// Simple replacement server using the same functionality as the previous chat server
// This file is a fresh, cleanized version that includes robust model discovery

const http = require('http');
const fs = require('fs/promises');
const fsSync = require('fs');
const path = require('path');
const os = require('os');
const { spawn } = require('child_process');
const { randomUUID, randomBytes } = require('crypto');
const archiver = require('archiver');
const AdmZip = require('adm-zip');
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');
const nodemailer = require('nodemailer');
const PDFDocument = require('pdfkit');

let sharp = null;
try {
  // Optional dependency (native). If missing, server will store originals.
  sharp = require('sharp');
} catch (_) {
  sharp = null;
}

const KIB = 1024;
const MIB = KIB * 1024;
const GIB = MIB * 1024;
const TIB = GIB * 1024;

function parseMemoryValue(raw) {
  if (raw === undefined || raw === null) return 0;
  const str = String(raw).trim();
  const match = str.match(/^([0-9.]+)\s*([kKmMgGtT]i?)?(?:[bB])?$/);
  if (!match) return Number(str) || 0;
  const value = parseFloat(match[1]);
  const unit = (match[2] || '').toLowerCase();
  // Binary unit multipliers (KiB, MiB, GiB, TiB)
  const multipliers = { '': 1, k: KIB, ki: KIB, m: MIB, mi: MIB, g: GIB, gi: GIB, t: TIB, ti: TIB };
  if (!Number.isFinite(value) || value <= 0) return 0;
  return Math.round(value * (multipliers[unit] || 1));
}

/**
 * Normalize interval values so misconfigured env vars can't create tight loops.
 * @param {string|number|undefined} raw
 * @param {number} fallback
 * @param {number} min
 * @returns {number}
 */
function resolveIntervalMs(raw, fallback, min) {
  const parsed = Number(raw);
  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
  return Math.max(parsed, min);
}

function resolvePositiveInt(raw, fallback) {
  const parsed = Number(raw);
  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
  return Math.round(parsed);
}

function formatDuration(ms) {
  if (ms < 1000) return Math.round(ms) + 'ms';
  if (ms < 60000) return (ms / 1000).toFixed(1) + 's';
  if (ms < 3600000) return (ms / 60000).toFixed(1) + 'm';
  if (ms < 86400000) return (ms / 3600000).toFixed(1) + 'h';
  return (ms / 86400000).toFixed(1) + 'd';
}

function detectDockerLimits(baseMemoryBytes, baseCpuCores, repoRoot) {
  let memoryBytes = baseMemoryBytes;
  let cpuCores = baseCpuCores;
  const root = repoRoot || process.cwd();
  // Best-effort parse of docker compose files without adding a YAML dependency; unexpected formats fall back to provided defaults.
  const candidates = ['stack-portainer.yml', 'docker-compose.yml'];
  for (const candidate of candidates) {
    try {
      const content = fsSync.readFileSync(path.join(root, candidate), 'utf8');
      const memMatch = content.match(/memory:\s*['"]?([0-9.]+\s*[kKmMgGtT]i?[bB]?)/);
      if (memMatch) {
        const parsed = parseMemoryValue(memMatch[1]);
        if (parsed > 0) memoryBytes = parsed;
      }
      const cpuMatch = content.match(/cpus:\s*['"]?([0-9.]+)/);
      if (cpuMatch) {
        const parsedCpu = Number(cpuMatch[1]);
        if (Number.isFinite(parsedCpu) && parsedCpu > 0) cpuCores = parsedCpu;
      }
    } catch (_) {
      // Ignore missing or unreadable docker config files and fall back to defaults
    }
  }
  return { memoryBytes, cpuCores };
}

const PORT = Number(process.env.CHAT_PORT || 4000);
const HOST = process.env.CHAT_HOST || '0.0.0.0';
const DATA_ROOT = process.env.CHAT_DATA_ROOT || path.join(process.cwd(), '.data');
const STATE_DIR = path.join(DATA_ROOT, '.opencode-chat');
const STATE_FILE = path.join(STATE_DIR, 'sessions.json');
const WORKSPACES_ROOT = path.join(DATA_ROOT, 'apps');
const STATIC_ROOT = path.join(__dirname, 'public');
const UPLOADS_DIR = path.join(STATE_DIR, 'uploads');
const REPO_ROOT = process.env.CHAT_REPO_ROOT || process.cwd();
const DEFAULT_OPENROUTER_API_URL = 'https://openrouter.ai/api/v1/chat/completions';
const OPENROUTER_API_URL = process.env.OPENROUTER_API_URL || DEFAULT_OPENROUTER_API_URL;
const OPENROUTER_API_KEY = process.env.OPENROUTER_API_KEY || process.env.OPENROUTER_API_TOKEN || '';
const OPENCODE_OLLAMA_API_KEY = process.env.OPENCODE_OLLAMA_API_KEY || '';
const OPENCODE_OLLAMA_BASE_URL = process.env.OPENCODE_OLLAMA_BASE_URL || 'https://ollama.plugincompass.com';
const OPENCODE_OLLAMA_MODEL = process.env.OPENCODE_OLLAMA_MODEL || 'qwen3:0.6b';
const OPENCODE_OLLAMA_PROVIDER = process.env.OPENCODE_OLLAMA_PROVIDER || 'openai';

// Ollama self-hosted (planning provider) - can be set via OLLAMA_* env vars or legacy OPENCODE_OLLAMA_* vars
const OLLAMA_API_URL = process.env.OLLAMA_API_URL || OPENCODE_OLLAMA_BASE_URL || '';
const OLLAMA_API_KEY = process.env.OLLAMA_API_KEY || process.env.OLLAMA_API_TOKEN || OPENCODE_OLLAMA_API_KEY || '';
const OLLAMA_DEFAULT_MODEL = process.env.OLLAMA_DEFAULT_MODEL || OPENCODE_OLLAMA_MODEL || ''; 
const OPENROUTER_MODEL_PRIMARY = process.env.OPENROUTER_MODEL_PRIMARY || process.env.OPENROUTER_MODEL || '';
const OPENROUTER_MODEL_BACKUP_1 = process.env.OPENROUTER_MODEL_BACKUP_1 || process.env.OPENROUTER_MODEL_BACKUP1 || '';
const OPENROUTER_MODEL_BACKUP_2 = process.env.OPENROUTER_MODEL_BACKUP_2 || process.env.OPENROUTER_MODEL_BACKUP2 || '';
const OPENROUTER_MODEL_BACKUP_3 = process.env.OPENROUTER_MODEL_BACKUP_3 || process.env.OPENROUTER_MODEL_BACKUP3 || '';
const OPENROUTER_FALLBACK_MODELS = process.env.OPENROUTER_FALLBACK_MODELS
  ? process.env.OPENROUTER_FALLBACK_MODELS.split(',').map((m) => m.trim()).filter(Boolean)
  : []; 
const OPENROUTER_STATIC_FALLBACK_MODELS = [
  'anthropic/claude-3.5-sonnet',
  'openai/gpt-4o-mini',
  'mistralai/mistral-large-latest',
  'google/gemini-flash-1.5',
];
const OPENROUTER_DEFAULT_MODEL = process.env.OPENROUTER_DEFAULT_MODEL || 'openai/gpt-4o-mini';
const OPENROUTER_PLAN_PROMPT_PATH = process.env.OPENROUTER_PLAN_PROMPT_PATH || path.join(STATIC_ROOT, 'openrouter-plan-prompt.txt');
const OPENROUTER_APP_NAME = process.env.OPENROUTER_APP_NAME || 'Shopify AI App Builder';
const OPENROUTER_SITE_URL = process.env.OPENROUTER_SITE_URL || process.env.OPENROUTER_SITE || '';
const OPENROUTER_ERROR_DETAIL_LIMIT = 400;

// External directory restriction for OpenCode (auto-deny based on app ID)
const ENABLE_EXTERNAL_DIR_RESTRICTION = process.env.ENABLE_EXTERNAL_DIR_RESTRICTION !== 'false';
let warnedOpenRouterApiUrl = false;

// Mistral configuration
const DEFAULT_MISTRAL_API_URL = 'https://api.mistral.ai/v1/chat/completions';
const MISTRAL_API_URL = process.env.MISTRAL_API_URL || DEFAULT_MISTRAL_API_URL;
const MISTRAL_API_KEY = process.env.MISTRAL_API_KEY || '';
const MISTRAL_MODEL_PRIMARY = process.env.MISTRAL_MODEL_PRIMARY || process.env.MISTRAL_MODEL || '';
const MISTRAL_MODEL_BACKUP_1 = process.env.MISTRAL_MODEL_BACKUP_1 || process.env.MISTRAL_MODEL_BACKUP1 || '';
const MISTRAL_MODEL_BACKUP_2 = process.env.MISTRAL_MODEL_BACKUP_2 || process.env.MISTRAL_MODEL_BACKUP2 || '';
const MISTRAL_MODEL_BACKUP_3 = process.env.MISTRAL_MODEL_BACKUP_3 || process.env.MISTRAL_MODEL_BACKUP3 || '';
const MISTRAL_DEFAULT_MODEL = process.env.MISTRAL_DEFAULT_MODEL || 'mistral-large-latest';
const MISTRAL_ERROR_DETAIL_LIMIT = 400;

// Optional direct provider credentials (set via environment variables)
const GOOGLE_API_KEY = process.env.GOOGLE_API_KEY || process.env.GOOGLE_API_TOKEN || '';
const GOOGLE_API_URL = process.env.GOOGLE_API_URL || 'https://generativelanguage.googleapis.com/v1beta2';
const GROQ_API_KEY = process.env.GROQ_API_KEY || process.env.GROQ_API_TOKEN || '';
const GROQ_API_URL = process.env.GROQ_API_URL || 'https://api.groq.com/openai/v1/chat/completions';
const NVIDIA_API_KEY = process.env.NVIDIA_API_KEY || process.env.NVIDIA_API_TOKEN || '';
const NVIDIA_API_URL = process.env.NVIDIA_API_URL || 'https://api.nvidia.com/v1';

const PROVIDER_LIMITS_FILE = path.join(STATE_DIR, 'provider-limits.json');
const PROVIDER_USAGE_FILE = path.join(STATE_DIR, 'provider-usage.json');
const TOKEN_USAGE_FILE = path.join(STATE_DIR, 'token-usage.json');
const TOPUP_SESSIONS_FILE = path.join(STATE_DIR, 'topup-sessions.json');
const TOPUP_PENDING_FILE = path.join(STATE_DIR, 'topup-pending.json');
const PAYG_SESSIONS_FILE = path.join(STATE_DIR, 'payg-sessions.json');
const PAYG_PENDING_FILE = path.join(STATE_DIR, 'payg-pending.json');
const SUBSCRIPTION_SESSIONS_FILE = path.join(STATE_DIR, 'subscription-sessions.json');
const SUBSCRIPTION_PENDING_FILE = path.join(STATE_DIR, 'subscription-pending.json');
const PLAN_TOKENS_FILE = path.join(STATE_DIR, 'plan-tokens.json');
const TOKEN_RATES_FILE = path.join(STATE_DIR, 'token-rates.json');
const FEATURE_REQUESTS_FILE = path.join(STATE_DIR, 'feature-requests.json');
const CONTACT_MESSAGES_FILE = path.join(STATE_DIR, 'contact-messages.json');
const INVOICES_FILE = path.join(STATE_DIR, 'invoices.json');
const INVOICES_DIR = path.join(STATE_DIR, 'invoices');
// One-off top-up discounts (Business 2.5%, Enterprise 5%; boost add-ons keep higher 10%/25% rates)
const BUSINESS_TOPUP_DISCOUNT = 0.025;
const ENTERPRISE_TOPUP_DISCOUNT = 0.05;
const MIN_PAYMENT_AMOUNT = (() => {
  const parsed = Number(process.env.DODO_MIN_AMOUNT || 50);
  return Number.isFinite(parsed) && parsed > 0 ? parsed : 50;
})();
const DODO_PAYMENTS_API_KEY = process.env.DODO_PAYMENTS_API_KEY || process.env.DODO_API_KEY || '';
const DODO_ENVIRONMENT = (process.env.DODO_PAYMENTS_ENV || process.env.DODO_ENVIRONMENT || process.env.DODO_ENV || 'test').toLowerCase();
const DODO_BASE_URL = DODO_ENVIRONMENT.includes('live') ? 'https://live.dodopayments.com' : 'https://test.dodopayments.com';
const DODO_ENABLED = Boolean(DODO_PAYMENTS_API_KEY);
// Token top-up product IDs (4 options × 3 currencies)
const TOPUP_PRODUCT_IDS = {
  // Top-up Option 1 (100,000 tokens)
  topup_1_usd: process.env.DODO_TOPUP_1_USD || '',
  topup_1_gbp: process.env.DODO_TOPUP_1_GBP || '',
  topup_1_eur: process.env.DODO_TOPUP_1_EUR || '',

  // Top-up Option 2 (5,000,000 tokens)
  topup_2_usd: process.env.DODO_TOPUP_2_USD || '',
  topup_2_gbp: process.env.DODO_TOPUP_2_GBP || '',
  topup_2_eur: process.env.DODO_TOPUP_2_EUR || '',

  // Top-up Option 3 (20,000,000 tokens)
  topup_3_usd: process.env.DODO_TOPUP_3_USD || '',
  topup_3_gbp: process.env.DODO_TOPUP_3_GBP || '',
  topup_3_eur: process.env.DODO_TOPUP_3_EUR || '',

  // Top-up Option 4 (50,000,000 tokens)
  topup_4_usd: process.env.DODO_TOPUP_4_USD || '',
  topup_4_gbp: process.env.DODO_TOPUP_4_GBP || '',
  topup_4_eur: process.env.DODO_TOPUP_4_EUR || '',
};
const TOPUP_TOKENS = {
  topup_1: resolvePositiveInt(process.env.DODO_TOPUP_TOKENS_1, 100_000),
  topup_2: resolvePositiveInt(process.env.DODO_TOPUP_TOKENS_2, 5_000_000),
  topup_3: resolvePositiveInt(process.env.DODO_TOPUP_TOKENS_3, 20_000_000),
  topup_4: resolvePositiveInt(process.env.DODO_TOPUP_TOKENS_4, 50_000_000),
};

// Pay-as-you-go (overage) product IDs (1 option × 3 currencies)
const PAYG_PRODUCT_IDS = {
  usd: process.env.DODO_PAYG_USD || '',
  gbp: process.env.DODO_PAYG_GBP || '',
  eur: process.env.DODO_PAYG_EUR || '',
};

// Pay-as-you-go pricing in minor units per PAYG unit (defaults: $2.50 / €2.50 / £2.00 per 1M tokens)
const PAYG_UNIT_TOKENS = Math.max(1, Number(process.env.DODO_PAYG_UNIT_TOKENS || 1_000_000));
const PAYG_PRICES = {
  usd: Number(process.env.DODO_PAYG_USD_AMOUNT || 250),
  gbp: Number(process.env.DODO_PAYG_GBP_AMOUNT || 200),
  eur: Number(process.env.DODO_PAYG_EUR_AMOUNT || 250),
};
const PAYG_MIN_TOKENS = Math.max(0, Number(process.env.DODO_PAYG_MIN_TOKENS || 0));
const PAYG_ENABLED = (process.env.DODO_PAYG_ENABLED || '1') !== '0';

// Usage-based billing events (Dodo meters)
const DODO_USAGE_EVENTS_ENABLED = (process.env.DODO_USAGE_EVENTS_ENABLED || '1') !== '0';
const DODO_USAGE_EVENT_NAME = process.env.DODO_USAGE_EVENT_NAME || 'token.usage';
const DODO_USAGE_EVENT_COST_FIELD = process.env.DODO_USAGE_EVENT_COST_FIELD || 'costCents';
const DODO_USAGE_EVENT_TOKENS_FIELD = process.env.DODO_USAGE_EVENT_TOKENS_FIELD || 'billableTokens';

// Subscription product IDs for plans (plan_billing_currency format)
const SUBSCRIPTION_PRODUCT_IDS = {
  // Starter Plan Products
  starter_monthly_usd: process.env.DODO_STARTER_MONTHLY_USD || 'prod_starter_monthly_usd',
  starter_yearly_usd: process.env.DODO_STARTER_YEARLY_USD || 'prod_starter_yearly_usd',
  starter_monthly_gbp: process.env.DODO_STARTER_MONTHLY_GBP || 'prod_starter_monthly_gbp',
  starter_yearly_gbp: process.env.DODO_STARTER_YEARLY_GBP || 'prod_starter_yearly_gbp',
  starter_monthly_eur: process.env.DODO_STARTER_MONTHLY_EUR || 'prod_starter_monthly_eur',
  starter_yearly_eur: process.env.DODO_STARTER_YEARLY_EUR || 'prod_starter_yearly_eur',
  
  // Professional Plan Products
  professional_monthly_usd: process.env.DODO_PROFESSIONAL_MONTHLY_USD || 'prod_professional_monthly_usd',
  professional_yearly_usd: process.env.DODO_PROFESSIONAL_YEARLY_USD || 'prod_professional_yearly_usd',
  professional_monthly_gbp: process.env.DODO_PROFESSIONAL_MONTHLY_GBP || 'prod_professional_monthly_gbp',
  professional_yearly_gbp: process.env.DODO_PROFESSIONAL_YEARLY_GBP || 'prod_professional_yearly_gbp',
  professional_monthly_eur: process.env.DODO_PROFESSIONAL_MONTHLY_EUR || 'prod_professional_monthly_eur',
  professional_yearly_eur: process.env.DODO_PROFESSIONAL_YEARLY_EUR || 'prod_professional_yearly_eur',
  
  // Enterprise Plan Products
  enterprise_monthly_usd: process.env.DODO_ENTERPRISE_MONTHLY_USD || 'prod_enterprise_monthly_usd',
  enterprise_yearly_usd: process.env.DODO_ENTERPRISE_YEARLY_USD || 'prod_enterprise_yearly_usd',
  enterprise_monthly_gbp: process.env.DODO_ENTERPRISE_MONTHLY_GBP || 'prod_enterprise_monthly_gbp',
  enterprise_yearly_gbp: process.env.DODO_ENTERPRISE_YEARLY_GBP || 'prod_enterprise_yearly_gbp',
  enterprise_monthly_eur: process.env.DODO_ENTERPRISE_MONTHLY_EUR || 'prod_enterprise_monthly_eur',
  enterprise_yearly_eur: process.env.DODO_ENTERPRISE_YEARLY_EUR || 'prod_enterprise_yearly_eur',
};

// Subscription pricing (in cents/minor units)
const SUBSCRIPTION_PRICES = {
  // Starter Plan Prices
  starter_monthly_usd: Number(process.env.DODO_STARTER_MONTHLY_USD_AMOUNT || 750),
  starter_yearly_usd: Number(process.env.DODO_STARTER_YEARLY_USD_AMOUNT || 7500),
  starter_monthly_gbp: Number(process.env.DODO_STARTER_MONTHLY_GBP_AMOUNT || 625),
  starter_yearly_gbp: Number(process.env.DODO_STARTER_YEARLY_GBP_AMOUNT || 6250),
  starter_monthly_eur: Number(process.env.DODO_STARTER_MONTHLY_EUR_AMOUNT || 750),
  starter_yearly_eur: Number(process.env.DODO_STARTER_YEARLY_EUR_AMOUNT || 7500),
  
  // Professional Plan Prices
  professional_monthly_usd: Number(process.env.DODO_PROFESSIONAL_MONTHLY_USD_AMOUNT || 2500),
  professional_yearly_usd: Number(process.env.DODO_PROFESSIONAL_YEARLY_USD_AMOUNT || 25000),
  professional_monthly_gbp: Number(process.env.DODO_PROFESSIONAL_MONTHLY_GBP_AMOUNT || 2100),
  professional_yearly_gbp: Number(process.env.DODO_PROFESSIONAL_YEARLY_GBP_AMOUNT || 21000),
  professional_monthly_eur: Number(process.env.DODO_PROFESSIONAL_MONTHLY_EUR_AMOUNT || 2500),
  professional_yearly_eur: Number(process.env.DODO_PROFESSIONAL_YEARLY_EUR_AMOUNT || 25000),
  
  // Enterprise Plan Prices
  enterprise_monthly_usd: Number(process.env.DODO_ENTERPRISE_MONTHLY_USD_AMOUNT || 7500),
  enterprise_yearly_usd: Number(process.env.DODO_ENTERPRISE_YEARLY_USD_AMOUNT || 75000),
  enterprise_monthly_gbp: Number(process.env.DODO_ENTERPRISE_MONTHLY_GBP_AMOUNT || 6250),
  enterprise_yearly_gbp: Number(process.env.DODO_ENTERPRISE_YEARLY_GBP_AMOUNT || 62500),
  enterprise_monthly_eur: Number(process.env.DODO_ENTERPRISE_MONTHLY_EUR_AMOUNT || 7500),
  enterprise_yearly_eur: Number(process.env.DODO_ENTERPRISE_YEARLY_EUR_AMOUNT || 75000),
};

// Token top-up pricing (in cents/minor units) - 4 options × 3 currencies
// Option 1: 100,000 tokens, Option 2: 5,000,000 tokens, Option 3: 20,000,000 tokens, Option 4: 50,000,000 tokens
const TOPUP_PRICES = {
  // Top-up Option 1 (100,000 tokens)
  topup_1_usd: resolvePositiveInt(process.env.DODO_TOPUP_1_USD_AMOUNT, 750),
  topup_1_gbp: resolvePositiveInt(process.env.DODO_TOPUP_1_GBP_AMOUNT, 500),
  topup_1_eur: resolvePositiveInt(process.env.DODO_TOPUP_1_EUR_AMOUNT, 750),

  // Top-up Option 2 (5,000,000 tokens)
  topup_2_usd: resolvePositiveInt(process.env.DODO_TOPUP_2_USD_AMOUNT, 2500),
  topup_2_gbp: resolvePositiveInt(process.env.DODO_TOPUP_2_GBP_AMOUNT, 2000),
  topup_2_eur: resolvePositiveInt(process.env.DODO_TOPUP_2_EUR_AMOUNT, 2500),

  // Top-up Option 3 (20,000,000 tokens)
  topup_3_usd: resolvePositiveInt(process.env.DODO_TOPUP_3_USD_AMOUNT, 7500),
  topup_3_gbp: resolvePositiveInt(process.env.DODO_TOPUP_3_GBP_AMOUNT, 6000),
  topup_3_eur: resolvePositiveInt(process.env.DODO_TOPUP_3_EUR_AMOUNT, 7500),

  // Top-up Option 4 (50,000,000 tokens)
  topup_4_usd: resolvePositiveInt(process.env.DODO_TOPUP_4_USD_AMOUNT, 12500),
  topup_4_gbp: resolvePositiveInt(process.env.DODO_TOPUP_4_GBP_AMOUNT, 10000),
  topup_4_eur: resolvePositiveInt(process.env.DODO_TOPUP_4_EUR_AMOUNT, 12500),
};

// Supported billing cycles and currencies
const BILLING_CYCLES = ['monthly', 'yearly'];
const SUPPORTED_CURRENCIES = ['usd', 'gbp', 'eur'];
const MINUTE_MS = 60_000;
const DODO_PRODUCTS_CACHE_TTL_MS = Math.max(30_000, Number(process.env.DODO_PRODUCTS_CACHE_TTL_MS || 5 * MINUTE_MS));
const DAY_MS = 86_400_000;
const FORTY_EIGHT_HOURS_MS = 48 * DAY_MS;
const AVG_CHARS_PER_TOKEN = 4; // rough heuristic
const MAX_JSON_BODY_SIZE = Number(process.env.MAX_JSON_BODY_SIZE || 6_000_000); // 6 MB default for JSON payloads (attachments)
const MAX_ATTACHMENT_SIZE = Number(process.env.MAX_ATTACHMENT_SIZE || 5_000_000); // 5 MB limit per attachment
const AFFILIATES_FILE = path.join(STATE_DIR, 'affiliates.json');
const WITHDRAWALS_FILE = path.join(STATE_DIR, 'withdrawals.json');
const AFFILIATE_COOKIE_NAME = 'affiliate_session';
const AFFILIATE_REF_COOKIE = 'affiliate_ref';
const AFFILIATE_SESSION_TTL_MS = Number(process.env.AFFILIATE_SESSION_TTL_MS || 30 * DAY_MS);
const AFFILIATE_COMMISSION_RATE = 0.075;
const AFFILIATE_REF_COOKIE_TTL_MS = 30 * DAY_MS;
const AFFILIATE_REF_COOKIE_TTL_SECONDS = Math.floor(AFFILIATE_REF_COOKIE_TTL_MS / 1000);
const ADMIN_USER = process.env.ADMIN_USER || process.env.ADMIN_EMAIL || '';
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || process.env.ADMIN_PASS || '';
const ADMIN_SESSION_TTL_MS = Number(process.env.ADMIN_SESSION_TTL_MS || 86_400_000); // default 24h
const ADMIN_MODELS_FILE = path.join(STATE_DIR, 'admin-models.json');
const OPENROUTER_SETTINGS_FILE = path.join(STATE_DIR, 'openrouter-settings.json');
const MISTRAL_SETTINGS_FILE = path.join(STATE_DIR, 'mistral-settings.json');
const ADMIN_COOKIE_NAME = 'admin_session';
const TRACKING_FILE = path.join(STATE_DIR, 'tracking.json');
const TRACKING_PERSIST_INTERVAL_MS = 60000; // Persist every minute
const ASSETS_DIR = path.join(STATIC_ROOT, 'assets');
const DEFAULT_MEMORY_LIMIT_BYTES = (() => {
  const parsed = parseMemoryValue(process.env.CONTAINER_MEMORY_LIMIT || process.env.MAX_CONTAINER_MEMORY || '512M');
  return parsed > 0 ? parsed : parseMemoryValue('512M');
})();
const DEFAULT_CPU_LIMIT_CORES = (() => {
  const parsed = Number(process.env.CONTAINER_CPU_LIMIT || process.env.MAX_CONTAINER_CPU || 0.5);
  return Number.isFinite(parsed) && parsed > 0 ? parsed : 0.5;
})();
const RESOURCE_LIMITS = detectDockerLimits(DEFAULT_MEMORY_LIMIT_BYTES, DEFAULT_CPU_LIMIT_CORES, REPO_ROOT);
const RESOURCE_MEMORY_SOFT_RATIO = Number(process.env.RESOURCE_MEMORY_SOFT_RATIO || 0.9);
const RESOURCE_CPU_SOFT_RATIO = Number(process.env.RESOURCE_CPU_SOFT_RATIO || 0.9);
const RESOURCE_CHECK_INTERVAL_MS = resolveIntervalMs(process.env.RESOURCE_CHECK_INTERVAL_MS, 750, 250);
const RESOURCE_MIN_LOAD_FLOOR = Number(process.env.RESOURCE_MIN_LOAD_FLOOR || 0.5);
const RESOURCE_WAIT_LOG_INTERVAL_MS = resolveIntervalMs(process.env.RESOURCE_WAIT_LOG_INTERVAL_MS, 4000, 500);
const OPENCODE_MAX_CONCURRENCY = Number(process.env.OPENCODE_MAX_CONCURRENCY || 0);

// User authentication configuration
const USERS_DB_FILE = path.join(STATE_DIR, 'users.json');
const USER_SESSIONS_FILE = path.join(STATE_DIR, 'user-sessions.json');
const USER_SESSION_SECRET = process.env.USER_SESSION_SECRET || process.env.SESSION_SECRET || (() => {
  // Generate a secure random session secret for development
  // In production, this should be set via environment variable
  const generatedSecret = randomBytes(32).toString('hex');
  console.warn('⚠️  WARNING: No USER_SESSION_SECRET or SESSION_SECRET found. Generated a random secret for this session.');
  console.warn('⚠️  For production use, set USER_SESSION_SECRET environment variable to a secure random value.');
  console.warn('⚠️  Generate one with: openssl rand -hex 32');
  return generatedSecret;
})();
const USER_COOKIE_NAME = 'user_session';
const USER_SESSION_TTL_MS = Number(process.env.USER_SESSION_TTL_MS || 30 * 24 * 60 * 60 * 1000); // default 30 days
const USER_SESSION_SHORT_TTL_MS = Number(process.env.USER_SESSION_SHORT_TTL_MS || 3 * 24 * 60 * 60 * 1000); // default 3 days
const PASSWORD_SALT_ROUNDS = 12; // bcrypt salt rounds
const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID || '';
const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET || '';
const GITHUB_CLIENT_ID = process.env.GITHUB_CLIENT_ID || '';
const GITHUB_CLIENT_SECRET = process.env.GITHUB_CLIENT_SECRET || '';
const PUBLIC_BASE_URL = process.env.PUBLIC_BASE_URL || '';
const OAUTH_STATE_TTL_MS = Number(process.env.OAUTH_STATE_TTL_MS || 10 * 60 * 1000); // 10 minutes
const oauthStateStore = new Map();
const OAUTH_USER_AGENT = process.env.OAUTH_USER_AGENT || 'shopify-ai-app-builder';
const EMAIL_VERIFICATION_TTL_MS = Number(process.env.EMAIL_VERIFICATION_TTL_MS || 24 * 60 * 60 * 1000); // 24h
const PASSWORD_RESET_TTL_MS = Number(process.env.PASSWORD_RESET_TTL_MS || 60 * 60 * 1000); // 1h
const SMTP_HOST = process.env.SMTP_HOST || '';
const SMTP_PORT = Number(process.env.SMTP_PORT || 587);
const SMTP_SECURE = process.env.SMTP_SECURE === '1' || String(process.env.SMTP_SECURE || '').toLowerCase() === 'true';
const SMTP_USER = process.env.SMTP_USER || process.env.SMTP_USERNAME || '';
const SMTP_PASS = (() => {
  if (process.env.SMTP_PASS_FILE) {
    try {
      return fsSync.readFileSync(process.env.SMTP_PASS_FILE, 'utf8').trim();
    } catch (_) { /* fall back to env */ }
  }
  return process.env.SMTP_PASS || process.env.SMTP_PASSWORD || '';
})();
const SMTP_FROM = process.env.SMTP_FROM || process.env.EMAIL_FROM || '';
const POSTHOG_API_KEY = process.env.POSTHOG_API_KEY || '';
const POSTHOG_API_HOST = process.env.POSTHOG_API_HOST || 'https://app.posthog.com';
const DODO_WEBHOOK_KEY = process.env.DODO_PAYMENTS_WEBHOOK_KEY || process.env.DODO_WEBHOOK_KEY || '';
const USER_PLANS = ['hobby', 'starter', 'professional', 'enterprise'];
const DEFAULT_PLAN = 'hobby';
const DEFAULT_BILLING_STATUS = 'active';
const PAID_PLANS = new Set(['starter', 'professional', 'enterprise']);
const MAX_UPLOAD_ZIP_SIZE = Number(process.env.MAX_UPLOAD_ZIP_SIZE || 25_000_000); // 25 MB default for uploaded zip apps
const MAX_EXPORT_ZIP_SIZE = Number(process.env.MAX_EXPORT_ZIP_SIZE || 100_000_000); // 100 MB default for exported zip apps
const MAX_EXPORT_FILE_COUNT = Number(process.env.MAX_EXPORT_FILE_COUNT || 10000); // Max 10,000 files per export
const BASE64_OVERHEAD_MULTIPLIER = 1.34; // ~33% overhead with small buffer
const ZIP_LOCAL_HEADER_SIG = [0x50, 0x4b, 0x03, 0x04];
const ZIP_EOCD_EMPTY_SIG = [0x50, 0x4b, 0x05, 0x06];
const BLOCKED_PATH_PATTERN = /^(?:[a-zA-Z]:|\\\\|\/\/|con:|prn:|aux:|nul:|com[1-9]:|lpt[1-9]:)/i;
const PLAN_APP_LIMITS = {
  hobby: 3,
  starter: 10,
  professional: 20,
  enterprise: Infinity,
};
const PLAN_TOKEN_LIMITS = {
  hobby: 50_000,
  starter: 100_000,
  professional: 10_000_000,
  enterprise: 50_000_000,
};

// Default token rates (price per 1M tokens in minor units/cents)
const DEFAULT_TOKEN_RATES = {
  usd: 250,
  gbp: 200,
  eur: 250,
};

// Runtime-editable copy persisted to disk
let planTokenLimits = JSON.parse(JSON.stringify(PLAN_TOKEN_LIMITS));
let tokenRates = JSON.parse(JSON.stringify(DEFAULT_TOKEN_RATES));

async function loadPlanTokenLimits() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(PLAN_TOKENS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') {
        const clean = {};
        Object.keys(PLAN_TOKEN_LIMITS).forEach((plan) => { clean[plan] = 0; });
        for (const [plan, value] of Object.entries(parsed)) {
          if (!clean.hasOwnProperty(plan)) continue;
          clean[plan] = Math.max(0, Number(value || 0));
        }
        planTokenLimits = clean;
      }
    }
  } catch (error) {
    log('Failed to load plan token limits, using defaults', { error: String(error) });
  }
}

async function persistPlanTokenLimits() {
  await ensureStateFile();
  const payload = JSON.stringify(planTokenLimits, null, 2);
  try {
    await safeWriteFile(PLAN_TOKENS_FILE, payload);
  } catch (err) {
    log('Failed to persist plan token limits', { error: String(err) });
  }
}

async function loadTokenRates() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(TOKEN_RATES_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') {
        const clean = {};
        Object.keys(DEFAULT_TOKEN_RATES).forEach((currency) => { clean[currency] = 0; });
        for (const [currency, value] of Object.entries(parsed)) {
          if (!clean.hasOwnProperty(currency)) continue;
          clean[currency] = Math.max(0, Number(value || 0));
        }
        tokenRates = clean;
      }
    }
  } catch (error) {
    log('Failed to load token rates, using defaults', { error: String(error) });
  }
}

async function persistTokenRates() {
  await ensureStateFile();
  const payload = JSON.stringify(tokenRates, null, 2);
  try {
    await safeWriteFile(TOKEN_RATES_FILE, payload);
  } catch (err) {
    log('Failed to persist token rates', { error: String(err) });
  }
}

const PLAN_PRICES = {
  starter: Number(process.env.PRICE_STARTER || 7.5),
  professional: Number(process.env.PRICE_BUSINESS || 25),
  enterprise: Number(process.env.PRICE_ENTERPRISE || 75),
};
const AUTO_MODEL_TOKEN = 'auto';
const DEFAULT_PROVIDER_FALLBACK = 'opencode';
const DEFAULT_PROVIDER_SEEDS = ['openrouter', 'mistral', 'google', 'groq', 'nvidia', DEFAULT_PROVIDER_FALLBACK];
const PROVIDER_PERSIST_DEBOUNCE_MS = 200;
const TOKEN_ESTIMATION_BUFFER = 400;
const BOOST_PACK_SIZE = 500_000;
const BOOST_BASE_PRICE = 15;
const TOKEN_GRACE_RATIO = 0.05;
const TOKEN_GRACE_MIN = 500;
const HOBBY_PRIORITY_DELAY_MS = (() => {
  const raw = Number(process.env.HOBBY_PRIORITY_DELAY_MS || process.env.STARTER_PRIORITY_DELAY_MS);
  return Number.isFinite(raw) && raw >= 0 ? raw : 280;
})();
const STARTER_PRIORITY_DELAY_MS = (() => {
  const raw = Number(process.env.STARTER_PRIORITY_DELAY_MS);
  return Number.isFinite(raw) && raw >= 0 ? raw : 220;
})();
const BUSINESS_PRIORITY_DELAY_MS = (() => {
  const raw = Number(process.env.BUSINESS_PRIORITY_DELAY_MS);
  return Number.isFinite(raw) && raw >= 0 ? raw : 120;
})();
const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

const IMAGE_COMPRESSION_ENABLED = (process.env.IMAGE_COMPRESSION_ENABLED || '1') !== '0';
const IMAGE_MAX_DIMENSION = Number(process.env.IMAGE_MAX_DIMENSION || 1600);
const IMAGE_WEBP_QUALITY = Number(process.env.IMAGE_WEBP_QUALITY || 78);

function isPaidPlan(plan) {
  const normalized = String(plan || '').trim().toLowerCase();
  return PAID_PLANS.has(normalized);
}

function isImageMime(mimeType) {
  const mt = String(mimeType || '').toLowerCase();
  return mt.startsWith('image/');
}

function getBytesPrefix(buf, length) {
  if (!Buffer.isBuffer(buf)) return Buffer.alloc(0);
  return buf.slice(0, Math.max(0, length || 0));
}

function isLikelyPng(buf) {
  const b = getBytesPrefix(buf, 8);
  return b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47 && b[4] === 0x0d && b[5] === 0x0a && b[6] === 0x1a && b[7] === 0x0a;
}

function isLikelyJpeg(buf) {
  const b = getBytesPrefix(buf, 3);
  return b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff;
}

function isLikelyGif(buf) {
  const b = getBytesPrefix(buf, 6);
  return b.length >= 6 && b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38 && (b[4] === 0x39 || b[4] === 0x37) && b[5] === 0x61;
}

function isLikelyWebp(buf) {
  const b = getBytesPrefix(buf, 12);
  return b.length >= 12 && b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50;
}

function isLikelySvg(buf) {
  const head = getBytesPrefix(buf, 200).toString('utf8').trim().toLowerCase();
  return head.startsWith('<svg') || head.startsWith('<?xml') || head.includes('<svg');
}

function validateImageSignature(clientMimeType, buffer) {
  const mt = String(clientMimeType || '').toLowerCase();
  if (!mt.startsWith('image/')) return true;
  if (!Buffer.isBuffer(buffer) || buffer.length < 8) return false;
  if (mt === 'image/png') return isLikelyPng(buffer);
  if (mt === 'image/jpeg') return isLikelyJpeg(buffer);
  if (mt === 'image/gif') return isLikelyGif(buffer);
  if (mt === 'image/webp') return isLikelyWebp(buffer);
  if (mt === 'image/svg+xml') return isLikelySvg(buffer);
  return true;
}

async function compressImageBuffer(buffer, mimeType) {
  if (!IMAGE_COMPRESSION_ENABLED) return { buffer, mimeType, ext: null };
  if (!sharp) return { buffer, mimeType, ext: null };
  const mt = String(mimeType || '').toLowerCase();
  if (!mt.startsWith('image/')) return { buffer, mimeType, ext: null };
  if (mt === 'image/svg+xml' || mt === 'image/gif') return { buffer, mimeType, ext: null };
  try {
    const pipeline = sharp(buffer, { failOn: 'none' }).rotate();
    const resized = pipeline.resize({ width: IMAGE_MAX_DIMENSION, height: IMAGE_MAX_DIMENSION, fit: 'inside', withoutEnlargement: true });
    const out = await resized.webp({ quality: IMAGE_WEBP_QUALITY }).toBuffer();
    if (out && out.length && out.length < buffer.length) {
      return { buffer: out, mimeType: 'image/webp', ext: 'webp' };
    }
  } catch (err) {
    log('image compression failed; storing original', { mimeType: mt, err: String(err) });
  }
  return { buffer, mimeType, ext: null };
}

function safeFileNamePart(raw) {
  return String(raw || 'upload').replace(/[^a-zA-Z0-9\-_\.]/g, '_').slice(0, 140) || 'upload';
}

function extensionForMime(mimeType) {
  const mt = String(mimeType || '').toLowerCase();
  if (mt === 'image/png') return 'png';
  if (mt === 'image/jpeg') return 'jpg';
  if (mt === 'image/gif') return 'gif';
  if (mt === 'image/webp') return 'webp';
  if (mt === 'image/svg+xml') return 'svg';
  if (mt === 'application/pdf') return 'pdf';
  if (mt === 'text/plain') return 'txt';
  if (mt === 'text/css') return 'css';
  if (mt === 'application/javascript') return 'js';
  if (mt === 'text/html') return 'html';
  if (mt === 'text/markdown') return 'md';
  if (mt === 'text/csv') return 'csv';
  if (mt === 'application/json') return 'json';
  if (mt === 'application/xml' || mt === 'text/xml') return 'xml';
  return 'bin';
}

function toDataUrl(mimeType, base64Data) {
  const mt = String(mimeType || 'application/octet-stream');
  return `data:${mt};base64,${base64Data || ''}`;
}

async function buildOpenRouterMessagesForSession(session, currentMessage) {
  const history = Array.isArray(session?.messages) ? session.messages : [];
  const prior = history.filter((m) => m && m.id !== currentMessage?.id && m.status === 'done').slice(-8);
  const mapped = prior.map((m) => {
    if (m.role === 'assistant') return { role: 'assistant', content: String(m.reply || m.partialOutput || '') };
    return { role: 'user', content: String(m.content || '') };
  }).filter((m) => (m.content || '').trim().length);

  const parts = [];
  const text = String(currentMessage?.content || '').trim();
  if (text) parts.push({ type: 'text', text });
  const images = (Array.isArray(currentMessage?.attachments) ? currentMessage.attachments : []).filter((a) => a && isImageMime(a.type) && a.url);
  for (const img of images.slice(0, 6)) {
    try {
      const filename = String(img.url || '').split('/').pop();
      if (!filename) continue;
      const candidate = path.join(session.uploadsDir, filename);
      const resolved = path.resolve(candidate);
      const uploadsRoot = path.resolve(session.uploadsDir);
      if (!resolved.startsWith(uploadsRoot + path.sep) && resolved !== uploadsRoot) continue;
      const buf = await fs.readFile(resolved);
      parts.push({ type: 'image_url', image_url: { url: toDataUrl(img.type, buf.toString('base64')) } });
    } catch (err) {
      log('failed to embed image for OpenRouter', { err: String(err), url: img.url });
    }
  }
  const userMsg = parts.length ? { role: 'user', content: parts } : { role: 'user', content: text };
  return mapped.concat([userMsg]);
}

const state = { sessions: [] };
const sessionQueues = new Map();
const activeStreams = new Map(); // Track active SSE streams per message
const runningProcesses = new Map(); // Track running opencode processes
let resourceReservations = 0; // Tracks reserved slots; Node event loop serializes updates.
const SUPPORTED_CLIS = ['opencode'];
let server = null;
let isShuttingDown = false;
const AUTO_SAVE_INTERVAL_MS = 120000; // Auto-save every 2 minutes (reduced from 30s)
let autoSaveTimer = null;

// ============================================================================
// Memory Management Constants and State
// ============================================================================
const MEMORY_CLEANUP_INTERVAL_MS = 300000; // Run cleanup every 5 minutes (reduced from 60s)
const SESSION_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
const MESSAGE_HISTORY_LIMIT = 50; // Max messages to keep per session (reduced from 100)
const PARTIAL_OUTPUT_MAX_LENGTH = 50000; // Truncate large outputs in completed messages
const STALE_STREAM_TIMEOUT_MS = 600000; // 10 minutes - clean up stale SSE streams
const STALE_PROCESS_TIMEOUT_MS = 900000; // 15 minutes - clean up potentially stuck processes
const MAX_SESSION_QUEUES = 1000; // Limit concurrent session queues
const MAX_OAUTH_STATES = 10000; // Limit OAuth state entries
const MAX_LOGIN_ATTEMPTS_ENTRIES = 50000; // Limit login attempt tracking
let lastMemoryCleanup = 0;
let memoryCleanupTimer = null;
const recentlyCleanedSessions = new Set(); // Track recently cleaned sessions to avoid redundant work

// Track spawned child processes for proper cleanup
const childProcesses = new Map(); // processId -> { pid, startTime, sessionId, messageId }

// ============================================================================
// Memory Cleanup Functions
// ============================================================================

/**
 * Triggers garbage collection hint and runs memory cleanup
 * @param {string} reason - Reason for triggering cleanup (for logging)
 */
function triggerMemoryCleanup(reason = 'manual') {
  const now = Date.now();
  // Debounce - don't run more than once every 60 seconds (increased from 10s)
  if (now - lastMemoryCleanup < 60000) return;
  lastMemoryCleanup = now;
  
  const beforeMem = process.memoryUsage();
  
  try {
    // Clean up completed session data (only if needed)
    const activeMessages = state.sessions.reduce((count, s) => count + (s.pending || 0), 0);
    if (activeMessages === 0 || state.sessions.length > 20) {
      cleanupCompletedSessions();
    }
    
    // Clean up stale entries from Maps
    cleanupStaleMaps();
    
    // Clean up orphaned processes
    cleanupOrphanedProcesses();
    
    // Truncate large message outputs (less frequently)
    if (now % 300000 < 60000) { // Every 5 minutes
      truncateLargeOutputs();
    }
    
    // Hint to V8 to run GC if available (--expose-gc flag)
    if (global.gc) {
      global.gc();
    }
    
    const afterMem = process.memoryUsage();
    const freedMb = ((beforeMem.heapUsed - afterMem.heapUsed) / (1024 * 1024)).toFixed(2);
    
    if (freedMb > 1) {
      log('Memory cleanup completed', {
        reason,
        freedMb: `${freedMb}MB`,
        beforeHeap: `${(beforeMem.heapUsed / 1024 / 1024).toFixed(2)}MB`,
        afterHeap: `${(afterMem.heapUsed / 1024 / 1024).toFixed(2)}MB`,
        rss: `${(afterMem.rss / 1024 / 1024).toFixed(2)}MB`
      });
    }
  } catch (err) {
    log('Memory cleanup error', { error: String(err), reason });
  }
}

/**
 * Cleans up old and completed session data
 */
function cleanupCompletedSessions() {
  const now = Date.now();
  let cleanedSessions = 0;
  let cleanedMessages = 0;
  
  for (const session of state.sessions) {
    // Skip sessions cleaned in the last hour to avoid redundant work
    const lastCleaned = session.lastCleanedAt ? now - new Date(session.lastCleanedAt).getTime() : Infinity;
    if (lastCleaned < 3600000) continue; // Skip if cleaned within last hour
    
    let sessionChanged = false;
    
    // Clean up old messages within sessions
    if (Array.isArray(session.messages) && session.messages.length > MESSAGE_HISTORY_LIMIT) {
      const excess = session.messages.length - MESSAGE_HISTORY_LIMIT;
      // Remove oldest completed messages first
      const toRemove = session.messages
        .filter(m => m.status === 'done' || m.status === 'error' || m.status === 'cancelled')
        .slice(0, excess);
      
      for (const msg of toRemove) {
        const idx = session.messages.indexOf(msg);
        if (idx !== -1) {
          session.messages.splice(idx, 1);
          cleanedMessages++;
          sessionChanged = true;
        }
      }
    }
    
    // Clear partialOutput from completed messages (keep reply only)
    if (Array.isArray(session.messages)) {
      for (const msg of session.messages) {
        if ((msg.status === 'done' || msg.status === 'error') && msg.partialOutput && msg.reply) {
          // Keep only the final reply, not the streaming partial output
          delete msg.partialOutput;
          cleanedMessages++;
          sessionChanged = true;
        }
      }
    }
    
    // Check session age
    const sessionAge = now - new Date(session.createdAt).getTime();
    if (sessionAge > SESSION_MAX_AGE_MS && session.pending === 0) {
      // Mark for cleanup but don't delete - just clean up heavy data
      if (session.messages && session.messages.length > 20) {
        const oldLength = session.messages.length;
        session.messages = session.messages.slice(-20); // Keep only last 20 messages
        if (session.messages.length < oldLength) {
          cleanedSessions++;
          sessionChanged = true;
        }
      }
    }
    
    // Mark session as cleaned
    if (sessionChanged) {
      session.lastCleanedAt = new Date().toISOString();
    }
  }
  
  if (cleanedSessions > 0 || cleanedMessages > 0) {
    log('Cleaned session data', { cleanedSessions, cleanedMessages });
  }
}

/**
 * Cleans up stale entries from various Maps to prevent memory leaks
 */
function cleanupStaleMaps() {
  const now = Date.now();
  let cleaned = { streams: 0, queues: 0, oauth: 0, processes: 0, loginAttempts: 0, apiRate: 0 };
  
  // Clean up stale active streams (SSE connections that didn't close properly)
  for (const [messageId, streams] of activeStreams.entries()) {
    // If message is no longer running/queued, cleanup its streams
    let messageFound = false;
    for (const session of state.sessions) {
      const msg = session.messages?.find(m => m.id === messageId);
      if (msg) {
        messageFound = true;
        if (msg.status !== 'running' && msg.status !== 'queued') {
          // Message completed - close and remove streams
          if (streams instanceof Set) {
            for (const stream of streams) {
              try { stream.end(); } catch (_) {}
            }
          }
          activeStreams.delete(messageId);
          cleaned.streams++;
        }
        break;
      }
    }
    if (!messageFound) {
      // Message not found at all - cleanup streams
      if (streams instanceof Set) {
        for (const stream of streams) {
          try { stream.end(); } catch (_) {}
        }
      }
      activeStreams.delete(messageId);
      cleaned.streams++;
    }
  }
  
  // Clean up old session queues for deleted/inactive sessions
  for (const [sessionId, _queue] of sessionQueues.entries()) {
    const session = state.sessions.find(s => s.id === sessionId);
    if (!session || session.pending === 0) {
      // Check if there are any running messages
      const hasRunning = session?.messages?.some(m => m.status === 'running' || m.status === 'queued');
      if (!hasRunning) {
        sessionQueues.delete(sessionId);
        cleaned.queues++;
      }
    }
  }
  
  // Limit session queues size
  if (sessionQueues.size > MAX_SESSION_QUEUES) {
    const toDelete = sessionQueues.size - MAX_SESSION_QUEUES;
    let deleted = 0;
    for (const [sessionId] of sessionQueues.entries()) {
      if (deleted >= toDelete) break;
      const session = state.sessions.find(s => s.id === sessionId);
      if (!session || session.pending === 0) {
        sessionQueues.delete(sessionId);
        deleted++;
        cleaned.queues++;
      }
    }
  }
  
  // Clean up running processes map for processes that finished
  for (const [messageId, processInfo] of runningProcesses.entries()) {
    // Check if message is still running
    let stillRunning = false;
    for (const session of state.sessions) {
      const msg = session.messages?.find(m => m.id === messageId);
      if (msg && (msg.status === 'running' || msg.status === 'queued')) {
        stillRunning = true;
        break;
      }
    }
    
    if (!stillRunning) {
      runningProcesses.delete(messageId);
      cleaned.processes++;
    }
    
    // Also check for stale processes (running too long)
    if (processInfo.started && (now - processInfo.started) > STALE_PROCESS_TIMEOUT_MS) {
      log('Cleaning up stale process entry', { messageId, age: now - processInfo.started });
      runningProcesses.delete(messageId);
      cleaned.processes++;
    }
  }
  
  // Clean up expired OAuth state entries (deferred cleanup - handled here for Maps that grow unbounded)
  // Note: oauthStateStore is defined later, so we access it via typeof check
  if (typeof oauthStateStore !== 'undefined' && oauthStateStore instanceof Map) {
    for (const [key, entry] of oauthStateStore.entries()) {
      if (entry.expiresAt && entry.expiresAt < now) {
        oauthStateStore.delete(key);
        cleaned.oauth++;
      }
    }
    // Hard limit on OAuth states
    if (oauthStateStore.size > MAX_OAUTH_STATES) {
      const toDelete = oauthStateStore.size - MAX_OAUTH_STATES;
      let deleted = 0;
      for (const [key] of oauthStateStore.entries()) {
        if (deleted >= toDelete) break;
        oauthStateStore.delete(key);
        deleted++;
        cleaned.oauth++;
      }
    }
  }
  
  // Clean up old login attempt entries (older than 1 hour)
  const LOGIN_ATTEMPT_MAX_AGE = 60 * 60 * 1000; // 1 hour
  if (typeof loginAttempts !== 'undefined' && loginAttempts instanceof Map) {
    for (const [key, record] of loginAttempts.entries()) {
      const age = now - (record.windowStart || 0);
      if (age > LOGIN_ATTEMPT_MAX_AGE && (!record.lockedUntil || record.lockedUntil < now)) {
        loginAttempts.delete(key);
        cleaned.loginAttempts++;
      }
    }
    // Hard limit
    if (loginAttempts.size > MAX_LOGIN_ATTEMPTS_ENTRIES) {
      const toDelete = loginAttempts.size - MAX_LOGIN_ATTEMPTS_ENTRIES;
      let deleted = 0;
      for (const [key, record] of loginAttempts.entries()) {
        if (deleted >= toDelete) break;
        if (!record.lockedUntil || record.lockedUntil < now) {
          loginAttempts.delete(key);
          deleted++;
          cleaned.loginAttempts++;
        }
      }
    }
  }
  
  // Clean up old admin login attempt entries
  if (typeof adminLoginAttempts !== 'undefined' && adminLoginAttempts instanceof Map) {
    for (const [key, record] of adminLoginAttempts.entries()) {
      const age = now - (record.windowStart || 0);
      if (age > LOGIN_ATTEMPT_MAX_AGE && (!record.lockedUntil || record.lockedUntil < now)) {
        adminLoginAttempts.delete(key);
        cleaned.loginAttempts++;
      }
    }
  }
  
  // Clean up old API rate limit entries (older than rate limit window)
  const API_RATE_LIMIT_MAX_AGE = 60 * 60 * 1000; // 1 hour
  if (typeof apiRateLimit !== 'undefined' && apiRateLimit instanceof Map) {
    for (const [key, record] of apiRateLimit.entries()) {
      const age = now - (record.windowStart || 0);
      if (age > API_RATE_LIMIT_MAX_AGE) {
        apiRateLimit.delete(key);
        cleaned.apiRate++;
      }
    }
  }
  
  const totalCleaned = Object.values(cleaned).reduce((a, b) => a + b, 0);
  if (totalCleaned > 0) {
    log('Cleaned stale map entries', cleaned);
  }
}

/**
 * Cleans up orphaned child processes
 */
function cleanupOrphanedProcesses() {
  const now = Date.now();
  let killed = 0;
  
  for (const [processId, info] of childProcesses.entries()) {
    const age = now - info.startTime;
    
    // Kill processes running longer than timeout
    if (age > STALE_PROCESS_TIMEOUT_MS) {
      try {
        process.kill(info.pid, 'SIGTERM');
        setTimeout(() => {
          try { process.kill(info.pid, 'SIGKILL'); } catch (_) {}
        }, 5000);
        killed++;
        log('Killed orphaned process', { processId, pid: info.pid, age, sessionId: info.sessionId });
      } catch (err) {
        // Process may already be dead
        if (err.code !== 'ESRCH') {
          log('Failed to kill orphaned process', { processId, error: String(err) });
        }
      }
      childProcesses.delete(processId);
    }
  }
  
  if (killed > 0) {
    log('Cleaned up orphaned processes', { killed });
  }
}

/**
 * Truncates large outputs in completed messages to save memory
 */
function truncateLargeOutputs() {
  let truncated = 0;
  
  for (const session of state.sessions) {
    if (!Array.isArray(session.messages)) continue;
    
    for (const msg of session.messages) {
      // Only truncate completed messages
      if (msg.status !== 'done' && msg.status !== 'error') continue;
      
      // Truncate large reply
      if (msg.reply && msg.reply.length > PARTIAL_OUTPUT_MAX_LENGTH) {
        msg.reply = msg.reply.substring(0, PARTIAL_OUTPUT_MAX_LENGTH) + '\n\n[Output truncated due to length...]';
        truncated++;
      }
      
      // Remove partialOutput if we have reply
      if (msg.partialOutput && msg.reply) {
        delete msg.partialOutput;
        truncated++;
      }
      
      // Truncate large content
      if (msg.content && msg.content.length > PARTIAL_OUTPUT_MAX_LENGTH) {
        msg.content = msg.content.substring(0, PARTIAL_OUTPUT_MAX_LENGTH) + '\n\n[Content truncated...]';
        truncated++;
      }
    }
  }
  
  if (truncated > 0) {
    log('Truncated large message fields', { truncated });
  }
}

/**
 * Starts periodic memory cleanup
 */
function startMemoryCleanup() {
  if (memoryCleanupTimer) return;
  
  memoryCleanupTimer = setInterval(() => {
    if (isShuttingDown) return;
    triggerMemoryCleanup('periodic');
  }, MEMORY_CLEANUP_INTERVAL_MS);
  
  log('Memory cleanup scheduler started', { intervalMs: MEMORY_CLEANUP_INTERVAL_MS });
}

/**
 * Stops periodic memory cleanup
 */
function stopMemoryCleanup() {
  if (memoryCleanupTimer) {
    clearInterval(memoryCleanupTimer);
    memoryCleanupTimer = null;
  }
}

/**
 * Registers a child process for tracking
 * @param {string} processId - Unique process identifier
 * @param {number} pid - Process ID
 * @param {string} sessionId - Associated session ID
 * @param {string} messageId - Associated message ID
 */
function registerChildProcess(processId, pid, sessionId, messageId) {
  childProcesses.set(processId, {
    pid,
    startTime: Date.now(),
    sessionId,
    messageId
  });
}

/**
 * Unregisters a child process
 * @param {string} processId - Process identifier
 */
function unregisterChildProcess(processId) {
  childProcesses.delete(processId);
}

// ============================================================================
// OpenCode Process Manager - Singleton for managing a single OpenCode instance
// ============================================================================
class OpencodeProcessManager {
  constructor() {
    this.process = null;
    this.isReady = false;
    this.pendingRequests = new Map(); // messageId -> { resolve, reject, timeout }
    this.heartbeatInterval = null;
    this.lastActivity = Date.now();
    this.sessionWorkspaces = new Map(); // sessionId -> workspaceDir
  }

  async start() {
    if (this.process) {
      log('OpenCode process manager already running');
      return;
    }

    log('Starting OpenCode process manager singleton...');
    
    try {
      const cliCommand = resolveCliCommand('opencode');
      
      // Verify CLI exists
      try {
        fsSync.accessSync(cliCommand, fsSync.constants.X_OK);
      } catch (err) {
        throw new Error(`OpenCode CLI not found: ${cliCommand}`);
      }

      // Start OpenCode in server/daemon mode if supported
      // Otherwise, we'll continue using per-message spawning
      // Check if OpenCode supports a server/daemon mode
      const serverArgs = this.getServerModeArgs();
      
      if (serverArgs) {
        log('Starting OpenCode in server mode', { args: serverArgs });
        this.process = spawn(cliCommand, serverArgs, {
          stdio: ['pipe', 'pipe', 'pipe'],
          env: { ...process.env }
        });

        this.process.stdout.on('data', (data) => this.handleStdout(data));
        this.process.stderr.on('data', (data) => this.handleStderr(data));
        this.process.on('error', (err) => this.handleError(err));
        this.process.on('exit', (code) => this.handleExit(code));

        // Wait for ready signal
        await this.waitForReady();
        
        // Start heartbeat to keep process alive
        this.startHeartbeat();
        
        log('OpenCode process manager started successfully');
      } else {
        log('OpenCode does not support server mode, will use per-session approach');
        // We'll track sessions instead of using a single process
        this.isReady = true;
      }
    } catch (err) {
      log('Failed to start OpenCode process manager', { error: String(err) });
      this.process = null;
      this.isReady = false;
      throw err;
    }
  }

  getServerModeArgs() {
    // Check if OpenCode supports server/daemon mode
    // This would need to be customized based on actual OpenCode CLI capabilities
    // For now, we return null to indicate no server mode support
    // If OpenCode adds 'serve' or 'daemon' command, update this
    return null;
  }

  async waitForReady(timeout = 10000) {
    return new Promise((resolve, reject) => {
      const timer = setTimeout(() => {
        reject(new Error('OpenCode process failed to become ready'));
      }, timeout);

      const checkReady = () => {
        if (this.isReady) {
          clearTimeout(timer);
          resolve();
        } else {
          setTimeout(checkReady, 100);
        }
      };
      checkReady();
    });
  }

  handleStdout(data) {
    const text = data.toString();
    log('OpenCode process stdout', { text: text.slice(0, 200) });
    
    // Check for ready signal
    if (text.includes('ready') || text.includes('listening')) {
      this.isReady = true;
    }
    
    // Process responses for pending requests
    this.processOutput(text);
  }

  handleStderr(data) {
    const text = data.toString();
    log('OpenCode process stderr', { text: text.slice(0, 200) });
  }

  handleError(err) {
    log('OpenCode process error', { error: String(err) });
    this.isReady = false;
    this.rejectAllPending(err);
  }

  handleExit(code) {
    log('OpenCode process exited', { code });
    this.isReady = false;
    this.process = null;
    this.rejectAllPending(new Error(`OpenCode process exited with code ${code}`));
    
    // Auto-restart if not shutting down
    if (!isShuttingDown) {
      log('Auto-restarting OpenCode process...');
      setTimeout(() => this.start().catch(err => 
        log('Failed to restart OpenCode', { error: String(err) })
      ), 5000);
    }
  }

  startHeartbeat() {
    this.heartbeatInterval = setInterval(() => {
      if (!this.process || !this.isReady) return;
      
      // Send a lightweight heartbeat command
      // This keeps the process alive and checks responsiveness
      const idleTime = Date.now() - this.lastActivity;
      
      // If idle for more than 5 minutes, send a ping
      if (idleTime > 300000) {
        log('Sending heartbeat to OpenCode process', { idleTime });
        // Could send a simple command like 'version' or 'status'
      }
    }, 60000); // Every minute
  }

  stopHeartbeat() {
    if (this.heartbeatInterval) {
      clearInterval(this.heartbeatInterval);
      this.heartbeatInterval = null;
    }
  }

  processOutput(text) {
    // Parse output and route to appropriate pending request
    // This would need to be customized based on OpenCode's output format
    this.lastActivity = Date.now();
  }

  rejectAllPending(error) {
    for (const [messageId, request] of this.pendingRequests.entries()) {
      if (request.timeout) clearTimeout(request.timeout);
      request.reject(error);
    }
    this.pendingRequests.clear();
  }

  async executeInSession(sessionId, workspaceDir, command, args, options = {}) {
    if (!this.isReady && !this.process) {
      // Fall back to per-message spawning if server mode not available
      return this.executeStandalone(workspaceDir, command, args, options);
    }

    // Track workspace for this session
    this.sessionWorkspaces.set(sessionId, workspaceDir);
    this.lastActivity = Date.now();

    // Send command to persistent process
    // This would need protocol implementation based on OpenCode's capabilities
    // For now, fall back to standalone execution
    return this.executeStandalone(workspaceDir, command, args, options);
  }

  async executeStandalone(workspaceDir, command, args, options) {
    // Execute as a standalone process (current behavior)
    // But track it so we can see when multiple processes are running
    const processId = randomUUID();
    const startTime = Date.now();
    
    log('Executing OpenCode command (standalone)', { 
      processId, 
      command, 
      args,
      workspaceDir,
      activeProcesses: runningProcesses.size 
    });

    try {
      const result = await runCommand(command, args, {
        ...options,
        cwd: workspaceDir
      });
      
      const duration = Date.now() - startTime;
      log('OpenCode command completed', { processId, duration, activeProcesses: runningProcesses.size });
      
      return result;
    } catch (err) {
      const duration = Date.now() - startTime;
      log('OpenCode command failed', { processId, duration, error: String(err) });
      throw err;
    }
  }

  async stop() {
    log('Stopping OpenCode process manager...');
    this.stopHeartbeat();
    this.isReady = false;

    if (this.process) {
      this.process.kill('SIGTERM');
      
      // Wait for graceful shutdown
      await new Promise((resolve) => {
        const timeout = setTimeout(() => {
          if (this.process) {
            log('Force killing OpenCode process');
            this.process.kill('SIGKILL');
          }
          resolve();
        }, 5000);
        
        if (this.process) {
          this.process.once('exit', () => {
            clearTimeout(timeout);
            resolve();
          });
        } else {
          clearTimeout(timeout);
          resolve();
        }
      });
      
      this.process = null;
    }
    
    this.sessionWorkspaces.clear();
    log('OpenCode process manager stopped');
  }

  getStats() {
    return {
      isRunning: !!this.process,
      isReady: this.isReady,
      pendingRequests: this.pendingRequests.size,
      activeSessions: this.sessionWorkspaces.size,
      lastActivity: this.lastActivity,
      idleTime: Date.now() - this.lastActivity
    };
  }
}

// Global singleton instance
const opencodeManager = new OpencodeProcessManager();

// ============================================================================
// End OpenCode Process Manager
// ============================================================================

async function safeWriteFile(filePath, data, maxRetries = 3) {
  const tempPath = filePath + '.tmp';
  const parentDir = path.dirname(filePath);
  
  for (let attempt = 1; attempt <= maxRetries; attempt++) {
    try {
      await fs.mkdir(parentDir, { recursive: true });
      await fs.writeFile(tempPath, data, 'utf8');
      await fs.rename(tempPath, filePath);
      return;
    } catch (error) {
      if (error.code === 'ENOENT' && attempt < maxRetries) {
        log(`safeWriteFile retry ${attempt}/${maxRetries} for ${path.basename(filePath)}`, { error: String(error) });
        await delay(50 * attempt);
        continue;
      }
      log(`safeWriteFile failed for ${path.basename(filePath)}`, { error: String(error), attempt });
      throw error;
    }
  }
}

async function persistAllState() {
  const persistFunctions = [
    persistState,
    persistAdminModels,
    persistOpenRouterSettings,
    persistMistralSettings,
    persistPlanSettings,
    persistPlanTokenLimits,
    persistProviderLimits,
    persistProviderUsage,
    persistTokenUsage,
    persistTopupSessions,
    persistPendingTopups,
    persistPaygSessions,
    persistPendingPayg,
    persistUsersDb,
    persistAffiliatesDb,
    persistFeatureRequestsDb,
    persistContactMessagesDb,
  ];
  for (const persistFn of persistFunctions) {
    try {
      await persistFn();
    } catch (error) {
      log(`Failed to persist ${persistFn.name}`, { error: String(error) });
    }
  }
}

async function gracefulShutdown(signal) {
  if (isShuttingDown) return;
  isShuttingDown = true;
  log(`Received ${signal}, starting graceful shutdown with session preservation...`);
  
  // Stop periodic tasks first
  stopAutoSave();
  stopMemoryCleanup();
  
  // Notify all active SSE connections about the restart
  for (const [messageId, streams] of activeStreams.entries()) {
    try {
      if (streams instanceof Set) {
        for (const stream of streams) {
          try {
            stream.write(`data: ${JSON.stringify({ type: 'server-restart', message: 'Server is restarting, your session will be restored automatically...' })}\n\n`);
            stream.end();
          } catch (_) {}
        }
      } else if (streams && streams.write) {
        streams.write(`data: ${JSON.stringify({ type: 'server-restart', message: 'Server is restarting, your session will be restored automatically...' })}\n\n`);
      }
    } catch (e) {
      // Stream may already be closed, ignore
    }
  }
  activeStreams.clear();
  
  // Kill all tracked child processes
  log('Terminating child processes...');
  for (const [processId, info] of childProcesses.entries()) {
    try {
      process.kill(info.pid, 'SIGTERM');
    } catch (_) {
      // Process may already be dead
    }
  }
  // Give them a moment to terminate gracefully
  await delay(1000);
  // Force kill any remaining
  for (const [processId, info] of childProcesses.entries()) {
    try {
      process.kill(info.pid, 'SIGKILL');
    } catch (_) {}
  }
  childProcesses.clear();
  runningProcesses.clear();
  sessionQueues.clear();
  
  log('Stopping OpenCode process manager...');
  await opencodeManager.stop();
  
  log('Persisting all state with session continuity info...');
  await persistAllState();
  
  if (server) {
    log('Closing HTTP server...');
    await new Promise((resolve) => server.close(resolve));
  }
  
  log('Graceful shutdown complete, sessions preserved for restoration');
  process.exit(0);
}

function startAutoSave() {
  autoSaveTimer = setInterval(async () => {
    if (isShuttingDown) return;
    try {
      await persistAllState();
    } catch (error) {
      log('Auto-save failed', { error: String(error) });
    }
  }, AUTO_SAVE_INTERVAL_MS);
}

function stopAutoSave() {
  if (autoSaveTimer) {
    clearInterval(autoSaveTimer);
    autoSaveTimer = null;
  }
}
let cachedModels = new Map();
let cachedModelsAt = new Map();
const adminSessions = new Map();
let adminModels = [];
let adminModelIndex = new Map();
let openrouterSettings = {
  primaryModel: OPENROUTER_MODEL_PRIMARY,
  backupModel1: OPENROUTER_MODEL_BACKUP_1,
  backupModel2: OPENROUTER_MODEL_BACKUP_2,
  backupModel3: OPENROUTER_MODEL_BACKUP_3,
};
let mistralSettings = {
  primaryModel: MISTRAL_MODEL_PRIMARY,
  backupModel1: MISTRAL_MODEL_BACKUP_1,
  backupModel2: MISTRAL_MODEL_BACKUP_2,
  backupModel3: MISTRAL_MODEL_BACKUP_3,
};
const PLANNING_PROVIDERS = ['openrouter', 'mistral', 'google', 'groq', 'nvidia', 'ollama'];
let planSettings = {
  provider: 'openrouter', // legacy field, retained for backwards compatibility
  freePlanModel: '',
  planningChain: [], // [{ provider, model }]
};
let providerLimits = {
  limits: {},
  modelProviders: {},
  opencodeBackupModel: '',
};
let pendingProviderPersistTimer = null;
let providerUsage = {};
let tokenUsage = {};
let processedTopups = {};
let pendingTopups = {};
let processedPayg = {};
let pendingPayg = {};
let processedSubscriptions = {};
let pendingSubscriptions = {};
let dodoProductCache = {
  fetchedAt: 0,
  items: [],
  byId: new Map(),
};
const userSessions = new Map(); // Track user sessions
let usersDb = []; // In-memory user database cache
let invoicesDb = []; // In-memory invoice database cache
let mailTransport = null;

// Security Rate Limiting Data Structures
const loginAttempts = new Map(); // { email:ip: { count, windowStart, lockedUntil } }
const adminLoginAttempts = new Map(); // { ip: { count, windowStart, lockedUntil } }
const apiRateLimit = new Map(); // { userId: { requests, windowStart } }
const csrfTokens = new Map(); // { token: { userId, expiresAt } }
const affiliateSessions = new Map();
let affiliatesDb = [];
let trackingData = {
  visits: [],
  summary: {
    totalVisits: 0,
    uniqueVisitors: new Set(),
    referrers: {},
    pages: {},
    dailyVisits: {},
    conversions: { signup: 0, paid: 0 },
    financials: { totalRevenue: 0, dailyRevenue: {} },
    referrersToUpgrade: {},
    conversionSources: {
      signup: { home: 0, pricing: 0, other: 0 },
      paid: { home: 0, pricing: 0, other: 0 }
    }
  },
  // Enhanced Analytics Tracking
  userAnalytics: {
    userSessions: {}, // userId: { loginTime, lastActivity, sessionDuration, pageViews, featuresUsed, modelUsage }
    dailyActiveUsers: {}, // date: Set of userIds
    weeklyActiveUsers: {}, // weekKey: Set of userIds  
    monthlyActiveUsers: {}, // monthKey: Set of userIds
    sessionDurations: [], // Array of session durations in seconds
    projectData: {}, // sessionId: { createdAt, completedAt, status, featuresUsed }
    featureUsage: {}, // featureName: usage count
    modelUsage: {}, // modelName: usage count
    exportUsage: {}, // exportType: count
    errorRates: {}, // errorType: count
    retentionCohorts: {}, // cohortMonth: { cohortSize, retention: { 1week: %, 1month: %, 3month: % } }
    conversionFunnels: {}, // funnelName: steps data
    resourceUtilization: {}, // timestamp: { cpu, memory, queueTime }
    queueMetrics: {}, // timestamp: { waitTime, processedCount }
    planUpgradePatterns: {}, // fromPlan: toPlan: count
  },
  businessMetrics: {
    mrr: 0, // Monthly Recurring Revenue
    ltv: 0, // Lifetime Value
    churnRate: 0, // Churn rate percentage
    customerAcquisitionCost: 0,
    averageRevenuePerUser: 0,
    trialConversions: {}, // plan: conversion rate
    upgradeDowngradePatterns: {}, // fromPlan: { toPlan: count }
    featureAdoptionByPlan: {}, // feature: { plan: usage count }
  },
  technicalMetrics: {
    aiResponseTimes: [], // Array of response times
    aiErrorRates: {}, // provider: error rate
    modelSelectionTrends: {}, // time period: model usage
    queueWaitTimes: [], // Array of wait times
    resourceUsage: [], // Array of resource usage snapshots
    systemHealth: {
      uptime: 0,
      errors: 0,
      lastRestart: null
    }
  }
};
let trackingPersistTimer = null;
let featureRequestsDb = [];
let contactMessagesDb = [];

// Security Configuration with Sensible Defaults
const ADMIN_LOGIN_RATE_LIMIT = Number(process.env.ADMIN_LOGIN_RATE_LIMIT || 5); // attempts per minute
const USER_LOGIN_RATE_LIMIT = Number(process.env.USER_LOGIN_RATE_LIMIT || 10);
const API_RATE_LIMIT = Number(process.env.API_RATE_LIMIT || 100); // requests per minute
const MAX_PROMPT_LENGTH = Number(process.env.MAX_PROMPT_LENGTH || 10000);
const LOGIN_LOCKOUT_MS = Number(process.env.LOGIN_LOCKOUT_MS || 900000); // 15 minutes
const RATE_LIMIT_WINDOW_MS = 60000; // 1 minute window

// Admin password hashing
let adminPasswordHash = null;

function log(message, extra) {
  const payload = extra ? `${message} ${JSON.stringify(extra)}` : message;
  console.log(`[${new Date().toISOString()}] ${payload}`);
}

// Lowercase identifiers and collapse unsafe characters into hyphens for safe path segments
function sanitizeSegment(value, fallback = '') {
  if (!value || typeof value !== 'string') return fallback || '';
  const clean = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/-+/g, '-').replace(/^-+|-+$/g, '');
  const safe = clean || fallback || '';
  return safe.slice(0, 120);
}

function sanitizeRedirectPath(rawPath, fallback = '/apps') {
  const value = (rawPath || '').trim();
  if (value && value.startsWith('/') && !value.startsWith('//')) return value;
  return fallback;
}

function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }

function getResourceUsageSnapshot() {
  const mem = process.memoryUsage();
  const load = os.loadavg();
  return {
    rss: mem.rss,
    heapUsed: mem.heapUsed,
    load1: load[0] || 0,
    running: runningProcesses.size,
  };
}

async function waitForResources(reasonId = '') {
  const softMemory = RESOURCE_LIMITS.memoryBytes ? RESOURCE_LIMITS.memoryBytes * RESOURCE_MEMORY_SOFT_RATIO : 0;
  const concurrencyLimit = OPENCODE_MAX_CONCURRENCY > 0
    ? OPENCODE_MAX_CONCURRENCY
    : (RESOURCE_LIMITS.cpuCores > 0 ? Math.max(1, Math.ceil(RESOURCE_LIMITS.cpuCores)) : 2);
  const loadLimit = RESOURCE_LIMITS.cpuCores > 0 ? Math.max(RESOURCE_LIMITS.cpuCores * RESOURCE_CPU_SOFT_RATIO, RESOURCE_MIN_LOAD_FLOOR) : Infinity;
  let lastLog = 0;
  let waitMs = RESOURCE_CHECK_INTERVAL_MS;
  const maxWaitMs = RESOURCE_CHECK_INTERVAL_MS * 8;
  const startTime = Date.now();

