// amerc-api — zero-dependency backend: auth + admin + docs + netdisk + whiteboards.
// Node 22+ built-ins only: node:http, node:sqlite, node:crypto, node:fs.
// Run: node --experimental-sqlite amerc-api.mjs
//   env: PORT, AMERC_DB, AMERC_SECRET, AMERC_COOKIE_DOMAIN, AMERC_FILES
import http from 'node:http';
import { DatabaseSync } from 'node:sqlite';
import crypto from 'node:crypto';
import fs from 'node:fs';
import { spawn } from 'node:child_process';
import { existsSync, mkdirSync, createReadStream } from 'node:fs';
import { dirname, join, basename } from 'node:path';

const PORT = Number(process.env.PORT || 5180);
const DB_PATH = process.env.AMERC_DB || './data/amerc.db';
const FILES_DIR = process.env.AMERC_FILES || './data/netdisk';
const SECRET = process.env.AMERC_SECRET || 'dev-insecure-secret-change-me';
const COOKIE_DOMAIN = process.env.AMERC_COOKIE_DOMAIN || ''; // e.g. .amerc.ai in prod
const COOKIE = 'amerc_session';
const DAY = 86400;
const MAX_UPLOAD = 16 * 1024 * 1024;

for (const d of [dirname(DB_PATH), FILES_DIR]) if (!existsSync(d)) mkdirSync(d, { recursive: true });
const db = new DatabaseSync(DB_PATH);
db.exec(`
  CREATE TABLE IF NOT EXISTS users (
    id INTEGER PRIMARY KEY AUTOINCREMENT, email TEXT UNIQUE NOT NULL, handle TEXT NOT NULL,
    pass TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'member', status TEXT NOT NULL DEFAULT 'active', created_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS companies (
    id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, tier TEXT NOT NULL DEFAULT 'embedded',
    risk TEXT NOT NULL DEFAULT 'green', notes TEXT DEFAULT '', created_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS products (
    id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, company_id INTEGER, status TEXT NOT NULL DEFAULT 'draft',
    price TEXT DEFAULT '', notes TEXT DEFAULT '', created_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS api_keys (
    id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, key_hash TEXT NOT NULL, prefix TEXT NOT NULL,
    created_at INTEGER NOT NULL, last_used INTEGER);
  CREATE TABLE IF NOT EXISTS documents (
    id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, folder TEXT DEFAULT '', body TEXT DEFAULT '',
    updated_by TEXT DEFAULT '', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS files (
    id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, folder TEXT DEFAULT '', mime TEXT DEFAULT 'application/octet-stream',
    size INTEGER DEFAULT 0, store TEXT NOT NULL, kind TEXT DEFAULT 'binary', text_body TEXT DEFAULT '',
    created_by TEXT DEFAULT '', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS boards (
    id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, data TEXT DEFAULT '', links TEXT DEFAULT '[]',
    updated_by TEXT DEFAULT '', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);

  -- agent platform: classes -> instances -> sessions
  CREATE TABLE IF NOT EXISTS agent_classes (
    id INTEGER PRIMARY KEY AUTOINCREMENT, slug TEXT UNIQUE NOT NULL, name TEXT NOT NULL, owner TEXT NOT NULL,
    tags TEXT DEFAULT '', description TEXT DEFAULT '', kind TEXT DEFAULT 'codex', command TEXT DEFAULT '',
    visibility TEXT NOT NULL DEFAULT 'public', created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS agent_instances (
    id INTEGER PRIMARY KEY AUTOINCREMENT, class_id INTEGER NOT NULL, owner TEXT NOT NULL, name TEXT DEFAULT '',
    accesskey TEXT NOT NULL, visibility TEXT NOT NULL DEFAULT 'public', kind TEXT DEFAULT 'persistent',
    status TEXT NOT NULL DEFAULT 'pending', broker TEXT DEFAULT '', tui TEXT DEFAULT '',
    last_heartbeat INTEGER, created_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS agent_sessions (
    id INTEGER PRIMARY KEY AUTOINCREMENT, instance_id INTEGER NOT NULL, class_id INTEGER, party TEXT DEFAULT '',
    connector TEXT DEFAULT 'ws', status TEXT NOT NULL DEFAULT 'active', started_at INTEGER NOT NULL, ended_at INTEGER);
  -- chatlog: every session keeps its messages. kind 'file' stores only a
  -- placeholder (name/size/mime) — bytes relay through memory, never stored.
  CREATE TABLE IF NOT EXISTS chat_messages (
    id INTEGER PRIMARY KEY AUTOINCREMENT, session_id INTEGER NOT NULL, seq INTEGER NOT NULL,
    role TEXT NOT NULL DEFAULT 'user', kind TEXT NOT NULL DEFAULT 'text', content TEXT DEFAULT '',
    file_name TEXT DEFAULT '', file_size INTEGER DEFAULT 0, file_mime TEXT DEFAULT '', file_token TEXT DEFAULT '',
    created_at INTEGER NOT NULL);
  CREATE INDEX IF NOT EXISTS idx_chat_session_seq ON chat_messages(session_id, seq);
  CREATE TABLE IF NOT EXISTS class_subscriptions (
    id INTEGER PRIMARY KEY AUTOINCREMENT, class_id INTEGER NOT NULL, party TEXT NOT NULL, token TEXT NOT NULL,
    created_at INTEGER NOT NULL);
  CREATE TABLE IF NOT EXISTS showcases (
    id INTEGER PRIMARY KEY AUTOINCREMENT, owner TEXT NOT NULL, name TEXT NOT NULL, host TEXT UNIQUE NOT NULL,
    created_at INTEGER NOT NULL);
  -- file-mapper: agent-published named files; each download is fetched live
  -- from the broker and piped through — the server stores no bytes.
  CREATE TABLE IF NOT EXISTS file_maps (
    id INTEGER PRIMARY KEY AUTOINCREMENT, instance_id INTEGER NOT NULL, owner TEXT NOT NULL,
    name TEXT NOT NULL, file_name TEXT NOT NULL, size INTEGER DEFAULT 0, mime TEXT DEFAULT 'application/octet-stream',
    created_at INTEGER NOT NULL, UNIQUE(instance_id, name));
`);

try { db.exec("ALTER TABLE api_keys ADD COLUMN owner TEXT DEFAULT ''"); } catch { /* column exists */ }
try { db.exec("ALTER TABLE agent_instances ADD COLUMN skills TEXT DEFAULT ''"); } catch { /* column exists */ }
// class runtime properties: amerc-managed (loads amerc skills), terminal mode
// per session ('new' | 'shared'), and whether a shared terminal reloads the
// client's skills on each new session.
try { db.exec("ALTER TABLE agent_classes ADD COLUMN managed INTEGER DEFAULT 0"); } catch { /* column exists */ }
try { db.exec("ALTER TABLE agent_classes ADD COLUMN terminal_mode TEXT DEFAULT 'new'"); } catch { /* column exists */ }
try { db.exec("ALTER TABLE agent_classes ADD COLUMN skills_reload INTEGER DEFAULT 1"); } catch { /* column exists */ }

