } = {}) {
+        const value = week === undefined ? '0' : weekValue(week);
+        const session = this.#session;
+        // The timetable form names its database; the first visit learns it.
+        if (!session.database) {
+            const first = await session.page('stundenplan.php', {}, signal);
+            session.database = timetableDatabase(parseHtml(first.text));
+        }
+        const { text } = await session.page('stundenplan.php', { woche: value, db_name: session.database, show_optimierung: 'false' }, signal);
+        const timetable = parseTimetable(text, (detail) => this.#drift(detail));
+        session.database = timetable.database;
+        if (week !== undefined && timetable.week?.start !== week) {
+            throw fail('NOT_FOUND', 'Kurswahl Online does not offer this week.');
+        }
+        // A single week holds only one rotation, so passing it off as the general plan would lose lessons.
+        if (week === undefined && !isGeneralPlan(text))
+            throw layoutChanged('the general plan');
+        return timetable;
+    }
+    /**
+     * This week's rotation, read from the plan Kurswahl shows by default, which is the current week.
+     * Null when that week has no A/B lessons, e.g. for a student without alternating courses.
+     */
+    async currentRotation({ signal } = {}) {
+        const { text } = await this.#session.page('stundenplan.php', {}, signal);
+        const timetable = parseTimetable(text, (detail) => this.#drift(detail));
+        this.#session.database = timetable.database;
+        if (timetable.week || isGeneralPlan(text))
+            throw layoutChanged('the current week');
+        const rotations = new Set(timetable.lessons.map((lesson) => lesson.rotation));
+        rotations.delete(null);
+        if (rotations.size > 1)
+            throw layoutChanged('a single rotation in the current week');
+        return [...rotations][0] ?? null;
+    }
+    /** Extends the session; throws SESSION_EXPIRED once Kurswahl has ended it. */
+    async keepAlive({ signal } = {}) {
+        await this.#session.ajax('index.php', { ajax: 'keepalive' }, signal);
+    }
+    /** Pings Kurswahl on an interval, as its pages do; stops on dispose() or a lasting failure. */
+    keepWarm(intervalMs = 60_000) {
+        this.#session.ensureOpen();
+        positive(intervalMs, 'intervalMs');
+        clearInterval(this.#heartbeat);
+        this.#heartbeat = setInterval(() => {
+            if (this.#beating)
+                return;
+            this.#beating = true;
+            this.keepAlive()
+                .catch((error) => {
+                if (!isRanzenError(error) || !error.retryable)
+                    clearInterval(this.#heartbeat);
+            })
+                .finally(() => (this.#beating = false));
+        }, intervalMs);
+        this.#heartbeat.unref();
+    }
+    /** Cookies, CSRF token and identity; never the password. Store it encrypted. */
+    exportState() {
+        const session = this.#session;
+        session.ensureOpen();
+        return writeKurswahlState({
+            account: session.account,
+            token: session.token,
+            database: session.database,
+            cookies: session.transport.jar.snapshot()
+        });
+    }
+    /** Stops keepWarm() and cancels pending requests; the session stays valid for restore(). */
+    dispose() {
+        clearInterval(this.#heartbeat);
+        this.#heartbeat = undefined;
+        this.#session.dispose();
+    }
+    /** Leaves through the logout link, then disposes. */
+    async logout({ signal } = {}) {
+        try {
+            await this.#session.leave(signal);
+        }
+        finally {
+            this.dispose();
+        }
+    }
+    // Once per kind and connection, so a timetable read in a loop does not flood the hook.
+    #drift(detail) {
+        if (!this.#onDrift || this.#drifted.has(detail))
+            return;
+        this.#drifted.add(detail);
+        try {
+            this.#onDrift({ app: 'kurswahl', detail });
+        }
+        catch {
+            // A failing log hook must not fail a read that succeeded.
+        }
+    }
+}
+// "2025-08-25" → "25_08_2025", the portal's week value.
+function weekValue(week) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(week);
+    if (!match)
+        throw fail('INVALID_OPTION', 'week must be an ISO date such as "2025-08-25".');
+    return `${match[3]}_${match[2]}_${match[1]}`;
+}

package/dist/kurswahl/index.d.ts

@@ -0,0 +1,30 @@
+import type { Drift } from '../app.js';
+import type { SignalOption } from '../connection.js';
+import { type FetchFunction } from '../transport/http.js';
+import { KurswahlConnection } from './connection.js';
+import { type KurswahlCredentials } from './sign-in.js';
+import type { School } from './types.js';
+export { KurswahlConnection, type TimetableOptions } from './connection.js';
+export type { KurswahlAccount } from './session.js';
+export type { KurswahlCredentials } from './sign-in.js';
+export type * from './types.js';
+export interface KurswahlOptions {
+    /** Replaces the global fetch, e.g. for a proxy or tests. */
+    fetch?: FetchFunction;
+    /** Must look like a browser's, or Kurswahl Online refuses; defaults to a current Firefox. */
+    userAgent?: string;
+    /** Milliseconds per request, including the wait for each body chunk; defaults to 15000. */
+    timeoutMs?: number;
+    /** Called once per connection for each kind of drift; log it to learn that ranzen needs an update. */
+    onDrift?: (drift: Drift) => void;
+}
+export interface Kurswahl {
+    /** Every school on Kurswahl Online; no sign-in needed. */
+    schools(options?: SignalOption): Promise<School[]>;
+    /** Signs in like the login page does, Argon2 hashing included (about a second of CPU). */
+    login(credentials: KurswahlCredentials, options?: SignalOption): Promise<KurswahlConnection>;
+    /** Validates and rebuilds a connection from exportState() without any request. */
+    restore(state: string): KurswahlConnection;
+}
+/** A Kurswahl Online client, independent of any Schulportal connection; creating it makes no request. */
+export declare function createKurswahl(options?: KurswahlOptions): Kurswahl;