  // Messages wait indefinitely for resources - never skip/timeout
  // This ensures no messages are lost due to temporary resource constraints
  while (true) {
    // Attempt memory cleanup if we're under pressure
    const waitTime = Date.now() - startTime;
    if (waitTime > 5000 && waitTime % 10000 < waitMs) {
      // Every ~10 seconds of waiting, try to free memory
      triggerMemoryCleanup('resource_wait');
    }
    
    const usage = getResourceUsageSnapshot();
    const memoryOk = !softMemory || usage.rss < softMemory;
    // Combine active processes and pending reservations so we don't schedule beyond the allowed concurrency.
    const currentActive = usage.running + resourceReservations;
    const projectedConcurrency = currentActive + 1;
    const concurrencyOk = projectedConcurrency <= concurrencyLimit;
    const loadOk = loadLimit === Infinity || usage.load1 <= loadLimit;

    if (memoryOk && concurrencyOk && loadOk) {
      let released = false;
      resourceReservations += 1;
      if (waitTime > 1000) {
        log('resource guard acquired after wait', { reasonId, waitTime, rss: usage.rss });
      }
      // Caller must invoke release; processMessage wraps usage in a finally block to avoid leaks.
      return () => {
        if (released) return;
        released = true;
        resourceReservations = Math.max(0, resourceReservations - 1);
      };
    }

    const now = Date.now();
    if (now - lastLog > RESOURCE_WAIT_LOG_INTERVAL_MS) {
      lastLog = now;
      const reason = !memoryOk ? 'memory_pressure' : (!concurrencyOk ? 'concurrency_limit' : 'cpu_load');
      log('resource guard waiting (message queued)', {
        reasonId,
        reason,
        rss: usage.rss,
        heapUsed: usage.heapUsed,
        load1: usage.load1,
        running: usage.running,
        memoryLimit: RESOURCE_LIMITS.memoryBytes,
        cpuLimit: RESOURCE_LIMITS.cpuCores,
        concurrencyLimit,
        softMemory,
        reservations: resourceReservations,
        waitTime,
        queuedMessages: getQueuedMessageCount()
      });
    }
    await delay(waitMs);
    // Gradually increase wait time to reduce CPU spinning, but cap it
    waitMs = Math.min(maxWaitMs, Math.max(RESOURCE_CHECK_INTERVAL_MS, waitMs * 1.2));
  }
}

// Helper to count queued messages for logging
function getQueuedMessageCount() {
  let count = 0;
  for (const session of state.sessions) {
    if (session.messages) {
      count += session.messages.filter(m => m.status === 'queued' || m.status === 'running').length;
    }
  }
  return count;
}

function resolveBaseUrl(req) {
  if (PUBLIC_BASE_URL) return PUBLIC_BASE_URL.replace(/\/+$/, '');
  const hostHeader = (req && req.headers && req.headers.host) ? req.headers.host : `${HOST}:${PORT}`;
  const proto = (req && req.headers && req.headers['x-forwarded-proto'] === 'https') ? 'https' : 'http';
  return `${proto}://${hostHeader}`;
}

function buildRedirectUri(req, provider) {
  const base = resolveBaseUrl(req);
  const safeProvider = (provider || '').toLowerCase();
  return `${base}/auth/${safeProvider}/callback`;
}

function createOAuthState(next, provider, remember = false) {
  // Clean up expired entries opportunistically
  const now = Date.now();
  for (const [key, entry] of oauthStateStore.entries()) {
    if (entry.expiresAt && entry.expiresAt < now) oauthStateStore.delete(key);
  }
  const state = randomUUID();
  oauthStateStore.set(state, {
    provider: (provider || '').toLowerCase(),
    next: sanitizeRedirectPath(next),
    remember: Boolean(remember),
    expiresAt: now + OAUTH_STATE_TTL_MS,
  });
  return state;
}

function consumeOAuthState(state, provider) {
  if (!state) return null;
  const entry = oauthStateStore.get(state);
  oauthStateStore.delete(state);
  if (!entry) return null;
  if (entry.provider !== (provider || '').toLowerCase()) return null;
  if (entry.expiresAt && entry.expiresAt < Date.now()) return null;
  return entry;
}

function decodeJwtPayload(token) {
  try {
    const parts = token.split('.');
    if (parts.length < 2) return {};
    const payload = Buffer.from(parts[1], 'base64').toString('utf8');
    return JSON.parse(payload);
  } catch (_) {
    return {};
  }
}

function escapeHtml(str) {
  return String(str || '')
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#39;')
    .replace(/`/g, '&#96;')
    .replace(/\//g, '&#47;');
}

// Security: Rate Limiting Functions
function checkLoginRateLimit(key, maxAttempts, attemptsMap) {
  const now = Date.now();
  const record = attemptsMap.get(key) || { count: 0, windowStart: now, lockedUntil: null };

  // Check if locked out
  if (record.lockedUntil && record.lockedUntil > now) {
    return { blocked: true, locked: true, retryAfter: Math.ceil((record.lockedUntil - now) / 1000) };
  }

  // Reset window if expired
  if (now - record.windowStart > RATE_LIMIT_WINDOW_MS) {
    record.count = 0;
    record.windowStart = now;
  }

  record.count++;

  // Lock out if too many attempts
  if (record.count > maxAttempts) {
    record.lockedUntil = now + LOGIN_LOCKOUT_MS;
    log('account locked due to failed attempts', { key, attempts: record.count });
  }

  attemptsMap.set(key, record);

  return {
    blocked: record.count > maxAttempts,
    locked: false,
    attempts: record.count,
    remaining: Math.max(0, maxAttempts - record.count)
  };
}

function checkApiRateLimit(userId, maxRequests = API_RATE_LIMIT) {
  const now = Date.now();
  const record = apiRateLimit.get(userId) || { requests: 0, windowStart: now };

  if (now - record.windowStart > RATE_LIMIT_WINDOW_MS) {
    record.requests = 0;
    record.windowStart = now;
  }

  record.requests++;
  apiRateLimit.set(userId, record);

  const remaining = Math.max(0, maxRequests - record.requests);
  const resetIn = Math.ceil((record.windowStart + RATE_LIMIT_WINDOW_MS - now) / 1000);

  return {
    limited: record.requests > maxRequests,
    remaining,
    resetIn,
    limit: maxRequests
  };
}

function sendRateLimitExceeded(res, retryAfter = 60, limit = API_RATE_LIMIT) {
  res.writeHead(429, {
    'Content-Type': 'application/json',
    'Retry-After': retryAfter,
    'X-RateLimit-Limit': limit,
    'X-RateLimit-Remaining': '0',
    'X-RateLimit-Reset': retryAfter
  });
  res.end(JSON.stringify({
    error: 'Rate limit exceeded',
    message: 'Too many requests. Please try again later.',
    retryAfter,
    limit
  }));
}

// Security: CSRF Token Functions
function generateCsrfToken(userId) {
  const token = randomUUID();
  csrfTokens.set(token, { userId, expiresAt: Date.now() + 3600000 }); // 1 hour
  return token;
}

function validateCsrfToken(token, userId) {
  const record = csrfTokens.get(token);
  if (!record) return false;
  if (record.expiresAt < Date.now()) return false;
  if (record.userId !== userId) return false;
  return true;
}

// Security: Honeypot Detection
function checkHoneypot(body) {
  return !!(body.website && body.website.length > 0);
}

// Security: Prompt Injection Protection
function sanitizePromptInput(input) {
  if (!input || typeof input !== 'string') return '';

  const patterns = [
    /ignore\s+previous\s+instructions/gi,
    /system\s*:/gi,
    /assistant\s*:/gi,
    /role\s*=\s*["']?system["']?/gi,
    /{{[^}]*}}/g,
    /```\s*ignore/gi,
    /\0/g,
    /eval\s*\(/gi,
    /exec\s*\(/gi,
    /process\./gi,
  ];

  let result = input;
  for (const pattern of patterns) {
    result = result.replace(pattern, '[FILTERED]');
  }

  return result.slice(0, MAX_PROMPT_LENGTH).trim();
}

// Security: Output Validation
function sanitizeAiOutput(output) {
  if (!output || typeof output !== 'string') return '';

  const patterns = [
    /api[_-]?key["']?\s*[:=]\s*["']?[a-zA-Z0-9_-]{20,}["']?/gi,
    /password["']?\s*[:=]\s*["']?[^"'\s]{8,}["']?/gi,
    /Bearer\s+[a-zA-Z0-9\-\._~\+\/]+=*/gi,
    /AWS_ACCESS_KEY_ID[^\s]*/gi,
    /AWS_SECRET_ACCESS_KEY[^\s]*/gi,
  ];

  let result = output;
  for (const pattern of patterns) {
    result = result.replace(pattern, '[REDACTED]');
  }

  return result;
}

// Security: Password Validation
function validatePassword(password) {
  const errors = [];
  if (!password || password.length < 12) errors.push('Minimum 12 characters');
  if (!/[A-Z]/.test(password)) errors.push('Uppercase letter required');
  if (!/[a-z]/.test(password)) errors.push('Lowercase letter required');
  if (!/[0-9]/.test(password)) errors.push('Number required');
  if (!/[!@#$%^&*(),.?":{}|<>]/.test(password)) errors.push('Special character required');
  return { valid: errors.length === 0, errors };
}

// Security: Git Action Validation
const VALID_GIT_ACTIONS = new Set(['pull', 'push', 'sync', 'status', 'log', 'fetch', 'commit', 'checkout', 'branch', 'init', 'clone', 'add', 'reset', 'restore']);

function validateGitAction(action) {
  return VALID_GIT_ACTIONS.has(action?.toLowerCase());
}

// Security: Model Validation
const ALLOWED_MODELS = new Set();

function isModelAllowed(model) {
  if (!model) return false;
  if (ALLOWED_MODELS.has(model)) return true;
  if (getAdminModelByIdOrName(model)) return true;
  return false;
}

// Security: Host Header Validation
function validateHostHeader(host) {
  if (!host || typeof host !== 'string') return false;
  if (host.length > 256) return false;
  const validPattern = /^([a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:\d+)?$/;
  return validPattern.test(host);
}

// Security: User Agent Validation
const SUSPICIOUS_USER_AGENTS = [
  /bot/i, /crawler/i, /spider/i, /curl/i, /wget/i, /python/i,
  /httpclient/i, /java\//i, /libwww/i, /lwp/i, /fetch/i
];

function isSuspiciousUserAgent(ua) {
  if (!ua) return true;
  return SUSPICIOUS_USER_AGENTS.some(pattern => pattern.test(ua));
}

// Security: Git Commit Message Sanitization
function sanitizeGitMessage(message) {
  if (!message || typeof message !== 'string') return '';
  return message
    .replace(/[\r\n]/g, ' ')
    .replace(/[^a-zA-Z0-9\s\-_.,!?'"()[\]{}@#$%^&*+=\\/]/g, '')
    .slice(0, 500)
    .trim();
}

function summarizeMailConfig() {
  return {
    hostConfigured: !!SMTP_HOST,
    portConfigured: Number.isFinite(SMTP_PORT) && SMTP_PORT > 0,
    secure: SMTP_SECURE,
    hasUser: !!SMTP_USER,
    hasPass: !!SMTP_PASS,
    fromConfigured: !!SMTP_FROM,
  };
}

function readUserIdFromCookie(req) {
  try {
    const cookieHeader = req?.headers?.cookie || '';
    if (!cookieHeader) return '';
    const parts = cookieHeader.split(';').map((p) => p.trim());
    const match = parts.find((p) => p.startsWith('chat_user='));
    if (!match) return '';
    // slice/join preserves cookie values that legitimately contain '=' characters
    const raw = match.split('=').slice(1).join('=') || '';
    return decodeURIComponent(raw);
  } catch (_) {
    return '';
  }
}

function resolveUserId(req, url) {
  // First try the new user session system
  const userSession = getUserSession(req);
  if (userSession && userSession.userId) {
    return userSession.userId;
  }

  // Fall back to the old system for backwards compatibility
  const cookieUser = readUserIdFromCookie(req);
  const headerUser = (req?.headers?.['x-user-id'] || req?.headers?.['x-user'] || req?.headers?.['x-user-email'] || '').toString();
  const resolved = cookieUser || headerUser;
  const sanitized = sanitizeSegment(resolved, '');
  return sanitized;
}

function requireUserId(req, res, url) {
  const userId = resolveUserId(req, url);
  if (!userId) {
    sendJson(res, 401, { error: 'User identity required' });
    return null;
  }
  return userId;
}

function readAdminSessionToken(req) {
  try {
    const cookieHeader = req?.headers?.cookie || '';
    if (!cookieHeader) return '';
    const parts = cookieHeader.split(';').map((p) => p.trim());
    const match = parts.find((p) => p.startsWith(`${ADMIN_COOKIE_NAME}=`));
    if (!match) return '';
    return decodeURIComponent(match.split('=').slice(1).join('=') || '');
  } catch (_) {
    return '';
  }
}

function getAdminSession(req) {
  const token = readAdminSessionToken(req);
  if (!token) return null;
  const session = adminSessions.get(token);
  if (!session) return null;
  if (session.expiresAt && session.expiresAt < Date.now()) {
    adminSessions.delete(token);
    return null;
  }
  return { token, expiresAt: session.expiresAt };
}

function startAdminSession(res) {
  const token = randomUUID();
  const expiresAt = Date.now() + ADMIN_SESSION_TTL_MS;
  adminSessions.set(token, { expiresAt });
  const parts = [
    `${ADMIN_COOKIE_NAME}=${encodeURIComponent(token)}`,
    'Path=/',
    'HttpOnly',
    'SameSite=Lax',
    `Max-Age=${Math.floor(ADMIN_SESSION_TTL_MS / 1000)}`,
  ];
  if (process.env.COOKIE_SECURE === '0') parts.push('Secure');
  res.setHeader('Set-Cookie', parts.join('; '));
  return token;
}

function clearAdminSession(res) {
  res.setHeader('Set-Cookie', `${ADMIN_COOKIE_NAME}=deleted; Path=/; Max-Age=0; SameSite=Lax`);
}

function requireAdminAuth(req, res) {
  const session = getAdminSession(req);
  if (!session) {
    sendJson(res, 401, { error: 'Admin login required' });
    return null;
  }
  return session;
}

// User authentication functions
async function loadUsersDb() {
  let shouldPersist = false;
  try {
    await ensureStateFile();
    await fs.access(USERS_DB_FILE);
    const raw = await fs.readFile(USERS_DB_FILE, 'utf8');
    const parsed = JSON.parse(raw || '[]');
    const rawUsers = Array.isArray(parsed) ? parsed : [];
    usersDb = rawUsers.map((user) => {
      const verification = normalizeVerificationState(user);
      if (verification.shouldPersist) shouldPersist = true;
      const normalizedPlan = normalizePlanSelection(user?.plan) || DEFAULT_PLAN;
      return {
        ...user,
        providers: Array.isArray(user?.providers) ? user.providers : [],
        emailVerified: verification.verified,
        verificationToken: verification.verificationToken,
        verificationExpiresAt: verification.verificationExpiresAt,
        resetToken: user?.resetToken || '',
        resetExpiresAt: user?.resetExpiresAt || null,
        plan: normalizedPlan,
        billingStatus: user?.billingStatus || DEFAULT_BILLING_STATUS,
        billingEmail: user?.billingEmail || user?.email || '',
        paymentMethodLast4: user?.paymentMethodLast4 || '',
        subscriptionRenewsAt: user?.subscriptionRenewsAt || null,
        referredByAffiliateCode: sanitizeAffiliateCode(user?.referredByAffiliateCode),
        affiliateAttributionAt: user?.affiliateAttributionAt || null,
        affiliatePayouts: Array.isArray(user?.affiliatePayouts)
          ? user.affiliatePayouts.map((p) => normalizePlanSelection(p)).filter(Boolean)
          : [],
      };
    });
    if (shouldPersist) {
      await persistUsersDb();
    }
    log('Loaded users database', { count: usersDb.length });
  } catch (error) {
    usersDb = [];
    log('Failed to load users database, starting fresh', { error: String(error) });
  }
}

async function persistUsersDb() {
  await ensureStateFile();
  const payload = JSON.stringify(usersDb, null, 2);
  await safeWriteFile(USERS_DB_FILE, payload);
}

async function loadUserSessions() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(USER_SESSIONS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw || '{}');
      const now = Date.now();
      for (const [token, session] of Object.entries(parsed)) {
        if (session.expiresAt && session.expiresAt > now) {
          userSessions.set(token, session);
        }
      }
      log('Loaded user sessions', { count: userSessions.size });
    }
  } catch (error) {
    log('Failed to load user sessions, starting fresh', { error: String(error) });
  }
}

async function persistUserSessions() {
  await ensureStateFile();
  const now = Date.now();
  const sessions = {};
  for (const [token, session] of userSessions.entries()) {
    if (session.expiresAt && session.expiresAt > now) {
      sessions[token] = session;
    }
  }
  const payload = JSON.stringify(sessions, null, 2);
  await safeWriteFile(USER_SESSIONS_FILE, payload);
}

function sanitizeAffiliateCode(code) {
  return (code || '').toString().trim().toLowerCase().replace(/[^a-z0-9\-]/g, '').slice(0, 32);
}

async function loadAffiliatesDb() {
  try {
    await ensureStateFile();
    let raw = '[]';
    try {
      raw = await fs.readFile(AFFILIATES_FILE, 'utf8');
    } catch (_) { /* new file */ }
    const parsed = JSON.parse(raw || '[]');
    affiliatesDb = Array.isArray(parsed) ? parsed.map((a) => ({
      ...a,
      codes: Array.isArray(a?.codes) && a.codes.length ? a.codes.map((c) => ({
        code: sanitizeAffiliateCode(c.code || c.id || c.slug || ''),
        label: c.label || 'Tracking link',
        createdAt: c.createdAt || a.createdAt || new Date().toISOString(),
      })).filter((c) => c.code) : [],
      earnings: Array.isArray(a?.earnings) ? a.earnings : [],
      commissionRate: Number.isFinite(a?.commissionRate) ? a.commissionRate : AFFILIATE_COMMISSION_RATE,
    })) : [];
    let changed = false;
    for (const affiliate of affiliatesDb) {
      if (!affiliate.codes || !affiliate.codes.length) {
        const fallbackCode = generateTrackingCode();
        affiliate.codes = [{
          code: fallbackCode,
          label: 'Default link',
          createdAt: affiliate.createdAt || new Date().toISOString(),
        }];
        changed = true;
      }
    }
    if (changed) await persistAffiliatesDb();
    log('Loaded affiliates database', { count: affiliatesDb.length });
  } catch (error) {
    affiliatesDb = [];
    log('Failed to load affiliates database, starting fresh', { error: String(error) });
  }
}

async function persistAffiliatesDb() {
  await ensureStateFile();
  const payload = JSON.stringify(affiliatesDb, null, 2);
  await safeWriteFile(AFFILIATES_FILE, payload);
}

// Withdrawals database
let withdrawalsDb = [];

async function loadWithdrawalsDb() {
  try {
    await ensureStateFile();
    let raw = '[]';
    try {
      raw = await fs.readFile(WITHDRAWALS_FILE, 'utf8');
    } catch (_) { /* new file */ }
    withdrawalsDb = Array.isArray(JSON.parse(raw || '[]')) ? JSON.parse(raw || '[]') : [];
    log('Loaded withdrawals database', { count: withdrawalsDb.length });
  } catch (error) {
    withdrawalsDb = [];
    log('Failed to load withdrawals database, starting fresh', { error: String(error) });
  }
}

async function persistWithdrawalsDb() {
  await ensureStateFile();
  const payload = JSON.stringify(withdrawalsDb, null, 2);
  await safeWriteFile(WITHDRAWALS_FILE, payload);
}

// Feature Requests functions
async function loadFeatureRequestsDb() {
  try {
    await ensureStateFile();
    let raw = '[]';
    try {
      raw = await fs.readFile(FEATURE_REQUESTS_FILE, 'utf8');
    } catch (_) { /* new file */ }
    const parsed = JSON.parse(raw || '[]');
    featureRequestsDb = Array.isArray(parsed) ? parsed : [];
    log('Loaded feature requests database', { count: featureRequestsDb.length });
  } catch (error) {
    featureRequestsDb = [];
    log('Failed to load feature requests database, starting fresh', { error: String(error) });
  }
}

async function persistFeatureRequestsDb() {
  await ensureStateFile();
  const payload = JSON.stringify(featureRequestsDb, null, 2);
  await safeWriteFile(FEATURE_REQUESTS_FILE, payload);
}

async function loadContactMessagesDb() {
  let contactMessagesDb = [];
  try {
    await ensureStateFile();
    let raw = '[]';
    try {
      raw = await fs.readFile(CONTACT_MESSAGES_FILE, 'utf8');
    } catch (_) { /* new file */ }
    const parsed = JSON.parse(raw || '[]');
    contactMessagesDb = Array.isArray(parsed) ? parsed : [];
    log('Loaded contact messages database', { count: contactMessagesDb.length });
  } catch (error) {
    contactMessagesDb = [];
    log('Failed to load contact messages database, starting fresh', { error: String(error) });
  }
  return contactMessagesDb;
}

async function persistContactMessagesDb() {
  await ensureStateFile();
  const payload = JSON.stringify(contactMessagesDb, null, 2);
  await safeWriteFile(CONTACT_MESSAGES_FILE, payload);
}

// Tracking functions
async function loadTrackingData() {
  try {
    await fs.access(TRACKING_FILE);
    const raw = await fs.readFile(TRACKING_FILE, 'utf8');
    const parsed = JSON.parse(raw);
    
    // Convert dailyVisits uniqueVisitors arrays back to Sets
    const dailyVisits = parsed.summary?.dailyVisits || {};
    for (const dateKey in dailyVisits) {
      if (dailyVisits[dateKey]) {
        // Convert array to Set, or create empty Set if missing
        dailyVisits[dateKey].uniqueVisitors = new Set(dailyVisits[dateKey].uniqueVisitors || []);
      }
    }

    // Convert user analytics Sets back to Sets
    const userAnalytics = parsed.userAnalytics || {};
    
    // Convert DAU/WAU/MAU Sets back to Sets
    for (const dateKey in userAnalytics.dailyActiveUsers || {}) {
      userAnalytics.dailyActiveUsers[dateKey] = new Set(userAnalytics.dailyActiveUsers[dateKey] || []);
    }
    for (const weekKey in userAnalytics.weeklyActiveUsers || {}) {
      userAnalytics.weeklyActiveUsers[weekKey] = new Set(userAnalytics.weeklyActiveUsers[weekKey] || []);
    }
    for (const monthKey in userAnalytics.monthlyActiveUsers || {}) {
      userAnalytics.monthlyActiveUsers[monthKey] = new Set(userAnalytics.monthlyActiveUsers[monthKey] || []);
    }

    trackingData = {
      visits: Array.isArray(parsed.visits) ? parsed.visits : [],
      summary: {
        totalVisits: parsed.summary?.totalVisits || 0,
        uniqueVisitors: new Set(parsed.summary?.uniqueVisitors || []),
        referrers: parsed.summary?.referrers || {},
        pages: parsed.summary?.pages || {},
        dailyVisits: dailyVisits,
        conversions: parsed.summary?.conversions || { signup: 0, paid: 0 },
        financials: parsed.summary?.financials || { totalRevenue: 0, dailyRevenue: {} },
        referrersToUpgrade: parsed.summary?.referrersToUpgrade || {},
        conversionSources: parsed.summary?.conversionSources || {
          signup: { home: 0, pricing: 0, other: 0 },
          paid: { home: 0, pricing: 0, other: 0 }
        }
      },
      userAnalytics: {
        userSessions: userAnalytics.userSessions || {},
        dailyActiveUsers: userAnalytics.dailyActiveUsers || {},
        weeklyActiveUsers: userAnalytics.weeklyActiveUsers || {},
        monthlyActiveUsers: userAnalytics.monthlyActiveUsers || {},
        sessionDurations: Array.isArray(userAnalytics.sessionDurations) ? userAnalytics.sessionDurations : [],
        projectData: userAnalytics.projectData || {},
        featureUsage: userAnalytics.featureUsage || {},
        modelUsage: userAnalytics.modelUsage || {},
        exportUsage: userAnalytics.exportUsage || {},
        errorRates: userAnalytics.errorRates || {},
        retentionCohorts: userAnalytics.retentionCohorts || {},
        conversionFunnels: userAnalytics.conversionFunnels || {},
        resourceUtilization: userAnalytics.resourceUtilization || {},
        queueMetrics: userAnalytics.queueMetrics || {},
        planUpgradePatterns: userAnalytics.planUpgradePatterns || {},
      },
      businessMetrics: {
        mrr: parsed.businessMetrics?.mrr || 0,
        ltv: parsed.businessMetrics?.ltv || 0,
        churnRate: parsed.businessMetrics?.churnRate || 0,
        customerAcquisitionCost: parsed.businessMetrics?.customerAcquisitionCost || 0,
        averageRevenuePerUser: parsed.businessMetrics?.averageRevenuePerUser || 0,
        trialConversions: parsed.businessMetrics?.trialConversions || {},
        upgradeDowngradePatterns: parsed.businessMetrics?.upgradeDowngradePatterns || {},
        featureAdoptionByPlan: parsed.businessMetrics?.featureAdoptionByPlan || {},
      },
      technicalMetrics: {
        aiResponseTimes: Array.isArray(parsed.technicalMetrics?.aiResponseTimes) ? parsed.technicalMetrics.aiResponseTimes : [],
        aiErrorRates: parsed.technicalMetrics?.aiErrorRates || {},
        modelSelectionTrends: parsed.technicalMetrics?.modelSelectionTrends || {},
        queueWaitTimes: Array.isArray(parsed.technicalMetrics?.queueWaitTimes) ? parsed.technicalMetrics.queueWaitTimes : [],
        resourceUsage: Array.isArray(parsed.technicalMetrics?.resourceUsage) ? parsed.technicalMetrics.resourceUsage : [],
        systemHealth: parsed.technicalMetrics?.systemHealth || {
          uptime: 0,
          errors: 0,
          lastRestart: null
        }
      }
    };
    log('Loaded tracking data', { 
      totalVisits: trackingData.summary.totalVisits,
      uniqueVisitors: trackingData.summary.uniqueVisitors.size,
      userAnalytics: Object.keys(trackingData.userAnalytics.userSessions).length
    });
  } catch (error) {
    // Initialize with default structure
    trackingData = {
      visits: [],
      summary: {
        totalVisits: 0,
        uniqueVisitors: new Set(),
        referrers: {},
        pages: {},
        dailyVisits: {},
        conversions: { signup: 0, paid: 0 },
        financials: { totalRevenue: 0, dailyRevenue: {} },
        referrersToUpgrade: {},
        conversionSources: {
          signup: { home: 0, pricing: 0, other: 0 },
          paid: { home: 0, pricing: 0, other: 0 }
        }
      },
      userAnalytics: {
        userSessions: {},
        dailyActiveUsers: {},
        weeklyActiveUsers: {},
        monthlyActiveUsers: {},
        sessionDurations: [],
        projectData: {},
        featureUsage: {},
        modelUsage: {},
        exportUsage: {},
        errorRates: {},
        retentionCohorts: {},
        conversionFunnels: {},
        resourceUtilization: {},
        queueMetrics: {},
        planUpgradePatterns: {},
      },
      businessMetrics: {
        mrr: 0,
        ltv: 0,
        churnRate: 0,
        customerAcquisitionCost: 0,
        averageRevenuePerUser: 0,
        trialConversions: {},
        upgradeDowngradePatterns: {},
        featureAdoptionByPlan: {},
      },
      technicalMetrics: {
        aiResponseTimes: [],
        aiErrorRates: {},
        modelSelectionTrends: {},
        queueWaitTimes: [],
        resourceUsage: [],
        systemHealth: {
          uptime: 0,
          errors: 0,
          lastRestart: null
        }
      }
    };
    log('Failed to load tracking data, starting fresh', { error: String(error) });
  }
}

async function persistTrackingData() {
  await ensureStateFile();
  
  // Convert dailyVisits Sets to arrays for JSON serialization
  const serializedDailyVisits = {};
  for (const dateKey in trackingData.summary.dailyVisits) {
    const dayData = trackingData.summary.dailyVisits[dateKey];
    serializedDailyVisits[dateKey] = {
      count: dayData.count,
      uniqueVisitors: Array.from(dayData.uniqueVisitors || [])
    };
  }

  // Convert user analytics Sets to arrays for JSON serialization
  const serializedUserAnalytics = {
    userSessions: trackingData.userAnalytics.userSessions,
    dailyActiveUsers: {},
    weeklyActiveUsers: {},
    monthlyActiveUsers: {},
    sessionDurations: trackingData.userAnalytics.sessionDurations,
    projectData: trackingData.userAnalytics.projectData,
    featureUsage: trackingData.userAnalytics.featureUsage,
    modelUsage: trackingData.userAnalytics.modelUsage,
    exportUsage: trackingData.userAnalytics.exportUsage,
    errorRates: trackingData.userAnalytics.errorRates,
    retentionCohorts: trackingData.userAnalytics.retentionCohorts,
    conversionFunnels: trackingData.userAnalytics.conversionFunnels,
    resourceUtilization: trackingData.userAnalytics.resourceUtilization,
    queueMetrics: trackingData.userAnalytics.queueMetrics,
    planUpgradePatterns: trackingData.userAnalytics.planUpgradePatterns,
  };

  // Convert DAU/WAU/MAU Sets to arrays
  for (const dateKey in trackingData.userAnalytics.dailyActiveUsers) {
    serializedUserAnalytics.dailyActiveUsers[dateKey] = Array.from(trackingData.userAnalytics.dailyActiveUsers[dateKey] || []);
  }
  for (const weekKey in trackingData.userAnalytics.weeklyActiveUsers) {
    serializedUserAnalytics.weeklyActiveUsers[weekKey] = Array.from(trackingData.userAnalytics.weeklyActiveUsers[weekKey] || []);
  }
  for (const monthKey in trackingData.userAnalytics.monthlyActiveUsers) {
    serializedUserAnalytics.monthlyActiveUsers[monthKey] = Array.from(trackingData.userAnalytics.monthlyActiveUsers[monthKey] || []);
  }
  
  const payload = {
    visits: trackingData.visits.slice(-10000), // Keep last 10k visits
    summary: {
      totalVisits: trackingData.summary.totalVisits,
      uniqueVisitors: Array.from(trackingData.summary.uniqueVisitors),
      referrers: trackingData.summary.referrers,
      pages: trackingData.summary.pages,
      dailyVisits: serializedDailyVisits,
      conversions: trackingData.summary.conversions,
      financials: trackingData.summary.financials,
      referrersToUpgrade: trackingData.summary.referrersToUpgrade,
      conversionSources: trackingData.summary.conversionSources
    },
    userAnalytics: serializedUserAnalytics,
    businessMetrics: trackingData.businessMetrics,
    technicalMetrics: trackingData.technicalMetrics
  };
  await safeWriteFile(TRACKING_FILE, JSON.stringify(payload, null, 2));
}

function scheduleTrackingPersist() {
  if (trackingPersistTimer) clearTimeout(trackingPersistTimer);
  trackingPersistTimer = setTimeout(async () => {
    try {
      await persistTrackingData();
    } catch (error) {
      log('Failed to persist tracking data', { error: String(error) });
    }
  }, TRACKING_PERSIST_INTERVAL_MS);
}

function sanitizeUrl(urlString) {
  // Fix malformed URLs with double slashes or other common issues
  if (!urlString || urlString === '') return '/';
  
  // Fix URLs starting with '//' which creates ambiguous protocol-relative URLs
  if (urlString.startsWith('//')) {
    return urlString.slice(1);
  }
  
  return urlString;
}

function trackVisit(req, res) {
  try {
    let pathname;
    try {
      // Sanitize URL before parsing
      const urlString = sanitizeUrl(req.url);
      pathname = new URL(urlString, 'http://localhost').pathname;
    } catch (urlError) {
      // If URL parsing fails, skip tracking
      log('Tracking skipped - invalid URL', { url: req.url, error: String(urlError) });
      return;
    }
    
    // Skip tracking for static assets, API calls, and admin pages
    if (
      pathname.startsWith('/assets/') ||
      pathname.startsWith('/api/') ||
      pathname.startsWith('/admin/') ||
      pathname.match(/\.(css|js|png|jpg|jpeg|gif|svg|ico|woff|woff2|ttf|map|txt|pdf|xml|json)$/i)
    ) {
      return;
    }

    const referrer = req.headers.referer || req.headers.referrer || 'direct';
    const userAgent = req.headers['user-agent'] || 'unknown';
    const ip = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
               req.headers['x-real-ip'] || 
               req.socket.remoteAddress || 
               'unknown';
    
    // Check if we should count this as a new session visit
    const visitSession = readCookieValue(req, 'v_session');
    const isNewSession = !visitSession;
    if (isNewSession && res) {
      const sessionToken = randomUUID();
      const parts = [
        `v_session=${sessionToken}`,
        'Path=/',
        'Max-Age=1800',
        'SameSite=Lax'
      ];
      if (process.env.COOKIE_SECURE !== '0') parts.push('Secure');
      res.setHeader('Set-Cookie', parts.join('; '));
      
      // Store landing info for conversion tracking
      const landingInfo = {
        landingPage: pathname,
        originalReferrer: referrer,
        timestamp: new Date().toISOString()
      };
      res.setHeader('Set-Cookie', `v_landing=${encodeURIComponent(JSON.stringify(landingInfo))}; Path=/; Max-Age=86400; SameSite=Lax`);
    }

    const visit = {
      timestamp: new Date().toISOString(),
      path: pathname,
      referrer: referrer,
      userAgent: userAgent,
      ip: ip
    };

    // Add to visits array
    trackingData.visits.push(visit);

    // Update summary
    if (isNewSession) {
      trackingData.summary.totalVisits += 1;
    }
    trackingData.summary.uniqueVisitors.add(ip);

    // Track referrer
    const referrerDomain = getReferrerDomain(referrer);
    trackingData.summary.referrers[referrerDomain] = (trackingData.summary.referrers[referrerDomain] || 0) + 1;

    // Track pages
    trackingData.summary.pages[pathname] = (trackingData.summary.pages[pathname] || 0) + 1;
    
    // Track referrers to upgrade/pricing page
    if (pathname === '/upgrade.html' || pathname === '/pricing.html' || pathname === '/select-plan.html') {
      trackingData.summary.referrersToUpgrade[referrerDomain] = (trackingData.summary.referrersToUpgrade[referrerDomain] || 0) + 1;
    }

    // Track daily visits
    const dateKey = new Date().toISOString().split('T')[0];
    if (!trackingData.summary.dailyVisits[dateKey]) {
      trackingData.summary.dailyVisits[dateKey] = {
        count: 0,
        uniqueVisitors: new Set()
      };
    }
    if (isNewSession) {
      trackingData.summary.dailyVisits[dateKey].count += 1;
    }
    trackingData.summary.dailyVisits[dateKey].uniqueVisitors.add(ip);

    scheduleTrackingPersist();
  } catch (error) {
    // Silent fail - tracking should not break the app
    log('Tracking error', { error: String(error) });
  }
}

function trackConversion(type, req) {
  try {
    if (!trackingData.summary.conversions) {
      trackingData.summary.conversions = { signup: 0, paid: 0 };
    }
    if (!trackingData.summary.conversions[type]) {
      trackingData.summary.conversions[type] = 0;
    }
    trackingData.summary.conversions[type] += 1;
    
    // Track source
    const landingInfoRaw = readCookieValue(req, 'v_landing');
    let source = 'other';
    if (landingInfoRaw) {
      try {
        const landingInfo = JSON.parse(decodeURIComponent(landingInfoRaw));
        if (landingInfo.landingPage === '/' || landingInfo.landingPage === '/home.html') source = 'home';
        else if (landingInfo.landingPage === '/pricing.html') source = 'pricing';
      } catch (_) {}
    }
    
    if (!trackingData.summary.conversionSources) {
      trackingData.summary.conversionSources = {
        signup: { home: 0, pricing: 0, other: 0 },
        paid: { home: 0, pricing: 0, other: 0 }
      };
    }
    if (!trackingData.summary.conversionSources[type]) {
      trackingData.summary.conversionSources[type] = { home: 0, pricing: 0, other: 0 };
    }
    trackingData.summary.conversionSources[type][source] += 1;
    
    scheduleTrackingPersist();
  } catch (error) {
    log('Conversion tracking error', { error: String(error) });
  }
}

function trackFinancial(amount, plan = 'unknown') {
  try {
    if (!trackingData.summary.financials) {
      trackingData.summary.financials = { totalRevenue: 0, dailyRevenue: {} };
    }
    const val = Number(amount) || 0;
    trackingData.summary.financials.totalRevenue += val;

    const dateKey = new Date().toISOString().split('T')[0];
    if (!trackingData.summary.financials.dailyRevenue[dateKey]) {
      trackingData.summary.financials.dailyRevenue[dateKey] = 0;
    }
    trackingData.summary.financials.dailyRevenue[dateKey] += val;

    scheduleTrackingPersist();
  } catch (error) {
    log('Financial tracking error', { error: String(error) });
  }
}

// Enhanced Analytics Tracking Functions
function trackUserSession(userId, action = 'login', data = {}) {
  try {
    if (!trackingData.userAnalytics.userSessions[userId]) {
      trackingData.userAnalytics.userSessions[userId] = {
        loginTime: null,
        lastActivity: null,
        sessionDuration: 0,
        pageViews: [],
        featuresUsed: {},
        modelUsage: {},
        projectCount: 0,
        exports: 0,
        errors: 0
      };
    }

    const session = trackingData.userAnalytics.userSessions[userId];
    const now = Date.now();

    switch (action) {
      case 'login':
        session.loginTime = now;
        session.lastActivity = now;
        break;
      case 'activity':
        session.lastActivity = now;
        if (data.page) session.pageViews.push({ path: data.page, timestamp: now });
        if (data.feature) {
          session.featuresUsed[data.feature] = (session.featuresUsed[data.feature] || 0) + 1;
        }
        if (data.model) {
          session.modelUsage[data.model] = (session.modelUsage[data.model] || 0) + 1;
        }
        break;
      case 'logout':
        if (session.loginTime) {
          session.sessionDuration = now - session.loginTime;
          trackingData.userAnalytics.sessionDurations.push(session.sessionDuration / 1000); // Store in seconds
        }
        break;
      case 'project_created':
        session.projectCount += 1;
        if (data.sessionId) {
          trackingData.userAnalytics.projectData[data.sessionId] = {
            createdAt: now,
            completedAt: null,
            status: 'created',
            featuresUsed: session.featuresUsed,
            plan: data.plan || 'unknown'
          };
        }
        break;
      case 'project_completed':
        if (data.sessionId && trackingData.userAnalytics.projectData[data.sessionId]) {
          trackingData.userAnalytics.projectData[data.sessionId].completedAt = now;
          trackingData.userAnalytics.projectData[data.sessionId].status = 'completed';
        }
        break;
      case 'export':
        session.exports += 1;
        const exportType = data.exportType || 'unknown';
        trackingData.userAnalytics.exportUsage[exportType] = (trackingData.userAnalytics.exportUsage[exportType] || 0) + 1;
        break;
      case 'error':
        session.errors += 1;
        const errorType = data.errorType || 'unknown';
        trackingData.userAnalytics.errorRates[errorType] = (trackingData.userAnalytics.errorRates[errorType] || 0) + 1;
        break;
    }

    // Update DAU/WAU/MAU
    updateActiveUsers(userId);
    
    scheduleTrackingPersist();
  } catch (error) {
    log('User session tracking error', { userId, action, error: String(error) });
  }
}

function updateActiveUsers(userId) {
  const now = new Date();
  const dateKey = now.toISOString().split('T')[0];
  const weekKey = `${now.getFullYear()}-W${Math.ceil((now.getDate() + now.getDay()) / 7)}`;
  const monthKey = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}`;

  // Initialize if needed
  if (!trackingData.userAnalytics.dailyActiveUsers[dateKey]) {
    trackingData.userAnalytics.dailyActiveUsers[dateKey] = new Set();
  }
  if (!trackingData.userAnalytics.weeklyActiveUsers[weekKey]) {
    trackingData.userAnalytics.weeklyActiveUsers[weekKey] = new Set();
  }
  if (!trackingData.userAnalytics.monthlyActiveUsers[monthKey]) {
    trackingData.userAnalytics.monthlyActiveUsers[monthKey] = new Set();
  }

  // Add user to all periods
  trackingData.userAnalytics.dailyActiveUsers[dateKey].add(userId);
  trackingData.userAnalytics.weeklyActiveUsers[weekKey].add(userId);
  trackingData.userAnalytics.monthlyActiveUsers[monthKey].add(userId);
}

function trackFeatureUsage(featureName, userId = null, plan = 'unknown') {
  try {
    trackingData.userAnalytics.featureUsage[featureName] = (trackingData.userAnalytics.featureUsage[featureName] || 0) + 1;
    
    // Track feature adoption by plan
    if (!trackingData.businessMetrics.featureAdoptionByPlan[featureName]) {
      trackingData.businessMetrics.featureAdoptionByPlan[featureName] = {};
    }
    trackingData.businessMetrics.featureAdoptionByPlan[featureName][plan] = 
      (trackingData.businessMetrics.featureAdoptionByPlan[featureName][plan] || 0) + 1;

    scheduleTrackingPersist();
  } catch (error) {
    log('Feature usage tracking error', { featureName, error: String(error) });
  }
}

function trackModelUsage(modelName, userId = null, plan = 'unknown') {
  try {
    trackingData.userAnalytics.modelUsage[modelName] = (trackingData.userAnalytics.modelUsage[modelName] || 0) + 1;
    
    // Track model selection trends over time
    const timeKey = new Date().toISOString().slice(0, 7); // YYYY-MM format
    if (!trackingData.technicalMetrics.modelSelectionTrends[timeKey]) {
      trackingData.technicalMetrics.modelSelectionTrends[timeKey] = {};
    }
    trackingData.technicalMetrics.modelSelectionTrends[timeKey][modelName] = 
      (trackingData.technicalMetrics.modelSelectionTrends[timeKey][modelName] || 0) + 1;

    scheduleTrackingPersist();
  } catch (error) {
    log('Model usage tracking error', { modelName, error: String(error) });
  }
}

function trackConversionFunnel(funnelName, step, userId = null, data = {}) {
  try {
    if (!trackingData.userAnalytics.conversionFunnels[funnelName]) {
      trackingData.userAnalytics.conversionFunnels[funnelName] = {};
    }
    
    if (!trackingData.userAnalytics.conversionFunnels[funnelName][step]) {
      trackingData.userAnalytics.conversionFunnels[funnelName][step] = {
        count: 0,
        users: new Set(),
        data: {}
      };
    }

    trackingData.userAnalytics.conversionFunnels[funnelName][step].count += 1;
    if (userId) {
      trackingData.userAnalytics.conversionFunnels[funnelName][step].users.add(userId);
    }

    scheduleTrackingPersist();
  } catch (error) {
    log('Conversion funnel tracking error', { funnelName, step, error: String(error) });
  }
}

function trackResourceUtilization() {
  try {
    const timestamp = Date.now();
    const usage = getResourceUsageSnapshot();
    
    trackingData.userAnalytics.resourceUtilization[timestamp] = {
      memory: usage.rss,
      heapUsed: usage.heapUsed,
      cpu: usage.load1,
      activeProcesses: usage.running
    };

    trackingData.technicalMetrics.resourceUsage.push({
      timestamp,
      memory: usage.rss,
      heapUsed: usage.heapUsed,
      cpu: usage.load1,
      activeProcesses: usage.running
    });

    // Keep only last 1000 entries
    if (trackingData.technicalMetrics.resourceUsage.length > 1000) {
      trackingData.technicalMetrics.resourceUsage = trackingData.technicalMetrics.resourceUsage.slice(-1000);
    }

    scheduleTrackingPersist();
  } catch (error) {
    log('Resource utilization tracking error', { error: String(error) });
  }
}

function trackQueueMetrics(waitTime, processedCount = 1) {
  try {
    const timestamp = Date.now();
    
    trackingData.userAnalytics.queueMetrics[timestamp] = {
      waitTime,
      processedCount
    };

    trackingData.technicalMetrics.queueWaitTimes.push(waitTime);

    // Keep only last 1000 entries
    if (trackingData.technicalMetrics.queueWaitTimes.length > 1000) {
      trackingData.technicalMetrics.queueWaitTimes = trackingData.technicalMetrics.queueWaitTimes.slice(-1000);
    }

    scheduleTrackingPersist();
  } catch (error) {
    log('Queue metrics tracking error', { waitTime, error: String(error) });
  }
}

function trackAIResponseTime(responseTime, provider, success = true, errorType = null) {
  try {
    trackingData.technicalMetrics.aiResponseTimes.push({
      timestamp: Date.now(),
      responseTime,
      provider,
      success
    });

    // Track error rates by provider
    if (!trackingData.technicalMetrics.aiErrorRates[provider]) {
      trackingData.technicalMetrics.aiErrorRates[provider] = {
        total: 0,
        errors: 0,
        errorRate: 0
      };
    }

    trackingData.technicalMetrics.aiErrorRates[provider].total += 1;
    if (!success) {
      trackingData.technicalMetrics.aiErrorRates[provider].errors += 1;
      trackingData.userAnalytics.errorRates[errorType || 'ai_error'] = 
        (trackingData.userAnalytics.errorRates[errorType || 'ai_error'] || 0) + 1;
    }
    
    trackingData.technicalMetrics.aiErrorRates[provider].errorRate = 
      (trackingData.technicalMetrics.aiErrorRates[provider].errors / 
       trackingData.technicalMetrics.aiErrorRates[provider].total * 100);

    // Keep only last 1000 entries
    if (trackingData.technicalMetrics.aiResponseTimes.length > 1000) {
      trackingData.technicalMetrics.aiResponseTimes = trackingData.technicalMetrics.aiResponseTimes.slice(-1000);
    }

    scheduleTrackingPersist();
  } catch (error) {
    log('AI response time tracking error', { responseTime, provider, error: String(error) });
  }
}

function trackPlanUpgrade(fromPlan, toPlan, userId = null) {
  try {
    if (!trackingData.userAnalytics.planUpgradePatterns[fromPlan]) {
      trackingData.userAnalytics.planUpgradePatterns[fromPlan] = {};
    }
    trackingData.userAnalytics.planUpgradePatterns[fromPlan][toPlan] = 
      (trackingData.userAnalytics.planUpgradePatterns[fromPlan][toPlan] || 0) + 1;

    if (!trackingData.businessMetrics.upgradeDowngradePatterns[fromPlan]) {
      trackingData.businessMetrics.upgradeDowngradePatterns[fromPlan] = {};
    }
    trackingData.businessMetrics.upgradeDowngradePatterns[fromPlan][toPlan] = 
      (trackingData.businessMetrics.upgradeDowngradePatterns[fromPlan][toPlan] || 0) + 1;

    scheduleTrackingPersist();
  } catch (error) {
    log('Plan upgrade tracking error', { fromPlan, toPlan, error: String(error) });
  }
}

function calculateBusinessMetrics() {
  try {
    const now = Date.now();
    const thirtyDaysAgo = now - (30 * 24 * 60 * 60 * 1000);
    const activeUsers = usersDb.filter(u => {
      const lastActive = u.lastActiveAt ? new Date(u.lastActiveAt).getTime() : 0;
      return lastActive > thirtyDaysAgo;
    });

    // Calculate MRR (Monthly Recurring Revenue)
    let mrr = 0;
    const planPrices = {
      hobby: 0,
      starter: 7.50,
      business: 25,
      enterprise: 75
    };

    usersDb.forEach(user => {
      if (PAID_PLANS.has(user.plan)) {
        mrr += planPrices[user.plan] || 0;
      }
    });

    trackingData.businessMetrics.mrr = mrr;

    // Calculate LTV (simplified)
    const avgRevenue = mrr / Math.max(activeUsers.length, 1);
    const avgLifespanMonths = 12; // Assume 12 months average
    trackingData.businessMetrics.ltv = avgRevenue * avgLifespanMonths;

    // Calculate churn rate (users who cancelled in last 30 days)
    const cancelledUsers = usersDb.filter(u => 
      u.plan === 'cancelled' && 
      u.cancelledAt && 
      new Date(u.cancelledAt).getTime() > thirtyDaysAgo
    ).length;
    
    const totalUsers30DaysAgo = usersDb.filter(u => 
      new Date(u.createdAt).getTime() <= thirtyDaysAgo
    ).length;

    trackingData.businessMetrics.churnRate = totalUsers30DaysAgo > 0 
      ? (cancelledUsers / totalUsers30DaysAgo * 100) 
      : 0;

    // Calculate ARPU (Average Revenue Per User)
    trackingData.businessMetrics.averageRevenuePerUser = 
      activeUsers.length > 0 ? mrr / activeUsers.length : 0;

  } catch (error) {
    log('Business metrics calculation error', { error: String(error) });
  }
}

function calculateRetentionCohorts() {
  try {
    const cohorts = {};
    const now = Date.now();
    
    usersDb.forEach(user => {
      const cohortMonth = new Date(user.createdAt).toISOString().slice(0, 7); // YYYY-MM
      
      if (!cohorts[cohortMonth]) {
        cohorts[cohortMonth] = {
          cohortSize: 0,
          users: [],
          retention: {
            '1week': 0,
            '1month': 0,
            '3month': 0
          }
        };
      }
      
      cohorts[cohortMonth].cohortSize += 1;
      cohorts[cohortMonth].users.push(user);
    });

    // Calculate retention for each cohort
    Object.keys(cohorts).forEach(cohortMonth => {
      const cohort = cohorts[cohortMonth];
      const cohortStart = new Date(cohortMonth + '-01').getTime();
      
      // 1 week retention
      const oneWeekAgo = cohortStart + (7 * 24 * 60 * 60 * 1000);
      const oneWeekActive = cohort.users.filter(u => {
        const lastActive = u.lastActiveAt ? new Date(u.lastActiveAt).getTime() : 0;
        return lastActive > oneWeekAgo;
      }).length;
      cohort.retention['1week'] = cohort.cohortSize > 0 ? (oneWeekActive / cohort.cohortSize * 100) : 0;

      // 1 month retention  
      const oneMonthAgo = cohortStart + (30 * 24 * 60 * 60 * 1000);
      const oneMonthActive = cohort.users.filter(u => {
        const lastActive = u.lastActiveAt ? new Date(u.lastActiveAt).getTime() : 0;
        return lastActive > oneMonthAgo;
      }).length;
      cohort.retention['1month'] = cohort.cohortSize > 0 ? (oneMonthActive / cohort.cohortSize * 100) : 0;

      // 3 month retention
      const threeMonthAgo = cohortStart + (90 * 24 * 60 * 60 * 1000);
      const threeMonthActive = cohort.users.filter(u => {
        const lastActive = u.lastActiveAt ? new Date(u.lastActiveAt).getTime() : 0;
        return lastActive > threeMonthAgo;
      }).length;
      cohort.retention['3month'] = cohort.cohortSize > 0 ? (threeMonthActive / cohort.cohortSize * 100) : 0;
    });

    trackingData.userAnalytics.retentionCohorts = cohorts;
  } catch (error) {
    log('Retention cohort calculation error', { error: String(error) });
  }
}

function getAnalyticsSummary() {
  try {
    // Update business metrics
    calculateBusinessMetrics();
    calculateRetentionCohorts();
    
    const now = new Date();
    const today = now.toISOString().split('T')[0];
    const thisWeek = `${now.getFullYear()}-W${Math.ceil((now.getDate() + now.getDay()) / 7)}`;
    const thisMonth = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}`;

    // Get DAU/WAU/MAU counts
    const dau = trackingData.userAnalytics.dailyActiveUsers[today]?.size || 0;
    const wau = trackingData.userAnalytics.weeklyActiveUsers[thisWeek]?.size || 0;
    const mau = trackingData.userAnalytics.monthlyActiveUsers[thisMonth]?.size || 0;

    // Calculate average session duration
    const avgSessionDuration = trackingData.userAnalytics.sessionDurations.length > 0
      ? trackingData.userAnalytics.sessionDurations.reduce((a, b) => a + b, 0) / trackingData.userAnalytics.sessionDurations.length
      : 0;

    // Calculate project completion rate
    const totalProjects = Object.keys(trackingData.userAnalytics.projectData).length;
    const completedProjects = Object.values(trackingData.userAnalytics.projectData)
      .filter(p => p.status === 'completed').length;
    const projectCompletionRate = totalProjects > 0 ? (completedProjects / totalProjects * 100) : 0;

    // Calculate return user rate
    const totalUsers = usersDb.length;
    const returningUsers = Object.keys(trackingData.userAnalytics.userSessions)
      .filter(uid => {
        const session = trackingData.userAnalytics.userSessions[uid];
        return session.loginTime && session.sessionDuration > 0 && session.pageViews.length > 1;
      }).length;
    const returnUserRate = totalUsers > 0 ? (returningUsers / totalUsers * 100) : 0;

    // Calculate free to paid conversion rate
    const freeUsers = usersDb.filter(u => u.plan === 'hobby').length;
    const convertedUsers = usersDb.filter(u => PAID_PLANS.has(u.plan)).length;
    const freeToPaidConversionRate = freeUsers > 0 ? (convertedUsers / freeUsers * 100) : 0;

    // Calculate trial to subscription conversion
    const trialUsers = usersDb.filter(u => u.trialStarted).length;
    const trialConversions = usersDb.filter(u => u.trialStarted && PAID_PLANS.has(u.plan)).length;
    const trialToSubscriptionConversion = trialUsers > 0 ? (trialConversions / trialUsers * 100) : 0;

    return {
      userEngagement: {
        dau,
        wau, 
        mau,
        averageSessionDuration: Math.round(avgSessionDuration),
        projectCompletionRate: Math.round(projectCompletionRate),
        returnUserRate: Math.round(returnUserRate),
        freeToPaidConversionRate: Math.round(freeToPaidConversionRate),
        trialToSubscriptionConversion: Math.round(trialToSubscriptionConversion)
      },
      featureUsage: trackingData.userAnalytics.featureUsage,
      modelUsage: trackingData.userAnalytics.modelUsage,
      exportUsage: trackingData.userAnalytics.exportUsage,
      errorRates: trackingData.userAnalytics.errorRates,
      retentionCohorts: trackingData.userAnalytics.retentionCohorts,
      businessMetrics: trackingData.businessMetrics,
      technicalMetrics: {
        aiResponseTimes: trackingData.technicalMetrics.aiResponseTimes.slice(-100), // Last 100
        aiErrorRates: trackingData.technicalMetrics.aiErrorRates,
        modelSelectionTrends: trackingData.technicalMetrics.modelSelectionTrends,
        averageQueueTime: trackingData.technicalMetrics.queueWaitTimes.length > 0
          ? Math.round(trackingData.technicalMetrics.queueWaitTimes.reduce((a, b) => a + b, 0) / trackingData.technicalMetrics.queueWaitTimes.length)
          : 0,
        resourceUtilization: trackingData.userAnalytics.resourceUtilization,
        systemHealth: trackingData.technicalMetrics.systemHealth
      },
      planUpgradePatterns: trackingData.userAnalytics.planUpgradePatterns,
      conversionFunnels: trackingData.userAnalytics.conversionFunnels,
      featureAdoptionByPlan: trackingData.businessMetrics.featureAdoptionByPlan
    };
  } catch (error) {
    log('Analytics summary calculation error', { error: String(error) });
    return {
      userEngagement: {
        dau: 0, wau: 0, mau: 0, averageSessionDuration: 0, projectCompletionRate: 0,
        returnUserRate: 0, freeToPaidConversionRate: 0, trialToSubscriptionConversion: 0
      },
      featureUsage: {},
      modelUsage: {},
      exportUsage: {},
      errorRates: {},
      retentionCohours: {},
      businessMetrics: {},
      technicalMetrics: {},
      planUpgradePatterns: {},
      conversionFunnels: {},
      featureAdoptionByPlan: {}
    };
  }
}

async function handleUpgradePopupTracking(req, res) {
  try {
    const body = await parseJsonBody(req);
    const source = (body && body.source) ? String(body.source).toLowerCase() : 'unknown';

    // Initialize upgradeSources tracking
    if (!trackingData.summary.upgradeSources) {
      trackingData.summary.upgradeSources = {
        apps_page: 0,
        builder_model: 0,
        usage_limit: 0,
        other: 0
      };
    }

    // Normalize source to known keys
    const sourceKey = {
      'apps_page': 'apps_page',
      'apps': 'apps_page',
      'builder_model': 'builder_model',
      'model_select': 'builder_model',
      'usage_limit': 'usage_limit',
      'token_limit': 'usage_limit',
      'out_of_tokens': 'usage_limit',
    }[source] || 'other';

    // Increment counter for this source
    trackingData.summary.upgradeSources[sourceKey] = (trackingData.summary.upgradeSources[sourceKey] || 0) + 1;

    log('Upgrade popup source tracked', { source, sourceKey });
    scheduleTrackingPersist();

    sendJson(res, 200, { ok: true });
  } catch (error) {
    log('Upgrade popup tracking error', { error: String(error) });
    sendJson(res, 400, { error: 'Failed to track upgrade popup source' });
  }
}

function calculateRetention() {
  try {
    const now = Date.now();
    const oneWeekMs = 7 * 24 * 60 * 60 * 1000;
    
    // 1-week retention: Users who signed up 7-14 days ago and were active in the last 7 days
    const cohortStart = now - (14 * 24 * 60 * 60 * 1000);
    const cohortEnd = now - (7 * 24 * 60 * 60 * 1000);
    
    const cohort = usersDb.filter(u => {
      const created = new Date(u.createdAt).getTime();
      return created >= cohortStart && created <= cohortEnd;
    });
    
    if (cohort.length === 0) return 0;
    
    const retained = cohort.filter(u => {
      const lastActive = u.lastActiveAt ? new Date(u.lastActiveAt).getTime() : 
                        (u.lastLoginAt ? new Date(u.lastLoginAt).getTime() : 0);
      return lastActive > cohortEnd;
    });
    
    return parseFloat(((retained.length / cohort.length) * 100).toFixed(1));
  } catch (error) {
    log('Retention calculation error', { error: String(error) });
    return 0;
  }
}

function getReferrerDomain(referrer) {
  if (!referrer || referrer === 'direct') return 'direct';
  try {
    const url = new URL(referrer);
    return url.hostname;
  } catch {
    return 'unknown';
  }
}

function findAffiliateByEmail(email) {
  const normalized = (email || '').trim().toLowerCase();
  return affiliatesDb.find((a) => a.email === normalized);
}

function findAffiliateByCode(code) {
  const normalized = sanitizeAffiliateCode(code);
  if (!normalized) return null;
  return affiliatesDb.find((a) => Array.isArray(a.codes) && a.codes.some((c) => c.code === normalized));
}

function generateTrackingCode(seed = '') {
  const base = sanitizeAffiliateCode(seed);
  const randomBit = randomBytes(3).toString('hex');
  let candidate = base ? `${base}-${randomBit}` : randomBytes(5).toString('hex');
  let attempt = 0;
  while (findAffiliateByCode(candidate) && attempt < 5) {
    candidate = base ? `${base}-${randomBytes(4).toString('hex')}` : randomBytes(6).toString('hex');
    attempt += 1;
  }
  return candidate;
}

async function registerAffiliate({ email, password, name }) {
  const normalized = (email || '').trim().toLowerCase();
  if (!EMAIL_REGEX.test(normalized)) throw new Error('Email is invalid');
  if (findAffiliateByEmail(normalized)) throw new Error('Affiliate already exists with this email');
  if (!password || password.length < 6) throw new Error('Password must be at least 6 characters long');
  const hashedPassword = await bcrypt.hash(password, PASSWORD_SALT_ROUNDS);
  const createdAt = new Date().toISOString();
  const code = generateTrackingCode();
  const affiliate = {
    id: randomUUID(),
    email: normalized,
    name: (name || '').trim() || normalized.split('@')[0],
    password: hashedPassword,
    createdAt,
    lastLoginAt: null,
    commissionRate: AFFILIATE_COMMISSION_RATE,
    codes: [{ code, label: 'Default link', createdAt }],
    earnings: [],
    lastPayoutAt: null,
    emailVerified: false,
    verificationToken: '',
    verificationExpiresAt: null,
  };
  assignVerificationToken(affiliate);
  affiliatesDb.push(affiliate);
  await persistAffiliatesDb();
  return affiliate;
}

async function verifyAffiliatePassword(email, password) {
  const affiliate = findAffiliateByEmail(email);
  if (!affiliate || !affiliate.password) return null;
  const valid = await bcrypt.compare(password, affiliate.password);
  if (!valid) return null;
  affiliate.lastLoginAt = new Date().toISOString();
  await persistAffiliatesDb();
  return affiliate;
}

function summarizeAffiliate(affiliate) {
  if (!affiliate) return null;
  const earnings = Array.isArray(affiliate.earnings) ? affiliate.earnings : [];
  const total = earnings.reduce((sum, e) => sum + Number(e.amount || 0), 0);
  return {
    id: affiliate.id,
    email: affiliate.email,
    name: affiliate.name || affiliate.email,
    emailVerified: affiliate.emailVerified || false,
    commissionRate: affiliate.commissionRate || AFFILIATE_COMMISSION_RATE,
    trackingLinks: affiliate.codes || [],
    earnings: {
      total,
      currency: 'USD',
      records: earnings.slice(-20),
    },
    createdAt: affiliate.createdAt,
    lastLoginAt: affiliate.lastLoginAt,
  };
}

function readCookieValue(req, name) {
  try {
    const cookieHeader = req?.headers?.cookie || '';
    if (!cookieHeader) return '';
    const parts = cookieHeader.split(';').map((p) => p.trim());
    const match = parts.find((p) => p.startsWith(`${name}=`));
    if (!match) return '';
    return decodeURIComponent(match.split('=').slice(1).join('=') || '');
  } catch (_) {
    return '';
  }
}

function readAffiliateSessionToken(req) {
  return readCookieValue(req, AFFILIATE_COOKIE_NAME);
}

function getAffiliateSession(req) {
  const token = readAffiliateSessionToken(req);
  if (!token) return null;
  const session = affiliateSessions.get(token);
  if (!session) return null;
  if (session.expiresAt && session.expiresAt < Date.now()) {
    affiliateSessions.delete(token);
    return null;
  }
  return { token, affiliateId: session.affiliateId, expiresAt: session.expiresAt };
}

function startAffiliateSession(res, affiliateId) {
  const token = randomUUID();
  const expiresAt = Date.now() + AFFILIATE_SESSION_TTL_MS;
  affiliateSessions.set(token, { affiliateId, expiresAt });
  const parts = [
    `${AFFILIATE_COOKIE_NAME}=${encodeURIComponent(token)}`,
    'Path=/',
    'HttpOnly',
    'SameSite=Lax',
    `Max-Age=${Math.floor(AFFILIATE_SESSION_TTL_MS / 1000)}`,
  ];
  if (process.env.COOKIE_SECURE !== '0') parts.push('Secure');
  res.setHeader('Set-Cookie', parts.join('; '));
  return token;
}

function clearAffiliateSession(res) {
  res.setHeader('Set-Cookie', `${AFFILIATE_COOKIE_NAME}=deleted; Path=/; Max-Age=0; SameSite=Lax`);
}

function requireAffiliateAuth(req, res) {
  const session = getAffiliateSession(req);
  if (!session) {
    sendJson(res, 401, { error: 'Affiliate authentication required' });
    return null;
  }
  const affiliate = affiliatesDb.find((a) => a.id === session.affiliateId);
  if (!affiliate) {
    sendJson(res, 401, { error: 'Affiliate session is invalid' });
    return null;
  }
  return { session, affiliate };
}

function setAffiliateReferralCookie(res, code) {
  const parts = [
    `${AFFILIATE_REF_COOKIE}=${encodeURIComponent(code)}`,
    'Path=/',
    'SameSite=Lax',
    `Max-Age=${AFFILIATE_REF_COOKIE_TTL_SECONDS}`,
  ];
  if (process.env.COOKIE_SECURE !== '0') parts.push('Secure');
  res.setHeader('Set-Cookie', parts.join('; '));
}

function readAffiliateReferralCode(req) {
  return sanitizeAffiliateCode(readCookieValue(req, AFFILIATE_REF_COOKIE));
}

async function trackAffiliateCommission(user, plan) {
  const normalizedPlan = normalizePlanSelection(plan);
  if (!normalizedPlan || !PAID_PLANS.has(normalizedPlan)) return;
  if (!user || !user.referredByAffiliateCode) return;
  user.affiliatePayouts = Array.isArray(user.affiliatePayouts) ? user.affiliatePayouts : [];
  const affiliate = findAffiliateByCode(user.referredByAffiliateCode);
  if (!affiliate) return;
  const price = PLAN_PRICES[normalizedPlan] || 0;
  if (!price) return;
  const amount = price * (affiliate.commissionRate || AFFILIATE_COMMISSION_RATE);
  const record = {
    id: randomUUID(),
    userId: user.id,
    plan: normalizedPlan,
    amount,
    currency: 'USD',
    description: `${normalizedPlan} subscription`,
    createdAt: new Date().toISOString(),
  };
  affiliate.earnings = Array.isArray(affiliate.earnings) ? affiliate.earnings : [];
  affiliate.earnings.push(record);
  affiliate.lastPayoutAt = record.createdAt;
  user.affiliatePayouts.push(normalizedPlan);
  await persistAffiliatesDb();
  await persistUsersDb();
}

function ensureMailTransport() {
  if (mailTransport) return mailTransport;
  const invalidPort = !Number.isFinite(SMTP_PORT) || SMTP_PORT <= 0;
  if (!SMTP_HOST || invalidPort || !SMTP_FROM || !SMTP_USER || !SMTP_PASS) {
    log('⚠️  SMTP configuration is incomplete. Emails will be logged to CONSOLE only (not sent).', summarizeMailConfig());
    console.log('');
    console.log('┌─────────────────────────────────────────────────────────────┐');
    console.log('│  📧  EMAIL/SMTP NOT CONFIGURED                               │');
    console.log('├─────────────────────────────────────────────────────────────┤');
    console.log('│  Password reset and verification emails will NOT be sent.   │');
    console.log('│  To enable real emails, configure SMTP in .env file:        │');
    console.log('│                                                             │');
    console.log('│    SMTP_HOST=smtp.gmail.com   (or your SMTP server)         │');
    console.log('│    SMTP_PORT=587                                             │');
    console.log('│    SMTP_USER=your-email@gmail.com                            │');
    console.log('│    SMTP_PASS=your-app-password                               │');
    console.log('│    SMTP_FROM=noreply@yourdomain.com                         │');
    console.log('│                                                             │');
    console.log('│  💡 Tip: Emails will be logged below when triggered          │');
    console.log('└─────────────────────────────────────────────────────────────┘');
    console.log('');
    // Create a mock transport that logs to console
    mailTransport = {
      sendMail: async (payload) => {
        console.log('');
        console.log('┌─────────────────────────────────────────────────────────────┐');
        console.log('│  📧  [MOCK EMAIL - Not Sent]                                │');
        console.log('├─────────────────────────────────────────────────────────────┤');
        console.log(`│  To:    ${payload.to}`);
        console.log(`│  Subject: ${payload.subject}`);
        console.log('│  Body preview:');
        const preview = (payload.text || payload.html || '').slice(0, 200).replace(/\n/g, ' ');
        console.log(`│    ${preview}...`);
        console.log('│                                                             │');
        console.log('│  Configure SMTP in .env to send real emails                 │');
        console.log('└─────────────────────────────────────────────────────────────┘');
        console.log('');
        return { messageId: 'mock-' + Date.now() };
      },
      verify: (cb) => cb(null, true)
    };
    return mailTransport;
  }

  log('initializing mail transport', summarizeMailConfig());
  mailTransport = nodemailer.createTransport({
    host: SMTP_HOST,
    port: SMTP_PORT,
    secure: SMTP_SECURE,
    auth: { user: SMTP_USER, pass: SMTP_PASS },
    // Add timeouts to avoid long hangs
    connectionTimeout: 5000,
    greetingTimeout: 5000,
    socketTimeout: 5000,
  });

  // Verify the connection asynchronously
  mailTransport.verify((error) => {
    if (error) {
      log('❌ SMTP verification failed', { error: String(error) });
    } else {
      log('✅ SMTP transport verified and ready');
    }
  });

  return mailTransport;
}

async function sendEmail({ to, subject, text, html }) {
  try {
    const transport = ensureMailTransport();
    const plain = text || undefined;
    const payload = {
      from: SMTP_FROM || 'noreply@plugincompass.com',
      to,
      subject,
    };
    if (plain) payload.text = plain;
    if (html) payload.html = html;

    log('sending email', { to, subject });
    const info = await transport.sendMail(payload);
    log('email sent successfully', { to, messageId: info.messageId });
    return info;
  } catch (err) {
    log('❌ FAILED TO SEND EMAIL', {
      to,
      subject,
      error: String(err),
      hint: 'Check SMTP configuration in .env file'
    });
    throw err;
  }
}

function assignVerificationToken(user) {
  user.emailVerified = false;
  user.verificationToken = randomBytes(32).toString('hex');
  user.verificationExpiresAt = new Date(Date.now() + EMAIL_VERIFICATION_TTL_MS).toISOString();
}

function assignPasswordResetToken(user) {
  user.resetToken = randomBytes(32).toString('hex');
  user.resetExpiresAt = new Date(Date.now() + PASSWORD_RESET_TTL_MS).toISOString();
}

function normalizeVerificationState(user) {
  const hasExplicitFlag = user?.emailVerified === true || user?.emailVerified === false;
  let verified = user?.emailVerified === true || (!hasExplicitFlag && !!user?.lastLoginAt);
  let verificationToken = user?.verificationToken || '';
  let verificationExpiresAt = user?.verificationExpiresAt || null;
  let shouldPersist = false;

  if (!verified && !verificationToken) {
    const tmp = { emailVerified: false, verificationToken: '', verificationExpiresAt: null };
    assignVerificationToken(tmp);
    verificationToken = tmp.verificationToken;
    verificationExpiresAt = tmp.verificationExpiresAt;
    shouldPersist = true;
  }

  if (!hasExplicitFlag) shouldPersist = true;

  return { verified, verificationToken, verificationExpiresAt, shouldPersist };
}

function renderBrandedEmail({ title, preheader, bodyHtml, buttonText, buttonLink, showHero = false, heroTitle = '', heroSubtitle = '' }) {
  const logoBase = (PUBLIC_BASE_URL || '').replace(/\/+/g, '');
  const logoUrl = (logoBase ? `${logoBase}/assets/Plugin.png` : '/assets/Plugin.png');
  const accent = '#004225';
  const accent2 = '#006B3D';
  const accentLight = '#E8F5EC';
  const bg = '#f9f7f4';
  const cardBg = '#ffffff';
  const textPrimary = '#1a1a1a';
  const textSecondary = '#666666';
  const textMuted = '#999999';
  const borderColor = '#e8e4de';
  const safeTitle = escapeHtml(title || '');
  const safePre = escapeHtml(preheader || '');
  const safeBtnLink = escapeHtml(buttonLink || '');

  const heroSection = showHero ? `
    <tr>
      <td style="background: linear-gradient(135deg, ${accent} 0%, ${accent2} 100%); padding: 32px 40px; text-align: center;">
        <img src="${logoUrl}" alt="Plugin Compass" width="56" height="56" style="border-radius:12px; display: inline-block; margin-bottom: 16px; background: rgba(255,255,255,0.15);">
        <h1 style="color: #ffffff; margin: 0; font-size: 26px; font-weight: 700; letter-spacing: -0.5px;">${escapeHtml(heroTitle || safeTitle)}</h1>
        ${heroSubtitle ? `<p style="color: rgba(255,255,255,0.85); margin: 8px 0 0 0; font-size: 15px;">${escapeHtml(heroSubtitle)}</p>` : ''}
      </td>
    </tr>
  ` : `
    <tr>
      <td style="padding: 28px 32px 16px 32px; text-align: center; border-bottom: 1px solid ${borderColor};">
        <img src="${logoUrl}" alt="Plugin Compass" width="52" height="52" style="border-radius:10px; display: inline-block; margin-bottom: 8px;">
        <div style="color: ${accent}; font-size: 16px; font-weight: 700; letter-spacing: -0.3px;">${safeTitle}</div>
      </td>
    </tr>
  `;

  const html = `<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>${safeTitle}</title>
  <style>
    @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap');
    body { margin: 0; padding: 0; background: ${bg}; font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; }
    .wrapper { width: 100%; max-width: 620px; margin: 0 auto; padding: 24px 16px; }
    .card { background: ${cardBg}; border-radius: 16px; overflow: hidden; box-shadow: 0 2px 12px rgba(0,0,0,0.06); border: 1px solid ${borderColor}; }
    .card-inner { background: ${cardBg}; }
    .body-content { padding: 28px 32px 24px 32px; color: ${textPrimary}; font-size: 15px; line-height: 1.7; }
    .body-content p { margin: 0 0 16px 0; }
    .body-content p:last-child { margin-bottom: 0; }
    .details-box { background: ${bg}; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid ${borderColor}; }
    .detail-row { display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid ${borderColor}; }
    .detail-row:last-child { border-bottom: none; padding-bottom: 0; }
    .detail-row:first-child { padding-top: 0; }
    .detail-label { color: ${textSecondary}; font-size: 14px; }
    .detail-value { font-weight: 600; color: ${textPrimary}; font-size: 14px; }
    .cta-section { padding: 0 32px 28px 32px; text-align: center; }
    .btn { display: inline-block; padding: 14px 28px; border-radius: 10px; color: #ffffff; text-decoration: none; font-weight: 600; font-size: 15px; background: linear-gradient(135deg, ${accent} 0%, ${accent2} 100%); box-shadow: 0 4px 12px rgba(0, 66, 37, 0.25); }
    .btn:hover { opacity: 0.95; }
    .success-icon { width: 64px; height: 64px; background: ${accentLight}; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px; }
    .success-icon svg { width: 32px; height: 32px; color: ${accent}; }
    .footer { padding: 24px 32px; border-top: 1px solid ${borderColor}; text-align: center; font-size: 13px; color: ${textMuted}; }
    .footer a { color: ${accent}; text-decoration: none; }
    .footer a:hover { text-decoration: underline; }
    .preheader { display: none !important; visibility: hidden; mso-hide: all; font-size: 0; line-height: 0; }
    .divider { height: 1px; background: ${borderColor}; margin: 0; }
    .highlight-box { background: ${accentLight}; border-left: 4px solid ${accent}; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0; }
    @media only screen and (max-width: 640px) {
      .wrapper { padding: 12px; }
      .body-content { padding: 20px 24px 20px 24px; }
      .cta-section { padding: 0 24px 24px 24px; }
      .footer { padding: 20px 24px; }
    }
  </style>
</head>
<body>
  <span class="preheader">${safePre}</span>
  <div class="wrapper">
    <table width="100%" cellpadding="0" cellspacing="0" border="0">
      <tr>
        <td>
          <table class="card" width="100%" cellpadding="0" cellspacing="0" border="0">
            ${heroSection}
            <tr>
              <td class="body-content">
                ${bodyHtml}
              </td>
            </tr>
            ${buttonText ? `
            <tr>
              <td class="cta-section">
                <a class="btn" href="${safeBtnLink}">${escapeHtml(buttonText)}</a>
              </td>
            </tr>
            ` : ''}
            <tr>
              <td class="divider"></td>
            </tr>
            <tr>
              <td class="footer">
                <p style="margin: 0 0 8px 0;">Need help? Contact us at <a href="mailto:support@plugincompass.com">support@plugincompass.com</a></p>
                <p style="margin: 0 0 4px 0;">© ${new Date().getFullYear()} Plugin Compass. All rights reserved.</p>
                <p style="margin: 0;"><a href="${escapeHtml(PUBLIC_BASE_URL || '')}">${escapeHtml(PUBLIC_BASE_URL || '') || 'Visit our website'}</a> &nbsp;|&nbsp; <a href="${escapeHtml(PUBLIC_BASE_URL || '' || '')}/privacy">Privacy</a> &nbsp;|&nbsp; <a href="${escapeHtml(PUBLIC_BASE_URL || '' || '')}/terms">Terms</a></p>
              </td>
            </tr>
          </table>
        </td>
      </tr>
    </table>
  </div>
</body>
</html>`;

  return html;
}

async function sendVerificationEmail(user, baseUrl) {
  if (!user || !user.email || !user.verificationToken) return;
  const link = `${baseUrl.replace(/\/+$/, '')}/verify-email?token=${encodeURIComponent(user.verificationToken)}`;
  const safeLink = escapeHtml(link);

  const text = `Welcome!\n\nPlease verify your email address by visiting the link below:\n${link}\n\nThis link expires in ${Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000))} hours.`;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M21.75 6.75v10.5a2.25 2.25 0 01-2.25 2.25h-15a2.25 2.25 0 01-2.25-2.25V6.75m19.5 0A2.25 2.25 0 0019.5 4.5h-15a2.25 2.25 0 00-2.25 2.25m19.5 0v.243a2.25 2.25 0 01-1.07 1.916l-7.5 4.615a2.25 2.25 0 01-2.36 0L3.32 8.91a2.25 2.25 0 01-1.07-1.916V6.75" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Welcome to Plugin Compass!</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Thanks for signing up! Please verify your email address to get started with AI-powered development.</p>

