// InstantAdPay — membership advertising with immutable on-chain settlement.
// Zero-dependency Node server (RM Circle pattern): static pages + JSON API,
// wallet sign-in (SIWE), live contract ledger, sponsor join links.
//
// Chain selection (Amoy rehearsal vs mainnet) lives in data/config.json —
// see chain.js. Wipe the volume's accounts/sessions + flip config = launch.
const http = require('http');
const https = require('https');
const dns = require('dns');
const fs = require('fs');
const path = require('path');
const crypto = require('crypto');
const sendy = require('./sendy');
const { URL } = require('url');
const chain = require('./chain');
const auth = require('./auth');
const accounts = require('./accounts');
const ads = require('./ads');
const mailer = require('./mailer');
const messages = require('./messages');
const reports = require('./reports');
const drip = require('./drip');
const spaces = require('./spaces'); // DO Spaces video storage (inert unless DO_SPACES_* set)
let QR = null; try { QR = require('qrcode'); } catch (e) { /* optional */ }
const chatbot = require('./chatbot');

const PORT = Number(process.env.PORT || 3000);
const ROOT = __dirname;
const PUBLIC_DIR = path.join(ROOT, 'public');
const DATA_DIR = process.env.DATA_DIR || path.join(ROOT, 'data');
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'changeme';
const ADMIN_EMAIL = String(process.env.ADMIN_EMAIL || '').trim().toLowerCase();
// Admin portal sessions: email-code sign-in allowlisted to ADMIN_EMAIL, kept
// in the volume so a restart doesn't log the admin out. Separate cookie and
// store from member sessions; the Bearer ADMIN_PASSWORD API path still works.
const ADMIN_SESS_FILE = path.join(DATA_DIR, 'admin-sessions.json');
const ADMIN_TTL = 12 * 60 * 60 * 1000;
let adminSessions = {};
try { adminSessions = JSON.parse(fs.readFileSync(ADMIN_SESS_FILE, 'utf8')) || {}; } catch (e) { adminSessions = {}; }
function saveAdminSessions() {
  const now = Date.now();
  for (const k of Object.keys(adminSessions)) if (!adminSessions[k] || adminSessions[k].expires < now) delete adminSessions[k];
  try { fs.writeFileSync(ADMIN_SESS_FILE, JSON.stringify(adminSessions), { mode: 0o600 }); } catch (e) {}
}
function mintAdminSession(email) {
  const t = crypto.randomBytes(32).toString('hex');
  adminSessions[t] = { email, expires: Date.now() + ADMIN_TTL };
  saveAdminSessions();
  return t;
}
function adminTokenOf(req) { const m = /(?:^|;\s*)iap\.adm=([^;]+)/.exec(req.headers.cookie || ''); return m ? decodeURIComponent(m[1]) : null; }
function adminFromRequest(req) { const t = adminTokenOf(req); const s = t && adminSessions[t]; return (s && s.expires > Date.now()) ? s : null; }
function dropAdminSession(req) { const t = adminTokenOf(req); if (t && adminSessions[t]) { delete adminSessions[t]; saveAdminSessions(); } }
function adminCookie(t) { return 'iap.adm=' + encodeURIComponent(t) + '; Path=/; HttpOnly; SameSite=Lax; Max-Age=' + (ADMIN_TTL / 1000) + (IS_PROD ? '; Secure' : ''); }
function clearAdminCookie() { return 'iap.adm=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0'; }
const IS_PROD = process.env.NODE_ENV === 'production';
const SITE_FILE = path.join(DATA_DIR, 'site.json');

const db = require('./db');