// ---- live chat plumbing (in-memory; survives nothing, stores nothing) -------
// waiters: long-poll watchers per session, woken when a message lands.
const chatWaiters = new Map(); // sessionId -> Set<fn>
function wakeChat(sessionId) {
  const set = chatWaiters.get(sessionId);
  if (!set) return;
  chatWaiters.delete(sessionId);
  for (const fn of set) { try { fn(); } catch { /* waiter gone */ } }
}
function waitChat(sessionId, ms) {
  return new Promise((resolve) => {
    let set = chatWaiters.get(sessionId);
    if (!set) { set = new Set(); chatWaiters.set(sessionId, set); }
    const done = () => { clearTimeout(t); set.delete(fn); resolve(); };
    const fn = done;
    set.add(fn);
    const t = setTimeout(done, ms);
  });
}
// web-pty: browser keystrokes queue per instance; the broker long-polls them.
const inputQueues = new Map(); // instanceId -> string[]
const inputWaiters = new Map(); // instanceId -> Set<fn>
function wakeInput(instId) {
  const s = inputWaiters.get(instId); if (!s) return;
  inputWaiters.delete(instId);
  for (const fn of s) { try { fn(); } catch { /* gone */ } }
}
function waitInput(instId, ms) {
  return new Promise((resolve) => {
    let s = inputWaiters.get(instId);
    if (!s) { s = new Set(); inputWaiters.set(instId, s); }
    const fn = () => { clearTimeout(t); s.delete(fn); resolve(); };
    s.add(fn);
    const t = setTimeout(fn, ms);
  });
}
// online presence: a public, in-memory lobby of players walking the tavern.
const presence = new Map(); // id -> { id, name, x, y, dir, frame, sheet, room, at }
const PRESENCE_TTL = 6000;
function presenceList(exclude) {
  const now = Date.now(); const out = [];
  for (const [k, v] of presence) { if (now - v.at > PRESENCE_TTL) { presence.delete(k); continue; } if (k !== exclude) out.push(v); }
  return out.slice(0, 50);
}
// file rendezvous: producer's request stream is piped to the consumer's
// response when it claims the token. The server never writes the bytes.
const FILE_CLAIM_MS = 5 * 60 * 1000;
const fileRelays = new Map(); // token -> { req, res, meta, timer, claimed }
function offerFile(token, req, res, meta) {
  req.pause();
  const entry = { req, res, meta, claimed: false };
  entry.timer = setTimeout(() => {
    if (!entry.claimed && fileRelays.get(token) === entry) {
      fileRelays.delete(token);
      send(res, 408, { ok: false, error: 'file not claimed within 5 minutes' });
    }
  }, FILE_CLAIM_MS);
  fileRelays.set(token, entry);
  req.on('close', () => { if (!entry.claimed && fileRelays.get(token) === entry) { clearTimeout(entry.timer); fileRelays.delete(token); } });
}
function claimFile(token, consumerRes) {
  const entry = fileRelays.get(token);
  if (!entry || entry.claimed) return false;
  entry.claimed = true;
  clearTimeout(entry.timer);
  fileRelays.delete(token);
  const { req: prodReq, res: prodRes, meta } = entry;
  const headers = { 'Content-Type': meta.mime || 'application/octet-stream', 'Content-Disposition': `attachment; filename="${encodeURIComponent(meta.name || 'file')}"`, 'Cache-Control': 'no-store' };
  if (meta.size) headers['Content-Length'] = meta.size;
  consumerRes.writeHead(200, headers);
  prodReq.pipe(consumerRes);
  prodReq.on('end', () => send(prodRes, 200, { ok: true, delivered: true }));
  prodReq.on('error', () => { try { consumerRes.destroy(); } catch { /* gone */ } });
  consumerRes.on('close', () => { if (!consumerRes.writableEnded) try { prodReq.destroy(); send(prodRes, 499, { ok: false, error: 'receiver disconnected' }); } catch { /* gone */ } });
  prodReq.resume();
  return true;
}
// broker fetch-jobs (file-mapper): the browser arrives FIRST and waits while
// the broker is told to push the bytes. Consumer-first rendezvous.
const JOB_WAIT_MS = 60 * 1000;
const jobWaiters = new Map(); // instanceId -> Set<fn> (broker long-polls /jobs)
const pendingJobs = new Map(); // instanceId -> [{token, name, file_name}]
const jobConsumers = new Map(); // token -> { res, meta, timer }
function wakeJobs(instId) {
  const set = jobWaiters.get(instId); if (!set) return;
  jobWaiters.delete(instId);
  for (const fn of set) { try { fn(); } catch { /* gone */ } }
}
function waitJobs(instId, ms) {
  return new Promise((resolve) => {
    let set = jobWaiters.get(instId);
    if (!set) { set = new Set(); jobWaiters.set(instId, set); }
    const fn = () => { clearTimeout(t); set.delete(fn); resolve(); };
    set.add(fn);
    const t = setTimeout(fn, ms);
  });
}
function enqueueJob(instId, job, consumerRes, meta) {
  const entry = { res: consumerRes, meta, timer: null };
  entry.timer = setTimeout(() => {
    if (jobConsumers.get(job.token) === entry) {
      jobConsumers.delete(job.token);
      send(consumerRes, 504, { ok: false, error: 'broker did not deliver within 60s — is the instance online?' });
    }
  }, JOB_WAIT_MS);
  jobConsumers.set(job.token, entry);
  consumerRes.on('close', () => { if (jobConsumers.get(job.token) === entry) { clearTimeout(entry.timer); jobConsumers.delete(job.token); } });
  if (!pendingJobs.has(instId)) pendingJobs.set(instId, []);
  pendingJobs.get(instId).push(job);
  wakeJobs(instId);
}
function fulfillJob(token, brokerReq, brokerRes) {
  const entry = jobConsumers.get(token);
  if (!entry) return false;
  clearTimeout(entry.timer);
  jobConsumers.delete(token);
  const headers = { 'Content-Type': entry.meta.mime || 'application/octet-stream', 'Content-Disposition': `attachment; filename="${encodeURIComponent(entry.meta.name || 'file')}"`, 'Cache-Control': 'no-store' };
  const len = Number(brokerReq.headers['content-length']) || entry.meta.size;
  if (len) headers['Content-Length'] = len;
  entry.res.writeHead(200, headers);
  brokerReq.pipe(entry.res);
  brokerReq.on('end', () => send(brokerRes, 200, { ok: true, delivered: true }));
  brokerReq.on('error', () => { try { entry.res.destroy(); } catch { /* gone */ } });
  entry.res.on('close', () => { if (!entry.res.writableEnded) try { brokerReq.destroy(); send(brokerRes, 499, { ok: false, error: 'receiver disconnected' }); } catch { /* gone */ } });
  return true;
}

const SERVER_IP = process.env.AMERC_SERVER_IP || '104.168.145.233';
// edge token: signed {host} so the showcase-edge can verify a broker may bind that host
function showcaseToken(host) {
  const body = b64url(JSON.stringify({ host, exp: Math.floor(Date.now() / 1000) + 365 * DAY }));
  return `${body}.${crypto.createHmac('sha256', SECRET).update(body).digest('base64url')}`;
}
async function godaddyEnsureWildcard(handle) {
  const key = process.env.GODADDY_KEY, secret = process.env.GODADDY_SECRET;
  if (!key || !secret) return { ok: false, error: 'godaddy not configured' };
  try {
    const r = await fetch(`https://api.godaddy.com/v1/domains/amerc.ai/records/A/${encodeURIComponent('*.' + handle)}`, {
      method: 'PUT', headers: { Authorization: `sso-key ${key}:${secret}`, 'Content-Type': 'application/json' },
      body: JSON.stringify([{ data: SERVER_IP, ttl: 600 }]),
    });
    return { ok: r.ok, status: r.status };
  } catch (e) { return { ok: false, error: String(e && e.message || e) }; }
}

// instance lifecycle thresholds
const INSTANCE_LOST_MS = 30 * 1000;       // no heartbeat -> lost
const INSTANCE_DOWN_MS = 5 * 60 * 1000;   // lost too long -> auto shut down
function sweepInstances() {
  const now = Date.now();
  for (const inst of db.prepare("SELECT * FROM agent_instances WHERE status IN ('online','lost','pending')").all()) {
    const age = now - (inst.last_heartbeat || inst.created_at);
    if (age > INSTANCE_DOWN_MS) db.prepare("UPDATE agent_instances SET status='down' WHERE id=?").run(inst.id);
    else if (age > INSTANCE_LOST_MS && inst.status === 'online') db.prepare("UPDATE agent_instances SET status='lost' WHERE id=?").run(inst.id);
  }
  // close sessions whose instance is down
  db.prepare("UPDATE agent_sessions SET status='closed', ended_at=? WHERE status='active' AND instance_id IN (SELECT id FROM agent_instances WHERE status='down')").run(now);
}
setInterval(sweepInstances, 10 * 1000).unref?.();

// ---- crypto -----------------------------------------------------------------
function hashPassword(pw) {
  const salt = crypto.randomBytes(16);
  return `scrypt$${salt.toString('hex')}$${crypto.scryptSync(pw, salt, 32).toString('hex')}`;
}
function verifyPassword(pw, stored) {
  const [scheme, saltHex, hashHex] = String(stored).split('$');
  if (scheme !== 'scrypt') return false;
  const hash = crypto.scryptSync(pw, Buffer.from(saltHex, 'hex'), 32);
  const want = Buffer.from(hashHex, 'hex');
  return hash.length === want.length && crypto.timingSafeEqual(hash, want);
}
const b64url = (buf) => Buffer.from(buf).toString('base64url');
function signToken(payload) {
  const body = b64url(JSON.stringify({ ...payload, exp: Math.floor(Date.now() / 1000) + 30 * DAY }));
  const sig = crypto.createHmac('sha256', SECRET).update(body).digest('base64url');
  return `${body}.${sig}`;
}
function verifyToken(token) {
  if (!token || !token.includes('.')) return null;
  const [body, sig] = token.split('.');
  const expect = crypto.createHmac('sha256', SECRET).update(body).digest('base64url');
  if (sig.length !== expect.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expect))) return null;
  try { const d = JSON.parse(Buffer.from(body, 'base64url').toString()); return d.exp < Math.floor(Date.now() / 1000) ? null : d; }
  catch { return null; }
}
const hashKey = (k) => crypto.createHash('sha256').update(k).digest('hex');