    <div style="text-align: center; margin: 28px 0;">
      <a class="btn" href="${safeLink}" style="display: inline-block; padding: 14px 28px; border-radius: 10px; color: #ffffff; text-decoration: none; font-weight: 600; font-size: 15px; background: linear-gradient(135deg, #004225 0%, #006B3D 100%); box-shadow: 0 4px 12px rgba(0, 66, 37, 0.25);">Verify Email Address</a>
    </div>

    <p style="margin-bottom: 8px; color: #666; font-size: 14px;">Or copy and paste this link into your browser:</p>
    <p style="word-break: break-all; margin: 0; color: #004225; font-size: 13px;"><a href="${safeLink}" style="color: #004225; text-decoration: none;">${safeLink}</a></p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 24px 0 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>This link expires in ${Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000))} hours.</strong><br>If you didn't sign up for Plugin Compass, you can safely ignore this email.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Verify your email',
    preheader: 'Confirm your email to get started',
    bodyHtml,
    buttonText: '',
    buttonLink: '',
  });

  await sendEmail({ to: user.email, subject: 'Plugin Compass — Verify your email', text, html });
}

async function sendAffiliateVerificationEmail(affiliate, baseUrl) {
  if (!affiliate || !affiliate.email || !affiliate.verificationToken) return;
  const link = `${baseUrl.replace(/\/+$/, '')}/affiliate-verify-email?token=${encodeURIComponent(affiliate.verificationToken)}`;
  const safeLink = escapeHtml(link);

  const text = `Welcome to the Plugin Compass Affiliate Program!\n\nPlease verify your email address by visiting the link below:\n${link}\n\nThis link expires in ${Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000))} hours.`;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M21.75 6.75v10.5a2.25 2.25 0 01-2.25 2.25h-15a2.25 2.25 0 01-2.25-2.25V6.75m19.5 0A2.25 2.25 0 0019.5 4.5h-15a2.25 2.25 0 00-2.25 2.25m19.5 0v.243a2.25 2.25 0 01-1.07 1.916l-7.5 4.615a2.25 2.25 0 01-2.36 0L3.32 8.91a2.25 2.25 0 01-1.07-1.916V6.75" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Welcome to the Affiliate Program!</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Thanks for joining our Affiliate Program! Please verify your email address to start earning 7.5% recurring commissions.</p>

    <div style="text-align: center; margin: 28px 0;">
      <a class="btn" href="${safeLink}" style="display: inline-block; padding: 14px 28px; border-radius: 10px; color: #ffffff; text-decoration: none; font-weight: 600; font-size: 15px; background: linear-gradient(135deg, #004225 0%, #006B3D 100%); box-shadow: 0 4px 12px rgba(0, 66, 37, 0.25);">Verify Email Address</a>
    </div>

    <p style="margin-bottom: 8px; color: #666; font-size: 14px;">Or copy and paste this link into your browser:</p>
    <p style="word-break: break-all; margin: 0; color: #004225; font-size: 13px;"><a href="${safeLink}" style="color: #004225; text-decoration: none;">${safeLink}</a></p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 24px 0 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>This link expires in ${Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000))} hours.</strong><br>If you didn't sign up for the Affiliate Program, you can safely ignore this email.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Verify your affiliate email',
    preheader: 'Confirm your email to start earning commissions',
    bodyHtml,
    buttonText: '',
    buttonLink: '',
  });

  await sendEmail({ to: affiliate.email, subject: 'Plugin Compass — Verify your affiliate email', text, html });
}

async function sendPasswordResetEmail(user, baseUrl) {
  if (!user || !user.email || !user.resetToken) return;
  const link = `${baseUrl.replace(/\/+$/, '')}/reset-password?token=${encodeURIComponent(user.resetToken)}`;
  const safeLink = escapeHtml(link);

  const text = `You requested a password reset.\n\nReset your password using the link below:\n${link}\n\nThis link expires in ${Math.round(PASSWORD_RESET_TTL_MS / (60 * 1000))} minutes.`;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFF3E0; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#E65100" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Reset your password</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">We received a request to reset your password. Click the button below to create a new password for your account.</p>

    <div style="text-align: center; margin: 28px 0;">
      <a class="btn" href="${safeLink}" style="display: inline-block; padding: 14px 28px; border-radius: 10px; color: #ffffff; text-decoration: none; font-weight: 600; font-size: 15px; background: linear-gradient(135deg, #004225 0%, #006B3D 100%); box-shadow: 0 4px 12px rgba(0, 66, 37, 0.25);">Reset Password</a>
    </div>

    <p style="margin-bottom: 8px; color: #666; font-size: 14px;">Or copy and paste this link into your browser:</p>
    <p style="word-break: break-all; margin: 0; color: #004225; font-size: 13px;"><a href="${safeLink}" style="color: #004225; text-decoration: none;">${safeLink}</a></p>

    <div class="highlight-box" style="background: #FFF3E0; border-left: 4px solid #E65100; padding: 16px 20px; margin: 24px 0 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>This link expires in ${Math.round(PASSWORD_RESET_TTL_MS / (60 * 1000))} minutes.</strong><br>If you didn't request a password reset, you can safely ignore this email.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Reset your password',
    preheader: 'Reset access to your Plugin Compass account',
    bodyHtml,
    buttonText: '',
    buttonLink: '',
  });

  await sendEmail({ to: user.email, subject: 'Plugin Compass — Reset your password', text, html });
}

async function sendPaymentConfirmationEmail(user, paymentType, details) {
  if (!user || !user.email) return;

  let title, preheader, bodyHtml, buttonText, buttonLink, subject, showHero, heroTitle, heroSubtitle;

  if (paymentType === 'topup') {
    const tokens = details.tokens || 0;
    const currency = (details.currency || 'USD').toUpperCase();
    const amount = (details.amount || 0) / 100;
    const formattedAmount = new Intl.NumberFormat('en-US', { style: 'currency', currency: currency }).format(amount);

    subject = 'Plugin Compass — Payment Confirmed';
    title = 'Payment Successful';
    preheader = 'Your token purchase is complete';
    showHero = true;
    heroTitle = 'Payment Confirmed';
    heroSubtitle = 'Your tokens have been added to your account';

    bodyHtml = `
      <div style="text-align: center; margin-bottom: 24px;">
        <div class="success-icon" style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
          <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
            <path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12.75l6 6 9-13.5" />
          </svg>
        </div>
        <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Thank you for your purchase!</p>
      </div>

      <div class="details-box" style="background: #f9f7f4; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid #e8e4de;">
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Description</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">Token Top-up</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Tokens Added</span>
          <span class="detail-value" style="font-weight: 600; color: #004225; font-size: 14px;">${tokens.toLocaleString()}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Amount Paid</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">${formattedAmount}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Status</span>
          <span class="detail-value" style="font-weight: 600; color: #006B3D; font-size: 14px;">Completed</span>
        </div>
      </div>

      <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
        <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your tokens are ready to use!</strong> You can now use them for AI-powered development and building.</p>
      </div>
    `;

    buttonText = 'View Your Account';
    buttonLink = `${PUBLIC_BASE_URL || ''}/settings`;

  } else if (paymentType === 'payg') {
    const tokens = details.tokens || 0;
    const currency = (details.currency || 'USD').toUpperCase();
    const amount = (details.amount || 0) / 100;
    const formattedAmount = new Intl.NumberFormat('en-US', { style: 'currency', currency: currency }).format(amount);

    subject = 'Plugin Compass — Payment Confirmed';
    title = 'Pay-as-you-go Billing';
    preheader = 'Your overage billing is complete';
    showHero = true;
    heroTitle = 'Payment Processed';
    heroSubtitle = 'Your usage has been billed';

    bodyHtml = `
      <div style="text-align: center; margin-bottom: 24px;">
        <div class="success-icon" style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
          <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
            <path stroke-linecap="round" stroke-linejoin="round" d="M9 7h6m0 10v-3m-3 3h.01M9 17h.01M9 14h.01M12 14h.01M15 11h.01M12 11h.01M9 11h.01M7 21h10a2 2 0 002-2V5a2 2 0 00-2-2H7a2 2 0 00-2 2v14a2 2 0 002 2z" />
          </svg>
        </div>
        <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Your pay-as-you-go billing has been processed</p>
      </div>

      <div class="details-box" style="background: #f9f7f4; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid #e8e4de;">
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Type</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">Pay-as-you-go Usage</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Tokens Billed</span>
          <span class="detail-value" style="font-weight: 600; color: #004225; font-size: 14px;">${tokens.toLocaleString()}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Amount Charged</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">${formattedAmount}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Status</span>
          <span class="detail-value" style="font-weight: 600; color: #006B3D; font-size: 14px;">Completed</span>
        </div>
      </div>
    `;

    buttonText = 'View Usage';
    buttonLink = `${PUBLIC_BASE_URL || ''}/settings`;

  } else if (paymentType === 'subscription') {
    const plan = details.plan || '';
    const billingCycle = details.billingCycle || 'monthly';
    const currency = (details.currency || 'USD').toUpperCase();
    const amount = (details.amount || 0) / 100;
    const formattedAmount = new Intl.NumberFormat('en-US', { style: 'currency', currency: currency }).format(amount);
    const nextBillingDate = new Date();
    nextBillingDate.setMonth(nextBillingDate.getMonth() + (billingCycle === 'yearly' ? 12 : 1));

    subject = 'Plugin Compass — Subscription Activated';
    title = 'Welcome to ' + plan.charAt(0).toUpperCase() + plan.slice(1);
    preheader = 'Your subscription is now active';
    showHero = true;
    heroTitle = 'Subscription Active';
    heroSubtitle = 'Welcome to ' + plan.charAt(0).toUpperCase() + plan.slice(1) + ' Plan';

    bodyHtml = `
      <div style="text-align: center; margin-bottom: 24px;">
        <div class="success-icon" style="width: 72px; height: 72px; background: linear-gradient(135deg, #004225 0%, #006B3D 100%); border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
          <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#ffffff" style="width: 36px; height: 36px;">
            <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
          </svg>
        </div>
        <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Welcome to the ${plan.charAt(0).toUpperCase() + plan.slice(1)} Plan!</p>
      </div>

      <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
        <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription is now active!</strong> You have full access to all ${plan} features and benefits.</p>
      </div>

      <div class="details-box" style="background: #f9f7f4; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid #e8e4de;">
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Plan</span>
          <span class="detail-value" style="font-weight: 600; color: #004225; font-size: 14px;">${plan.charAt(0).toUpperCase() + plan.slice(1)}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Billing Cycle</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">${billingCycle.charAt(0).toUpperCase() + billingCycle.slice(1)}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Amount</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">${formattedAmount}/${billingCycle === 'yearly' ? 'year' : 'month'}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Next Billing Date</span>
          <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">${nextBillingDate.toLocaleDateString('en-US', { month: 'long', day: 'numeric', year: 'numeric' })}</span>
        </div>
        <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0;">
          <span class="detail-label" style="color: #666; font-size: 14px;">Status</span>
          <span class="detail-value" style="font-weight: 600; color: #006B3D; font-size: 14px;">Active</span>
        </div>
      </div>
    `;

    buttonText = 'Explore Your Plan';
    buttonLink = `${PUBLIC_BASE_URL || ''}/settings`;
  }

  const html = renderBrandedEmail({
    title,
    preheader,
    bodyHtml,
    buttonText,
    buttonLink,
    showHero,
    heroTitle,
    heroSubtitle,
  });

  const text = bodyHtml.replace(/<[^>]*>/g, '').replace(/\n\s*\n/g, '\n\n').trim();

  try {
    await sendEmail({ to: user.email, subject, text, html });
  } catch (err) {
    log('failed to send payment confirmation email', { userId: user.id, email: user.email, paymentType, error: String(err) });
  }
}

async function sendPaymentCancelledEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Payment Cancelled</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your payment has been cancelled. This could be due to a timeout, customer cancellation, or payment method issue.</p>

    <div class="highlight-box" style="background: #FFF3E0; border-left: 4px solid #FF9800; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>No charges were made.</strong> You can try making the payment again if you wish.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Payment Cancelled',
    preheader: 'Your payment was cancelled',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Payment Cancelled', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send payment cancelled email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendDisputeAcceptedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Dispute Accepted</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">A dispute related to your payment has been accepted by the bank. The funds have been returned to the customer.</p>

    <div class="highlight-box" style="background: #FFEBEE; border-left: 4px solid #D32F2F; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription has been cancelled.</strong> Please contact support if you have any questions.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Dispute Accepted',
    preheader: 'Payment dispute accepted by bank',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Dispute Accepted', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send dispute accepted email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendDisputeCancelledEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Dispute Cancelled</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Good news! The dispute related to your payment has been cancelled and your account is in good standing.</p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription remains active.</strong> Thank you for your continued support!</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Dispute Cancelled',
    preheader: 'Payment dispute has been cancelled',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Dispute Cancelled', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send dispute cancelled email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendDisputeChallengedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFF3E0; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#FF9800" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Dispute Challenged</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">A dispute related to your payment has been challenged. The bank is reviewing the case.</p>

    <div class="highlight-box" style="background: #FFF3E0; border-left: 4px solid #FF9800; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription may be temporarily affected.</strong> We'll notify you once the review is complete.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Dispute Challenged',
    preheader: 'Payment dispute is being reviewed',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Dispute Challenged', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send dispute challenged email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendDisputeExpiredEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Dispute Expired</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Good news! The dispute related to your payment has expired. The dispute period has ended and the original charge stands.</p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your account remains in good standing.</strong> Thank you for your continued support!</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Dispute Expired',
    preheader: 'Payment dispute has expired',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Dispute Expired', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send dispute expired email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendDisputeLostEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Dispute Lost</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">We regret to inform you that the dispute has been decided in favor of the customer. The funds have been refunded.</p>

    <div class="highlight-box" style="background: #FFEBEE; border-left: 4px solid #D32F2F; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription has been cancelled.</strong> If you believe this is an error, please contact our support team.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Dispute Lost',
    preheader: 'Payment dispute was not successful',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Dispute Lost', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send dispute lost email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendDisputeWonEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Dispute Won</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Great news! The dispute has been decided in your favor. The original charge remains valid.</p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your account remains in good standing.</strong> Thank you for your patience during this process.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Dispute Won',
    preheader: 'Payment dispute was successful',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Dispute Won', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send dispute won email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendRefundFailedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFF3E0; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#FF9800" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Refund Failed</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">We attempted to process a refund but it was unsuccessful. This could be due to expired card details or payment processor issues.</p>

    <div class="highlight-box" style="background: #FFF3E0; border-left: 4px solid #FF9800; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Please contact support</strong> if you were expecting a refund but haven't received it.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Refund Failed',
    preheader: 'Refund processing failed',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Refund Failed', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send refund failed email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendPaymentFailedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Payment Failed</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your payment could not be processed. This could be due to insufficient funds, expired card, or other payment issues.</p>

    <div class="highlight-box" style="background: #FFEBEE; border-left: 4px solid #D32F2F; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription has been cancelled.</strong> Please update your payment method to reactivate.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Payment Failed',
    preheader: 'Your payment could not be processed',
    bodyHtml,
    buttonText: 'Update Payment',
    buttonLink: `${PUBLIC_BASE_URL || ''}/settings`,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Payment Failed', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send payment failed email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionActiveEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div class="success-icon" style="width: 72px; height: 72px; background: linear-gradient(135deg, #004225 0%, #006B3D 100%); border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#ffffff" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Your subscription is active!</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Great news! Your subscription has been activated successfully. You now have full access to your plan features.</p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Current Plan:</strong> ${user.plan ? user.plan.charAt(0).toUpperCase() + user.plan.slice(1) : 'Hobby'}</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Subscription Active',
    preheader: 'Your subscription is now active',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Subscription Active', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send subscription active email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionExpiredEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Subscription Expired</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your subscription has expired and you have been downgraded to the Hobby plan.</p>

    <div class="details-box" style="background: #f9f7f4; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid #e8e4de;">
      <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
        <span class="detail-label" style="color: #666; font-size: 14px;">Current Plan</span>
        <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">Hobby</span>
      </div>
      <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0;">
        <span class="detail-label" style="color: #666; font-size: 14px;">Status</span>
        <span class="detail-value" style="font-weight: 600; color: #D32F2F; font-size: 14px;">Expired</span>
      </div>
    </div>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Resubscribe anytime</strong> to regain access to all premium features and benefits.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Subscription Expired',
    preheader: 'Your subscription has expired',
    bodyHtml,
    buttonText: 'Renew Subscription',
    buttonLink: `${PUBLIC_BASE_URL || ''}/settings`,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Subscription Expired', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send subscription expired email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionOnHoldEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFF3E0; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#FF9800" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Subscription On Hold</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your subscription has been placed on hold. This could be due to a payment issue or account review.</p>

    <div class="highlight-box" style="background: #FFF3E0; border-left: 4px solid #FF9800; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Please update your payment method</strong> or contact support to reactivate your subscription.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Subscription On Hold',
    preheader: 'Your subscription is temporarily on hold',
    bodyHtml,
    buttonText: 'Update Payment',
    buttonLink: `${PUBLIC_BASE_URL || ''}/settings`,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Subscription On Hold', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send subscription on hold email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionPlanChangedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E3F2FD; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#1976D2" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M7.5 21L3 16.5m0 0L7.5 12M3 16.5h13.5m0-13.5L21 7.5m0 0L16.5 12M21 7.5H7.5" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Plan Changed</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your subscription plan has been updated successfully.</p>

    <div class="highlight-box" style="background: #E3F2FD; border-left: 4px solid #1976D2; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>New Plan:</strong> ${user.plan ? user.plan.charAt(0).toUpperCase() + user.plan.slice(1) : 'Hobby'}</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Plan Changed',
    preheader: 'Your subscription plan has been updated',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Plan Changed', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send plan changed email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionRenewedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div class="success-icon" style="width: 72px; height: 72px; background: linear-gradient(135deg, #004225 0%, #006B3D 100%); border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#ffffff" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Subscription Renewed!</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your subscription has been renewed successfully. Thank you for your continued support!</p>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Current Plan:</strong> ${user.plan ? user.plan.charAt(0).toUpperCase() + user.plan.slice(1) : 'Hobby'}</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Subscription Renewed',
    preheader: 'Your subscription has been renewed',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Subscription Renewed', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send subscription renewed email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendPaymentDisputeCreatedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Payment Dispute Created</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">A payment dispute has been created against your account. We are reviewing the case.</p>

    <div class="highlight-box" style="background: #FFEBEE; border-left: 4px solid #D32F2F; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription has been temporarily suspended.</strong> We'll notify you once the dispute is resolved.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Payment Dispute Created',
    preheader: 'A dispute has been created',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Payment Dispute Created', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send payment dispute created email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendChargeRefundedEmail(user, data) {
  if (!user || !user.email) return;

  const amount = data.amount || 0;
  const formattedAmount = new Intl.NumberFormat('en-US', { style: 'currency', currency: data.currency || 'USD' }).format(amount / 100);

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #E8F5EC; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#004225" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Refund Processed</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">We have processed a refund for your payment.</p>

    <div class="details-box" style="background: #f9f7f4; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid #e8e4de;">
      <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
        <span class="detail-label" style="color: #666; font-size: 14px;">Refund Amount</span>
        <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">${formattedAmount}</span>
      </div>
      <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0;">
        <span class="detail-label" style="color: #666; font-size: 14px;">Status</span>
        <span class="detail-value" style="font-weight: 600; color: #006B3D; font-size: 14px;">Refunded</span>
      </div>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Refund Processed',
    preheader: 'A refund has been processed',
    bodyHtml,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Refund Processed', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send refund processed email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionCancelledEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Subscription Cancelled</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your subscription has been cancelled and you have been downgraded to Hobby plan.</p>

    <div class="details-box" style="background: #f9f7f4; border-radius: 10px; padding: 20px; margin: 20px 0; border: 1px solid #e8e4de;">
      <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px solid #e8e4de;">
        <span class="detail-label" style="color: #666; font-size: 14px;">Current Plan</span>
        <span class="detail-value" style="font-weight: 600; color: #1a1a1a; font-size: 14px;">Hobby</span>
      </div>
      <div class="detail-row" style="display: flex; justify-content: space-between; padding: 10px 0;">
        <span class="detail-label" style="color: #666; font-size: 14px;">Status</span>
        <span class="detail-value" style="font-weight: 600; color: #D32F2F; font-size: 14px;">Cancelled</span>
      </div>
    </div>

    <div class="highlight-box" style="background: #E8F5EC; border-left: 4px solid #004225; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Resubscribe anytime</strong> to regain access to all premium features and benefits.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Subscription Cancelled',
    preheader: 'Your subscription has been cancelled',
    bodyHtml,
    buttonText: 'Resubscribe',
    buttonLink: `${PUBLIC_BASE_URL || ''}/settings`,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Subscription Cancelled', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send subscription cancelled email', { userId: user.id, email: user.email, error: String(err) });
  }
}

async function sendSubscriptionPaymentFailedEmail(user, data) {
  if (!user || !user.email) return;

  const bodyHtml = `
    <div style="text-align: center; margin-bottom: 24px;">
      <div style="width: 72px; height: 72px; background: #FFEBEE; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; margin-bottom: 16px;">
        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="#D32F2F" style="width: 36px; height: 36px;">
          <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
        </svg>
      </div>
      <p style="margin: 0; color: #1a1a1a; font-size: 16px;">Subscription Payment Failed</p>
    </div>

    <p style="margin-top: 0; margin-bottom: 16px; color: #1a1a1a;">Your subscription payment failed. This could be due to insufficient funds, expired card, or other payment issues.</p>

    <div class="highlight-box" style="background: #FFEBEE; border-left: 4px solid #D32F2F; padding: 16px 20px; margin: 16px 0; border-radius: 0 8px 8px 0;">
      <p style="margin: 0; font-size: 14px; color: #1a1a1a;"><strong>Your subscription has been cancelled.</strong> Please update your payment method to reactivate.</p>
    </div>
  `;

  const html = renderBrandedEmail({
    title: 'Subscription Payment Failed',
    preheader: 'Your subscription payment failed',
    bodyHtml,
    buttonText: 'Update Payment',
    buttonLink: `${PUBLIC_BASE_URL || ''}/settings`,
  });

  try {
    await sendEmail({ to: user.email, subject: 'Plugin Compass — Subscription Payment Failed', text: bodyHtml.replace(/<[^>]*>/g, '').trim(), html });
  } catch (err) {
    log('failed to send subscription payment failed email', { userId: user.id, email: user.email, error: String(err) });
  }
}

function findUserByEmail(email) {
  const normalized = (email || '').trim().toLowerCase();
  return usersDb.find(u => u.email === normalized);
}

function findUserByProvider(provider, providerId) {
  if (!provider || !providerId) return null;
  const normalizedProvider = provider.toLowerCase();
  return usersDb.find((u) =>
    Array.isArray(u.providers) &&
    u.providers.some((p) => p.provider === normalizedProvider && p.id === providerId)
  );
}

async function upsertOAuthUser(provider, providerId, email, profile = {}) {
  const normalizedProvider = (provider || '').toLowerCase();
  const normalizedEmail = (email || '').trim().toLowerCase();
  if (!normalizedProvider || !providerId) {
    throw new Error('OAuth provider and id are required');
  }

  const now = new Date().toISOString();
  let user = findUserByProvider(normalizedProvider, providerId) || (normalizedEmail ? findUserByEmail(normalizedEmail) : null);

  if (!user) {
    const placeholderPassword = await bcrypt.hash(randomBytes(32).toString('hex'), PASSWORD_SALT_ROUNDS);
    user = {
      id: randomUUID(),
      email: normalizedEmail || `noreply+${providerId}@example.com`,
      password: placeholderPassword,
      createdAt: now,
      lastLoginAt: now,
      providers: [],
      plan: null,
      billingStatus: DEFAULT_BILLING_STATUS,
      billingEmail: normalizedEmail,
      stripeCustomerId: '',
      stripePaymentMethodId: '',
      paymentMethodBrand: '',
      paymentMethodExpMonth: null,
      paymentMethodExpYear: null,
      paymentMethodLast4: '',
      dodoCustomerId: '',
      dodoSubscriptionId: '',
      billingCycle: null,
      subscriptionCurrency: null,
      subscriptionRenewsAt: null,
    };
    usersDb.push(user);
  }

  user.providers = Array.isArray(user.providers) ? user.providers : [];
  const existingProvider = user.providers.find((p) => p.provider === normalizedProvider && p.id === providerId);
  const providerPayload = {
    provider: normalizedProvider,
    id: providerId,
    email: normalizedEmail || existingProvider?.email || '',
    name: profile.name || profile.login || existingProvider?.name || '',
    avatar: profile.picture || profile.avatar_url || existingProvider?.avatar || '',
  };

  if (existingProvider) {
    Object.assign(existingProvider, providerPayload);
  } else {
    user.providers.push(providerPayload);
  }

  if (normalizedEmail && (!user.email || user.email.endsWith('@example.com'))) {
    user.email = normalizedEmail;
  }
  user.lastLoginAt = now;
  await persistUsersDb();
  log('OAuth user upserted', { provider: normalizedProvider, providerId, userId: user.id, email: user.email });
  return user;
}

function findUserById(userId) {
  return usersDb.find(u => u.id === userId);
}

async function createUser(email, password, options = {}) {
  const normalized = (email || '').trim().toLowerCase();
  if (!normalized || !password) {
    throw new Error('Email and password are required');
  }

  if (findUserByEmail(normalized)) {
    throw new Error('User already exists with this email');
  }

  const hashedPassword = await bcrypt.hash(password, PASSWORD_SALT_ROUNDS);
  const user = {
    id: randomUUID(),
    email: normalized,
    password: hashedPassword,
    createdAt: new Date().toISOString(),
    lastLoginAt: null,
    providers: [],
    emailVerified: false,
    verificationToken: '',
    verificationExpiresAt: null,
    resetToken: '',
    resetExpiresAt: null,
    plan: null,
    billingStatus: DEFAULT_BILLING_STATUS,
    billingEmail: normalized,
    stripeCustomerId: '',
    stripePaymentMethodId: '',
    paymentMethodBrand: '',
    paymentMethodExpMonth: null,
    paymentMethodExpYear: null,
    paymentMethodLast4: '',
    dodoCustomerId: '',
    dodoSubscriptionId: '',
    billingCycle: null,
    subscriptionCurrency: null,
    subscriptionRenewsAt: null,
    referredByAffiliateCode: sanitizeAffiliateCode(options.referredByAffiliateCode),
    affiliateAttributionAt: options.referredByAffiliateCode ? new Date().toISOString() : null,
    affiliatePayouts: [],
    onboardingCompleted: false,
  };

  assignVerificationToken(user);
  usersDb.push(user);
  await persistUsersDb();
  log('Created new user', { userId: user.id, email: user.email });
  return user;
}

async function verifyUserPassword(email, password) {
  const user = findUserByEmail(email);
  if (!user || typeof user.password !== 'string' || !user.password.length) return null;

  const isValid = await bcrypt.compare(password, user.password);
  if (!isValid) {
    // Track failed attempts
    user.failedLogins = (user.failedLogins || 0) + 1;

    // Lock account after 5 failed attempts
    if (user.failedLogins >= 5) {
      user.lockedUntil = Date.now() + LOGIN_LOCKOUT_MS;
      log('account locked due to failed attempts', { email, failedAttempts: user.failedLogins });
    }

    await persistUsersDb();
    return null;
  }

  // Update last login
  user.lastLoginAt = new Date().toISOString();
  user.failedLogins = 0;
  user.lockedUntil = null;
  await persistUsersDb();
  return user;
}

function normalizePlanSelection(plan) {
  const candidate = (plan || '').toString().trim().toLowerCase();
  return USER_PLANS.includes(candidate) ? candidate : null;
}

function resolveUserPlan(userId) {
  const user = findUserById(userId);
  return normalizePlanSelection(user?.plan) || DEFAULT_PLAN;
}

function getPlanAppLimit(plan) {
  const key = normalizePlanSelection(plan) || DEFAULT_PLAN;
  const limit = PLAN_APP_LIMITS[key];
  return Number.isFinite(limit) ? limit : Infinity;
}

function isPaidPlan(plan) {
  const normalized = (plan || '').toLowerCase();
  return PAID_PLANS.has(normalized);
}

function planPriority(plan) {
  const normalized = normalizePlanSelection(plan) || DEFAULT_PLAN;
  if (normalized === 'enterprise') return 4;
  if (normalized === 'professional') return 3;
  if (normalized === 'starter') return 2;
  return 1; // hobby
}

async function applyPlanPriorityDelay(plan) {
  const priority = planPriority(plan);
  if (priority === 4) return;
  let delayMs = HOBBY_PRIORITY_DELAY_MS;
  if (priority === 3) delayMs = BUSINESS_PRIORITY_DELAY_MS;
  else if (priority === 2) delayMs = STARTER_PRIORITY_DELAY_MS;

  await delay(delayMs);
}

function resolveFallbackModel(cli = 'opencode') {
  const configured = getConfiguredModels(cli);
  if (Array.isArray(configured) && configured.length) {
    return configured[0].name || configured[0].id || 'default';
  }
  return 'default';
}

function refreshAdminModelIndex() {
  const next = new Map();
  adminModels.forEach((model) => {
    if (!model) return;
    const idKey = String(model.id || '').trim();
    const nameKey = String(model.name || '').trim();
    if (idKey) next.set(`id:${idKey}`, model);
    if (nameKey) next.set(`name:${nameKey}`, model);
  });
  adminModelIndex = next;
}

function getAdminModelByIdOrName(value) {
  const key = String(value || '').trim();
  if (!key) return null;
  return adminModelIndex.get(`id:${key}`) || adminModelIndex.get(`name:${key}`) || null;
}

function resolvePlanModel(plan, requestedModel) {
  const normalized = normalizePlanSelection(plan) || DEFAULT_PLAN;
  const rawRequested = (requestedModel || '').trim();
  const requestedRecord = rawRequested ? getAdminModelByIdOrName(rawRequested) : null;
  const normalizedRequested = requestedRecord ? requestedRecord.name : '';
  const requested = normalizedRequested || rawRequested;
  const requestedTier = getModelTier(requested);
  
  // If user explicitly requests a valid model (not 'auto'), use it
  if (requested && requestedTier && requested !== AUTO_MODEL_TOKEN) {
    return requested;
  }
  
  const candidateList = getConfiguredModels();
  
  // For hobby/free plan users, use the admin-configured auto model
  if (normalized === 'hobby') {
    const adminDefault = (planSettings.freePlanModel || '').trim();
    if (adminDefault) return adminDefault;
    const firstModel = candidateList[0];
    if (firstModel) return firstModel.name;
    return resolveFallbackModel();
  }
  
  // For paid plans: respect user's model choice
  // If they requested a specific model (even without a tier), use it
  // Only fall back to first configured if they didn't request anything or requested 'auto'
  if (requested && requested !== AUTO_MODEL_TOKEN) {
    return requested;
  }
  
  // No specific request or 'auto' requested - use first configured model
  if (candidateList.length) {
    return candidateList[0].name;
  }
  
  return resolveFallbackModel();
}

function addMonthsSafely(date, months) {
  const base = new Date(date);
  const day = base.getDate();
  base.setDate(1);
  base.setMonth(base.getMonth() + months);
  const lastDay = new Date(base.getFullYear(), base.getMonth() + 1, 0).getDate();
  base.setDate(Math.min(day, lastDay));
  return base;
}

function computeRenewalDate(cycle = 'monthly') {
  const now = new Date();
  if (cycle === 'yearly') return addMonthsSafely(now, 12).toISOString();
  return addMonthsSafely(now, 1).toISOString();
}

async function serializeAccount(user) {
  if (!user) return null;
  const normalizedPayouts = Array.isArray(user.affiliatePayouts)
    ? user.affiliatePayouts.map((p) => normalizePlanSelection(p)).filter(Boolean)
    : [];
  
  let paymentMethod = null;
  if (user.dodoSubscriptionId && DODO_ENABLED) {
    try {
      const subscription = await dodoRequest(`/subscriptions/${user.dodoSubscriptionId}`, {
        method: 'GET',
      });
      
      if (subscription && subscription.payment_method) {
        const pm = subscription.payment_method;
        paymentMethod = {
          brand: pm.card?.brand || pm.payment_method || 'Card',
          last4: pm.card?.last4 || pm.card?.last_digits || '',
          expiresAt: pm.card?.expiry || pm.card?.expires_at || '',
        };
      }
    } catch (error) {
      console.error('[SerializeAccount] Failed to fetch payment method:', error.message);
    }
  }

  return {
    id: user.id,
    email: user.email,
    plan: user.plan || DEFAULT_PLAN,
    billingStatus: user.billingStatus || DEFAULT_BILLING_STATUS,
    billingEmail: user.billingEmail || user.email || '',
    subscriptionRenewsAt: user.subscriptionRenewsAt || null,
    referredByAffiliateCode: sanitizeAffiliateCode(user.referredByAffiliateCode),
    affiliateAttributionAt: user.affiliateAttributionAt || null,
    affiliatePayouts: normalizedPayouts,
    createdAt: user.createdAt || null,
    lastLoginAt: user.lastLoginAt || null,
    unlimitedUsage: Boolean(user.unlimitedUsage),
    balance: Number(user.balance || 0),
    currency: String(user.currency || 'usd').toLowerCase(),
    limits: {
      uploadZipBytes: MAX_UPLOAD_ZIP_SIZE,
    },
    tokenUsage: getTokenUsageSummary(user.id, user.plan || DEFAULT_PLAN),
    paymentMethod,
  };
}

function readUserSessionToken(req) {
  try {
    const cookieHeader = req?.headers?.cookie || '';
    if (!cookieHeader) return '';
    const parts = cookieHeader.split(';').map((p) => p.trim());
    const match = parts.find((p) => p.startsWith(`${USER_COOKIE_NAME}=`));
    if (!match) return '';
    return decodeURIComponent(match.split('=').slice(1).join('=') || '');
  } catch (_) {
    return '';
  }
}

function getUserSession(req) {
  const token = readUserSessionToken(req);
  if (!token) return null;

  const session = userSessions.get(token);
  if (!session) return null;

  if (session.expiresAt && session.expiresAt < Date.now()) {
    userSessions.delete(token);
    persistUserSessions().catch(() => {});
    return null;
  }

  // Update last active for the user (throttled to once every 5 mins)
  try {
    const user = findUserById(session.userId);
    if (user) {
      const now = new Date();
      const lastActive = user.lastActiveAt ? new Date(user.lastActiveAt) : new Date(0);
      if (now.getTime() - lastActive.getTime() > 300000) {
        user.lastActiveAt = now.toISOString();
        persistUsersDb().catch(() => {});
      }
    }
  } catch (_) {}

  return { token, userId: session.userId, expiresAt: session.expiresAt };
}

function startUserSession(res, userId, remember = false) {
  const token = randomUUID();
  const ttl = remember ? USER_SESSION_TTL_MS : USER_SESSION_SHORT_TTL_MS;
  const expiresAt = Date.now() + ttl;
  userSessions.set(token, { userId, expiresAt });
  persistUserSessions().catch(() => {});

  const parts = [
    `${USER_COOKIE_NAME}=${encodeURIComponent(token)}`,
    'Path=/',
    'HttpOnly',
    'SameSite=Lax',
    `Max-Age=${Math.floor(ttl / 1000)}`,
  ];
  if (process.env.COOKIE_SECURE === '0') parts.push('Secure');
  res.setHeader('Set-Cookie', parts.join('; '));

  return token;
}

function clearUserSession(res) {
  res.setHeader('Set-Cookie', `${USER_COOKIE_NAME}=deleted; Path=/; Max-Age=0; SameSite=Lax`);
}

function requireUserAuth(req, res) {
  const session = getUserSession(req);
  if (!session) {
    sendJson(res, 401, { error: 'User authentication required' });
    return null;
  }
  return session;
}

function buildWorkspacePaths(session) {
  const userSegment = sanitizeSegment(session.userId || 'anonymous', 'anonymous');
  const appSegment = sanitizeSegment(session.appId || session.id || 'app', 'app');
  const workspaceDir = path.join(WORKSPACES_ROOT, userSegment, appSegment);
  const uploadsDir = path.join(workspaceDir, 'uploads');
  return { workspaceDir, uploadsDir };
}

async function ensureSessionPaths(session) {
  const paths = buildWorkspacePaths(session);
  session.workspaceDir = paths.workspaceDir;
  session.uploadsDir = paths.uploadsDir;
  session.attachmentKey = session.attachmentKey || randomUUID();
  await fs.mkdir(session.workspaceDir, { recursive: true });
  await fs.mkdir(session.uploadsDir, { recursive: true });
  await ensureOpencodeConfig(session);
  return session;
}

async function ensureOpencodeConfig(session) {
  if (!ENABLE_EXTERNAL_DIR_RESTRICTION) {
    return;
  }
  if (!session?.workspaceDir || !session?.appId) {
    return;
  }

  const userSegment = sanitizeSegment(session.userId || 'anonymous', 'anonymous');
  const appSegment = sanitizeSegment(session.appId || session.id || 'app', 'app');

  const providerName = OPENCODE_OLLAMA_PROVIDER || 'openai';
  const modelId = OPENCODE_OLLAMA_MODEL || 'qwen3:0.6b';
  // Respect the base URL exactly as provided by OPENCODE_OLLAMA_BASE_URL (trim trailing slashes)
  const baseUrl = (OPENCODE_OLLAMA_BASE_URL || 'https://ollama.plugincompass.com').replace(/\/+$/, '');

  const providerCfg = {
    options: {
      baseURL: baseUrl
    },
    models: {
      [modelId]: {
        id: modelId,
        name: modelId,
        tool_call: true,
        temperature: true
      }
    }
  };
  if (OPENCODE_OLLAMA_API_KEY) {
    providerCfg.options.apiKey = OPENCODE_OLLAMA_API_KEY;
  }

  const config = {
    $schema: 'https://opencode.ai/config.json',
    model: `${providerName}/${modelId}`,
    small_model: `${providerName}/${modelId}`,
    permission: {
      external_directory: {
        '*': 'deny',
        [`*/${appSegment}/*`]: 'allow',
        [`apps/${userSegment}/${appSegment}/*`]: 'allow'
      }
    },
    provider: {
      [providerName]: providerCfg
    }
  }; 

  const configPath = path.join(session.workspaceDir, 'opencode.json');

  try {
    await fs.writeFile(
      configPath,
      JSON.stringify(config, null, 2),
      'utf8'
    );
    log('Created opencode config for session', {
      sessionId: session.id,
      appId: appSegment,
      userId: userSegment
    });
  } catch (err) {
    log('Failed to create opencode config', {
      sessionId: session.id,
      error: String(err)
    });
  }
}

function newOpencodeSessionId() {
  return `ses-${randomUUID()}`;
}

async function ensureOpencodeSession(session, model) {
  if (!session) return null;
  await ensureSessionPaths(session);

  const targetModel = model || session.model;
  const workspaceDir = session.workspaceDir;
  if (!workspaceDir) throw new Error('Session workspace directory not initialized');

  // If we have an initial session ID locked, always use it without validation
  // This ensures session continuity across all messages in the builder
  if (session.initialOpencodeSessionId) {
    log('Using locked initial opencode session', {
      sessionId: session.id,
      lockedSessionId: session.initialOpencodeSessionId,
      currentSessionId: session.opencodeSessionId
    });

    // Ensure session.opencodeSessionId is synced with initial
    if (session.opencodeSessionId !== session.initialOpencodeSessionId) {
      session.opencodeSessionId = session.initialOpencodeSessionId;
      await persistState();
    }
    return session.initialOpencodeSessionId;
  }

  // If session already has an opencode session ID (but no locked initial), verify it exists in CLI listing.
  // (Previously we only checked that "list" ran, which doesn't validate the id.)
  if (session.opencodeSessionId) {
    try {
      const cliCommand = resolveCliCommand('opencode');
      const listCandidates = [
        ['session', '--list', '--json'],
        ['sessions', '--list', '--json'],
        ['session', 'list', '--json'],
        ['sessions', 'list', '--json'],
      ];

      let stdout = '';
      for (const args of listCandidates) {
        try {
          const result = await runCommand(cliCommand, args, { timeout: 7000, cwd: workspaceDir });
          stdout = result.stdout || '';
          if (stdout) break;
        } catch (_) {
          // try next candidate
        }
      }

      if (stdout) {
        try {
          const parsed = JSON.parse(stdout);
          const items = Array.isArray(parsed)
            ? parsed
            : (Array.isArray(parsed.sessions) ? parsed.sessions : (Array.isArray(parsed.data) ? parsed.data : []));
          const ids = items.map((it) => it?.id || it?.sessionId || it?.session_id).filter(Boolean);
          if (ids.includes(session.opencodeSessionId)) {
            return session.opencodeSessionId;
          }
          log('stored opencode session id not found in list; using stored id for continuity', { stored: session.opencodeSessionId });
          return session.opencodeSessionId;
        } catch (err) {
          // If JSON parse fails, try to continue with existing id
          log('opencode session list unparseable; attempting to use stored id', { stored: session.opencodeSessionId, err: String(err) });
          return session.opencodeSessionId;
        }
      } else {
        // Cannot list sessions; try to use stored id and let CLI handle it
        log('cannot list sessions; falling back to stored id', { stored: session.opencodeSessionId });
        return session.opencodeSessionId;
      }
    } catch (err) {
      log('existing opencode session validation failed', { sessionId: session.opencodeSessionId, err: String(err) });
      // CRITICAL FIX: If validation fails, don't create a new session - return existing one
      // This prevents creating a new OpenCode session on every message when CLI operations fail
      log('Using existing opencode session ID despite validation failure for continuity', { stored: session.opencodeSessionId });
      return session.opencodeSessionId;
    }
    // If we reach here, the existing session ID may be invalid - continue to create new below
  }

  // Create a new opencode session using the createOpencodeSession helper
  const freshId = newOpencodeSessionId();
  try {
    const sessionId = await createOpencodeSession(freshId, targetModel, workspaceDir);
    if (sessionId) {
      session.opencodeSessionId = sessionId;
      // CRITICAL FIX: Only set initialOpencodeSessionId if not already set
      // This prevents overwriting the initial session ID when creating subsequent sessions
      if (!session.initialOpencodeSessionId) {
        session.initialOpencodeSessionId = sessionId; // Lock this as the initial session
        log('Created and locked new opencode session', { sessionId, model: targetModel });
      } else {
        log('Updated opencode session ID (preserving initial)', {
          sessionId,
          initialSessionId: session.initialOpencodeSessionId,
          model: targetModel
        });
      }
      await persistState();
      return sessionId;
    }
  } catch (err) {
    log('Failed to create opencode session', { err: String(err), desiredId: freshId, model: targetModel });
  }

  // If createOpencodeSession failed, try a simple direct approach
  // This handles cases where CLI doesn't support expected session commands
  try {
    // We cannot just generate a random ID because CLI will crash if session file doesn't exist.
    // Instead, we return null to let the run command create a new session implicitly.
    log('Cannot create explicit session, will rely on auto-creation during run', { model: targetModel });
    return null;
  } catch (error) {
    log('Failed to setup opencode session', { error: String(error), model: targetModel });
    return null;
  }
}

function normalizeCli(cli) {
  const name = (cli || '').toLowerCase();
  return SUPPORTED_CLIS.includes(name) ? name : 'opencode';
}

function resolveCliCommand(cli) {
  const normalized = normalizeCli(cli);
  const binDir = process.env.OPENCODE_BIN_DIR || '/root/.opencode/bin';
  const candidates = [];
  if (binDir) candidates.push(path.join(binDir, normalized));
  candidates.push(`/usr/local/bin/${normalized}`);
  candidates.push(normalized);
  for (const candidate of candidates) {
    try {
      fsSync.accessSync(candidate, fsSync.constants.X_OK);
      return candidate;
    } catch (_) { }
  }
  log('CLI command not found on PATH; falling back to raw name', { cli: normalized, candidates });
  return normalized;
}

async function ensureStateFile() {
  try {
    await fs.mkdir(STATE_DIR, { recursive: true });
    await fs.mkdir(UPLOADS_DIR, { recursive: true });
    await fs.mkdir(WORKSPACES_ROOT, { recursive: true });
  } catch (error) {
    log('Error creating state directories', { error: String(error), STATE_DIR, UPLOADS_DIR, WORKSPACES_ROOT });
  }
  try { await fs.access(STATE_FILE); } catch (_) {
    try {
      await fs.writeFile(STATE_FILE, JSON.stringify(state, null, 2), 'utf8');
    } catch (writeError) {
      log('Error initializing state file', { error: String(writeError), STATE_FILE });
    }
  }
}

async function loadState() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(STATE_FILE, 'utf8');
    const parsed = JSON.parse(raw || '{}');
    const savedSessions = Array.isArray(parsed.sessions) ? parsed.sessions : [];
    state.sessions = [];
    for (const saved of savedSessions) {
      const session = {
        ...saved,
        cli: normalizeCli(saved.cli),
        userId: sanitizeSegment(saved.userId || 'anonymous', 'anonymous'),
        appId: sanitizeSegment(saved.appId || saved.id || 'app', 'app'),
        entryMode: saved.entryMode === 'opencode' ? 'opencode' : 'plan',
        source: saved.source || 'builder',
        planApproved: !!saved.planApproved,
        opencodeSessionId: saved.opencodeSessionId || saved.opencodeSession,
        initialOpencodeSessionId: saved.initialOpencodeSessionId || saved.opencodeSessionId,
      };
      if (session.opencodeSession) delete session.opencodeSession;
      try {
        await ensureSessionPaths(session);
      } catch (err) {
        log('Failed to ensure session paths while loading state', { err: String(err), sessionId: session.id });
      }

      // Restore running/queued messages after server restart to allow continuation
      if (Array.isArray(session.messages)) {
        let sessionModified = false;
        session.messages.forEach(msg => {
          if (msg.status === 'running' || msg.status === 'queued') {
            log('Restoring interrupted message after restart', { sessionId: session.id, messageId: msg.id, prevStatus: msg.status });
            // Reset to queued state so it can be retried automatically
            msg.status = 'queued';
            msg.retryAfterRestart = true;
            msg.restartedAt = new Date().toISOString();
            sessionModified = true;
          }
        });
        if (sessionModified) {
          // Keep pending count to trigger automatic retry
          session.updatedAt = new Date().toISOString();
          session.restoredAfterRestart = true;
        }
      }

      state.sessions.push(session);
    }
    log(`Loaded ${state.sessions.length} sessions from ${STATE_FILE}`);
    // If any sessions were modified during cleanup, persist the changes
    await persistState();
  } catch (error) {
    log('Failed to load state, starting fresh', { error: String(error) });
    state.sessions = [];
  }
}

async function persistState() {
  try {
    // Prepare state with additional runtime information for graceful restart
    const stateToSave = {
      sessions: state.sessions.map(session => ({
        ...session,
        lastSavedAt: new Date().toISOString(),
        activeQueues: sessionQueues.has(session.id),
        hasActiveStreams: activeStreams.has(session.id)
      })),
      serverVersion: '2.0',
      savedAt: new Date().toISOString()
    };
    const safe = JSON.stringify(stateToSave, null, 2);
    await safeWriteFile(STATE_FILE, safe);
  } catch (error) {
    log('persistState failed', { error: String(error), STATE_FILE });
  }
}

async function restoreInterruptedSessions() {
  try {
    let restoredCount = 0;
    let messageCount = 0;
    
    for (const session of state.sessions) {
      if (!session.restoredAfterRestart) continue;
      
      let hasQueuedMessages = false;
      if (Array.isArray(session.messages)) {
        for (const msg of session.messages) {
          if (msg.status === 'queued' && msg.retryAfterRestart) {
            hasQueuedMessages = true;
            messageCount++;
            log('Restoring message after restart', { 
              sessionId: session.id, 
              messageId: msg.id,
              role: msg.role 
            });
          }
        }
      }
      
      if (hasQueuedMessages) {
        restoredCount++;
        // Clear the restart flag
        delete session.restoredAfterRestart;
      }
    }
    
    if (restoredCount > 0) {
      log(`Restored ${restoredCount} sessions with ${messageCount} queued messages after restart`);
      await persistState();
    } else {
      log('No interrupted sessions to restore');
    }
  } catch (error) {
    log('Failed to restore interrupted sessions', { error: String(error) });
  }
}

async function cleanupOrphanedWorkspaces() {
  try {
    const workspaceRoot = path.resolve(WORKSPACES_ROOT);
    
    // Check if workspaces root exists
    try {
      await fs.access(workspaceRoot);
    } catch {
      log('Workspaces root does not exist, skipping orphaned workspace cleanup');
      return;
    }
    
    // Create a set of all active workspace directories from current sessions
    const activeWorkspaceDirs = new Set();
    for (const session of state.sessions) {
      if (session.workspaceDir) {
        const normalizedPath = path.resolve(session.workspaceDir);
        if (normalizedPath.startsWith(workspaceRoot)) {
          activeWorkspaceDirs.add(normalizedPath);
        }
      }
    }
    
    let cleanedCount = 0;
    let errorCount = 0;
    
    // Recursively walk through workspaces directory
    async function scanAndClean(dirPath) {
      const entries = await fs.readdir(dirPath, { withFileTypes: true });
      
      for (const entry of entries) {
        const fullPath = path.join(dirPath, entry.name);
        const normalizedPath = path.resolve(fullPath);
        
        if (!normalizedPath.startsWith(workspaceRoot)) {
          continue; // Skip paths outside workspace root
        }
        
        if (entry.isDirectory()) {
          // Check if this directory is an active workspace
          if (activeWorkspaceDirs.has(normalizedPath)) {
            // This is an active workspace, skip it but don't recurse into it
            continue;
          }
          
          // Recursively scan subdirectories
          await scanAndClean(fullPath);
          
          // After scanning children, if this directory is empty (we cleaned all children) and not active, delete it
          try {
            const remainingEntries = await fs.readdir(fullPath);
            if (remainingEntries.length === 0) {
              await fs.rm(fullPath, { recursive: true, force: true });
              cleanedCount++;
              log('Cleaned orphaned workspace directory', { path: fullPath });
            }
          } catch (err) {
            errorCount++;
            log('Failed to check/clean orphaned workspace', { path: fullPath, error: String(err) });
          }
        }
      }
    }
    
    await scanAndClean(workspaceRoot);
    
    if (cleanedCount > 0) {
      log(`Orphaned workspace cleanup completed: ${cleanedCount} directories cleaned${errorCount > 0 ? `, ${errorCount} errors` : ''}`);
    } else {
      log('Orphaned workspace cleanup: no orphaned directories found');
    }
  } catch (error) {
    log('Failed to clean orphaned workspaces', { error: String(error) });
  }
}

function sanitizeMessage(message) { if (!message) return ''; return message.toString().trim(); }

async function ensureAssetsDir() { await fs.mkdir(ASSETS_DIR, { recursive: true }); }

async function loadAdminModelStore() {
  try {
    await ensureStateFile();
    await ensureAssetsDir();
    const raw = await fs.readFile(ADMIN_MODELS_FILE, 'utf8').catch(() => '[]');
    const parsed = JSON.parse(raw || '[]');
    if (Array.isArray(parsed)) adminModels = parsed;
    else if (Array.isArray(parsed.models)) adminModels = parsed.models;
    else adminModels = [];
    adminModels = adminModels.map((m) => {
      const providersRaw = Array.isArray(m.providers) && m.providers.length
        ? m.providers
        : [{ provider: 'opencode', model: m.name, primary: true }];
      const providers = providersRaw.map((p, idx) => ({
        provider: normalizeProviderName(p.provider || p.name || 'opencode'),
        model: (p.model || p.name || m.name || '').trim() || m.name,
        primary: typeof p.primary === 'boolean' ? p.primary : idx === 0,
      })).filter((p) => !!p.model);
      const primaryProvider = providers.find((p) => p.primary)?.provider || providers[0]?.provider || 'opencode';
      return {
        id: m.id || randomUUID(),
        name: m.name,
        label: m.label || m.name,
        icon: m.icon || '',
        cli: normalizeCli(m.cli || 'opencode'),
        providers,
        primaryProvider,
        tier: normalizeTier(m.tier),
        supportsMedia: m.supportsMedia ?? false,
      };
    }).filter((m) => !!m.name);
    refreshAdminModelIndex();
  } catch (error) {
    log('Failed to load admin models, starting empty', { error: String(error) });
    adminModels = [];
    refreshAdminModelIndex();
  }
}

async function persistAdminModels() {
  await ensureStateFile();
  await ensureAssetsDir();
  const payload = JSON.stringify(adminModels, null, 2);
  await safeWriteFile(ADMIN_MODELS_FILE, payload);
  refreshAdminModelIndex();
}

async function loadOpenRouterSettings() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(OPENROUTER_SETTINGS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (typeof parsed.primaryModel === 'string') openrouterSettings.primaryModel = parsed.primaryModel;
      if (typeof parsed.backupModel1 === 'string') openrouterSettings.backupModel1 = parsed.backupModel1;
      if (typeof parsed.backupModel2 === 'string') openrouterSettings.backupModel2 = parsed.backupModel2;
      if (typeof parsed.backupModel3 === 'string') openrouterSettings.backupModel3 = parsed.backupModel3;
    }
  } catch (error) {
    log('Failed to load OpenRouter settings, using defaults', { error: String(error) });
  }
}

async function persistOpenRouterSettings() {
  await ensureStateFile();
  const payload = JSON.stringify(openrouterSettings, null, 2);
  await safeWriteFile(OPENROUTER_SETTINGS_FILE, payload);
}

async function loadMistralSettings() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(MISTRAL_SETTINGS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (typeof parsed.primaryModel === 'string') mistralSettings.primaryModel = parsed.primaryModel;
      if (typeof parsed.backupModel1 === 'string') mistralSettings.backupModel1 = parsed.backupModel1;
      if (typeof parsed.backupModel2 === 'string') mistralSettings.backupModel2 = parsed.backupModel2;
      if (typeof parsed.backupModel3 === 'string') mistralSettings.backupModel3 = parsed.backupModel3;
    }
  } catch (error) {
    log('Failed to load Mistral settings, using defaults', { error: String(error) });
  }
}

async function persistMistralSettings() {
  await ensureStateFile();
  const payload = JSON.stringify(mistralSettings, null, 2);
  await safeWriteFile(MISTRAL_SETTINGS_FILE, payload);
}

async function loadPlanSettings() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(path.join(STATE_DIR, 'plan-settings.json'), 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (typeof parsed.provider === 'string' && PLANNING_PROVIDERS.includes(normalizeProviderName(parsed.provider))) {
        planSettings.provider = normalizeProviderName(parsed.provider);
      }
      if (typeof parsed.freePlanModel === 'string') {
        planSettings.freePlanModel = parsed.freePlanModel.trim();
      }
      if (Array.isArray(parsed.planningChain)) {
        planSettings.planningChain = normalizePlanningChain(parsed.planningChain);
      }
    }
    if (!planSettings.planningChain.length) {
      planSettings.planningChain = defaultPlanningChainFromSettings(planSettings.provider);
    }
  } catch (error) {
    log('Failed to load plan settings, using defaults', { error: String(error) });
  }
}

async function persistPlanSettings() {
  await ensureStateFile();
  const payload = JSON.stringify(planSettings, null, 2);
  await safeWriteFile(path.join(STATE_DIR, 'plan-settings.json'), payload);
}

function normalizePlanningChain(chain) {
  if (!Array.isArray(chain)) return [];
  const seen = new Set();
  const normalized = [];
  for (const entry of chain) {
    // Start with provider from the entry or fallback to planSettings
    let provider = normalizeProviderName(entry?.provider || planSettings.provider || 'openrouter');
    if (!PLANNING_PROVIDERS.includes(provider)) continue;

    // Preserve the original user input (raw) while still normalizing a model
    // for runtime usage. `raw` lets the admin UI show exactly what was entered
    // (e.g., "groq/compound-mini") even if the normalized model value omits
    // the provider prefix for API calls.
    const rawModel = (typeof entry?.raw === 'string' && entry.raw.trim())
      ? entry.raw.trim()
      : (typeof entry?.model === 'string' ? entry.model.trim() : '');

    const parsed = parseModelString(rawModel);
    if (parsed.provider) {
      provider = parsed.provider;
    }
    const model = parsed.model || rawModel;

    const key = `${provider}::${model || '__any__'}`;
    if (seen.has(key)) continue;
    seen.add(key);
    // Store both a normalized `model` (used at runtime) and the original `raw`
    // input so the admin UI can display what the user actually typed.
    normalized.push({ provider, model, raw: rawModel || undefined });
    if (normalized.length >= 25) break;
  }
  return normalized;
}

function defaultPlanningChainFromSettings(preferredProvider) {
  const provider = PLANNING_PROVIDERS.includes(normalizeProviderName(preferredProvider))
    ? normalizeProviderName(preferredProvider)
    : 'openrouter';

  let primaryChain = [];
  if (provider === 'mistral') {
    primaryChain = buildMistralPlanChain();
  } else if (provider === 'groq') {
    primaryChain = buildGroqPlanChain();
  } else if (provider === 'google') {
    primaryChain = buildGooglePlanChain();
  } else if (provider === 'nvidia') {
    primaryChain = buildNvidiaPlanChain();
  } else {
    primaryChain = buildOpenRouterPlanChain();
  }

  const base = primaryChain.map((model) => ({ provider, model }));

  // Add OpenRouter as fallback for non-OpenRouter providers
  if (provider !== 'openrouter') {
    buildOpenRouterPlanChain().forEach((model) => base.push({ provider: 'openrouter', model }));
  }

  return normalizePlanningChain(base);
}

function normalizeProviderName(name) {
  return (name || '').toString().trim().toLowerCase() || 'opencode';
}

const KNOWN_USAGE_PROVIDERS = new Set(['openrouter', 'mistral', 'opencode', 'google', 'groq', 'nvidia']);

// Treat unknown "provider" labels that are really OpenRouter model families (e.g. openai/anthropic)
// as OpenRouter for usage + rate-limits, so admin charts roll up correctly.
function normalizeUsageProvider(provider, model = '') {
  const key = normalizeProviderName(provider);
  if (KNOWN_USAGE_PROVIDERS.has(key)) return key;
  const modelStr = (model || '').toString();
  if (modelStr.includes('/')) return 'openrouter';
  return key;
}

function sanitizeLimitNumber(value) {
  const num = Number(value);
  return Number.isFinite(num) && num > 0 ? num : 0;
}

function defaultProviderLimit(provider) {
  return {
    provider: normalizeProviderName(provider),
    scope: 'provider',
    tokensPerMinute: 0,
    tokensPerDay: 0,
    requestsPerMinute: 0,
    requestsPerDay: 0,
    perModel: {},
  };
}

function extractProviderName(p) {
  return normalizeProviderName((p && (p.provider || p.name)) || DEFAULT_PROVIDER_FALLBACK);
}

function collectProviderSeeds() {
  const seeds = new Set(DEFAULT_PROVIDER_SEEDS);
  Object.keys(providerLimits.limits || {}).forEach((p) => seeds.add(normalizeProviderName(p)));
  Object.keys(providerUsage || {}).forEach((p) => seeds.add(normalizeProviderName(p)));
  adminModels.forEach((m) => {
    (m.providers || []).forEach((p) => seeds.add(extractProviderName(p)));
  });
  (planSettings.planningChain || []).forEach((entry) => seeds.add(normalizeProviderName(entry.provider)));
  return Array.from(seeds);
}

function ensureProviderLimitDefaults(provider) {
  const key = normalizeProviderName(provider);
  if (!providerLimits.limits[key]) providerLimits.limits[key] = defaultProviderLimit(key);
  const cfg = providerLimits.limits[key];
  cfg.scope = cfg.scope === 'model' ? 'model' : 'provider';
  cfg.tokensPerMinute = sanitizeLimitNumber(cfg.tokensPerMinute);
  cfg.tokensPerDay = sanitizeLimitNumber(cfg.tokensPerDay);
  cfg.requestsPerMinute = sanitizeLimitNumber(cfg.requestsPerMinute);
  cfg.requestsPerDay = sanitizeLimitNumber(cfg.requestsPerDay);
  cfg.perModel = cfg.perModel && typeof cfg.perModel === 'object' ? cfg.perModel : {};
  Object.keys(cfg.perModel).forEach((model) => {
    const entry = cfg.perModel[model] || {};
    cfg.perModel[model] = {
      tokensPerMinute: sanitizeLimitNumber(entry.tokensPerMinute),
      tokensPerDay: sanitizeLimitNumber(entry.tokensPerDay),
      requestsPerMinute: sanitizeLimitNumber(entry.requestsPerMinute),
      requestsPerDay: sanitizeLimitNumber(entry.requestsPerDay),
    };
  });
  return cfg;
}

async function discoverProviderModels() {
  const map = new Map();
  const add = (provider, model) => {
    const key = normalizeProviderName(provider || DEFAULT_PROVIDER_FALLBACK);
    if (!map.has(key)) map.set(key, new Set());
    if (model) map.get(key).add(model);
  };

  collectProviderSeeds().forEach((p) => add(p));

  adminModels.forEach((m) => {
    (m.providers || []).forEach((p) => add(extractProviderName(p), p.model || m.name));
  });

  (planSettings.planningChain || []).forEach((entry) => {
    add(entry.provider, entry.model);
  });

  try {
    const models = await listModels(DEFAULT_PROVIDER_FALLBACK);
    models.forEach((m) => {
      // listModels may return strings or objects; handle both.
      const name = m.name || m.id || m;
      if (!name || typeof name !== 'string') return;
      const parts = name.split('/');
      if (parts.length > 1 && parts[0]) add(parts[0], name);
      else add(DEFAULT_PROVIDER_FALLBACK, name);
    });
  } catch (err) {
    log('provider discovery failed', { error: String(err) });
  }

  const providers = Array.from(map.keys()).sort();
  providers.forEach((p) => ensureProviderLimitDefaults(p));

  const providerModels = {};
  providers.forEach((p) => {
    providerModels[p] = Array.from(map.get(p) || []).sort();
  });

  return { providers, providerModels };
}

async function loadProviderLimits() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(PROVIDER_LIMITS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') providerLimits = { ...providerLimits, ...parsed };
    }
  } catch (error) {
    log('Failed to load provider limits, using defaults', { error: String(error) });
  }
  collectProviderSeeds().forEach((p) => ensureProviderLimitDefaults(p));
  if (!providerLimits.opencodeBackupModel) providerLimits.opencodeBackupModel = '';
}

async function persistProviderLimits() {
  await ensureStateFile();
  collectProviderSeeds().forEach((p) => ensureProviderLimitDefaults(p));
  const payload = JSON.stringify(providerLimits, null, 2);
  await safeWriteFile(PROVIDER_LIMITS_FILE, payload);
}

function ensureProviderUsageBucket(provider) {
  const key = normalizeProviderName(provider);
  if (!providerUsage[key]) providerUsage[key] = [];
  return providerUsage[key];
}

function mergeLegacyProviderUsageIntoOpenRouter() {
  // Historical/config-driven provider keys like "openai" or "anthropic" should be rolled up
  // into OpenRouter usage when the model name looks like an OpenRouter model.
  const openrouterBucket = ensureProviderUsageBucket('openrouter');
  Object.keys(providerUsage || {}).forEach((providerKey) => {
    const normalized = normalizeProviderName(providerKey);
    if (KNOWN_USAGE_PROVIDERS.has(normalized)) return;
    const entries = Array.isArray(providerUsage[providerKey]) ? providerUsage[providerKey] : [];
    if (!entries.length) return;
    const keep = [];
    entries.forEach((entry) => {
      const model = (entry && entry.model) ? String(entry.model) : '';
      if (model.includes('/')) openrouterBucket.push(entry);
      else keep.push(entry);
    });
    if (keep.length) providerUsage[providerKey] = keep;
    else delete providerUsage[providerKey];
  });
  pruneProviderUsage();
}

function pruneProviderUsage(now = Date.now()) {
  const cutoff = now - FORTY_EIGHT_HOURS_MS; // keep last 48h for reporting
  Object.keys(providerUsage).forEach((provider) => {
    providerUsage[provider] = (providerUsage[provider] || []).filter((entry) => entry && typeof entry.ts === 'number' && entry.ts >= cutoff);
  });
}

async function loadProviderUsage() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(PROVIDER_USAGE_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') providerUsage = parsed;
    }
  } catch (error) {
    log('Failed to load provider usage, starting empty', { error: String(error) });
    providerUsage = {};
  }
  pruneProviderUsage();
  mergeLegacyProviderUsageIntoOpenRouter();
  collectProviderSeeds().forEach((p) => ensureProviderUsageBucket(p));
}

async function persistProviderUsage() {
  pruneProviderUsage();
  await ensureStateFile();
  const payload = JSON.stringify(providerUsage, null, 2);
  try {
    await safeWriteFile(PROVIDER_USAGE_FILE, payload);
  } catch (err) {
    log('Failed to persist provider usage', { error: String(err) });
  }
}

function currentMonthKey(date = new Date()) {
  const yr = date.getFullYear();
  const mo = String(date.getMonth() + 1).padStart(2, '0');
  return `${yr}-${mo}`;
}

function getModelTier(modelName) {
  if (!modelName) return null;
  const target = getAdminModelByIdOrName(modelName);
  return target ? target.tier : null;
}

function ensureTokenUsageBucket(userId) {
  const key = String(userId || '');
  if (!key) return null;
  const month = currentMonthKey();
  if (!tokenUsage[key] || tokenUsage[key].month !== month) {
    tokenUsage[key] = {
      month,
      usage: 0,
      addOns: 0,
      paygBilled: 0,
    };
  } else {
    const entry = tokenUsage[key];
    entry.usage = typeof entry.usage === 'number' ? entry.usage : 0;
    entry.addOns = typeof entry.addOns === 'number' ? entry.addOns : 0;
    entry.paygBilled = typeof entry.paygBilled === 'number' ? entry.paygBilled : 0;
  }
  return tokenUsage[key];
}

function normalizeTier(tier) {
  const normalized = (tier || '').toLowerCase();
  return ['free', 'plus', 'pro'].includes(normalized) ? normalized : 'free';
}

function getTierMultiplier(tier) {
  const normalizedTier = normalizeTier(tier);
  return normalizedTier === 'pro' ? 3 : (normalizedTier === 'plus' ? 2 : 1);
}

async function loadTokenUsage() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(TOKEN_USAGE_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') tokenUsage = parsed;
    }
  } catch (error) {
    log('Failed to load token usage, starting empty', { error: String(error) });
    tokenUsage = {};
  }
}

async function persistTokenUsage() {
  await ensureStateFile();
  const payload = JSON.stringify(tokenUsage, null, 2);
  try {
    await safeWriteFile(TOKEN_USAGE_FILE, payload);
  } catch (err) {
    log('Failed to persist token usage', { error: String(err) });
  }
}

async function loadTopupSessions() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(TOPUP_SESSIONS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') processedTopups = parsed;
    }
  } catch (error) {
    processedTopups = {};
    log('Failed to load top-up sessions, starting empty', { error: String(error) });
  }
}

async function persistTopupSessions() {
  await ensureStateFile();
  const payload = JSON.stringify(processedTopups, null, 2);
  try {
    await safeWriteFile(TOPUP_SESSIONS_FILE, payload);
  } catch (err) {
    log('Failed to persist top-up sessions', { error: String(err) });
  }
}

async function loadPendingTopups() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(TOPUP_PENDING_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') pendingTopups = parsed;
    }
  } catch (error) {
    pendingTopups = {};
    log('Failed to load pending top-ups, starting empty', { error: String(error) });
  }
}

async function persistPendingTopups() {
  await ensureStateFile();
  const payload = JSON.stringify(pendingTopups, null, 2);
  try {
    await safeWriteFile(TOPUP_PENDING_FILE, payload);
  } catch (err) {
    log('Failed to persist pending top-ups', { error: String(err) });
  }
}

async function loadInvoicesDb() {
  try {
    await ensureStateFile();
    await fs.mkdir(INVOICES_DIR, { recursive: true });
    const raw = await fs.readFile(INVOICES_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && Array.isArray(parsed)) invoicesDb = parsed;
    }
  } catch (error) {
    invoicesDb = [];
    log('Failed to load invoices, starting empty', { error: String(error) });
  }
}

async function persistInvoicesDb() {
  await ensureStateFile();
  const payload = JSON.stringify(invoicesDb, null, 2);
  try {
    await safeWriteFile(INVOICES_FILE, payload);
  } catch (err) {
    log('Failed to persist invoices', { error: String(err) });
  }
}

function generateInvoiceNumber() {
  const date = new Date();
  const year = date.getFullYear();
  const month = String(date.getMonth() + 1).padStart(2, '0');
  const count = invoicesDb.filter(inv => inv.invoiceNumber?.startsWith(`INV-${year}${month}`)).length + 1;
  return `INV-${year}${month}-${String(count).padStart(4, '0')}`;
}

function normalizeInvoiceSource(source) {
  if (!source || typeof source !== 'object') return null;
  const provider = String(source.provider || 'dodo').toLowerCase();
  const normalized = { provider };
  for (const key of ['orderId', 'checkoutId', 'paymentId', 'eventId', 'subscriptionId']) {
    if (source[key]) normalized[key] = String(source[key]);
  }
  const hasIdentifier = Object.keys(normalized).some((key) => key !== 'provider');
  return hasIdentifier ? normalized : null;
}

function findInvoiceBySource(userId, source) {
  const normalized = normalizeInvoiceSource(source);
  if (!normalized) return null;
  const matchOrder = ['paymentId', 'eventId', 'orderId', 'checkoutId'];

  return invoicesDb.find((invoice) => {
    if (!invoice || invoice.userId !== userId) return false;
    const invSource = invoice.details?.source;
    if (!invSource || typeof invSource !== 'object') return false;
    if (String(invSource.provider || 'dodo').toLowerCase() !== normalized.provider) return false;

    return matchOrder.some((key) => normalized[key] && invSource[key] && String(invSource[key]) === normalized[key]);
  }) || null;
}

async function createInvoiceIfMissing(user, type, details) {
  const existing = findInvoiceBySource(user.id, details?.source);
  if (existing) return existing;
  return createInvoice(user, type, details);
}

async function createInvoice(user, type, details) {
  const invoiceNumber = generateInvoiceNumber();
  const amountRaw = Number(details?.amount);
  const amount = Number.isFinite(amountRaw) ? Math.max(0, Math.round(amountRaw)) : 0;
  const currency = String(details?.currency || 'usd').toUpperCase();
  const invoice = {
    id: randomUUID(),
    invoiceNumber,
    userId: user.id,
    email: user.email,
    type,
    status: 'paid',
    amount,
    currency,
    createdAt: new Date().toISOString(),
    dueDate: new Date().toISOString(),
    paidAt: new Date().toISOString(),
    details: {}
  };

  const source = normalizeInvoiceSource(details?.source);
  if (source) invoice.details.source = source;

  if (type === 'topup') {
    const tokenCount = Number(details?.tokens);
    const tokenLabel = Number.isFinite(tokenCount) ? tokenCount.toLocaleString() : '0';
    invoice.description = `Top-up - ${tokenLabel} tokens`;
    invoice.details.tokens = Number.isFinite(tokenCount) ? tokenCount : 0;
    if (details?.tier) invoice.details.tier = details.tier;
  } else if (type === 'subscription') {
    invoice.description = `Subscription - ${details?.plan || 'plan'} (${details?.billingCycle || 'monthly'})`;
    invoice.details.plan = details?.plan;
    invoice.details.billingCycle = details?.billingCycle;
  } else if (type === 'payg') {
    const tokenCount = Number(details?.tokens);
    const tokenLabel = Number.isFinite(tokenCount) ? tokenCount.toLocaleString() : '0';
    invoice.description = `Pay-as-you-go - ${tokenLabel} tokens`;
    invoice.details.tokens = Number.isFinite(tokenCount) ? tokenCount : 0;
  }

  invoicesDb.push(invoice);
  await persistInvoicesDb();

  const pdfPath = path.join(INVOICES_DIR, `${invoice.id}.pdf`);
  await generateInvoicePdf(invoice, user, pdfPath);

  return invoice;
}

async function generateInvoicePdf(invoice, user, outputPath) {
  return new Promise((resolve, reject) => {
    const doc = new PDFDocument({
      size: 'A4',
      margins: { top: 50, bottom: 50, left: 50, right: 50 },
      compress: true,
      info: {
        Title: `Invoice ${invoice.invoiceNumber}`,
        Author: 'Plugin Compass',
        Subject: invoice.description,
        Creator: 'Plugin Compass'
      }
    });

    const stream = require('fs').createWriteStream(outputPath);
    doc.pipe(stream);

    const green = '#008060';
    const darkGreen = '#004c3f';
    const gray = '#6b7280';
    const lightGray = '#f3f4f6';

    doc.fontSize(24).fillColor(green).font('Helvetica-Bold').text('Plugin Compass', 50, 50);
    doc.moveDown(0.5);

    doc.fontSize(10).fillColor(gray).font('Helvetica').text('Invoice', 50, null);
    doc.fontSize(28).fillColor('#1f2937').font('Helvetica-Bold').text(invoice.invoiceNumber, 50, null);
    doc.moveDown(0.5);

    doc.fontSize(10).fillColor(gray).font('Helvetica').text('Date:', 50, null);
    doc.fontSize(12).fillColor('#1f2937').font('Helvetica').text(new Date(invoice.createdAt).toLocaleDateString(), 50, null);
    doc.moveDown(0.3);

    doc.fontSize(10).fillColor(gray).font('Helvetica').text('Due Date:', 50, null);
    doc.fontSize(12).fillColor('#1f2937').font('Helvetica').text(new Date(invoice.dueDate).toLocaleDateString(), 50, null);

    const y = 50;
    const rightX = 400;
    doc.fontSize(10).fillColor(gray).font('Helvetica').text('Bill To:', rightX, y);
    doc.fontSize(12).fillColor('#1f2937').font('Helvetica-Bold').text(user.email || 'N/A', rightX, null);

    doc.moveDown(1.5);

    doc.rect(50, doc.y, 495, 0).fill(lightGray);
    doc.fill(green).fontSize(10).font('Helvetica-Bold').text('Description', 60, doc.y - 24, { width: 250 });
    doc.text('Amount', 430, doc.y, { width: 100 });
    doc.rect(50, doc.y - 24, 495, 24).strokeColor('#e5e7eb').lineWidth(0.5).stroke();

    doc.moveDown(0.5);

    doc.fontSize(10).fillColor('#374151').font('Helvetica').text(invoice.description, 60, null, { width: 250 });
    const amountText = `${invoice.currency} ${(invoice.amount / 100).toFixed(2)}`;
    doc.text(amountText, 430, doc.y - 14, { width: 100, align: 'right' });

    doc.moveDown(0.5);
    doc.rect(50, doc.y - 12, 495, 0).strokeColor('#e5e7eb').lineWidth(0.5).stroke();

    const totalY = doc.y + 20;
    doc.fontSize(10).fillColor(gray).font('Helvetica').text('Total:', 430, totalY);
    doc.fontSize(16).fillColor(green).font('Helvetica-Bold').text(amountText, 430, totalY + 15, { width: 100, align: 'right' });

    doc.moveDown(3);

    doc.fontSize(9).fillColor(gray).font('Helvetica').text('Payment Status: PAID', 50, null);

    doc.moveDown(2);
    doc.fontSize(9).fillColor(gray).font('Helvetica').text('Thank you for your payment!', 50, null);

    doc.moveDown(1);
    doc.fontSize(8).fillColor('#9ca3af').font('Helvetica').text('Plugin Compass © ' + new Date().getFullYear() + '. All rights reserved.', 50, null);

    doc.end();

    stream.on('finish', resolve);
    stream.on('error', reject);
  });
}

function getInvoicesByUserId(userId) {
  return invoicesDb
    .filter(inv => inv.userId === userId)
    .sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt));
}

async function loadPaygSessions() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(PAYG_SESSIONS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') processedPayg = parsed;
    }
  } catch (error) {
    processedPayg = {};
    log('Failed to load pay-as-you-go sessions, starting empty', { error: String(error) });
  }
}

async function persistPaygSessions() {
  await ensureStateFile();
  const payload = JSON.stringify(processedPayg, null, 2);
  try {
    await safeWriteFile(PAYG_SESSIONS_FILE, payload);
  } catch (err) {
    log('Failed to persist pay-as-you-go sessions', { error: String(err) });
  }
}

async function loadPendingPayg() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(PAYG_PENDING_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') pendingPayg = parsed;
    }
  } catch (error) {
    pendingPayg = {};
    log('Failed to load pending pay-as-you-go sessions, starting empty', { error: String(error) });
  }
}

async function persistPendingPayg() {
  await ensureStateFile();
  const payload = JSON.stringify(pendingPayg, null, 2);
  try {
    await safeWriteFile(PAYG_PENDING_FILE, payload);
  } catch (err) {
    log('Failed to persist pending pay-as-you-go sessions', { error: String(err) });
  }
}