package/dist/kurswahl/index.js

@@ -0,0 +1,55 @@
+import { fail, layoutChanged } from '../errors.js';
+import { CookieJar } from '../transport/cookies.js';
+import { Transport } from '../transport/http.js';
+import { isRecord, parseJson, positive } from '../util.js';
+import { KurswahlConnection } from './connection.js';
+import { KurswahlSession, WWW } from './session.js';
+import { signIn } from './sign-in.js';
+import { isSchool, readKurswahlState } from './state.js';
+export { KurswahlConnection } from './connection.js';
+// Kurswahl Online sends any client it does not take for a browser to its main site.
+const BROWSER = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0';
+/** A Kurswahl Online client, independent of any Schulportal connection; creating it makes no request. */
+export function createKurswahl(options = {}) {
+    const base = {
+        fetch: options.fetch ?? ((url, init) => fetch(url, init)),
+        userAgent: options.userAgent ?? BROWSER,
+        timeoutMs: positive(options.timeoutMs ?? 15_000, 'timeoutMs'),
+        maxConcurrency: 1
+    };
+    // One host per transport, so a signed-in session never reaches the main site or another school.
+    const settings = (school) => ({
+        ...base,
+        hosts: new Set([school ? `${school}.kurswahl-online.de` : new URL(WWW).host])
+    });
+    return {
+        async schools({ signal } = {}) {
+            const reply = await new Transport(settings(null)).send({
+                url: `${WWW}/ajax.php`,
+                query: { type: 'schulen' },
+                signal
+            });
+            const data = parseJson(reply.text, 'the school list');
+            if (!isRecord(data) || Array.isArray(data))
+                throw layoutChanged('the school list as an object');
+            return Object.entries(data).flatMap(([id, name]) => isSchool(id) && typeof name === 'string' ? [{ id, name: name.trim() }] : []);
+        },
+        async login(credentials, { signal } = {}) {
+            for (const field of ['school', 'username', 'password']) {
+                if (typeof credentials[field] !== 'string' || !credentials[field]) {
+                    throw fail('INVALID_OPTION', `${field} must be a non-empty string.`);
+                }
+            }
+            if (!isSchool(credentials.school)) {
+                throw fail('INVALID_OPTION', 'school must be a Kurswahl subdomain such as "musterschule".');
+            }
+            const session = await signIn(new Transport(settings(credentials.school)), credentials, signal);
+            return new KurswahlConnection(session, options.onDrift);
+        },
+        restore(state) {
+            const { account, token, database, cookies } = readKurswahlState(state);
+            const transport = new Transport(settings(account.school), CookieJar.restore(cookies));
+            return new KurswahlConnection(new KurswahlSession(account, transport, token, database), options.onDrift);
+        }
+    };
+}

package/dist/kurswahl/parse.d.ts

@@ -0,0 +1,13 @@
+import { type Document } from '../html.js';
+import { type DriftSink } from '../util.js';
+import type { Timetable } from './types.js';
+/** The anti-CSRF token every Kurswahl page carries. */
+export declare function csrfToken(html: string): string | null;
+/** The timetable database the page's week form posts, e.g. "musterschule_stundenplan_1". */
+export declare function timetableDatabase(doc: Document): string;
+/** Kurswahl marks "allgemeiner Stundenplan" as selected only when it shows the general plan. */
+export declare function isGeneralPlan(html: string): boolean;
+/** Visible ASCII only, since the token travels in a header; shared with state validation. */
+export declare function isToken(value: string): boolean;
+export declare function isDatabase(value: string): boolean;
+export declare function parseTimetable(html: string, drift: DriftSink): Timetable;