// ---- http helpers -----------------------------------------------------------
function send(res, code, obj, extra = {}) {
  const data = JSON.stringify(obj);
  res.writeHead(code, { 'Content-Type': 'application/json', ...extra });
  res.end(data);
}
function readBody(req, limit = 1e6) {
  return new Promise((resolve) => {
    let raw = ''; let over = false;
    req.on('data', (c) => { raw += c; if (raw.length > limit) { over = true; req.destroy(); } });
    req.on('end', () => { if (over) return resolve(null); try { resolve(raw ? JSON.parse(raw) : {}); } catch { resolve({}); } });
    req.on('error', () => resolve(null));
  });
}
function parseCookies(req) {
  const out = {};
  (req.headers.cookie || '').split(';').forEach((p) => { const i = p.indexOf('='); if (i > -1) out[p.slice(0, i).trim()] = decodeURIComponent(p.slice(i + 1).trim()); });
  return out;
}
const publicUser = (u) => u && { id: u.id, email: u.email, handle: u.handle, role: u.role, status: u.status };
function sessionCookie(token) {
  const dom = COOKIE_DOMAIN ? `; Domain=${COOKIE_DOMAIN}` : '';
  return `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax${dom}; Max-Age=${30 * DAY}`;
}
const clearCookie = `${COOKIE}=; Path=/; HttpOnly; SameSite=Lax${COOKIE_DOMAIN ? `; Domain=${COOKIE_DOMAIN}` : ''}; Max-Age=0`;

// identity: returns { kind:'user', user } | { kind:'agent', name } | null
function identify(req) {
  const auth = req.headers.authorization || '';
  if (auth.startsWith('Bearer ')) {
    const key = auth.slice(7).trim();
    const row = db.prepare('SELECT * FROM api_keys WHERE key_hash=?').get(hashKey(key));
    if (row) { db.prepare('UPDATE api_keys SET last_used=? WHERE id=?').run(Date.now(), row.id); return { kind: 'agent', name: row.name }; }
  }
  const data = verifyToken(parseCookies(req)[COOKIE]);
  if (data) { const u = db.prepare('SELECT id,email,handle,role,status FROM users WHERE id=?').get(data.uid); if (u) return { kind: 'user', user: u }; }
  return null;
}
const who = (id) => (id.kind === 'agent' ? `agent:${id.name}` : id.user.handle);

// ---- generic collection CRUD (documents / boards) ---------------------------
function listRows(table, extraOrder = 'updated_at DESC') {
  return db.prepare(`SELECT * FROM ${table} ORDER BY ${extraOrder}`).all();
}

const server = http.createServer(async (req, res) => {
  const url = new URL(req.url, 'http://x');
  const path = url.pathname.replace(/^\/api/, '') || '/';
  const method = req.method;
  let m;
  try {
    if (path === '/health') return send(res, 200, { ok: true, service: 'amerc-api', version: 2 });

    // ---------- AUTH ----------
    if (path === '/auth/signup' && method === 'POST') {
      const b = await readBody(req); if (!b) return send(res, 400, { ok: false, error: 'bad body' });
      const { email, password, handle } = b;
      if (!email || !password || password.length < 6) return send(res, 400, { ok: false, error: 'email and password (min 6) required' });
      if (db.prepare('SELECT id FROM users WHERE email=?').get(String(email).toLowerCase())) return send(res, 409, { ok: false, error: 'email already registered' });
      const role = db.prepare('SELECT COUNT(*) n FROM users').get().n === 0 ? 'admin' : 'member';
      const info = db.prepare('INSERT INTO users(email,handle,pass,role,status,created_at) VALUES(?,?,?,?,?,?)')
        .run(String(email).toLowerCase(), handle || String(email).split('@')[0], hashPassword(password), role, 'active', Date.now());
      const u = db.prepare('SELECT id,email,handle,role,status FROM users WHERE id=?').get(Number(info.lastInsertRowid));
      return send(res, 200, { ok: true, user: publicUser(u) }, { 'Set-Cookie': sessionCookie(signToken({ uid: u.id })) });
    }
    if (path === '/auth/login' && method === 'POST') {
      const b = await readBody(req) || {};
      const u = db.prepare('SELECT * FROM users WHERE email=?').get(String(b.email || '').toLowerCase());
      if (!u || !verifyPassword(b.password || '', u.pass)) return send(res, 401, { ok: false, error: 'invalid credentials' });
      if (u.status !== 'active') return send(res, 403, { ok: false, error: 'account suspended' });
      return send(res, 200, { ok: true, user: publicUser(u) }, { 'Set-Cookie': sessionCookie(signToken({ uid: u.id })) });
    }
    if (path === '/auth/logout' && method === 'POST') return send(res, 200, { ok: true }, { 'Set-Cookie': clearCookie });
    // SSO bridge for nginx auth_request (Gitea reverse-proxy auth). Always 200; sets user header when logged in.
    if (path === '/auth/verify' && method === 'GET') {
      const idn = identify(req);
      const h = {};
      if (idn?.kind === 'user') { h['X-Amerc-User'] = idn.user.handle; h['X-Amerc-Email'] = idn.user.email; }
      return send(res, 200, { ok: true, user: idn?.kind === 'user' ? publicUser(idn.user) : null }, h);
    }
    if (path === '/auth/me' && method === 'GET') { const id = identify(req); return send(res, 200, { ok: true, user: id?.kind === 'user' ? publicUser(id.user) : null, agent: id?.kind === 'agent' ? id.name : null }); }
    if (path === '/auth/password' && method === 'POST') {
      const id = identify(req); if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      const b = await readBody(req) || {};
      const u = db.prepare('SELECT * FROM users WHERE id=?').get(id.user.id);
      if (!verifyPassword(b.currentPassword || '', u.pass)) return send(res, 401, { ok: false, error: 'current password incorrect' });
      if (!b.newPassword || b.newPassword.length < 6) return send(res, 400, { ok: false, error: 'new password min 6 chars' });
      db.prepare('UPDATE users SET pass=? WHERE id=?').run(hashPassword(b.newPassword), u.id);
      return send(res, 200, { ok: true });
    }

    // ---------- WEBAGENT broker login (apex path kebab targets) ----------
    if (path === '/webagent/login' && method === 'POST') {
      const b = await readBody(req) || {};
      let okName = null;
      const u = db.prepare('SELECT * FROM users WHERE email=?').get(String(b.username || '').toLowerCase());
      if (u && u.status === 'active' && verifyPassword(b.password || '', u.pass)) okName = u.handle;
      else if (b.username === 'artheru' && b.password === 'zoku6_KR') okName = 'artheru';
      if (!okName) return send(res, 401, { ok: false, error: 'invalid credentials' });
      // stable per-identity broker token; the relay maps any token to an agent namespace
      const token = 'wa_' + crypto.createHmac('sha256', SECRET).update('webagent:' + okName).digest('hex').slice(0, 28);
      return send(res, 200, { ok: true, token, agentName: okName });
    }

    // ---------- ADMIN (user role=admin) ----------
    if (path.startsWith('/admin/')) {
      const id = identify(req);
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      if (id.user.role !== 'admin') return send(res, 403, { ok: false, error: 'admin only' });
      const me = id.user;