fs.mkdirSync(DATA_DIR, { recursive: true });
const UPLOADS_DIR = path.join(DATA_DIR, 'uploads'); // solo-ad media lives on the volume
fs.mkdirSync(UPLOADS_DIR, { recursive: true });
const uploadCounts = new Map(); // email:day -> uploads today
const gauntletTokens = new Map(); // email -> welcome-tour token (server-clock dwell floor)
const videoTokens = new Map(); // email -> watch-to-earn video token (server-clock watch floor)
const faucetHits = new Map(); // address -> last faucet ts (rehearsal test-POL faucet rate limit)
const visitTokens = new Map(); // email -> verified-visit token (dwell + captcha floor)
// walk the referral chain upward via sponsorRef (code/username/member id)
async function uplineSlides(email, depth = 3) {
  const out = [];
  let cur = await accounts.byEmail(email);
  for (let i = 0; i < depth && cur; i++) {
    const ref = String(cur.sponsorRef || '').trim().toLowerCase();
    if (!ref) break;
    let s = null;
    if (/^\d+$/.test(ref)) s = await accounts.byMemberId(Number(ref));
    if (!s) s = await accounts.byCode(ref);
    if (!s) s = await accounts.byUsername(ref);
    if (!s || s.email === cur.email) break;
    out.push(s);
    cur = s;
  }
  return out;
}
// Wall ownership ladder: position 1 is always the member's own line banner;
// positions 2 and 3 become theirs at 2 and 5 qualifying buyers (the same
// thresholds that open payout levels 2 and 3). Until then, or while an unlocked
// slot is empty, the slot shows an upline's banner, then a house ad.
const wallUnlockedFor = bc => (bc >= 5 ? 3 : bc >= 2 ? 2 : 1);
function parseWallOffers(a) {
  try { const v = JSON.parse((a && a.wallOffers) || '[]'); return Array.isArray(v) ? v.slice(0, 2) : []; } catch (e) { return []; }
}
// admin fallback ads for wall positions 2 & 3 when a member has no upline.
// Configurable by dropping data/admin-wall-ads.json ([{name,targetUrl,bannerUrl}]).
function getAdminWallAds() {
  try { const j = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'admin-wall-ads.json'), 'utf8')); if (Array.isArray(j) && j.length) return j; } catch (e) {}
  return [{ name: 'InstantAdPay', targetUrl: 'https://instantadpay.com/', bannerUrl: null }];
}
const chatHits = new Map();
function chatLimited(ip) {
  const now = Date.now(), rec = chatHits.get(ip);
  if (!rec || now > rec.reset) { chatHits.set(ip, { count: 1, reset: now + 60000 }); return false; }
  rec.count += 1;
  return rec.count > 10;
}
// magic-code sign-in: emailLower -> {code, exp, tries}
const emailCodes = new Map();
// earn-view tokens: emailLower -> {token, ts} (one live token per member)
const earnTokens = new Map();
// human-check pairs for the view verifier: [emoji shown, word named in the prompt]
const CAPTCHA = [['🚀', 'rocket'], ['⚡', 'lightning bolt'], ['🔑', 'key'], ['🎯', 'target'],
  ['🌊', 'wave'], ['🔥', 'flame'], ['💎', 'diamond'], ['🧲', 'magnet'], ['🔔', 'bell'], ['🌙', 'moon']];

// ── frame-breaking check ─────────────────────────────────
// Surf views frame the advertiser's URL full screen, so a target that refuses
// framing (X-Frame-Options / CSP frame-ancestors) would burn members' views on
// a blank frame. Catch it the moment the campaign is submitted. The lookup
// also refuses private/internal addresses so member URLs can't probe our LAN.