package/dist/kurswahl/parse.js

@@ -0,0 +1,149 @@
+import { layoutChanged } from '../errors.js';
+import { all, attr, cells, hasClass, one, ownText, parseHtml, stripTags, text } from '../html.js';
+import { isoDate } from '../util.js';
+const DAYS = ['montag', 'dienstag', 'mittwoch', 'donnerstag', 'freitag', 'samstag', 'sonntag'];
+// "<b>Leiste 1: LK 1:  MATHEMATIK bei Muster, Frau<br>Raum: 101, Woche: A</b><br>Realkurs: 7"
+const TOOLTIP = /^<b>\s*Leiste\s+(\d+):\s*(.*?)(?:\s+bei\s+(.*?))?\s*<br\s*\/?>\s*Raum:\s*(.*?)(?:,\s*Woche:\s*([AB]))?\s*<\/b>\s*<br\s*\/?>\s*Realkurs:\s*(\d+)\s*$/is;
+// "2: LK 2:  PH-LK (Mu)" or "18: TUT (Bsp)".
+const LABEL = /^(\d+):\s*(?:LK\s*\d+:\s*)?(.+?)(?:\s*\(([^()]+)\))?$/;
+// "27.08.26  12:12:51"
+const STAMP = /(\d{2})\.(\d{2})\.(\d{2}|\d{4})\s+(\d{2}):(\d{2}):(\d{2})/g;
+/** The anti-CSRF token every Kurswahl page carries. */
+export function csrfToken(html) {
+    const token = attr(one('meta[name="anti_csrf_token"]', parseHtml(html)), 'content');
+    return token && isToken(token) ? token : null;
+}
+/** The timetable database the page's week form posts, e.g. "musterschule_stundenplan_1". */
+export function timetableDatabase(doc) {
+    const database = attr(one('input[name="db_name"]', doc), 'value');
+    if (!database || !isDatabase(database))
+        throw layoutChanged('the timetable database field');
+    return database;
+}
+/** Kurswahl marks "allgemeiner Stundenplan" as selected only when it shows the general plan. */
+export function isGeneralPlan(html) {
+    return all('select[name="woche"] option[selected]', parseHtml(html)).some((option) => attr(option, 'value') === '0');
+}
+/** Visible ASCII only, since the token travels in a header; shared with state validation. */
+export function isToken(value) {
+    return /^[\x21-\x7e]{1,512}$/.test(value);
+}
+export function isDatabase(value) {
+    return /^[\w-]{1,200}$/.test(value);
+}
+export function parseTimetable(html, drift) {
+    const doc = parseHtml(html);
+    const database = timetableDatabase(doc);
+    const table = one('table.stundenplan', doc);
+    if (!table)
+        throw layoutChanged('the timetable table');
+    const [head, ...body] = all('tr', table);
+    const days = all('th', head ?? table)
+        .slice(1)
+        .map((th) => DAYS.indexOf(text(th).toLowerCase()) + 1);
+    if (!days.length || !days.every(isWeekday))
+        throw layoutChanged('weekday headers in the timetable');
+    const periods = [];
+    const courses = new Map();
+    const lessons = [];
+    for (const row of body) {
+        const [first, ...slots] = cells(row);
+        const match = /^(\d+)\.\s*(?:(\d{1,2}:\d{2})\s*-\s*(\d{1,2}:\d{2}))?/.exec(text(first));
+        if (!match || slots.length !== days.length)
+            throw layoutChanged('timetable rows per period');
+        const period = Number(match[1]);
+        periods.push({ period, start: match[2] ?? null, end: match[3] ?? null });
+        slots.forEach((slot, index) => {
+            const entries = all('div[tooltip]', slot);
+            if (!entries.length && text(slot))
+                throw layoutChanged('course entries in timetable cells');
+            for (const entry of entries) {
+                const { course, room, rotation } = parseEntry(entry);
+                const known = courses.get(course.id);
+                if (!known)
+                    courses.set(course.id, course);
+                else if (JSON.stringify(known) !== JSON.stringify(course)) {
+                    drift('A course shows different details in different cells.');
+                }
+                lessons.push({ course: course.id, day: days[index], period, room, rotation });
+            }
+        });
+    }
+    const options = all('select[name="woche"] option', doc).map((option) => {
+        const value = attr(option, 'value') ?? '';
+        const week = parseWeek(value, text(option));
+        if (!week && value !== '0')
+            drift('A week option has an unknown format.');
+        return { value, week, selected: 'selected' in option.attribs };
+    });
+    // The general plan selects no option (or "0"); an unreadable dated week must not pass for it.
+    const chosen = options.find((option) => option.selected && option.value !== '0');
+    if (chosen && !chosen.week)
+        throw layoutChanged('the selected week');
+    return {
+        database,
+        week: chosen?.week ?? null,
+        weeks: options.flatMap((option) => (option.week ? [option.week] : [])),
+        periods,
+        courses: [...courses.values()],
+        lessons,
+        ...changeTimes(doc)
+    };
+}
+function parseEntry(entry) {
+    const tooltip = TOOLTIP.exec((attr(entry, 'tooltip') ?? '').trim());
+    const label = LABEL.exec(ownText(entry));
+    if (!tooltip || !label)
+        throw layoutChanged('a known course entry in the timetable');
+    const [, block = '', heading = '', teacher = '', room = '', week, id = ''] = tooltip;
+    const code = label[2] ?? '';
+    const level = /^(LK|GK)\b\s*(?:\d+:)?\s*(.*)$/.exec(stripTags(heading));
+    // The heading names the level; failing that, a "-LK"/"-GK" code or the cell's lk class does.
+    const kind = level?.[1] ?? /-(LK|GK)$/.exec(code)?.[1] ?? (hasClass(entry, 'lk') ? 'LK' : null);
+    const person = /^(.*?)(?:,\s*(Frau|Herr))?$/.exec(stripTags(teacher));
+    const shown = text(one('span', entry));
+    return {
+        course: {
+            id,
+            block: Number(block),
+            code,
+            title: (level ? level[2] : stripTags(heading)) || null,
+            level: kind,
+            teacher: {
+                code: label[3]?.trim() || null,
+                lastName: person?.[1] || null,
+                salutation: person?.[2] ?? null
+            }
+        },
+        room: stripTags(room) || shown.replace(/\[[AB]\]/, '').trim() || null,
+        rotation: (week ?? /\[([AB])\]/.exec(shown)?.[1] ?? null)
+    };
+}
+function isWeekday(day) {
+    return day >= 1 && day <= 7;
+}
+function parseWeek(value, label) {
+    const [start, end] = label.split(/\s+-\s+/).map((part) => isoDate(part));
+    return /^\d{2}_\d{2}_\d{4}$/.test(value) && start && end ? { id: value, start, end } : null;
+}
+// "Letzte Änderung Stundenplan (Kurszuteilung): 27.08.26 12:12:51 (25.08.26 09:02:04)"
+function changeTimes(doc) {
+    let updatedAt = null;
+    let assignedAt = null;
+    let examsUpdatedAt = null;
+    for (const row of all('tr', doc)) {
+        const [label = '', value = ''] = cells(row).map((cell) => text(cell));
+        if (!label.startsWith('Letzte Änderung'))
+            continue;
+        const [first = null, second = null] = [...value.matchAll(STAMP)].map(localTime);
+        if (label.includes('Klausurplan'))
+            examsUpdatedAt = first;
+        else if (label.includes('Stundenplan'))
+            [updatedAt, assignedAt] = [first, second];
+    }
+    return { updatedAt, assignedAt, examsUpdatedAt };
+}
+function localTime([, day, month, year = '', hours, minutes, seconds]) {
+    const date = isoDate(`${day}.${month}.${year.length === 2 ? `20${year}` : year}`);
+    return date && `${date}T${hours}:${minutes}:${seconds}`;
+}