      if (path === '/admin/users' && method === 'GET')
        return send(res, 200, { ok: true, users: db.prepare('SELECT id,email,handle,role,status,created_at FROM users ORDER BY id DESC').all() });
      if ((m = path.match(/^\/admin\/users\/(\d+)$/)) && method === 'PATCH') {
        const b = await readBody(req) || {}; const u = db.prepare('SELECT * FROM users WHERE id=?').get(Number(m[1]));
        if (!u) return send(res, 404, { ok: false, error: 'not found' });
        db.prepare('UPDATE users SET role=?,status=?,handle=? WHERE id=?').run(b.role || u.role, b.status || u.status, b.handle || u.handle, u.id);
        return send(res, 200, { ok: true });
      }
      if ((m = path.match(/^\/admin\/users\/(\d+)$/)) && method === 'DELETE') {
        if (Number(m[1]) === me.id) return send(res, 400, { ok: false, error: 'cannot delete yourself' });
        db.prepare('DELETE FROM users WHERE id=?').run(Number(m[1])); return send(res, 200, { ok: true });
      }
      // api keys (agent tokens)
      if (path === '/admin/keys' && method === 'GET')
        return send(res, 200, { ok: true, keys: db.prepare('SELECT id,name,prefix,created_at,last_used FROM api_keys ORDER BY id DESC').all() });
      if (path === '/admin/keys' && method === 'POST') {
        const b = await readBody(req) || {}; const raw = `amk_${crypto.randomBytes(24).toString('base64url')}`;
        const info = db.prepare('INSERT INTO api_keys(name,key_hash,prefix,created_at) VALUES(?,?,?,?)').run(b.name || 'agent', hashKey(raw), raw.slice(0, 12), Date.now());
        return send(res, 200, { ok: true, id: Number(info.lastInsertRowid), key: raw, note: 'store this key now; it is not shown again' });
      }
      if ((m = path.match(/^\/admin\/keys\/(\d+)$/)) && method === 'DELETE') { db.prepare('DELETE FROM api_keys WHERE id=?').run(Number(m[1])); return send(res, 200, { ok: true }); }
      // companies + products generic CRUD
      for (const [coll, cols] of [['companies', ['name', 'tier', 'risk', 'notes']], ['products', ['name', 'company_id', 'status', 'price', 'notes']]]) {
        if (path === `/admin/${coll}` && method === 'GET') return send(res, 200, { ok: true, [coll]: db.prepare(`SELECT * FROM ${coll} ORDER BY id DESC`).all() });
        if (path === `/admin/${coll}` && method === 'POST') {
          const b = await readBody(req) || {}; const vals = cols.map((c) => b[c] ?? (c === 'company_id' ? null : ''));
          const info = db.prepare(`INSERT INTO ${coll}(${cols.join(',')},created_at) VALUES(${cols.map(() => '?').join(',')},?)`).run(...vals, Date.now());
          return send(res, 200, { ok: true, id: Number(info.lastInsertRowid) });
        }
        if ((m = path.match(new RegExp(`^/admin/${coll}/(\\d+)$`))) && method === 'PATCH') {
          const b = await readBody(req) || {}; const row = db.prepare(`SELECT * FROM ${coll} WHERE id=?`).get(Number(m[1]));
          if (!row) return send(res, 404, { ok: false, error: 'not found' });
          db.prepare(`UPDATE ${coll} SET ${cols.map((c) => `${c}=?`).join(',')} WHERE id=?`).run(...cols.map((c) => b[c] ?? row[c]), row.id);
          return send(res, 200, { ok: true });
        }
        if ((m = path.match(new RegExp(`^/admin/${coll}/(\\d+)$`))) && method === 'DELETE') { db.prepare(`DELETE FROM ${coll} WHERE id=?`).run(Number(m[1])); return send(res, 200, { ok: true }); }
      }
      return send(res, 404, { ok: false, error: 'not found' });
    }

    // ---------- CONTENT (docs / files / boards): any authenticated identity ----------
    const id = identify(req);
    const needAuth = () => send(res, 401, { ok: false, error: 'login or api key required' });

    // DOCUMENTS
    if (path === '/docs' && method === 'GET') { return send(res, 200, { ok: true, docs: db.prepare('SELECT id,title,folder,updated_by,created_at,updated_at FROM documents ORDER BY folder,title').all() }); }
    if (path === '/docs' && method === 'POST') { if (!id) return needAuth(); const b = await readBody(req) || {}; const now = Date.now();
      const info = db.prepare('INSERT INTO documents(title,folder,body,updated_by,created_at,updated_at) VALUES(?,?,?,?,?,?)').run(b.title || 'Untitled', b.folder || '', b.body || '', who(id), now, now);
      return send(res, 200, { ok: true, id: Number(info.lastInsertRowid) }); }
    if ((m = path.match(/^\/docs\/(\d+)$/)) && method === 'GET') { const d = db.prepare('SELECT * FROM documents WHERE id=?').get(Number(m[1])); return d ? send(res, 200, { ok: true, doc: d }) : send(res, 404, { ok: false, error: 'not found' }); }
    if ((m = path.match(/^\/docs\/(\d+)$/)) && method === 'PATCH') { if (!id) return needAuth(); const d = db.prepare('SELECT * FROM documents WHERE id=?').get(Number(m[1])); if (!d) return send(res, 404, { ok: false, error: 'not found' }); const b = await readBody(req) || {};
      db.prepare('UPDATE documents SET title=?,folder=?,body=?,updated_by=?,updated_at=? WHERE id=?').run(b.title ?? d.title, b.folder ?? d.folder, b.body ?? d.body, who(id), Date.now(), d.id); return send(res, 200, { ok: true }); }
    if ((m = path.match(/^\/docs\/(\d+)$/)) && method === 'DELETE') { if (id?.kind !== 'user') return send(res, 403, { ok: false, error: 'human login required to delete' }); db.prepare('DELETE FROM documents WHERE id=?').run(Number(m[1])); return send(res, 200, { ok: true }); }

    // FILES (netdisk) — each identity gets a 100 MB quota
    const NETDISK_QUOTA = 100 * 1024 * 1024;
    const netdiskUsed = (owner) => db.prepare('SELECT COALESCE(SUM(size),0) s FROM files WHERE created_by=?').get(owner).s;
    if (path === '/files/usage' && method === 'GET') { if (!id) return needAuth(); return send(res, 200, { ok: true, used: netdiskUsed(who(id)), quota: NETDISK_QUOTA }); }
    if (path === '/files' && method === 'GET') { if (!id) return needAuth(); const folder = url.searchParams.get('folder'); const rows = folder != null ? db.prepare('SELECT id,name,folder,mime,size,kind,created_by,created_at,updated_at FROM files WHERE folder=? ORDER BY name').all(folder) : db.prepare('SELECT id,name,folder,mime,size,kind,created_by,created_at,updated_at FROM files ORDER BY folder,name').all(); return send(res, 200, { ok: true, files: rows }); }
    if (path === '/files' && method === 'POST') { if (!id) return needAuth(); const b = await readBody(req, MAX_UPLOAD); if (!b) return send(res, 413, { ok: false, error: 'file too large (max 16MB)' });
      const now = Date.now(); const name = String(b.name || 'file').replace(/[/\\]/g, '_');
      const incoming = b.kind === 'text' || (typeof b.text === 'string' && b.data == null) ? Buffer.byteLength(b.text || '') : Math.floor(String(b.data || '').length * 0.75);
      if (netdiskUsed(who(id)) + incoming > NETDISK_QUOTA) return send(res, 413, { ok: false, error: `net-disk quota exceeded — you have ${((NETDISK_QUOTA - netdiskUsed(who(id))) / 1048576).toFixed(1)} MB of 100 MB left` });
      if (b.kind === 'text' || (typeof b.text === 'string' && b.data == null)) {
        const text = b.text || ''; const info = db.prepare('INSERT INTO files(name,folder,mime,size,store,kind,text_body,created_by,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?)').run(name, b.folder || '', b.mime || 'text/plain', Buffer.byteLength(text), '', 'text', text, who(id), now, now);
        return send(res, 200, { ok: true, id: Number(info.lastInsertRowid) });
      }
      const buf = Buffer.from(String(b.data || ''), 'base64'); const store = `${now}-${crypto.randomBytes(4).toString('hex')}-${name}`;
      fs.writeFileSync(join(FILES_DIR, store), buf);
      const info = db.prepare('INSERT INTO files(name,folder,mime,size,store,kind,created_by,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?)').run(name, b.folder || '', b.mime || 'application/octet-stream', buf.length, store, 'binary', who(id), now, now);
      return send(res, 200, { ok: true, id: Number(info.lastInsertRowid) }); }
    if ((m = path.match(/^\/files\/(\d+)\/raw$/)) && method === 'GET') { if (!id) return needAuth(); const f = db.prepare('SELECT * FROM files WHERE id=?').get(Number(m[1])); if (!f) return send(res, 404, { ok: false, error: 'not found' });
      if (f.kind === 'text') { res.writeHead(200, { 'Content-Type': f.mime || 'text/plain; charset=utf-8' }); return res.end(f.text_body || ''); }
      const p = join(FILES_DIR, f.store); if (!existsSync(p)) return send(res, 410, { ok: false, error: 'blob missing' });
      res.writeHead(200, { 'Content-Type': f.mime, 'Content-Length': f.size, 'Content-Disposition': `inline; filename="${basename(f.name)}"` }); return createReadStream(p).pipe(res); }
    if ((m = path.match(/^\/files\/(\d+)$/)) && method === 'GET') { if (!id) return needAuth(); const f = db.prepare('SELECT * FROM files WHERE id=?').get(Number(m[1])); return f ? send(res, 200, { ok: true, file: f }) : send(res, 404, { ok: false, error: 'not found' }); }
    if ((m = path.match(/^\/files\/(\d+)$/)) && method === 'PATCH') { if (!id) return needAuth(); const f = db.prepare('SELECT * FROM files WHERE id=?').get(Number(m[1])); if (!f) return send(res, 404, { ok: false, error: 'not found' }); const b = await readBody(req, MAX_UPLOAD) || {};
      const text = b.text != null && f.kind === 'text' ? b.text : f.text_body;
      db.prepare('UPDATE files SET name=?,folder=?,text_body=?,size=?,updated_at=? WHERE id=?').run(b.name ?? f.name, b.folder ?? f.folder, text, f.kind === 'text' ? Buffer.byteLength(text) : f.size, Date.now(), f.id); return send(res, 200, { ok: true }); }
    if ((m = path.match(/^\/files\/(\d+)$/)) && method === 'DELETE') { if (!id) return needAuth(); const f = db.prepare('SELECT * FROM files WHERE id=?').get(Number(m[1])); if (f) { if (f.store) try { fs.unlinkSync(join(FILES_DIR, f.store)); } catch {} db.prepare('DELETE FROM files WHERE id=?').run(f.id); } return send(res, 200, { ok: true }); }