// Subscription persistence functions
async function loadSubscriptionSessions() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(SUBSCRIPTION_SESSIONS_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') processedSubscriptions = parsed;
    }
  } catch (error) {
    processedSubscriptions = {};
    log('Failed to load subscription sessions, starting empty', { error: String(error) });
  }
}

async function loadPendingSubscriptions() {
  try {
    await ensureStateFile();
    const raw = await fs.readFile(SUBSCRIPTION_PENDING_FILE, 'utf8').catch(() => null);
    if (raw) {
      const parsed = JSON.parse(raw);
      if (parsed && typeof parsed === 'object') pendingSubscriptions = parsed;
    }
  } catch (error) {
    pendingSubscriptions = {};
    log('Failed to load pending subscriptions, starting empty', { error: String(error) });
  }
}

async function persistPendingSubscriptions() {
  await ensureStateFile();
  const payload = JSON.stringify(pendingSubscriptions, null, 2);
  try {
    await safeWriteFile(SUBSCRIPTION_PENDING_FILE, payload);
  } catch (err) {
    log('Failed to persist pending subscriptions', { error: String(err) });
  }
}

async function persistProcessedSubscriptions() {
  await ensureStateFile();
  const payload = JSON.stringify(processedSubscriptions, null, 2);
  try {
    await safeWriteFile(SUBSCRIPTION_SESSIONS_FILE, payload);
  } catch (err) {
    log('Failed to persist processed subscriptions', { error: String(err) });
  }
}

async function dodoRequest(pathname, { method = 'GET', body, query } = {}) {
  if (!DODO_ENABLED) throw new Error('Dodo Payments is not configured');
  const url = new URL(`${DODO_BASE_URL}${pathname}`);
  if (query && typeof query === 'object') {
    Object.entries(query).forEach(([key, value]) => {
      if (value === undefined || value === null || value === '') return;
      url.searchParams.set(key, String(value));
    });
  }
  const headers = {
    Authorization: `Bearer ${DODO_PAYMENTS_API_KEY}`,
  };
  if (body) headers['Content-Type'] = 'application/json';
  const res = await fetch(url, {
    method,
    headers,
    body: body ? JSON.stringify(body) : undefined,
  });
  const payload = await res.json().catch(() => ({}));
  if (!res.ok) {
    const detail = payload?.error || payload?.message || res.statusText || 'Dodo request failed';
    const error = new Error(detail);
    error.status = res.status;
    throw error;
  }
  return payload;
}

// Attempt immediate cancellation first (DELETE), then fall back to end-of-period cancellation (PATCH).
const DODO_SUBSCRIPTION_CANCEL_ATTEMPTS = [
  { method: 'DELETE', body: undefined, label: 'immediate' },
  { method: 'PATCH', body: { cancel_at_next_billing_date: true }, label: 'period_end' },
];

/**
 * Cancel a Dodo subscription with a best-effort fallback strategy.
 * Tries immediate cancellation first, then schedules cancellation at period end.
 * @param {object} user - User record containing dodoSubscriptionId.
 * @param {string} reason - Cancellation reason for logging.
 * @param {object} options - Behavior options.
 * @param {boolean} options.clearOnFailure - Whether to clear the subscription ID on failure.
 * @returns {Promise<boolean>} True if a cancellation request succeeded.
 */
async function cancelDodoSubscription(user, reason = 'manual', { clearOnFailure = false } = {}) {
  if (!user?.dodoSubscriptionId) return false;
  const subscriptionId = user.dodoSubscriptionId;

  for (const attempt of DODO_SUBSCRIPTION_CANCEL_ATTEMPTS) {
    try {
      await dodoRequest(`/subscriptions/${subscriptionId}`, attempt);
      log('Dodo subscription cancelled', { userId: user.id, subscriptionId, reason, method: attempt.method, mode: attempt.label });
      user.dodoSubscriptionId = '';
      await persistUsersDb();
      return true;
    } catch (error) {
      log('Failed to cancel Dodo subscription', {
        userId: user.id,
        subscriptionId,
        reason,
        method: attempt.method,
        mode: attempt.label,
        error: String(error)
      });
    }
  }
  if (clearOnFailure) {
    user.dodoSubscriptionId = '';
    await persistUsersDb();
  }
  return false;
}

/**
 * Change an existing Dodo subscription to a different plan using the Change Plan API.
 * This properly handles upgrades and downgrades with proration.
 * @param {object} user - User record containing dodoSubscriptionId.
 * @param {string} newPlan - The new plan to change to (starter, professional, enterprise).
 * @param {string} billingCycle - The billing cycle (monthly, yearly).
 * @param {string} currency - The currency (usd, gbp, eur).
 * @returns {Promise<object>} The change plan response from Dodo.
 */
async function changeDodoSubscriptionPlan(user, newPlan, billingCycle, currency) {
  if (!user?.dodoSubscriptionId) {
    throw new Error('No active subscription to change');
  }
  
  const subscriptionId = user.dodoSubscriptionId;
  const product = resolveSubscriptionProduct(newPlan, billingCycle, currency);
  
  if (!product) {
    throw new Error('Invalid plan, billing cycle, or currency combination');
  }
  
  try {
    // Use Dodo's Change Plan API with difference_immediately proration
    // This will charge the difference for upgrades and apply credits for downgrades
    const result = await dodoRequest(`/subscriptions/${subscriptionId}/change-plan`, {
      method: 'POST',
      body: {
        product_id: product.productId,
        quantity: 1,
        proration_billing_mode: 'difference_immediately',
      },
    });
    
    log('Dodo subscription plan changed', {
      userId: user.id,
      subscriptionId,
      oldPlan: user.plan,
      newPlan,
      billingCycle,
      currency,
      productId: product.productId,
    });
    
    return result;
  } catch (error) {
    log('Failed to change Dodo subscription plan', {
      userId: user.id,
      subscriptionId,
      oldPlan: user.plan,
      newPlan,
      error: String(error),
    });
    throw error;
  }
}

async function ensureDodoCustomer(user) {
  if (!user) return '';
  if (user.dodoCustomerId) return user.dodoCustomerId;
  const email = user.billingEmail || user.email || '';
  if (!email) return '';
  const customers = await dodoRequest('/customers', {
    method: 'POST',
    body: {
      email,
      name: email.split('@')[0] || email,
      metadata: { userId: String(user.id) },
    },
  });
  const customerId = customers?.customer_id || customers?.id || '';
  if (customerId) {
    user.dodoCustomerId = customerId;
    await persistUsersDb();
  }
  return customerId;
}

async function ingestUsageEvent({ user, tokens, amountCents, currency, ratePerMillion, plan, month }) {
  if (!DODO_ENABLED || !DODO_USAGE_EVENTS_ENABLED) return false;
  if (!user || !Number.isFinite(tokens) || tokens <= 0) return false;
  if (!Number.isFinite(amountCents) || amountCents <= 0) return false;
  const customerId = await ensureDodoCustomer(user);
  if (!customerId) return false;

  const metadata = {
    [DODO_USAGE_EVENT_TOKENS_FIELD]: Math.max(0, Math.round(tokens)),
    [DODO_USAGE_EVENT_COST_FIELD]: Math.max(0, Math.round(amountCents)),
    currency: String(currency || 'usd').toLowerCase(),
    ratePerMillion: Math.max(0, Number(ratePerMillion || 0)),
    plan: String(plan || '').toLowerCase(),
    month: String(month || ''),
    userId: String(user.id),
  };

  const event = {
    event_id: `usage_${randomUUID()}`,
    customer_id: customerId,
    event_name: DODO_USAGE_EVENT_NAME,
    timestamp: new Date().toISOString(),
    metadata,
  };

  await dodoRequest('/events/ingest', {
    method: 'POST',
    body: { events: [event] },
  });
  return true;
}

async function refreshDodoProductsCache() {
  const now = Date.now();
  if (dodoProductCache.items.length && (now - dodoProductCache.fetchedAt) < DODO_PRODUCTS_CACHE_TTL_MS) {
    return dodoProductCache;
  }
  const items = [];
  const pageSize = 100;
  for (let page = 0; page < 10; page += 1) {
    const data = await dodoRequest('/products', {
      method: 'GET',
      query: { page_size: pageSize, page_number: page },
    });
    const list = Array.isArray(data?.items) ? data.items : [];
    items.push(...list);
    if (list.length < pageSize) break;
  }
  const byId = new Map();
  items.forEach((item) => {
    if (item?.product_id) byId.set(String(item.product_id), item);
  });
  dodoProductCache = { fetchedAt: now, items, byId };
  return dodoProductCache;
}

async function getDodoProductById(productId) {
  if (!productId) return null;
  const cache = await refreshDodoProductsCache();
  if (cache.byId.has(productId)) return cache.byId.get(productId);
  return null;
}

// Subscription product resolution
function resolveSubscriptionProduct(plan, billingCycle, currency) {
  const normalizedPlan = String(plan || '').toLowerCase();
  const normalizedBilling = String(billingCycle || '').toLowerCase();
  const normalizedCurrency = String(currency || '').toLowerCase();
  
  // Only support paid plans for subscriptions
  if (!PAID_PLANS.has(normalizedPlan)) return null;
  if (!BILLING_CYCLES.includes(normalizedBilling)) return null;
  if (!SUPPORTED_CURRENCIES.includes(normalizedCurrency)) return null;
  
  const productKey = `${normalizedPlan}_${normalizedBilling}_${normalizedCurrency}`;
  const productId = SUBSCRIPTION_PRODUCT_IDS[productKey];
  const price = SUBSCRIPTION_PRICES[productKey];
  
  if (!productId || !price) return null;
  
  return {
    plan: normalizedPlan,
    billingCycle: normalizedBilling,
    currency: normalizedCurrency,
    productId,
    price,
    productKey,
  };
}

// Get all available subscription products for a plan
function getAvailableSubscriptionProducts(plan) {
  const normalizedPlan = String(plan || '').toLowerCase();
  if (!PAID_PLANS.has(normalizedPlan)) return [];
  
  const products = [];
  for (const billing of BILLING_CYCLES) {
    for (const currency of SUPPORTED_CURRENCIES) {
      const product = resolveSubscriptionProduct(normalizedPlan, billing, currency);
      if (product) products.push(product);
    }
  }
  return products;
}

// Validate subscription selection
function validateSubscriptionSelection(plan, billingCycle, currency) {
  const product = resolveSubscriptionProduct(plan, billingCycle, currency);
  return product !== null;
}

function getPlanTokenLimits(plan, userId) {
  const normalized = normalizePlanSelection(plan) || DEFAULT_PLAN;
  const base = (planTokenLimits && typeof planTokenLimits[normalized] === 'number') ? planTokenLimits[normalized] : (PLAN_TOKEN_LIMITS[DEFAULT_PLAN] || 0);
  const bucket = ensureTokenUsageBucket(userId) || { addOns: 0 };
  return Math.max(0, Number(base || 0) + Number(bucket.addOns || 0));
}

function getTokenUsageSummary(userId, plan) {
  const bucket = ensureTokenUsageBucket(userId) || { usage: 0, addOns: 0 };
  const limit = getPlanTokenLimits(plan, userId);
  const used = Math.max(0, Number(bucket.usage || 0));
  const remaining = limit > 0 ? Math.max(0, limit - used) : 0;
  return {
    month: bucket.month || currentMonthKey(),
    used,
    limit,
    remaining,
    percent: limit > 0 ? Math.min(100, parseFloat(((used / limit) * 100).toFixed(1))) : 0,
    addOn: Math.max(0, Number(bucket.addOns || 0)),
    plan: normalizePlanSelection(plan) || DEFAULT_PLAN,
  };
}

function resolveUserCurrency(user) {
  const currency = String(user?.subscriptionCurrency || user?.billingCurrency || '').toLowerCase();
  return SUPPORTED_CURRENCIES.includes(currency) ? currency : 'usd';
}

function getPaygPrice(currency = 'usd') {
  const normalized = String(currency || 'usd').toLowerCase();
  const fallback = PAYG_PRICES.usd || MIN_PAYMENT_AMOUNT;
  return Math.max(MIN_PAYMENT_AMOUNT, PAYG_PRICES[normalized] || fallback);
}

function getPendingPaygTokens(userId, monthKey = currentMonthKey()) {
  const targetMonth = monthKey || currentMonthKey();
  let total = 0;
  Object.values(pendingPayg || {}).forEach((entry) => {
    if (!entry) return;
    if (entry.userId !== userId) return;
    if (entry.month && entry.month !== targetMonth) return;
    total += Math.max(0, Number(entry.tokens || 0));
  });
  return total;
}

function computePaygSummary(userId, plan, { projectedUsage } = {}) {
  const user = findUserById(userId);
  const currency = resolveUserCurrency(user);
  const pricePerUnit = getPaygPrice(currency);
  const bucket = ensureTokenUsageBucket(userId) || { usage: 0, addOns: 0, paygBilled: 0 };
  const limit = getPlanTokenLimits(plan, userId);
  const used = Math.max(0, Number(projectedUsage !== undefined ? projectedUsage : bucket.usage || 0));
  const overageTokens = Math.max(0, used - limit);
  const billedTokens = Math.max(0, Number(bucket.paygBilled || 0));
  const pendingTokens = getPendingPaygTokens(userId, bucket.month);
  const billableTokens = Math.max(0, overageTokens - billedTokens - pendingTokens);
  const amount = PAYG_ENABLED ? Math.max(0, Math.ceil((billableTokens * pricePerUnit) / PAYG_UNIT_TOKENS)) : 0;
  const projectedAmount = PAYG_ENABLED ? Math.max(0, Math.ceil((Math.max(0, overageTokens - billedTokens - pendingTokens) * pricePerUnit) / PAYG_UNIT_TOKENS)) : 0;
  return {
    currency,
    productConfigured: !!PAYG_PRODUCT_IDS[currency],
    pricePerUnit,
    unitTokens: PAYG_UNIT_TOKENS,
    overageTokens,
    billedTokens,
    pendingTokens,
    billableTokens,
    amount,
    projectedAmount,
    month: bucket.month,
    limit,
    used,
  };
}

function computeTopupDiscount(plan) {
  const normalized = normalizePlanSelection(plan);
  if (normalized === 'enterprise') return ENTERPRISE_TOPUP_DISCOUNT;
  if (normalized === 'professional') return BUSINESS_TOPUP_DISCOUNT;
  return 0;
}

function applyTopupDiscount(baseAmount, discount) {
  // Respect gateway minimum charge; if discount pushes below minimum, cap at MIN_PAYMENT_AMOUNT
  return Math.max(MIN_PAYMENT_AMOUNT, Math.round(baseAmount * (1 - discount)));
}

function resolveTopupPack(tier, currency = 'usd') {
  const normalizedTier = (tier || '').toString().toLowerCase();
  const normalizedCurrency = (currency || 'usd').toLowerCase();
  const priceKey = `${normalizedTier}_${normalizedCurrency}`;

  // Ensure config objects exist
  const productIds = TOPUP_PRODUCT_IDS || {};
  const tokens = TOPUP_TOKENS || {};

  // Try new format with currency support
  if (productIds[priceKey]) {
    return {
      tier: normalizedTier,
      currency: normalizedCurrency,
      tokens: tokens[normalizedTier] || 0,
      productId: productIds[priceKey] || '',
    };
  }

  // Fallback to legacy mapping for backward compatibility (assumes USD)
  let legacy = 'topup_1';
  if (normalizedTier === 'free') legacy = 'topup_1';
  else if (normalizedTier === 'plus') legacy = 'topup_2';
  else if (normalizedTier === 'pro') legacy = 'topup_3';

  return {
    tier: legacy,
    currency: normalizedCurrency,
    tokens: tokens[legacy] || 0,
    productId: productIds[`${legacy}_usd`] || '',
  };
}

function getTopupPrice(tier, currency = 'usd') {
  const normalizedTier = (tier || '').toLowerCase();
  const normalizedCurrency = (currency || 'usd').toLowerCase();
  const priceKey = `${normalizedTier}_${normalizedCurrency}`;
  const prices = TOPUP_PRICES || {};
  return prices[priceKey] || 0;
}

async function recordUserTokens(userId, tokens = 0) {
  if (!userId) {
    console.error('[USAGE] recordUserTokens: userId is missing, cannot record tokens');
    return;
  }
  const roundedTokens = Math.ceil(tokens || 0); // Always round up
  if (roundedTokens <= 0) {
    console.error(`[USAGE] recordUserTokens: token count is 0 or negative, skipping. Raw: ${tokens}, Rounded: ${roundedTokens}`);
    return;
  }

  const user = findUserById(userId);
  const bucket = ensureTokenUsageBucket(userId);
  const previousTotal = Number(bucket.usage) || 0;
  bucket.usage = previousTotal + roundedTokens;

  // Usage-based billing for unlimited usage (charge only over plan limit)
  if (user?.unlimitedUsage) {
    const plan = user?.plan || DEFAULT_PLAN;
    const limit = getPlanTokenLimits(plan, userId);
    const previousOverage = Math.max(0, previousTotal - limit);
    const currentOverage = Math.max(0, bucket.usage - limit);
    const overageDelta = Math.max(0, currentOverage - previousOverage);

    if (overageDelta > 0) {
      const currency = resolveUserCurrency(user);
      const rate = tokenRates[currency] || DEFAULT_TOKEN_RATES[currency] || 250;
      const chargeAmount = Math.max(0, Math.round((overageDelta * rate) / 1_000_000));

      if (chargeAmount > 0) {
        try {
          await ingestUsageEvent({
            user,
            tokens: overageDelta,
            amountCents: chargeAmount,
            currency,
            ratePerMillion: rate,
            plan,
            month: bucket.month || currentMonthKey(),
          });
          console.log(`[BILLING] 📈 Usage event: ${overageDelta} tokens over limit, ${currency.toUpperCase()}${(chargeAmount / 100).toFixed(2)} billed for user ${userId}.`);
        } catch (err) {
          console.error(`[BILLING] ❌ Failed to ingest usage event for ${userId}:`, err?.message || err);
        }
      }
    }
  }

  // Force immediate write
  try {
    await persistTokenUsage();
    console.log(`[USAGE] ✅ Recorded ${roundedTokens} tokens for ${userId}. Previous: ${previousTotal}, New total: ${bucket.usage}`);
  } catch (err) {
    console.error(`[USAGE] ❌ Failed to persist token usage for ${userId}:`, err);
  }
}

function canConsumeTokens(userId, plan, requestedTokens = 0) {
  const user = findUserById(userId);
  const summary = getTokenUsageSummary(userId, plan);
  const requested = Math.max(0, Math.round(requestedTokens || 0));
  const grace = Math.max(TOKEN_GRACE_MIN, Math.round(summary.limit * TOKEN_GRACE_RATIO));
  const projected = (summary.used || 0) + requested;
  const unlimitedEnabled = Boolean(user?.unlimitedUsage);
  const paid = isPaidPlan(plan);
  const allowOverage = paid && PAYG_ENABLED && !unlimitedEnabled;
  const payg = allowOverage ? computePaygSummary(userId, plan, { projectedUsage: projected }) : null;

  if (unlimitedEnabled) {
    return {
      allowed: true,
      limit: summary.limit,
      used: summary.used,
      remaining: summary.remaining,
      projected,
      requestedTokens: requested,
      payg: null,
      unlimited: true,
    };
  }

  if (!allowOverage && summary.limit > 0 && projected > summary.limit + grace) {
    return {
      allowed: false,
      reason: 'You have exceeded your token allowance. Upgrade or add a boost.',
      limit: summary.limit,
      used: summary.used,
      remaining: summary.remaining,
    };
  }
  return {
    allowed: true,
    limit: summary.limit,
    used: summary.used,
    remaining: summary.remaining,
    projected,
    requestedTokens: requested,
    payg,
  };
}

function summarizeProviderUsage(provider, model) {
  const key = normalizeUsageProvider(provider, model);
  const now = Date.now();
  const minuteAgo = now - MINUTE_MS;
  const dayAgo = now - DAY_MS;
  const entries = ensureProviderUsageBucket(key);
  const filterByModel = !!(model && providerLimits.limits[key] && providerLimits.limits[key].scope === 'model');
  const result = {
    tokensLastMinute: 0,
    tokensLastDay: 0,
    requestsLastMinute: 0,
    requestsLastDay: 0,
    perModel: {},
  };

  entries.forEach((entry) => {
    if (!entry || typeof entry.ts !== 'number') return;
    const matchesModel = !filterByModel || (entry.model && model && entry.model === model);
    const targetKey = entry.model || 'unknown';
    const isMinute = entry.ts >= minuteAgo;
    const isDay = entry.ts >= dayAgo;
    if (isMinute && matchesModel) {
      result.tokensLastMinute += Number(entry.tokens || 0);
      result.requestsLastMinute += Number(entry.requests || 0);
    }
    if (isDay && matchesModel) {
      result.tokensLastDay += Number(entry.tokens || 0);
      result.requestsLastDay += Number(entry.requests || 0);
    }
    if (!result.perModel[targetKey]) {
      result.perModel[targetKey] = { tokensLastMinute: 0, tokensLastDay: 0, requestsLastMinute: 0, requestsLastDay: 0 };
    }
    if (isMinute) {
      result.perModel[targetKey].tokensLastMinute += Number(entry.tokens || 0);
      result.perModel[targetKey].requestsLastMinute += Number(entry.requests || 0);
    }
    if (isDay) {
      result.perModel[targetKey].tokensLastDay += Number(entry.tokens || 0);
      result.perModel[targetKey].requestsLastDay += Number(entry.requests || 0);
    }
  });

  return result;
}

function isProviderLimited(provider, model) {
  const key = normalizeUsageProvider(provider, model);
  const cfg = ensureProviderLimitDefaults(key);
  const usage = summarizeProviderUsage(key, model);
  const modelCfg = (cfg.scope === 'model' && model && cfg.perModel[model]) ? cfg.perModel[model] : cfg;
  const checks = [
    ['tokensPerMinute', usage.tokensLastMinute, 'minute tokens'],
    ['tokensPerDay', usage.tokensLastDay, 'daily tokens'],
    ['requestsPerMinute', usage.requestsLastMinute, 'minute requests'],
    ['requestsPerDay', usage.requestsLastDay, 'daily requests'],
  ];
  for (const [field, used, label] of checks) {
    const limit = sanitizeLimitNumber(modelCfg[field]);
    if (limit > 0 && used >= limit) {
      return { limited: true, reason: `${label} limit reached`, field, used, limit, usage, scope: cfg.scope };
    }
  }
  return { limited: false, usage, scope: cfg.scope };
}

function recordProviderUsage(provider, model, tokens = 0, requests = 1) {
  const key = normalizeUsageProvider(provider, model);
  const isNew = !providerLimits.limits[key];
  ensureProviderLimitDefaults(key);
  if (isNew) {
    if (pendingProviderPersistTimer) clearTimeout(pendingProviderPersistTimer);
    const timer = setTimeout(() => {
      if (pendingProviderPersistTimer !== timer) return;
      pendingProviderPersistTimer = null;
      persistProviderLimits().catch((err) => log('Failed to persist new provider limit defaults', { provider: key, error: String(err) }));
    }, PROVIDER_PERSIST_DEBOUNCE_MS);
    pendingProviderPersistTimer = timer;
  }
  const bucket = ensureProviderUsageBucket(key);
  bucket.push({
    ts: Date.now(),
    tokens: Math.max(0, Math.round(tokens || 0)),
    requests: Math.max(0, Math.round(requests || 0)),
    model: model || '',
  });
  pruneProviderUsage();
  persistProviderUsage().catch((err) => log('Failed to persist provider usage (async)', { error: String(err) }));
}

/**
 * Validates that a token count is reasonable
 * @param {number} tokens - The token count to validate
 * @param {object} context - Context for validation (contentLength, source, etc.)
 * @returns {{valid: boolean, reason?: string, adjustedTokens?: number}}
 */
function validateTokenCount(tokens, context = {}) {
  const { contentLength = 0, source = 'unknown' } = context;
  
  // Must be a positive number
  if (typeof tokens !== 'number' || !isFinite(tokens)) {
    return { valid: false, reason: `tokens is not a finite number (type: ${typeof tokens}, value: ${tokens})` };
  }
  
  if (tokens <= 0) {
    return { valid: false, reason: `tokens is not positive (value: ${tokens})` };
  }
  
  // Reasonable maximum: 1M tokens (most models have much lower limits)
  const MAX_REASONABLE_TOKENS = 1000000;
  if (tokens > MAX_REASONABLE_TOKENS) {
    log('⚠️  validateTokenCount: Token count exceeds reasonable maximum', { tokens, max: MAX_REASONABLE_TOKENS, source, contentLength });
    return { valid: false, reason: `tokens exceeds reasonable maximum of ${MAX_REASONABLE_TOKENS}` };
  }
  
  // If we have content length, verify tokens are roughly consistent
  // Minimum chars per token is typically 1 (for very dense text), max is typically 10
  if (contentLength > 0) {
    const charsPerToken = contentLength / tokens;
    const MIN_CHARS_PER_TOKEN = 0.5; // Very conservative lower bound
    const MAX_CHARS_PER_TOKEN = 15;  // Very conservative upper bound
    
    if (charsPerToken < MIN_CHARS_PER_TOKEN) {
      log('⚠️  validateTokenCount: Chars per token too low (suspicious)', { 
        tokens, 
        contentLength, 
        charsPerToken, 
        min: MIN_CHARS_PER_TOKEN,
        source 
      });
      return { 
        valid: false, 
        reason: `chars per token (${charsPerToken.toFixed(2)}) is suspiciously low (< ${MIN_CHARS_PER_TOKEN})` 
      };
    }
    
    if (charsPerToken > MAX_CHARS_PER_TOKEN) {
      log('⚠️  validateTokenCount: Chars per token too high (suspicious)', { 
        tokens, 
        contentLength, 
        charsPerToken, 
        max: MAX_CHARS_PER_TOKEN,
        source 
      });
      return { 
        valid: false, 
        reason: `chars per token (${charsPerToken.toFixed(2)}) is suspiciously high (> ${MAX_CHARS_PER_TOKEN})` 
      };
    }
  }
  
  return { valid: true };
}

function normalizeTokenNumber(value) {
  if (typeof value === 'number' && isFinite(value)) return value;
  if (typeof value === 'string' && value.trim()) {
    const n = Number(value);
    if (isFinite(n)) return n;
  }
  return null;
}

function extractTokenUsage(parsed) {
  if (!parsed || typeof parsed !== 'object') return null;

  const directCandidates = [
    ['tokensUsed', parsed.tokensUsed],
    ['tokens', parsed.tokens],
    ['totalTokens', parsed.totalTokens],
    ['total_tokens', parsed.total_tokens],
    ['totalTokenCount', parsed.totalTokenCount],
    ['tokenCount', parsed.tokenCount],
    ['token_count', parsed.token_count],
    ['usage.total_tokens', parsed.usage?.total_tokens],
    ['usage.totalTokens', parsed.usage?.totalTokens],
    ['usage.totalTokenCount', parsed.usage?.totalTokenCount],
    ['usage.total', parsed.usage?.total],
    ['usage.totalTokensUsed', parsed.usage?.totalTokensUsed],
    ['usageMetadata.totalTokenCount', parsed.usageMetadata?.totalTokenCount],
    ['tokenUsage.total_tokens', parsed.tokenUsage?.total_tokens],
    ['tokenUsage.totalTokens', parsed.tokenUsage?.totalTokens],
    ['tokenUsage.totalTokenCount', parsed.tokenUsage?.totalTokenCount],
  ];

  for (const [source, value] of directCandidates) {
    const n = normalizeTokenNumber(value);
    if (n && n > 0) return { tokens: n, source };
  }

  const usage = parsed.usage || parsed.tokenUsage || parsed.usageMetadata || parsed.usage_metadata || null;
  if (usage) {
    const prompt = normalizeTokenNumber(usage.prompt_tokens ?? usage.promptTokens ?? usage.input_tokens ?? usage.inputTokens ?? usage.inputTokenCount);
    const completion = normalizeTokenNumber(usage.completion_tokens ?? usage.completionTokens ?? usage.output_tokens ?? usage.outputTokens ?? usage.outputTokenCount);
    if ((prompt || 0) + (completion || 0) > 0) {
      return { tokens: (prompt || 0) + (completion || 0), source: 'usage.sum' };
    }
  }

  const inputTokens = normalizeTokenNumber(parsed.inputTokens || parsed.input_tokens || parsed.prompt_tokens || parsed.promptTokens);
  const outputTokens = normalizeTokenNumber(parsed.outputTokens || parsed.output_tokens || parsed.completion_tokens || parsed.completionTokens);
  if ((inputTokens || 0) + (outputTokens || 0) > 0) {
    return { tokens: (inputTokens || 0) + (outputTokens || 0), source: 'input+output' };
  }

  return null;
}

function estimateTokensFromText(text) {
  if (!text) return 0;
  const str = typeof text === 'string' ? text : JSON.stringify(text);
  return Math.max(1, Math.ceil(str.length / AVG_CHARS_PER_TOKEN));
}

function estimateTokensFromMessages(messages = [], reply = '') {
  const combined = []
    .concat((messages || []).map((m) => {
      if (typeof m === 'string') return m;
      if (m && typeof m.content === 'string') return m.content;
      if (m && Array.isArray(m.content)) {
        return m.content.map(part => (part && part.text) || '').join(' ');
      }
      return '';
    }))
    .concat(reply || '')
    .filter(Boolean)
    .join(' ');
  const tokens = estimateTokensFromText(combined);
  console.log(`[USAGE] Estimated tokens: ${tokens} from combined length: ${combined.length}`);
  return tokens;
}

function extractTokenUsageFromResult(result, messages, options = {}) {
  const { allowEstimate = true } = options || {};
  console.log('[USAGE] extractTokenUsageFromResult called with:', { 
    resultType: typeof result,
    hasRaw: !!(result && result.raw),
    hasUsage: !!(result && (result.usage || (result.raw && result.raw.usage))),
    hasReply: !!(result && result.reply),
    hasMessages: !!messages && messages.length,
    allowEstimate
  });

  // 1. Try OpenAI/Standard format
  if (result && (result.usage || (result.raw && result.raw.usage))) {
    const usage = result.usage || result.raw.usage;
    const total = usage.total_tokens || usage.total || (usage.prompt_tokens || 0) + (usage.completion_tokens || 0);
    if (total) {
      console.log('[USAGE] ✅ Extracted tokens from OpenAI format:', total);
      return total;
    }
  }
  
  // 2. Try Google/Gemini format
  if (result && (result.usageMetadata || (result.raw && result.raw.usageMetadata))) {
    const meta = result.usageMetadata || result.raw.usageMetadata;
    const total = meta.totalTokenCount || (meta.promptTokenCount || 0) + (meta.candidatesTokenCount || 0);
    if (total) {
      console.log('[USAGE] ✅ Extracted tokens from Google format:', total);
      return total;
    }
  }

  // 3. Fallback to estimation - handle different result structures (OpenCode returns { reply, model, attempts, provider })
  if (!allowEstimate) {
    console.log('[USAGE] ⚠️ Token usage missing and estimation disabled.');
    return 0;
  }
  const replyText = (typeof result === 'string' ? result : (result && typeof result.reply === 'string' ? result.reply : ''));
  const estimated = estimateTokensFromMessages(messages || [], replyText);
  console.log('[USAGE] ⚠️ Using estimation fallback:', { replyLength: replyText.length, estimatedTokens: estimated });
  return estimated;
}

function getProviderUsageSnapshot(providerList = null) {
  const providers = (providerList && providerList.length)
    ? providerList.map((p) => normalizeProviderName(p))
    : Object.keys(providerLimits.limits || {});
  return providers.map((provider) => {
    const cfg = ensureProviderLimitDefaults(provider);
    const usage = summarizeProviderUsage(provider);
    return {
      provider,
      scope: cfg.scope,
      limits: {
        tokensPerMinute: cfg.tokensPerMinute,
        tokensPerDay: cfg.tokensPerDay,
        requestsPerMinute: cfg.requestsPerMinute,
        requestsPerDay: cfg.requestsPerDay,
      },
      perModelLimits: cfg.perModel || {},
      usage,
    };
  });
}

function serializeSession(session) {
  // Accuracy fix: detect if 'running' messages have actually stopped
  if (Array.isArray(session.messages)) {
    const now = Date.now();
    session.messages.forEach(msg => {
      if (msg.status === 'running') {
        const isActuallyRunning = runningProcesses.has(msg.id);
        const startedAt = msg.startedAt ? new Date(msg.startedAt).getTime() : 0;
        const runningDuration = now - startedAt;

        // Only mark as error if there's evidence of an actual error from the opencode server
        // (non-zero exit code or existing error message). Don't mark as error just because
        // it's been running for a while - the process may still be working.
        const hasActualError = (msg.opencodeExitCode && msg.opencodeExitCode !== 0) ||
                               (msg.error && msg.error.length > 0);
        if (!isActuallyRunning && startedAt > 0 && runningDuration > 30000 && hasActualError) {
          log('Detecting failed running message in serializeSession', {
            sessionId: session.id,
            messageId: msg.id,
            duration: runningDuration,
            exitCode: msg.opencodeExitCode,
            error: msg.error
          });
          msg.status = 'error';
          if (!msg.error || !msg.error.length) {
            msg.error = 'Message processing seems to have stalled or was interrupted.';
          }
          msg.finishedAt = new Date().toISOString();
          session.updatedAt = msg.finishedAt;
          // Note: we don't call persistState() here to keep this fast,
          // but the next state change will save it.
        }
      }
    });
  }
  return {
    id: session.id,
    title: session.title,
    model: session.model,
    cli: session.cli || 'opencode',
    opencodeSessionId: session.opencodeSessionId,
    createdAt: session.createdAt,
    updatedAt: session.updatedAt,
    messages: session.messages,
    pending: session.pending || 0,
    userId: session.userId,
    appId: session.appId,
    entryMode: session.entryMode || 'plan',
    source: session.source || 'builder',
    planSummary: session.planSummary,
    planUserRequest: session.planUserRequest,
    planApproved: !!session.planApproved,
  };
}

async function pathExists(targetPath) {
  try {
    await fs.access(targetPath);
    return true;
  } catch (_) {
    return false;
  }
}

async function safeMkdir(targetPath) {
  await fs.mkdir(targetPath, { recursive: true });
}

async function normalizeIconPath(iconPath) {
  if (!iconPath) return '';
  await ensureAssetsDir();
  const trimmed = iconPath.trim().replace(/^https?:\/\/[^/]+/, '');
  const withoutLeadingSlash = trimmed.replace(/^\/+/, '');
  const relative = withoutLeadingSlash.startsWith('assets/') ? withoutLeadingSlash : `assets/${withoutLeadingSlash}`;
  const resolved = path.resolve(STATIC_ROOT, relative);
  const assetsRoot = path.resolve(ASSETS_DIR);
  if (!resolved.startsWith(assetsRoot)) return '';
  if (!(await pathExists(resolved))) throw new Error('Icon not found in assets folder');
  return `/${relative.replace(/\\/g, '/')}`;
}

async function listAdminIcons() {
  await ensureAssetsDir();
  try {
    const entries = await fs.readdir(ASSETS_DIR, { withFileTypes: true });
    return entries
      .filter((e) => e.isFile())
      .map((e) => e.name)
      .filter((name) => name.match(/\.(png|jpg|jpeg|gif|svg|webp)$/i))
      .map((name) => `/assets/${name}`);
  } catch (error) {
    log('Failed to list admin icons', { error: String(error) });
    return [];
  }
}
async function mergeCopyPath(srcPath, destPath, tag) {
  const srcStat = await fs.stat(srcPath);
  if (srcStat.isDirectory()) {
    await safeMkdir(destPath);
    const entries = await fs.readdir(srcPath);
    for (const entry of entries) {
      await mergeCopyPath(path.join(srcPath, entry), path.join(destPath, entry), tag);
    }
    return;
  }

  // File: only copy if destination doesn't exist; otherwise preserve both by writing a suffixed copy.
  if (!(await pathExists(destPath))) {
    await safeMkdir(path.dirname(destPath));
    await fs.copyFile(srcPath, destPath);
    return;
  }

  const ext = path.extname(destPath);
  const base = destPath.slice(0, destPath.length - ext.length);
  const suffixed = `${base}.migrated-${tag}${ext || ''}`;
  await safeMkdir(path.dirname(suffixed));
  await fs.copyFile(srcPath, suffixed);
}

async function migrateUserSessions(fromUserId, toUserId) {
  const from = sanitizeSegment(fromUserId || '', '');
  const to = sanitizeSegment(toUserId || '', '');
  if (!from || !to || from === to) return { moved: 0, skipped: 0 };

  const tag = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
  const sessionsToMove = state.sessions.filter((s) => s.userId === from);
  let moved = 0;
  let skipped = 0;

  for (const session of sessionsToMove) {
    const oldWorkspaceDir = session.workspaceDir;
    const oldUploadsDir = session.uploadsDir;

    const targetPaths = buildWorkspacePaths({ userId: to, appId: session.appId || session.id, id: session.id });
    const newWorkspaceDir = targetPaths.workspaceDir;
    const newUploadsDir = targetPaths.uploadsDir;

    try {
      await safeMkdir(newWorkspaceDir);
      await safeMkdir(newUploadsDir);

      // Merge-copy old workspace into new workspace, without deleting old.
      if (oldWorkspaceDir && oldWorkspaceDir !== newWorkspaceDir && (await pathExists(oldWorkspaceDir))) {
        await mergeCopyPath(oldWorkspaceDir, newWorkspaceDir, tag);
      }
      if (oldUploadsDir && oldUploadsDir !== newUploadsDir && (await pathExists(oldUploadsDir))) {
        await mergeCopyPath(oldUploadsDir, newUploadsDir, tag);
      }

      // Only after the disk merge succeeded do we flip ownership.
      session.userId = to;
      session.workspaceDir = newWorkspaceDir;
      session.uploadsDir = newUploadsDir;
      session.attachmentKey = session.attachmentKey || randomUUID();

      moved += 1;
    } catch (err) {
      skipped += 1;
      log('migration copy failed', { sessionId: session.id, err: String(err), oldWorkspaceDir, newWorkspaceDir });
    }
  }

  await persistState();
  return { moved, skipped };
}

function getSession(sessionId, userId) {
  const session = state.sessions.find((s) => s.id === sessionId);
  if (!session) return null;
  if (userId && session.userId && session.userId !== userId) return null;
  return session;
}
async function createSession(payload = {}, userId, appId) {
  const ownerPlan = resolveUserPlan(userId);
  const model = resolvePlanModel(ownerPlan, payload.model || 'default');
  const cli = normalizeCli(payload.cli);
  const entryMode = payload.entryMode === 'opencode' ? 'opencode' : 'plan';
  const source = payload.source || 'builder';
  const planApproved = payload.planApproved === true;
  const now = new Date().toISOString();
  const sessionId = randomUUID();
  const rawAppId = appId || payload.appId || payload.app;
  const reuseAppId = payload.reuseAppId === true || payload.reuseApp === true;
  const sanitizedAppId = sanitizeSegment(rawAppId || '', '');
  const ownerId = sanitizeSegment(userId || 'anonymous', 'anonymous');
  // Default to the unique session id when no app identifier is provided
  let resolvedAppId = sanitizedAppId || sessionId;
  
  // When reusing an existing appId, look up the existing session to preserve its title
  let existingSession = null;
  let sessionTitle = payload.title?.trim() || 'New Chat';
  
  if (sanitizedAppId && reuseAppId) {
    existingSession = state.sessions.find((s) => s.userId === ownerId && s.appId === resolvedAppId);
    if (existingSession && existingSession.title) {
      // Preserve the existing app's title
      sessionTitle = existingSession.title;
    }
  }
  
  if (sanitizedAppId) {
    const collision = state.sessions.some((s) => s.userId === ownerId && s.appId === resolvedAppId);
    if (collision && !reuseAppId) resolvedAppId = `${resolvedAppId}-${sessionId.slice(0, 8)}`;
  }
  const appLimit = getPlanAppLimit(ownerPlan);
  const existingAppIds = new Set(state.sessions.filter((s) => s.userId === ownerId).map((s) => s.appId));
  const isNewApp = !existingAppIds.has(resolvedAppId);
  const currentAppCount = existingAppIds.size;
  if (isNewApp && Number.isFinite(appLimit) && currentAppCount >= appLimit) {
    const err = new Error(`You have reached the app limit (${appLimit} apps, currently ${currentAppCount}) for your plan. Upgrade to create more apps.`);
    err.statusCode = 403;
    throw err;
  }
  const session = {
    id: sessionId,
    title: sessionTitle,
    model,
    cli,
    userId: ownerId,
    appId: resolvedAppId,
    attachmentKey: randomUUID(),
    opencodeSessionId: null, // Will be initialized when first message is sent
    initialOpencodeSessionId: null, // Will be locked to the first session created for continuity
    entryMode,
    source,
    planApproved,
    createdAt: now,
    updatedAt: now,
    messages: [],
    pending: 0
  };

  // WordPress identifies plugins by their folder + main file (plugin basename).
  // If we generate a new slug per session/export, WP treats it as a different plugin and won't upgrade cleanly.
  // Keep the slug stable per appId (and independent of title), so repeated exports upgrade the same plugin.
  const baseSlug = sanitizeSegment(resolvedAppId || payload.title || 'plugin', 'plugin');
  session.pluginSlug = baseSlug.startsWith('pc-') ? baseSlug : `pc-${baseSlug}`;
  // Plugin Name can change safely; keep it stable-ish for UX.
  session.pluginName = payload.title?.trim() ? `Plugin Compass ${payload.title.trim()}` : 'Plugin Compass Plugin';

  await ensureSessionPaths(session);
  state.sessions.unshift(session);

  // Track new session/project creation
  trackUserSession(userId, 'project_created', { 
    sessionId: session.id, 
    appId: session.appId, 
    plan: ownerPlan,
    isNewApp: isNewApp
  });
  trackFeatureUsage('project_creation', userId, ownerPlan);
  trackConversionFunnel('app_creation', 'project_created', userId, {
    appId: session.appId,
    plan: ownerPlan,
    isNewApp: isNewApp
  });

  log('session created', { id: session.id, opencodeSessionId: 'pending', model: session.model, cli: session.cli, userId: session.userId, appId: session.appId, pluginSlug: session.pluginSlug });
  return session;
}
function updatePending(sessionId, delta, userId) { const session = getSession(sessionId, userId); if (!session) return; session.pending = Math.max(0, (session.pending || 0) + delta); session.updatedAt = new Date().toISOString(); }

async function parseJsonBody(req, maxBytes = MAX_JSON_BODY_SIZE) { return new Promise((resolve, reject) => { let body = ''; req.on('data', (chunk) => { body += chunk; if (body.length > maxBytes) { req.socket.destroy(); reject(new Error('Payload too large')); } }); req.on('end', () => { if (!body) return resolve({}); try { const parsed = JSON.parse(body); resolve(parsed); } catch (error) { reject(error); } }); }); }

function decodeBase64Payload(raw) {
  if (!raw) return Buffer.alloc(0);
  const trimmed = String(raw).trim();
  const base64 = trimmed.includes(',') ? trimmed.slice(trimmed.indexOf(',') + 1) : trimmed;
  return Buffer.from(base64, 'base64');
}

// Basic ZIP signature check: PK\x03\x04 (local header) or PK\x05\x06 (empty archives)
function isLikelyZip(buffer) {
  if (!buffer || buffer.length < 4) return false;
  const matchesSig = (sig) => buffer.subarray(0, 4).equals(Buffer.from(sig));
  return matchesSig(ZIP_LOCAL_HEADER_SIG) || matchesSig(ZIP_EOCD_EMPTY_SIG);
}

function findCommonRoot(entries) {
  if (!entries || entries.length === 0) return null;
  
  let commonPrefix = null;
  
  for (const entry of entries) {
    const rawName = (entry.entryName || '').replace(/\\/g, '/');
    const cleaned = rawName.replace(/^\/+/, '');
    
    if (!cleaned) continue;
    
    const parts = cleaned.split('/');
    const topDir = parts[0];
    
    if (!topDir) continue;
    
    if (commonPrefix === null) {
      commonPrefix = topDir;
    } else if (commonPrefix !== topDir) {
      return null;
    }
  }
  
  return commonPrefix;
}

async function extractZipToWorkspace(buffer, workspaceDir) {
  const zip = new AdmZip(buffer);
  const entries = zip.getEntries() || [];
  let fileCount = 0;
  const root = path.resolve(workspaceDir);
  
  const commonRoot = findCommonRoot(entries);

  for (const entry of entries) {
    const rawName = (entry.entryName || '').replace(/\\/g, '/');
    const cleaned = rawName.replace(/^\/+/, '');
    
    let entryPath = cleaned;
    if (commonRoot && cleaned.startsWith(commonRoot)) {
      entryPath = cleaned.slice(commonRoot.length).replace(/^\/+/, '');
    }
    
    const decoded = (() => { try { return decodeURIComponent(entryPath); } catch (_) { return entryPath; } })();
    const normalized = path.normalize(decoded);
    if (!entryPath || normalized.startsWith('..') || normalized.includes(`..${path.sep}`)) continue;
    if (path.isAbsolute(normalized)) continue;
    if (BLOCKED_PATH_PATTERN.test(normalized)) continue;

    const targetPath = path.join(workspaceDir, normalized);
    const resolved = path.resolve(targetPath);
    if (!resolved.startsWith(root)) continue;

    if (entry.isDirectory) {
      await fs.mkdir(resolved, { recursive: true });
      continue;
    }

    await fs.mkdir(path.dirname(resolved), { recursive: true });
    const data = entry.getData();
    await fs.writeFile(resolved, data);
    fileCount += 1;
  }

  if (fileCount === 0) {
    throw new Error('ZIP archive contained no valid files (entries may have been blocked)');
  }

  return fileCount;
}


function sendJson(res, statusCode, payload) { res.writeHead(statusCode, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(payload)); }
function serveFile(res, filePath, contentType = 'text/html') { return fs.readFile(filePath).then((content) => { res.writeHead(200, { 'Content-Type': contentType }); res.end(content); }).catch(() => { res.writeHead(404); res.end('Not found'); }); }
function guessContentType(filePath) { const ext = path.extname(filePath); switch (ext) { case '.css': return 'text/css'; case '.js': return 'application/javascript'; case '.svg': return 'image/svg+xml'; case '.json': return 'application/json'; case '.html': return 'text/html'; default: return 'text/plain'; } }
function guessContentTypeFromExt(ext) { switch (ext) { case '.css': return 'text/css'; case '.js': return 'application/javascript'; case '.svg': return 'image/svg+xml'; case '.json': return 'application/json'; case '.png': return 'image/png'; case '.jpg': case '.jpeg': return 'image/jpeg'; case '.gif': return 'image/gif'; default: return 'application/octet-stream'; } }
function safeStaticPath(relativePath) { const clean = relativePath.replace(/^\/+/, '').replace(/\.\.+/g, ''); const target = path.resolve(STATIC_ROOT, clean || 'index.html'); const root = path.resolve(STATIC_ROOT); if (!target.startsWith(root)) throw new Error('Invalid path'); return target; }

function runCommand(command, args, options = {}) {
  return new Promise((resolve, reject) => {
    const spawnOpts = { ...options, stdio: ['ignore', 'pipe', 'pipe'] };
    const child = spawn(command, args, spawnOpts);
    const processId = randomUUID();
    let stdout = '';
    let stderr = '';
    let finished = false;
    
    // Track this child process for cleanup
    if (child.pid) {
      registerChildProcess(processId, child.pid, options.sessionId || '', options.messageId || '');
    }
    
    const cleanup = () => {
      unregisterChildProcess(processId);
    };
    
    const timer = options.timeout
      ? setTimeout(() => {
        finished = true;
        cleanup();
        try {
          child.kill('SIGTERM');
          // Force kill after 5 seconds if still running
          setTimeout(() => {
            try { child.kill('SIGKILL'); } catch (_) {}
          }, 5000);
        } catch (ignored) { }
        const err = new Error(`Command timed out after ${options.timeout}ms`);
        err.code = 'TIMEOUT';
        err.stdout = stdout;
        err.stderr = stderr;
        reject(err);
      }, options.timeout)
      : null;

    child.stdout.on('data', (data) => {
      const chunk = data.toString();
      stdout += chunk;
      if (options.onData) options.onData('stdout', chunk);
    });
    child.stderr.on('data', (data) => {
      const chunk = data.toString();
      stderr += chunk;
      if (options.onData) options.onData('stderr', chunk);
    });
    child.on('error', (error) => {
      if (finished) return;
      if (timer) clearTimeout(timer);
      finished = true;
      cleanup();
      const err = new Error(String(error) || 'Failed to spawn process');
      err.code = error.code || 'spawn_error';
      err.stdout = stdout;
      err.stderr = stderr;
      reject(err);
    });
    child.on('close', (code) => {
      if (finished) return;
      if (timer) clearTimeout(timer);
      finished = true;
      cleanup();
      if (code === 0) return resolve({ stdout, stderr, code });
      const err = new Error(`Command exited with code ${code}${stderr ? `: ${stderr.trim()}` : ''}`);
      err.code = code;
      err.stdout = stdout;
      err.stderr = stderr;
      reject(err);
    });
  });
}


// Fetch models from OpenRouter API when API key is configured
async function fetchOpenRouterModels() {
  if (!OPENROUTER_API_KEY) return [];
  try {
    const res = await fetch('https://openrouter.ai/api/v1/models', {
      headers: { 'Authorization': `Bearer ${OPENROUTER_API_KEY}` }
    });
    if (!res.ok) {
      log('OpenRouter models fetch failed', { status: res.status });
      return [];
    }
    const data = await res.json();
    const models = Array.isArray(data?.data) ? data.data : [];
    return models.map((m) => ({
      name: m.id || m.name,
      label: `${m.id || m.name} (OpenRouter)`,
      provider: 'openrouter'
    })).filter((m) => m.name);
  } catch (error) {
    log('OpenRouter models fetch error', { error: String(error) });
    return [];
  }
}

// Fetch models from Mistral API when API key is configured
async function fetchMistralModels() {
  if (!MISTRAL_API_KEY) return [];
  try {
    const res = await fetch('https://api.mistral.ai/v1/models', {
      headers: { 'Authorization': `Bearer ${MISTRAL_API_KEY}` }
    });
    if (!res.ok) {
      log('Mistral models fetch failed', { status: res.status });
      return [];
    }
    const data = await res.json();
    const models = Array.isArray(data?.data) ? data.data : [];
    return models.map((m) => ({
      name: m.id || m.name,
      label: `${m.id || m.name} (Mistral)`,
      provider: 'mistral'
    })).filter((m) => m.name);
  } catch (error) {
    log('Mistral models fetch error', { error: String(error) });
    return [];
  }
}

// Fetch models from Groq API when API key is configured
async function fetchGroqModels() {
  if (!GROQ_API_KEY) return [];
  try {
    const res = await fetch('https://api.groq.com/openai/v1/models', {
      headers: { 'Authorization': `Bearer ${GROQ_API_KEY}` }
    });
    if (!res.ok) {
      log('Groq models fetch failed', { status: res.status });
      return [];
    }
    const data = await res.json();
    const models = Array.isArray(data?.data) ? data.data : [];
    return models.map((m) => ({
      name: m.id || m.name,
      label: `${m.id || m.name} (Groq)`,
      provider: 'groq'
    })).filter((m) => m.name);
  } catch (error) {
    log('Groq models fetch error', { error: String(error) });
    return [];
  }
}

// Fetch models from Google Gemini API when API key is configured
async function fetchGoogleModels() {
  if (!GOOGLE_API_KEY) return [];
  try {
    const res = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${GOOGLE_API_KEY}`);
    if (!res.ok) {
      log('Google models fetch failed', { status: res.status });
      return [];
    }
    const data = await res.json();
    const models = Array.isArray(data?.models) ? data.models : [];
    return models.map((m) => ({
      name: m.name || m.id,
      label: `${m.name || m.id} (Google)`,
      provider: 'google'
    })).filter((m) => m.name);
  } catch (error) {
    log('Google models fetch error', { error: String(error) });
    return [];
  }
}

// Fetch models from NVIDIA API when API key is configured
async function fetchNvidiaModels() {
  if (!NVIDIA_API_KEY) return [];
  try {
    const res = await fetch('https://integrate.api.nvidia.com/v1/models', {
      headers: { 'Authorization': `Bearer ${NVIDIA_API_KEY}` }
    });
    if (!res.ok) {
      log('NVIDIA models fetch failed', { status: res.status });
      return [];
    }
    const data = await res.json();
    const models = Array.isArray(data?.data) ? data.data : [];
    return models.map((m) => ({
      name: m.id || m.name,
      label: `${m.id || m.name} (NVIDIA)`,
      provider: 'nvidia'
    })).filter((m) => m.name);
  } catch (error) {
    log('NVIDIA models fetch error', { error: String(error) });
    return [];
  }
}

async function listModels(cliName = 'opencode') {
  const now = Date.now();
  const normalizedCli = normalizeCli(cliName);
  const cacheKey = normalizedCli;
  if (cachedModels.has(cacheKey) && now - (cachedModelsAt.get(cacheKey) || 0) < 60_000) return cachedModels.get(cacheKey);

  const collected = [];
  function addModel(m) {
    if (!m) return;
    if (typeof m === 'string') collected.push({ name: m, label: m });
    else if (m.name) collected.push({ name: m.name, label: m.label || m.name });
    else if (m.label) collected.push({ name: m.label, label: m.label });
  }

  const cliCommand = resolveCliCommand(normalizedCli);

  // Try CLI models with --json
  try {
    const { stdout } = await runCommand(cliCommand, ['models', '--json'], { timeout: 15000 });
    const parsed = JSON.parse(stdout);
    const parsedList = Array.isArray(parsed) ? parsed : parsed.models || [];
    parsedList.forEach((m) => addModel(m));
  } catch (error) { log('Unable to read models via --json', { cli: normalizedCli, error: String(error) }); }

  // Fallback: Try CLI models without --json
  try {
    const { stdout } = await runCommand(cliCommand, ['models'], { timeout: 15000 });
    const lines = stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
    const modelLines = lines.filter(l => !l.match(/^(Usage:|Options:|Commands:|Examples?:|Description:|\s*-)/i));
    modelLines.forEach((name) => {
      if (name && name.length > 0 && name.length < 100) {
        addModel({ name, label: name });
      }
    });
  } catch (fallbackError) { log('Models text fallback failed', { cli: normalizedCli, error: String(fallbackError) }); }

  // Try provider and connection commands in parallel
  const providerCmds = [
    [cliCommand, ['providers', '--json']],
    [cliCommand, ['providers', 'list', '--json']],
    [cliCommand, ['connections', '--json']],
    [cliCommand, ['connections', 'list', '--json']],
    [cliCommand, ['providers']],
    [cliCommand, ['connections']],
  ];

  const providerPromises = providerCmds.map(([cmd, args]) =>
    runCommand(cmd, args, { timeout: 8000 })
      .then(({ stdout }) => ({ stdout, cmd, args }))
      .catch(err => ({ err, cmd, args }))
  );

  const results = await Promise.allSettled(providerPromises);

  for (const result of results) {
    if (result.status === 'fulfilled' && !result.value.err) {
      const { stdout } = result.value;
      try {
        const parsed = JSON.parse(stdout);
        const arr = Array.isArray(parsed) ? parsed : parsed.providers || parsed.connections || [];
        arr.forEach((p) => {
          if (!p) return;
          const providerName = p.name || p.id || p.provider || normalizedCli;
          if (Array.isArray(p.models) && p.models.length) p.models.forEach((m) => addModel({ name: `${providerName}/${m}`, label: `${providerName}/${m}` }));
          else if (Array.isArray(p.availableModels) && p.availableModels.length) p.availableModels.forEach((m) => addModel({ name: `${providerName}/${m}`, label: `${providerName}/${m}` }));
          else if (p.defaultModel) addModel({ name: `${providerName}/${p.defaultModel}`, label: `${providerName}/${p.defaultModel}` });
          else if (p.model) addModel({ name: `${providerName}/${p.model}`, label: `${providerName}/${p.model}` });
        });
      } catch (parseError) {
        // Fallback for text output
        const lines = stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
        const contentLines = lines.filter(l => !l.match(/^(Usage:|Options:|Commands:|Examples?:|Description:|\s*-)/i));
        contentLines.forEach((line) => {
          const m = line.split(/[\s:\t-]+/).pop();
          if (m && m.length > 0 && m.length < 100) addModel({ name: m, label: `${m} (connected)` });
        });
      }
    }
  }

  // Fetch models from configured external providers
  const externalProviderFetches = [
    fetchOpenRouterModels(),
    fetchMistralModels(),
    fetchGroqModels(),
    fetchGoogleModels(),
    fetchNvidiaModels()
  ];

  const externalResults = await Promise.allSettled(externalProviderFetches);
  for (const result of externalResults) {
    if (result.status === 'fulfilled' && Array.isArray(result.value)) {
      result.value.forEach((m) => addModel(m));
    }
  }

  // Add fallback models per CLI
  const fallbackModels = {
    opencode: [],
  };

  // Add models from OPENCODE_EXTRA_MODELS env var
  if (process.env.OPENCODE_EXTRA_MODELS) {
    const extras = process.env.OPENCODE_EXTRA_MODELS.split(',').map((s) => s.trim()).filter(Boolean);
    extras.forEach((name) => addModel({ name, label: name }));
  }

  const unique = new Map();
  for (const m of collected) {
    const key = `${normalizedCli}:${encodeURIComponent((m.name || m.label || '').toLowerCase())}`;
    if (!unique.has(key)) unique.set(key, { name: m.name, label: m.label || m.name });
  }
  let result = Array.from(unique.values());
  if (!result.length) result = [{ name: 'default', label: 'default' }];
  cachedModels.set(cacheKey, result);
  cachedModelsAt.set(cacheKey, now);
  return result;
}

// Filter out opencode status messages that aren't meant for the user
function filterOpencodeStatusMessages(text) {
  if (!text) return '';
  const lines = text.split('\n');
  const filtered = lines.filter(line => {
    const lower = line.toLowerCase();
    // Filter out common status messages
    if (lower.includes('you need to open a file first')) return false;
    if (lower.includes('no file is currently open')) return false;
    if (lower.includes('use /open') && lower.includes('to open a file')) return false;
    if (lower.includes('session created') && lower.includes('ses-')) return false;
    if (lower.match(/^session:\s*ses-/i)) return false;
    if (lower.match(/^model:\s*\w+/i) && line.length < 50) return false;
    return true;
  });
  return filtered.join('\n').trim();
}

// Strip ANSI color codes and stray bracket-only codes and leading pipe prefixes
function stripAnsiAndPrefixes(text) {
  if (!text) return '';
  // Remove standard ANSI escape sequences like \x1b[93m
  let t = text.replace(/\x1b\[[0-9;]*m/g, '');
  // Remove stray bracket-only sequences like [93m or [0m that may appear when ESC is stripped
  t = t.replace(/\[\d+(?:;\d+)*m/g, '');
  // Remove any remaining ESC characters
  t = t.replace(/\u001b/g, '');
  // Remove leading pipe prefixes on each line (some CLIs prefix lines with "| ")
  t = t.split('\n').map(l => l.replace(/^\s*\|\s*/, '')).join('\n');
  return t;
}

// Detect if output looks like terminal/command output
function detectOutputType(text) {
  if (!text) return 'text';
  const lines = text.split('\n');

  // Check for terminal indicators
  const hasCommandPrompt = lines.some(l => l.match(/^\$\s+/) || l.match(/^>\s+/) || l.match(/^#\s+/));
  const hasExitCode = text.match(/exit\s+code:\s*\d+/i);
  const hasShellOutput = lines.some(l => l.match(/^\w+:\s*command not found/i) || l.match(/^\/[\w\/]+/));

  if (hasCommandPrompt || hasExitCode || hasShellOutput) {
    return 'terminal';
  }

  // Check for code blocks
  const hasCodeFence = text.includes('```');
  if (hasCodeFence) {
    return 'code';
  }

  return 'text';
}

function normalizeModels(list) {
  return (list || []).map((m) => (m || '').trim()).filter(Boolean);
}

function resolveOpenRouterModel() {
  const candidates = normalizeModels([
    openrouterSettings.primaryModel,
    openrouterSettings.backupModel1,
    openrouterSettings.backupModel2,
    openrouterSettings.backupModel3,
    ...OPENROUTER_FALLBACK_MODELS,
    ...OPENROUTER_STATIC_FALLBACK_MODELS,
  ]);
  return candidates[0] || OPENROUTER_DEFAULT_MODEL;
}

function resolveMistralModel() {
  const candidates = normalizeModels([
    mistralSettings.primaryModel,
    mistralSettings.backupModel1,
    mistralSettings.backupModel2,
    mistralSettings.backupModel3,
  ]);
  return candidates[0] || MISTRAL_DEFAULT_MODEL;
}

function uniqueStrings(values = []) {
  const seen = new Set();
  const result = [];
  (values || []).forEach((val) => {
    const trimmed = (val || '').trim();
    if (trimmed && !seen.has(trimmed)) {
      seen.add(trimmed);
      result.push(trimmed);
    }
  });
  return result;
}

function buildOpenRouterPlanChain() {
  return uniqueStrings([
    openrouterSettings.primaryModel,
    openrouterSettings.backupModel1,
    openrouterSettings.backupModel2,
    openrouterSettings.backupModel3,
    ...OPENROUTER_FALLBACK_MODELS,
    ...OPENROUTER_STATIC_FALLBACK_MODELS,
    OPENROUTER_DEFAULT_MODEL,
  ]);
}

function buildMistralPlanChain() {
  return uniqueStrings([
    mistralSettings.primaryModel,
    mistralSettings.backupModel1,
    mistralSettings.backupModel2,
    mistralSettings.backupModel3,
    MISTRAL_DEFAULT_MODEL,
  ]);
}

function buildGroqPlanChain() {
  // Groq uses fast models like Llama 3.3 70B and Mixtral
  return uniqueStrings([
    'llama-3.3-70b-versatile',
    'mixtral-8x7b-32768',
    'llama-3.1-70b-versatile',
  ]);
}

function buildGooglePlanChain() {
  // Google Gemini models
  return uniqueStrings([
    'gemini-1.5-flash',
    'gemini-1.5-pro',
    'gemini-pro',
  ]);
}

function buildNvidiaPlanChain() {
  // NVIDIA NIM models
  return uniqueStrings([
    'meta/llama-3.1-70b-instruct',
    'meta/llama-3.1-8b-instruct',
  ]);
}

function parseModelString(modelString) {
  // Parse a model string like "groq/compound-mini" or "compound-mini" into { provider, model }
  if (!modelString || typeof modelString !== 'string') {
    return { provider: null, model: '' };
  }

  const trimmed = modelString.trim();
  const parts = trimmed.split('/');

  if (parts.length > 1 && parts[0] && PLANNING_PROVIDERS.includes(normalizeProviderName(parts[0]))) {
    // Format: "provider/model"
    return {
      provider: normalizeProviderName(parts[0]),
      model: parts.slice(1).join('/')
    };
  }

  // No provider prefix, return just the model
  return { provider: null, model: trimmed };
}

function buildPlanModelChain() {
  const chain = normalizePlanningChain(planSettings.planningChain);
  if (chain.length) return chain;

  // Check if freePlanModel has a provider prefix (e.g., "groq/compound-mini")
  const freePlanModel = (planSettings.freePlanModel || '').trim();
  if (freePlanModel) {
    const parsed = parseModelString(freePlanModel);
    if (parsed.provider) {
      // User specified a provider prefix, use it directly
      return [{ provider: parsed.provider, model: parsed.model }];
    }
  }

  return defaultPlanningChainFromSettings(planSettings.provider);
}

function isPlanProviderConfigured(providerName) {
  const normalized = normalizeProviderName(providerName);
  if (normalized === 'openrouter') return !!OPENROUTER_API_KEY;
  if (normalized === 'mistral') return !!MISTRAL_API_KEY;
  if (normalized === 'google') return !!GOOGLE_API_KEY;
  if (normalized === 'groq') return !!GROQ_API_KEY;
  if (normalized === 'nvidia') return !!NVIDIA_API_KEY;
  if (normalized === 'ollama') return !!(OLLAMA_API_URL || OLLAMA_API_KEY);
  return false;
}

function parseProviderErrorDetail(detailText) {
  if (!detailText) return { text: '', code: '' };
  try {
    const parsed = JSON.parse(detailText);
    const text = parsed?.error?.message || parsed?.message || parsed?.error || detailText;
    const code = parsed?.error?.code || parsed?.code || parsed?.error?.type || '';
    return { text: typeof text === 'string' ? text : JSON.stringify(text), code: typeof code === 'string' ? code : '' };
  } catch (_) {
    return { text: detailText, code: '' };
  }
}

function buildProviderError(provider, status, detailText, codeHint = '') {
  const { text, code } = parseProviderErrorDetail(detailText || '');
  const lower = (text || '').toLowerCase();
  const err = new Error(`${provider} request failed (${status || 'error'}): ${text || 'Unknown error'}`);
  err.provider = provider;
  err.status = status;
  err.detail = text ? text.slice(0, 600) : '';
  err.code = codeHint || code || '';
  err.isAuthError = status === 401 || lower.includes('unauthorized') || lower.includes('api key') || lower.includes('invalid token') || lower.includes('invalid auth');
  err.isBillingError = status === 402 || lower.includes('payment required') || lower.includes('insufficient credit') || lower.includes('insufficient quota') || lower.includes('billing');
  err.isRateLimit = status === 429 || lower.includes('rate limit') || lower.includes('too many requests') || lower.includes('tokens per minute') || lower.includes('tpm');
  err.isTokenLimit = lower.includes('request too large') || lower.includes('token limit') || lower.includes('context length exceeded') || lower.includes('maximum context') || lower.includes('max tokens') || lower.includes('reduce your message size');
  err.isModelMissing = status === 404 || lower.includes('model not found') || lower.includes('unknown model') || lower.includes('does not exist');
  err.isServerError = typeof status === 'number' && status >= 500;
  err.shouldFallback = err.isModelMissing || err.isRateLimit || err.isTokenLimit || err.isServerError || err.isBillingError || err.isAuthError;
  err.rawDetail = detailText;
  return err;
}

function shouldFallbackProviderError(err) {
  return !!(err && err.shouldFallback);
}

async function loadOpenRouterPlanPrompt(userRequest) {
  const sanitizedRequest = sanitizePromptInput(userRequest);
  const fallback = `You are the planning specialist for the WordPress Plugin Builder. Stay in PLAN mode only and never write code.