package/dist/kurswahl/session.d.ts

@@ -0,0 +1,29 @@
+import type { Reply, Transport } from '../transport/http.js';
+export interface KurswahlAccount {
+    /** The school's subdomain, e.g. "musterschule". */
+    readonly school: string;
+    readonly username: string;
+}
+export declare const WWW = "https://www.kurswahl-online.de";
+export declare function schoolUrl(school: string): string;
+export declare class KurswahlSession {
+    #private;
+    readonly account: KurswahlAccount;
+    readonly transport: Transport;
+    token: string | null;
+    database: string | null;
+    constructor(account: KurswahlAccount, transport: Transport, token: string | null, database?: string | null);
+    get disposed(): boolean;
+    ensureOpen(): void;
+    dispose(): void;
+    /** A page the way post_link() opens it: a multipart POST carrying the current token. */
+    page(path: string, fields: Record<string, string>, signal?: AbortSignal): Promise<Reply>;
+    /** An XHR call; the token travels as a header, and a new one may come back the same way. */
+    ajax(path: string, form: Record<string, string>, signal?: AbortSignal): Promise<Reply>;
+    /** Leaves through the logout link, after any request still running. */
+    leave(signal?: AbortSignal): Promise<void>;
+}
+/** A token handed back in the XHR header, kept only if exported state would accept it. */
+export declare function nextToken(reply: Reply, current: string | null): string | null;
+/** The sign-in form, which Kurswahl serves in place of any page once the session is gone. */
+export declare function isLoginPage(html: string): boolean;