    // BOARDS (whiteboards)
    if (path === '/boards' && method === 'GET') { if (!id) return needAuth(); return send(res, 200, { ok: true, boards: db.prepare('SELECT id,name,links,updated_by,created_at,updated_at FROM boards ORDER BY updated_at DESC').all() }); }
    if (path === '/boards' && method === 'POST') { if (!id) return needAuth(); const b = await readBody(req, MAX_UPLOAD) || {}; const now = Date.now();
      const info = db.prepare('INSERT INTO boards(name,data,links,updated_by,created_at,updated_at) VALUES(?,?,?,?,?,?)').run(b.name || 'Untitled board', b.data || '', JSON.stringify(b.links || []), who(id), now, now); return send(res, 200, { ok: true, id: Number(info.lastInsertRowid) }); }
    if ((m = path.match(/^\/boards\/(\d+)$/)) && method === 'GET') { if (!id) return needAuth(); const bd = db.prepare('SELECT * FROM boards WHERE id=?').get(Number(m[1])); return bd ? send(res, 200, { ok: true, board: bd }) : send(res, 404, { ok: false, error: 'not found' }); }
    if ((m = path.match(/^\/boards\/(\d+)$/)) && method === 'PATCH') { if (!id) return needAuth(); const bd = db.prepare('SELECT * FROM boards WHERE id=?').get(Number(m[1])); if (!bd) return send(res, 404, { ok: false, error: 'not found' }); const b = await readBody(req, MAX_UPLOAD) || {};
      db.prepare('UPDATE boards SET name=?,data=?,links=?,updated_by=?,updated_at=? WHERE id=?').run(b.name ?? bd.name, b.data ?? bd.data, b.links != null ? JSON.stringify(b.links) : bd.links, who(id), Date.now(), bd.id); return send(res, 200, { ok: true }); }
    if ((m = path.match(/^\/boards\/(\d+)$/)) && method === 'DELETE') { if (!id) return needAuth(); db.prepare('DELETE FROM boards WHERE id=?').run(Number(m[1])); return send(res, 200, { ok: true }); }

    // ---------- AGENT PLATFORM: classes -> instances -> sessions ----------
    const isAdmin = id?.kind === 'user' && id.user.role === 'admin';
    const owns = (row) => id && (row.owner === who(id) || isAdmin);
    const liveStatus = (inst) => {
      if (inst.status === 'down') return 'down';
      const age = Date.now() - (inst.last_heartbeat || inst.created_at);
      if (age > INSTANCE_DOWN_MS) return 'down';
      if (age > INSTANCE_LOST_MS && inst.status !== 'pending') return 'lost';
      return inst.status;
    };
    const parseSkills = (s) => { try { const v = JSON.parse(s || '[]'); return Array.isArray(v) ? v : []; } catch { return []; } };
    const instView = (inst, key = false) => ({ id: inst.id, class_id: inst.class_id, owner: inst.owner, name: inst.name, visibility: inst.visibility, kind: inst.kind, status: liveStatus(inst), broker: inst.broker, skills: parseSkills(inst.skills), last_heartbeat: inst.last_heartbeat, created_at: inst.created_at, ...(key ? { accesskey: inst.accesskey } : {}) });
    // chatlog insert: persists the message (file kinds keep only the placeholder) and wakes long-pollers
    const addMsg = (sessionId, role, kind, content, file = {}) => {
      const seq = db.prepare('SELECT COALESCE(MAX(seq),0) s FROM chat_messages WHERE session_id=?').get(sessionId).s + 1;
      db.prepare('INSERT INTO chat_messages(session_id,seq,role,kind,content,file_name,file_size,file_mime,file_token,created_at) VALUES(?,?,?,?,?,?,?,?,?,?)')
        .run(sessionId, seq, role, kind, String(content || '').slice(0, 32000), String(file.name || '').slice(0, 200), Number(file.size) || 0, String(file.mime || '').slice(0, 100), file.token || '', Date.now());
      wakeChat(sessionId);
      return seq;
    };
    // who may touch a session: the instance's broker (accesskey) acts as 'agent';
    // the hiring party / instance owner / admin act as 'user'.
    const sessionRole = (sess, inst, akey) => {
      if (akey && akey === inst.accesskey) return 'agent';
      if (id && (sess.party === who(id) || inst.owner === who(id) || isAdmin)) return 'user';
      return null;
    };
    const slugify = (s) => String(s || 'agent').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 40) || 'agent';

    // public stats for the tavern frontpage
    if (path === '/agents/stats' && method === 'GET') {
      const classes = db.prepare("SELECT COUNT(*) n FROM agent_classes WHERE visibility='public'").get().n;
      const insts = db.prepare('SELECT * FROM agent_instances').all();
      const online = insts.filter((i) => liveStatus(i) === 'online').length;
      const sessions = db.prepare("SELECT COUNT(*) n FROM agent_sessions WHERE status='active'").get().n;
      const owners = db.prepare('SELECT COUNT(DISTINCT owner) n FROM agent_classes').get().n;
      const tagRows = db.prepare("SELECT tags FROM agent_classes WHERE visibility='public'").all();
      const tags = {}; tagRows.forEach((r) => (r.tags || '').split(',').map((t) => t.trim()).filter(Boolean).forEach((t) => (tags[t] = (tags[t] || 0) + 1)));
      return send(res, 200, { ok: true, classes, instances: insts.length, online, sessions, owners, tags });
    }

    // live activity feed (public, derived from existing tables)
    if (path === '/agents/activity' && method === 'GET') {
      const items = [];
      for (const c of db.prepare("SELECT name, owner, created_at FROM agent_classes WHERE visibility='public' ORDER BY created_at DESC LIMIT 8").all())
        items.push({ kind: 'class', text: `${c.owner} published “${c.name}”`, at: c.created_at });
      for (const i of db.prepare("SELECT i.created_at, i.owner, c.name cn FROM agent_instances i JOIN agent_classes c ON c.id=i.class_id WHERE i.visibility='public' ORDER BY i.created_at DESC LIMIT 8").all())
        items.push({ kind: 'instance', text: `${i.owner} ran an instance of “${i.cn}”`, at: i.created_at });
      for (const s of db.prepare("SELECT s.started_at, c.name cn FROM agent_sessions s LEFT JOIN agent_classes c ON c.id=s.class_id ORDER BY s.started_at DESC LIMIT 8").all())
        items.push({ kind: 'session', text: `a session started on “${s.cn || 'an agent'}”`, at: s.started_at });
      for (const sc of db.prepare('SELECT owner, host, created_at FROM showcases ORDER BY created_at DESC LIMIT 5').all())
        items.push({ kind: 'showcase', text: `${sc.owner} opened a showcase ${sc.host}`, at: sc.created_at });
      items.sort((a, b) => b.at - a.at);
      return send(res, 200, { ok: true, activity: items.slice(0, 12) });
    }

    // online presence (public lobby — no auth; visitors see each other in the tavern)
    if (path === '/agents/presence' && method === 'POST') {
      const b = await readBody(req) || {};
      const pid = String(b.id || '').slice(0, 40); if (!pid) return send(res, 400, { ok: false, error: 'id required' });
      const dir = ['up', 'down', 'left', 'right'].includes(b.dir) ? b.dir : 'down';
      presence.set(pid, { id: pid, name: String(b.name || 'wanderer').slice(0, 24), x: Math.round(Number(b.x) || 0), y: Math.round(Number(b.y) || 0), dir, frame: Math.max(0, Math.min(8, Number(b.frame) || 0)), sheet: String(b.sheet || 'soldier2').slice(0, 16), room: String(b.room || 'tavern').slice(0, 16), at: Date.now() });
      return send(res, 200, { ok: true, players: presenceList(pid) });
    }
    if (path === '/agents/presence' && method === 'GET') return send(res, 200, { ok: true, players: presenceList(null) });