User request:
{{USER_REQUEST}}

Create a concise, actionable plan: key features, WordPress hooks/APIs, data models, UI, security/GDPR, and a numbered roadmap. Ask for approval or changes.`;
  try {
    const prompt = await fs.readFile(OPENROUTER_PLAN_PROMPT_PATH, 'utf8');
    const trimmed = prompt?.trim();
    if (trimmed) {
      // Use a placeholder to prevent template injection
      return trimmed.replace('{{USER_REQUEST}}', sanitizedRequest);
    }
  } catch (err) {
    log('Failed to load OpenRouter plan prompt file', { path: OPENROUTER_PLAN_PROMPT_PATH, err: String(err) });
  }
  return fallback.replace('{{USER_REQUEST}}', sanitizedRequest);
}

async function sendOpenRouterChat({ messages, model }) {
  if (!OPENROUTER_API_KEY) {
    log('OpenRouter API key missing, cannot fulfill planning request');
    throw new Error('OpenRouter API key is not configured');
  }
  if (!process.env.OPENROUTER_API_URL && !warnedOpenRouterApiUrl) {
    log('OPENROUTER_API_URL not set; using default OpenRouter endpoint', { url: DEFAULT_OPENROUTER_API_URL });
    warnedOpenRouterApiUrl = true;
  }

  const safeMessages = Array.isArray(messages) ? messages : [];
  if (!safeMessages.length) throw new Error('OpenRouter messages must be a non-empty array');

  const payload = { model: model || resolveOpenRouterModel(), messages: safeMessages };
  const headers = {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${OPENROUTER_API_KEY}`,
  };
  if (OPENROUTER_SITE_URL) headers['HTTP-Referer'] = OPENROUTER_SITE_URL;
  headers['X-Title'] = OPENROUTER_APP_NAME;
  const res = await fetch(OPENROUTER_API_URL, { method: 'POST', headers, body: JSON.stringify(payload) });
  if (!res.ok) {
    let detail = '';
    try { detail = await res.text(); } catch (err) {
      log('OpenRouter error body read failed', { status: res.status, err: String(err) });
    }
    const err = buildProviderError('OpenRouter', res.status, detail || res.statusText);
    log('OpenRouter request failed', { status: res.status, detail: err.detail || res.statusText });
    throw err;
  }
  const data = await res.json();
  const reply = data?.choices?.[0]?.message?.content || '';
  return { reply: reply ? String(reply).trim() : '', raw: data };
}

async function sendMistralChat({ messages, model }) {
  if (!MISTRAL_API_KEY) {
    console.error('[MISTRAL] API key missing');
    log('Mistral API key missing, cannot fulfill planning request');
    throw new Error('Mistral API key is not configured');
  }

  const safeMessages = Array.isArray(messages) ? messages : [];
  if (!safeMessages.length) {
    console.error('[MISTRAL] Empty messages array');
    throw new Error('Mistral messages must be a non-empty array');
  }

  const resolvedModel = model || resolveMistralModel();
  const payload = { model: resolvedModel, messages: safeMessages };

  console.log('[MISTRAL] Starting API request', {
    url: MISTRAL_API_URL,
    model: resolvedModel,
    messageCount: safeMessages.length,
    hasApiKey: !!MISTRAL_API_KEY,
    apiKeyPrefix: MISTRAL_API_KEY ? MISTRAL_API_KEY.substring(0, 8) + '...' : 'none'
  });

  console.log('[MISTRAL] Request payload:', {
    model: payload.model,
    messagesCount: payload.messages.length,
    firstMessage: payload.messages[0] ? {
      role: payload.messages[0].role,
      contentLength: payload.messages[0].content?.length || 0,
      contentPreview: payload.messages[0].content?.substring(0, 100)
    } : null,
    lastMessage: payload.messages[payload.messages.length - 1] ? {
      role: payload.messages[payload.messages.length - 1].role,
      contentLength: payload.messages[payload.messages.length - 1].content?.length || 0,
      contentPreview: payload.messages[payload.messages.length - 1].content?.substring(0, 100)
    } : null
  });

  const headers = {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${MISTRAL_API_KEY}`,
  };

  try {
    const res = await fetch(MISTRAL_API_URL, { method: 'POST', headers, body: JSON.stringify(payload) });

    console.log('[MISTRAL] Response received', {
      status: res.status,
      statusText: res.statusText,
      ok: res.ok,
      headers: Object.fromEntries(res.headers.entries())
    });

    if (!res.ok) {
      let detail = '';
      try {
        detail = await res.text();
        console.error('[MISTRAL] Error response body:', detail);
      } catch (err) {
        console.error('[MISTRAL] Failed to read error body', String(err));
        log('Mistral error body read failed', { status: res.status, err: String(err) });
      }
      const err = buildProviderError('Mistral', res.status, detail || res.statusText);
      console.error('[MISTRAL] Request failed', { status: res.status, detail: err.detail });
      log('Mistral request failed', { status: res.status, detail: err.detail || res.statusText });
      throw err;
    }

    const data = await res.json();

    // Log the FULL raw response for debugging
    console.log('[MISTRAL] Full API response:', JSON.stringify(data, null, 2));

    // Log the response data structure analysis
    console.log('[MISTRAL] Response data structure:', {
      hasChoices: !!data?.choices,
      choicesLength: data?.choices?.length || 0,
      firstChoiceKeys: data?.choices?.[0] ? Object.keys(data.choices[0]) : [],
      hasMessage: !!data?.choices?.[0]?.message,
      messageKeys: data?.choices?.[0]?.message ? Object.keys(data.choices[0].message) : [],
      hasContent: !!data?.choices?.[0]?.message?.content,
      contentLength: data?.choices?.[0]?.message?.content?.length || 0,
      rawDataKeys: Object.keys(data || {})
    });

    // Log each step of content extraction
    console.log('[MISTRAL] Choices array:', data?.choices);
    console.log('[MISTRAL] First choice:', data?.choices?.[0]);
    console.log('[MISTRAL] Message object:', data?.choices?.[0]?.message);
    console.log('[MISTRAL] Content value:', data?.choices?.[0]?.message?.content);
    console.log('[MISTRAL] Content type:', typeof data?.choices?.[0]?.message?.content);

    const reply = data?.choices?.[0]?.message?.content || '';

    console.log('[MISTRAL] Extracted reply:', {
      reply: reply,
      replyType: typeof reply,
      replyLength: reply?.length || 0,
      isEmpty: reply === '',
      isNull: reply === null,
      isUndefined: reply === undefined,
      isFalsy: !reply
    });

    if (!reply) {
      console.error('[MISTRAL] No content in response!', {
        fullData: JSON.stringify(data, null, 2),
        extractedReply: reply,
        replyType: typeof reply
      });
    } else {
      console.log('[MISTRAL] Successfully extracted reply', {
        replyLength: reply.length,
        replyPreview: reply.substring(0, 200)
      });
    }

    log('Mistral request succeeded', { model: resolvedModel, replyLength: reply.length });
    return { reply: reply ? String(reply).trim() : '', model: resolvedModel, raw: data };
  } catch (fetchErr) {
    console.error('[MISTRAL] Fetch error:', {
      error: String(fetchErr),
      message: fetchErr.message,
      stack: fetchErr.stack
    });
    throw fetchErr;
  }
}

async function sendOpenRouterPlanWithFallback(messages, preferredModel) {
  const chain = preferredModel ? uniqueStrings([preferredModel, ...buildOpenRouterPlanChain()]) : buildOpenRouterPlanChain();
  const attempts = [];
  let lastError = null;
  for (const candidate of chain) {
    try {
      const result = await sendOpenRouterChat({ messages, model: candidate });
      if (attempts.length) {
        log('OpenRouter plan succeeded after fallback', { attempts, model: candidate });
      }
      return { ...result, model: candidate, attempts };
    } catch (err) {
      lastError = err;
      attempts.push({ model: candidate, error: err.message || String(err), status: err.status || null });
      if (!shouldFallbackProviderError(err)) break;
    }
  }
  const err = new Error('OpenRouter plan failed after trying all configured models');
  err.attempts = attempts;
  err.cause = lastError;
  throw err;
}

// Direct Google/Groq/NVIDIA handlers (use provider-specific API if configured; otherwise fall back to OpenRouter)
async function sendGoogleChat({ messages, model }) {
  if (!GOOGLE_API_KEY) throw new Error('Google API key is not configured');
  const safeMessages = Array.isArray(messages) ? messages : [];
  if (!safeMessages.length) throw new Error('Google messages must be a non-empty array');
  // Attempt typical Gemini-like endpoint; callers can override via GOOGLE_API_URL
  const targetModel = model || 'gemini-alpha';
  const url = `${GOOGLE_API_URL}/models/${encodeURIComponent(targetModel)}:generateMessage`;
  const headers = { 'Content-Type': 'application/json', 'Authorization': `Bearer ${GOOGLE_API_KEY}` };
  const payload = { messages: safeMessages };
  const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify(payload) });
  if (!res.ok) {
    let detail = '';
    try { detail = await res.text(); } catch (_) { }
    const err = buildProviderError('Google', res.status, detail || res.statusText);
    log('Google request failed', { status: res.status, detail: err.detail || res.statusText });
    throw err;
  }
  const data = await res.json();
  const reply = data?.candidates?.[0]?.content || data?.output?.[0]?.content || '';
  return { reply: reply ? String(reply).trim() : '', model: targetModel, raw: data };
}

async function sendGroqChat({ messages, model }) {
  if (!GROQ_API_KEY) throw new Error('Groq API key is not configured');
  const safeMessages = Array.isArray(messages) ? messages : [];
  if (!safeMessages.length) throw new Error('Groq messages must be a non-empty array');
  // Use a valid Groq model - llama-3.3-70b-versatile is a good default
  const targetModel = model || 'llama-3.3-70b-versatile';
  const headers = {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${GROQ_API_KEY}`
  };
  // Groq uses OpenAI-compatible API format
  const payload = {
    model: targetModel,
    messages: safeMessages
  };

  console.log('[GROQ] Starting API request', {
    url: GROQ_API_URL,
    model: targetModel,
    messageCount: safeMessages.length
  });

  const res = await fetch(GROQ_API_URL, { method: 'POST', headers, body: JSON.stringify(payload) });

  console.log('[GROQ] Response received', {
    status: res.status,
    ok: res.ok
  });

  if (!res.ok) {
    let detail = '';
    try { detail = await res.text(); } catch (_) { }
    const err = buildProviderError('Groq', res.status, detail || res.statusText);
    log('Groq request failed', { status: res.status, detail: err.detail || res.statusText });
    console.error('[GROQ] Request failed', { status: res.status, detail });
    throw err;
  }
  const data = await res.json();

  console.log('[GROQ] Response data:', {
    hasChoices: !!data?.choices,
    choicesLength: data?.choices?.length || 0,
    model: data?.model
  });

  // Extract reply from OpenAI-compatible response format with validation
  if (!data?.choices || !Array.isArray(data.choices) || data.choices.length === 0) {
    console.error('[GROQ] Invalid response structure - no choices array', {
      dataKeys: Object.keys(data || {}),
      hasChoices: !!data?.choices,
      choicesType: typeof data?.choices
    });
    throw new Error('Groq API returned invalid response structure - missing choices array');
  }

  const reply = data.choices[0]?.message?.content || '';

  if (!reply) {
    console.error('[GROQ] No content in response', {
      firstChoice: data.choices[0],
      hasMessage: !!data.choices[0]?.message,
      messageKeys: data.choices[0]?.message ? Object.keys(data.choices[0].message) : []
    });
  }

  console.log('[GROQ] Extracted reply:', {
    replyLength: reply?.length || 0,
    replyPreview: reply ? reply.substring(0, 150) : 'empty'
  });

  return { reply: reply ? String(reply).trim() : '', model: data?.model || targetModel, raw: data };
}

async function sendNvidiaChat({ messages, model }) {
  if (!NVIDIA_API_KEY) throw new Error('NVIDIA API key is not configured');
  const safeMessages = Array.isArray(messages) ? messages : [];
  if (!safeMessages.length) throw new Error('NVIDIA messages must be a non-empty array');
  const targetModel = model || 'nvidia-model';
  const url = `${NVIDIA_API_URL}/models/${encodeURIComponent(targetModel)}/generate`;
  const headers = { 'Content-Type': 'application/json', 'Authorization': `Bearer ${NVIDIA_API_KEY}` };
  const payload = { messages: safeMessages };
  const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify(payload) });
  if (!res.ok) {
    let detail = '';
    try { detail = await res.text(); } catch (_) { }
    const err = buildProviderError('NVIDIA', res.status, detail || res.statusText);
    log('NVIDIA request failed', { status: res.status, detail: err.detail || res.statusText });
    throw err;
  }
  const data = await res.json();
  const reply = data?.output?.text || '';
  return { reply: reply ? String(reply).trim() : '', model: targetModel, raw: data };
}

async function sendOllamaChat({ messages, model }) {
  const urlBase = OLLAMA_API_URL;
  if (!urlBase) throw new Error('Ollama API URL is not configured');
  const safeMessages = Array.isArray(messages) ? messages : [];
  if (!safeMessages.length) throw new Error('Ollama messages must be a non-empty array');

  // Build a simple prompt by joining roles - Ollama expects a text prompt by default
  const prompt = safeMessages.map((m) => `${m.role.toUpperCase()}: ${m.content}`).join('\n\n');
  const targetModel = model || OLLAMA_DEFAULT_MODEL || '';
  const endpoint = `${String(urlBase).replace(/\/$/, '')}/api/generate`;
  const headers = { 'Content-Type': 'application/json' };
  if (OLLAMA_API_KEY) headers['Authorization'] = `Bearer ${OLLAMA_API_KEY}`;
  const payload = { model: targetModel, prompt };

  const res = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify(payload) });
  if (!res.ok) {
    let detail = '';
    try { detail = await res.text(); } catch (_) { }
    const err = buildProviderError('Ollama', res.status, detail || res.statusText);
    log('Ollama request failed', { status: res.status, detail: err.detail || res.statusText });
    throw err;
  }

  let data;
  try { data = await res.json(); } catch (_) { data = {}; }

  // Try common fields returned by Ollama
  const reply = data?.text || data?.generated_text || data?.result || (data?.response?.[0]?.content) || '';
  return { reply: reply ? String(reply).trim() : '', model: targetModel || data?.model || '', raw: data };
}

async function sendMistralPlanWithFallback(messages, preferredModel) {
  const chain = preferredModel ? uniqueStrings([preferredModel, ...buildMistralPlanChain()]) : buildMistralPlanChain();
  console.log('[MISTRAL] Starting fallback chain', {
    preferredModel,
    chainLength: chain.length,
    models: chain
  });

  const attempts = [];
  let lastError = null;
  for (const candidate of chain) {
    console.log('[MISTRAL] Trying model:', candidate);
    try {
      const result = await sendMistralChat({ messages, model: candidate });
      if (attempts.length) {
        console.log('[MISTRAL] Plan succeeded after fallback', { attempts, model: candidate });
        log('Mistral plan succeeded after fallback', { attempts, model: candidate });
      } else {
        console.log('[MISTRAL] Plan succeeded on first try', { model: candidate });
      }
      return { ...result, model: candidate, attempts };
    } catch (err) {
      lastError = err;
      console.error('[MISTRAL] Model failed:', {
        model: candidate,
        error: err.message || String(err),
        status: err.status || null,
        shouldFallback: shouldFallbackProviderError(err)
      });
      attempts.push({ model: candidate, error: err.message || String(err), status: err.status || null });
      if (!shouldFallbackProviderError(err)) {
        console.error('[MISTRAL] Breaking fallback chain - error not fallback-eligible');
        break;
      }
    }
  }
  console.error('[MISTRAL] All models failed', {
    attempts,
    lastError: lastError ? String(lastError) : 'none'
  });
  const err = new Error('Mistral plan failed after trying all configured models');
  err.attempts = attempts;
  err.cause = lastError;
  throw err;
}


async function handlePlanMessage(req, res, userId) {
  let body;
  try {
    body = await parseJsonBody(req);
  } catch (error) {
    return sendJson(res, 400, { error: 'Invalid JSON body' });
  }
  const sessionId = body.sessionId || body.session || body.session_id;
  if (!sessionId) return sendJson(res, 400, { error: 'sessionId is required' });
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });

  // Sanitize user input to prevent prompt injection
  const content = sanitizePromptInput(body.content || '');
  const displayContent = typeof body.displayContent === 'string' && body.displayContent.trim() ? sanitizePromptInput(body.displayContent) : content;
  if (!content) return sendJson(res, 400, { error: 'Message is required' });
  const userPlan = resolveUserPlan(session.userId);
  const allowance = canConsumeTokens(session.userId, userPlan, estimateTokensFromText(content) + TOKEN_ESTIMATION_BUFFER);
  if (!allowance.allowed) {
    return sendJson(res, 402, { error: 'You have reached your token allowance. Upgrade or add a boost.', allowance });
  }

  try {
    await ensureSessionPaths(session);
    const planRoot = sanitizePromptInput(session.planUserRequest || content);
    const systemPrompt = await loadOpenRouterPlanPrompt(planRoot);
    // Replace plugin slug and name placeholders if present in the planning prompt
    const safePluginSlugRaw = session.pluginSlug || session.title || 'plugin';
    const safePluginSlugBase = sanitizeSegment(safePluginSlugRaw, 'plugin');
    const safePluginSlug = safePluginSlugBase.startsWith('pc-') ? safePluginSlugBase : `pc-${safePluginSlugBase}`;
    const safePluginName = session.pluginName || `Plugin Compass ${session.title || 'Plugin'}`;
    let finalSystemPrompt = (systemPrompt || '').replace('{{PLUGIN_SLUG}}', safePluginSlug);
    finalSystemPrompt = finalSystemPrompt.replace('{{PLUGIN_NAME}}', safePluginName);
    const historyMessages = (session.messages || []).filter((m) => m.phase === 'plan');
    const messages = [{ role: 'system', content: finalSystemPrompt }];
    historyMessages.forEach((m) => {
      if (m.content) messages.push({ role: 'user', content: sanitizePromptInput(m.content) });
      if (m.reply) messages.push({ role: 'assistant', content: sanitizeAiOutput(m.reply) });
    });
    messages.push({ role: 'user', content });

    let model;
    let reply;
    let cli;
    let failoverAttempts = [];
    let providerUsed = null;
    // Build the normalized plan chain and filter out providers that are not configured
    const normalizedChain = buildPlanModelChain();
    const planChain = normalizedChain.filter((entry) => isPlanProviderConfigured(entry.provider));

    if (!planChain.length) {
      // If the normalized chain requested providers that are not configured, report which ones
      const requestedProviders = Array.from(new Set((normalizedChain || []).map((e) => normalizeProviderName(e.provider))));
      const missing = requestedProviders.filter((p) => !isPlanProviderConfigured(p));
      console.log('[PLAN] No configured providers found for plan chain', { requestedProviders, missing });
      const msg = missing.length
        ? `No configured planning providers available. Missing provider API keys: ${missing.join(', ')}.`
        : 'Planning is not configured. Please configure a planning provider first.';
      return sendJson(res, 503, { error: msg, missingProviders: missing });
    }

    console.log('[PLAN] Starting plan message handling', {
      sessionId: session.id,
      planChainLength: planChain.length,
      providers: planChain.map(e => `${e.provider}:${e.model || 'default'}`)
    });

    for (const entry of planChain) {
      const providerName = normalizeProviderName(entry.provider);
      const modelHint = entry.raw || entry.model || '';
      console.log('[PLAN] Trying provider', { provider: providerName, model: modelHint });

      const limitState = isProviderLimited(providerName, modelHint || 'plan');
      if (limitState.limited) {
        console.log('[PLAN] Provider limited, skipping', { provider: providerName, reason: limitState.reason });
        failoverAttempts.push({ provider: providerName, model: modelHint, error: `limit: ${limitState.reason}` });
        continue;
      }
      try {
        let result;
        if (providerName === 'mistral') {
          console.log('[PLAN] Using Mistral provider', { modelHint, messagesCount: messages.length });
          result = await sendMistralPlanWithFallback(messages, modelHint);
          cli = 'mistral';
          console.log('[PLAN] Mistral result received (raw):', {
            hasResult: !!result,
            resultKeys: result ? Object.keys(result) : [],
            hasReply: !!result?.reply,
            replyValue: result?.reply,
            replyType: typeof result?.reply,
            replyLength: result?.reply?.length || 0,
            model: result?.model,
            fullResult: JSON.stringify(result, null, 2)
          });
        } else if (providerName === 'google') {
          // Google is a separate provider and requires GOOGLE_API_KEY to be configured
          console.log('[PLAN] Using Google provider', { modelHint });
          result = await sendGoogleChat({ messages, model: modelHint });
          cli = 'google';
        } else if (providerName === 'groq') {
          console.log('[PLAN] Using Groq provider', { modelHint });
          result = await sendGroqChat({ messages, model: modelHint });
          cli = 'groq';
        } else if (providerName === 'nvidia') {
          console.log('[PLAN] Using NVIDIA provider', { modelHint });
          result = await sendNvidiaChat({ messages, model: modelHint });
          cli = 'nvidia';
        } else if (providerName === 'ollama') {
          console.log('[PLAN] Using Ollama provider', { modelHint });
          result = await sendOllamaChat({ messages, model: modelHint });
          cli = 'ollama';
        } else {
          // default to OpenRouter if configured (explicit choice)
          console.log('[PLAN] Using OpenRouter provider', { modelHint });
          result = await sendOpenRouterPlanWithFallback(messages, modelHint);
          cli = 'openrouter';
        }

        model = result.model || modelHint;

        console.log('[PLAN] Before sanitization:', {
          provider: providerName,
          rawReply: result.reply,
          rawReplyType: typeof result.reply,
          rawReplyLength: result.reply?.length || 0
        });

        reply = sanitizeAiOutput(result.reply);

        console.log('[PLAN] After sanitization:', {
          provider: providerName,
          sanitizedReply: reply,
          sanitizedReplyType: typeof reply,
          sanitizedReplyLength: reply?.length || 0,
          wasModified: result.reply !== reply
        });

        console.log('[PLAN] Provider succeeded', {
          provider: providerName,
          model,
          replyLength: reply?.length || 0,
          replyPreview: reply ? reply.substring(0, 150) : 'no reply'
        });

        failoverAttempts = failoverAttempts.concat(result.attempts || []);
        providerUsed = providerName;
        const tokensUsed = extractTokenUsageFromResult(result, messages);
        // Ensure we log provider usage
        recordProviderUsage(providerName, model || modelHint || providerName, tokensUsed, 1);

        const recordId = userId || session.userId;
        if (recordId) {
          console.log(`[PLAN] Recording tokens: user=${recordId} tokens=${tokensUsed} provider=${providerName}`);
          // Await this to ensure file is written before we return response to client
          await recordUserTokens(recordId, tokensUsed);
        } else {
          console.error('[PLAN] Cannot record tokens: no userId available');
        }
        break;
      } catch (err) {
        console.error('[PLAN] Provider failed', {
          provider: providerName,
          model: modelHint,
          error: err.message || String(err),
          status: err.status || null,
          shouldFallback: shouldFallbackProviderError(err)
        });
        failoverAttempts.push({ provider: providerName, model: modelHint, error: err.message || String(err), status: err.status || null });
        if (!shouldFallbackProviderError(err)) {
          console.error('[PLAN] Breaking provider chain - error not fallback-eligible');
          break;
        }
      }
    }

    if (!providerUsed) {
      console.error('[PLAN] No provider succeeded', { failoverAttempts });
      return sendJson(res, 429, { error: 'All planning providers are rate limited or unavailable' });
    }

    const now = new Date().toISOString();

    console.log('[PLAN] Creating message object with reply:', {
      reply: reply,
      replyType: typeof reply,
      replyLength: reply?.length || 0,
      replyPreview: reply ? reply.substring(0, 200) : 'empty'
    });

    const message = {
      id: randomUUID(),
      role: 'user',
      content,
      displayContent,
      model,
      cli,
      status: 'done',
      createdAt: now,
      updatedAt: now,
      finishedAt: now,
      reply,
      phase: 'plan',
    };

    if (failoverAttempts.length) message.failoverAttempts = failoverAttempts;

    if (!session.planUserRequest) session.planUserRequest = planRoot;
    const cleanReply = reply && reply.trim ? reply.trim() : reply;

    console.log('[PLAN] Final message details:', {
      messageId: message.id,
      messageReply: message.reply,
      messageReplyLength: message.reply?.length || 0,
      cleanReply: cleanReply,
      cleanReplyLength: cleanReply?.length || 0,
      planSummary: session.planSummary,
      planSummaryLength: session.planSummary?.length || 0
    });

    session.planSummary = cleanReply || session.planSummary;
    session.planApproved = false;
    session.messages.push(message);
    session.updatedAt = now;
    await persistState();

    console.log('[PLAN] Plan message completed successfully', {
      sessionId: session.id,
      provider: providerUsed,
      model,
      replyLength: cleanReply?.length || 0,
      hasFailovers: failoverAttempts.length > 0
    });

    return sendJson(res, 200, { message, model, planSummary: session.planSummary });
  } catch (error) {
    console.error('[PLAN] Plan message handler error', {
      error: error.message || String(error),
      stack: error.stack,
      attempts: error.attempts
    });
    const attemptInfo = Array.isArray(error.attempts)
      ? error.attempts.map((a) => `${a.model || 'unknown'}: ${a.error || 'error'}`).join(' | ')
      : '';
    const message = error.message || 'Failed to process plan message';
    const composed = attemptInfo ? `${message} (${attemptInfo})` : message;
    return sendJson(res, 500, { error: composed });
  }
}

async function sendToOpencode({ session, model, content, message, cli, streamCallback, opencodeSessionId }) {
  const clean = sanitizeMessage(content);
  
  // Validate content is properly sanitized
  if (clean === null || clean === undefined) {
    throw new Error('Message content failed sanitization');
  }
  
  // Convert to string if needed and ensure it's not empty after trimming
  const contentStr = String(clean).trim();
  if (!contentStr) {
    throw new Error('Message cannot be empty after sanitization');
  }
  if (!session) throw new Error('Session is required for OpenCode commands');
  await ensureSessionPaths(session);
  if (!session.workspaceDir) throw new Error('Session workspace directory not initialized');
  const workspaceDir = session.workspaceDir;
  const cliName = normalizeCli(cli || session?.cli);
  const cliCommand = resolveCliCommand(cliName);
  
  // Ensure model is properly resolved
  const resolvedModel = model || session.model;
  if (!resolvedModel) {
    throw new Error('Model is required for OpenCode commands');
  }
  
  const args = ['run', '--format', 'json', '--model', resolvedModel];

  // Add session ID if available
  if (opencodeSessionId) {
    args.push('--session', opencodeSessionId);
  }

  // Ensure content is properly passed as the final argument
  if (typeof clean !== 'string' || clean.length === 0) {
    throw new Error('Message content is invalid or empty after sanitization');
  }

  args.push(clean);
  
  log('Preparing OpenCode CLI command', { 
    cli: cliName, 
    cmd: cliCommand, 
    model: resolvedModel,
    sessionId: session.id,
    messageId: message?.id,
    contentLength: clean.length,
    contentPreview: clean.substring(0, 100).replace(/\n/g, '\\n')
  });
  let partialOutput = '';
  let lastStreamTime = Date.now();
  const messageKey = message?.id;
  let sessionsBefore = null;

  try {
    log('Running CLI', { cli: cliName, cmd: cliCommand, args: args.slice(0, -1).concat(['[content]']), messageId: messageKey, workspaceDir, opencodeSessionId });

  if (!opencodeSessionId) {
    try {
      sessionsBefore = await listOpencodeSessions(workspaceDir);
    } catch (err) {
      log('Failed to list opencode sessions before run', { error: String(err) });
    }
  }

  // Verify CLI command exists before attempting to run
  try {
    fsSync.accessSync(cliCommand, fsSync.constants.X_OK);
    log('OpenCode CLI verified', { cliCommand });
  } catch (cliError) {
    log('OpenCode CLI not found or not executable', { cliCommand, error: String(cliError) });
    throw new Error(`OpenCode CLI not found or not executable: ${cliCommand}. Please ensure OpenCode is properly installed.`);
  }

  // Log the full command that will be executed
  const fullCommandStr = `${cliCommand} ${args.map(arg => {
    const str = String(arg);
    if (str.includes(' ') || str.includes('"') || str.includes("'") || str.includes('\\')) {
      return `"${str.replace(/"/g, '\\"')}"`;
    }
    return str;
  }).join(' ')}`;
  
  log('Executing OpenCode command', {
    command: fullCommandStr,
    workspaceDir,
    messageId: messageKey
  });

  // Mark process as running - this allows tracking even if SSE stream closes
  // The process will continue running independently of the HTTP connection
  if (messageKey) {
    runningProcesses.set(messageKey, { started: Date.now(), cli: cliName, model });
  }

    let capturedSessionId = null;

    // Use the OpenCode process manager for execution
    // This ensures all sessions share the same OpenCode instance when possible
    const { stdout, stderr } = await opencodeManager.executeInSession(
      session?.id || 'standalone',
      workspaceDir,
      cliCommand,
      args,
      {
        timeout: 600000, // 10 minute timeout to prevent stuck processes
        env: {
          ...process.env,
          OPENAI_API_KEY: OPENCODE_OLLAMA_API_KEY
        },
        onData: (type, chunk) => {
        try {
          const now = Date.now();
          const chunkStr = chunk.toString();

          // Split chunk into lines (since output is newline-delimited JSON)
          const lines = chunkStr.split('\n');

          for (const line of lines) {
            if (!line.trim()) continue;

            // Parse JSON line
            try {
              const event = JSON.parse(line);

              // Capture session ID from any event that has it
              // CRITICAL FIX: Only update session ID if we don't already have an explicit one
              // This prevents overwriting the passed opencodeSessionId with a new auto-generated one
              if (!capturedSessionId && event.sessionID) {
                capturedSessionId = event.sessionID;
                log('Captured session ID from JSON event', { capturedSessionId, messageType: event.type, messageId: messageKey, existingOpencodeSessionId: opencodeSessionId });
                if (session) {
                  // Only update session.opencodeSessionId if no explicit session was passed
                  // This ensures we don't overwrite the intended session ID with an auto-generated one
                  if (!opencodeSessionId || !session.opencodeSessionId) {
                    session.opencodeSessionId = capturedSessionId;
                    // Lock this as the initial session if not already set
                    if (!session.initialOpencodeSessionId) {
                      session.initialOpencodeSessionId = capturedSessionId;
                      log('Locked initial opencode session', { initialOpencodeSessionId: capturedSessionId, sessionId: session.id });
                    }
                    persistState().catch(() => { });
                  } else {
                    log('Preserving existing opencode session ID (not overwriting with captured)', {
                      existing: session.opencodeSessionId || opencodeSessionId,
                      captured: capturedSessionId
                    });
                  }
                }
              }

              // Extract token usage from step_finish events
              if (event.type === 'step_finish' && event.part?.tokens) {
                const inputTokens = event.part.tokens.input || 0;
                const outputTokens = event.part.tokens.output || 0;
                const reasoningTokens = event.part.tokens.reasoning || 0;
                const totalTokens = inputTokens + outputTokens + reasoningTokens;

                if (totalTokens > 0) {
                  // Accumulate tokens if we've already captured some
                  if (message.opencodeTokensUsed) {
                    message.opencodeTokensUsed += totalTokens;
                  } else {
                    message.opencodeTokensUsed = totalTokens;
                  }
                  log('Captured token usage from step_finish event', {
                    inputTokens,
                    outputTokens,
                    reasoningTokens,
                    totalTokens,
                    accumulatedTokens: message.opencodeTokensUsed,
                    messageId: messageKey
                  });
                }
              }

              // Extract text from text events
              if (event.type === 'text' && event.part?.text) {
                partialOutput += event.part.text;

                // Filter out status messages
                const filtered = filterOpencodeStatusMessages(partialOutput);

                if (message) {
                  message.partialOutput = filtered;
                  message.outputType = detectOutputType(filtered);
                  message.partialUpdatedAt = new Date().toISOString();

                  // Only persist every 500ms to avoid excessive writes
                  if (now - lastStreamTime > 500) {
                    persistState().catch(() => { });
                    lastStreamTime = now;
                  }
                }

                // Stream to clients immediately
                const cleanChunk = event.part.text;
                if (streamCallback) {
                  streamCallback({
                    type: 'chunk',
                    content: cleanChunk,
                    filtered: filtered,
                    outputType: message?.outputType,
                    timestamp: new Date().toISOString()
                  });
                }

                // Broadcast to SSE clients
                if (messageKey && activeStreams.has(messageKey)) {
                  const streams = activeStreams.get(messageKey);
                  const data = JSON.stringify({
                    type: 'chunk',
                    content: cleanChunk,
                    filtered: filtered,
                    outputType: message?.outputType,
                    partialOutput: filtered,
                    timestamp: new Date().toISOString()
                  });
                  streams.forEach(res => {
                    try {
                      res.write(`data: ${data}\n\n`);
                    } catch (err) {
                      log('SSE write error', { err: String(err) });
                    }
                  });
                }

                log('cli chunk', { cli: cliName, type: 'text', messageId: messageKey, length: cleanChunk.length, filtered: filtered.slice(0, 100) });
              }
            } catch (jsonErr) {
              // Line is not valid JSON - might be partial line or error output
              log('Failed to parse JSON line', { line: line.substring(0, 200), error: String(jsonErr), messageId: messageKey });
            }
          }
        } catch (err) {
          log('onData handler error', { err: String(err) });
        }
      }
    });

    // Process complete
    if (messageKey) {
      runningProcesses.delete(messageKey);
    }

    // Use accumulated text output (partialOutput) since we're using --format json
    const finalOutput = filterOpencodeStatusMessages(partialOutput || '');

    // Check for completion signal and process it
    const completionMatch = finalOutput.match(/\s*[COMPLETE]\s*$/i);
    let processedOutput = finalOutput;
    if (completionMatch) {
      // Remove the completion signal from the output
      processedOutput = finalOutput.slice(0, completionMatch.index).trim();
      log('OpenCode completion signal detected', {
        messageId: messageKey,
        hadCompletionSignal: true,
        originalLength: finalOutput.length,
        processedLength: processedOutput.length
      });
    }

    // Mark message as done to prevent false "stalled" detection
    if (message) {
      message.status = 'done';
      message.finishedAt = new Date().toISOString();
      if (session) {
        session.updatedAt = message.finishedAt;
      }
    }

    // The reply is the final accumulated output
    let reply = processedOutput;

    if (message) {
      message.partialOutput = finalOutput;
      message.reply = reply; // Set reply on message object before sending completion event
      message.outputType = detectOutputType(finalOutput);
      message.partialUpdatedAt = new Date().toISOString();
      message.opencodeExitCode = 0;
      message.opencodeSummary = finalOutput.slice(0, 800) || `No output from ${cliName} (exit 0)`;
      persistState().catch(() => { });
    }

    // Send completion event to SSE clients with processed reply
    if (messageKey && activeStreams.has(messageKey)) {
      const streams = activeStreams.get(messageKey);
      const data = JSON.stringify({
        type: 'complete',
        content: reply, // Send the processed reply instead of raw finalOutput
        outputType: message?.outputType,
        exitCode: 0,
        timestamp: new Date().toISOString()
      });
      streams.forEach(res => {
        try {
          res.write(`data: ${data}\n\n`);
          res.end();
        } catch (err) {
          log('SSE completion error', { err: String(err) });
        }
      });
      activeStreams.delete(messageKey);
    }

    log('cli finished', { cli: cliName, messageId: messageKey, outputLength: finalOutput.length, replyLength: reply.length });

    if (!opencodeSessionId && session && !session.opencodeSessionId) {
      try {
        const sessionsAfter = await listOpencodeSessions(workspaceDir);
        const beforeIds = new Set((sessionsBefore || []).map((s) => s.id));
        const newSessions = sessionsAfter.filter((s) => s.id && !beforeIds.has(s.id));
        const candidates = newSessions.length ? newSessions : sessionsAfter;

        if (candidates.length) {
          const sorted = candidates.slice().sort((a, b) => {
            const aTime = Date.parse(a.updatedAt || a.createdAt || '') || 0;
            const bTime = Date.parse(b.updatedAt || b.createdAt || '') || 0;
            return bTime - aTime;
          });
          const detected = sorted[0]?.id || null;
          if (detected) {
            session.opencodeSessionId = detected;
            // CRITICAL: Only set initialOpencodeSessionId if not already set
            // This prevents overwriting an existing initial session with a new one
            if (!session.initialOpencodeSessionId) {
              session.initialOpencodeSessionId = detected;
              log('Recovered and locked opencode session ID from session list', { detected, messageId: messageKey });
            } else {
              log('Recovered opencode session ID but preserving existing initial session', {
                detected,
                initialSessionId: session.initialOpencodeSessionId,
                messageId: messageKey
              });
            }
            opencodeSessionId = session.initialOpencodeSessionId || detected;
            persistState().catch(() => { });
          }
        }
      } catch (err) {
        log('Failed to recover opencode session ID from session list', { error: String(err), messageId: messageKey });
      }
    } else if (!opencodeSessionId && session && session.opencodeSessionId) {
      // No explicit session was passed but session has one - log for continuity verification
      log('Using stored opencode session ID (no explicit session in request)', {
        sessionId: session.id,
        opencodeSessionId: session.opencodeSessionId,
        messageId: messageKey
      });
    }

    // Extract token usage from the parsed response if available
    let tokensUsed = 0;
    let tokenSource = 'none';
    const tokenExtractionLog = [];

    // First, check if we captured token usage from the stream (JSON events)
    if (message && message.opencodeTokensUsed) {
      const candidateTokens = message.opencodeTokensUsed;
      const validation = validateTokenCount(candidateTokens, {
        contentLength: finalOutput?.length || 0,
        source: 'stream'
      });

      if (validation.valid) {
        tokensUsed = candidateTokens;
        tokenSource = 'stream';
        tokenExtractionLog.push({ method: 'stream', success: true, value: tokensUsed, validation: 'passed' });
        log('✓ Token extraction: Using token usage captured from stream', { tokensUsed, messageId: messageKey });
      } else {
        tokenExtractionLog.push({
          method: 'stream',
          success: false,
          value: candidateTokens,
          validation: 'failed',
          validationReason: validation.reason
        });
        log('✗ Token extraction: Stream tokens failed validation', {
          tokens: candidateTokens,
          reason: validation.reason,
          messageId: messageKey
        });
      }
    } else if (message) {
      tokenExtractionLog.push({ method: 'stream', success: false, reason: 'message.opencodeTokensUsed not set during streaming' });
    }

    // If no tokens found in response, try to get from session
    if (!tokensUsed && capturedSessionId && workspaceDir) {
      try {
        tokenExtractionLog.push({ method: 'session_query', attempt: 'starting', sessionId: capturedSessionId });
        const sessionTokens = await getOpencodeSessionTokenUsage(capturedSessionId, workspaceDir);
        if (sessionTokens > 0) {
          const validation = validateTokenCount(sessionTokens, {
            contentLength: finalOutput?.length || 0,
            source: 'session'
          });

          if (validation.valid) {
            tokensUsed = sessionTokens;
            tokenSource = 'session';
            tokenExtractionLog.push({ method: 'session_query', success: true, value: tokensUsed, validation: 'passed' });
            log('✓ Token extraction: Got tokens from session info', { opencodeSessionId: capturedSessionId, tokensUsed, messageId: messageKey });
          } else {
            tokenExtractionLog.push({
              method: 'session_query',
              success: false,
              value: sessionTokens,
              validation: 'failed',
              validationReason: validation.reason
            });
            log('✗ Token extraction: Session tokens failed validation', {
              opencodeSessionId: capturedSessionId,
              tokens: sessionTokens,
              reason: validation.reason,
              messageId: messageKey
            });
          }
        } else {
          tokenExtractionLog.push({ method: 'session_query', success: false, reason: 'session query returned 0 tokens' });
          log('✗ Token extraction: Session query returned 0 tokens', { opencodeSessionId: capturedSessionId, messageId: messageKey });
        }
      } catch (sessionErr) {
        tokenExtractionLog.push({ method: 'session_query', success: false, error: String(sessionErr) });
        log('✗ Token extraction: Failed to get session token usage', { opencodeSessionId: capturedSessionId, error: String(sessionErr), messageId: messageKey });
      }
    } else if (!tokensUsed) {
      const reason = !capturedSessionId ? 'no capturedSessionId' : !workspaceDir ? 'no workspaceDir' : 'unknown';
      tokenExtractionLog.push({ method: 'session_query', success: false, reason });
    }

    // Log full extraction summary
    if (!tokensUsed) {
      log('⚠️  Token extraction: All methods failed, will fall back to estimation', {
        messageId: messageKey,
        extractionLog: tokenExtractionLog,
        hadStream: !!message?.opencodeTokensUsed,
        hadOutput: !!finalOutput,
        hadSessionId: !!capturedSessionId
      });
    } else {
      log('✅ Token extraction successful', {
        messageId: messageKey,
        tokensUsed,
        tokenSource,
        extractionLog: tokenExtractionLog
      });
    }

    return { reply, raw: null, tokensUsed, tokenSource, tokenExtractionLog };
  } catch (error) {
    // Process failed
    if (messageKey) {
      runningProcesses.delete(messageKey);
    }

    // Try to parse error from JSON format
    let errorOutput = '';
    const errorStr = error.stderr || error.stdout || '';
    const errorLines = errorStr.split('\n');

    for (const line of errorLines) {
      if (!line.trim()) continue;
      try {
        const event = JSON.parse(line);
        if (event.type === 'error' && event.error) {
          errorOutput += event.error.data?.message || event.error.message || JSON.stringify(event.error);
        } else if (event.type === 'text' && event.part?.text) {
          errorOutput += event.part.text;
        }
      } catch (_) {
        // Not JSON, include as-is
        errorOutput += line + '\n';
      }
    }

    if (!errorOutput) {
      errorOutput = filterOpencodeStatusMessages(stripAnsiAndPrefixes(errorStr));
    }

    const msg = `${cliName} failed: ${String(error.message || error)}${errorOutput ? `\n${errorOutput}` : ''}`;
    log('cli error', {
      cli: cliName,
      cmd: `${cliCommand} ${args.join(' ')}`,
      code: error.code || 'error',
      messageId: messageKey,
      errorDetails: errorOutput.substring(0, 200)
    });

    const err = new Error(msg);
    err.code = error.code || 'error';
    err.stderr = error.stderr;
    err.stdout = error.stdout;

    const isEarlyTerminated = isEarlyTerminationError(error, error.stderr, error.stdout);
    if (isEarlyTerminated) {
      err.shouldFallback = true;
      err.earlyTermination = true;
      log('Early session termination detected', {
        error: error.message,
        pattern: 'early termination indicator',
        sessionId: opencodeSessionId,
        messageId: messageKey
      });
    }

    if (message) {
      message.opencodeExitCode = err.code;
      message.opencodeSummary = errorOutput.slice(0, 800) || String(error.message || error).slice(0, 800);
      message.outputType = detectOutputType(errorOutput);
      message.partialUpdatedAt = new Date().toISOString();
      persistState().catch(() => { });
    }

    // Send error event to SSE clients
    if (messageKey && activeStreams.has(messageKey)) {
      const streams = activeStreams.get(messageKey);
      const data = JSON.stringify({
        type: 'error',
        error: msg,
        content: errorOutput || '', // Include error output as content for the client
        code: err.code,
        exitCode: err.code,
        outputType: message?.outputType,
        timestamp: new Date().toISOString()
      });
      streams.forEach(res => {
        try {
          res.write(`data: ${data}\n\n`);
          res.end();
        } catch (err) {
          log('SSE error event error', { err: String(err) });
        }
      });
      activeStreams.delete(messageKey);
    }

    throw err;
  }
}

function isEarlyTerminationError(error, stderr, stdout) {
  const errorOutput = (stderr || '').toLowerCase();
  const combinedOutput = `${errorOutput} ${(stdout || '').toLowerCase()}`;

  // Exclude warnings and info messages - these are not termination failures
  const isWarningOrInfo = /(warn|warning|info|notice)/i.test(errorOutput);
  if (isWarningOrInfo) return false;

  // Only trigger on specific error patterns that indicate actual early termination
  // These must be explicit errors, not warnings or informational messages
  const terminationPatterns = [
    /error:.*proper prefixing/i,
    /error:.*tool.*call.*format/i,
    /error:.*tool.?call.*prefix/i,
    /error:.*session terminated/i,
    /error:.*unexpected end/i,
    /error:.*premature exit/i,
    /error:.*incomplete output/i,
    /error:.*bracket prefix/i,
    /error:.*xml tag.*missing/i,
    /error:.*function call/i,
    /error:.*invalid tool call/i,
    /error:.*stream.*closed/i,
    /error:.*connection.*lost/i,
    /error:.*process.*exited/i
  ];

  return terminationPatterns.some(pattern => pattern.test(errorOutput));
}

function isSuccessfulCompletion(stderr, stdout, exitCode) {
  const errorOutput = (stderr || '').toLowerCase();
  const normalOutput = (stdout || '').toLowerCase();

  // If there's substantial output, check if it indicates successful completion
  if (normalOutput.length > 200) {
    // Check for success indicators in output
    const successIndicators = [
      /completed successfully/i,
      /done\.$/i,
      /finished/i,
      /output generated/i,
      /response complete/i,
      /task completed/i
    ];

    // Also check for absence of critical error patterns
    const criticalErrors = [
      /error:/i,
      /failed/i,
      /exception/i,
      /crashed/i,
      /terminated abnormally/i
    ];

    const hasSuccessIndicator = successIndicators.some(ind => ind.test(normalOutput));
    const hasCriticalError = criticalErrors.some(err => err.test(errorOutput) || err.test(normalOutput));

    return hasSuccessIndicator && !hasCriticalError;
  }

  return false;
}

function resetMessageStreamingFields(message) {
  if (!message) return;
  delete message.partialOutput;
  delete message.partialUpdatedAt;
  delete message.opencodeExitCode;
  delete message.opencodeSummary;
  delete message.outputType;
}

function resolveModelProviders(modelName) {
  const target = getAdminModelByIdOrName(modelName);
  if (target && Array.isArray(target.providers) && target.providers.length) {
    return target.providers.map((p, idx) => ({
      provider: normalizeProviderName(p.provider || p.name || 'opencode'),
      model: (p.model || p.name || modelName || '').trim() || modelName,
      primary: typeof p.primary === 'boolean' ? p.primary : idx === 0,
      cli: target.cli || 'opencode',
    }));
  }
  return [{
    provider: 'opencode',
    model: modelName,
    primary: true,
    cli: 'opencode',
  }];
}

function buildOpencodeAttemptChain(cli, preferredModel) {
  const chain = [];
  const seen = new Set();
  const addProviderOptions = (modelName) => {
    const providers = resolveModelProviders(modelName);
    providers.forEach((p, idx) => {
      const key = `${p.provider}:${p.model || modelName}`;
      if (seen.has(key)) return;
      seen.add(key);
      chain.push({
        provider: p.provider,
        model: p.model || modelName,
        primary: typeof p.primary === 'boolean' ? p.primary : idx === 0,
        cli: normalizeCli(p.cli || cli || 'opencode'),
        sourceModel: modelName,
      });
    });
  };

  // Only add preferredModel if it's a non-empty string
  if (typeof preferredModel === 'string' && preferredModel.trim()) {
    addProviderOptions(preferredModel);
  }
  getConfiguredModels(cli).forEach((m) => {
    if (m.name && m.name !== preferredModel) addProviderOptions(m.name);
  });
  addProviderOptions('default');
  
  // Log the built chain for debugging
  log('Built model attempt chain', {
    cli,
    preferredModel: (typeof preferredModel === 'string' && preferredModel.trim()) ? preferredModel : '(none)',
    chainLength: chain.length,
    models: chain.map(c => `${c.provider}:${c.model}`).slice(0, 5) // First 5 to avoid log spam
  });
  
  return chain;
}

function buildCliFallbackModels(cli, preferredModel) {
  const chain = [];
  const add = (name) => {
    const trimmed = (name || '').trim();
    if (trimmed && !chain.includes(trimmed)) chain.push(trimmed);
  };
  add(preferredModel);
  getConfiguredModels(cli).forEach((m) => add(m.name));
  add('default');
  return chain;
}

function shouldFallbackCliError(err, message) {
  if (!err) return false;

  // First, check if this was actually a successful completion despite an error being thrown
  // This can happen if the model completed but the process had a non-zero exit code
  if (message && message.partialOutput && message.partialOutput.length > 200) {
    // Check for success indicators in the output
    const successIndicators = [
      /completed successfully/i,
      /finished successfully/i,
      /done\.$/i,
      /task completed/i,
      /output generated/i,
      /response complete/i,
      /✔|✓|success/i
    ];

    const hasSuccessIndicator = successIndicators.some(ind => ind.test(message.partialOutput));
    const hasCriticalError = /error:|failed|exception|crashed/i.test(message.partialOutput);

    if (hasSuccessIndicator && !hasCriticalError) {
      log('Blocking fallback - model completed successfully', {
        messageId: message.id,
        partialOutputLength: message.partialOutput.length,
        successIndicator: true
      });
      return false;
    }
  }

  // Check if message has substantial output - if so, don't fallback even on errors
  // This prevents fallback when model was working fine but hit a minor issue
  if (message && message.partialOutput && message.partialOutput.length > 500) {
    log('Blocking fallback - message has substantial output', {
      messageId: message.id,
      partialOutputLength: message.partialOutput.length
    });
    return false;
  }

  // Only check stderr and error message for actual errors, not stdout which may contain informational logs
  const errorMessage = (err.message || '').toLowerCase();
  const stderr = (err.stderr || '').toLowerCase();
  const combinedOutput = `${errorMessage} ${stderr}`;

  // Exclude warnings and info messages - these are not failures requiring fallback
  const isWarningOrInfo = /(warn|warning|info|notice)/i.test(combinedOutput);
  if (isWarningOrInfo) {
    log('Blocking fallback - only warning/info present', {
      hasWarning: true,
      combinedOutput: combinedOutput.substring(0, 200)
    });
    return false;
  }

  // Use more specific patterns that indicate actual API/model failures requiring fallback
  // These require explicit "error:" prefix or very specific failure indicators
  const apiFailurePatterns = [
    // Model availability errors - these are clear failures requiring fallback
    /error:.*model not found/i,
    /error:.*unknown model/i,
    /error:.*invalid model/i,
    /error:.*unsupported model/i,
    // Authentication errors - clear API failures
    /error:.*api key/i,
    /error:.*unauthorized/i,
    /error:.*forbidden/i,
    // Quota/credit errors - clear service failures
    /error:.*insufficient credit/i,
    /error:.*insufficient quota/i,
    /error:.*no credit/i,
    /error:.*payment required/i,
    // Rate limiting - these require fallback
    /error:.*rate limit exceeded/i,
    /error:.*too many requests/i,
    /error:.*rate limited/i,
    // Size limits - clear model constraints
    /error:.*request too large/i,
    /error:.*token limit exceeded/i,
    /error:.*context length exceeded/i,
    /error:.*maximum context length/i,
    /error:.*max tokens exceeded/i,
    /error:.*reduce your message size/i,
    // Connection and server errors
    /error:.*connection.*refused/i,
    /error:.*connection.*timeout/i,
    /error:.*server.*error/i,
    /error:.*internal server error/i,
    /error:.*service unavailable/i,
    /error:.*gateway.*timeout/i
  ];

  // Check if any API failure pattern is present in error output
  const hasApiFailure = apiFailurePatterns.some((pattern) => pattern.test(combinedOutput));

  if (hasApiFailure) {
    log('Allowing fallback - API failure detected', {
      pattern: 'api_failure',
      combinedOutput: combinedOutput.substring(0, 200)
    });
    return true;
  }

  // Additional check: if error mentions a provider with explicit error indicator
  // Only trigger for actual errors, not provider mentions in normal logging
  if (combinedOutput.includes('openrouter') ||
      combinedOutput.includes('mistral') ||
      combinedOutput.includes('nvidia') ||
      combinedOutput.includes('groq')) {

    // Require explicit error indicators for provider mentions
    const errorIndicators = [
      /^error:/i,
      / failed/i,
      / failure/i,
      / exception/i,
      / rejected/i,
      / denied/i
    ];

    const hasErrorIndicator = errorIndicators.some((ind) => ind.test(combinedOutput));

    if (hasErrorIndicator) {
      log('Allowing fallback - provider error detected', {
        provider: 'provider_mentioned',
        combinedOutput: combinedOutput.substring(0, 200)
      });
      return true;
    }
  }

  // Additional check: HTTP status codes that indicate actual failures
  const httpStatusPatterns = [
    /error.*401/i,
    /error.*402/i,
    /error.*404/i,
    /error.*429/i,
    /error.*5\d{2}/
  ];

  const hasHttpError = httpStatusPatterns.some((pattern) => pattern.test(combinedOutput));
  if (hasHttpError) {
    log('Allowing fallback - HTTP error status detected', {
      pattern: 'http_error',
      combinedOutput: combinedOutput.substring(0, 200)
    });
    return true;
  }

  log('Blocking fallback - no eligible error pattern detected', {
    combinedOutput: combinedOutput.substring(0, 200)
  });
  return false;
}

async function sendToOpencodeWithFallback({ session, model, content, message, cli, streamCallback, opencodeSessionId, plan }) {
  const cliName = normalizeCli(cli || session?.cli);
  const preferredModel = model || session?.model;
  const chain = buildOpencodeAttemptChain(cliName, preferredModel);
  const tried = new Set();
  const attempts = [];
  let lastError = null;
  let switchedToBackup = false;

  log('Fallback sequence initiated', {
    sessionId: session?.id,
    messageId: message?.id,
    primaryModel: preferredModel,
    cliName,
    chainLength: chain.length,
    timestamp: new Date().toISOString()
  });

  const tryOption = async (option, isBackup = false) => {
    const key = `${option.provider}:${option.model}`;
    if (tried.has(key)) return null;
    tried.add(key);
    const limit = isProviderLimited(option.provider, option.model);
    if (limit.limited) {
      attempts.push({ model: option.model, provider: option.provider, error: `limit: ${limit.reason}` });
      return null;
    }
    try {
      resetMessageStreamingFields(message);
      
      // When switching to backup model, preserve session and keep original content
      let messageContent = content;
      if (isBackup && !switchedToBackup && attempts.length > 0) {
        switchedToBackup = true;
        log('Switching to backup model with session continuity', {
          model: option.model,
          provider: option.provider,
          preservedSession: opencodeSessionId,
          attempts: attempts.length
        });
      }
      const result = await sendToOpencode({ session, model: option.model, content: messageContent, message, cli: cliName, streamCallback, opencodeSessionId });
      const normalizedResult = (result && typeof result === 'object') ? result : { reply: result };
      
      let tokensUsed = 0;
      let tokenSource = 'none';
      let tokenExtractionLog = [];
      
      // First try to use tokens from sendToOpencode result if available
      if (result && typeof result === 'object' && result.tokensUsed > 0) {
        tokensUsed = result.tokensUsed;
        tokenSource = result.tokenSource || 'result';
        tokenExtractionLog = result.tokenExtractionLog || [];
        log('✓ sendToOpencodeWithFallback: Using tokens from sendToOpencode result', { tokensUsed, tokenSource, messageId: message?.id });
      } else {
        // Fallback to extractTokenUsageFromResult
        tokensUsed = extractTokenUsageFromResult(normalizedResult, [messageContent], { allowEstimate: false });
        if (tokensUsed > 0) {
          tokenSource = 'response-extracted';
          tokenExtractionLog.push({ method: 'extractTokenUsageFromResult', success: true, value: tokensUsed });
          log('✓ sendToOpencodeWithFallback: Extracted tokens from result', { tokensUsed, messageId: message?.id });
        } else {
          tokenExtractionLog.push({ method: 'extractTokenUsageFromResult', success: false, reason: 'returned 0 tokens' });
        }
      }

      // Check if token usage was captured during streaming
      if (!tokensUsed && message.opencodeTokensUsed) {
        tokensUsed = message.opencodeTokensUsed;
        tokenSource = 'stream';
        tokenExtractionLog.push({ method: 'stream', success: true, value: tokensUsed, context: 'sendToOpencodeWithFallback' });
        log('✓ sendToOpencodeWithFallback: Using token usage captured during streaming', { tokensUsed, messageId: message?.id });
      }

      // Try session query
      if (!tokensUsed && opencodeSessionId && session?.workspaceDir) {
        log('🔍 sendToOpencodeWithFallback: Attempting session token query', { sessionId: opencodeSessionId, messageId: message?.id });
        tokensUsed = await getOpencodeSessionTokenUsage(opencodeSessionId, session.workspaceDir);
        if (tokensUsed > 0) {
          tokenSource = 'session';
          tokenExtractionLog.push({ method: 'session_query', success: true, value: tokensUsed, context: 'sendToOpencodeWithFallback' });
          log('✓ sendToOpencodeWithFallback: Got tokens from session', { tokensUsed, messageId: message?.id });
        } else {
          tokenExtractionLog.push({ method: 'session_query', success: false, reason: 'returned 0 tokens', context: 'sendToOpencodeWithFallback' });
        }
      }
      
      // Use estimation as last resort
      if (!tokensUsed) {
        const inputTokens = estimateTokensFromMessages([messageContent], '');
        const outputTokens = estimateTokensFromMessages([], normalizedResult.reply || '');
        tokensUsed = Math.max(inputTokens, outputTokens) + Math.ceil(Math.min(inputTokens, outputTokens) * 0.5);
        tokensUsed = Math.max(tokensUsed, 50);
        tokenSource = 'estimate-improved';
        
        const estimationDetails = {
          inputTokens,
          outputTokens,
          inputLength: (messageContent || '').length,
          outputLength: (normalizedResult.reply || '').length,
          calculatedTokens: Math.max(inputTokens, outputTokens) + Math.ceil(Math.min(inputTokens, outputTokens) * 0.5),
          finalTokens: tokensUsed,
          reason: 'All token extraction methods failed in sendToOpencodeWithFallback'
        };
        
        tokenExtractionLog.push({ method: 'estimation', success: true, value: tokensUsed, details: estimationDetails });
        
        log('⚠️  sendToOpencodeWithFallback: Using estimation', {
          messageId: message?.id,
          sessionId: session?.id,
          model: option.model,
          provider: option.provider,
          ...estimationDetails
        });
        
        console.warn('[TOKEN_TRACKING] ⚠️  ESTIMATION USED in sendToOpencodeWithFallback:', JSON.stringify({
          messageId: message?.id,
          sessionId: session?.id,
          model: option.model,
          provider: option.provider,
          estimatedTokens: tokensUsed,
          ...estimationDetails
        }, null, 2));
      }
      
      log('✅ Token usage determined in sendToOpencodeWithFallback', { 
        tokenSource, 
        tokensUsed, 
        sessionId: session?.id, 
        messageId: message?.id,
        extractionLog: tokenExtractionLog
      });
      
      recordProviderUsage(option.provider, option.model, tokensUsed, 1);
      
      if (attempts.length) {
        log('opencode succeeded after fallback', { attempts, model: option.model, provider: option.provider, cli: cliName, backup: isBackup });
      }
      
      return { 
        reply: normalizedResult.reply, 
        model: option.model, 
        attempts, 
        provider: option.provider, 
        raw: normalizedResult.raw, 
        tokensUsed,
        tokenSource,
        tokenExtractionLog
      };
    } catch (err) {
      lastError = err;
      attempts.push({
        model: option.model,
        provider: option.provider,
        error: err.message || String(err),
        code: err.code || null,
        earlyTermination: err.earlyTermination || false,
        timestamp: new Date().toISOString()
      });

      if (err.earlyTermination) {
        // Only allow fallback if there's no substantial partial output
        // If there's substantial output, the model was working fine and shouldn't fallback
        const partialOutputLength = (message?.partialOutput || '').length;
        const hasSubstantialOutput = partialOutputLength > 500;
        
        if (hasSubstantialOutput) {
          log('Blocking fallback - model has substantial output despite early termination', {
            model: option.model,
            provider: option.provider,
            error: err.message,
            partialOutputLength
          });
          return err;
        }
        
        log('Allowing automatic fallback due to early termination', {
          model: option.model,
          provider: option.provider,
          error: err.message,
          partialOutputLength
        });
        return null;
      }

      if (!shouldFallbackCliError(err, message)) return err;
      return null;
    }
  };

  for (const option of chain) {
    const result = await tryOption(option);
    if (result instanceof Error) break;
    if (result) return result;
  }

  const backupModel = (providerLimits.opencodeBackupModel || '').trim();
  if (backupModel) {
    const backupChain = buildOpencodeAttemptChain(cliName, backupModel);
    for (const option of backupChain) {
      const result = await tryOption(option, true);
      if (result instanceof Error) break;
      if (result) return result;
    }
  }

  const MAX_EARLY_TERMINATIONS = 2;
  const recentEarlyTerminations = attempts.filter(
    a => a.earlyTermination &&
    Date.now() - new Date(a.timestamp || 0).getTime() < 60000
  ).length;

  if (recentEarlyTerminations >= MAX_EARLY_TERMINATIONS) {
    log('Too many early terminations, giving up', {
      sessionId: session?.id,
      earlyTerminations: recentEarlyTerminations,
      attempts: attempts.length
    });
  }

  const err = new Error(`All ${cliName.toUpperCase()} models failed`);
  err.attempts = attempts;
  err.cause = lastError;
  throw err;
}

async function queueMessage(sessionId, message) { 
  traceMessageLifecycle('queued', sessionId, message); 
  const prev = sessionQueues.get(sessionId) || Promise.resolve(); 
  const next = prev.then(async () => {
    try {
      await processMessage(sessionId, message);
    } catch (error) {
      // Enhanced error handling to ensure resource cleanup
      log('Queue processing error', { sessionId, messageId: message.id, error: String(error) });
      
      // Try to find the session and message to mark as error if not already handled
      try {
        const session = getSession(sessionId);
        if (session) {
          const msg = session.messages.find(m => m.id === message.id);
          if (msg && msg.status !== 'error' && msg.status !== 'completed' && msg.status !== 'skipped') {
            msg.status = 'error';
            msg.error = `Queue processing failed: ${String(error)}`;
            msg.finishedAt = new Date().toISOString();
            session.updatedAt = msg.finishedAt;
            updatePending(sessionId, -1, session.userId);
            await persistState();
          }
        }
      } catch (cleanupError) {
        log('Failed to cleanup after queue error', { sessionId, error: String(cleanupError) });
      }
      
      // Re-throw to maintain the promise chain behavior
      throw error;
    }
  }); 
  sessionQueues.set(sessionId, next); 
  return next; 
}
async function processMessage(sessionId, message) {
  const session = getSession(sessionId);
  if (!session) return;

  // Track message processing start
  const startTime = Date.now();
  const userPlan = resolveUserPlan(session.userId);

  if (message.isContinuation && message.originalMessageId) {
    const originalMessage = session.messages?.find(m => m.id === message.originalMessageId);
    
    // Ensure we always preserve the session for continuations
    // Priority order: originalMessage.opencodeSessionId > session.opencodeSessionId > session.initialOpencodeSessionId
    if (originalMessage && originalMessage.opencodeSessionId) {
      message.opencodeSessionId = originalMessage.opencodeSessionId;
    } else if (session.opencodeSessionId) {
      message.opencodeSessionId = session.opencodeSessionId;
    } else if (session.initialOpencodeSessionId) {
      message.opencodeSessionId = session.initialOpencodeSessionId;
    }
    
    log('Processing continuation message', {
      sessionId,
      originalMessageId: message.originalMessageId,
      newMessageId: message.id,
      model: message.model,
      preservedSessionId: message.opencodeSessionId,
      initialSessionId: session.initialOpencodeSessionId,
      sessionOpencodeSessionId: session.opencodeSessionId,
      originalMessageSessionId: originalMessage?.opencodeSessionId
    });
  }

  message.status = 'running';
  message.startedAt = new Date().toISOString();
  updatePending(sessionId, 0, session.userId);
  await persistState();
  let releaseResources = null;
  try {
    traceMessageLifecycle('processing', sessionId, message);
    await ensureSessionPaths(session);
    const sessionPlan = resolveUserPlan(session.userId);
    await applyPlanPriorityDelay(sessionPlan);
    
    // Wait for resources - this will wait indefinitely until resources are available
    // Messages are never skipped, they stay in queue until they can be processed
    releaseResources = await waitForResources(message.id);
    
    const activeCli = normalizeCli(message.cli || session.cli);

    // Track model usage
    const modelUsed = message.model || session.model || 'default';
    trackModelUsage(modelUsed, session.userId, userPlan);
    trackFeatureUsage('ai_chat', session.userId, userPlan);

    // Image attachments: append image URLs to message content
    // Images are sent to the opencode session along with the message
    const imageAttachments = Array.isArray(message.attachments)
      ? message.attachments.filter((a) => a && isImageMime(a.type) && a.url)
      : [];
    if (imageAttachments.length) {
      const imageTags = imageAttachments.map(a => `@${a.name}`).join(' ');
      message.content = `${imageTags}\n\n${message.content}`;
    }

    // Ensure opencode session exists before processing
    // CRITICAL FIX: Use message.opencodeSessionId if explicitly provided in request
    // This ensures session continuity for continuations and retries
    let opencodeSessionId;
    if (message.opencodeSessionId) {
      log('Using explicit opencodeSessionId from message', {
        sessionId,
        messageOpencodeSessionId: message.opencodeSessionId,
        sessionOpencodeSessionId: session.opencodeSessionId
      });
      opencodeSessionId = message.opencodeSessionId;
      // Update session to use this session ID
      if (session.opencodeSessionId !== opencodeSessionId) {
        session.opencodeSessionId = opencodeSessionId;
        // Only set initialOpencodeSessionId if not already set to preserve session continuity
        if (!session.initialOpencodeSessionId) {
          session.initialOpencodeSessionId = opencodeSessionId;
        }
        await persistState();
      }
    } else {
      log('Ensuring opencode session (no explicit session ID in message)', {
        sessionId,
        activeCli,
        model: message.model,
        isProceedWithBuild: message.isProceedWithBuild
      });
      opencodeSessionId = await ensureOpencodeSession(session, message.model);
      if (opencodeSessionId && session.opencodeSessionId !== opencodeSessionId) {
        session.opencodeSessionId = opencodeSessionId;
        await persistState();
      }
    }
    // We allow null opencodeSessionId, which means we'll let the CLI create one
    log('opencode session ensured (or pending)', { sessionId, opencodeSessionId, model: message.model, workspaceDir: session.workspaceDir });

    const opencodeResult = await sendToOpencodeWithFallback({ session, model: message.model, content: message.content, message, cli: activeCli, opencodeSessionId, plan: sessionPlan });
    const reply = opencodeResult.reply;
    if (opencodeResult.model) {
      message.model = opencodeResult.model;
    }
    if (Array.isArray(opencodeResult.attempts) && opencodeResult.attempts.length) {
      message.failoverAttempts = opencodeResult.attempts;
    }
    
    // Track AI response time
    const responseTime = Date.now() - startTime;
    const provider = opencodeResult.provider || 'opencode';
    trackAIResponseTime(responseTime, provider, true, null);
    
    // Calculate tokens: prefer OpenCode-reported usage, then stream capture, then real session usage, then estimation
    let tokensUsed = 0;
    let tokenSource = 'none';
    let tokenExtractionLog = [];

    // First check if we got tokens from the result
    if (typeof opencodeResult.tokensUsed === 'number' && opencodeResult.tokensUsed > 0) {
      tokensUsed = opencodeResult.tokensUsed;
      tokenSource = opencodeResult.tokenSource || 'result';
      tokenExtractionLog = opencodeResult.tokenExtractionLog || [];
      log('✓ processMessage: Using tokens from opencodeResult', { tokensUsed, tokenSource, messageId: message.id });
    }

    // Check if token usage was captured during streaming (fallback if result didn't have it)
    if (!tokensUsed && message.opencodeTokensUsed) {
      tokensUsed = message.opencodeTokensUsed;
      tokenSource = 'stream';
      tokenExtractionLog.push({ method: 'stream', success: true, value: tokensUsed, context: 'processMessage fallback' });
      log('✓ processMessage: Using token usage captured during streaming', { tokensUsed, messageId: message.id });
    }

    // Try session query if still no tokens
    if (!tokensUsed && session.opencodeSessionId && session.workspaceDir) {
      try {
        log('🔍 processMessage: Attempting session token query as fallback', { sessionId: session.opencodeSessionId, messageId: message.id });
        tokensUsed = await getOpencodeSessionTokenUsage(session.opencodeSessionId, session.workspaceDir);
        if (tokensUsed > 0) {
          tokenSource = 'session';
          tokenExtractionLog.push({ method: 'session_query', success: true, value: tokensUsed, context: 'processMessage fallback' });
          log('✓ processMessage: Got tokens from session query', { tokensUsed, messageId: message.id });
        } else {
          tokenExtractionLog.push({ method: 'session_query', success: false, reason: 'returned 0 tokens', context: 'processMessage fallback' });
        }
      } catch (sessionErr) {
        tokenExtractionLog.push({ method: 'session_query', success: false, error: String(sessionErr), context: 'processMessage fallback' });
        log('✗ processMessage: Session token query failed', { error: String(sessionErr), messageId: message.id });
      }
    }

    // If still no tokens, use estimation with detailed logging
    if (!tokensUsed) {
      const inputTokens = estimateTokensFromMessages([message.content], '');
      const outputTokens = estimateTokensFromMessages([], reply || '');
      // Use a more accurate ratio for AI-generated code (typically ~3-4 chars per token for code)
      tokensUsed = Math.max(inputTokens, outputTokens) + Math.ceil(Math.min(inputTokens, outputTokens) * 0.5);
      // Ensure minimum token count for any AI interaction
      tokensUsed = Math.max(tokensUsed, 50);
      tokenSource = 'estimate-improved';

      const estimationDetails = {
        inputTokens,
        outputTokens,
        inputLength: (message.content || '').length,
        outputLength: (reply || '').length,
        calculatedTokens: Math.max(inputTokens, outputTokens) + Math.ceil(Math.min(inputTokens, outputTokens) * 0.5),
        finalTokens: tokensUsed,
        reason: 'All token extraction methods failed'
      };

      tokenExtractionLog.push({
        method: 'estimation',
        success: true,
        value: tokensUsed,
        details: estimationDetails,
        context: 'processMessage fallback'
      });

      log('⚠️  processMessage: Using estimation because all extraction methods failed', {
        messageId: message.id,
        sessionId: session.id,
        ...estimationDetails
      });

      console.warn('[TOKEN_TRACKING] ⚠️  ESTIMATION USED:', JSON.stringify({
        messageId: message.id,
        sessionId: session.id,
        model: message.model,
        provider,
        estimatedTokens: tokensUsed,
        ...estimationDetails
      }, null, 2));

      // Mark message as having token extraction failure for client-side error detection
      // This allows the client to detect server-side errors even when status is 'done'
      message.tokenExtractionFailed = true;
      message.tokenSource = tokenSource;
    }

      log('✅ Token usage determined for processMessage', {
        tokenSource,
        tokensUsed,
        sessionId,
        messageId: message.id,
        extractionLog: tokenExtractionLog
      });

      console.log(`[USAGE] processMessage: recording tokens user=${session.userId} tokens=${tokensUsed} model=${message.model} source=${tokenSource}`);

      if (session.userId) {
        await recordUserTokens(session.userId, tokensUsed);
      } else {
        console.error('[USAGE] ERROR: Cannot record tokens in processMessage because session.userId is missing', { sessionId, messageId: message.id });
      }

      // Check if message appears incomplete due to token extraction failure
      // If token extraction failed and output is suspiciously short, mark as incomplete
      const outputLength = (reply || '').length;
      const isSuspiciouslyShort = outputLength < 100 && tokenSource === 'estimate-improved';
      const isTokenExtractionFailed = tokenSource === 'estimate-improved';

      if (isTokenExtractionFailed && isSuspiciouslyShort && message.cli === 'opencode') {
        console.warn('[COMPLETION_DETECTION] Message appears incomplete due to token extraction failure', {
          messageId: message.id,
          sessionId: session.id,
          outputLength,
          tokenSource,
          isSuspiciouslyShort
        });
        // Mark message as potentially incomplete for client-side detection
        message.potentiallyIncomplete = true;
      }

      message.status = 'done';
      message.reply = reply;
    message.finishedAt = new Date().toISOString();
    session.updatedAt = message.finishedAt;
    session.cli = activeCli;
    session.model = message.model; // Update session's active model after any fallback
    await persistState(); // Persist the updated model
    traceMessageLifecycle('done', sessionId, message);
  } catch (error) {
    // Provide helpful and parseable error details in the message
    message.status = 'error';
    const details = [];
    if (error.code) details.push(`code: ${error.code}`);
    if (error.stderr) details.push(`stderr: ${error.stderr.trim()}`);
    if (error.stdout) details.push(`stdout: ${error.stdout.trim()}`);
    if (Array.isArray(error.attempts) && error.attempts.length) {
      const attemptSummary = error.attempts.map((a) => `${a.model || 'unknown'}: ${a.error || 'error'}`).join(' | ');
      details.push(`attempts: ${attemptSummary}`);
      const lastAttempt = error.attempts[error.attempts.length - 1];
      if (lastAttempt?.model) message.model = lastAttempt.model;
    }
    const messageText = (error.message && error.message.length) ? String(error.message) : `${String(error)}`;
    message.error = `${messageText}${details.length ? ` -- ${details.join(' | ')}` : ''}`;
    
    // Track AI errors
    const errorType = error.code || 'processing_error';
    trackUserSession(session.userId, 'error', { 
      errorType: errorType,
      sessionId: sessionId,
      messageId: message.id 
    });
    trackAIResponseTime(Date.now() - startTime, 'opencode', false, errorType);
    
    log('message processing failed', { sessionId, messageId: message.id, error: message.error });
    message.finishedAt = new Date().toISOString();
    session.updatedAt = message.finishedAt;
  } finally {
    releaseResources?.();
    updatePending(sessionId, -1, session.userId);
    
    // Clean up any active streams for this message
    if (activeStreams.has(message.id)) {
      const streams = activeStreams.get(message.id);
      if (streams instanceof Set) {
        for (const stream of streams) {
          try {
            const finalData = JSON.stringify({
              type: message.status === 'error' ? 'error' : 'complete',
              content: message.reply || message.partialOutput || '',
              error: message.error,
              outputType: message.outputType,
              exitCode: message.opencodeExitCode,
              timestamp: message.finishedAt || new Date().toISOString()
            });
            stream.write(`data: ${finalData}\n\n`);
            stream.end();
          } catch (_) {}
        }
      }
      activeStreams.delete(message.id);
    }
    
    // Clean up process tracking
    if (runningProcesses.has(message.id)) {
      runningProcesses.delete(message.id);
    }
    
    // Trigger memory cleanup after processing completes
    const processTime = Date.now() - startTime;
    if (processTime > 60000) { // If processing took > 1 minute, trigger cleanup
      triggerMemoryCleanup('long_process_complete');
    }
    
    await persistState();
  }
}

function getConfiguredModels(cliParam = 'opencode') {
  const cli = normalizeCli(cliParam || 'opencode');
  const filtered = adminModels.filter((m) => !m.cli || normalizeCli(m.cli) === cli);
  const mapped = filtered.map((m) => ({
    id: m.id,
    name: m.name,
    label: m.label || m.name,
    icon: m.icon || '',
    cli: m.cli || 'opencode',
    providers: Array.isArray(m.providers) ? m.providers : [],
    primaryProvider: m.primaryProvider || (Array.isArray(m.providers) && m.providers[0]?.provider) || 'opencode',
    tier: m.tier || 'free',
    multiplier: getTierMultiplier(m.tier || 'free'),
    supportsMedia: m.supportsMedia ?? false,
  }));
  return mapped.sort((a, b) => (a.label || '').localeCompare(b.label || ''));
}

async function handleModels(_req, res, cliParam = null) {
  try {
    const models = getConfiguredModels(cliParam || 'opencode');
    sendJson(res, 200, { models, empty: models.length === 0 });
  } catch (error) {
    sendJson(res, 500, { error: error.message || 'Failed to load models' });
  }
}

async function handleUserLogin(req, res) {
  try {
    const body = await parseJsonBody(req);
    const email = (body.email || body.username || body.user || '').trim().toLowerCase();
    const password = (body.password || body.pass || '').trim();
    const remember = body.remember === true || body.remember === 'true';
    const clientIp = req.socket?.remoteAddress || 'unknown';

    // Check honeypot
    if (checkHoneypot(body)) {
      log('user login honeypot triggered', { ip: clientIp });
      return sendJson(res, 400, { error: 'Invalid request' });
    }

    if (!email || !password) {
      return sendJson(res, 400, { error: 'Email and password are required' });
    }

    // Check rate limit
    const rateLimitKey = `${email}:${clientIp}`;
    const rateLimit = checkLoginRateLimit(rateLimitKey, USER_LOGIN_RATE_LIMIT, loginAttempts);
    if (rateLimit.blocked) {
      log('user login rate limited', { email, ip: clientIp, retryAfter: rateLimit.retryAfter });
      return sendJson(res, 429, {
        error: 'Too many login attempts. Please try again later.',
        retryAfter: rateLimit.retryAfter || 60
      });
    }

    const user = await verifyUserPassword(email, password);
    if (!user) {
      log('failed user login attempt', { email, ip: clientIp, reason: 'invalid_credentials' });
      return sendJson(res, 401, { error: 'Incorrect credentials' });
    }

    // Check account lockout
    if (user.lockedUntil && user.lockedUntil > Date.now()) {
      log('login attempt on locked account', { email, ip: clientIp, lockedUntil: user.lockedUntil });
      return sendJson(res, 429, {
        error: 'Account temporarily locked due to too many failed attempts.',
        retryAfter: Math.ceil((user.lockedUntil - Date.now()) / 1000)
      });
    }

    if (!user.emailVerified) {
      return sendJson(res, 403, { error: 'Please verify your email address before signing in.' });
    }

    // Clear failed attempts on success
    loginAttempts.delete(rateLimitKey);

    // Reset failed logins on successful login
    user.failedLogins = 0;
    user.lockedUntil = null;
    await persistUsersDb();

    const token = startUserSession(res, user.id, remember);
    const ttl = remember ? USER_SESSION_TTL_MS : USER_SESSION_SHORT_TTL_MS;
    const expiresAt = Date.now() + ttl;

    // Track user login
    trackUserSession(user.id, 'login', { plan: user.plan });
    trackConversionFunnel('signup_to_login', 'login', user.id, { plan: user.plan });

    log('successful user login', { userId: user.id, email: user.email, remember });
    sendJson(res, 200, {
      ok: true,
      user: { id: user.id, email: user.email, plan: user.plan },
      token,
      expiresAt
    });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to login' });
  }
}

async function subscribeToEmailMarketing(email) {
  try {
    await fetch('https://emailmarketing.modelrailway3d.co.uk/api/webhooks/incoming/wh_0Z49zi_DGj4-lKJMOPO8-g', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        email,
        source: 'plugin_compass_signup',
        timestamp: new Date().toISOString()
      })
    });
    log('email marketing subscription added', { email });
  } catch (error) {
    log('email marketing subscription failed', { email, error: error.message });
  }
}

async function handleUserRegister(req, res) {
  try {
    const body = await parseJsonBody(req);
    const email = (body.email || body.username || body.user || '').trim().toLowerCase();
    const password = (body.password || body.pass || '').trim();
    const clientIp = req.socket?.remoteAddress || 'unknown';

    // Check honeypot
    if (checkHoneypot(body)) {
      log('user registration honeypot triggered', { ip: clientIp });
      return sendJson(res, 400, { error: 'Invalid request' });
    }

    if (!email || !password) {
      return sendJson(res, 400, { error: 'Email and password are required' });
    }

    // Basic email validation
    if (!EMAIL_REGEX.test(email)) {
      return sendJson(res, 400, { error: 'Invalid email format' });
    }

    // Enhanced password strength validation
    const passwordValidation = validatePassword(password);
    if (!passwordValidation.valid) {
      return sendJson(res, 400, {
        error: 'Password does not meet requirements',
        requirements: passwordValidation.errors
      });
    }

    const affiliateCode = sanitizeAffiliateCode(body.affiliateCode || body.ref || readAffiliateReferralCode(req));
    const trackedAffiliate = affiliateCode && findAffiliateByCode(affiliateCode) ? affiliateCode : '';
    if (trackedAffiliate) {
      setAffiliateReferralCookie(res, trackedAffiliate);
    }

    const user = await createUser(email, password, { referredByAffiliateCode: trackedAffiliate });

    subscribeToEmailMarketing(user.email).catch(err => {
      log('background email marketing subscription failed', { userId: user.id, email: user.email });
    });

    // Track signup conversion and start conversion funnel
    trackConversion('signup', req);
    trackConversionFunnel('signup_process', 'signup_completed', user.id, { 
      source: body.source || 'direct',
      has_affiliate: !!trackedAffiliate 
    });