package/dist/kurswahl/session.js

@@ -0,0 +1,125 @@
+import { ensureOk } from '../app.js';
+import { fail, isRanzenError, layoutChanged } from '../errors.js';
+import { Limiter } from '../transport/limiter.js';
+import { csrfToken, isToken } from './parse.js';
+export const WWW = 'https://www.kurswahl-online.de';
+export function schoolUrl(school) {
+    return `https://${school}.kurswahl-online.de`;
+}
+// Package-internal: one request at a time, since every reply hands out the next CSRF token.
+export class KurswahlSession {
+    account;
+    transport;
+    token;
+    database;
+    #life = new AbortController();
+    #queue = new Limiter(1);
+    constructor(account, transport, token, database = null) {
+        this.account = account;
+        this.transport = transport;
+        this.token = token;
+        this.database = database;
+    }
+    get disposed() {
+        return this.#life.signal.aborted;
+    }
+    ensureOpen() {
+        if (this.disposed)
+            throw fail('DISPOSED', 'The connection was disposed.');
+    }
+    dispose() {
+        this.#life.abort();
+        this.transport.jar.clear();
+    }
+    /** A page the way post_link() opens it: a multipart POST carrying the current token. */
+    page(path, fields, signal) {
+        return this.#run(signal, async (bound) => {
+            const form = new FormData();
+            for (const [name, value] of Object.entries(fields))
+                form.set(name, value);
+            form.set('_scrollLeft', '0');
+            form.set('_scrollTop', '0');
+            form.set('_scrollLocation', `/${path}`);
+            if (this.token)
+                form.set('_anti_csrf_token', this.token);
+            const reply = await this.transport.send({
+                url: `${schoolUrl(this.account.school)}/${path}`,
+                method: 'POST',
+                multipart: form,
+                redirects: 'manual',
+                signal: bound
+            });
+            this.#check(reply, path);
+            // Every page hands out the token for the next request; going on with a stale one would fail later.
+            const token = csrfToken(reply.text);
+            if (!token)
+                throw layoutChanged('an anti-CSRF token on the page');
+            this.token = token;
+            return reply;
+        });
+    }
+    /** An XHR call; the token travels as a header, and a new one may come back the same way. */
+    ajax(path, form, signal) {
+        return this.#run(signal, async (bound) => {
+            const headers = { 'x-requested-with': 'XMLHttpRequest' };
+            if (this.token)
+                headers['x-csrf-token'] = this.token;
+            const reply = await this.transport.send({
+                url: `${schoolUrl(this.account.school)}/${path}`,
+                method: 'POST',
+                form,
+                headers,
+                redirects: 'manual',
+                signal: bound
+            });
+            this.#check(reply, path);
+            this.token = nextToken(reply, this.token);
+            return reply;
+        });
+    }
+    /** Leaves through the logout link, after any request still running. */
+    leave(signal) {
+        return this.#run(signal, async (bound) => {
+            const url = `${schoolUrl(this.account.school)}/login.php`;
+            const reply = await this.transport.send({ url, redirects: 'manual', signal: bound });
+            // A refused logout may leave the session alive, so it must not pass for success.
+            if (!reply.location)
+                ensureOk(reply.status, 'login.php');
+        });
+    }
+    // Kurswahl flags an ended session with X-LOGIN-FORM on XHR and a redirect to login.php on pages.
+    #check(reply, path) {
+        const toLogin = reply.location && /\/login\.php$|^\/?$/.test(reply.location.pathname);
+        if (reply.headers.get('x-login-form') === 'true' || toLogin || isLoginPage(reply.text)) {
+            throw fail('SESSION_EXPIRED', 'The Kurswahl session has ended.');
+        }
+        if (reply.location)
+            throw layoutChanged(`${path} to answer without a redirect`);
+        ensureOk(reply.status, path);
+    }
+    async #run(signal, work) {
+        this.ensureOpen();
+        const life = this.#life.signal;
+        const bound = signal ? AbortSignal.any([signal, life]) : life;
+        try {
+            return await this.#queue.run(() => work(bound), bound);
+        }
+        catch (error) {
+            if (isRanzenError(error) || !bound.aborted)
+                throw error;
+            throw fail('ABORTED', 'Request aborted.', error);
+        }
+        finally {
+            this.ensureOpen();
+        }
+    }
+}
+/** A token handed back in the XHR header, kept only if exported state would accept it. */
+export function nextToken(reply, current) {
+    const token = reply.headers.get('x-csrf-token');
+    return token && isToken(token) ? token : current;
+}
+/** The sign-in form, which Kurswahl serves in place of any page once the session is gone. */
+export function isLoginPage(html) {
+    return /<input\b[^>]*\bname\s*=\s*["']?realpasswort\b/i.test(html);
+}

package/dist/kurswahl/sign-in.d.ts

@@ -0,0 +1,19 @@
+import type { Transport } from '../transport/http.js';
+import { KurswahlSession } from './session.js';
+export interface KurswahlCredentials {
+    /** The school's subdomain, e.g. "musterschule"; see schools(). */
+    school: string;
+    username: string;
+    password: string;
+}
+interface Argon2Parameters {
+    type: 1 | 2;
+    time: number;
+    mem: number;
+    parallelism: number;
+    hashLen: number;
+}
+/** Signs in like the login page's script does, hashing the password with Argon2 on this side. */
+export declare function signIn(transport: Transport, { school, username, password }: KurswahlCredentials, signal: AbortSignal | undefined): Promise<KurswahlSession>;
+export declare function argon2(password: string, salt: string, parameters: Argon2Parameters | null | undefined): Promise<string>;
+export {};