    // browse classes (public + own private)
    if (path === '/agents/classes' && method === 'GET') {
      const tag = url.searchParams.get('tag'); const q = (url.searchParams.get('q') || '').toLowerCase(); const mine = url.searchParams.get('mine');
      let rows = db.prepare('SELECT * FROM agent_classes ORDER BY updated_at DESC').all();
      const me = id ? who(id) : null;
      rows = rows.filter((c) => c.visibility === 'public' || (me && c.owner === me) || isAdmin);
      if (mine && me) rows = rows.filter((c) => c.owner === me);
      if (tag) rows = rows.filter((c) => (c.tags || '').split(',').map((t) => t.trim()).includes(tag));
      if (q) rows = rows.filter((c) => (c.name + ' ' + c.tags + ' ' + c.description).toLowerCase().includes(q));
      const out = rows.map((c) => {
        const insts = db.prepare('SELECT * FROM agent_instances WHERE class_id=?').all(c.id);
        return { ...c, tags: (c.tags || '').split(',').map((t) => t.trim()).filter(Boolean), instanceCount: insts.length, onlineCount: insts.filter((i) => liveStatus(i) === 'online').length };
      });
      return send(res, 200, { ok: true, classes: out });
    }
    if (path === '/agents/classes' && method === 'POST') {
      if (!id) return needAuth();
      const b = await readBody(req) || {}; const now = Date.now();
      const tags = Array.isArray(b.tags) ? b.tags.join(',') : (b.tags || '');
      let slug = slugify(b.slug || b.name); let n = 1;
      while (db.prepare('SELECT id FROM agent_classes WHERE slug=?').get(slug)) slug = `${slugify(b.name)}-${++n}`;
      const info = db.prepare('INSERT INTO agent_classes(slug,name,owner,tags,description,kind,command,visibility,managed,terminal_mode,skills_reload,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)')
        .run(slug, b.name || 'Agent', who(id), tags, b.description || '', b.kind || 'codex', b.command || '', b.visibility === 'private' ? 'private' : 'public',
          b.managed ? 1 : 0, b.terminalMode === 'shared' ? 'shared' : 'new', b.skillsReload === false ? 0 : 1, now, now);
      return send(res, 200, { ok: true, id: Number(info.lastInsertRowid), slug });
    }
    if ((m = path.match(/^\/agents\/classes\/(\d+)$/)) && method === 'GET') {
      const c = db.prepare('SELECT * FROM agent_classes WHERE id=?').get(Number(m[1])); if (!c) return send(res, 404, { ok: false, error: 'not found' });
      const me = id ? who(id) : null;
      if (c.visibility !== 'public' && !(me && c.owner === me) && !isAdmin) return send(res, 403, { ok: false, error: 'private class' });
      let insts = db.prepare('SELECT * FROM agent_instances WHERE class_id=?').all(c.id);
      insts = insts.filter((i) => i.visibility === 'public' || owns(i)).map((i) => instView(i, owns(i)));
      return send(res, 200, { ok: true, class: { ...c, tags: (c.tags || '').split(',').map((t) => t.trim()).filter(Boolean) }, instances: insts });
    }
    if ((m = path.match(/^\/agents\/classes\/(\d+)$/)) && (method === 'PATCH' || method === 'DELETE')) {
      const c = db.prepare('SELECT * FROM agent_classes WHERE id=?').get(Number(m[1])); if (!c) return send(res, 404, { ok: false, error: 'not found' });
      if (!owns(c)) return send(res, 403, { ok: false, error: 'not owner' });
      if (method === 'DELETE') { db.prepare('DELETE FROM agent_classes WHERE id=?').run(c.id); db.prepare('DELETE FROM agent_instances WHERE class_id=?').run(c.id); return send(res, 200, { ok: true }); }
      const b = await readBody(req) || {}; const tags = Array.isArray(b.tags) ? b.tags.join(',') : (b.tags ?? c.tags);
      db.prepare('UPDATE agent_classes SET name=?,tags=?,description=?,kind=?,command=?,visibility=?,managed=?,terminal_mode=?,skills_reload=?,updated_at=? WHERE id=?')
        .run(b.name ?? c.name, tags, b.description ?? c.description, b.kind ?? c.kind, b.command ?? c.command, b.visibility ?? c.visibility,
          b.managed != null ? (b.managed ? 1 : 0) : c.managed, b.terminalMode != null ? (b.terminalMode === 'shared' ? 'shared' : 'new') : c.terminal_mode,
          b.skillsReload != null ? (b.skillsReload ? 1 : 0) : c.skills_reload, Date.now(), c.id);
      return send(res, 200, { ok: true });
    }
    // subscription token for a class
    if ((m = path.match(/^\/agents\/classes\/(\d+)\/subscribe$/)) && method === 'POST') {
      if (!id) return needAuth(); const c = db.prepare('SELECT * FROM agent_classes WHERE id=?').get(Number(m[1])); if (!c) return send(res, 404, { ok: false, error: 'not found' });
      const me = who(id);
      let sub = db.prepare('SELECT * FROM class_subscriptions WHERE class_id=? AND party=?').get(c.id, me);
      if (!sub) { const tok = 'sub_' + crypto.randomBytes(18).toString('base64url'); db.prepare('INSERT INTO class_subscriptions(class_id,party,token,created_at) VALUES(?,?,?,?)').run(c.id, me, tok, Date.now()); sub = { token: tok }; }
      return send(res, 200, { ok: true, token: sub.token, classSlug: c.slug });
    }