    // Send verification email in the background to avoid holding up the response
    sendVerificationEmail(user, resolveBaseUrl(req)).catch(err => {
      log('background verification email failed', { userId: user.id, email: user.email });
    });

    log('user registered successfully', { userId: user.id, email: user.email });
    sendJson(res, 200, {
      ok: true,
      user: { id: user.id, email: user.email, emailVerified: user.emailVerified },
      verificationRequired: true,
      message: 'Please check your email to verify your account.'
    });
  } catch (error) {
    if (error.message === 'User already exists with this email') {
      sendJson(res, 409, { error: error.message });
    } else {
      sendJson(res, 400, { error: error.message || 'Unable to register' });
    }
  }
}

async function handleAffiliateSignup(req, res) {
  try {
    const body = await parseJsonBody(req);
    const email = (body.email || body.username || '').trim().toLowerCase();
    const password = (body.password || '').trim();
    const name = (body.name || body.fullName || '').trim();
    if (!EMAIL_REGEX.test(email)) return sendJson(res, 400, { error: 'Email is invalid' });
    if (!password || password.length < 6) return sendJson(res, 400, { error: 'Password must be at least 6 characters long' });
    const affiliate = await registerAffiliate({ email, password, name });
    sendAffiliateVerificationEmail(affiliate, resolveBaseUrl(req)).catch(err => {
      log('background affiliate verification email failed', { affiliateId: affiliate.id, email: affiliate.email });
    });
    return sendJson(res, 201, { ok: true, verificationRequired: true, message: 'Please check your email to verify your account.' });
  } catch (error) {
    if (error.message && error.message.includes('already exists')) {
      return sendJson(res, 409, { error: error.message });
    }
    return sendJson(res, 400, { error: error.message || 'Unable to create affiliate' });
  }
}

async function handleAffiliateLogin(req, res) {
  try {
    const body = await parseJsonBody(req);
    const email = (body.email || '').trim().toLowerCase();
    const password = (body.password || '').trim();
    if (!email || !password) return sendJson(res, 400, { error: 'Email and password are required' });
    const affiliate = await verifyAffiliatePassword(email, password);
    if (!affiliate) return sendJson(res, 401, { error: 'Incorrect credentials' });
    if (!affiliate.emailVerified) {
      return sendJson(res, 403, { error: 'Please verify your email before logging in.', verificationRequired: true });
    }
    const token = startAffiliateSession(res, affiliate.id);
    return sendJson(res, 200, { ok: true, affiliate: summarizeAffiliate(affiliate), token });
  } catch (error) {
    return sendJson(res, 400, { error: error.message || 'Unable to login' });
  }
}

async function handleAffiliateVerifyEmailApi(req, res, url) {
  try {
    const tokenFromQuery = (url && url.searchParams && url.searchParams.get('token')) || '';
    const body = req.method === 'POST' ? await parseJsonBody(req).catch(() => ({})) : {};
    const token = (body.token || tokenFromQuery || '').trim();
    if (!token) return sendJson(res, 400, { error: 'Verification token is required' });

    const affiliate = affiliatesDb.find((a) => a.verificationToken === token);
    if (!affiliate) return sendJson(res, 400, { error: 'Verification link is invalid' });

    if (affiliate.verificationExpiresAt) {
      const expires = new Date(affiliate.verificationExpiresAt).getTime();
      if (Number.isFinite(expires) && expires < Date.now()) {
        return sendJson(res, 400, { error: 'Verification link has expired. Please request a new one.' });
      }
    }

    affiliate.emailVerified = true;
    affiliate.verificationToken = '';
    affiliate.verificationExpiresAt = null;
    await persistAffiliatesDb();
    const tokenValue = startAffiliateSession(res, affiliate.id);
    log('affiliate email verified', { affiliateId: affiliate.id, email: affiliate.email });

    sendJson(res, 200, {
      ok: true,
      affiliate: summarizeAffiliate(affiliate),
      token: tokenValue,
      expiresAt: Date.now() + AFFILIATE_SESSION_TTL_MS,
      message: 'Email verified successfully.',
      redirect: '/affiliate-dashboard',
    });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to verify email' });
  }
}

async function handleAffiliateLogout(_req, res) {
  clearAffiliateSession(res);
  sendJson(res, 200, { ok: true });
}

async function handleAffiliateMe(req, res, url) {
  const auth = requireAffiliateAuth(req, res);
  if (!auth) return;
  const affiliate = auth.affiliate;
  const summary = summarizeAffiliate(affiliate);
  const baseUrl = resolveBaseUrl(req, url);
  const firstLink = (summary.trackingLinks || [])[0];
  const firstCode = firstLink?.code || '';
  const firstPath = firstLink?.targetPath || '/pricing';
  const sampleLink = firstCode ? `${baseUrl}${firstPath}${firstPath.includes('?') ? '&' : '?'}aff=${firstCode}` : `${baseUrl}/pricing`;
  sendJson(res, 200, { ok: true, affiliate: summary, sampleLink });
}

async function handleAffiliateTransactions(req, res) {
  const auth = requireAffiliateAuth(req, res);
  if (!auth) return;
  const affiliate = auth.affiliate;
  const records = Array.isArray(affiliate.earnings) ? affiliate.earnings : [];
  // Sort by date descending
  const sorted = [...records].sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt));
  sendJson(res, 200, { ok: true, transactions: sorted });
}

async function handleInvoicesList(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  const invoices = getInvoicesByUserId(user.id);
  sendJson(res, 200, { ok: true, invoices });
}

async function handleInvoiceDownload(req, res, url, invoiceId) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  const invoice = invoicesDb.find(inv => inv.id === invoiceId);
  if (!invoice) return sendJson(res, 404, { error: 'Invoice not found' });
  if (invoice.userId !== user.id) return sendJson(res, 403, { error: 'Access denied' });

  const pdfPath = path.join(INVOICES_DIR, `${invoiceId}.pdf`);
  try {
    await fs.access(pdfPath);
    const fileStream = fsSync.createReadStream(pdfPath);
    res.setHeader('Content-Type', 'application/pdf');
    res.setHeader('Content-Disposition', `attachment; filename="${invoice.invoiceNumber}.pdf"`);
    fileStream.pipe(res);
  } catch (error) {
    log('Failed to read invoice PDF', { invoiceId, error: String(error) });
    return sendJson(res, 500, { error: 'Failed to download invoice' });
  }
}

async function handleAffiliateCreateLink(req, res) {
  const auth = requireAffiliateAuth(req, res);
  if (!auth) return;
  const affiliate = auth.affiliate;
  const body = await parseJsonBody(req).catch(() => ({}));
  const label = (body.label || body.name || 'New link').toString().trim() || 'New link';
  let targetPath = (body.targetPath || body.path || '/pricing').toString().trim();
  if (!targetPath.startsWith('/')) targetPath = '/' + targetPath;
  
  const code = generateTrackingCode(label);
  affiliate.codes = Array.isArray(affiliate.codes) ? affiliate.codes : [];
  affiliate.codes.push({ code, label, targetPath, createdAt: new Date().toISOString() });
  await persistAffiliatesDb();
  sendJson(res, 201, { ok: true, link: { code, label, targetPath }, links: affiliate.codes });
}

async function handleAffiliateCreateWithdrawal(req, res) {
  const auth = requireAffiliateAuth(req, res);
  if (!auth) return;
  const affiliate = auth.affiliate;
  const body = await parseJsonBody(req).catch(() => ({}));

  const paypalEmail = (body.paypalEmail || '').trim().toLowerCase();
  const currency = (body.currency || 'USD').toUpperCase();
  const amount = Number(body.amount || 0);

  if (!paypalEmail || !paypalEmail.includes('@')) {
    return sendJson(res, 400, { error: 'PayPal email is required' });
  }
  if (!['USD', 'EUR', 'GBP', 'CAD', 'AUD', 'JPY', 'CHF'].includes(currency)) {
    return sendJson(res, 400, { error: 'Invalid currency' });
  }
  if (amount <= 0) {
    return sendJson(res, 400, { error: 'Amount must be greater than 0' });
  }

  const earnings = Array.isArray(affiliate.earnings) ? affiliate.earnings : [];
  const totalEarnings = earnings.reduce((sum, e) => sum + Number(e.amount || 0), 0);
  if (amount > totalEarnings) {
    return sendJson(res, 400, { error: 'Amount exceeds available balance' });
  }

  const withdrawal = {
    id: randomUUID(),
    affiliateId: affiliate.id,
    affiliateEmail: affiliate.email,
    paypalEmail,
    currency,
    amount,
    status: 'pending',
    createdAt: new Date().toISOString(),
    processedAt: null,
  };

  withdrawalsDb.push(withdrawal);
  await persistWithdrawalsDb();
  sendJson(res, 201, { ok: true, withdrawal });
}

async function handleAdminWithdrawalsList(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;

  const sorted = [...withdrawalsDb].sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt));
  sendJson(res, 200, { withdrawals: sorted });
}

async function handleAdminWithdrawalUpdate(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;

  const body = await parseJsonBody(req).catch(() => ({}));
  const withdrawalId = body.withdrawalId;
  const newStatus = body.status;

  if (!withdrawalId) {
    return sendJson(res, 400, { error: 'Withdrawal ID is required' });
  }
  if (!['pending', 'done'].includes(newStatus)) {
    return sendJson(res, 400, { error: 'Invalid status' });
  }

  const withdrawal = withdrawalsDb.find(w => w.id === withdrawalId);
  if (!withdrawal) {
    return sendJson(res, 404, { error: 'Withdrawal not found' });
  }

  withdrawal.status = newStatus;
  if (newStatus === 'done') {
    withdrawal.processedAt = new Date().toISOString();
  }

  await persistWithdrawalsDb();
  sendJson(res, 200, { ok: true, withdrawal });
}

async function handleFeatureRequestsList(req, res) {
  const session = getUserSession(req);
  const userId = session?.userId || '';
  const userEmail = userId ? (findUserById(userId)?.email || '') : '';

  const sorted = [...featureRequestsDb].sort((a, b) => {
    if (b.votes !== a.votes) return b.votes - a.votes;
    return new Date(b.createdAt) - new Date(a.createdAt);
  });

  const result = sorted.map(fr => ({
    id: fr.id,
    title: fr.title,
    description: fr.description,
    votes: fr.votes,
    createdAt: fr.createdAt,
    authorEmail: fr.authorEmail,
    hasVoted: userId ? fr.upvoters.includes(userId) : false,
  }));

  sendJson(res, 200, { featureRequests: result });
}

async function handleFeatureRequestCreate(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  try {
    const body = await parseJsonBody(req);
    const title = (body.title || '').toString().trim();
    const description = (body.description || '').toString().trim();

    if (!title || title.length < 3) {
      return sendJson(res, 400, { error: 'Title must be at least 3 characters' });
    }
    if (!description || description.length < 10) {
      return sendJson(res, 400, { error: 'Description must be at least 10 characters' });
    }

    const featureRequest = {
      id: randomUUID(),
      title,
      description,
      votes: 1,
      upvoters: [session.userId],
      authorEmail: user.email || '',
      authorId: session.userId,
      createdAt: new Date().toISOString(),
    };

    featureRequestsDb.push(featureRequest);
    await persistFeatureRequestsDb();

    log('Feature request created', { id: featureRequest.id, title, userId: session.userId });
    sendJson(res, 201, {
      ok: true,
      featureRequest: {
        id: featureRequest.id,
        title: featureRequest.title,
        description: featureRequest.description,
        votes: featureRequest.votes,
        createdAt: featureRequest.createdAt,
        authorEmail: featureRequest.authorEmail,
        hasVoted: true,
      }
    });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to create feature request' });
  }
}

async function handleFeatureRequestUpvote(req, res, id) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const featureRequest = featureRequestsDb.find(fr => fr.id === id);
  if (!featureRequest) return sendJson(res, 404, { error: 'Feature request not found' });

  const userId = session.userId;
  const hasUpvoted = featureRequest.upvoters.includes(userId);

  if (hasUpvoted) {
    featureRequest.upvoters = featureRequest.upvoters.filter(uid => uid !== userId);
    featureRequest.votes = Math.max(0, featureRequest.votes - 1);
  } else {
    featureRequest.upvoters.push(userId);
    featureRequest.votes = (featureRequest.votes || 0) + 1;
  }

  await persistFeatureRequestsDb();

  sendJson(res, 200, {
    ok: true,
    votes: featureRequest.votes,
    hasVoted: !hasUpvoted,
  });
}

async function handleContactMessagesList(req, res) {
  const session = getUserSession(req);
  const userId = session?.userId || '';
  const isAdmin = session?.isAdmin || false;

  if (!isAdmin) {
    return sendJson(res, 403, { error: 'Admin access required' });
  }

  const sorted = [...contactMessagesDb].sort((a, b) => {
    return new Date(b.createdAt) - new Date(a.createdAt);
  });

  const result = sorted.map(msg => ({
    id: msg.id,
    name: msg.name,
    email: msg.email,
    subject: msg.subject,
    message: msg.message,
    createdAt: msg.createdAt,
    read: msg.read || false,
  }));

  sendJson(res, 200, { messages: result });
}

async function handleContactMessageCreate(req, res) {
  try {
    const body = await parseJsonBody(req);
    const name = (body.name || '').toString().trim();
    const email = (body.email || '').toString().trim();
    const subject = (body.subject || '').toString().trim();
    const message = (body.message || '').toString().trim();

    if (!name || name.length < 2) {
      return sendJson(res, 400, { error: 'Name must be at least 2 characters' });
    }
    if (!email || !EMAIL_REGEX.test(email)) {
      return sendJson(res, 400, { error: 'Please provide a valid email address' });
    }
    if (!subject || subject.length < 3) {
      return sendJson(res, 400, { error: 'Subject must be at least 3 characters' });
    }
    if (!message || message.length < 10) {
      return sendJson(res, 400, { error: 'Message must be at least 10 characters' });
    }

    const contactMessage = {
      id: randomUUID(),
      name,
      email,
      subject,
      message,
      read: false,
      createdAt: new Date().toISOString(),
      ip: req.socket?.remoteAddress || '',
    };

    contactMessagesDb.push(contactMessage);
    await persistContactMessagesDb();

    log('Contact message received', { id: contactMessage.id, email });
    sendJson(res, 201, { ok: true, id: contactMessage.id });
  } catch (error) {
    log('Contact form error', { error: String(error) });
    sendJson(res, 400, { error: error.message || 'Unable to process your message' });
  }
}

async function handleContactMessageMarkRead(req, res, id) {
  const session = getUserSession(req);
  const isAdmin = session?.isAdmin || false;

  if (!isAdmin) {
    return sendJson(res, 403, { error: 'Admin access required' });
  }

  const message = contactMessagesDb.find(msg => msg.id === id);
  if (!message) return sendJson(res, 404, { error: 'Message not found' });

  message.read = true;
  await persistContactMessagesDb();

  sendJson(res, 200, { ok: true });
}

async function handleContactMessageDelete(req, res, id) {
  const session = getUserSession(req);
  const isAdmin = session?.isAdmin || false;

  if (!isAdmin) {
    return sendJson(res, 403, { error: 'Admin access required' });
  }

  const index = contactMessagesDb.findIndex(msg => msg.id === id);
  if (index === -1) return sendJson(res, 404, { error: 'Message not found' });

  contactMessagesDb.splice(index, 1);
  await persistContactMessagesDb();

  sendJson(res, 200, { ok: true });
}

async function handleUserLogout(req, res) {
  const session = getUserSession(req);
  if (session) {
    // Track user logout and session end
    trackUserSession(session.userId, 'logout', { sessionDuration: session.expiresAt - Date.now() });
    userSessions.delete(session.token);
    persistUserSessions().catch(() => {});
  }
  clearUserSession(res);
  sendJson(res, 200, { ok: true });
}

async function handleUserMe(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const user = findUserById(session.userId);
  if (!user) {
    return sendJson(res, 404, { error: 'User not found' });
  }

  // Generate CSRF token for state-changing operations
  const csrfToken = generateCsrfToken(user.id);

  sendJson(res, 200, {
    ok: true,
    user: { id: user.id, email: user.email, createdAt: user.createdAt, lastLoginAt: user.lastLoginAt, plan: user.plan },
    expiresAt: session.expiresAt,
    csrfToken
  });
}

// CSRF token refresh endpoint
async function handleCsrfToken(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const csrfToken = generateCsrfToken(session.userId);
  sendJson(res, 200, { csrfToken });
}

// Validate CSRF token middleware for state-changing endpoints
function validateCsrfMiddleware(req, res, userId, body = null) {
  const csrfToken = req.headers['x-csrf-token'] || body?.csrfToken;
  if (!csrfToken || !validateCsrfToken(csrfToken, userId)) {
    log('csrf validation failed', { userId, path: req.url });
    return sendJson(res, 403, { error: 'Invalid CSRF token' });
  }
  return null; // Valid
}

async function handleAccountSettingsGet(req, res, url) {
  // Use requireUserId to support both session cookie and X-User-Id header
  // This matches the pattern used by /api/sessions for consistency
  const userId = requireUserId(req, res, url);
  if (!userId) return;

  const user = findUserById(userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  return sendJson(res, 200, { ok: true, account: await serializeAccount(user) });
}

async function handleAccountUsage(req, res) {
  // Prefer authenticated user-session. If absent, fall back to legacy identity (chat_user cookie / X-User-Id)
  // so the builder usage meter still updates for legacy clients.
  const authed = getUserSession(req);
  const resolvedUserId = authed?.userId || resolveUserId(req);
  if (!resolvedUserId) {
    return sendJson(res, 401, { error: 'User identity required' });
  }
  const user = findUserById(resolvedUserId);
  const plan = user?.plan || DEFAULT_PLAN;
  const summary = getTokenUsageSummary(resolvedUserId, plan);
  const payg = PAYG_ENABLED && isPaidPlan(plan) && !user?.unlimitedUsage
    ? computePaygSummary(resolvedUserId, plan)
    : null;
  return sendJson(res, 200, { ok: true, summary, payg, legacy: !authed });
}

async function handleAccountPlans(_req, res) {
  sendJson(res, 200, { plans: USER_PLANS, defaultPlan: DEFAULT_PLAN });
}

async function handleProviderLimitsGet(_req, res) {
  try {
    sendJson(res, 200, {
      opencodeBackupModel: providerLimits.opencodeBackupModel || '',
      limits: providerLimits.limits || {}
    });
  } catch (error) {
    sendJson(res, 500, { error: error.message || 'Unable to load provider limits' });
  }
}

async function handleAccountSettingsUpdate(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  const previousPlan = user.plan;

  const body = await parseJsonBody(req).catch(() => ({}));

  // Validate CSRF token
  const csrfError = validateCsrfMiddleware(req, res, session.userId, body);
  if (csrfError) return;

  let updated = false;

  if (!user.referredByAffiliateCode) {
    const cookieCode = sanitizeAffiliateCode(readAffiliateReferralCode(req));
    if (cookieCode && findAffiliateByCode(cookieCode)) {
      user.referredByAffiliateCode = cookieCode;
      user.affiliateAttributionAt = new Date().toISOString();
      updated = true;
    }
  }

  const requestedPlan = normalizePlanSelection(body.plan || body.newPlan);
  const requestedBillingCycle = String(body.billingCycle || '').toLowerCase();
  const requestedCurrency = String(body.currency || '').toLowerCase();

  // Handle plan changes with Dodo subscription management
  if (requestedPlan && requestedPlan !== user.plan) {
    const isPaidToFree = PAID_PLANS.has(user.plan) && requestedPlan === 'hobby';
    const isPaidToPaid = PAID_PLANS.has(user.plan) && PAID_PLANS.has(requestedPlan);

    // Cancel Dodo subscription when changing from paid to free hobby plan
    if (isPaidToFree && user.dodoSubscriptionId) {
      await cancelDodoSubscription(user, 'paid_to_free', { clearOnFailure: true });
      user.plan = requestedPlan;
      user.billingStatus = DEFAULT_BILLING_STATUS;
      user.subscriptionRenewsAt = null;
      user.billingCycle = null;
      user.subscriptionCurrency = null;
      updated = true;
    }
    // For paid-to-paid changes, use Dodo's Change Plan API if subscription exists
    else if (isPaidToPaid && user.dodoSubscriptionId) {
      try {
        // Ensure we have valid billing cycle and currency
        const targetBillingCycle = requestedBillingCycle || user.billingCycle || 'monthly';
        const targetCurrency = requestedCurrency || user.subscriptionCurrency || 'usd';
        
        // Call Dodo's Change Plan API
        await changeDodoSubscriptionPlan(user, requestedPlan, targetBillingCycle, targetCurrency);
        
        // Update user record after successful plan change
        user.plan = requestedPlan;
        user.billingCycle = targetBillingCycle;
        user.subscriptionCurrency = targetCurrency;
        user.billingStatus = DEFAULT_BILLING_STATUS;
        user.subscriptionRenewsAt = computeRenewalDate(targetBillingCycle);
        updated = true;
      } catch (error) {
        log('Failed to change plan via Dodo API', { userId: user.id, error: String(error) });
        return sendJson(res, 400, { error: error.message || 'Unable to change subscription plan' });
      }
    }
    // For free-to-paid or when no subscription exists, redirect to checkout
    else if (!user.dodoSubscriptionId && PAID_PLANS.has(requestedPlan)) {
      return sendJson(res, 400, { 
        error: 'Please use the checkout flow to subscribe to a paid plan',
        requiresCheckout: true 
      });
    }
    // Simple plan update for free plans or special cases
    else {
      user.plan = requestedPlan;
      user.billingStatus = DEFAULT_BILLING_STATUS;
      
      // Only set renewal date for paid plans
      if (requestedPlan === 'hobby') {
        user.subscriptionRenewsAt = null;
        user.billingCycle = null;
        user.subscriptionCurrency = null;
      } else {
        user.subscriptionRenewsAt = computeRenewalDate(requestedBillingCycle === 'yearly' ? 'yearly' : 'monthly');
      }
      
      updated = true;
    }
  }

  // Handle currency updates
  if (requestedCurrency && SUPPORTED_CURRENCIES.includes(requestedCurrency)) {
    user.subscriptionCurrency = requestedCurrency;
    user.currency = requestedCurrency;
    updated = true;
  }

  // Handle billing cycle updates (separate from plan change)
  if (requestedBillingCycle && BILLING_CYCLES.includes(requestedBillingCycle) && !requestedPlan) {
    user.billingCycle = requestedBillingCycle;
    if (user.plan !== 'hobby') {
      user.subscriptionRenewsAt = computeRenewalDate(requestedBillingCycle);
    }
    updated = true;
  }

  if (typeof body.billingEmail === 'string' && body.billingEmail.trim()) {
    const nextEmail = body.billingEmail.trim().toLowerCase();
    if (!EMAIL_REGEX.test(nextEmail)) {
      return sendJson(res, 400, { error: 'Billing email is invalid' });
    }
    user.billingEmail = nextEmail;
    updated = true;
  }

  if (typeof body.unlimitedUsage === 'boolean') {
    user.unlimitedUsage = body.unlimitedUsage;
    updated = true;
  }

  const action = (body.action || '').toString().toLowerCase();
  if (action === 'cancel') {
    // Cancel Dodo subscription when user explicitly cancels
    if (user.dodoSubscriptionId && PAID_PLANS.has(user.plan)) {
      await cancelDodoSubscription(user, 'manual_cancel', { clearOnFailure: true });
    }
    user.billingStatus = 'canceled';
    user.subscriptionRenewsAt = null;
    updated = true;
  } else if (action === 'resume') {
    user.billingStatus = DEFAULT_BILLING_STATUS;
    if (!user.subscriptionRenewsAt && user.plan !== 'hobby') {
      user.subscriptionRenewsAt = computeRenewalDate(body.billingCycle === 'yearly' ? 'yearly' : 'monthly');
    }
    updated = true;
  }

  if (updated) {
    const normalizedPlan = normalizePlanSelection(user.plan);
    const previousNormalized = normalizePlanSelection(previousPlan);
    if (PAID_PLANS.has(normalizedPlan) && previousNormalized !== normalizedPlan) {
      await trackAffiliateCommission(user, normalizedPlan);
    }
    await persistUsersDb();
  }

  return sendJson(res, 200, { ok: true, account: await serializeAccount(user) });
}

async function handleOnboardingGet(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  sendJson(res, 200, { ok: true, completed: !!user.onboardingCompleted });
}

async function handleOnboardingPost(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  const body = await parseJsonBody(req).catch(() => ({}));
  const completed = !!body?.completed;

  if (user.onboardingCompleted !== completed) {
    user.onboardingCompleted = completed;
    await persistUsersDb();
  }

  sendJson(res, 200, { ok: true, completed });
}

async function handlePaymentMethodsList(req, res, url) {
  const userId = requireUserId(req, res, url);
  if (!userId) return;

  const user = findUserById(userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  if (!DODO_ENABLED) {
    return sendJson(res, 200, { paymentMethods: [] });
  }

  try {
    let customerId = user.dodoCustomerId;
    if (!customerId) {
      const customers = await dodoRequest('/customers', {
        method: 'POST',
        body: {
          email: user.billingEmail || user.email,
          name: user.email.split('@')[0],
          metadata: { userId: String(user.id) },
        },
      });
      customerId = customers?.customer_id || customers?.id;
      if (customerId) {
        user.dodoCustomerId = customerId;
        await persistUsersDb();
      }
    }

    if (!customerId) {
      return sendJson(res, 200, { paymentMethods: [] });
    }

    const response = await dodoRequest(`/customers/${customerId}/payment-methods`, { method: 'GET' });
    const paymentMethods = Array.isArray(response) ? response : response?.items || [];

    const serializedMethods = paymentMethods.map((pm, index) => {
      const card = pm.card || {};
      return {
        id: pm.payment_method_id,
        brand: card.brand || pm.payment_method || 'Card',
        last4: card.last4 || card.last_digits || '',
        expiresAt: card.expiry || card.expires_at || '',
        isDefault: index === 0,
      };
    });

    return sendJson(res, 200, { paymentMethods: serializedMethods });
  } catch (err) {
    console.error('[PaymentMethods] List error:', err.message);
    return sendJson(res, 200, { paymentMethods: [] });
  }
}

async function handlePaymentMethodCreate(req, res) {
  const userId = requireUserId(req, res, new URL(req.url, `http://${req.headers.host}`));
  if (!userId) return;

  const user = findUserById(userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  if (!DODO_ENABLED) {
    return sendJson(res, 503, { error: 'Dodo Payments is not configured' });
  }

  try {
    let customerId = user.dodoCustomerId;
    if (!customerId) {
      const customers = await dodoRequest('/customers', {
        method: 'POST',
        body: {
          email: user.billingEmail || user.email,
          name: user.email.split('@')[0],
          metadata: { userId: String(user.id) },
        },
      });
      customerId = customers?.customer_id || customers?.id;
      if (customerId) {
        user.dodoCustomerId = customerId;
        await persistUsersDb();
      }
    }

    if (!customerId) {
      return sendJson(res, 500, { error: 'Unable to create customer' });
    }

    const returnUrl = `${resolveBaseUrl(req)}/settings?payment_method_added=1`;

    const portalSession = await dodoRequest(`/customers/${customerId}/customer-portal/session`, {
      method: 'POST',
    });

    const portalUrl = portalSession?.link || portalSession?.url;
    if (!portalUrl) {
      return sendJson(res, 500, { error: 'Unable to create customer portal session' });
    }

    // The frontend expects a checkoutUrl or url field. Return all common keys so
    // clients (existing and future) can open the portal to add/save cards without purchasing.
    return sendJson(res, 200, { portalUrl, checkoutUrl: portalUrl, url: portalUrl });
  } catch (err) {
    console.error('[PaymentMethod] Create error:', err.message);
    return sendJson(res, 500, { error: 'Unable to create customer portal session' });
  }
}

async function handleAccountBalanceAdd(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  const body = await parseJsonBody(req);
  const amount = Number(body?.amount);
  const currency = String(body?.currency || user.currency || 'usd').toLowerCase();

  if (!Number.isFinite(amount) || amount < MIN_PAYMENT_AMOUNT) {
    return sendJson(res, 400, { error: `Minimum amount is $${(MIN_PAYMENT_AMOUNT / 100).toFixed(2)}` });
  }

  if (!DODO_ENABLED) {
    return sendJson(res, 503, { error: 'Dodo Payments is not configured' });
  }

  try {
    let customerId = user.dodoCustomerId;
    if (!customerId) {
      const customers = await dodoRequest('/customers', {
        method: 'POST',
        body: {
          email: user.billingEmail || user.email,
          name: user.email.split('@')[0],
          metadata: { userId: String(user.id) },
        },
      });
      customerId = customers?.customer_id || customers?.id;
      if (customerId) {
        user.dodoCustomerId = customerId;
        await persistUsersDb();
      }
    }

    if (!customerId) {
      return sendJson(res, 500, { error: 'Unable to create customer' });
    }

    const returnUrl = `${resolveBaseUrl(req)}/settings?balance_added=1`;

    const sessionId = `balance_${randomUUID()}`;

    pendingSubscriptions[sessionId] = {
      userId: user.id,
      amount,
      currency,
      type: 'balance_add',
      createdAt: Date.now(),
    };

    await persistPendingSubscriptions();

    const productConfigured = Boolean(TOPUP_PRODUCT_IDS[`topup_1_${currency}`]);

    const checkoutSession = await dodoRequest('/checkout/sessions', {
      method: 'POST',
      body: {
        customer_id: customerId,
        success_url: returnUrl,
        cancel_url: returnUrl,
        mode: 'payment',
        payment_method_types: ['card'],
        line_items: [
          {
            amount: amount,
            currency: currency.toUpperCase(),
            quantity: 1,
            name: `Add Funds - ${currency.toUpperCase()}${(amount / 100).toFixed(2)}`,
            description: `Add funds to account balance`,
            metadata: {
              userId: String(user.id),
              sessionId,
              type: 'balance_add',
            },
          },
        ],
      },
    });

    const checkoutUrl = checkoutSession?.checkout_url || checkoutSession?.url;
    if (!checkoutUrl) {
      return sendJson(res, 500, { error: 'Unable to create checkout session' });
    }

    return sendJson(res, 200, { checkoutUrl, sessionId });
  } catch (err) {
    console.error('[Balance] Add error:', err.message);
    return sendJson(res, 500, { error: 'Unable to create checkout' });
  }
}

async function handlePaymentMethodSetDefault(req, res, methodId) {
  const userId = requireUserId(req, res, new URL(req.url, `http://${req.headers.host}`));
  if (!userId) return;

  const user = findUserById(userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  if (!DODO_ENABLED) {
    return sendJson(res, 503, { error: 'Dodo Payments is not configured' });
  }

  try {
    let customerId = user.dodoCustomerId;
    if (!customerId) {
      return sendJson(res, 400, { error: 'Customer not found. Please add a payment method first.' });
    }

    const returnUrl = `${resolveBaseUrl(req)}/settings`;

    const portalSession = await dodoRequest(`/customers/${customerId}/customer-portal/session`, {
      method: 'POST',
    });

    const portalUrl = portalSession?.link || portalSession?.url;
    if (!portalUrl) {
      return sendJson(res, 500, { error: 'Unable to create customer portal session' });
    }

    return sendJson(res, 200, { portalUrl, message: 'Please manage payment methods through the customer portal' });
  } catch (err) {
    console.error('[PaymentMethod] Set default error:', err.message);
    return sendJson(res, 500, { error: 'Unable to update payment method. Please try again.' });
  }
}

async function handlePaymentMethodDelete(req, res, methodId) {
  const userId = requireUserId(req, res, new URL(req.url, `http://${req.headers.host}`));
  if (!userId) return;

  const user = findUserById(userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  if (!DODO_ENABLED) {
    return sendJson(res, 503, { error: 'Dodo Payments is not configured' });
  }

  try {
    let customerId = user.dodoCustomerId;
    if (!customerId) {
      return sendJson(res, 400, { error: 'Customer not found. Please add a payment method first.' });
    }

    const returnUrl = `${resolveBaseUrl(req)}/settings`;

    const portalSession = await dodoRequest(`/customers/${customerId}/customer-portal/session`, {
      method: 'POST',
    });

    const portalUrl = portalSession?.link || portalSession?.url;
    if (!portalUrl) {
      return sendJson(res, 500, { error: 'Unable to create customer portal session' });
    }

    return sendJson(res, 200, { portalUrl, message: 'Please manage payment methods through the customer portal' });
  } catch (err) {
    console.error('[PaymentMethod] Delete error:', err.message);
    return sendJson(res, 500, { error: 'Unable to delete payment method. Please try again.' });
  }
}

async function fetchTopupProduct(tier, currency = 'usd') {
  const pack = resolveTopupPack(tier, currency);
  if (!pack.productId) throw new Error('Top-up product is not configured');
  const product = await getDodoProductById(pack.productId);
  if (!product) throw new Error('Top-up product is unavailable');
  const baseAmount = getTopupPrice(pack.tier, pack.currency);
  if (!Number.isFinite(baseAmount) || baseAmount <= 0) throw new Error('Top-up price amount is invalid');
  return { pack, product, baseAmount, currency: pack.currency };
}

async function handleTopupOptions(req, res, userId) {
  try {
    const user = findUserById(userId);
    if (!user) return sendJson(res, 404, { error: 'User not found' });
    if (!DODO_ENABLED) {
      return sendJson(res, 503, { error: 'Dodo Payments is not configured' });
    }
    const discount = computeTopupDiscount(user.plan);
    const tiers = ['topup_1', 'topup_2', 'topup_3', 'topup_4'];
    const currencies = ['usd', 'gbp', 'eur'];
    const options = [];
    for (const tier of tiers) {
      for (const currency of currencies) {
        try {
          const pack = resolveTopupPack(tier, currency);
          if (!pack.productId || !pack.tokens) continue;
          const baseAmount = getTopupPrice(tier, currency);
          if (!baseAmount || baseAmount <= 0) continue;
          const finalAmount = applyTopupDiscount(baseAmount, discount);
          options.push({
            tier: pack.tier,
            currency: pack.currency,
            tokens: pack.tokens,
            productId: pack.productId,
            baseAmount,
            finalAmount,
            discountRate: discount,
          });
        } catch (packErr) {
          // Log per-pack errors but continue building remaining options
          log('topup options pack error', { tier, currency, error: String(packErr), stack: packErr.stack });
        }
      }
    }
    if (!options.length) return sendJson(res, 503, { error: 'Top-up products are not configured' });
    return sendJson(res, 200, { options, discount, discountRate: discount });
  } catch (error) {
    log('topup options failed', { error: String(error), stack: error.stack });
    return sendJson(res, 500, { error: error.message || 'Unable to fetch top-up options' });
  }
}

async function handleTopupCheckout(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  try {
    const body = await parseJsonBody(req).catch(() => ({}));
    const tier = body?.tier || 'topup_1';
    const currency = body?.currency || 'usd';
    const isInline = Boolean(body.inline);
    const { pack, baseAmount } = await fetchTopupProduct(tier, currency);
    if (!pack.tokens) throw new Error('Top-up tokens are not configured');
    const discount = computeTopupDiscount(user.plan);
    const unitAmount = applyTopupDiscount(baseAmount, discount);
    const returnUrl = `${resolveBaseUrl(req)}/topup`;
    const orderId = `topup_${randomUUID()}`;
    const checkoutBody = {
      product_cart: [{
        product_id: pack.productId,
        quantity: 1,
        amount: unitAmount,
      }],
      customer: {
        email: user.billingEmail || user.email,
        name: user.billingEmail || user.email,
      },
      metadata: {
        type: 'topup',
        orderId,
        userId: String(user.id),
        tokens: String(pack.tokens),
        tier: String(pack.tier),
        currency: String(pack.currency),
        amount: String(unitAmount),
        discountRate: String(discount),
        inline: String(isInline),
      },
      settings: {
        redirect_immediately: false,
      },
      return_url: returnUrl,
    };
    const checkoutSession = await dodoRequest('/checkouts', {
      method: 'POST',
      body: checkoutBody,
    });
    const sessionId = checkoutSession?.session_id || checkoutSession?.id || '';
    if (!sessionId || !checkoutSession?.checkout_url) {
      throw new Error('Dodo checkout session was not created');
    }
    pendingTopups[sessionId] = {
      userId: user.id,
      orderId,
      tokens: pack.tokens,
      tier: pack.tier,
      currency: pack.currency,
      amount: unitAmount,
      productId: pack.productId,
      createdAt: new Date().toISOString(),
      inline: isInline,
    };
    await persistPendingTopups();

    const response = {
      sessionId,
      amount: unitAmount,
      currency,
      tokens: pack.tokens,
    };

    if (isInline) {
      response.inlineCheckoutUrl = checkoutSession.checkout_url;
      response.checkoutUrl = checkoutSession.checkout_url;
    } else {
      response.url = checkoutSession.checkout_url;
      response.checkoutUrl = checkoutSession.checkout_url;
    }

    return sendJson(res, 200, response);
  } catch (error) {
    log('top-up checkout failed', { error: String(error), userId: user?.id });
    const status = /configured/i.test(String(error?.message || '')) ? 503 : 400;
    return sendJson(res, status, { error: error.message || 'Unable to start checkout' });
  }
}

function isDodoPaymentComplete(status) {
  const normalized = String(status || '').toLowerCase();
  return ['paid', 'succeeded', 'success', 'completed', 'complete'].includes(normalized);
}

async function handleTopupConfirm(req, res, url) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  const sessionId = (url && url.searchParams && (url.searchParams.get('session_id') || url.searchParams.get('checkout_id') || url.searchParams.get('session'))) || '';
  if (!sessionId) return sendJson(res, 400, { error: 'session_id is required' });

  const existing = processedTopups[sessionId];
  if (existing) {
    if (existing.userId !== user.id) return sendJson(res, 403, { error: 'This top-up belongs to another user' });

    try {
      await createInvoiceIfMissing(user, 'topup', {
        tokens: existing.tokens,
        amount: existing.amount,
        currency: existing.currency,
        tier: existing.tier,
        source: {
          provider: 'dodo',
          checkoutId: sessionId,
          orderId: existing.orderId,
          paymentId: existing.paymentId,
        },
      });
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, error: String(invoiceError) });
    }

    return sendJson(res, 200, { ok: true, alreadyApplied: true, tokensAdded: existing.tokens, summary: getTokenUsageSummary(user.id, user.plan || DEFAULT_PLAN) });
  }

  const pending = pendingTopups[sessionId];
  if (pending && pending.userId !== user.id) {
    return sendJson(res, 403, { error: 'This top-up belongs to another user' });
  }

  try {
    const checkout = await dodoRequest(`/checkouts/${sessionId}`, { method: 'GET' });
    const paid = isDodoPaymentComplete(checkout?.payment_status || checkout?.status);
    if (!paid) {
      return sendJson(res, 200, { ok: false, pending: true, paymentStatus: checkout?.payment_status || checkout?.status || 'unpaid' });
    }
    const tokens = Number(pending?.tokens || checkout?.metadata?.tokens || 0);
    if (!tokens) return sendJson(res, 400, { error: 'Top-up tokens missing' });

    const orderId = pending?.orderId || checkout?.metadata?.orderId || '';
    const tier = pending?.tier || checkout?.metadata?.tier || '';
    const currency = String(pending?.currency || checkout?.metadata?.currency || checkout?.currency || '').toLowerCase() || null;

    const amountCandidate = pending?.amount !== undefined && pending?.amount !== null
      ? Number(pending.amount)
      : Number(checkout?.metadata?.amount || checkout?.amount || checkout?.amount_total || checkout?.total_amount || 0);
    const amount = Number.isFinite(amountCandidate) ? Math.max(0, Math.round(amountCandidate)) : null;

    const paymentId = checkout?.payment_id || checkout?.paymentId || checkout?.charge_id || checkout?.chargeId || '';

    const bucket = ensureTokenUsageBucket(user.id);
    bucket.addOns = Math.max(0, Number(bucket.addOns || 0) + tokens);
    await persistTokenUsage();

    processedTopups[sessionId] = {
      userId: user.id,
      orderId: orderId || null,
      paymentId: paymentId || null,
      tokens,
      tier: tier || null,
      amount,
      currency,
      completedAt: new Date().toISOString(),
    };
    delete pendingTopups[sessionId];
    await Promise.all([persistTopupSessions(), persistPendingTopups()]);

    await sendPaymentConfirmationEmail(user, 'topup', {
      tokens,
      amount,
      currency,
    });

    try {
      await createInvoiceIfMissing(user, 'topup', {
        tokens,
        amount,
        currency,
        tier,
        source: {
          provider: 'dodo',
          checkoutId: sessionId,
          orderId,
          paymentId,
        },
      });
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, error: String(invoiceError) });
    }

    return sendJson(res, 200, { ok: true, tokensAdded: tokens, summary: getTokenUsageSummary(user.id, user.plan || DEFAULT_PLAN) });
  } catch (error) {
    log('top-up confirmation failed', { error: String(error), userId: user?.id, sessionId });
    return sendJson(res, 400, { error: error.message || 'Unable to confirm payment' });
  }

// -------------------------
// Admin test endpoints for Dodo top-ups
// -------------------------
async function handleAdminTopupOptions(req, res) {
  try {
    if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });
    const discount = 0; // admin tests run without user plan discount
    const tiers = ['topup_1', 'topup_2', 'topup_3', 'topup_4'];
    const currencies = ['usd', 'gbp', 'eur'];
    const options = [];

    // Quick debug log to surface configuration state when this endpoint is called
    try {
      const productKeys = TOPUP_PRODUCT_IDS && typeof TOPUP_PRODUCT_IDS === 'object' ? Object.keys(TOPUP_PRODUCT_IDS) : [];
      log('admin topup options debug start', {
        DODO_ENABLED,
        productKeysCount: productKeys.length,
        productKeySample: productKeys.slice(0, 6),
        topupTokensKeys: Object.keys(TOPUP_TOKENS || {}).slice(0, 6),
        topupPricesKeys: Object.keys(TOPUP_PRICES || {}).slice(0, 6),
      });
    } catch (dbgErr) {
      log('admin topup options debug logging failed', { dbgErr: String(dbgErr) });
    }

    // Build options similarly to the user-facing flow. Allow missing TOPUP_PRODUCT_IDS but log a warning so
    // admins can still use the test page in environments where product IDs may not be pre-populated.
    if (!TOPUP_PRODUCT_IDS || typeof TOPUP_PRODUCT_IDS !== 'object') {
      log('admin topup options warning', { reason: 'TOPUP_PRODUCT_IDS missing or invalid - attempting to build options from fallback data' });
    }

    for (const tier of tiers) {
      for (const currency of currencies) {
        try {
          const pack = resolveTopupPack(tier, currency);
          if (!pack || !pack.productId || !pack.tokens) {
            log('admin topup options skip pack', { tier, currency, pack });
            continue;
          }

          const baseAmount = getTopupPrice(tier, currency);
          if (!baseAmount || baseAmount <= 0) {
            log('admin topup options skip price', { tier, currency, baseAmount });
            continue;
          }

          const finalAmount = applyTopupDiscount(baseAmount, discount);
          options.push({
            tier: pack.tier,
            currency: pack.currency,
            tokens: pack.tokens,
            productId: pack.productId,
            baseAmount,
            finalAmount,
            discountRate: discount,
          });
        } catch (packErr) {
          // Log per-pack errors but continue building remaining options
          log('admin topup options pack error', { tier, currency, error: String(packErr), stack: packErr.stack });
        }
      }
    }

    if (!options.length) {
      log('admin topup options none found', { TOPUP_PRODUCT_IDS: Object.keys(TOPUP_PRODUCT_IDS || {}).slice(0, 10) });
      return sendJson(res, 503, { error: 'Top-up products are not configured' });
    }

    log('admin topup options success', { optionsCount: options.length });
    return sendJson(res, 200, { options, discount, discountRate: discount });
  } catch (error) {
    log('admin topup options failed', { error: String(error), stack: error.stack });
    return sendJson(res, 500, { error: error.message || 'Unable to fetch admin top-up options' });
  }
}

async function handleAdminTopupCheckout(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  try {
    const body = await parseJsonBody(req).catch(() => ({}));
    const tier = body?.tier || 'topup_1';
    const currency = (body?.currency || 'usd').toLowerCase();
    const isInline = Boolean(body.inline);
    const customer = body.customer || {};

    const { pack, baseAmount } = await fetchTopupProduct(tier, currency);
    if (!pack.tokens) throw new Error('Top-up tokens are not configured');
    const unitAmount = applyTopupDiscount(baseAmount, 0);
    const returnUrl = `${resolveBaseUrl(req)}/test-checkout`;
    const orderId = `admin_test_topup_${randomUUID()}`;

    const checkoutBody = {
      product_cart: [{
        product_id: pack.productId,
        quantity: 1,
        amount: unitAmount,
      }],
      customer: {
        email: (customer.email || ADMIN_USER || 'admin@example.com'),
        name: (customer.name || ADMIN_USER || 'Admin'),
      },
      metadata: {
        type: 'admin_test_topup',
        orderId,
        admin: 'true',
        adminToken: session.token || '',
        tokens: String(pack.tokens),
        tier: String(pack.tier),
        currency: String(pack.currency),
        amount: String(unitAmount),
      },
      settings: {
        redirect_immediately: false,
      },
      return_url: returnUrl,
    };

    const checkoutSession = await dodoRequest('/checkouts', {
      method: 'POST',
      body: checkoutBody,
    });

    const sessionId = checkoutSession?.session_id || checkoutSession?.id || '';
    if (!sessionId || !checkoutSession?.checkout_url) {
      throw new Error('Dodo checkout session was not created');
    }

    pendingTopups[sessionId] = {
      userId: null,
      admin: true,
      adminToken: session.token,
      orderId,
      tokens: pack.tokens,
      tier: pack.tier,
      currency: pack.currency,
      amount: unitAmount,
      productId: pack.productId,
      createdAt: new Date().toISOString(),
      inline: isInline,
    };

    await persistPendingTopups();

    const response = {
      sessionId,
      amount: unitAmount,
      currency,
      tokens: pack.tokens,
    };

    if (isInline) {
      response.inlineCheckoutUrl = checkoutSession.checkout_url;
      response.checkoutUrl = checkoutSession.checkout_url;
    } else {
      response.checkoutUrl = checkoutSession.checkout_url;
      response.url = checkoutSession.checkout_url;
    }

    return sendJson(res, 200, response);
  } catch (error) {
    log('admin top-up checkout failed', { error: String(error) });
    const status = /configured/i.test(String(error?.message || '')) ? 503 : 400;
    return sendJson(res, status, { error: error.message || 'Unable to start admin checkout' });
  }
}

async function handleAdminTopupConfirm(req, res, url) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  const sessionId = (url && url.searchParams && (url.searchParams.get('session_id') || url.searchParams.get('checkout_id') || url.searchParams.get('session'))) || '';
  if (!sessionId) return sendJson(res, 400, { error: 'session_id is required' });

  try {
    const checkout = await dodoRequest(`/checkouts/${sessionId}`, { method: 'GET' });
    const paid = isDodoPaymentComplete(checkout?.payment_status || checkout?.status);
    if (!paid) {
      return sendJson(res, 200, { ok: false, pending: true, paymentStatus: checkout?.payment_status || checkout?.status || 'unpaid' });
    }

    // Admin test confirmation does not apply tokens to any user; return details for inspection
    return sendJson(res, 200, {
      ok: true,
      paid: true,
      sessionId,
      amount: checkout?.amount || checkout?.amount_total || checkout?.total_amount || null,
      currency: checkout?.currency || null,
      metadata: checkout?.metadata || null,
      checkout,
    });
  } catch (error) {
    log('admin top-up confirmation failed', { error: String(error), sessionId });
    return sendJson(res, 400, { error: error.message || 'Unable to confirm admin checkout' });
  }
}

async function handleAdminMe(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  return sendJson(res, 200, { ok: true, admin: { username: ADMIN_USER || 'admin' } });
}
}

function resolvePaygProduct(currency = 'usd') {
  const normalized = String(currency || 'usd').toLowerCase();
  return {
    currency: normalized,
    productId: PAYG_PRODUCT_IDS[normalized] || '',
  };
}

async function handlePaygStatus(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  const plan = user.plan || DEFAULT_PLAN;
  if (!isPaidPlan(plan)) return sendJson(res, 200, { ok: true, payg: null, plan });
  const payg = (PAYG_ENABLED && !user?.unlimitedUsage) ? computePaygSummary(user.id, plan) : null;
  const pending = Object.fromEntries(Object.entries(pendingPayg || {}).filter(([, entry]) => entry && entry.userId === user.id));
  return sendJson(res, 200, { ok: true, plan, payg, pending });
}

async function handlePaygCheckout(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  const plan = user.plan || DEFAULT_PLAN;
  if (!PAYG_ENABLED) return sendJson(res, 503, { error: 'Pay-as-you-go billing is not enabled' });
  if (!isPaidPlan(plan)) return sendJson(res, 400, { error: 'Pay-as-you-go is only available on paid plans' });
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  const payg = computePaygSummary(user.id, plan);
  if (payg.billableTokens <= 0 || payg.amount <= 0) {
    return sendJson(res, 400, { error: 'No pay-as-you-go usage to bill', payg });
  }

  if (PAYG_MIN_TOKENS > 0 && payg.billableTokens < PAYG_MIN_TOKENS) {
    return sendJson(res, 400, { error: `Minimum overage to bill is ${PAYG_MIN_TOKENS.toLocaleString()} tokens`, payg });
  }

  const { productId, currency } = resolvePaygProduct(payg.currency);
  if (!productId) {
    return sendJson(res, 503, { error: `Pay-as-you-go product ID for ${currency.toUpperCase()} is not configured` });
  }

  const amount = Math.max(MIN_PAYMENT_AMOUNT, Math.ceil((payg.billableTokens * payg.pricePerUnit) / PAYG_UNIT_TOKENS));
  const returnUrl = `${resolveBaseUrl(req)}/settings`;
  const orderId = `payg_${randomUUID()}`;

  try {
    const checkoutSession = await dodoRequest('/checkouts', {
      method: 'POST',
      body: {
        product_cart: [{
          product_id: productId,
          quantity: 1,
          amount,
        }],
        customer: {
          email: user.billingEmail || user.email,
          name: user.billingEmail || user.email,
        },
        return_url: returnUrl,
        metadata: {
          type: 'payg',
          orderId,
          userId: String(user.id),
          payg: 'true',
          tokens: String(payg.billableTokens),
          currency: String(currency),
          amount: String(amount),
          month: String(payg.month),
        },
      },
    });

    const sessionId = checkoutSession?.session_id || checkoutSession?.id || '';
    if (!sessionId || !checkoutSession?.checkout_url) throw new Error('Dodo checkout session was not created');

    pendingPayg[sessionId] = {
      userId: user.id,
      orderId,
      tokens: payg.billableTokens,
      amount,
      currency,
      month: payg.month,
      createdAt: new Date().toISOString(),
    };
    await persistPendingPayg();

    return sendJson(res, 200, {
      url: checkoutSession.checkout_url,
      checkoutUrl: checkoutSession.checkout_url,
      sessionId,
      amount,
      currency,
      tokens: payg.billableTokens,
      payg,
    });
  } catch (error) {
    log('payg checkout failed', { error: String(error), userId: user?.id });
    const status = /configured/i.test(String(error?.message || '')) ? 503 : 400;
    return sendJson(res, status, { error: error.message || 'Unable to start pay-as-you-go checkout' });
  }
}

async function handlePaygConfirm(req, res, url) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  const sessionId = (url && url.searchParams && (url.searchParams.get('session_id') || url.searchParams.get('checkout_id') || url.searchParams.get('session'))) || '';
  if (!sessionId) return sendJson(res, 400, { error: 'session_id is required' });

  const existing = processedPayg[sessionId];
  if (existing) {
    if (existing.userId !== user.id) return sendJson(res, 403, { error: 'This pay-as-you-go charge belongs to another user' });

    try {
      await createInvoiceIfMissing(user, 'payg', {
        tokens: existing.tokens,
        amount: existing.amount,
        currency: existing.currency,
        source: {
          provider: 'dodo',
          checkoutId: sessionId,
          orderId: existing.orderId,
          paymentId: existing.paymentId,
        },
      });
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, error: String(invoiceError) });
    }

    return sendJson(res, 200, { ok: true, alreadyApplied: true, payg: computePaygSummary(user.id, user.plan || DEFAULT_PLAN) });
  }

  const pending = pendingPayg[sessionId];
  if (pending && pending.userId !== user.id) {
    return sendJson(res, 403, { error: 'This pay-as-you-go charge belongs to another user' });
  }

  try {
    const checkout = await dodoRequest(`/checkouts/${sessionId}`, { method: 'GET' });
    const paid = isDodoPaymentComplete(checkout?.payment_status || checkout?.status);
    if (!paid) {
      return sendJson(res, 200, { ok: false, pending: true, paymentStatus: checkout?.payment_status || checkout?.status || 'unpaid' });
    }

    const tokens = Number(pending?.tokens || checkout?.metadata?.tokens || 0);
    if (!tokens) return sendJson(res, 400, { error: 'Pay-as-you-go tokens missing' });

    const bucket = ensureTokenUsageBucket(user.id);
    if (!pending?.month || pending.month === bucket.month) {
      bucket.paygBilled = Math.max(0, Number(bucket.paygBilled || 0) + tokens);
      await persistTokenUsage();
    }

    const orderId = pending?.orderId || checkout?.metadata?.orderId || '';
    const currency = String(pending?.currency || checkout?.metadata?.currency || checkout?.currency || '').toLowerCase() || null;

    const amountCandidate = pending?.amount !== undefined && pending?.amount !== null
      ? Number(pending.amount)
      : Number(checkout?.metadata?.amount || checkout?.amount || checkout?.amount_total || checkout?.total_amount || 0);
    const amount = Number.isFinite(amountCandidate) ? Math.max(0, Math.round(amountCandidate)) : null;

    const paymentId = checkout?.payment_id || checkout?.paymentId || checkout?.charge_id || checkout?.chargeId || '';

    processedPayg[sessionId] = {
      userId: user.id,
      orderId: orderId || null,
      paymentId: paymentId || null,
      tokens,
      amount,
      currency,
      completedAt: new Date().toISOString(),
      month: pending?.month || bucket.month,
    };
    delete pendingPayg[sessionId];
    await Promise.all([persistPaygSessions(), persistPendingPayg()]);

    await sendPaymentConfirmationEmail(user, 'payg', {
      tokens,
      amount,
      currency,
    });

    try {
      await createInvoiceIfMissing(user, 'payg', {
        tokens,
        amount,
        currency,
        source: {
          provider: 'dodo',
          checkoutId: sessionId,
          orderId,
          paymentId,
        },
      });
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, error: String(invoiceError) });
    }

    return sendJson(res, 200, { ok: true, tokensBilled: tokens, payg: computePaygSummary(user.id, user.plan || DEFAULT_PLAN) });
  } catch (error) {
    log('payg confirmation failed', { error: String(error), userId: user?.id, sessionId });
    return sendJson(res, 400, { error: error.message || 'Unable to confirm pay-as-you-go payment' });
  }
}

// Handle subscription checkout creation
async function handleSubscriptionCheckout(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  try {
    const body = await parseJsonBody(req);
    const plan = normalizePlanSelection(body.plan);
    const billingCycle = String(body.billingCycle || 'monthly').toLowerCase();
    const currency = String(body.currency || 'usd').toLowerCase();
    const isInline = Boolean(body.inline);
    // If the client provided a previousPlan from the UI, prefer that for previous-subscription detection.
    const previousPlan = normalizePlanSelection((body && body.previousPlan) || user.plan);
    const previousSubscriptionId = (
      user.dodoSubscriptionId &&
      PAID_PLANS.has(previousPlan || '') &&
      PAID_PLANS.has(plan) &&
      previousPlan !== plan
    ) ? user.dodoSubscriptionId : '';

    if (previousSubscriptionId) {
      log('subscription checkout: detected previous subscription to cancel after confirm', { userId: user.id, previousPlan, previousSubscriptionId, requestedPlan: plan });
    }

    if (!plan) {
      return sendJson(res, 400, { error: 'Plan is required' });
    }

    // Hobby plan is free, no checkout needed
    if (plan === 'hobby') {
      user.plan = plan;
      user.billingStatus = DEFAULT_BILLING_STATUS;
      user.subscriptionRenewsAt = null;
      user.billingCycle = null;
      user.subscriptionCurrency = null;
      await persistUsersDb();
      
      log('hobby plan selected (free)', { userId: user.id, email: user.email, plan });
      return sendJson(res, 200, { ok: true, plan: 'hobby', message: 'Free hobby plan activated' });
    }

    // Validate subscription selection
    if (!validateSubscriptionSelection(plan, billingCycle, currency)) {
      return sendJson(res, 400, { error: 'Invalid plan, billing cycle, or currency combination' });
    }

    const product = resolveSubscriptionProduct(plan, billingCycle, currency);
    if (!product) {
      return sendJson(res, 400, { error: 'Subscription product not available' });
    }

    // Create a unique session ID for this checkout
    const checkoutSessionId = randomUUID();
 
    // Create checkout session with enhanced metadata for session tracking
    const returnUrl = `${resolveBaseUrl(req)}/apps`;
    const checkoutBody = {
      product_cart: [{
        product_id: product.productId,
        quantity: 1,
      }],
      customer: {
        email: user.billingEmail || user.email,
        name: user.billingEmail || user.email,
      },
      metadata: {
        type: 'subscription',
        orderId: String(checkoutSessionId),
        userId: String(user.id),
        sessionId: String(checkoutSessionId),
        plan: String(plan),
        billingCycle: String(billingCycle),
        currency: String(currency),
        amount: String(product.price),
        inline: String(isInline),
      },
      settings: {
        allow_payment_methods: ['card'],
        redirect_immediately: !isInline,
      },
    };
    checkoutBody.return_url = returnUrl;
    const checkoutSession = await dodoRequest('/checkouts', {
      method: 'POST',
      body: checkoutBody,
    });

    const sessionId = checkoutSession?.session_id || checkoutSession?.id || '';
    if (!sessionId || !checkoutSession?.checkout_url) {
      throw new Error('Dodo checkout session was not created');
    }

    // Store pending subscription with enhanced tracking
    pendingSubscriptions[sessionId] = {
      userId: user.id,
      orderId: checkoutSessionId,
      plan: plan,
      billingCycle: billingCycle,
      currency: currency,
      productId: product.productId,
      price: product.price,
      checkoutSessionId,
      previousSubscriptionId,
      createdAt: new Date().toISOString(),
      inline: isInline,
    };
    await persistPendingSubscriptions();

    // Return appropriate checkout URL based on request type
    const response = {
      sessionId,
      plan,
      billingCycle,
      currency,
      price: product.price,
    };

    if (isInline) {
      // For inline checkout, return the same URL but mark it as inline
      response.inlineCheckoutUrl = checkoutSession.checkout_url;
      response.checkoutUrl = checkoutSession.checkout_url; // Keep for backward compatibility
    } else {
      response.checkoutUrl = checkoutSession.checkout_url;
      response.url = checkoutSession.checkout_url;
    }

    return sendJson(res, 200, response);
  } catch (error) {
    log('subscription checkout failed', { error: String(error), userId: user?.id });
    const status = /configured/i.test(String(error?.message || '')) ? 503 : 400;
    return sendJson(res, status, { error: error.message || 'Unable to start subscription checkout' });
  }
}

// Handle subscription confirmation
async function handleSubscriptionConfirm(req, res, url) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });
  if (!DODO_ENABLED) return sendJson(res, 503, { error: 'Dodo Payments is not configured' });

  const sessionId = (url && url.searchParams && (url.searchParams.get('session_id') || url.searchParams.get('checkout_id') || url.searchParams.get('session'))) || '';
  if (!sessionId) return sendJson(res, 400, { error: 'session_id is required' });

  let processed = processedSubscriptions[sessionId];
  let processedKey = sessionId;

  if (!processed) {
    for (const [key, value] of Object.entries(processedSubscriptions)) {
      if (value?.checkoutSessionId === sessionId || value?.orderId === sessionId) {
        processed = value;
        processedKey = key;
        break;
      }
    }
  }

  if (processed) {
    if (processed.userId !== user.id) return sendJson(res, 403, { error: 'This subscription belongs to another user' });

    try {
      await createInvoiceIfMissing(user, 'subscription', {
        plan: processed.plan,
        billingCycle: processed.billingCycle,
        currency: processed.currency,
        amount: processed.amount,
        source: {
          provider: 'dodo',
          checkoutId: processedKey,
          orderId: processed.orderId || processed.checkoutSessionId,
          paymentId: processed.paymentId,
          subscriptionId: processed.subscriptionId,
        },
      });
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, error: String(invoiceError) });
    }

    const accountData = await serializeAccount(user);
    return sendJson(res, 200, {
      ok: true,
      alreadyApplied: true,
      plan: processed.plan,
      billingCycle: processed.billingCycle,
      currency: processed.currency,
      account: accountData,
    });
  }

  // Enhanced session tracking - try multiple ways to find the pending subscription
  let pending = pendingSubscriptions[sessionId];
  let pendingKey = sessionId;

  // If direct lookup fails, search by checkoutSessionId (for inline payments)
  if (!pending) {
    for (const [key, value] of Object.entries(pendingSubscriptions)) {
      if (value.checkoutSessionId === sessionId || value.orderId === sessionId) {
        pending = value;
        pendingKey = key;
        break;
      }
    }
  }

  if (!pending) return sendJson(res, 404, { error: 'Subscription not found or already processed' });
  if (pending.userId !== user.id) return sendJson(res, 403, { error: 'This subscription belongs to another user' });

  try {
    // Get checkout details from Dodo
    const checkout = await dodoRequest(`/checkouts/${pendingKey}`, { method: 'GET' });
    const paid = isDodoPaymentComplete(checkout?.payment_status || checkout?.status);
    if (!paid) {
      return sendJson(res, 200, { ok: false, pending: true, paymentStatus: checkout?.payment_status || checkout?.status || 'unpaid' });
    }

    // Activate subscription
    const previousSubscriptionId = pending.previousSubscriptionId;

    user.plan = pending.plan;
    user.billingStatus = DEFAULT_BILLING_STATUS;
    user.billingCycle = pending.billingCycle;
    user.subscriptionCurrency = pending.currency;
    user.subscriptionRenewsAt = computeRenewalDate(pending.billingCycle);
    user.dodoCustomerId = checkout?.customer_id || user.dodoCustomerId;

    if (checkout?.subscription_id) {
      user.dodoSubscriptionId = checkout.subscription_id;
    }

    if (previousSubscriptionId && previousSubscriptionId !== user.dodoSubscriptionId) {
      const cancelTarget = {
        ...user,
        dodoSubscriptionId: previousSubscriptionId,
      };
      await cancelDodoSubscription(cancelTarget, 'paid_plan_switch', { clearOnFailure: true });
    }

    await persistUsersDb();

    const paymentId = checkout?.payment_id || checkout?.paymentId || checkout?.charge_id || checkout?.chargeId || '';
    const subscriptionId = checkout?.subscription_id || user.dodoSubscriptionId || '';

    // Mark subscription as processed
    processedSubscriptions[pendingKey] = {
      userId: user.id,
      orderId: pending.orderId || pending.checkoutSessionId || null,
      checkoutSessionId: pending.checkoutSessionId || null,
      subscriptionId: subscriptionId || null,
      paymentId: paymentId || null,
      plan: pending.plan,
      billingCycle: pending.billingCycle,
      currency: pending.currency,
      amount: pending.price,
      completedAt: new Date().toISOString(),
    };
    
    // Clean up pending subscription
    delete pendingSubscriptions[pendingKey];
    await Promise.all([persistPendingSubscriptions(), persistProcessedSubscriptions()]);

    // Track conversion and financial
    trackConversion('paid', req);
    trackFinancial(pending.price / 100, pending.plan); // Convert from cents to dollars

    await sendPaymentConfirmationEmail(user, 'subscription', {
      plan: pending.plan,
      billingCycle: pending.billingCycle,
      currency: pending.currency,
      amount: pending.price,
    });

    try {
      await createInvoiceIfMissing(user, 'subscription', {
        plan: pending.plan,
        billingCycle: pending.billingCycle,
        currency: pending.currency,
        amount: pending.price,
        source: {
          provider: 'dodo',
          checkoutId: pendingKey,
          orderId: pending.orderId || pending.checkoutSessionId,
          paymentId,
          subscriptionId,
        },
      });
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, error: String(invoiceError) });
    }

    log('subscription activated', { 
      userId: user.id, 
      email: user.email, 
      plan: pending.plan, 
      billingCycle: pending.billingCycle, 
      currency: pending.currency,
      sessionId: pendingKey,
      checkoutSessionId: sessionId 
    });

    const accountData = await serializeAccount(user);
    return sendJson(res, 200, {
      ok: true,
      plan: pending.plan,
      billingCycle: pending.billingCycle,
      currency: pending.currency,
      account: accountData,
      sessionId: pendingKey,
      checkoutSessionId: sessionId 
    });
  } catch (error) {
    log('subscription confirmation failed', { 
      error: String(error), 
      userId: user?.id, 
      sessionId,
      pendingKey 
    });
    return sendJson(res, 400, { error: error.message || 'Unable to confirm subscription' });
  }
}

// Get subscription status
async function handleSubscriptionStatus(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  const isPaidPlan = PAID_PLANS.has(user.plan || '');
  const hasActiveSubscription = isPaidPlan && user.billingStatus === DEFAULT_BILLING_STATUS;

  let paymentMethod = null;
  
  if (user.dodoSubscriptionId) {
    try {
      const subscription = await dodoRequest(`/subscriptions/${user.dodoSubscriptionId}`, {
        method: 'GET',
      });
      
      if (subscription && subscription.payment_method) {
        const pm = subscription.payment_method;
        paymentMethod = {
          brand: pm.card?.brand || pm.payment_method || 'Card',
          last4: pm.card?.last4 || pm.card?.last_digits || '',
          expiresAt: pm.card?.expiry || pm.card?.expires_at || '',
        };
      }
    } catch (error) {
      console.error('[SubscriptionStatus] Failed to fetch subscription details:', error.message);
    }
  }

  return sendJson(res, 200, {
    plan: user.plan || DEFAULT_PLAN,
    hasActiveSubscription,
    billingStatus: user.billingStatus,
    billingCycle: user.billingCycle,
    currency: user.subscriptionCurrency,
    renewsAt: user.subscriptionRenewsAt,
    paymentMethod,
  });
}

// Cancel subscription
async function handleSubscriptionCancel(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  if (!PAID_PLANS.has(user.plan || '')) {
    return sendJson(res, 400, { error: 'No active subscription to cancel' });
  }

  // Cancel Dodo subscription
  if (user.dodoSubscriptionId) {
    await cancelDodoSubscription(user, 'subscription_cancel', { clearOnFailure: true });
  }

  user.billingStatus = 'cancelled';
  await persistUsersDb();

  log('subscription cancelled', { userId: user.id, email: user.email, plan: user.plan });

  const accountData = await serializeAccount(user);
  return sendJson(res, 200, {
    ok: true,
    message: 'Subscription cancelled. Access will continue until the end of the billing period.',
    account: accountData,
  });
}

async function handleDodoWebhook(req, res) {
  try {
    const DODO_WEBHOOK_KEY = process.env.DODO_PAYMENTS_WEBHOOK_KEY || '';
    const rawBody = await new Promise((resolve, reject) => {
      let body = '';
      req.on('data', (chunk) => { body += chunk; });
      req.on('end', () => resolve(body));
      req.on('error', reject);
    });

    const signature = req.headers['dodo-signature'] || '';
    
    if (DODO_WEBHOOK_KEY && signature) {
      const expectedSignature = `sha256=${require('crypto').createHmac('sha256', DODO_WEBHOOK_KEY).update(rawBody).digest('hex')}`;
      if (!require('crypto').timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
        log('Dodo webhook signature verification failed', { signature });
        return sendJson(res, 401, { error: 'Invalid signature' });
      }
    } else if (DODO_WEBHOOK_KEY) {
      log('Dodo webhook missing signature', { hasKey: !!DODO_WEBHOOK_KEY });
      return sendJson(res, 401, { error: 'Missing signature' });
    }

    const event = JSON.parse(rawBody);
    log('Dodo webhook received', { type: event.type, id: event.id });

    switch (event.type) {
      case 'payment_succeeded':
      case 'subscription_payment_succeeded':
        await handlePaymentSucceeded(event);
        break;
      case 'payment_failed':
        await handlePaymentFailed(event);
        break;
      case 'payment_cancelled':
        await handlePaymentCancelled(event);
        break;
      case 'payment_processing':
        await handlePaymentProcessing(event);
        break;
      case 'payment_dispute_created':
        await handlePaymentDisputeCreated(event);
        break;
      case 'dispute_accepted':
        await handleDisputeAccepted(event);
        break;
      case 'dispute_cancelled':
        await handleDisputeCancelled(event);
        break;
      case 'dispute_challenged':
        await handleDisputeChallenged(event);
        break;
      case 'dispute_expired':
        await handleDisputeExpired(event);
        break;
      case 'dispute_lost':
        await handleDisputeLost(event);
        break;
      case 'dispute_won':
        await handleDisputeWon(event);
        break;
      case 'charge_refunded':
        await handleChargeRefunded(event);
        break;
      case 'refund_failed':
        await handleRefundFailed(event);
        break;
      case 'subscription_canceled':
        await handleSubscriptionCanceled(event);
        break;
      case 'subscription_payment_failed':
        await handleSubscriptionPaymentFailed(event);
        break;
      case 'subscription_active':
        await handleSubscriptionActive(event);
        break;
      case 'subscription_expired':
        await handleSubscriptionExpired(event);
        break;
      case 'subscription_on_hold':
        await handleSubscriptionOnHold(event);
        break;
      case 'subscription_plan_changed':
        await handleSubscriptionPlanChanged(event);
        break;
      case 'subscription_renewed':
        await handleSubscriptionRenewed(event);
        break;
      case 'subscription_updated':
        await handleSubscriptionUpdated(event);
        break;
      default:
        log('Unhandled Dodo webhook event', { type: event.type });
    }

    sendJson(res, 200, { received: true });
  } catch (error) {
    log('Dodo webhook error', { error: String(error), stack: error.stack });
    sendJson(res, 200, { received: true });
  }
}

async function handlePaymentSucceeded(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};

  const paymentId = data.payment_id || data.paymentId || data.charge_id || data.chargeId || data.id || event.id || '';
  const checkoutId = data.checkout_id || data.checkoutId || data.checkout_session_id || data.checkoutSessionId || '';
  const subscriptionId = data.subscription_id || data.subscriptionId || metadata.subscriptionId || '';
  const orderId = metadata.orderId || metadata.sessionId || metadata.checkoutSessionId || '';

  const inferredType = String(metadata.type || '').toLowerCase()
    || (metadata.payg === 'true' ? 'payg' : '')
    || (String(event?.type || '').toLowerCase().includes('subscription') ? 'subscription' : '');

  let userId = metadata.userId || '';
  let user = userId ? findUserById(userId) : null;

  if (!user && subscriptionId) {
    user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
    userId = user?.id || '';
  }

  if (!userId || !user) {
    log('payment_succeeded: user not found', { userId, subscriptionId, eventId: event.id });
    return;
  }

  const findKeyByOrderId = (store, wanted) => {
    if (!wanted) return '';
    for (const [key, value] of Object.entries(store || {})) {
      if (value?.orderId && value.orderId === wanted) return key;
      if (value?.checkoutSessionId && value.checkoutSessionId === wanted) return key;
    }
    return '';
  };

  const parseAmount = (value) => {
    const num = Number(value);
    return Number.isFinite(num) ? Math.max(0, Math.round(num)) : null;
  };

  const ensureInvoice = async (type, details) => {
    try {
      await createInvoiceIfMissing(user, type, details);
    } catch (invoiceError) {
      log('failed to create invoice', { userId: user.id, type, error: String(invoiceError) });
    }
  };

  if (inferredType === 'topup') {
    const pendingKey = (checkoutId && pendingTopups?.[checkoutId] ? checkoutId : '') || findKeyByOrderId(pendingTopups, orderId);
    const pending = pendingKey ? pendingTopups[pendingKey] : null;

    const tokens = Number(metadata.tokens || pending?.tokens || 0);
    if (!tokens) {
      log('payment_succeeded: top-up missing tokens', { userId, eventId: event.id, checkoutId, orderId });
      return;
    }

    const amount = parseAmount(metadata.amount || pending?.amount || data.amount || data.amount_total || data.total_amount);
    const currency = String(metadata.currency || pending?.currency || data.currency || '').toLowerCase() || null;
    const tier = metadata.tier || pending?.tier || null;

    if (pendingKey && processedTopups[pendingKey]) {
      await ensureInvoice('topup', {
        tokens,
        amount: processedTopups[pendingKey].amount ?? amount,
        currency: processedTopups[pendingKey].currency ?? currency,
        tier: processedTopups[pendingKey].tier ?? tier,
        source: {
          provider: 'dodo',
          checkoutId: pendingKey,
          orderId: processedTopups[pendingKey].orderId || orderId,
          paymentId: processedTopups[pendingKey].paymentId || paymentId,
          eventId: event.id,
        },
      });
      return;
    }

    const bucket = ensureTokenUsageBucket(userId);
    bucket.addOns = Math.max(0, Number(bucket.addOns || 0) + tokens);
    await persistTokenUsage();

    if (pendingKey) {
      processedTopups[pendingKey] = {
        userId: user.id,
        orderId: (pending?.orderId || orderId) || null,
        paymentId: paymentId || null,
        tokens,
        tier: tier || null,
        amount,
        currency,
        completedAt: new Date().toISOString(),
      };
      delete pendingTopups[pendingKey];
      await Promise.all([persistTopupSessions(), persistPendingTopups()]);
    }

    await ensureInvoice('topup', {
      tokens,
      amount,
      currency,
      tier,
      source: {
        provider: 'dodo',
        checkoutId: pendingKey || checkoutId,
        orderId,
        paymentId,
        eventId: event.id,
      },
    });

    log('payment_succeeded: top-up processed via webhook', { userId, tokens, eventId: event.id, checkoutId: pendingKey || checkoutId });
    return;
  }

  if (inferredType === 'payment_method_save') {
    log('payment_method_save: payment method added via webhook', { userId, eventId: event.id, checkoutId });
    return;
  }

  if (inferredType === 'subscription') {
    const pendingKey = (checkoutId && pendingSubscriptions?.[checkoutId] ? checkoutId : '') || findKeyByOrderId(pendingSubscriptions, orderId);
    const pending = pendingKey ? pendingSubscriptions[pendingKey] : null;

    if (pendingKey && processedSubscriptions[pendingKey]) {
      await ensureInvoice('subscription', {
        plan: processedSubscriptions[pendingKey].plan,
        billingCycle: processedSubscriptions[pendingKey].billingCycle,
        currency: processedSubscriptions[pendingKey].currency,
        amount: processedSubscriptions[pendingKey].amount,
        source: {
          provider: 'dodo',
          checkoutId: pendingKey,
          orderId: processedSubscriptions[pendingKey].orderId || orderId,
          paymentId: processedSubscriptions[pendingKey].paymentId || paymentId,
          subscriptionId: processedSubscriptions[pendingKey].subscriptionId || subscriptionId,
          eventId: event.id,
        },
      });
      return;
    }

    if (pending) {
      user.plan = pending.plan || metadata.plan || user.plan;
      user.billingStatus = DEFAULT_BILLING_STATUS;
      user.billingCycle = pending.billingCycle || metadata.billingCycle || user.billingCycle;
      user.subscriptionCurrency = pending.currency || metadata.currency || user.subscriptionCurrency;
      if (user.billingCycle) {
        user.subscriptionRenewsAt = computeRenewalDate(user.billingCycle);
      }

      if (subscriptionId) {
        user.dodoSubscriptionId = subscriptionId;
      }

      await persistUsersDb();

      processedSubscriptions[pendingKey] = {
        userId: user.id,
        orderId: pending.orderId || pending.checkoutSessionId || orderId || null,
        checkoutSessionId: pending.checkoutSessionId || null,
        subscriptionId: subscriptionId || null,
        paymentId: paymentId || null,
        plan: user.plan,
        billingCycle: user.billingCycle,
        currency: user.subscriptionCurrency,
        amount: pending.price || parseAmount(metadata.amount || data.amount || data.amount_total || data.total_amount) || null,
        completedAt: new Date().toISOString(),
      };

      delete pendingSubscriptions[pendingKey];
      await Promise.all([persistPendingSubscriptions(), persistProcessedSubscriptions()]);

      await ensureInvoice('subscription', {
        plan: user.plan,
        billingCycle: user.billingCycle,
        currency: user.subscriptionCurrency,
        amount: processedSubscriptions[pendingKey].amount,
        source: {
          provider: 'dodo',
          checkoutId: pendingKey,
          orderId: processedSubscriptions[pendingKey].orderId || orderId,
          paymentId,
          subscriptionId,
          eventId: event.id,
        },
      });

      log('payment_succeeded: subscription activated via webhook', { userId: user.id, eventId: event.id, subscriptionId });
      return;
    }