package/dist/kurswahl/sign-in.js

@@ -0,0 +1,134 @@
+import { argon2i, argon2id } from 'hash-wasm';
+import { fail, layoutChanged } from '../errors.js';
+import { isRecord, parseJson } from '../util.js';
+import { csrfToken } from './parse.js';
+import { isLoginPage, KurswahlSession, nextToken, schoolUrl } from './session.js';
+/** Signs in like the login page's script does, hashing the password with Argon2 on this side. */
+export async function signIn(transport, { school, username, password }, signal) {
+    const base = schoolUrl(school);
+    const login = await transport.send({ url: `${base}/login.php`, redirects: 'manual', signal });
+    // An unknown subdomain bounces to the main site.
+    if (login.location)
+        throw fail('NOT_FOUND', 'Kurswahl Online does not know this school.');
+    const versions = argon2Parameters(login.text);
+    let token = csrfToken(login.text);
+    // The login page's XHR carries the token as a header and may get the next one back.
+    const headers = { 'x-requested-with': 'XMLHttpRequest' };
+    if (token)
+        headers['x-csrf-token'] = token;
+    const answer = await transport.send({
+        url: `${base}/login.php`,
+        method: 'POST',
+        form: { ajax: 'argon2', username },
+        headers,
+        redirects: 'manual',
+        signal
+    });
+    token = nextToken(answer, token);
+    const { salts, rotating } = readSalts(parseJson(answer.text, 'the Argon2 salts'));
+    const latest = versions.length - 1;
+    const hash = (salt, version) => argon2(password, salt, versions[version]);
+    const hashes = await Promise.all(salts.map(async ({ version, raw, salt, upgradeSalt }) => {
+        const entry = {
+            version: raw,
+            hash: version === 0 ? password : await hash(salt, version),
+            rotating: false
+        };
+        if (upgradeSalt)
+            entry.upgrade_hash = await hash(upgradeSalt, latest);
+        return entry;
+    }));
+    if (rotating) {
+        hashes.push({
+            version: latest,
+            hash: await hash(rotating, latest),
+            upgrade_hash: null,
+            rotating: true
+        });
+    }
+    const form = new FormData();
+    form.set('username', username);
+    form.set('passwort', '');
+    form.set('keep_active', 'on');
+    form.set('resolution', '1920x1080');
+    form.set('realpasswort', JSON.stringify(hashes));
+    form.set('_scrollLeft', '0');
+    form.set('_scrollTop', '0');
+    form.set('_scrollLocation', '/login.php');
+    if (token)
+        form.set('_anti_csrf_token', token);
+    const result = await transport.send({
+        url: `${base}/login.php`,
+        method: 'POST',
+        multipart: form,
+        redirects: 'manual',
+        signal
+    });
+    if (isLoginPage(result.text))
+        throw fail('AUTH_FAILED', 'Kurswahl Online rejected the login.');
+    // The answer is an interstitial whose script continues with post_link("index.php").
+    if (result.status !== 200 || !/post_link\(\s*["']index\.php["']/.test(result.text)) {
+        throw layoutChanged('the page that follows a Kurswahl login');
+    }
+    const account = { school, username };
+    const session = new KurswahlSession(account, transport, csrfToken(result.text) ?? token);
+    await session.page('index.php', {}, signal);
+    return session;
+}
+// kwo.settings("argon2_client_parameters", ["dummy for old schema", {type, time, mem, ...}, ...])
+function argon2Parameters(html) {
+    const json = /kwo\.settings\(\s*"argon2_client_parameters"\s*,\s*(\[.*?\])\s*\)\s*;/s.exec(html)?.[1];
+    const list = json === undefined ? null : parseJson(json, 'the Argon2 parameters');
+    if (!Array.isArray(list) || list.length < 2)
+        throw layoutChanged('the Argon2 parameters');
+    return list.map((entry) => (isParameters(entry) ? entry : null));
+}
+// Far above today's cost (time 14, 56 MiB), so a broken page cannot exhaust the host.
+const LIMITS = { time: 100, mem: 512 * 1024, parallelism: 16, hashLen: 256 };
+function isParameters(value) {
+    if (!isRecord(value) || (value.type !== 1 && value.type !== 2))
+        return false;
+    return ['time', 'mem', 'parallelism', 'hashLen'].every((key) => {
+        const number = value[key];
+        return Number.isSafeInteger(number) && Number(number) > 0 && Number(number) <= LIMITS[key];
+    });
+}
+function readSalts(data) {
+    if (!isRecord(data) || !Array.isArray(data.salts) || !data.salts.length) {
+        throw layoutChanged('Argon2 salts for the login');
+    }
+    const salts = data.salts.map((entry) => {
+        const version = isRecord(entry) ? Number(entry.version) : NaN;
+        if (!isRecord(entry) || !Number.isSafeInteger(version) || version < 0) {
+            throw layoutChanged('Argon2 salts for the login');
+        }
+        const salt = typeof entry.salt === 'string' ? entry.salt : '';
+        if (version !== 0 && !salt)
+            throw layoutChanged('Argon2 salts for the login');
+        return {
+            version,
+            raw: entry.version,
+            salt,
+            upgradeSalt: typeof entry.upgrade_salt === 'string' ? entry.upgrade_salt : null
+        };
+    });
+    return { salts, rotating: typeof data.rotating_salt === 'string' ? data.rotating_salt : null };
+}
+// The browser worker passes UTF-8 bytes but the JS string length, so longer UTF-8 input is cut short.
+export function argon2(password, salt, parameters) {
+    if (!parameters)
+        throw layoutChanged('Argon2 parameters for every salt version');
+    const bytes = (value) => new TextEncoder().encode(value).slice(0, value.length);
+    return (parameters.type === 2 ? argon2id : argon2i)({
+        password: bytes(password),
+        salt: bytes(salt),
+        iterations: parameters.time,
+        memorySize: parameters.mem,
+        parallelism: parameters.parallelism,
+        hashLength: parameters.hashLen,
+        outputType: 'hex'
+    }).catch((error) => {
+        // hash-wasm refuses combinations such as too little memory per lane or a short salt.
+        throw layoutChanged('usable Argon2 parameters and salts', error);
+    });
+}

package/dist/kurswahl/state.d.ts

@@ -0,0 +1,12 @@
+import type { StoredCookie } from '../transport/cookies.js';
+import type { KurswahlAccount } from './session.js';
+export interface KurswahlState {
+    account: KurswahlAccount;
+    token: string | null;
+    database: string | null;
+    cookies: StoredCookie[];
+}
+export declare function writeKurswahlState({ account, token, database, cookies }: KurswahlState): string;
+export declare function readKurswahlState(text: string): KurswahlState;
+/** A Kurswahl subdomain, so a school key can never point a request at another host. */
+export declare function isSchool(value: string): boolean;