    // instances
    if (path === '/agents/instances' && method === 'GET') {
      const classId = url.searchParams.get('classId'); const me = id ? who(id) : null;
      let rows = classId ? db.prepare('SELECT * FROM agent_instances WHERE class_id=?').all(Number(classId)) : db.prepare('SELECT * FROM agent_instances').all();
      rows = rows.filter((i) => i.visibility === 'public' || (me && i.owner === me) || isAdmin);
      return send(res, 200, { ok: true, instances: rows.map((i) => instView(i, owns(i))) });
    }
    if (path === '/agents/instances' && method === 'POST') {
      if (!id) return needAuth(); const b = await readBody(req) || {};
      const c = db.prepare('SELECT * FROM agent_classes WHERE id=?').get(Number(b.classId)); if (!c) return send(res, 404, { ok: false, error: 'class not found' });
      const accesskey = 'ik_' + crypto.randomBytes(20).toString('base64url');
      const info = db.prepare('INSERT INTO agent_instances(class_id,owner,name,accesskey,visibility,kind,status,created_at,last_heartbeat) VALUES(?,?,?,?,?,?,?,?,?)')
        .run(c.id, who(id), b.name || `${c.name} instance`, accesskey, b.visibility === 'private' ? 'private' : 'public', b.kind || 'persistent', 'pending', Date.now(), Date.now());
      return send(res, 200, { ok: true, id: Number(info.lastInsertRowid), accesskey, classSlug: c.slug, relayWs: `wss://amerc.ai/webagent/ws?role=broker&token=${accesskey}` });
    }
    if ((m = path.match(/^\/agents\/instances\/(\d+)$/)) && method === 'GET') {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      const akey = url.searchParams.get('accesskey'); const authed = owns(inst) || (akey && akey === inst.accesskey);
      if (inst.visibility !== 'public' && !authed) return send(res, 403, { ok: false, error: 'private instance' });
      return send(res, 200, { ok: true, instance: instView(inst, authed), tui: authed ? inst.tui : undefined });
    }
    // heartbeat (broker, by accesskey — no session needed)
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/heartbeat$/)) && method === 'POST') {
      const b = await readBody(req, MAX_UPLOAD) || {}; const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      if (b.accesskey !== inst.accesskey) return send(res, 401, { ok: false, error: 'bad accesskey' });
      const status = b.status === 'down' ? 'down' : 'online';
      const skills = Array.isArray(b.skills) ? JSON.stringify(b.skills.slice(0, 64).map((s) => String(s).slice(0, 80))) : inst.skills;
      db.prepare('UPDATE agent_instances SET status=?,last_heartbeat=?,broker=?,tui=?,skills=? WHERE id=?').run(status, Date.now(), b.broker || inst.broker, b.tui != null ? String(b.tui).slice(0, 20000) : inst.tui, skills, inst.id);
      // tell the broker which of its sessions are live, so it can long-poll their chat
      const live = db.prepare("SELECT id FROM agent_sessions WHERE instance_id=? AND status='active'").all(inst.id).map((r) => r.id);
      return send(res, 200, { ok: true, status, activeSessions: live });
    }
    // web-pty: lightweight tui frame push from the broker (keeps it online too)
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/tui$/)) && method === 'POST') {
      const b = await readBody(req, MAX_UPLOAD) || {}; const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      if (b.accesskey !== inst.accesskey) return send(res, 401, { ok: false, error: 'bad accesskey' });
      db.prepare('UPDATE agent_instances SET tui=?,last_heartbeat=?,status=? WHERE id=?').run(String(b.tui || '').slice(0, 20000), Date.now(), inst.status === 'down' ? 'online' : inst.status, inst.id);
      return send(res, 200, { ok: true });
    }
    // web-pty: browser posts keystrokes (owner/accesskey); broker long-polls them
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/input$/)) && method === 'POST') {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      const b = await readBody(req) || {};
      if (!(owns(inst) || (b.accesskey && b.accesskey === inst.accesskey))) return send(res, 403, { ok: false, error: 'only the owner can drive this terminal' });
      if (typeof b.data !== 'string') return send(res, 400, { ok: false, error: 'data required' });
      let q = inputQueues.get(inst.id); if (!q) { q = []; inputQueues.set(inst.id, q); }
      q.push(b.data.slice(0, 8192));
      if (q.length > 256) q.splice(0, q.length - 256);
      wakeInput(inst.id);
      return send(res, 200, { ok: true });
    }
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/input$/)) && method === 'GET') {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      if (url.searchParams.get('accesskey') !== inst.accesskey) return send(res, 401, { ok: false, error: 'bad accesskey' });
      let q = inputQueues.get(inst.id) || [];
      if (!q.length && url.searchParams.get('wait')) { await waitInput(inst.id, 25000); q = inputQueues.get(inst.id) || []; }
      inputQueues.set(inst.id, []);
      return send(res, 200, { ok: true, input: q });
    }
    if ((m = path.match(/^\/agents\/instances\/(\d+)$/)) && method === 'DELETE') {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      const b = await readBody(req) || {}; if (!owns(inst) && b.accesskey !== inst.accesskey) return send(res, 403, { ok: false, error: 'not authorized' });
      db.prepare("UPDATE agent_instances SET status='down' WHERE id=?").run(inst.id);
      db.prepare("UPDATE agent_sessions SET status='closed', ended_at=? WHERE instance_id=? AND status='active'").run(Date.now(), inst.id);
      return send(res, 200, { ok: true });
    }
    // start a session against an instance
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/sessions$/)) && method === 'POST') {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      const b = await readBody(req) || {}; const authed = owns(inst) || (b.accesskey && b.accesskey === inst.accesskey) || (inst.visibility === 'public' && id);
      if (!authed) return send(res, 403, { ok: false, error: 'not authorized — need login (public) or accesskey (private)' });
      const info = db.prepare('INSERT INTO agent_sessions(instance_id,class_id,party,connector,status,started_at) VALUES(?,?,?,?,?,?)')
        .run(inst.id, inst.class_id, id ? who(id) : 'anon', b.connector || 'chat', 'active', Date.now());
      const sid = Number(info.lastInsertRowid);
      addMsg(sid, 'system', 'event', `session opened by ${id ? who(id) : 'anon'}`);
      return send(res, 200, { ok: true, sessionId: sid, relayToken: inst.accesskey, relayWs: `wss://amerc.ai/webagent/ws?role=iframe&token=${inst.accesskey}`, chatboxJs: `https://webagent.amerc.ai/client.js?token=${inst.accesskey}` });
    }
    if ((m = path.match(/^\/agents\/sessions\/(\d+)\/close$/)) && method === 'POST') {
      db.prepare("UPDATE agent_sessions SET status='closed', ended_at=? WHERE id=?").run(Date.now(), Number(m[1]));
      addMsg(Number(m[1]), 'system', 'event', 'session closed');
      return send(res, 200, { ok: true });
    }

    // ---------- CHAT: native amerc chat — no external relay needed ----------
    // my chatlog: every session I started, or that runs on an instance I own
    if (path === '/agents/sessions' && method === 'GET') {
      if (!id) return needAuth();
      const me = who(id);
      const rows = db.prepare(`SELECT s.*, c.name class_name, c.slug class_slug, i.name inst_name, i.owner inst_owner
        FROM agent_sessions s LEFT JOIN agent_classes c ON c.id=s.class_id LEFT JOIN agent_instances i ON i.id=s.instance_id
        WHERE s.party=? OR i.owner=?${isAdmin ? ' OR 1=1' : ''} ORDER BY s.started_at DESC LIMIT 100`).all(me, me);
      const out = rows.map((s) => {
        const last = db.prepare('SELECT role,kind,content,file_name,created_at FROM chat_messages WHERE session_id=? ORDER BY seq DESC LIMIT 1').get(s.id);
        const n = db.prepare("SELECT COUNT(*) n FROM chat_messages WHERE session_id=? AND kind!='event'").get(s.id).n;
        return { ...s, messageCount: n, last };
      });
      return send(res, 200, { ok: true, sessions: out });
    }
    // poll/long-poll messages: GET ?after=<seq>&wait=1 — agent side passes ?accesskey=
    if ((m = path.match(/^\/agents\/sessions\/(\d+)\/messages$/)) && method === 'GET') {
      const sess = db.prepare('SELECT * FROM agent_sessions WHERE id=?').get(Number(m[1])); if (!sess) return send(res, 404, { ok: false, error: 'not found' });
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(sess.instance_id);
      const role = sessionRole(sess, inst, url.searchParams.get('accesskey'));
      if (!role) return send(res, 403, { ok: false, error: 'not in this session' });
      const after = Number(url.searchParams.get('after') || 0);
      const fetchRows = () => db.prepare('SELECT seq,role,kind,content,file_name,file_size,file_mime,file_token,created_at FROM chat_messages WHERE session_id=? AND seq>? ORDER BY seq LIMIT 200').all(sess.id, after);
      let rows = fetchRows();
      if (!rows.length && url.searchParams.get('wait')) { await waitChat(sess.id, 25000); rows = fetchRows(); }
      const fresh = db.prepare('SELECT status FROM agent_sessions WHERE id=?').get(sess.id);
      return send(res, 200, { ok: true, messages: rows, sessionStatus: fresh.status, instanceStatus: liveStatus(inst), skills: parseSkills(inst.skills) });
    }
    // send a message: browser (cookie) or broker (accesskey in body)
    if ((m = path.match(/^\/agents\/sessions\/(\d+)\/messages$/)) && method === 'POST') {
      const sess = db.prepare('SELECT * FROM agent_sessions WHERE id=?').get(Number(m[1])); if (!sess) return send(res, 404, { ok: false, error: 'not found' });
      if (sess.status !== 'active') return send(res, 409, { ok: false, error: 'session closed' });
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(sess.instance_id);
      const b = await readBody(req) || {};
      const role = sessionRole(sess, inst, b.accesskey);
      if (!role) return send(res, 403, { ok: false, error: 'not in this session' });
      if (!b.content || typeof b.content !== 'string') return send(res, 400, { ok: false, error: 'content required' });
      const seq = addMsg(sess.id, role, 'text', b.content);
      return send(res, 200, { ok: true, seq });
    }
    // FILE RELAY (no cache): producer streams the raw body here; the bytes wait
    // in this paused request until the other side claims the token — the server
    // stores nothing. The chatlog records only "there was a file".
    if ((m = path.match(/^\/agents\/sessions\/(\d+)\/files$/)) && method === 'POST') {
      const sess = db.prepare('SELECT * FROM agent_sessions WHERE id=?').get(Number(m[1])); if (!sess) return send(res, 404, { ok: false, error: 'not found' });
      if (sess.status !== 'active') return send(res, 409, { ok: false, error: 'session closed' });
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(sess.instance_id);
      const role = sessionRole(sess, inst, url.searchParams.get('accesskey'));
      if (!role) return send(res, 403, { ok: false, error: 'not in this session' });
      const meta = {
        name: (url.searchParams.get('name') || 'file').replace(/[/\\]/g, '_').slice(0, 200),
        size: Number(req.headers['content-length']) || Number(url.searchParams.get('size')) || 0,
        mime: req.headers['content-type'] && req.headers['content-type'] !== 'application/x-www-form-urlencoded' ? req.headers['content-type'] : 'application/octet-stream',
      };
      const token = 'f_' + crypto.randomBytes(18).toString('base64url');
      offerFile(token, req, res, meta);
      addMsg(sess.id, role, 'file', `sent ${meta.name}`, { ...meta, token });
      return; // responds when claimed (delivered) or after the 5-min timeout
    }
    // claim a relayed file: single-use capability token from the chat message
    if ((m = path.match(/^\/agents\/files\/([A-Za-z0-9_-]+)$/)) && method === 'GET') {
      if (claimFile(m[1], res)) return; // piped
      return send(res, 410, { ok: false, error: 'file gone — relay links are single-use and expire in 5 minutes' });
    }