    // Subscription renewal (or webhook delivered after pending record expired)
    const amount = parseAmount(metadata.amount || data.amount || data.amount_total || data.total_amount);
    const currency = String(metadata.currency || data.currency || user.subscriptionCurrency || '').toLowerCase() || null;

    await ensureInvoice('subscription', {
      plan: metadata.plan || user.plan,
      billingCycle: metadata.billingCycle || user.billingCycle,
      currency,
      amount,
      source: {
        provider: 'dodo',
        paymentId,
        eventId: event.id,
        subscriptionId: subscriptionId || user.dodoSubscriptionId,
      },
    });

    log('payment_succeeded: subscription payment recorded via webhook', { userId: user.id, eventId: event.id, subscriptionId: subscriptionId || user.dodoSubscriptionId });
    return;
  }

  if (inferredType === 'payg') {
    const pendingKey = (checkoutId && pendingPayg?.[checkoutId] ? checkoutId : '') || findKeyByOrderId(pendingPayg, orderId);
    const pending = pendingKey ? pendingPayg[pendingKey] : null;

    const tokens = Number(metadata.tokens || pending?.tokens || 0);
    const amount = parseAmount(metadata.amount || pending?.amount || data.amount || data.amount_total || data.total_amount);
    const currency = String(metadata.currency || pending?.currency || data.currency || '').toLowerCase() || null;

    await ensureInvoice('payg', {
      tokens,
      amount,
      currency,
      source: {
        provider: 'dodo',
        checkoutId: pendingKey || checkoutId,
        orderId,
        paymentId,
        eventId: event.id,
      },
    });

    log('payment_succeeded: payg invoice recorded via webhook', { userId: user.id, eventId: event.id, checkoutId: pendingKey || checkoutId });
    return;
  }

  log('payment_succeeded: unsupported payment type', { userId, type: metadata.type, eventId: event.id });
}

async function handlePaymentFailed(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;
  
  if (!userId) {
    log('payment_failed: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('payment_failed: user not found', { userId, eventId: event.id });
    return;
  }

  const paymentType = metadata.type;

  if (paymentType === 'subscription' || user.dodoSubscriptionId) {
    await cancelSubscriptionForUser(user, 'payment_failed');
    log('payment_failed: subscription cancelled', { userId, email: user.email, eventId: event.id });

    if (user.email) {
      await sendPaymentFailedEmail(user, data);
    }
  }
}

async function handlePaymentDisputeCreated(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;
  
  if (!userId) {
    log('payment_dispute_created: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('payment_dispute_created: user not found', { userId, eventId: event.id });
    return;
  }

  await cancelSubscriptionForUser(user, 'dispute_created');
  log('payment_dispute_created: subscription cancelled due to dispute', { userId, email: user.email, eventId: event.id, disputeId: data.dispute_id });

  if (user.email) {
    await sendPaymentDisputeCreatedEmail(user, data);
  }
}

async function handleChargeRefunded(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;
  
  if (!userId) {
    log('charge_refunded: no userId in metadata', { eventId: event.id, amount: data.amount });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('charge_refunded: user not found', { userId, eventId: event.id });
    return;
  }

  const paymentType = metadata.type;
  log('charge_refunded: refund processed', { userId, paymentType, amount: data.amount, eventId: event.id });

  if (user.email) {
    await sendChargeRefundedEmail(user, data);
  }
}

async function handleSubscriptionCanceled(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;
  
  if (!subscriptionId) {
    log('subscription_canceled: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_canceled: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  user.plan = 'hobby';
  user.billingStatus = 'cancelled';
  user.dodoSubscriptionId = '';
  user.subscriptionRenewsAt = '';
  await persistUsersDb();

  log('subscription_canceled: user downgraded to hobby', { userId: user.id, email: user.email, subscriptionId, eventId: event.id });

  if (user.email) {
    await sendSubscriptionCancelledEmail(user, data);
  }
}

async function handleSubscriptionPaymentFailed(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;
  
  if (!subscriptionId) {
    log('subscription_payment_failed: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_payment_failed: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  await cancelSubscriptionForUser(user, 'subscription_payment_failed');
  log('subscription_payment_failed: subscription cancelled due to payment failure', { userId: user.id, email: user.email, subscriptionId, eventId: event.id });

  if (user.email) {
    await sendSubscriptionPaymentFailedEmail(user, data);
  }
}

async function cancelSubscriptionForUser(user, reason) {
  if (user.dodoSubscriptionId) {
    await cancelDodoSubscription(user, reason, { clearOnFailure: true });
  }

  user.plan = 'hobby';
  user.billingStatus = 'cancelled';
  user.subscriptionRenewsAt = '';
  await persistUsersDb();
}

async function handlePaymentCancelled(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('payment_cancelled: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('payment_cancelled: user not found', { userId, eventId: event.id });
    return;
  }

  const paymentType = metadata.type;
  log('payment_cancelled: payment cancelled', { userId, paymentType, eventId: event.id });

  if (user.email) {
    await sendPaymentCancelledEmail(user, data);
  }
}

async function handlePaymentProcessing(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('payment_processing: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('payment_processing: user not found', { userId, eventId: event.id });
    return;
  }

  log('payment_processing: payment processing', { userId, eventId: event.id });
}

async function handleDisputeAccepted(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('dispute_accepted: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('dispute_accepted: user not found', { userId, eventId: event.id });
    return;
  }

  log('dispute_accepted: dispute accepted by bank', { userId, disputeId: data.dispute_id, eventId: event.id });

  if (user.email) {
    await sendDisputeAcceptedEmail(user, data);
  }
}

async function handleDisputeCancelled(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('dispute_cancelled: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('dispute_cancelled: user not found', { userId, eventId: event.id });
    return;
  }

  log('dispute_cancelled: dispute cancelled', { userId, disputeId: data.dispute_id, eventId: event.id });

  if (user.email) {
    await sendDisputeCancelledEmail(user, data);
  }
}

async function handleDisputeChallenged(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('dispute_challenged: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('dispute_challenged: user not found', { userId, eventId: event.id });
    return;
  }

  log('dispute_challenged: dispute challenged', { userId, disputeId: data.dispute_id, eventId: event.id });

  if (user.email) {
    await sendDisputeChallengedEmail(user, data);
  }
}

async function handleDisputeExpired(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('dispute_expired: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('dispute_expired: user not found', { userId, eventId: event.id });
    return;
  }

  log('dispute_expired: dispute expired', { userId, disputeId: data.dispute_id, eventId: event.id });

  if (user.email) {
    await sendDisputeExpiredEmail(user, data);
  }
}

async function handleDisputeLost(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('dispute_lost: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('dispute_lost: user not found', { userId, eventId: event.id });
    return;
  }

  log('dispute_lost: dispute lost', { userId, disputeId: data.dispute_id, eventId: event.id });

  if (user.email) {
    await sendDisputeLostEmail(user, data);
  }
}

async function handleDisputeWon(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('dispute_won: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('dispute_won: user not found', { userId, eventId: event.id });
    return;
  }

  log('dispute_won: dispute won', { userId, disputeId: data.dispute_id, eventId: event.id });

  if (user.email) {
    await sendDisputeWonEmail(user, data);
  }
}

async function handleRefundFailed(event) {
  const data = event?.data?.object || event?.data || {};
  const metadata = data?.metadata || {};
  const userId = metadata.userId;

  if (!userId) {
    log('refund_failed: no userId in metadata', { eventId: event.id });
    return;
  }

  const user = findUserById(userId);
  if (!user) {
    log('refund_failed: user not found', { userId, eventId: event.id });
    return;
  }

  log('refund_failed: refund failed', { userId, amount: data.amount, eventId: event.id });

  if (user.email) {
    await sendRefundFailedEmail(user, data);
  }
}

async function handleSubscriptionActive(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;

  if (!subscriptionId) {
    log('subscription_active: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_active: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  user.billingStatus = 'active';
  if (data.renews_at || data.current_period_end) {
    user.subscriptionRenewsAt = data.renews_at || data.current_period_end;
  }
  await persistUsersDb();

  log('subscription_active: subscription activated', { userId: user.id, subscriptionId, eventId: event.id });

  if (user.email) {
    await sendSubscriptionActiveEmail(user, data);
  }
}

async function handleSubscriptionExpired(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;

  if (!subscriptionId) {
    log('subscription_expired: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_expired: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  user.plan = 'hobby';
  user.billingStatus = 'expired';
  user.dodoSubscriptionId = '';
  user.subscriptionRenewsAt = '';
  await persistUsersDb();

  log('subscription_expired: subscription expired', { userId: user.id, subscriptionId, eventId: event.id });

  if (user.email) {
    await sendSubscriptionExpiredEmail(user, data);
  }
}

async function handleSubscriptionOnHold(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;

  if (!subscriptionId) {
    log('subscription_on_hold: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_on_hold: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  user.billingStatus = 'on_hold';
  await persistUsersDb();

  log('subscription_on_hold: subscription on hold', { userId: user.id, subscriptionId, eventId: event.id });

  if (user.email) {
    await sendSubscriptionOnHoldEmail(user, data);
  }
}

async function handleSubscriptionPlanChanged(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;

  if (!subscriptionId) {
    log('subscription_plan_changed: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_plan_changed: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  const newPlan = data.plan || data.metadata?.plan;
  if (newPlan && USER_PLANS.includes(newPlan.toLowerCase())) {
    user.plan = newPlan.toLowerCase();
  }
  await persistUsersDb();

  log('subscription_plan_changed: plan changed', { userId: user.id, subscriptionId, newPlan: user.plan, eventId: event.id });

  if (user.email) {
    await sendSubscriptionPlanChangedEmail(user, data);
  }
}

async function handleSubscriptionRenewed(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;

  if (!subscriptionId) {
    log('subscription_renewed: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_renewed: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  user.billingStatus = 'active';
  if (data.renews_at || data.current_period_end) {
    user.subscriptionRenewsAt = data.renews_at || data.current_period_end;
  }
  await persistUsersDb();

  log('subscription_renewed: subscription renewed', { userId: user.id, subscriptionId, eventId: event.id });

  if (user.email) {
    await sendSubscriptionRenewedEmail(user, data);
  }
}

async function handleSubscriptionUpdated(event) {
  const { data } = event;
  const subscriptionId = data.id || data.subscription_id;

  if (!subscriptionId) {
    log('subscription_updated: no subscription ID', { eventId: event.id });
    return;
  }

  const user = usersDb.find(u => u.dodoSubscriptionId === subscriptionId);
  if (!user) {
    log('subscription_updated: user not found for subscription', { subscriptionId, eventId: event.id });
    return;
  }

  if (data.renews_at || data.current_period_end) {
    user.subscriptionRenewsAt = data.renews_at || data.current_period_end;
  }
  await persistUsersDb();

  log('subscription_updated: subscription updated', { userId: user.id, subscriptionId, eventId: event.id });
}

async function handleAccountBoostPurchase(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;
  const user = findUserById(session.userId);
  if (!user) return sendJson(res, 404, { error: 'User not found' });

  const packSize = BOOST_PACK_SIZE;
  const discount = user.plan === 'enterprise' ? 0.25 : user.plan === 'professional' ? 0.1 : user.plan === 'starter' ? 0.05 : 0;
  const bucket = ensureTokenUsageBucket(user.id);
  bucket.addOns = Math.max(0, Number(bucket.addOns || 0) + packSize);
  await persistTokenUsage();
  const price = BOOST_BASE_PRICE * (1 - discount);

  // Track financial
  trackFinancial(price, user.plan || DEFAULT_PLAN);

  // Create invoice for boost purchase
  try {
    await createInvoiceIfMissing(user, 'boost', {
      tokens: packSize,
      amount: Math.round(price * 100),
      currency: 'usd',
      source: {
        provider: 'internal',
        type: 'boost_purchase',
      },
    });
  } catch (invoiceError) {
    log('failed to create boost invoice', { userId: user.id, error: String(invoiceError) });
  }

  return sendJson(res, 200, {
    ok: true,
    message: `Added a power boost worth ${packSize.toLocaleString()} tokens`,
    priceCharged: `$${price.toFixed(2)} (simulated)`,
    summary: getTokenUsageSummary(user.id, user.plan || DEFAULT_PLAN),
  });
}

// Test endpoint to simulate token usage for testing the usage bar
async function handleSimulateTokenUsage(req, res) {
  // Prefer authenticated user-session, fall back to legacy identity
  const authed = getUserSession(req);
  const resolvedUserId = authed?.userId || resolveUserId(req);
  if (!resolvedUserId) {
    return sendJson(res, 401, { error: 'User identity required' });
  }
  
  const body = await parseJsonBody(req).catch(() => ({}));
  const tokensToAdd = Math.max(0, Math.ceil(Number(body.tokens || 1000)));
  
  console.log(`[TEST] Simulating ${tokensToAdd} tokens for user ${resolvedUserId}`);
  
  // Record the tokens
  await recordUserTokens(resolvedUserId, tokensToAdd);
  
  // Get updated summary
  const user = findUserById(resolvedUserId);
  const plan = user?.plan || DEFAULT_PLAN;
  const summary = getTokenUsageSummary(resolvedUserId, plan);
  
  console.log(`[TEST] Updated usage summary:`, summary);
  
  return sendJson(res, 200, {
    ok: true,
    message: `Simulated ${tokensToAdd} tokens`,
    tokensAdded: tokensToAdd,
    summary,
  });
}

async function handleVerifyEmailApi(req, res, url) {
  try {
    const tokenFromQuery = (url && url.searchParams && url.searchParams.get('token')) || '';
    const body = req.method === 'POST' ? await parseJsonBody(req).catch(() => ({})) : {};
    const token = (body.token || tokenFromQuery || '').trim();
    if (!token) return sendJson(res, 400, { error: 'Verification token is required' });

    const user = usersDb.find((u) => u.verificationToken === token);
    if (!user) return sendJson(res, 400, { error: 'Verification link is invalid' });

    if (user.verificationExpiresAt) {
      const expires = new Date(user.verificationExpiresAt).getTime();
      if (Number.isFinite(expires) && expires < Date.now()) {
        return sendJson(res, 400, { error: 'Verification link has expired. Please request a new one.' });
      }
    }

    user.emailVerified = true;
    user.verificationToken = '';
    user.verificationExpiresAt = null;
    await persistUsersDb();
    const tokenValue = startUserSession(res, user.id, true);
    log('user email verified', { userId: user.id, email: user.email });

    // Check if user has selected a plan
    const hasPlan = normalizePlanSelection(user?.plan);

    sendJson(res, 200, {
      ok: true,
      user: { id: user.id, email: user.email, emailVerified: true, hasPlan },
      token: tokenValue,
      expiresAt: Date.now() + USER_SESSION_TTL_MS,
      message: 'Email verified successfully.',
      redirect: hasPlan ? '/apps' : '/select-plan',
    });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to verify email' });
  }
}

async function handlePasswordResetRequest(req, res) {
  try {
    const body = await parseJsonBody(req);
    const email = (body.email || '').trim().toLowerCase();
    if (!email) return sendJson(res, 400, { error: 'Email is required' });

    const user = findUserByEmail(email);
    if (!user) {
      await new Promise((resolve) => setTimeout(resolve, 250));
      return sendJson(res, 200, { ok: true, message: 'If an account exists, a reset link has been sent.' });
    }

    assignPasswordResetToken(user);
    await persistUsersDb();

    // Send reset email in the background
    sendPasswordResetEmail(user, resolveBaseUrl(req)).catch(err => {
      log('background password reset email failed', { error: String(err), email: user.email });
    });

    log('password reset email queued', { userId: user.id, email: user.email });
    sendJson(res, 200, { ok: true, message: 'If an account exists, a reset link has been sent.' });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to start password reset' });
  }
}

async function handlePasswordReset(req, res) {
  try {
    const body = await parseJsonBody(req);
    const token = (body.token || '').trim();
    const newPassword = (body.password || '').trim();
    if (!token || !newPassword) return sendJson(res, 400, { error: 'Token and new password are required' });
    if (newPassword.length < 6) return sendJson(res, 400, { error: 'Password must be at least 6 characters long' });

    const user = usersDb.find((u) => u.resetToken === token);
    if (!user) return sendJson(res, 400, { error: 'Reset link is invalid' });

    if (user.resetExpiresAt) {
      const expires = new Date(user.resetExpiresAt).getTime();
      if (Number.isFinite(expires) && expires < Date.now()) {
        return sendJson(res, 400, { error: 'Reset link has expired' });
      }
    }

    user.password = await bcrypt.hash(newPassword, PASSWORD_SALT_ROUNDS);
    user.resetToken = '';
    user.resetExpiresAt = null;
    if (!user.emailVerified) user.emailVerified = true;
    await persistUsersDb();

    const tokenValue = startUserSession(res, user.id, true);
    log('password reset successful', { userId: user.id, email: user.email });
    sendJson(res, 200, {
      ok: true,
      user: { id: user.id, email: user.email, emailVerified: !!user.emailVerified },
      token: tokenValue,
      expiresAt: Date.now() + USER_SESSION_TTL_MS,
    });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to reset password' });
  }
}

async function handleSelectPlan(req, res) {
  const session = requireUserAuth(req, res);
  if (!session) return;

  const user = findUserById(session.userId);
  if (!user) {
    return sendJson(res, 404, { error: 'User not found' });
  }

  try {
    const body = await parseJsonBody(req);
    const plan = normalizePlanSelection(body.plan || body.newPlan);

    if (!plan) {
      return sendJson(res, 400, { error: 'Invalid plan selection' });
    }

    // Hobby plan is free - activate immediately
    if (plan === 'hobby') {
      const previousPlan = user.plan || 'none';

      // Cancel any existing Dodo subscription
      if (user.dodoSubscriptionId) {
        await cancelDodoSubscription(user, 'hobby_plan', { clearOnFailure: true });
      }

      user.plan = plan;
      user.billingStatus = DEFAULT_BILLING_STATUS;
      user.subscriptionRenewsAt = null;
      user.billingCycle = null;
      user.subscriptionCurrency = null;
      await persistUsersDb();

      // Track plan selection and conversion
      trackConversionFunnel('plan_selection', 'hobby_selected', user.id, {
        previousPlan: previousPlan,
        newPlan: plan
      });
      trackPlanUpgrade(previousPlan, plan, user.id);
      trackFeatureUsage('plan_selection', user.id, plan);

      log('hobby plan selected (free)', { userId: user.id, email: user.email, plan });
      return sendJson(res, 200, { ok: true, account: await serializeAccount(user) });
    }

    // For paid plans, redirect to subscription checkout
    // Return a special response that frontend can handle to redirect to subscription flow
    const previousPlan = user.plan || 'none';
    trackConversionFunnel('plan_selection', 'paid_plan_selected', user.id, {
      previousPlan: previousPlan,
      newPlan: plan
    });
    trackPlanUpgrade(previousPlan, plan, user.id);
    trackFeatureUsage('plan_selection', user.id, plan);
    
    return sendJson(res, 200, { 
      requiresPayment: true, 
      plan: plan,
      message: 'Paid plan selected - redirecting to payment' 
    });
    
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to select plan' });
  }
}

function renderOAuthResultPage(res, { success, message, next, user, token, provider }) {
  const safeNext = sanitizeRedirectPath(next, '/apps');
  const safeMessage = escapeHtml(message || (success ? 'Signing you in...' : 'Authentication failed'));
  let script = `window.location.href = '${safeNext}';`;
  if (success && user) {
    const payload = {
      email: user.email,
      accountId: user.id,
      sessionToken: token || '',
      provider: provider || 'oauth'
    };
    const payloadJson = JSON.stringify(payload).replace(/</g, '\\u003c');
    script = `
      (() => {
        try {
          const data = ${payloadJson};
          const json = JSON.stringify(data);
          localStorage.setItem('wordpress_plugin_ai_user', json);
          localStorage.setItem('shopify_ai_user', json);
          document.cookie = 'chat_user=' + encodeURIComponent(data.accountId) + '; path=/; SameSite=Lax';
        } catch (_) { /* ignore */ }
        window.location.href = '${safeNext}';
      })();
    `;
  }
  const statusCode = success ? 200 : 400;
  res.writeHead(statusCode, { 'Content-Type': 'text/html' });
  res.end(`<!doctype html><html><body><p>${safeMessage}</p><script>${script}</script></body></html>`);
}

function renderOAuthError(res, message, next) {
  return renderOAuthResultPage(res, { success: false, message: message || 'Unable to sign you in', next: next || '/login' });
}

function renderOAuthSuccess(res, user, token, next, provider) {
  // Check if user has selected a plan
  const hasPlan = normalizePlanSelection(user?.plan);
  const redirectNext = hasPlan ? next : '/select-plan';
  return renderOAuthResultPage(res, { success: true, message: 'Signing you in...', next: redirectNext, user, token, provider });
}

async function handleGoogleAuthStart(req, res, url) {
  if (!GOOGLE_CLIENT_ID || !GOOGLE_CLIENT_SECRET) {
    return renderOAuthError(res, 'Google sign-in is not configured', url.searchParams.get('next') || '/login');
  }
  const next = url.searchParams.get('next') || '/apps';
  const remember = url.searchParams.get('remember') === 'true' || url.searchParams.get('remember') === '1';
  const state = createOAuthState(next, 'google', remember);
  const redirectUri = buildRedirectUri(req, 'google');
  const params = new URLSearchParams({
    client_id: GOOGLE_CLIENT_ID,
    redirect_uri: redirectUri,
    response_type: 'code',
    scope: 'openid email profile',
    state,
    access_type: 'offline',
    include_granted_scopes: 'true',
    prompt: 'consent',
  });
  res.writeHead(302, { Location: `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}` });
  res.end();
}

async function handleGoogleAuthCallback(req, res, url) {
  const stateParam = url.searchParams.get('state') || '';
  const stateEntry = consumeOAuthState(stateParam, 'google');
  const hintNext = sanitizeRedirectPath(url.searchParams.get('next') || '/apps');
  const next = stateEntry?.next || hintNext;

  if (!GOOGLE_CLIENT_ID || !GOOGLE_CLIENT_SECRET) {
    return renderOAuthError(res, 'Google sign-in is not configured', next);
  }
  if (!stateEntry) {
    return renderOAuthError(res, 'This Google login request has expired. Please try again.', next);
  }
  const code = url.searchParams.get('code');
  const error = url.searchParams.get('error');
  if (error) {
    return renderOAuthError(res, `Google authentication was cancelled: ${escapeHtml(error)}`, next);
  }
  if (!code) {
    return renderOAuthError(res, 'Missing Google authorization code', next);
  }

  try {
    const redirectUri = buildRedirectUri(req, 'google');
    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        code,
        client_id: GOOGLE_CLIENT_ID,
        client_secret: GOOGLE_CLIENT_SECRET,
        redirect_uri: redirectUri,
        grant_type: 'authorization_code'
      })
    });
    const tokenJson = await tokenRes.json().catch(() => ({}));
    const accessToken = tokenJson.access_token;
    const idToken = tokenJson.id_token;
    if (!tokenRes.ok || (!accessToken && !idToken)) {
      log('google oauth token exchange failed', { status: tokenRes.status, body: tokenJson });
      return renderOAuthError(res, 'Google authentication failed during token exchange', next);
    }

    let profile = {};
    if (idToken) {
      profile = decodeJwtPayload(idToken);
    }
    if (accessToken) {
      try {
        const userInfoRes = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
          headers: { Authorization: `Bearer ${accessToken}` }
        });
        if (userInfoRes.ok) {
          profile = await userInfoRes.json();
        }
      } catch (err) {
        log('google userinfo fetch failed', { err: String(err) });
      }
    }

    const email = (profile?.email || '').toLowerCase();
    const providerId = profile?.sub || profile?.id || null;
    if (!providerId) {
      return renderOAuthError(res, 'Google account did not include an id', next);
    }
    if (!email) {
      return renderOAuthError(res, 'Google account did not return an email address', next);
    }

    const user = await upsertOAuthUser('google', providerId, email, profile || {});
    const token = startUserSession(res, user.id, stateEntry.remember || false);
    log('google oauth login success', { userId: user.id, email: user.email, remember: stateEntry.remember });
    return renderOAuthSuccess(res, user, token, next, 'google');
  } catch (err) {
    log('google oauth callback error', { error: String(err) });
    return renderOAuthError(res, 'Unexpected error during Google sign-in', next);
  }
}

async function handleGithubAuthStart(req, res, url) {
  if (!GITHUB_CLIENT_ID || !GITHUB_CLIENT_SECRET) {
    return renderOAuthError(res, 'GitHub sign-in is not configured', url.searchParams.get('next') || '/login');
  }
  const next = url.searchParams.get('next') || '/apps';
  const remember = url.searchParams.get('remember') === 'true' || url.searchParams.get('remember') === '1';
  const state = createOAuthState(next, 'github', remember);
  const redirectUri = buildRedirectUri(req, 'github');
  const params = new URLSearchParams({
    client_id: GITHUB_CLIENT_ID,
    redirect_uri: redirectUri,
    scope: 'read:user user:email',
    state
  });
  res.writeHead(302, { Location: `https://github.com/login/oauth/authorize?${params.toString()}` });
  res.end();
}

async function handleGithubAuthCallback(req, res, url) {
  const stateParam = url.searchParams.get('state') || '';
  const stateEntry = consumeOAuthState(stateParam, 'github');
  const hintNext = sanitizeRedirectPath(url.searchParams.get('next') || '/apps');
  const next = stateEntry?.next || hintNext;

  if (!GITHUB_CLIENT_ID || !GITHUB_CLIENT_SECRET) {
    return renderOAuthError(res, 'GitHub sign-in is not configured', next);
  }
  if (!stateEntry) {
    return renderOAuthError(res, 'This GitHub login request has expired. Please try again.', next);
  }

  const code = url.searchParams.get('code');
  const error = url.searchParams.get('error');
  if (error) {
    return renderOAuthError(res, `GitHub authentication was cancelled: ${escapeHtml(error)}`, next);
  }
  if (!code) {
    return renderOAuthError(res, 'Missing GitHub authorization code', next);
  }

  try {
    const redirectUri = buildRedirectUri(req, 'github');
    const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Accept': 'application/json'
      },
      body: JSON.stringify({
        client_id: GITHUB_CLIENT_ID,
        client_secret: GITHUB_CLIENT_SECRET,
        code,
        redirect_uri: redirectUri,
      })
    });
    const tokenJson = await tokenRes.json().catch(() => ({}));
    const accessToken = tokenJson.access_token;
    if (!tokenRes.ok || !accessToken) {
      log('github oauth token exchange failed', { status: tokenRes.status, body: tokenJson });
      return renderOAuthError(res, 'GitHub authentication failed during token exchange', next);
    }

    const userRes = await fetch('https://api.github.com/user', {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        'User-Agent': OAUTH_USER_AGENT
      }
    });
    const userProfile = await userRes.json().catch(() => ({}));
    if (!userRes.ok) {
      log('github user profile fetch failed', { status: userRes.status, body: userProfile });
      return renderOAuthError(res, 'Could not read your GitHub profile', next);
    }

    let email = (userProfile.email || '').toLowerCase();
    if (!email) {
      try {
        const emailRes = await fetch('https://api.github.com/user/emails', {
          headers: {
            Authorization: `Bearer ${accessToken}`,
            'User-Agent': OAUTH_USER_AGENT
          }
        });
        const emails = await emailRes.json().catch(() => []);
        if (Array.isArray(emails)) {
          const verifiedEmails = emails.filter((e) => e && e.verified);
          const primary = verifiedEmails.find((e) => e.primary) || verifiedEmails[0];
          if (primary?.email) {
            email = primary.email.toLowerCase();
          } else {
            return renderOAuthError(res, 'GitHub account must have a verified email address', next);
          }
        }
      } catch (err) {
        log('github email fetch failed', { err: String(err) });
      }
    }

    const providerId = userProfile?.id ? String(userProfile.id) : null;
    if (!providerId) {
      return renderOAuthError(res, 'GitHub account did not include an id', next);
    }
    if (!email) {
      return renderOAuthError(res, 'GitHub account did not return a verified email address', next);
    }

    const user = await upsertOAuthUser('github', providerId, email, userProfile || {});
    const token = startUserSession(res, user.id, stateEntry.remember || false);
    log('github oauth login success', { userId: user.id, email: user.email, remember: stateEntry.remember });
    return renderOAuthSuccess(res, user, token, next, 'github');
  } catch (err) {
    log('github oauth callback error', { error: String(err) });
    return renderOAuthError(res, 'Unexpected error during GitHub sign-in', next);
  }
}

async function handleAdminLogin(req, res) {
  if (!ADMIN_USER || !ADMIN_PASSWORD) return sendJson(res, 500, { error: 'Admin credentials not configured' });
  try {
    const body = await parseJsonBody(req);
    const user = (body.username || body.user || '').trim();
    const pass = (body.password || body.pass || '').trim();

    // Normalize username comparison to be case-insensitive and trim whitespace
    const adminUserNormalized = (ADMIN_USER || '').trim().toLowerCase();
    const userNormalized = (user || '').trim().toLowerCase();
    const clientIp = req.socket?.remoteAddress || 'unknown';

    // Check honeypot
    if (checkHoneypot(body)) {
      log('admin login honeypot triggered', { ip: clientIp });
      return sendJson(res, 400, { error: 'Invalid request' });
    }

    // Check rate limit
    const rateLimit = checkLoginRateLimit(clientIp, ADMIN_LOGIN_RATE_LIMIT, adminLoginAttempts);
    if (rateLimit.blocked) {
      log('admin login rate limited', { ip: clientIp, retryAfter: rateLimit.retryAfter });
      return sendJson(res, 429, {
        error: 'Too many login attempts. Please try again later.',
        retryAfter: rateLimit.retryAfter || 60
      });
    }

    if (!adminUserNormalized || !ADMIN_PASSWORD) {
      log('admin credentials not configured (runtime)');
      return sendJson(res, 500, { error: 'Admin credentials not configured' });
    }

    // Validate username
    if (userNormalized !== adminUserNormalized) {
      log('failed admin login', { user: userNormalized, ip: clientIp, reason: 'invalid_username' });
      return sendJson(res, 401, { error: 'Incorrect credentials' });
    }

    // Validate password using bcrypt
    let passwordValid = false;
    if (adminPasswordHash) {
      passwordValid = await bcrypt.compare(pass, adminPasswordHash);
    } else {
      // Fallback to plaintext comparison if hashing failed at startup
      passwordValid = pass === ADMIN_PASSWORD.trim();
    }

    if (!passwordValid) {
      log('failed admin login', { user: userNormalized, ip: clientIp, reason: 'invalid_password' });
      return sendJson(res, 401, { error: 'Incorrect credentials' });
    }

    // Clear failed attempts on success
    adminLoginAttempts.delete(clientIp);

    const token = startAdminSession(res);
    sendJson(res, 200, { ok: true, token, user: ADMIN_USER, expiresAt: Date.now() + ADMIN_SESSION_TTL_MS });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to login' });
  }
}

async function handleAdminLogout(req, res) {
  const session = getAdminSession(req);
  if (session) adminSessions.delete(session.token);
  clearAdminSession(res);
  sendJson(res, 200, { ok: true });
}

async function handleAdminMe(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  sendJson(res, 200, { ok: true, user: ADMIN_USER, expiresAt: session.expiresAt });
}

async function handleAdminAvailableModels(req, res, cliParam = 'opencode') {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const cli = normalizeCli(cliParam);
    const models = await listModels(cli);
    sendJson(res, 200, { models });
  } catch (error) {
    sendJson(res, 500, { error: error.message || 'Failed to load available models' });
  }
}

async function handleAdminListIcons(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  const icons = await listAdminIcons();
  sendJson(res, 200, { icons });
}

async function handleAdminModelsList(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  const models = (adminModels || []).map((m) => ({
    id: m.id,
    name: m.name,
    label: m.label || m.name,
    icon: m.icon || '',
    cli: m.cli || 'opencode',
    providers: Array.isArray(m.providers) ? m.providers : [],
    primaryProvider: m.primaryProvider || (Array.isArray(m.providers) && m.providers[0]?.provider) || 'opencode',
    tier: m.tier || 'free',
    multiplier: getTierMultiplier(m.tier || 'free'),
    supportsMedia: m.supportsMedia ?? false,
  })).sort((a, b) => (a.label || '').localeCompare(b.label || ''));
  sendJson(res, 200, { models });
}

async function handleAdminModelUpsert(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    const modelName = (body.name || body.model || '').trim();
    const label = (body.label || body.displayName || modelName).trim();
    const cli = normalizeCli(body.cli || 'opencode');
    const tier = normalizeTier(body.tier);
    if (!modelName) return sendJson(res, 400, { error: 'Model name is required' });
    const id = body.id || randomUUID();
    const existingIndex = adminModels.findIndex((m) => m.id === id);
    const existing = existingIndex >= 0 ? adminModels[existingIndex] : null;
    let icon = existing?.icon || '';
    if (typeof body.icon === 'string' && body.icon.trim()) {
      icon = await normalizeIconPath(body.icon);
      if (!icon) return sendJson(res, 400, { error: 'Icon must be stored in /assets' });
    }
    let providers = [];
    if (Array.isArray(body.providers)) {
      providers = body.providers.map((p, idx) => ({
        provider: normalizeProviderName(p.provider || p.name || p.id || 'opencode'),
        model: (p.model || p.name || modelName || '').trim() || modelName,
        primary: typeof p.primary === 'boolean' ? p.primary : idx === 0,
      })).filter((p) => !!p.model);
    } else if (typeof body.provider === 'string') {
      const normalized = normalizeProviderName(body.provider);
      providers = [{ provider: normalized, model: modelName, primary: true }];
    }
    if (!providers.length) providers = [{ provider: 'opencode', model: modelName, primary: true }];
    const primaryProvider = providers.find((p) => p.primary)?.provider || providers[0].provider;
    const supportsMedia = typeof body.supportsMedia === 'boolean' ? body.supportsMedia : false;

    const payload = { id, name: modelName, label: label || modelName, cli, icon, providers, primaryProvider, tier, multiplier: getTierMultiplier(tier), supportsMedia };
    if (existingIndex >= 0) adminModels[existingIndex] = { ...adminModels[existingIndex], ...payload };
    else adminModels.push(payload);
    await persistAdminModels();
    sendJson(res, 200, { model: payload, models: getConfiguredModels(cli) });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save model' });
  }
}

async function handleAdminModelDelete(req, res, id) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  const before = adminModels.length;
  adminModels = adminModels.filter((m) => m.id !== id);
  if (adminModels.length === before) return sendJson(res, 404, { error: 'Model not found' });
  await persistAdminModels();
  sendJson(res, 200, { ok: true, models: getConfiguredModels('opencode') });
}

async function handleAdminOpenRouterSettingsGet(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  sendJson(res, 200, openrouterSettings);
}

async function handleAdminMistralSettingsGet(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  sendJson(res, 200, mistralSettings);
}

async function handleAdminMistralSettingsPost(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    mistralSettings = {
      primaryModel: (body.primaryModel || '').trim(),
      backupModel1: (body.backupModel1 || '').trim(),
      backupModel2: (body.backupModel2 || '').trim(),
      backupModel3: (body.backupModel3 || '').trim(),
    };
    await persistMistralSettings();
    sendJson(res, 200, { ok: true, settings: mistralSettings });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save settings' });
  }
}

async function handleAdminPlanSettingsGet(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  sendJson(res, 200, planSettings);
}

async function handleAdminPlanSettingsPost(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    if (body.provider && PLANNING_PROVIDERS.includes(normalizeProviderName(body.provider))) {
      planSettings.provider = normalizeProviderName(body.provider);
    }
    if (Array.isArray(body.planningChain)) {
      planSettings.planningChain = normalizePlanningChain(body.planningChain);
    }
    if (typeof body.freePlanModel === 'string') {
      planSettings.freePlanModel = body.freePlanModel.trim();
    }
    if (!planSettings.planningChain.length) {
      planSettings.planningChain = defaultPlanningChainFromSettings(planSettings.provider);
    }
    await persistPlanSettings();
    sendJson(res, 200, { ok: true, settings: planSettings });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save settings' });
  }
}

// Get current plan token allocations
async function handleAdminPlanTokensGet(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    sendJson(res, 200, { limits: planTokenLimits });
  } catch (error) {
    sendJson(res, 500, { error: error.message || 'Unable to fetch plan tokens' });
  }
}

// Update plan token allocations
async function handleAdminPlanTokensPost(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    if (!body || typeof body !== 'object' || typeof body.limits !== 'object') return sendJson(res, 400, { error: 'Invalid payload' });
    const incoming = body.limits || {};
    const clean = JSON.parse(JSON.stringify(planTokenLimits || {}));
    for (const plan of Object.keys(clean)) {
      if (incoming[plan] && typeof incoming[plan] === 'number') {
        clean[plan] = Math.max(0, Number(incoming[plan] || 0));
      }
    }
    planTokenLimits = clean;
    await persistPlanTokenLimits();
    sendJson(res, 200, { ok: true, limits: planTokenLimits });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save plan tokens' });
  }
}

// Get token rates
async function handleAdminTokenRatesGet(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    sendJson(res, 200, { rates: tokenRates });
  } catch (error) {
    sendJson(res, 500, { error: error.message || 'Unable to fetch token rates' });
  }
}

// Update token rates
async function handleAdminTokenRatesPost(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    if (!body || typeof body !== 'object' || typeof body.rates !== 'object') return sendJson(res, 400, { error: 'Invalid payload' });
    const incoming = body.rates || {};
    const clean = JSON.parse(JSON.stringify(tokenRates || {}));
    for (const currency of Object.keys(clean)) {
      if (incoming[currency] && typeof incoming[currency] === 'number') {
        clean[currency] = Math.max(0, Number(incoming[currency] || 0));
      }
    }
    tokenRates = clean;
    await persistTokenRates();
    sendJson(res, 200, { ok: true, rates: tokenRates });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save token rates' });
  }
}

async function handleAdminProviderLimitsGet(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const discovery = await discoverProviderModels();
    const snapshot = getProviderUsageSnapshot(discovery.providers);
    sendJson(res, 200, {
      limits: providerLimits.limits,
      usage: snapshot,
      opencodeBackupModel: providerLimits.opencodeBackupModel || '',
      providers: discovery.providers,
      providerModels: discovery.providerModels,
    });
  } catch (error) {
    sendJson(res, 500, { error: error.message || 'Unable to load provider limits' });
  }
}

async function handleAdminProviderLimitsPost(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    const provider = normalizeProviderName(body.provider);
    if (!provider) return sendJson(res, 400, { error: 'Provider is required' });
    const cfg = ensureProviderLimitDefaults(provider);
    if (body.scope === 'model') cfg.scope = 'model';
    else if (body.scope === 'provider') cfg.scope = 'provider';

    const targetModel = (body.model || '').trim();
    const target = cfg.scope === 'model' && targetModel ? (cfg.perModel[targetModel] = cfg.perModel[targetModel] || {}) : cfg;
    ['tokensPerMinute', 'tokensPerDay', 'requestsPerMinute', 'requestsPerDay'].forEach((field) => {
      if (body[field] !== undefined) target[field] = sanitizeLimitNumber(body[field]);
    });

    if (typeof body.opencodeBackupModel === 'string') {
      providerLimits.opencodeBackupModel = body.opencodeBackupModel.trim();
    }

    await persistProviderLimits();
    const discovery = await discoverProviderModels();
    sendJson(res, 200, {
      ok: true,
      limits: providerLimits.limits,
      usage: getProviderUsageSnapshot(discovery.providers),
      opencodeBackupModel: providerLimits.opencodeBackupModel || '',
      providers: discovery.providers,
      providerModels: discovery.providerModels,
    });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save provider limits' });
  }
}

// Admin-only environment diagnostics for debugging missing provider API keys
async function handleAdminEnvConfig(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const groqKey = process.env.GROQ_API_KEY || process.env.GROQ_API_TOKEN || '';
    const mistralKey = process.env.MISTRAL_API_KEY || process.env.MISTRAL_API_TOKEN || '';
    const openrouterKey = process.env.OPENROUTER_API_KEY || process.env.OPENROUTER_API_TOKEN || '';

    const payload = {
      GROQ: {
        configured: !!groqKey,
        prefix: groqKey ? `${groqKey.substring(0, 8)}...` : null,
        source: groqKey ? (process.env.GROQ_API_KEY ? 'GROQ_API_KEY' : 'GROQ_API_TOKEN') : null,
      },
      MISTRAL: {
        configured: !!mistralKey,
        prefix: mistralKey ? `${mistralKey.substring(0, 8)}...` : null,
        source: mistralKey ? (process.env.MISTRAL_API_KEY ? 'MISTRAL_API_KEY' : 'MISTRAL_API_TOKEN') : null,
      },
      OPENROUTER: {
        configured: !!openrouterKey,
        prefix: openrouterKey ? `${openrouterKey.substring(0, 8)}...` : null,
        source: openrouterKey ? (process.env.OPENROUTER_API_KEY ? 'OPENROUTER_API_KEY' : 'OPENROUTER_API_TOKEN') : null,
      }
    };

    sendJson(res, 200, { ok: true, env: payload });
  } catch (err) {
    sendJson(res, 500, { error: err.message || String(err) });
  }
}

async function handleAdminAccountsList(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  const accountPromises = usersDb.map((u) => serializeAccount(u));
  const accounts = (await Promise.all(accountPromises)).filter(Boolean);
  sendJson(res, 200, { accounts });
}

async function handleAdminAccountPlanUpdate(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    const userId = body.userId;
    const plan = normalizePlanSelection(body.plan);

    if (!userId) return sendJson(res, 400, { error: 'User ID is required' });
    if (!plan) return sendJson(res, 400, { error: 'Invalid plan selected' });

    const user = findUserById(userId);
    if (!user) return sendJson(res, 404, { error: 'User not found' });

    user.plan = plan;
    // Also update billing status and renewal date if it's a paid plan to make it look "active"
    if (isPaidPlan(plan)) {
      user.billingStatus = 'active';
      user.subscriptionRenewsAt = computeRenewalDate('monthly');
    } else {
      user.billingStatus = 'active';
      user.subscriptionRenewsAt = null;
    }

    await persistUsersDb();
    const accountData = await serializeAccount(user);
    log('Admin updated user plan', { userId, plan, admin: ADMIN_USER });
    sendJson(res, 200, { ok: true, account: accountData });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to update plan' });
  }
}

// Admin account delete endpoint
async function handleAdminAccountDelete(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    const userId = body.userId;

    if (!userId) return sendJson(res, 400, { error: 'User ID is required' });

    const userIndex = usersDb.findIndex(u => u.id === userId);
    if (userIndex === -1) return sendJson(res, 404, { error: 'User not found' });

    const user = usersDb[userIndex];
    
    // Permanently delete user data
    usersDb.splice(userIndex, 1);
    
    for (const [token, session] of userSessions.entries()) {
      if (session.userId === userId) {
        userSessions.delete(token);
      }
    }
    
    // Remove user's sessions from the main state
    state.sessions = state.sessions.filter(s => s.userId !== userId);
    
    // Delete user's workspaces/sessions from file system
    const userWorkspaceDir = path.join(WORKSPACES_ROOT, userId);
    if (fsSync.existsSync(userWorkspaceDir)) {
      try {
        fsSync.rmSync(userWorkspaceDir, { recursive: true, force: true });
      } catch (err) {
        console.error('Failed to delete user workspace:', err);
        // Continue with deletion even if workspace cleanup fails
      }
    }
    
    // Delete user's session state
    const userStateFile = path.join(STATE_DIR, `session-${userId}.json`);
    if (fsSync.existsSync(userStateFile)) {
      try {
        fsSync.unlinkSync(userStateFile);
      } catch (err) {
        console.error('Failed to delete user state file:', err);
        // Continue with deletion even if state cleanup fails
      }
    }
    
    await persistUsersDb();
    await persistState();
    
    log('Admin permanently deleted user', { 
      userId, 
      email: user.email, 
      admin: ADMIN_USER 
    });
    
    sendJson(res, 200, { ok: true, message: 'User permanently deleted' });
  } catch (error) {
    console.error('Error deleting user:', error);
    sendJson(res, 500, { error: error.message || 'Unable to delete user' });
  }
}

// Affiliate management API endpoints
async function handleAdminAffiliatesList(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  const affiliates = affiliatesDb.map((a) => summarizeAffiliate(a)).filter(Boolean);
  sendJson(res, 200, { affiliates });
}

async function handleAdminAffiliateDelete(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    const affiliateId = body.affiliateId;

    if (!affiliateId) return sendJson(res, 400, { error: 'Affiliate ID is required' });

    const affiliateIndex = affiliatesDb.findIndex(a => a.id === affiliateId);
    if (affiliateIndex === -1) return sendJson(res, 404, { error: 'Affiliate not found' });

    const affiliate = affiliatesDb[affiliateIndex];

    // Remove from database
    affiliatesDb.splice(affiliateIndex, 1);

    // Clear any active sessions for this affiliate
    for (const [token, sess] of affiliateSessions.entries()) {
      if (sess.affiliateId === affiliateId) {
        affiliateSessions.delete(token);
      }
    }

    await persistAffiliatesDb();

    log('Admin permanently deleted affiliate', {
      affiliateId,
      email: affiliate.email,
      admin: ADMIN_USER
    });

    sendJson(res, 200, { ok: true, message: 'Affiliate permanently deleted' });
  } catch (error) {
    console.error('Error deleting affiliate:', error);
    sendJson(res, 500, { error: error.message || 'Unable to delete affiliate' });
  }
}

// Tracking API endpoints
async function handleAdminTrackingStats(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  
  try {
    // Convert dailyVisits for serialization
    const dailyVisits = {};
    for (const [date, data] of Object.entries(trackingData.summary.dailyVisits)) {
      dailyVisits[date] = {
        count: data.count,
        uniqueVisitors: data.uniqueVisitors instanceof Set 
          ? data.uniqueVisitors.size 
          : (Array.isArray(data.uniqueVisitors) ? data.uniqueVisitors.length : 0)
      };
    }

    // Get top referrers
    const referrersList = Object.entries(trackingData.summary.referrers)
      .map(([domain, count]) => ({ domain, count }))
      .sort((a, b) => b.count - a.count);

    // Get top pages
    const pagesList = Object.entries(trackingData.summary.pages)
      .map(([path, count]) => ({ path, count }))
      .sort((a, b) => b.count - a.count);

    // Get recent visits (last 100)
    const recentVisits = trackingData.visits.slice(-100).reverse();

    // Get comprehensive analytics summary
    const analytics = getAnalyticsSummary();

    const stats = {
      // Legacy tracking data
      totalVisits: trackingData.summary.totalVisits,
      uniqueVisitors: trackingData.summary.uniqueVisitors.size,
      topReferrers: referrersList.slice(0, 20),
      topPages: pagesList.slice(0, 20),
      dailyVisits: dailyVisits,
      recentVisits: recentVisits,
      referrersList: referrersList,
      pagesList: pagesList,
      conversions: trackingData.summary.conversions,
      conversionSources: trackingData.summary.conversionSources,
      financials: trackingData.summary.financials,
      referrersToUpgrade: Object.entries(trackingData.summary.referrersToUpgrade || {})
        .map(([domain, count]) => ({ domain, count }))
        .sort((a, b) => b.count - a.count)
        .slice(0, 10),
      upgradeSources: trackingData.summary.upgradeSources || {},
      retention: calculateRetention(),

      // Enhanced Analytics
      userEngagement: analytics.userEngagement,
      featureUsage: analytics.featureUsage,
      modelUsage: analytics.modelUsage,
      exportUsage: analytics.exportUsage,
      errorRates: analytics.errorRates,
      retentionCohorts: analytics.retentionCohorts,
      businessMetrics: analytics.businessMetrics,
      technicalMetrics: analytics.technicalMetrics,
      planUpgradePatterns: analytics.planUpgradePatterns,
      conversionFunnels: analytics.conversionFunnels,
      featureAdoptionByPlan: analytics.featureAdoptionByPlan,

      // Additional Insights
      sessionInsights: {
        totalSessions: Object.keys(trackingData.userAnalytics.userSessions).length,
        averageSessionDuration: analytics.userEngagement.averageSessionDuration,
        totalProjectsCreated: Object.keys(trackingData.userAnalytics.projectData).length,
        totalExports: Object.values(trackingData.userAnalytics.exportUsage).reduce((a, b) => a + b, 0),
        totalErrors: Object.values(trackingData.userAnalytics.errorRates).reduce((a, b) => a + b, 0)
      }
    };

    sendJson(res, 200, { ok: true, stats });
  } catch (error) {
    log('Failed to fetch tracking stats', { error: String(error) });
    sendJson(res, 500, { error: error.message || 'Unable to fetch tracking stats' });
  }
}

async function handleAdminCancelMessages(req, res) {
  const adminSession = requireAdminAuth(req, res);
  if (!adminSession) return;

  try {
    let totalCancelled = 0;
    let sessionsAffected = 0;
    let runningCancelled = 0;
    let queuedCancelled = 0;

    for (const session of state.sessions) {
      let sessionCancelled = 0;
      for (const message of (session.messages || [])) {
        if (message.status === 'running' || message.status === 'queued') {
          message.status = 'cancelled';
          message.finishedAt = new Date().toISOString();
          message.cancelledAt = new Date().toISOString();
          message.cancelledBy = 'admin';
          if (!message.reply) message.reply = '';
          if (!message.opencodeSummary) message.opencodeSummary = 'Cancelled by admin';

          if (message.status === 'running') {
            runningCancelled++;
            runningProcesses.delete(message.id);
            if (activeStreams.has(message.id)) {
              const streams = activeStreams.get(message.id);
              streams.forEach(streamRes => {
                try {
                  streamRes.write(`data: ${JSON.stringify({ type: 'cancelled', reason: 'admin_cancelled', timestamp: new Date().toISOString() })}\n\n`);
                  streamRes.end();
                } catch (e) { }
              });
              activeStreams.delete(message.id);
            }
          } else {
            queuedCancelled++;
          }

          sessionCancelled++;
          totalCancelled++;
        }
      }

      if (sessionCancelled > 0) {
        sessionsAffected++;
        sessionQueues.delete(session.id);
        session.updatedAt = new Date().toISOString();
      }
    }

    if (totalCancelled > 0) {
      await persistState();
    }

    log('Admin cancelled all messages', { totalCancelled, sessionsAffected, runningCancelled, queuedCancelled, adminId: adminSession.userId });

    sendJson(res, 200, {
      ok: true,
      totalCancelled,
      sessionsAffected,
      runningCancelled,
      queuedCancelled
    });
  } catch (error) {
    log('Failed to cancel messages', { error: String(error) });
    sendJson(res, 500, { error: error.message || 'Unable to cancel messages' });
  }
}

// Get detailed resource usage breakdown by session for admin panel
async function handleAdminResources(req, res) {
  const adminSession = requireAdminAuth(req, res);
  if (!adminSession) return;

  try {
    const mem = process.memoryUsage();
    const cpuUsage = process.cpuUsage();
    const now = Date.now();

    // Calculate per-session memory estimates and collect detailed info
    const sessionsData = state.sessions.map((session) => {
      const sessionAge = now - new Date(session.createdAt).getTime();
      const messages = (session.messages || []).map((msg) => {
        // Estimate message memory footprint
        let messageSize = 0;
        messageSize += (msg.content || '').length * 2; // UTF-16 characters
        messageSize += (msg.reply || '').length * 2;
        messageSize += (msg.partialOutput || '').length * 2;
        messageSize += (msg.opencodeSummary || '').length * 2;
        if (msg.attachments) {
          messageSize += JSON.stringify(msg.attachments).length * 2;
        }
        return {
          id: msg.id,
          role: msg.role,
          status: msg.status,
          model: msg.model,
          createdAt: msg.createdAt,
          finishedAt: msg.finishedAt,
          contentLength: (msg.content || '').length,
          replyLength: (msg.reply || '').length,
          estimatedMemoryBytes: messageSize,
          estimatedMemoryKb: (messageSize / 1024).toFixed(2) + ' KB',
          isRunning: msg.status === 'running',
          isQueued: msg.status === 'queued',
          isDone: msg.status === 'done',
          isError: msg.status === 'error'
        };
      });

      // Calculate session total
      const totalMessageMemory = messages.reduce((sum, m) => sum + m.estimatedMemoryBytes, 0);
      const runningMessages = messages.filter(m => m.isRunning);
      const queuedMessages = messages.filter(m => m.isQueued);
      const errorMessages = messages.filter(m => m.isError);

      return {
        id: session.id,
        userId: session.userId,
        title: session.title || 'Untitled',
        appId: session.appId || null,
        appName: session.appName || null,
        createdAt: session.createdAt,
        updatedAt: session.updatedAt,
        ageMs: sessionAge,
        age: formatDuration(sessionAge),
        messageCount: messages.length,
        messages: messages,
        runningMessages: runningMessages.length,
        queuedMessages: queuedMessages.length,
        errorMessages: errorMessages.length,
        totalMessageMemoryBytes: totalMessageMemory,
        totalMessageMemoryKb: (totalMessageMemory / 1024).toFixed(2) + ' KB',
        estimatedSessionMemoryKb: ((totalMessageMemory + 10240) / 1024).toFixed(2) + ' KB', // Base overhead
        pending: session.pending || 0,
        workspaceDir: session.workspaceDir ? session.workspaceDir.replace(WORKSPACES_ROOT, '...') : null,
        model: session.model || null,
        cli: session.cli || 'opencode',
        opencodeSessionId: session.opencodeSessionId || null,
        hasOpencodeSession: !!session.opencodeSessionId
      };
    });

    // Sort sessions by estimated memory usage (descending)
    const sortedSessions = sessionsData.sort((a, b) => b.totalMessageMemoryBytes - a.totalMessageMemoryBytes);

    // Get running processes info
    const runningProcessInfo = [];
    for (const [messageId, procInfo] of runningProcesses.entries()) {
      // Find the session and message for this process
      let sessionId = null;
      let messageContent = null;
      for (const session of state.sessions) {
        const msg = session.messages?.find(m => m.id === messageId);
        if (msg) {
          sessionId = session.id;
          messageContent = (msg.content || '').slice(0, 100);
          break;
        }
      }
      runningProcessInfo.push({
        messageId,
        sessionId,
        startTime: procInfo.startTime,
        age: formatDuration(now - procInfo.startTime),
        messagePreview: messageContent
      });
    }

    // Get child processes info
    const childProcessInfo = [];
    for (const [processId, info] of childProcesses.entries()) {
      const age = now - info.startTime;
      childProcessInfo.push({
        processId,
        pid: info.pid,
        sessionId: info.sessionId,
        messageId: info.messageId,
        startTime: info.startTime,
        age: formatDuration(age),
        ageMs: age
      });
    }

    // Get active streams info
    const streamInfo = [];
    for (const [messageId, streams] of activeStreams.entries()) {
      // Find the session for this message
      let sessionId = null;
      for (const session of state.sessions) {
        const msg = session.messages?.find(m => m.id === messageId);
        if (msg) {
          sessionId = session.id;
          break;
        }
      }
      streamInfo.push({
        messageId,
        sessionId,
        streamCount: streams.size,
        statuses: Array.from(streams).map(s => s.statusCode || 200)
      });
    }

    // OpenCode process manager stats
    const managerStats = opencodeManager.getStats ? opencodeManager.getStats() : { isRunning: false };

    // Calculate totals
    const totals = {
      sessions: sessionsData.length,
      totalMessages: sessionsData.reduce((sum, s) => sum + s.messageCount, 0),
      runningMessages: sessionsData.reduce((sum, s) => sum + s.runningMessages, 0),
      queuedMessages: sessionsData.reduce((sum, s) => sum + s.queuedMessages, 0),
      errorMessages: sessionsData.reduce((sum, s) => sum + s.errorMessages, 0),
      totalEstimatedMemoryMb: (sessionsData.reduce((sum, s) => sum + s.totalMessageMemoryBytes, 0) / (1024 * 1024)).toFixed(2) + ' MB'
    };

    // System load
    const loadAvg = os.loadavg();

    sendJson(res, 200, {
      system: {
        memory: {
          rss: `${(mem.rss / 1024 / 1024).toFixed(2)} MB`,
          heapTotal: `${(mem.heapTotal / 1024 / 1024).toFixed(2)} MB`,
          heapUsed: `${(mem.heapUsed / 1024 / 1024).toFixed(2)} MB`,
          external: `${(mem.external / 1024 / 1024).toFixed(2)} MB`,
          arrayBuffers: `${((mem.arrayBuffers || 0) / 1024 / 1024).toFixed(2)} MB`,
          raw: {
            rss: mem.rss,
            heapTotal: mem.heapTotal,
            heapUsed: mem.heapUsed,
            external: mem.external,
            arrayBuffers: mem.arrayBuffers || 0
          }
        },
        cpu: {
          user: cpuUsage.user,
          system: cpuUsage.system,
          userPercent: ((cpuUsage.user / 1000000 / process.uptime()) * 100).toFixed(1) + '%',
          systemPercent: ((cpuUsage.system / 1000000 / process.uptime()) * 100).toFixed(1) + '%',
          loadAvg1m: loadAvg[0].toFixed(2),
          loadAvg5m: loadAvg[1].toFixed(2),
          loadAvg15m: loadAvg[2].toFixed(2)
        },
        limits: {
          memoryBytes: RESOURCE_LIMITS.memoryBytes,
          memoryMb: `${(RESOURCE_LIMITS.memoryBytes / 1024 / 1024).toFixed(2)} MB`,
          cpuCores: RESOURCE_LIMITS.cpuCores,
          memoryPercentUsed: ((mem.rss / RESOURCE_LIMITS.memoryBytes) * 100).toFixed(1) + '%'
        },
        process: {
          uptime: process.uptime(),
          uptimeFormatted: formatDuration(process.uptime() * 1000),
          pid: process.pid,
          nodeVersion: process.version,
          platform: process.platform,
          arch: process.arch
        }
      },
      totals,
      sessions: sortedSessions,
      runningProcesses: runningProcessInfo,
      childProcesses: childProcessInfo,
      activeStreams: streamInfo,
      opencode: {
        mode: managerStats.isRunning ? 'singleton' : 'per-session',
        isReady: managerStats.isReady || false,
        pendingRequests: managerStats.pendingRequests || 0,
        sessionWorkspaces: managerStats.activeSessions || 0,
        runningInstances: managerStats.activeSessions || 0
      },
      maps: {
        sessionQueues: sessionQueues.size,
        activeStreams: activeStreams.size,
        runningProcesses: runningProcesses.size,
        childProcesses: childProcesses.size,
        oauthStates: typeof oauthStateStore !== 'undefined' ? oauthStateStore.size : 0,
        loginAttempts: typeof loginAttempts !== 'undefined' ? loginAttempts.size : 0,
        adminLoginAttempts: typeof adminLoginAttempts !== 'undefined' ? adminLoginAttempts.size : 0,
        apiRateLimit: typeof apiRateLimit !== 'undefined' ? apiRateLimit.size : 0
      },
      timestamp: new Date().toISOString()
    });
  } catch (error) {
    log('Failed to get resource usage', { error: String(error) });
    sendJson(res, 500, { error: error.message || 'Unable to fetch resource usage' });
  }
}

async function handleAdminOpenRouterSettingsPost(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  try {
    const body = await parseJsonBody(req);
    openrouterSettings = {
      primaryModel: (body.primaryModel || '').trim(),
      backupModel1: (body.backupModel1 || '').trim(),
      backupModel2: (body.backupModel2 || '').trim(),
      backupModel3: (body.backupModel3 || '').trim(),
    };
    await persistOpenRouterSettings();
    sendJson(res, 200, { ok: true, settings: openrouterSettings });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to save settings' });
  }
}

async function handleNewSession(req, res, userId) {
  try {
    const body = await parseJsonBody(req);
    const session = await createSession(
      {
        title: body.title,
        model: body.model,
        cli: body.cli,
        appId: body.appId || body.app || body.appSlug,
        reuseAppId: body.reuseAppId === true
      },
      userId
    );

    // Handle template loading
    if (body.templateId) {
      try {
        const templatePath = path.join(__dirname, 'templates', sanitizeSegment(body.templateId));
        // recursive copy function - explicitly defined here to avoid reference issues
        const copyDirRecursive = async (src, dest) => {
          await fs.mkdir(dest, { recursive: true });
          const entries = await fs.readdir(src, { withFileTypes: true });
          for (let entry of entries) {
            const srcPath = path.join(src, entry.name);
            const destPath = path.join(dest, entry.name);
            if (entry.isDirectory()) {
              await copyDirRecursive(srcPath, destPath);
            } else {
              await fs.copyFile(srcPath, destPath);
            }
          }
        };

        if (session.workspaceDir) {
          await copyDirRecursive(templatePath, session.workspaceDir);
          session.planSummary = `Started from template: ${body.templateId}`;
          session.planApproved = true; // Skip plan phase
          session.entryMode = 'opencode'; // Force builder to build mode
          log('Template loaded into session', { sessionId: session.id, templateId: body.templateId });
        }
      } catch (err) {
        log('Failed to copy template', { error: String(err) });
      }
    }

    await persistState();
    sendJson(res, 201, { session: serializeSession(session) });
  } catch (error) {
    const status = error.statusCode && Number.isInteger(error.statusCode) ? error.statusCode : 400;
    sendJson(res, status, { error: error.message || 'Unable to create session' });
  }
}

async function handleListSessions(req, res, userId) {
  // Allow optional filtering by appId query param to support client-side lookups
  try {
    const url = new URL(req.url || '', 'http://localhost');
    const rawAppId = url.searchParams.get('appId') || '';
    const appId = sanitizeSegment(rawAppId, '');
    const sessions = state.sessions.filter((s) => s.userId === userId && (!appId || s.appId === appId));
    sendJson(res, 200, { sessions: sessions.map(serializeSession) });
  } catch (err) {
    // Fallback: return all sessions if parsing fails
    const sessions = state.sessions.filter((s) => s.userId === userId);
    sendJson(res, 200, { sessions: sessions.map(serializeSession) });
  }
}

async function handleGetSession(_req, res, sessionId, userId) { const session = getSession(sessionId, userId); if (!session) return sendJson(res, 404, { error: 'Session not found' }); sendJson(res, 200, { session: serializeSession(session) }); }

async function handleNewMessage(req, res, sessionId, userId) {
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });
  try {
    await ensureSessionPaths(session);
    const body = await parseJsonBody(req);
    const content = sanitizeMessage(body.content || '');
    const displayContent = typeof body.displayContent === 'string' && body.displayContent.trim()
      ? body.displayContent.trim()
      : content;
    // Allow empty content if there are attachments
    const hasAttachments = Array.isArray(body.attachments) && body.attachments.length;
    if (!content && !hasAttachments) return sendJson(res, 400, { error: 'Message is required' });
    const userPlan = resolveUserPlan(session.userId);

    // Paid plans only: image attachments.
    if (hasAttachments) {
      const hasImage = body.attachments.some((a) => a && isImageMime(a.type));
      if (hasImage && !isPaidPlan(userPlan)) {
        return sendJson(res, 402, { error: 'Image uploads are available on Business and Enterprise plans only. Please upgrade to attach images.' });
      }
    }
    const model = resolvePlanModel(userPlan, body.model || session.model);
    const estimatedTokens = estimateTokensFromText(content) + TOKEN_ESTIMATION_BUFFER; // include headroom for reply
    const allowance = canConsumeTokens(session.userId, userPlan, estimatedTokens);
    if (!allowance.allowed) {
      const friendlyRemaining = allowance.remaining > 0 ? `${allowance.remaining.toLocaleString()} remaining` : 'no remaining balance';
      return sendJson(res, 402, { error: `You have reached your token allowance (${friendlyRemaining}). Upgrade or add a boost.`, allowance });
    }
    const cli = normalizeCli(body.cli || session.cli);
    const now = new Date().toISOString();
    const message = { id: randomUUID(), role: 'user', content, displayContent, model, cli, status: 'queued', createdAt: now, updatedAt: now, opencodeTokensUsed: null };
    // Copy continuation-related fields for background continuations
    if (body.isContinuation) message.isContinuation = true;
    if (body.isBackgroundContinuation) message.isBackgroundContinuation = true;
    if (body.originalMessageId) message.originalMessageId = body.originalMessageId;
    // Preserve opencodeSessionId for session continuity in retries/continuations
    // Also prioritize body.opencodeSessionId over session.opencodeSessionId for explicit continuation
    if (body.opencodeSessionId) {
      message.opencodeSessionId = body.opencodeSessionId;
      log('Using explicit opencodeSessionId from request body', { opencodeSessionId: body.opencodeSessionId });
    } else if (session.opencodeSessionId) {
      message.opencodeSessionId = session.opencodeSessionId;
      log('Inheriting opencodeSessionId from session', { opencodeSessionId: session.opencodeSessionId });
    }
    // Process attachments if provided as base64 JSON entries
    if (hasAttachments) {
      message.attachments = [];
      for (const att of body.attachments) {
        try {
          if (!att.data || !att.type) continue;

          // Validate file size
          const buffer = Buffer.from(att.data, 'base64');
          if (buffer.length > MAX_ATTACHMENT_SIZE) { log('attachment too large, skipping', { size: buffer.length, max: MAX_ATTACHMENT_SIZE, name: att.name }); continue; }

          // Validate MIME type
          const clientMimeType = att.type.toLowerCase();
          const allowedMimeTypes = [
            'image/png', 'image/jpeg', 'image/gif', 'image/svg+xml', 'image/webp',
            'application/pdf', 'text/plain', 'text/css', 'application/javascript',
            'text/html', 'text/markdown', 'text/csv', 'application/json',
            'application/xml', 'text/xml'
          ];

          if (!allowedMimeTypes.includes(clientMimeType)) {
            log('attachment rejected - invalid mime type', { mimeType: clientMimeType, name: att.name });
            continue;
          }

          // Magic byte verification for images
          if (clientMimeType.startsWith('image/')) {
            if (!validateImageSignature(clientMimeType, buffer)) {
              log('attachment rejected - invalid image signature', { mimeType: clientMimeType, name: att.name });
              continue;
            }
          }

          // Compress images before storing.
          let storedBuffer = buffer;
          let storedMimeType = clientMimeType;
          let forcedExt = null;
          if (clientMimeType.startsWith('image/')) {
            const compressed = await compressImageBuffer(buffer, clientMimeType);
            storedBuffer = compressed.buffer;
            storedMimeType = compressed.mimeType;
            forcedExt = compressed.ext;
          }

          const id = `${randomUUID()}-${safeFileNamePart(att.name)}`;
          const ext = forcedExt || extensionForMime(storedMimeType);
          const safeExt = String(ext || 'bin').replace(/[^a-zA-Z0-9]/g, '').slice(0, 10) || 'bin';
          const filename = `${id}.${safeExt}`;
          const outPath = path.join(session.uploadsDir, filename);
          await fs.writeFile(outPath, storedBuffer);
          const attachmentUrl = `/uploads/${session.id}/${session.attachmentKey}/${filename}`;
          message.attachments.push({ name: att.name || filename, type: storedMimeType, url: attachmentUrl, size: storedBuffer.length, originalType: clientMimeType, originalSize: buffer.length });
        } catch (err) {
          log('attachment save failed', { err: String(err), attName: att.name });
        }
      }
    }
    session.messages.push(message);
    session.model = model;
    session.cli = cli;
    session.updatedAt = now;
    updatePending(sessionId, 1, session.userId);
    await persistState();
    await queueMessage(sessionId, message);
    sendJson(res, 202, { message });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to queue message' });
  }
}

// SSE endpoint for real-time streaming
async function handleMessageStream(req, res, sessionId, messageId, userId) {
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });

  const message = session.messages.find(m => m.id === messageId);
  if (!message) return sendJson(res, 404, { error: 'Message not found' });

  // Set up SSE headers
  res.writeHead(200, {
    'Content-Type': 'text/event-stream',
    'Cache-Control': 'no-cache',
    'Connection': 'keep-alive',
    'X-Accel-Buffering': 'no', // Disable nginx buffering
  });

  try { req.socket.setTimeout(0); } catch (_) { }
  try { req.socket.setKeepAlive(true); } catch (_) { }
  try { res.flushHeaders(); } catch (_) { }

  // Register this stream
  if (!activeStreams.has(messageId)) {
    activeStreams.set(messageId, new Set());
  }
  activeStreams.get(messageId).add(res);

  log('SSE stream opened', { sessionId, messageId, activeStreams: activeStreams.size });

  // Helper to cleanup this specific stream
  const cleanupStream = () => {
    clearInterval(heartbeat);
    clearTimeout(streamTimeout);
    if (activeStreams.has(messageId)) {
      activeStreams.get(messageId).delete(res);
      if (activeStreams.get(messageId).size === 0) {
        activeStreams.delete(messageId);
      }
    }
  };

  // Send initial status
  const initialData = JSON.stringify({
    type: 'start',
    messageId,
    status: message.status,
    timestamp: new Date().toISOString()
  });
  try {
    res.write(`data: ${initialData}\n\n`);
  } catch (err) {
    cleanupStream();
    return;
  }

  // If message already has output, send it
  if (message.partialOutput) {
    const catchupData = JSON.stringify({
      type: 'chunk',
      content: message.partialOutput,
      filtered: message.partialOutput,
      outputType: message.outputType,
      partialOutput: message.partialOutput,
      timestamp: message.partialUpdatedAt || new Date().toISOString()
    });
    try {
      res.write(`data: ${catchupData}\n\n`);
    } catch (_) {}
  }

  // If message is already done, send completion
  if (message.status === 'done' || message.status === 'error' || message.status === 'cancelled' || message.status === 'skipped') {
    const completeData = JSON.stringify({
      type: message.status === 'error' ? 'error' : 'complete',
      content: message.reply || message.partialOutput,
      error: message.error,
      outputType: message.outputType,
      exitCode: message.opencodeExitCode,
      timestamp: message.finishedAt || new Date().toISOString()
    });
    try {
      res.write(`data: ${completeData}\n\n`);
      res.end();
    } catch (_) {}
    cleanupStream();
    return;
  }

  // Stream timeout - close streams that have been open too long (30 minutes max)
  const STREAM_MAX_DURATION_MS = 30 * 60 * 1000;
  const streamTimeout = setTimeout(() => {
    try {
      const timeoutData = JSON.stringify({
        type: 'timeout',
        message: 'Stream timeout - please refresh to reconnect',
        timestamp: new Date().toISOString()
      });
      res.write(`data: ${timeoutData}\n\n`);
      res.end();
    } catch (_) {}
    cleanupStream();
    log('SSE stream timeout', { sessionId, messageId });
  }, STREAM_MAX_DURATION_MS);

  // Keep connection alive with heartbeat/pings.
  // Send a small data event periodically so proxies/load balancers don't treat the stream as idle.
  let heartbeatCount = 0;
  const heartbeat = setInterval(() => {
    try {
      heartbeatCount++;
      
      // Check if message has completed while stream was open
      const currentMsg = session.messages.find(m => m.id === messageId);
      if (currentMsg && (currentMsg.status === 'done' || currentMsg.status === 'error' || currentMsg.status === 'cancelled')) {
        // Message completed - send final status and close
        const completeData = JSON.stringify({
          type: currentMsg.status === 'error' ? 'error' : 'complete',
          content: currentMsg.reply || currentMsg.partialOutput,
          error: currentMsg.error,
          outputType: currentMsg.outputType,
          exitCode: currentMsg.opencodeExitCode,
          timestamp: currentMsg.finishedAt || new Date().toISOString()
        });
        res.write(`data: ${completeData}\n\n`);
        res.end();
        cleanupStream();
        return;
      }
      
      res.write(`: heartbeat ${heartbeatCount} ${Date.now()}\n\n`);
      const healthData = JSON.stringify({
        type: 'health',
        timestamp: new Date().toISOString(),
        heartbeatCount,
        status: currentMsg?.status || message.status
      });
      res.write(`data: ${healthData}\n\n`);
    } catch (err) {
      cleanupStream();
    }
  }, 15000);

  // Clean up on client disconnect
  req.on('close', () => {
    cleanupStream();
    log('SSE stream closed by client', { sessionId, messageId });
  });
  
  // Also handle errors
  req.on('error', (err) => {
    cleanupStream();
    log('SSE stream error', { sessionId, messageId, error: String(err) });
  });
  
  res.on('error', (err) => {
    cleanupStream();
    log('SSE response error', { sessionId, messageId, error: String(err) });
  });
}

// Check if opencode is currently running for a message
async function handleRunningStatus(req, res, sessionId, messageId, userId) {
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });

  const message = session.messages.find(m => m.id === messageId);
  if (!message) return sendJson(res, 404, { error: 'Message not found' });

  const isRunning = runningProcesses.has(messageId);
  const processInfo = runningProcesses.get(messageId);

  sendJson(res, 200, {
    running: isRunning,
    status: message.status,
    process: processInfo ? {
      started: processInfo.started,
      duration: Date.now() - processInfo.started,
      cli: processInfo.cli,
      model: processInfo.model
    } : null,
    hasOutput: !!(message.partialOutput || message.reply),
    outputType: message.outputType
  });
}

// Get current status of opencode CLI
async function handleOpencodeStatus(req, res) {
  const cliCommand = resolveCliCommand('opencode');
  
  // Get OpenCode process manager stats
  const managerStats = opencodeManager.getStats();
  
  try {
    const { stdout } = await runCommand(cliCommand, ['--version'], { timeout: 3000 });
    sendJson(res, 200, {
      available: true,
      version: stdout.trim(),
      command: cliCommand,
      runningProcesses: runningProcesses.size,
      activeStreams: activeStreams.size,
      processManager: {
        ...managerStats,
        mode: managerStats.isRunning ? 'singleton' : 'per-session',
        description: managerStats.isRunning 
          ? 'All sessions sharing single OpenCode instance' 
          : 'Each message spawns separate OpenCode process'
      }
    });
  } catch (error) {
    sendJson(res, 200, {
      available: false,
      error: error.message,
      command: cliCommand,
      runningProcesses: runningProcesses.size,
      activeStreams: activeStreams.size,
      processManager: {
        ...managerStats,
        mode: managerStats.isRunning ? 'singleton' : 'per-session'
      }
    });
  }
}

// Get memory and resource statistics for monitoring
async function handleMemoryStats(req, res) {
  const mem = process.memoryUsage();
  const now = Date.now();
  
  // Count sessions and messages
  let totalMessages = 0;
  let runningMessages = 0;
  let queuedMessages = 0;
  let oldSessions = 0;
  
  for (const session of state.sessions) {
    if (session.messages) {
      totalMessages += session.messages.length;
      for (const msg of session.messages) {
        if (msg.status === 'running') runningMessages++;
        if (msg.status === 'queued') queuedMessages++;
      }
    }
    // Check for old sessions
    const sessionAge = now - new Date(session.createdAt).getTime();
    if (sessionAge > SESSION_MAX_AGE_MS) oldSessions++;
  }
  
  sendJson(res, 200, {
    memory: {
      rss: `${(mem.rss / 1024 / 1024).toFixed(2)} MB`,
      heapTotal: `${(mem.heapTotal / 1024 / 1024).toFixed(2)} MB`,
      heapUsed: `${(mem.heapUsed / 1024 / 1024).toFixed(2)} MB`,
      external: `${(mem.external / 1024 / 1024).toFixed(2)} MB`,
      arrayBuffers: `${((mem.arrayBuffers || 0) / 1024 / 1024).toFixed(2)} MB`,
      raw: {
        rss: mem.rss,
        heapTotal: mem.heapTotal,
        heapUsed: mem.heapUsed,
        external: mem.external,
        arrayBuffers: mem.arrayBuffers || 0
      }
    },
    limits: {
      memoryBytes: RESOURCE_LIMITS.memoryBytes,
      memoryMb: `${(RESOURCE_LIMITS.memoryBytes / 1024 / 1024).toFixed(2)} MB`,
      cpuCores: RESOURCE_LIMITS.cpuCores,
      softMemoryRatio: RESOURCE_MEMORY_SOFT_RATIO,
      softMemoryBytes: RESOURCE_LIMITS.memoryBytes * RESOURCE_MEMORY_SOFT_RATIO
    },
    processes: {
      uptime: process.uptime(),
      pid: process.pid,
      cpuUsage: process.cpuUsage(),
      resourceReservations: resourceReservations
    },
    maps: {
      sessions: state.sessions.length,
      sessionQueues: sessionQueues.size,
      activeStreams: activeStreams.size,
      runningProcesses: runningProcesses.size,
      childProcesses: childProcesses.size,
      oauthStates: typeof oauthStateStore !== 'undefined' ? oauthStateStore.size : 0,
      loginAttempts: typeof loginAttempts !== 'undefined' ? loginAttempts.size : 0,
      adminLoginAttempts: typeof adminLoginAttempts !== 'undefined' ? adminLoginAttempts.size : 0,
      apiRateLimit: typeof apiRateLimit !== 'undefined' ? apiRateLimit.size : 0
    },
    messages: {
      total: totalMessages,
      running: runningMessages,
      queued: queuedMessages
    },
    sessions: {
      total: state.sessions.length,
      old: oldSessions
    },
    cleanup: {
      lastCleanup: lastMemoryCleanup,
      lastCleanupAgo: `${Math.round((now - lastMemoryCleanup) / 1000)}s ago`,
      cleanupIntervalMs: MEMORY_CLEANUP_INTERVAL_MS
    },
    load: {
      loadAvg: os.loadavg(),
      freeMem: `${(os.freemem() / 1024 / 1024).toFixed(2)} MB`,
      totalMem: `${(os.totalmem() / 1024 / 1024).toFixed(2)} MB`
    }
  });
}

// Trigger manual memory cleanup (admin only)
async function handleForceMemoryCleanup(req, res) {
  const session = requireAdminAuth(req, res);
  if (!session) return;
  
  const beforeMem = process.memoryUsage();
  triggerMemoryCleanup('admin_manual');
  const afterMem = process.memoryUsage();
  
  sendJson(res, 200, {
    ok: true,
    before: {
      rss: `${(beforeMem.rss / 1024 / 1024).toFixed(2)} MB`,
      heapUsed: `${(beforeMem.heapUsed / 1024 / 1024).toFixed(2)} MB`
    },
    after: {
      rss: `${(afterMem.rss / 1024 / 1024).toFixed(2)} MB`,
      heapUsed: `${(afterMem.heapUsed / 1024 / 1024).toFixed(2)} MB`
    },
    freed: {
      rss: `${((beforeMem.rss - afterMem.rss) / 1024 / 1024).toFixed(2)} MB`,
      heapUsed: `${((beforeMem.heapUsed - afterMem.heapUsed) / 1024 / 1024).toFixed(2)} MB`
    }
  });
}