package/dist/kurswahl/state.js

@@ -0,0 +1,43 @@
+import { fail } from '../errors.js';
+import { copyCookie, isCookie } from '../state.js';
+import { isRecord } from '../util.js';
+import { isDatabase, isToken } from './parse.js';
+const FORMAT = 'ranzen/kurswahl@1';
+export function writeKurswahlState({ account, token, database, cookies }) {
+    const { school, username } = account;
+    return JSON.stringify({ format: FORMAT, school, username, token, database, cookies });
+}
+export function readKurswahlState(text) {
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw fail('INVALID_STATE', 'Connection state is not valid JSON.');
+    }
+    if (!isRecord(data) || data.format !== FORMAT) {
+        throw fail('INVALID_STATE', 'Connection state has an unknown format.');
+    }
+    const { school, username, token, database, cookies } = data;
+    if (typeof school !== 'string' || !isSchool(school)) {
+        throw fail('INVALID_STATE', 'Connection state has an invalid school.');
+    }
+    if (typeof username !== 'string' || !username) {
+        throw fail('INVALID_STATE', 'Connection state has an invalid username.');
+    }
+    if (!isNullOr(token, isToken) || !isNullOr(database, isDatabase)) {
+        throw fail('INVALID_STATE', 'Connection state has an invalid token or database.');
+    }
+    if (!Array.isArray(cookies) || !cookies.every(isCookie)) {
+        throw fail('INVALID_STATE', 'Connection state has invalid cookies.');
+    }
+    return { account: { school, username }, token, database, cookies: cookies.map(copyCookie) };
+}
+/** A Kurswahl subdomain, so a school key can never point a request at another host. */
+export function isSchool(value) {
+    return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(value) && value !== 'www';
+}
+// The same checks the parser applies, so every exported state restores.
+function isNullOr(value, valid) {
+    return value === null || (typeof value === 'string' && valid(value));
+}

package/dist/kurswahl/types.d.ts

@@ -0,0 +1,68 @@
+import type { Rotation } from '../rotation.js';
+export type { Rotation };
+/** ISO weekday, 1 = Monday. */
+export type Weekday = 1 | 2 | 3 | 4 | 5 | 6 | 7;
+export interface School {
+    /** The subdomain, e.g. "musterschule" for musterschule.kurswahl-online.de. */
+    id: string;
+    name: string;
+}
+export interface KurswahlTeacher {
+    /** The school's short code, the same one SPH uses, e.g. "Mu". */
+    code: string | null;
+    /** As written, e.g. "McLeod"; named like the SPH teacher field. */
+    lastName: string | null;
+    salutation: 'Frau' | 'Herr' | null;
+}
+export interface KurswahlCourse {
+    /** Kurswahl's "Realkurs" number; unrelated to SPH course ids. */
+    id: string;
+    /** The "Leiste" the course runs in. */
+    block: number | null;
+    /** The short name shown in the timetable, e.g. "M-LK" or "TUT". */
+    code: string;
+    /** The long name as written, e.g. "MATHEMATIK" or "Politik&Wirtschaft". */
+    title: string | null;
+    level: 'LK' | 'GK' | null;
+    teacher: KurswahlTeacher;
+}
+export interface KurswahlLesson {
+    /** A KurswahlCourse id. */
+    course: string;
+    day: Weekday;
+    /** The period number, as SPH counts them. */
+    period: number;
+    room: string | null;
+    /** Null when the lesson takes place every week. */
+    rotation: Rotation | null;
+}
+export interface PeriodTime {
+    period: number;
+    /** Local time, e.g. "08:00". */
+    start: string | null;
+    end: string | null;
+}
+export interface Week {
+    /** The portal's value, e.g. "25_08_2025". */
+    id: string;
+    /** ISO calendar dates. */
+    start: string;
+    end: string;
+}
+export interface Timetable {
+    /** The timetable database, e.g. "musterschule_stundenplan_1". */
+    database: string;
+    /** The week shown; null for the general plan. */
+    week: Week | null;
+    /** Weeks the portal offers; schools sometimes leave last year's dates here, so prefer rotation. */
+    weeks: Week[];
+    periods: PeriodTime[];
+    courses: KurswahlCourse[];
+    lessons: KurswahlLesson[];
+    /** Local portal time of the last timetable change, e.g. "2026-08-27T12:12:51". */
+    updatedAt: string | null;
+    /** Local portal time of the last course assignment change. */
+    assignedAt: string | null;
+    /** Local portal time of the last exam plan change. */
+    examsUpdatedAt: string | null;
+}

package/dist/kurswahl/types.js

@@ -0,0 +1 @@
+export {};

package/dist/rotation.d.ts

@@ -0,0 +1,2 @@
+/** The A/B week; Schulportal labels it "A-Woche" or "WA-Woche", Kurswahl Online "Woche: A". */
+export type Rotation = 'A' | 'B';

package/dist/rotation.js

@@ -0,0 +1 @@
+export {};

package/dist/state.d.ts

@@ -7,3 +7,5 @@ export interface ConnectionState {
 }
 export declare function writeState({ account, secret, cookies }: ConnectionState): string;
 export declare function readState(text: string): ConnectionState;
+export declare function copyCookie({ name, value, domain, hostOnly, path, secure, expires }: StoredCookie): StoredCookie;
+export declare function isCookie(value: unknown): value is StoredCookie;