    // ---------- FILE-MAPPER: stable agent-published file links, broker-relayed ----------
    // agent registers/lists/unregisters named files on its instance
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/fm$/))) {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      if (method === 'GET') {
        const akey = url.searchParams.get('accesskey');
        if (!(owns(inst) || (akey && akey === inst.accesskey))) return send(res, 403, { ok: false, error: 'not authorized' });
        return send(res, 200, { ok: true, maps: db.prepare('SELECT * FROM file_maps WHERE instance_id=? ORDER BY name').all(inst.id) });
      }
      const b = await readBody(req) || {};
      if (!(owns(inst) || (b.accesskey && b.accesskey === inst.accesskey))) return send(res, 403, { ok: false, error: 'not authorized' });
      if (method === 'POST') {
        const name = String(b.name || '').toLowerCase().replace(/[^a-z0-9._-]/g, '').slice(0, 80);
        if (!name) return send(res, 400, { ok: false, error: 'name required (letters/numbers/._-)' });
        db.prepare('INSERT INTO file_maps(instance_id,owner,name,file_name,size,mime,created_at) VALUES(?,?,?,?,?,?,?) ON CONFLICT(instance_id,name) DO UPDATE SET file_name=excluded.file_name,size=excluded.size,mime=excluded.mime')
          .run(inst.id, inst.owner, name, String(b.fileName || name).slice(0, 200), Number(b.size) || 0, String(b.mime || 'application/octet-stream').slice(0, 100), Date.now());
        return send(res, 200, { ok: true, url: `https://amerc.ai/api/fm/${inst.id}/${name}` });
      }
      if (method === 'DELETE') {
        db.prepare('DELETE FROM file_maps WHERE instance_id=? AND name=?').run(inst.id, String(b.name || ''));
        return send(res, 200, { ok: true });
      }
    }
    // my mapped files across my instances (Mansion room)
    if (path === '/fm' && method === 'GET') {
      if (!id) return needAuth();
      const rows = db.prepare(`SELECT f.*, i.status inst_status, i.last_heartbeat, i.created_at inst_created, c.name class_name
        FROM file_maps f JOIN agent_instances i ON i.id=f.instance_id LEFT JOIN agent_classes c ON c.id=i.class_id
        WHERE f.owner=? ORDER BY f.created_at DESC`).all(who(id));
      return send(res, 200, { ok: true, maps: rows.map((r) => ({ ...r, inst_status: liveStatus({ status: r.inst_status, last_heartbeat: r.last_heartbeat, created_at: r.inst_created }), url: `https://amerc.ai/api/fm/${r.instance_id}/${r.name}` })) });
    }
    // public download: relayed live through the broker, nothing cached
    if ((m = path.match(/^\/fm\/(\d+)\/([a-z0-9._-]+)$/)) && method === 'GET') {
      const map = db.prepare('SELECT * FROM file_maps WHERE instance_id=? AND name=?').get(Number(m[1]), m[2]);
      if (!map) return send(res, 404, { ok: false, error: 'no such mapped file' });
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(map.instance_id);
      if (!inst || liveStatus(inst) !== 'online') return send(res, 503, { ok: false, error: 'the instance serving this file is offline' });
      const token = 'j_' + crypto.randomBytes(18).toString('base64url');
      enqueueJob(inst.id, { token, kind: 'file', name: map.name, file_name: map.file_name }, res, { name: map.file_name, size: map.size, mime: map.mime });
      return; // responds when the broker delivers (or 504)
    }
    // broker long-polls its fetch jobs
    if ((m = path.match(/^\/agents\/instances\/(\d+)\/jobs$/)) && method === 'GET') {
      const inst = db.prepare('SELECT * FROM agent_instances WHERE id=?').get(Number(m[1])); if (!inst) return send(res, 404, { ok: false, error: 'not found' });
      if (url.searchParams.get('accesskey') !== inst.accesskey) return send(res, 401, { ok: false, error: 'bad accesskey' });
      let jobs = pendingJobs.get(inst.id) || [];
      if (!jobs.length && url.searchParams.get('wait')) { await waitJobs(inst.id, 25000); jobs = pendingJobs.get(inst.id) || []; }
      pendingJobs.delete(inst.id);
      return send(res, 200, { ok: true, jobs });
    }
    // broker pushes the bytes for a job (raw body) -> piped to the waiting browser
    if ((m = path.match(/^\/agents\/jobs\/([A-Za-z0-9_-]+)$/)) && method === 'POST') {
      if (fulfillJob(m[1], req, res)) return;
      return send(res, 410, { ok: false, error: 'job gone — the requester disconnected or timed out' });
    }

    // ---------- self-service agent keys (any logged-in user) ----------
    if (path === '/keys' && method === 'GET') {
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      return send(res, 200, { ok: true, keys: db.prepare('SELECT id,name,prefix,created_at,last_used FROM api_keys WHERE owner=? ORDER BY id DESC').all(id.user.handle) });
    }
    if (path === '/keys' && method === 'POST') {
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      const b = await readBody(req) || {}; const raw = `amk_${crypto.randomBytes(24).toString('base64url')}`;
      const info = db.prepare('INSERT INTO api_keys(name,key_hash,prefix,owner,created_at) VALUES(?,?,?,?,?)').run((b.name || 'my-agent').slice(0, 40), hashKey(raw), raw.slice(0, 12), id.user.handle, Date.now());
      return send(res, 200, { ok: true, id: Number(info.lastInsertRowid), key: raw, note: 'store this key now; it is not shown again' });
    }
    if ((m = path.match(/^\/keys\/(\d+)$/)) && method === 'DELETE') {
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      const k = db.prepare('SELECT * FROM api_keys WHERE id=?').get(Number(m[1]));
      if (k && (k.owner === id.user.handle || id.user.role === 'admin')) db.prepare('DELETE FROM api_keys WHERE id=?').run(k.id);
      return send(res, 200, { ok: true });
    }

    // ---------- SHOWCASE (reverse-proxy subdomains) — amerc mansion service ----------
    if (path === '/showcase' && method === 'GET') {
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      return send(res, 200, { ok: true, showcases: db.prepare('SELECT id,name,host,created_at FROM showcases WHERE owner=? ORDER BY id DESC').all(id.user.handle) });
    }
    if (path === '/showcase' && method === 'POST') {
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      const b = await readBody(req) || {};
      const handle = id.user.handle.toLowerCase().replace(/[^a-z0-9]/g, '');
      const name = String(b.name || '').toLowerCase().replace(/[^a-z0-9-]/g, '').slice(0, 30);
      if (!name || !handle) return send(res, 400, { ok: false, error: 'name required (letters/numbers)' });
      const host = `${name}.${handle}.amerc.ai`;
      if (db.prepare('SELECT id FROM showcases WHERE host=?').get(host)) return send(res, 409, { ok: false, error: 'showcase already registered' });
      const dns = await godaddyEnsureWildcard(handle);
      // provision per-user wildcard TLS cert + nginx vhost (idempotent, async)
      try { if (existsSync('/home/amerc/showcase-cert.sh')) spawn('/home/amerc/showcase-cert.sh', [handle], { detached: true, stdio: 'ignore' }).unref(); } catch { /* best effort */ }
      db.prepare('INSERT INTO showcases(owner,name,host,created_at) VALUES(?,?,?,?)').run(id.user.handle, name, host, Date.now());
      return send(res, 200, { ok: true, host, url: `https://${host}/`, edgeToken: showcaseToken(host), edgeWs: 'wss://amerc.ai/showcase/ws', dns: dns.ok ? 'configured' : (dns.error || 'pending'), tls: 'HTTPS provisions automatically (~1-2 min on your first showcase)' });
    }
    if ((m = path.match(/^\/showcase\/(\d+)$/)) && method === 'DELETE') {
      if (id?.kind !== 'user') return send(res, 401, { ok: false, error: 'login required' });
      const s = db.prepare('SELECT * FROM showcases WHERE id=?').get(Number(m[1]));
      if (s && (s.owner === id.user.handle || id.user.role === 'admin')) db.prepare('DELETE FROM showcases WHERE id=?').run(s.id);
      return send(res, 200, { ok: true });
    }

    return send(res, 404, { ok: false, error: 'not found' });
  } catch (err) {
    return send(res, 500, { ok: false, error: 'server error', detail: String(err && err.message || err) });
  }
});

server.listen(PORT, '127.0.0.1', () => console.log(`amerc-api v2 listening on 127.0.0.1:${PORT}, db=${DB_PATH}, files=${FILES_DIR}`));