// Handle undo request - sends /undo command to opencode to revert file changes
async function handleUndoMessage(req, res, sessionId, messageId, userId) {
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });

  const message = session.messages.find(m => m.id === messageId);
  if (!message) return sendJson(res, 404, { error: 'Message not found' });

  // Only allow undo for opencode messages
  if (message.cli !== 'opencode') {
    return sendJson(res, 400, { error: 'Undo only available for opencode messages' });
  }

  try {
    log('Sending undo command to opencode', { sessionId, messageId, opencodeSessionId: session.opencodeSessionId });

    const cliCommand = resolveCliCommand('opencode');
    const args = ['--message', '/undo'];

    // Add session if we have one
    if (session.opencodeSessionId) {
      args.push('--session', session.opencodeSessionId);
    }

    await runCommand(cliCommand, args, {
      cwd: session.workspaceDir || REPO_ROOT,
      timeout: 30000
    });

    log('Undo command completed', { sessionId, messageId });
    sendJson(res, 200, { ok: true, message: 'Undo command sent successfully' });
  } catch (error) {
    log('Undo command failed', { sessionId, messageId, error: String(error) });
    sendJson(res, 500, { error: `Undo failed: ${error.message}` });
  }
}

async function handleRedoMessage(req, res, sessionId, messageId, userId) {
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });

  const message = session.messages.find(m => m.id === messageId);
  if (!message) return sendJson(res, 404, { error: 'Message not found' });

  // Only allow redo for opencode messages
  if (message.cli !== 'opencode') {
    return sendJson(res, 400, { error: 'Redo only available for opencode messages' });
  }

  // Ensure we have an opencode session
  if (!session.opencodeSessionId) {
    return sendJson(res, 400, { error: 'No opencode session found. Cannot redo without an active session.' });
  }

  try {
    log('Sending redo command to opencode', { sessionId, messageId, opencodeSessionId: session.opencodeSessionId });

    const cliCommand = resolveCliCommand('opencode');
    const args = ['--message', '/redo', '--session', session.opencodeSessionId];

    await runCommand(cliCommand, args, {
      cwd: session.workspaceDir || REPO_ROOT,
      timeout: 30000
    });

    log('Redo command completed', { sessionId, messageId });
    sendJson(res, 200, { ok: true, message: 'Redo command sent successfully' });
  } catch (error) {
    log('Redo command failed', { sessionId, messageId, error: String(error) });
    sendJson(res, 500, { error: `Redo failed: ${error.message}` });
  }
}

// Add small debug logging for message lifecycle

function traceMessageLifecycle(stage, sessionId, message) {
  try {
    const snippet = (message && message.content) ? (String(message.content).slice(0, 200)) : '';
    log(`message ${stage}`, { sessionId, messageId: message && message.id, model: message && message.model, snippet });
  } catch (err) {
    log('traceMessageLifecycle error', { err: String(err) });
  }
}

async function handleUpdateSession(req, res, sessionId, userId) {
  const session = getSession(sessionId, userId);
  if (!session) return sendJson(res, 404, { error: 'Session not found' });
  try {
    const body = await parseJsonBody(req);
    let changed = false;
    if (body.model && typeof body.model === 'string' && body.model.trim()) {
      const plan = resolveUserPlan(session.userId);
      session.model = resolvePlanModel(plan, body.model.trim());
      session.updatedAt = new Date().toISOString();
      changed = true;
    }
    if (body.title && typeof body.title === 'string' && body.title.trim()) {
      session.title = body.title.trim();
      session.updatedAt = new Date().toISOString();
      changed = true;
    }
    if (body.cli && typeof body.cli === 'string') {
      session.cli = normalizeCli(body.cli);
      session.updatedAt = new Date().toISOString();
      changed = true;
    }
    if (changed) await persistState();
    sendJson(res, 200, { session: serializeSession(session) });
  } catch (error) {
    sendJson(res, 400, { error: error.message || 'Unable to update session' });
  }
}

async function handleDeleteSession(req, res, sessionId, userId) {
  const idx = state.sessions.findIndex((s) => s.id === sessionId && s.userId === userId);
  if (idx === -1) return sendJson(res, 404, { error: 'Session not found' });
  const removed = state.sessions.splice(idx, 1)[0];
  // Remove any queue for the session
  if (sessionQueues.has(sessionId)) sessionQueues.delete(sessionId);
  // Delete workspace directory from disk
  if (removed.workspaceDir) {
    const workspaceRoot = path.resolve(WORKSPACES_ROOT);
    const workspacePath = path.resolve(removed.workspaceDir);
    if (workspacePath.startsWith(workspaceRoot)) {
      try {
        await fs.rm(workspacePath, { recursive: true, force: true });
        log('workspace directory deleted', { sessionId, workspacePath });
      } catch (err) {
        log('workspace directory cleanup failed', { sessionId, workspacePath, err: String(err) });
      }
    }
  }
  try { await persistState(); } catch (err) { log('failed to persist state after delete', { err: String(err) }); }
  log('session deleted', { id: sessionId });
  sendJson(res, 200, { ok: true, session: serializeSession(removed) });
}

async function handleDiagnostics(_req, res) {
  try {
    const versionRes = await runCommand('opencode', ['--version'], { timeout: 5000 }).catch((e) => ({ stdout: e.stdout, stderr: e.stderr, code: e.code }));
    const modelRes = await runCommand('opencode', ['models', '--json'], { timeout: 10000 }).catch((e) => ({ stdout: e.stdout, stderr: e.stderr, code: e.code }));
    sendJson(res, 200, { version: versionRes.stdout || versionRes.stderr, modelsOutput: modelRes.stdout || modelRes.stderr });
  } catch (error) {
    sendJson(res, 500, { error: String(error.message || error) });
  }
}

async function handleAccountClaim(req, res, userId) {
  try {
    // Require proper user authentication for account claiming
    const session = requireUserAuth(req, res);
    if (!session) return;

    const body = await parseJsonBody(req);
    const previousUserId = sanitizeSegment(body.previousUserId || body.deviceUserId || body.fromUserId || '', '');
    const targetUserId = session.userId; // Use the authenticated user ID

    if (!previousUserId || previousUserId === targetUserId) {
      return sendJson(res, 200, { ok: true, moved: 0, skipped: 0 });
    }

    const result = await migrateUserSessions(previousUserId, targetUserId);
    log('account claim completed', { previousUserId, targetUserId, moved: result.moved, skipped: result.skipped });
    return sendJson(res, 200, { ok: true, moved: result.moved, skipped: result.skipped });
  } catch (error) {
    return sendJson(res, 400, { error: error.message || 'Unable to claim account' });
  }
}

async function handleUploadApp(req, res, userId) {
  const plan = resolveUserPlan(userId);
  if (!isPaidPlan(plan)) {
    return sendJson(res, 403, { error: 'Uploading existing apps is available on Business and Enterprise plans.' });
  }

  // Base64 adds ~33% overhead (4/3 ratio); allow a small buffer over that.
  const uploadLimit = Math.max(MAX_JSON_BODY_SIZE, Math.ceil(MAX_UPLOAD_ZIP_SIZE * BASE64_OVERHEAD_MULTIPLIER));
  let body;
  try {
    body = await parseJsonBody(req, uploadLimit);
  } catch (err) {
    return sendJson(res, 400, { error: err.message || 'Invalid upload payload' });
  }

  const rawData = (body.data || body.fileData || '').toString();
  if (!rawData) return sendJson(res, 400, { error: 'ZIP file is required' });

  let zipBuffer;
  try {
    zipBuffer = decodeBase64Payload(rawData);
  } catch (err) {
    return sendJson(res, 400, { error: 'Could not decode uploaded file' });
  }

  if (!zipBuffer || !zipBuffer.length) return sendJson(res, 400, { error: 'ZIP file is empty' });
  if (zipBuffer.length > MAX_UPLOAD_ZIP_SIZE) {
    const mb = Math.ceil(MAX_UPLOAD_ZIP_SIZE / (1024 * 1024));
    return sendJson(res, 413, { error: `ZIP too large. Maximum size is ${mb} MB.` });
  }
  if (!isLikelyZip(zipBuffer)) return sendJson(res, 400, { error: 'Only ZIP archives are supported.' });

  const displayName = (body.title || body.name || body.fileName || 'Uploaded App').toString().trim() || 'Uploaded App';
  const baseName = path.parse(body.fileName || displayName).name || displayName;
  const desiredAppId = sanitizeSegment(body.appId || baseName, '');

  let session;
  try {
    session = await createSession({
      title: displayName,
      appId: desiredAppId,
      cli: 'opencode',
      model: 'default',
      entryMode: 'opencode',
      source: 'upload',
      planApproved: true,
    }, userId, desiredAppId);

    // Ensure workspace exists and is clean
    if (session.workspaceDir) {
      const workspaceRoot = path.resolve(WORKSPACES_ROOT);
      const workspacePath = path.resolve(session.workspaceDir);
      if (!workspacePath.startsWith(workspaceRoot)) throw new Error('Invalid workspace path');
      await fs.rm(workspacePath, { recursive: true, force: true }).catch((err) => {
        log('workspace cleanup failed', { path: workspacePath, err: String(err) });
      });
      await fs.mkdir(workspacePath, { recursive: true });
    }
    if (session.uploadsDir) {
      await fs.mkdir(session.uploadsDir, { recursive: true }).catch(() => { });
    }

    const files = await extractZipToWorkspace(zipBuffer, session.workspaceDir);
    session.planSummary = session.planSummary || 'Imported from ZIP upload';
    session.planUserRequest = session.planUserRequest || displayName;
    await persistState();
    return sendJson(res, 201, { session: serializeSession(session), files });
  } catch (error) {
    // Clean up the failed session if it exists
    if (session) {
      const idx = state.sessions.findIndex((s) => s.id === session.id);
      if (idx !== -1) state.sessions.splice(idx, 1);
      try { await persistState(); } catch (_) { }
      if (session.workspaceDir) {
        try { await fs.rm(session.workspaceDir, { recursive: true, force: true }); } catch (_) { }
      }
    }
    return sendJson(res, 500, { error: `Unable to import ZIP: ${error.message}` });
  }
}

// Export app as ZIP file
async function handleExportZip(_req, res, sessionId, userId) {
  try {
    const session = getSession(sessionId, userId);
    if (!session) return sendJson(res, 404, { error: 'Session not found' });
    await ensureSessionPaths(session);

    // Track export start
    const userPlan = resolveUserPlan(session.userId);
    trackUserSession(session.userId, 'export', { 
      exportType: 'zip',
      sessionId: sessionId,
      appId: session.appId,
      plan: userPlan
    });
    trackFeatureUsage('app_export', session.userId, userPlan);
    trackConversionFunnel('app_export', 'export_started', session.userId, {
      sessionId: sessionId,
      appId: session.appId,
      plan: userPlan
    });

    log('Starting export to ZIP...', { sessionId, userId: session.userId, workspace: session.workspaceDir });

    // Check if workspace directory exists and has files
    let validFiles = [];
    try {
      await fs.access(session.workspaceDir);
      // Collect all valid files with their relative paths
      await collectValidFiles(session.workspaceDir, session.workspaceDir, validFiles, [
        'node_modules',
        '.git',
        '.data',
        'uploads',
        '*.log',
        '*.zip'
      ]);

      if (validFiles.length === 0) {
        log('Workspace is empty', { workspace: session.workspaceDir });
        return sendJson(res, 400, {
          error: 'No app content found to export. Please create or build your app first before exporting.'
        });
      }

      // Check file count limit
      if (validFiles.length > MAX_EXPORT_FILE_COUNT) {
        log('Workspace exceeds file count limit', { workspace: session.workspaceDir, fileCount: validFiles.length, limit: MAX_EXPORT_FILE_COUNT });
        return sendJson(res, 400, {
          error: `Export contains too many files (${validFiles.length}). Maximum allowed is ${MAX_EXPORT_FILE_COUNT} files.`
        });
      }
    } catch (accessError) {
      log('Workspace directory not accessible', { workspace: session.workspaceDir, error: String(accessError) });
      return sendJson(res, 400, {
        error: 'App workspace not found. Please create your app first before exporting.'
      });
    }

    const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
    
    // Use pluginSlug for ZIP filename if available to ensure WordPress recognizes same plugin across versions
    const exportBaseName = session.pluginSlug || sanitizeSegment(session.appId || session.id || 'app-export', 'app-export');
    const zipFilename = `${exportBaseName}-${timestamp}.zip`;
    const zipPath = path.join('/tmp', zipFilename);

    // Create ZIP using archiver
    const output = fsSync.createWriteStream(zipPath);
    const archive = archiver('zip', { zlib: { level: 9 } });

    let fileCount = 0;
    let totalUncompressedSize = 0;

    // Set up size limit enforcement
    archive.on('entry', (data) => {
      fileCount++;
      totalUncompressedSize += data.size;
      if (totalUncompressedSize > MAX_EXPORT_ZIP_SIZE) {
        archive.emit('error', new Error(`Export size exceeds ${Math.ceil(MAX_EXPORT_ZIP_SIZE / (1024 * 1024))}MB limit`));
      }
    });

    await new Promise(async (resolve, reject) => {
      output.on('close', resolve);
      archive.on('error', (err) => {
        // Clean up temp file on error
        fs.unlink(zipPath).catch(() => { });
        reject(err);
      });
      archive.pipe(output);

      // Find the main plugin PHP file by looking for WordPress plugin header
      let mainPluginFile = null;
      let pluginContent = null;
      
      for (const fileInfo of validFiles) {
        if (fileInfo.fullPath.endsWith('.php')) {
          try {
            const content = await fs.readFile(fileInfo.fullPath, 'utf-8');
            // Check for WordPress plugin header
            if (content.includes('Plugin Name:') || content.includes('Plugin URI:')) {
              mainPluginFile = fileInfo;
              pluginContent = content;
              break;
            }
          } catch (err) {
            // Continue if we can't read the file
          }
        }
      }
      
      // Determine the plugin folder name
      // WordPress identifies plugins by folder name + main file name
      let pluginFolderName = session.pluginSlug;
      
      if (mainPluginFile && !pluginFolderName) {
        // If we don't have a pluginSlug, derive it from the main plugin file
        const pathParts = mainPluginFile.fullPath.split(path.sep);
        const mainPluginFolderIndex = pathParts.length - 2;
        if (mainPluginFolderIndex >= 0) {
          const existingFolder = pathParts[mainPluginFolderIndex];
          pluginFolderName = existingFolder;
          log('Using folder from main plugin file', { file: mainPluginFile.relativePath, folder: existingFolder });
        }
      } else if (mainPluginFile && pluginFolderName) {
        const pathParts = mainPluginFile.fullPath.split(path.sep);
        const mainPluginFolderIndex = pathParts.length - 2;
        if (mainPluginFolderIndex >= 0) {
          const existingFolder = pathParts[mainPluginFolderIndex];
          log('Plugin folder will be normalized', { file: mainPluginFile.relativePath, existingFolder, pluginSlug: pluginFolderName });
        }
      }
      
      // Determine the optimal root to avoid nested wrappers
      const optimalRoot = findOptimalExportRoot(validFiles, session.workspaceDir);

      // Add files to archive with corrected paths
      // For WordPress plugins, we MUST ensure the folder name is consistent across exports
      // WordPress identifies plugins by: folder-name/main-file.php
      const wrapInPluginFolder = pluginFolderName ? pluginFolderName : null;
      
      // Check if we should rename the existing folder to match pluginSlug
      // This is critical for WordPress to recognize it as the same plugin across exports
      let renameFirstLevelDir = null;
      
      if (wrapInPluginFolder) {
        // Analyze first-level directory structure (only actual directories, not files)
        const firstLevelDirs = new Set();
        for (const fileInfo of validFiles) {
          const relativePath = path.relative(optimalRoot, fileInfo.fullPath);
          const parts = relativePath.split(path.sep);
          if (parts.length > 1 && parts[0]) {
            firstLevelDirs.add(parts[0]);
          }
        }
        
        // If there's exactly one first-level directory and it doesn't match our target,
        // we'll rename it in the archive
        if (firstLevelDirs.size === 1) {
          const existingDir = Array.from(firstLevelDirs)[0];
          if (existingDir !== wrapInPluginFolder) {
            renameFirstLevelDir = existingDir;
            log('Renaming plugin folder for consistency', { from: existingDir, to: wrapInPluginFolder });
          }
        } else if (firstLevelDirs.size === 0) {
          // No subdirectories, files are at root level of optimalRoot
          // We'll wrap them in the pluginSlug folder
          log('Files at root level, wrapping in plugin folder', { folder: wrapInPluginFolder });
        }
      }
      
      for (const fileInfo of validFiles) {
        const relativePath = path.relative(optimalRoot, fileInfo.fullPath);
        
        if (wrapInPluginFolder) {
          let archivePath;
          
          if (renameFirstLevelDir) {
            // Rename the first-level directory to match pluginSlug
            const pathParts = relativePath.split(path.sep);
            if (pathParts[0] === renameFirstLevelDir) {
              pathParts[0] = wrapInPluginFolder;
              archivePath = pathParts.join(path.sep);
            } else {
              archivePath = path.join(wrapInPluginFolder, relativePath);
            }
          } else {
            // Wrap in pluginSlug folder
            archivePath = path.join(wrapInPluginFolder, relativePath);
          }
          
          archive.file(fileInfo.fullPath, { name: archivePath });
        } else {
          archive.file(fileInfo.fullPath, { name: relativePath });
        }
      }

      archive.finalize();
    });

    // Check if any files were added to the archive
    if (fileCount === 0) {
      await fs.unlink(zipPath).catch(() => { });
      log('No files added to archive', { workspace: session.workspaceDir });
      return sendJson(res, 400, {
        error: 'No files found to export. Your app workspace appears to be empty.'
      });
    }

    // Read and send the ZIP file
    const zipContent = await fs.readFile(zipPath);

    // Check final size limit
    if (zipContent.length > MAX_EXPORT_ZIP_SIZE) {
      await fs.unlink(zipPath).catch(() => { });
      log('Export exceeds size limit', { size: zipContent.length, limit: MAX_EXPORT_ZIP_SIZE });
      return sendJson(res, 400, {
        error: `Export size (${Math.ceil(zipContent.length / (1024 * 1024))}MB) exceeds the maximum allowed size (${Math.ceil(MAX_EXPORT_ZIP_SIZE / (1024 * 1024))}MB). Try excluding large files like images or binaries.`
      });
    }

    // Clean up temp file
    await fs.unlink(zipPath).catch(() => { });

    res.writeHead(200, {
      'Content-Type': 'application/zip',
      'Content-Disposition': `attachment; filename="${zipFilename}"`,
      'Content-Length': zipContent.length
    });
    res.end(zipContent);
    log('Export completed successfully', { filename: zipFilename, size: zipContent.length, fileCount });
  } catch (error) {
    if (error.message && error.message.includes('size exceeds')) {
      return sendJson(res, 400, { error: error.message });
    }
    log('Export failed', { error: String(error) });
    sendJson(res, 500, { error: `Export failed: ${error.message}` });
  }
}

// Helper function to collect all valid files recursively
async function collectValidFiles(rootDir, currentDir, validFiles, excludePatterns) {
  let entries;
  try {
    entries = await fs.readdir(currentDir, { withFileTypes: true });
  } catch {
    return;
  }

  for (const entry of entries) {
    const fullPath = path.join(currentDir, entry.name);
    const relativePath = path.relative(rootDir, fullPath);
    const parts = relativePath.split(path.sep);

    // Check if any part matches exclusion patterns
    const isExcluded = parts.some(part => {
      if (part.startsWith('.')) return true;
      if (excludePatterns.includes(part)) return true;
      // Check wildcard patterns like *.log, *.zip
      return excludePatterns.some(pattern => {
        if (pattern.startsWith('*.')) {
          const ext = pattern.slice(1);
          return entry.name.endsWith(ext);
        }
        return false;
      });
    });

    if (isExcluded) continue;

    if (entry.isDirectory()) {
      await collectValidFiles(rootDir, fullPath, validFiles, excludePatterns);
    } else if (entry.isFile()) {
      // Exclude files named opencode.json specifically
      if (entry.name !== 'opencode.json') {
        validFiles.push({ fullPath, relativePath });
      }
    }
  }
}

// Helper function to find the optimal root for export
// Avoids single-level wrapper folders that contain everything
function findOptimalExportRoot(files, workspaceRoot) {
  if (files.length === 0) return workspaceRoot;

  // Get all unique first-level directories
  const firstLevelDirs = new Set();
  const firstLevelFiles = new Set();

  for (const fileInfo of files) {
    const relativePath = fileInfo.relativePath;
    const parts = relativePath.split(path.sep);
    if (parts.length > 1) {
      firstLevelDirs.add(parts[0]);
    } else {
      firstLevelFiles.add(parts[0]);
    }
  }

  // If there are files directly at the root level, that's the optimal root
  if (firstLevelFiles.size > 0) {
    return workspaceRoot;
  }

  // If there's only one first-level directory, check if it's a wrapper
  if (firstLevelDirs.size === 1) {
    const singleDir = Array.from(firstLevelDirs)[0];
    const allFilesInSingleDir = files.every(f => {
      const parts = f.relativePath.split(path.sep);
      return parts[0] === singleDir;
    });

    // Check if this single directory looks like a wrapper (has no direct files, only subdirs)
    const filesInSingleDir = files.filter(f => {
      const parts = f.relativePath.split(path.sep);
      return parts[0] === singleDir;
    });

    const hasDirectFilesInSingleDir = filesInSingleDir.some(f => {
      const parts = f.relativePath.split(path.sep);
      return parts.length === 2; // Only one level deep in the single dir
    });

    // If all files are in a single subdirectory and there are direct files there,
    // we should use that subdirectory as the root
    if (allFilesInSingleDir && hasDirectFilesInSingleDir) {
      return path.join(workspaceRoot, singleDir);
    }
  }

  // Default to workspace root
  return workspaceRoot;
}

// Helper function to get all files recursively (alternative approach)
async function getAllFilesRecursively(dir) {
  const files = [];
  try {
    const entries = await fs.readdir(dir, { withFileTypes: true });
    for (const entry of entries) {
      const fullPath = path.join(dir, entry.name);
      if (entry.isDirectory()) {
        files.push(...await getAllFilesRecursively(fullPath));
      } else if (entry.isFile()) {
        files.push(fullPath);
      }
    }
  } catch {
    // Directory might not exist or be accessible
  }
  return files;
}

async function handleListTemplates(req, res) {
  try {
    const templatesPath = path.join(__dirname, 'templates', 'templates.json');
    const content = await fs.readFile(templatesPath, 'utf-8');
    const templates = JSON.parse(content);
    sendJson(res, 200, { templates });
  } catch (error) {
    if (error.code === 'ENOENT') {
      return sendJson(res, 200, { templates: [] });
    }
    log('Failed to list templates', { error: String(error) });
    sendJson(res, 500, { error: 'Failed to list templates' });
  }
}

async function runGit(commands, opts = {}) {
  // Ensure git operations are serialized to avoid concurrent fetch/pulls producing
  // "cannot lock ref" errors when remote refs change during a simultaneous fetch.
  // We also retry on transient ref lock errors ("cannot lock ref", "unable to update local ref",
  // "index.lock") a few times with backoff to reduce races.
  if (!global.__opencode_git_queue) global.__opencode_git_queue = Promise.resolve();
  const enqueue = (workFn) => {
    const next = global.__opencode_git_queue.then(() => workFn());
    // Prevent the queue from getting rejected - keep it alive
    global.__opencode_git_queue = next.catch(() => { });
    return next;
  };

  const worker = async () => {
    let last = '';
    let combinedStdout = '';
    let combinedStderr = '';
    const credentials = (opts && opts.credentials) ? opts.credentials : null;
    const os = require('os');
    const tmpdir = require('path');
    const fsSync = require('fs');
    const tmp = require('fs/promises');
    let tempHomeDir;
    let envOverride = null;
    if (credentials && credentials.username && credentials.pat) {
      const prefix = 'web-chat-netrc-';
      tempHomeDir = await tmp.mkdtemp(tmpdir.join(os.tmpdir(), prefix));
      const netrcPath = tmpdir.join(tempHomeDir, '.netrc');
      const netrcContent = `machine github.com\nlogin ${credentials.username}\npassword ${credentials.pat}\n`;
      await tmp.writeFile(netrcPath, netrcContent, { mode: 0o600, encoding: 'utf8' });
      envOverride = { ...process.env, HOME: tempHomeDir, GIT_TERMINAL_PROMPT: '0' };
    }
    try {
      for (const step of commands) {
        const shouldRetryOnRefLock = step.cmd === 'git' && Array.isArray(step.args) && (step.args.includes('pull') || step.args.includes('fetch'));
        let attempt = 0;
        while (true) {
          attempt += 1;
          try {
            const spawnOpts = { cwd: REPO_ROOT };
            if (envOverride) spawnOpts.env = envOverride;
            const { stdout, stderr } = await runCommand(step.cmd, step.args, spawnOpts);
            combinedStdout += stdout || '';
            combinedStderr += stderr || '';
            last = stdout || last;
            break; // step succeeded
          } catch (error) {
            // If this looks like a remote ref lock/update race, retry a few times
            const stderrData = String(error.stderr || '').toLowerCase() + ' ' + String(error.stdout || '').toLowerCase();
            if (shouldRetryOnRefLock && attempt < 4 && (stderrData.includes('cannot lock ref') || stderrData.includes('unable to update local ref') || stderrData.includes('index.lock'))) {
              const backoff = Math.min(2000, 100 * Math.pow(2, attempt));
              log('Git operation had a ref-lock problem, retrying', { cmd: step.cmd, args: step.args, attempt, backoff, stderr: error.stderr || error.stdout || '' });
              await new Promise((r) => setTimeout(r, backoff));
              continue; // try again
            }
            const err = new Error(String(error.message || error));
            err.stdout = (combinedStdout || '') + (error.stdout || '');
            err.stderr = (combinedStderr || '') + (error.stderr || '');
            throw err;
          }
        }
      }
    } finally {
      if (tempHomeDir) {
        try { await tmp.rm(tempHomeDir, { recursive: true, force: true }); } catch (ignore) { }
      }
    }
    const result = { stdout: (combinedStdout || '').trim(), stderr: (combinedStderr || '').trim(), last: (last || '').trim() };
    return result;
  }

  // Run a serialized git worker so commands don't run concurrently.
  return enqueue(worker);
}

// Attempt to create an opencode session on the CLI side. Returns the id if created or null.
async function createOpencodeSession(wantedId, model, cwd) {
  const cliCommand = resolveCliCommand('opencode');
  const candidates = [
    ['session', 'create', '--id', wantedId, '--model', model, '--json'],
    ['session', 'create', '--id', wantedId, '--json'],
    ['sessions', 'create', '--id', wantedId, '--model', model, '--json'],
    ['sessions', 'create', '--id', wantedId, '--json'],
    ['session', 'create', '--model', model, '--json'],
    ['sessions', 'create', '--model', model, '--json'],
    ['session', 'create', '--json'],
  ];
  for (const args of candidates) {
    try {
      log('creating opencode session (candidate)', { args });
      const { stdout } = await runCommand(cliCommand, args, { timeout: 15000, cwd: cwd || REPO_ROOT });
      try {
        const parsed = JSON.parse(stdout);
        const id = parsed.id || (parsed.session && parsed.session.id) || parsed.sessionId || parsed.session_id || null;
        if (id) return id;
        if (typeof parsed === 'string' && parsed.startsWith('ses-')) return parsed;
      } catch (_) {
        const lines = stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
        for (const line of lines) {
          const m = line.match(/(ses-[a-f0-9\-]+)/i);
          if (m) return m[1];
        }
      }
    } catch (err) {
      log('session creation candidate failed', { args, stderr: err.stderr || err.stdout || String(err) });
    }
  }
  return null;
}

async function listOpencodeSessions(cwd) {
  const cliCommand = resolveCliCommand('opencode');
  const candidates = [
    ['session', '--list', '--json'],
    ['sessions', '--list', '--json'],
    ['session', 'list', '--json'],
    ['sessions', 'list', '--json'],
  ];

  for (const args of candidates) {
    try {
      const { stdout } = await runCommand(cliCommand, args, { timeout: 7000, cwd });
      if (!stdout || !stdout.trim()) continue;

      try {
        const parsed = JSON.parse(stdout);
        const items = Array.isArray(parsed)
          ? parsed
          : (Array.isArray(parsed.sessions) ? parsed.sessions
            : (Array.isArray(parsed.data) ? parsed.data
              : (Array.isArray(parsed.items) ? parsed.items : [])));

        return items.map((it) => ({
          id: it?.id || it?.sessionId || it?.session_id || null,
          createdAt: it?.createdAt || it?.created_at || it?.startedAt || it?.startTime || null,
          updatedAt: it?.updatedAt || it?.updated_at || it?.lastUpdatedAt || it?.last_updated_at || null,
        })).filter((it) => it.id);
      } catch (_) {
        const matches = stdout.match(/ses[-_][a-zA-Z0-9-]+/g) || [];
        return matches.map((id) => ({ id }));
      }
    } catch (_) {
      // try next candidate
    }
  }

  return [];
}

async function getOpencodeSessionTokenUsage(sessionId, cwd) {
  if (!sessionId || !cwd) {
    log('⚠️  getOpencodeSessionTokenUsage: Missing required parameters', { hasSessionId: !!sessionId, hasCwd: !!cwd });
    return 0;
  }
  
  const cliCommand = resolveCliCommand('opencode');
  const candidates = [
    ['session', 'info', '--id', sessionId, '--json'],
    ['sessions', 'info', '--id', sessionId, '--json'],
    ['session', 'info', sessionId, '--json'],
    ['session', 'usage', '--id', sessionId, '--json'],
    ['session', 'show', '--id', sessionId, '--json'],
  ];

  log('🔍 getOpencodeSessionTokenUsage: Starting session token query', { 
    sessionId, 
    cwd, 
    cliCommand,
    candidateCount: candidates.length,
    candidates: candidates.map(c => c.join(' '))
  });

  const attemptResults = [];

  for (const args of candidates) {
    const cmdStr = args.join(' ');
    try {
      log(`  → Trying: ${cliCommand} ${cmdStr}`, { sessionId });
      const { stdout, stderr } = await runCommand(cliCommand, args, { timeout: 10000, cwd });
      
      const hasStdout = stdout && stdout.trim();
      const hasStderr = stderr && stderr.trim();
      
      log(`  ← Response received`, { 
        args: cmdStr, 
        hasStdout, 
        hasStderr,
        stdoutLength: stdout?.length || 0,
        stderrLength: stderr?.length || 0,
        stdoutSample: stdout?.substring(0, 300),
        stderrSample: stderr?.substring(0, 200)
      });

      if (hasStdout) {
        // Try JSON parsing first
        try {
          const parsed = JSON.parse(stdout);
          log('  ✓ JSON parse successful', { 
            args: cmdStr,
            parsedKeys: Object.keys(parsed),
            hasUsage: !!parsed.usage,
            hasTokens: !!parsed.tokens,
            hasTokensUsed: !!parsed.tokensUsed,
            hasSession: !!parsed.session
          });
          
          const extracted = extractTokenUsage(parsed) || extractTokenUsage(parsed.session) || null;
          const tokens = extracted?.tokens || 0;

          if (typeof tokens === 'number' && tokens > 0) {
            log('✅ getOpencodeSessionTokenUsage: Successfully extracted tokens from JSON', { 
              sessionId, 
              tokens, 
              command: cmdStr,
              extractionPath: extracted?.source || 'unknown'
            });
            attemptResults.push({ command: cmdStr, success: true, tokens, source: 'json' });
            return tokens;
          } else {
            const reason = typeof tokens !== 'number' ? `tokens is ${typeof tokens}, not number` : 'tokens is 0 or negative';
            log('  ✗ JSON parsed but no valid token count', { args: cmdStr, tokens, reason });
            attemptResults.push({ command: cmdStr, success: false, reason, parsedTokens: tokens, source: 'json' });
          }
        } catch (jsonErr) {
          log('  ✗ JSON parse failed, trying text parse', { 
            args: cmdStr,
            error: jsonErr.message,
            stdoutSample: stdout.substring(0, 200)
          });
          
          // Try to parse token count from text output
          const tokenMatch = stdout.match(/total[_\s-]?tokens?\s*[:=]?\s*(\d+)/i) ||
                             stdout.match(/tokens?\s*[:=]?\s*(\d+)/i) ||
                             stdout.match(/token\s*count\s*[:=]?\s*(\d+)/i);
          if (tokenMatch) {
            const tokens = parseInt(tokenMatch[1], 10);
            if (tokens > 0) {
              log('✅ getOpencodeSessionTokenUsage: Successfully extracted tokens from text', { 
                sessionId, 
                tokens, 
                command: cmdStr,
                pattern: tokenMatch[0]
              });
              attemptResults.push({ command: cmdStr, success: true, tokens, source: 'text', pattern: tokenMatch[0] });
              return tokens;
            } else {
              log('  ✗ Text pattern matched but tokens <= 0', { args: cmdStr, tokens, pattern: tokenMatch[0] });
              attemptResults.push({ command: cmdStr, success: false, reason: 'matched text pattern but tokens <= 0', parsedTokens: tokens, source: 'text' });
            }
          } else {
            log('  ✗ No text patterns matched', { args: cmdStr, stdoutSample: stdout.substring(0, 200) });
            attemptResults.push({ command: cmdStr, success: false, reason: 'no text patterns matched', source: 'text' });
          }
        }
      } else {
        const reason = !stdout ? 'no stdout' : 'stdout is empty';
        log('  ✗ No stdout to parse', { args: cmdStr, reason, hasStderr });
        attemptResults.push({ command: cmdStr, success: false, reason, stderr: stderr?.substring(0, 200) });
      }
    } catch (err) {
      const errorDetails = {
        message: err.message,
        stderr: err.stderr?.substring(0, 200),
        stdout: err.stdout?.substring(0, 200),
        code: err.code
      };
      log('  ✗ Command execution failed', { args: cmdStr, error: errorDetails });
      attemptResults.push({ command: cmdStr, success: false, error: errorDetails });
    }
  }
  
  log('❌ getOpencodeSessionTokenUsage: All commands failed', { 
    sessionId, 
    totalAttempts: attemptResults.length,
    attemptResults
  });
  return 0;
}

async function handleGit(req, res, action) {
  // Validate git action
  if (!validateGitAction(action)) {
    return sendJson(res, 400, { error: 'Invalid git action' });
  }

  try {
    const body = req.method === 'POST' ? await parseJsonBody(req) : {};
    let output = '';
    let _stdout = '';
    let _stderr = '';
    if (action === 'pull') {
      // Use plain git pull (no rebase)
      const result = await runGit([{ cmd: 'git', args: ['pull'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
      output = result.stdout || result.last || '';
      _stdout = result.stdout;
      _stderr = result.stderr;
    } else if (action === 'push') {
      const message = sanitizeGitMessage(body.message) || 'Update from chat UI';
      // Add all changes (use `git add .` rather than `-A`)
      await runGit([{ cmd: 'git', args: ['add', '.'] }]);
      // Check if there are staged changes
      const statusResult = await runCommand('git', ['status', '--porcelain'], { cwd: REPO_ROOT, timeout: 60000 }).catch((e) => ({ stdout: e.stdout || '', stderr: e.stderr || '' }));
      if ((statusResult.stdout || '').trim().length === 0) {
        // Nothing to commit; just push
        const pushResult = await runGit([{ cmd: 'git', args: ['push', 'origin', 'main'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
        output = pushResult.stdout || pushResult.last || '';
        _stdout = pushResult.stdout;
        _stderr = pushResult.stderr;
      } else {
        const commitResult = await runGit([{ cmd: 'git', args: ['commit', '-m', message] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
        const pushResult = await runGit([{ cmd: 'git', args: ['push', 'origin', 'main'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
        output = `${commitResult.stdout || ''}\n${pushResult.stdout || ''}`.trim();
        _stdout = `${commitResult.stdout || ''}\n${pushResult.stdout || ''}`.trim();
        _stderr = `${commitResult.stderr || ''}\n${pushResult.stderr || ''}`.trim();
      }
    } else if (action === 'sync') {
      const message = sanitizeGitMessage(body.message) || 'Update from chat UI';
      // Sync: pull; add; commit if needed; push
      const resultPull = await runGit([{ cmd: 'git', args: ['pull'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
      await runGit([{ cmd: 'git', args: ['add', '.'] }]);
      const statusResult2 = await runCommand('git', ['status', '--porcelain'], { cwd: REPO_ROOT, timeout: 60000 }).catch((e) => ({ stdout: e.stdout || '', stderr: e.stderr || '' }));
      if ((statusResult2.stdout || '').trim().length === 0) {
        const pushResult = await runGit([{ cmd: 'git', args: ['push', 'origin', 'main'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
        output = `${resultPull.stdout || ''}\n${pushResult.stdout || ''}`.trim();
        _stdout = `${resultPull.stdout || ''}\n${pushResult.stdout || ''}`.trim();
        _stderr = `${resultPull.stderr || ''}\n${pushResult.stderr || ''}`.trim();
      } else {
        const commitResult = await runGit([{ cmd: 'git', args: ['commit', '-m', message] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
        const pushResult = await runGit([{ cmd: 'git', args: ['push', 'origin', 'main'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
        output = `${resultPull.stdout || ''}\n${commitResult.stdout || ''}\n${pushResult.stdout || ''}`.trim();
        _stdout = `${resultPull.stdout || ''}\n${commitResult.stdout || ''}\n${pushResult.stdout || ''}`.trim();
        _stderr = `${resultPull.stderr || ''}\n${commitResult.stderr || ''}\n${pushResult.stderr || ''}`.trim();
      }
    } else if (action === 'status') {
      const { stdout, stderr } = await runCommand('git', ['status', '--short'], { cwd: REPO_ROOT, timeout: 20000 });
      output = stdout;
      _stdout = stdout;
      _stderr = stderr;
    } else if (action === 'log') {
      const { stdout, stderr } = await runCommand('git', ['log', '--oneline', '-n', '20'], { cwd: REPO_ROOT, timeout: 20000 });
      output = stdout;
      _stdout = stdout;
      _stderr = stderr;
    } else if (action === 'fetch') {
      const result = await runGit([{ cmd: 'git', args: ['fetch', '--all'] }], { credentials: { username: process.env.GITHUB_USERNAME, pat: process.env.GITHUB_PAT } });
      output = result.stdout || result.last || '';
      _stdout = result.stdout;
      _stderr = result.stderr;
    } else {
      return sendJson(res, 400, { error: 'Unknown git action' });
    }
    sendJson(res, 200, { output, stdout: _stdout, stderr: _stderr });
  } catch (error) {
    const payload = { error: error.message || 'Git command failed' };
    if (error.stdout) payload.stdout = error.stdout;
    if (error.stderr) payload.stderr = error.stderr;
    sendJson(res, 500, payload);
  }
}

async function route(req, res) {
  try {
    // Validate and sanitize the URL to handle malformed requests
    const urlString = sanitizeUrl(req.url);
    const url = new URL(urlString, `http://${req.headers.host}`);
    const pathname = url.pathname;

    // Track visitor
    trackVisit(req, res);

    // Add rate limit headers to all responses
    const userId = resolveUserId(req, url);
    if (userId) {
      const rateLimit = checkApiRateLimit(userId);
      res.setHeader('X-RateLimit-Limit', rateLimit.limit);
      res.setHeader('X-RateLimit-Remaining', rateLimit.remaining);
      res.setHeader('X-RateLimit-Reset', rateLimit.resetIn);

      if (rateLimit.limited) {
        return sendRateLimitExceeded(res, rateLimit.resetIn, rateLimit.limit);
      }
    }

    // Add timing header for bot detection
    res.setHeader('X-Request-Time', Date.now());

    const affiliateParam = sanitizeAffiliateCode(url.searchParams.get('aff') || url.searchParams.get('affiliate'));
    if (affiliateParam && findAffiliateByCode(affiliateParam)) {
      setAffiliateReferralCookie(res, affiliateParam);
    }

    await routeInternal(req, res, url, pathname);
  } catch (error) {
    // Log all route errors to ensure they're visible in container logs
    log('Route error', {
      url: req.url,
      method: req.method,
      error: String(error),
      stack: error.stack
    });

    // If response hasn't been sent yet, send a 500 error
    if (!res.headersSent) {
      try {
        sendJson(res, 500, { error: 'Internal server error' });
      } catch (sendError) {
        // If even sending the error response fails, just end the response
        log('Failed to send error response', { sendError: String(sendError) });
        res.end();
      }
    }
  }
}

async function routeInternal(req, res, url, pathname) {
  if (req.method === 'GET' && pathname === '/api/health') return sendJson(res, 200, { ok: true });
  if (req.method === 'GET' && pathname === '/api/opencode/status') return handleOpencodeStatus(req, res);
  if (req.method === 'GET' && pathname === '/api/memory/stats') return handleMemoryStats(req, res);
  if (req.method === 'POST' && pathname === '/api/memory/cleanup') return handleForceMemoryCleanup(req, res);
  if (req.method === 'GET' && pathname === '/auth/google') return handleGoogleAuthStart(req, res, url);
  if (req.method === 'GET' && pathname === '/auth/google/callback') return handleGoogleAuthCallback(req, res, url);
  if (req.method === 'GET' && pathname === '/auth/github') return handleGithubAuthStart(req, res, url);
  if (req.method === 'GET' && pathname === '/auth/github/callback') return handleGithubAuthCallback(req, res, url);
  if (req.method === 'POST' && pathname === '/api/account/claim') {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleAccountClaim(req, res, userId);
  }
  if (req.method === 'POST' && pathname === '/api/affiliates/signup') return handleAffiliateSignup(req, res);
  if (req.method === 'POST' && pathname === '/api/affiliates/login') return handleAffiliateLogin(req, res);
  if (req.method === 'POST' && pathname === '/api/affiliates/logout') return handleAffiliateLogout(req, res);
  if (req.method === 'GET' && pathname === '/api/affiliates/me') return handleAffiliateMe(req, res, url);
  if (req.method === 'GET' && pathname === '/api/affiliates/verify-email') return handleAffiliateVerifyEmailApi(req, res, url);
  if (req.method === 'POST' && pathname === '/api/affiliates/verify-email') return handleAffiliateVerifyEmailApi(req, res, url);
  if (req.method === 'GET' && pathname === '/api/affiliates/transactions') return handleAffiliateTransactions(req, res);
  if (req.method === 'POST' && pathname === '/api/affiliates/links') return handleAffiliateCreateLink(req, res);
  if (req.method === 'POST' && pathname === '/api/affiliates/withdrawals') return handleAffiliateCreateWithdrawal(req, res);
  if (req.method === 'GET' && pathname === '/api/feature-requests') return handleFeatureRequestsList(req, res);
  if (req.method === 'POST' && pathname === '/api/feature-requests') return handleFeatureRequestCreate(req, res);
  const featureUpvoteMatch = pathname.match(/^\/api\/feature-requests\/([a-f0-9\-]+)\/upvote$/i);
  if (req.method === 'POST' && featureUpvoteMatch) return handleFeatureRequestUpvote(req, res, featureUpvoteMatch[1]);
  if (req.method === 'POST' && pathname === '/api/contact') return handleContactMessageCreate(req, res);
  const contactMessagesMatch = pathname.match(/^\/api\/contact\/messages$/i);
  if (req.method === 'GET' && contactMessagesMatch) return handleContactMessagesList(req, res);
  const contactMessageReadMatch = pathname.match(/^\/api\/contact\/messages\/([a-f0-9\-]+)\/read$/i);
  if (req.method === 'POST' && contactMessageReadMatch) return handleContactMessageMarkRead(req, res, contactMessageReadMatch[1]);
  const contactMessageDeleteMatch = pathname.match(/^\/api\/contact\/messages\/([a-f0-9\-]+)$/i);
  if (req.method === 'DELETE' && contactMessageDeleteMatch) return handleContactMessageDelete(req, res, contactMessageDeleteMatch[1]);
  if (req.method === 'POST' && pathname === '/api/login') return handleUserLogin(req, res);
  if (req.method === 'POST' && pathname === '/api/register') return handleUserRegister(req, res);
  if (req.method === 'POST' && pathname === '/api/logout') return handleUserLogout(req, res);
  if (req.method === 'GET' && pathname === '/api/me') return handleUserMe(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/me') {
    const session = requireAdminAuth(req, res);
    if (!session) return;
    return handleAdminMe(req, res);
  }
  if (req.method === 'GET' && pathname === '/api/csrf') return handleCsrfToken(req, res);
  if (req.method === 'GET' && pathname === '/api/account') return handleAccountSettingsGet(req, res, url);
  if (req.method === 'GET' && pathname === '/api/account/usage') return handleAccountUsage(req, res);
  if (req.method === 'GET' && pathname === '/api/provider-limits') return handleProviderLimitsGet(req, res);
  if (req.method === 'GET' && pathname === '/api/account/plans') return handleAccountPlans(req, res);
  if (req.method === 'GET' && pathname === '/api/invoices') return handleInvoicesList(req, res);
  const invoiceDownloadMatch = pathname.match(/^\/api\/invoices\/([a-f0-9\-]+)\/download$/i);
  if (req.method === 'GET' && invoiceDownloadMatch) return handleInvoiceDownload(req, res, url, invoiceDownloadMatch[1]);
  if (req.method === 'GET' && pathname === '/api/topups/options') {
    const session = requireUserAuth(req, res);
    if (!session) return;
    return handleTopupOptions(req, res, session.userId);
  }
  // Admin-only test endpoints for Dodo top-ups
  if (req.method === 'GET' && pathname === '/api/admin/topups/options') {
    const session = requireAdminAuth(req, res);
    if (!session) return;
    return handleAdminTopupOptions(req, res);
  }
  if (req.method === 'GET' && pathname === '/api/admin/topups/confirm') {
    const session = requireAdminAuth(req, res);
    if (!session) return;
    return handleAdminTopupConfirm(req, res, url);
  }
  if (req.method === 'POST' && pathname === '/api/admin/topups/checkout') {
    const session = requireAdminAuth(req, res);
    if (!session) return;
    return handleAdminTopupCheckout(req, res);
  }

  if (req.method === 'GET' && pathname === '/api/topups/confirm') return handleTopupConfirm(req, res, url);
  if (req.method === 'POST' && pathname === '/api/topups/checkout') return handleTopupCheckout(req, res);
  if (req.method === 'GET' && pathname === '/api/payg/status') return handlePaygStatus(req, res);
  if (req.method === 'POST' && pathname === '/api/payg/checkout') return handlePaygCheckout(req, res);
  if (req.method === 'GET' && pathname === '/api/payg/confirm') return handlePaygConfirm(req, res, url);
  if (req.method === 'POST' && pathname === '/api/account/boost') return handleAccountBoostPurchase(req, res);
  if (req.method === 'POST' && pathname === '/api/test/simulate-tokens') return handleSimulateTokenUsage(req, res);
  if (req.method === 'GET' && pathname === '/api/onboarding') return handleOnboardingGet(req, res);
  if (req.method === 'POST' && pathname === '/api/onboarding') return handleOnboardingPost(req, res);
  if (req.method === 'POST' && pathname === '/api/account') return handleAccountSettingsUpdate(req, res);
  if (req.method === 'GET' && pathname === '/api/account/payment-methods') return handlePaymentMethodsList(req, res, url);
  const paymentMethodCreateMatch = pathname.match(/^\/api\/account\/payment-methods\/create$/i);
  if (req.method === 'POST' && paymentMethodCreateMatch) return handlePaymentMethodCreate(req, res);
  const paymentMethodSetDefaultMatch = pathname.match(/^\/api\/account\/payment-methods\/([^\/]+)\/default$/i);
  if (req.method === 'POST' && paymentMethodSetDefaultMatch) return handlePaymentMethodSetDefault(req, res, paymentMethodSetDefaultMatch[1]);
  const paymentMethodDeleteMatch = pathname.match(/^\/api\/account\/payment-methods\/([^\/]+)$/i);
  if (req.method === 'DELETE' && paymentMethodDeleteMatch) return handlePaymentMethodDelete(req, res, paymentMethodDeleteMatch[1]);
  if (req.method === 'POST' && pathname === '/api/account/balance/add') return handleAccountBalanceAdd(req, res);
  if (req.method === 'POST' && pathname === '/api/select-plan') return handleSelectPlan(req, res);
  
  // Subscription API endpoints
  if (req.method === 'POST' && pathname === '/api/subscription/checkout') return handleSubscriptionCheckout(req, res);
  if (req.method === 'GET' && pathname === '/api/subscription/confirm') return handleSubscriptionConfirm(req, res, url);
  if (req.method === 'GET' && pathname === '/api/subscription/status') return handleSubscriptionStatus(req, res);
  if (req.method === 'POST' && pathname === '/api/subscription/cancel') return handleSubscriptionCancel(req, res);
  
  // Dodo webhooks
  if (req.method === 'POST' && pathname === '/webhooks/dodo') return handleDodoWebhook(req, res);
  
  if (req.method === 'GET' && pathname === '/api/verify-email') return handleVerifyEmailApi(req, res, url);
  if (req.method === 'POST' && pathname === '/api/password/forgot') return handlePasswordResetRequest(req, res);

  // Dev helper: preview branded email templates without sending
  if (req.method === 'GET' && pathname === '/debug/email/preview') {
    const type = url.searchParams.get('type') || 'verification';
    const email = url.searchParams.get('email') || 'user@example.com';
    const token = url.searchParams.get('token') || 'sample-token';
    if (type === 'verification') {
      const link = `${resolveBaseUrl(req)}/verify-email?token=${encodeURIComponent(token)}`;
      const bodyHtml = `<p style="margin-top:0;">Welcome!</p><p>Please verify your email address by clicking the button below — or copy and paste the link into your browser:</p><p style="word-break:break-all;"><a href="${escapeHtml(link)}">${escapeHtml(link)}</a></p>`;
      const html = renderBrandedEmail({ title: 'Verify your email address', preheader: 'Confirm your email to get started', bodyHtml, buttonText: 'Verify email', buttonLink: link });
      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
      return res.end(html);
    }
    if (type === 'reset') {
      const link = `${resolveBaseUrl(req)}/reset-password?token=${encodeURIComponent(token)}`;
      const bodyHtml = `<p style="margin-top:0;">You requested a password reset.</p><p>Reset your password by clicking the button below — or copy and paste the link into your browser:</p><p style="word-break:break-all;"><a href="${escapeHtml(link)}">${escapeHtml(link)}</a></p>`;
      const html = renderBrandedEmail({ title: 'Reset your password', preheader: 'Reset access to your Plugin Compass account', bodyHtml, buttonText: 'Reset password', buttonLink: link });
      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
      return res.end(html);
    }
    return sendJson(res, 400, { error: 'type must be verification or reset' });
  }
  if (req.method === 'POST' && pathname === '/api/password/reset') return handlePasswordReset(req, res);
  if (req.method === 'POST' && pathname === '/api/apps/upload') {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleUploadApp(req, res, userId);
  }
  if (req.method === 'POST' && pathname === '/api/admin/login') return handleAdminLogin(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/logout') return handleAdminLogout(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/me') return handleAdminMe(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/available-models') {
    const cliParam = url.searchParams.get('cli');
    return handleAdminAvailableModels(req, res, cliParam);
  }
  if (req.method === 'GET' && pathname === '/api/admin/icons') return handleAdminListIcons(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/models') return handleAdminModelsList(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/models') return handleAdminModelUpsert(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/openrouter-settings') return handleAdminOpenRouterSettingsGet(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/openrouter-settings') return handleAdminOpenRouterSettingsPost(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/mistral-settings') return handleAdminMistralSettingsGet(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/mistral-settings') return handleAdminMistralSettingsPost(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/plan-settings') return handleAdminPlanSettingsGet(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/plan-settings') return handleAdminPlanSettingsPost(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/plan-tokens') return handleAdminPlanTokensGet(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/plan-tokens') return handleAdminPlanTokensPost(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/token-rates') return handleAdminTokenRatesGet(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/token-rates') return handleAdminTokenRatesPost(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/provider-limits') return handleAdminProviderLimitsGet(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/provider-limits') return handleAdminProviderLimitsPost(req, res);
  // Admin-only env debug endpoint
  if (req.method === 'GET' && pathname === '/api/admin/env-config') return handleAdminEnvConfig(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/accounts') return handleAdminAccountsList(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/accounts/plan') return handleAdminAccountPlanUpdate(req, res);
  if (req.method === 'DELETE' && pathname === '/api/admin/accounts') return handleAdminAccountDelete(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/affiliates') return handleAdminAffiliatesList(req, res);
  if (req.method === 'DELETE' && pathname === '/api/admin/affiliates') return handleAdminAffiliateDelete(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/withdrawals') return handleAdminWithdrawalsList(req, res);
  if (req.method === 'PUT' && pathname === '/api/admin/withdrawals') return handleAdminWithdrawalUpdate(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/tracking') return handleAdminTrackingStats(req, res);
  if (req.method === 'GET' && pathname === '/api/admin/resources') return handleAdminResources(req, res);
  if (req.method === 'POST' && pathname === '/api/upgrade-popup-tracking') return handleUpgradePopupTracking(req, res);
  if (req.method === 'POST' && pathname === '/api/admin/cancel-messages') return handleAdminCancelMessages(req, res);
  const adminDeleteMatch = pathname.match(/^\/api\/admin\/models\/([a-f0-9\-]+)$/i);
  if (req.method === 'DELETE' && adminDeleteMatch) return handleAdminModelDelete(req, res, adminDeleteMatch[1]);
  if (req.method === 'GET' && pathname === '/api/models') {
    const cliParam = url.searchParams.get('cli');
    return handleModels(req, res, cliParam);
  }
  if (req.method === 'POST' && pathname === '/api/plan') {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handlePlanMessage(req, res, userId);
  }
  if (req.method === 'GET' && pathname === '/api/sessions') {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleListSessions(req, res, userId);
  }
  if (req.method === 'POST' && pathname === '/api/sessions') {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleNewSession(req, res, userId);
  }
  const sessionMatch = pathname.match(/^\/api\/sessions\/([a-f0-9\-]+)$/i);
  if (req.method === 'DELETE' && sessionMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleDeleteSession(req, res, sessionMatch[1], userId);
  }
  if (req.method === 'PATCH' && sessionMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleUpdateSession(req, res, sessionMatch[1], userId);
  }
  if (req.method === 'GET' && sessionMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleGetSession(req, res, sessionMatch[1], userId);
  }
  const messageMatch = pathname.match(/^\/api\/sessions\/([a-f0-9\-]+)\/messages$/i);
  if (req.method === 'POST' && messageMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleNewMessage(req, res, messageMatch[1], userId);
  }
  const streamMatch = pathname.match(/^\/api\/sessions\/([a-f0-9\-]+)\/messages\/([a-f0-9\-]+)\/stream$/i);
  if (req.method === 'GET' && streamMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleMessageStream(req, res, streamMatch[1], streamMatch[2], userId);
  }
  const statusMatch = pathname.match(/^\/api\/sessions\/([a-f0-9\-]+)\/messages\/([a-f0-9\-]+)\/status$/i);
  if (req.method === 'GET' && statusMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleRunningStatus(req, res, statusMatch[1], statusMatch[2], userId);
  }
  // Undo route for opencode messages
  const undoMatch = pathname.match(/^\/api\/sessions\/([a-f0-9\-]+)\/messages\/([a-f0-9\-]+)\/undo$/i);
  if (req.method === 'POST' && undoMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleUndoMessage(req, res, undoMatch[1], undoMatch[2], userId);
  }
  // Redo route for opencode messages
  const redoMatch = pathname.match(/^\/api\/sessions\/([a-f0-9\-]+)\/messages\/([a-f0-9\-]+)\/redo$/i);
  if (req.method === 'POST' && redoMatch) {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    return handleRedoMessage(req, res, redoMatch[1], redoMatch[2], userId);
  }
  const gitMatch = pathname.match(/^\/api\/git\/([a-z]+)$/i);
  if (gitMatch) return handleGit(req, res, gitMatch[1]);
  if (req.method === 'GET' && pathname === '/api/templates') return handleListTemplates(req, res);

  if (req.method === 'GET' && pathname === '/api/diagnostics') return handleDiagnostics(req, res);
  if (req.method === 'GET' && pathname === '/api/posthog-config.js') {
    res.writeHead(200, { 'Content-Type': 'application/javascript' });
    res.end(`window.posthogConfig = ${JSON.stringify({ apiKey: POSTHOG_API_KEY, apiHost: POSTHOG_API_HOST })};`);
    return;
  }
  if (req.method === 'GET' && pathname === '/api/export/zip') {
    const userId = requireUserId(req, res, url);
    if (!userId) return;
    const sessionId = url.searchParams.get('sessionId');
    if (!sessionId) return sendJson(res, 400, { error: 'sessionId is required for export' });
    return handleExportZip(req, res, sessionId, userId);
  }

  // Serve apps list UI - check if user has selected a plan
  if (pathname === '/apps' || pathname === '/apps/') {
    const session = getUserSession(req);
    if (session) {
      const user = findUserById(session.userId);
      const hasPlan = normalizePlanSelection(user?.plan);
      if (!hasPlan) {
        res.writeHead(302, { Location: '/select-plan' });
        res.end();
        return;
      }
    }
    return serveFile(res, safeStaticPath('apps.html'), 'text/html');
  }

  // Serve builder UI
  if (pathname === '/builder' || pathname === '/builder/') return serveFile(res, safeStaticPath('builder.html'), 'text/html');
  if (pathname === '/chat' || pathname === '/chat/') return serveFile(res, safeStaticPath('builder.html'), 'text/html');
  if (pathname.startsWith('/chat/')) {
    try {
      const filePath = safeStaticPath(pathname.replace('/chat/', ''));
      return serveFile(res, filePath, guessContentType(filePath));
    } catch (_) { }
  }
  if (pathname.startsWith('/uploads/')) {
    try {
      const uploadMatch = pathname.match(/^\/uploads\/([a-f0-9\-]+)\/([a-f0-9\-]+)\/(.+)$/i);
      if (!uploadMatch) throw new Error('Invalid upload path');
      const userId = requireUserId(req, res, url);
      if (!userId) return;
      const sessionId = uploadMatch[1];
      const attachmentKey = uploadMatch[2];
      const requestedName = uploadMatch[3].replace(/\.\.+/g, '');
      const session = getSession(sessionId, userId);
      if (!session) return sendJson(res, 404, { error: 'File not found' });
      await ensureSessionPaths(session);
      if (session.attachmentKey && session.attachmentKey !== attachmentKey) return sendJson(res, 403, { error: 'Invalid attachment token' });
      const filePath = path.join(session.uploadsDir, requestedName);
      const resolvedPath = path.resolve(filePath);
      const uploadsRoot = path.resolve(session.uploadsDir);
      if (!resolvedPath.startsWith(uploadsRoot)) throw new Error('Invalid path');
      const stat = await fs.stat(resolvedPath);
      if (!stat.isFile()) throw new Error('Not a file');
      const content = await fs.readFile(resolvedPath);
      const contentType = guessContentTypeFromExt(path.extname(resolvedPath));
      res.writeHead(200, { 'Content-Type': contentType });
      res.end(content);
      return;
    } catch (_) { }
  }
  if (pathname === '/admin/login') return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
  if (pathname === '/admin' || pathname === '/admin/') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin.html'), 'text/html');
  }
  if (pathname === '/admin/build') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin.html'), 'text/html');
  }
  if (pathname === '/admin/plan') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-plan.html'), 'text/html');
  }
  if (pathname === '/admin/plans') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-plans.html'), 'text/html');
  }
  if (pathname === '/admin/accounts') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-accounts.html'), 'text/html');
  }
  if (pathname === '/admin/affiliates') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-affiliates.html'), 'text/html');
  }
  if (pathname === '/admin/withdrawals') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-withdrawals.html'), 'text/html');
  }
  if (pathname === '/admin/tracking') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-tracking.html'), 'text/html');
  }
  if (pathname === '/admin/resources') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-resources.html'), 'text/html');
  }
  if (pathname === '/admin/contact-messages') {
    const session = getAdminSession(req);
    if (!session) return serveFile(res, safeStaticPath('admin-login.html'), 'text/html');
    return serveFile(res, safeStaticPath('admin-contact-messages.html'), 'text/html');
  }
  // Homepage serves landing page, /index.html serves homepage
  if (pathname === '/' || pathname === '/index.html') return serveFile(res, safeStaticPath('home.html'), 'text/html');
  if (pathname === '/login') {
    const session = getUserSession(req);
    if (session) {
      const user = findUserById(session.userId);
      const hasPlan = normalizePlanSelection(user?.plan);
      if (hasPlan) {
        res.writeHead(302, { Location: '/apps' });
        res.end();
        return;
      }
    }
    return serveFile(res, safeStaticPath('login.html'), 'text/html');
  }
  if (pathname === '/signup') {
    const session = getUserSession(req);
    if (session) {
      const user = findUserById(session.userId);
      const hasPlan = normalizePlanSelection(user?.plan);
      if (hasPlan) {
        res.writeHead(302, { Location: '/apps' });
        res.end();
        return;
      }
    }
    return serveFile(res, safeStaticPath('signup.html'), 'text/html');
  }
  if (pathname === '/signup-success') return serveFile(res, safeStaticPath('signup-success.html'), 'text/html');
  if (pathname === '/select-plan') {
    const session = getUserSession(req);
    if (!session) return serveFile(res, safeStaticPath('login.html'), 'text/html');
    const user = findUserById(session.userId);
    const hasPlan = normalizePlanSelection(user?.plan);
    if (hasPlan) {
      res.writeHead(302, { Location: '/apps' });
      res.end();
      return;
    }
    return serveFile(res, safeStaticPath('select-plan.html'), 'text/html');
  }
  if (pathname === '/verify-email') return serveFile(res, safeStaticPath('verify-email.html'), 'text/html');
  if (pathname === '/reset-password') return serveFile(res, safeStaticPath('reset-password.html'), 'text/html');
  if (pathname === '/topup' || pathname === '/topup/') return serveFile(res, safeStaticPath('topup.html'), 'text/html');
  if (pathname === '/test-checkout' || pathname === '/test-checkout/') {
    const adminSession = getAdminSession(req);
    if (!adminSession) {
      res.writeHead(302, { Location: '/admin/login?next=' + encodeURIComponent('/test-checkout') });
      res.end();
      return;
    }
    return serveFile(res, safeStaticPath('test-checkout.html'), 'text/html');
  }
  if (pathname === '/upgrade' || pathname === '/upgrade/') return serveFile(res, safeStaticPath('upgrade.html'), 'text/html');
  if (pathname === '/pricing') return serveFile(res, safeStaticPath('pricing.html'), 'text/html');
  if (pathname === '/credits') return serveFile(res, safeStaticPath('credits.html'), 'text/html');
  if (pathname === '/features') return serveFile(res, safeStaticPath('features.html'), 'text/html');
  if (pathname === '/subscription-success') return serveFile(res, safeStaticPath('subscription-success.html'), 'text/html');
  if (pathname === '/affiliate' || pathname === '/affiliates') return serveFile(res, safeStaticPath('affiliate.html'), 'text/html');
  if (pathname === '/affiliate-login') return serveFile(res, safeStaticPath('affiliate-login.html'), 'text/html');
  if (pathname === '/affiliate-signup') return serveFile(res, safeStaticPath('affiliate-signup.html'), 'text/html');
  if (pathname === '/affiliate-dashboard') return serveFile(res, safeStaticPath('affiliate-dashboard.html'), 'text/html');
  if (pathname === '/affiliate-withdrawal') return serveFile(res, safeStaticPath('affiliate-withdrawal.html'), 'text/html');
  if (pathname === '/affiliate-transactions') return serveFile(res, safeStaticPath('affiliate-transactions.html'), 'text/html');
  if (pathname === '/docs' || pathname === '/documentation') return serveFile(res, safeStaticPath('docs.html'), 'text/html');
  if (pathname === '/faq' || pathname === '/faqs') return serveFile(res, safeStaticPath('faq.html'), 'text/html');
  if (pathname === '/settings') return serveFile(res, safeStaticPath('settings.html'), 'text/html');
  if (pathname === '/feature-requests') return serveFile(res, safeStaticPath('feature-requests.html'), 'text/html');
  // Serve legal pages with proper caching headers
  if (pathname === '/terms') return serveFile(res, safeStaticPath('terms.html'), 'text/html');
  if (pathname === '/privacy') return serveFile(res, safeStaticPath('privacy.html'), 'text/html');
  // Redirect legacy /contact.html to canonical /contact
  if (pathname === '/contact.html' || pathname === '/contact.html/') {
    res.writeHead(301, { Location: '/contact' });
    res.end();
    return;
  }
  // Contact page (serve contact.html at /contact)
  if (pathname === '/contact' || pathname === '/contact/') return serveFile(res, safeStaticPath('contact.html'), 'text/html');
  // Serve sitemap.xml with proper caching headers for SEO
  if (pathname === '/sitemap.xml') {
    try {
      const content = await fs.readFile(safeStaticPath('sitemap.xml'));
      res.writeHead(200, {
        'Content-Type': 'application/xml',
        'Cache-Control': 'public, max-age=86400', // Cache for 24 hours
      });
      res.end(content);
      return;
    } catch (_) { }
  }
  // Serve robots.txt with proper caching headers for SEO
  if (pathname === '/robots.txt') {
    try {
      const content = await fs.readFile(safeStaticPath('robots.txt'));
      res.writeHead(200, {
        'Content-Type': 'text/plain',
        'Cache-Control': 'public, max-age=86400', // Cache for 24 hours
      });
      res.end(content);
      return;
    } catch (_) { }
  }
  try {
    const staticFile = safeStaticPath(pathname.replace(/^\//, ''));
    const stat = await fs.stat(staticFile);
    if (stat.isFile()) return serveFile(res, staticFile, guessContentType(staticFile));
  } catch (_) { }
  try {
    const content = await fs.readFile(safeStaticPath('404.html'));
    res.writeHead(404, { 'Content-Type': 'text/html' });
    res.end(content);
  } catch (_) {
    res.writeHead(404, { 'Content-Type': 'text/html' });
    res.end('<h1>404 Not Found</h1><p>The page you are looking for does not exist.</p>');
  }
}

async function bootstrap() {
  process.on('uncaughtException', async (error) => {
    log('Uncaught Exception, saving state before exit', { error: String(error), stack: error.stack });
    try {
      await persistAllState();
    } catch (saveError) {
      log('Failed to save state during uncaughtException', { error: String(saveError) });
    }
    process.exit(1);
  });

  process.on('unhandledRejection', (reason, promise) => {
    log('Unhandled Rejection', { reason: String(reason), promise: String(promise) });
  });

  process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
  process.on('SIGINT', () => gracefulShutdown('SIGINT'));

  await loadState();
  await loadAdminModelStore();
  await loadOpenRouterSettings();
  await loadMistralSettings();
  await loadPlanSettings();
  await loadPlanTokenLimits();
  await loadProviderLimits();
  await loadProviderUsage();
  await loadTokenUsage();
  await loadTopupSessions();
  await loadPendingTopups();
  await loadPaygSessions();
  await loadPendingPayg();
  await loadSubscriptionSessions();
  await loadPendingSubscriptions();
  await loadInvoicesDb();
  await loadUsersDb(); // Load user authentication database
  await loadUserSessions(); // Load user sessions
  await loadAffiliatesDb();
  await loadWithdrawalsDb();
  await loadTrackingData();
  await loadFeatureRequestsDb();
  contactMessagesDb = await loadContactMessagesDb();
  await ensureAssetsDir();

  // Clean up orphaned workspace directories from deleted sessions
  await cleanupOrphanedWorkspaces();

  // Initialize admin password hashing
  if (ADMIN_USER && ADMIN_PASSWORD) {
    try {
      adminPasswordHash = await bcrypt.hash(ADMIN_PASSWORD, PASSWORD_SALT_ROUNDS);
      log('admin password hashed successfully');
    } catch (error) {
      log('failed to hash admin password', { error: String(error) });
    }
  }

  log('Resource limits detected', {
    memoryBytes: RESOURCE_LIMITS.memoryBytes,
    memoryMb: Math.round((RESOURCE_LIMITS.memoryBytes || 0) / (1024 * 1024)),
    cpuCores: RESOURCE_LIMITS.cpuCores
  });

  // Log provider configuration
  console.log('=== PROVIDER CONFIGURATION ===');
  console.log('[CONFIG] OpenRouter:', {
    configured: !!OPENROUTER_API_KEY,
    apiUrl: OPENROUTER_API_URL,
    primaryModel: openrouterSettings.primaryModel || 'not set',
    hasApiKey: !!OPENROUTER_API_KEY
  });
  console.log('[CONFIG] Mistral:', {
    configured: !!MISTRAL_API_KEY,
    apiUrl: MISTRAL_API_URL,
    primaryModel: mistralSettings.primaryModel || 'not set',
    backupModel1: mistralSettings.backupModel1 || 'not set',
    backupModel2: mistralSettings.backupModel2 || 'not set',
    backupModel3: mistralSettings.backupModel3 || 'not set',
    hasApiKey: !!MISTRAL_API_KEY,
    apiKeyPrefix: MISTRAL_API_KEY ? MISTRAL_API_KEY.substring(0, 8) + '...' : 'none',
    defaultModel: MISTRAL_DEFAULT_MODEL
  });
  console.log('[CONFIG] Groq:', {
    configured: !!GROQ_API_KEY,
    apiUrl: GROQ_API_URL,
    hasApiKey: !!GROQ_API_KEY,
    apiKeyPrefix: GROQ_API_KEY ? GROQ_API_KEY.substring(0, 8) + '...' : 'none'
  });
  console.log('[CONFIG] Planning Settings:', {
    provider: planSettings.provider,
    freePlanModel: planSettings.freePlanModel || 'not set',
    planningChainLength: planSettings.planningChain?.length || 0,
    planningChain: planSettings.planningChain
  });

  // Log email/SMTP configuration
  const smtpConfig = summarizeMailConfig();
  console.log('[CONFIG] Email / SMTP:');
  console.log('  - SMTP Configured:', smtpConfig.hostConfigured ? 'YES ✓' : 'NO ✗');
  console.log('  - SMTP Host:', smtpConfig.hostConfigured ? SMTP_HOST : 'not configured');
  console.log('  - SMTP Port:', smtpConfig.portConfigured ? SMTP_PORT : 'not configured');
  console.log('  - SMTP Secure:', smtpConfig.secure ? 'YES (TLS/SSL)' : 'NO (STARTTLS)');
  console.log('  - From Address:', smtpConfig.fromConfigured ? SMTP_FROM : 'not configured');
  console.log('');
  if (!smtpConfig.hostConfigured) {
    console.log('  ⚠️  WARNING: Email is NOT configured. Password reset and verification');
    console.log('      emails will be logged to console only. To enable real emails:');
    console.log('      1. Edit the .env file');
    console.log('      2. Set SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, and SMTP_FROM');
    console.log('      3. Restart the server');
    console.log('  💡 Tip: Use /debug/email/preview?type=reset to preview the email template');
  } else {
    console.log('  ✓ Email/SMTP is configured and ready to send emails');
  }
  console.log('');
  console.log('==============================');

  log('Environment PATH', { PATH: process.env.PATH });
  try {
    const versionCheck = await runCommand('opencode', ['--version'], { timeout: 5000 }).catch((e) => ({ stdout: e.stdout, stderr: e.stderr, code: e.code }));
  log('opencode version', { version: versionCheck.stdout || versionCheck.stderr });
  } catch (_) {
    log('opencode version check failed');
  }
  
  // Initialize OpenCode process manager
  log('Initializing OpenCode process manager...');
  try {
    await opencodeManager.start();
    log('OpenCode process manager initialized', opencodeManager.getStats());
  } catch (err) {
    log('OpenCode process manager initialization failed (will fall back to per-message spawning)', { error: String(err) });
  }
  
  // Restore interrupted sessions after restart
  await restoreInterruptedSessions();
  
  startAutoSave();
  
  // Start memory cleanup scheduler
  startMemoryCleanup();
  
  // Start periodic resource monitoring for analytics
  startPeriodicMonitoring();

  server = http.createServer((req, res) => { route(req, res); });

  // Disable Node's built-in request timeouts so long-running SSE streams / long LLM "thinking" phases
  // don't get cut off (Node defaults can be ~5 minutes depending on version).
  server.requestTimeout = 0;
  server.headersTimeout = 0;
  server.timeout = 0;

  server.listen(PORT, HOST, () => { log(`${OPENROUTER_APP_NAME} listening on http://${HOST}:${PORT}`); });
}

function startPeriodicMonitoring() {
  // Track system health metrics every 5 minutes
  setInterval(() => {
    try {
      trackResourceUtilization();
      
      // Update system health
      trackingData.technicalMetrics.systemHealth.uptime = process.uptime();
      
      // Calculate queue wait times (simplified)
      const activeSessions = state.sessions.filter(s => s.pending > 0).length;
      if (activeSessions > 0) {
        const estimatedWaitTime = activeSessions * 1000; // 1 second per active session
        trackQueueMetrics(estimatedWaitTime, activeSessions);
      }
      
    } catch (error) {
      log('Periodic monitoring error', { error: String(error) });
    }
  }, 5 * 60 * 1000); // 5 minutes

  // Clean up old data daily
  setInterval(() => {
    try {
      // Clean up old resource utilization data (keep last 7 days)
      const sevenDaysAgo = Date.now() - (7 * 24 * 60 * 60 * 1000);
      const recentResourceData = {};
      for (const [timestamp, data] of Object.entries(trackingData.userAnalytics.resourceUtilization)) {
        if (parseInt(timestamp) > sevenDaysAgo) {
          recentResourceData[timestamp] = data;
        }
      }
      trackingData.userAnalytics.resourceUtilization = recentResourceData;
      
      // Clean up old queue metrics (keep last 3 days)
      const threeDaysAgo = Date.now() - (3 * 24 * 60 * 60 * 1000);
      const recentQueueData = {};
      for (const [timestamp, data] of Object.entries(trackingData.userAnalytics.queueMetrics)) {
        if (parseInt(timestamp) > threeDaysAgo) {
          recentQueueData[timestamp] = data;
        }
      }
      trackingData.userAnalytics.queueMetrics = recentQueueData;
      
      // Clean up old active user data (keep last 30 days)
      const thirtyDaysAgo = Date.now() - (30 * 24 * 60 * 60 * 1000);
      const recentDAU = {};
      for (const [date, users] of Object.entries(trackingData.userAnalytics.dailyActiveUsers)) {
        const dateTime = new Date(date).getTime();
        if (dateTime > thirtyDaysAgo) {
          recentDAU[date] = users;
        }
      }
      trackingData.userAnalytics.dailyActiveUsers = recentDAU;
      
      scheduleTrackingPersist();
      
    } catch (error) {
      log('Data cleanup error', { error: String(error) });
    }
  }, 24 * 60 * 60 * 1000); // 24 hours
}


async function handleListTemplates(req, res) {
  try {
    const templatesPath = path.join(__dirname, 'templates', 'templates.json');
    const content = await fs.readFile(templatesPath, 'utf-8');
    const templates = JSON.parse(content);
    sendJson(res, 200, { templates });
  } catch (error) {
    if (error.code === 'ENOENT') {
      return sendJson(res, 200, { templates: [] });
    }
    log('Failed to list templates', { error: String(error) });
    sendJson(res, 500, { error: 'Failed to list templates' });
  }
}

bootstrap().catch((error) => { log(`Failed to start ${OPENROUTER_APP_NAME} service`, { error: String(error) }); process.exit(1); });