package/dist/state.js

@@ -38,15 +38,19 @@ export function readState(text) {
     return {
         account: { schoolId, username },
         secret: key,
-        cookies: cookies.map(({ name, value, domain, hostOnly, path, secure, expires }) => expires === undefined
-            ? { name, value, domain, hostOnly, path, secure }
-            : { name, value, domain, hostOnly, path, secure, expires })
+        cookies: cookies.map(copyCookie)
     };
 }
+// Only the known fields, so stray keys in stored state never reach the jar.
+export function copyCookie({ name, value, domain, hostOnly, path, secure, expires }) {
+    return expires === undefined
+        ? { name, value, domain, hostOnly, path, secure }
+        : { name, value, domain, hostOnly, path, secure, expires };
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-function isCookie(value) {
+export function isCookie(value) {
     return (isRecord(value) &&
         typeof value.name === 'string' &&
         typeof value.value === 'string' &&

package/dist/transport/cookies.js

@@ -25,6 +25,7 @@ export class CookieJar {
             secure: false
         };
         let maxAge;
+        let pathSet = false;
         for (const attribute of attributes) {
             const index = attribute.indexOf('=');
             const key = (index < 0 ? attribute : attribute.slice(0, index)).trim().toLowerCase();
@@ -36,8 +37,10 @@ export class CookieJar {
                 cookie.domain = domain;
                 cookie.hostOnly = false;
             }
-            else if (key === 'path' && value.startsWith('/'))
+            else if (key === 'path' && value.startsWith('/')) {
                 cookie.path = value;
+                pathSet = true;
+            }
             else if (key === 'secure')
                 cookie.secure = true;
             else if (key === 'max-age' && /^-?\d+$/.test(value))
@@ -50,6 +53,8 @@ export class CookieJar {
         }
         if (maxAge !== undefined)
             cookie.expires = this.now() + maxAge * 1000;
+        if (!prefixAllows(cookie, url, pathSet))
+            return;
         const key = `${cookie.domain};${cookie.path};${cookie.name}`;
         if (cookie.expires !== undefined && cookie.expires <= this.now())
             this.cookies.delete(key);
@@ -90,6 +95,15 @@ export class CookieJar {
             .sort((a, b) => b.path.length - a.path.length);
     }
 }
+// RFC 6265bis §4.1.3: __Secure- needs Secure over https; __Host- also needs no Domain and an explicit Path=/.
+function prefixAllows(cookie, url, pathSet) {
+    const name = cookie.name.toLowerCase();
+    const secure = cookie.secure && url.protocol === 'https:';
+    if (name.startsWith('__host-')) {
+        return secure && cookie.hostOnly && pathSet && cookie.path === '/';
+    }
+    return !name.startsWith('__secure-') || secure;
+}
 function domainMatches(host, domain) {
     return host === domain || host.endsWith(`.${domain}`);
 }

package/dist/transport/http.d.ts

@@ -6,6 +6,8 @@ export interface TransportSettings {
     userAgent: string;
     timeoutMs: number;
     maxConcurrency: number;
+    /** Hosts requests may reach over https; defaults to Schulportal's. */
+    hosts?: ReadonlySet<string>;
 }
 export interface Exchange {
     url: string | URL;
@@ -29,6 +31,7 @@ export interface Reply extends Head {
 export interface StreamReply extends Head {
     body: ReadableStream<Uint8Array>;
 }
+export declare const PORTAL_HOSTS: ReadonlySet<string>;
 export declare class Transport {
     private readonly settings;
     readonly jar: CookieJar;

package/dist/transport/http.js

@@ -2,7 +2,7 @@ import { RanzenError, fail, layoutChanged } from '../errors.js';
 import { CookieJar } from './cookies.js';
 import { Limiter } from './limiter.js';
 // The hosts sign-in and apps use; any other host, subdomain or port is a portal change.
-const PORTAL_HOSTS = new Set(['start', 'login', 'connect'].map((name) => `${name}.schulportal.hessen.de`));
+export const PORTAL_HOSTS = new Set(['start', 'login', 'connect'].map((name) => `${name}.schulportal.hessen.de`));
 const MAX_REDIRECTS = 10;
 export class Transport {
     settings;
@@ -113,7 +113,7 @@ export class Transport {
         let method = exchange.method ?? 'GET';
         let body = exchange.multipart ?? (exchange.form && new URLSearchParams(exchange.form).toString());
         for (let hop = 0;; hop++) {
-            if (url.protocol !== 'https:' || !PORTAL_HOSTS.has(url.host)) {
+            if (url.protocol !== 'https:' || !(this.settings.hosts ?? PORTAL_HOSTS).has(url.host)) {
                 throw layoutChanged('a portal address');
             }
             const headers = new Headers(exchange.headers);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ranzenjs/client",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "Typed client for Schulportal Hessen (SPH, LANIS)",
 	"license": "MIT",
 	"author": "Suko",
@@ -42,6 +42,10 @@
 			"types": "./dist/apps/catalog/index.d.ts",
 			"default": "./dist/apps/catalog/index.js"
 		},
+		"./kurswahl": {
+			"types": "./dist/kurswahl/index.d.ts",
+			"default": "./dist/kurswahl/index.js"
+		},
 		"./html": {
 			"types": "./dist/html.d.ts",
 			"default": "./dist/html.js"
@@ -66,6 +70,7 @@
 	"dependencies": {
 		"css-select": "^7.0.0",
 		"domhandler": "^6.0.1",
+		"hash-wasm": "^4.12.0",
 		"htmlparser2": "^12.0.0"
 	},
 	"devDependencies": {