const PRIVATE_IP = /^(127\.|10\.|192\.168\.|169\.254\.|0\.|172\.(1[6-9]|2\d|3[01])\.|::1$|::$|f[cd])/i;
function frameFetch(url, depth) {
  return new Promise(resolve => {
    let u;
    try { u = new URL(String(url || '')); } catch (e) { return resolve({ error: 'that is not a valid URL' }); }
    if (!/^https?:$/.test(u.protocol)) return resolve({ error: 'only http(s) URLs work' });
    if (u.port && u.port !== '80' && u.port !== '443') return resolve({ error: 'custom ports are not allowed' });
    if (u.hostname === 'localhost' || u.hostname.endsWith('.local')) return resolve({ error: 'that address is not reachable from here' });
    dns.lookup(u.hostname, (de, addr) => {
      if (de) return resolve({ error: 'that domain does not resolve' });
      if (PRIVATE_IP.test(addr)) return resolve({ error: 'that address is not reachable from here' });
      const mod = u.protocol === 'https:' ? https : http;
      const rq = mod.get(u.href, { timeout: 8000,
        headers: { 'User-Agent': 'Mozilla/5.0 (compatible; InstantAdPay-FrameCheck/1.0)', Accept: 'text/html' } }, r => {
        const loc = r.headers.location;
        r.resume(); // headers are all we need
        if ([301, 302, 303, 307, 308].includes(r.statusCode) && loc && depth < 4) {
          rq.destroy();
          let next; try { next = new URL(loc, u.href).href; } catch (e2) { return resolve({ error: 'it redirects somewhere invalid' }); }
          return resolve(frameFetch(next, depth + 1)); // every hop re-runs the private-IP guard
        }
        resolve({ status: r.statusCode, xfo: r.headers['x-frame-options'] || '', csp: r.headers['content-security-policy'] || '' });
        rq.destroy();
      });
      rq.on('timeout', () => { rq.destroy(); resolve({ error: 'it did not answer within 8 seconds' }); });
      rq.on('error', e2 => resolve({ error: 'it did not answer (' + (e2.code || 'connection failed') + ')' }));
    });
  });
}
// shared upload path for member creatives (/api/my/upload) and admin house-ad
// creatives (/api/admin/upload): `who` keys the per-day upload counter
async function handleUpload(req, res, who) {
  const ct = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
  const EXT = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp', 'image/gif': 'gif',
    'video/mp4': 'mp4', 'video/webm': 'webm' };
  if (!EXT[ct]) return json(res, 400, { error: 'Use a PNG, JPG, WebP, GIF, MP4 or WebM file.' });
  const isVideo = ct.startsWith('video/');
  const key = who + ':' + new Date().toISOString().slice(0, 10);
  if ((uploadCounts.get(key) || 0) >= 10) return json(res, 400, { error: 'Upload limit for today reached (10 files).' });
  let buf;
  try { buf = await readRaw(req, isVideo ? 25 * 1024 * 1024 : 3 * 1024 * 1024); }
  catch (e) { return json(res, 400, { error: 'File too large. Images up to 3MB, video up to 25MB.' }); }
  const magicOk = buf.length > 16 && (
    (ct === 'image/png' && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) ||
    (ct === 'image/jpeg' && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) ||
    (ct === 'image/webp' && buf.slice(0, 4).toString() === 'RIFF' && buf.slice(8, 12).toString() === 'WEBP') ||
    (ct === 'image/gif' && buf.slice(0, 4).toString() === 'GIF8') ||
    (ct === 'video/mp4' && buf.slice(4, 8).toString() === 'ftyp') ||
    (ct === 'video/webm' && buf[0] === 0x1a && buf[1] === 0x45 && buf[2] === 0xdf && buf[3] === 0xa3));
  if (!magicOk) return json(res, 400, { error: 'That file does not look like a real ' + EXT[ct].toUpperCase() + '.' });
  const name = crypto.randomBytes(12).toString('hex') + '.' + EXT[ct];
  uploadCounts.set(key, (uploadCounts.get(key) || 0) + 1);
  // video goes to DO Spaces when configured (keeps big files off the volume);
  // images stay local. Falls back to the volume if Spaces isn't set or errors.
  if (isVideo && spaces.enabled()) {
    try {
      const url = await spaces.put('iap-uploads/' + name, buf, ct);
      return json(res, 200, { url, type: 'video' });
    } catch (e) { console.error('spaces put', e.message); /* fall through to volume */ }
  }
  fs.writeFileSync(path.join(UPLOADS_DIR, name), buf);
  return json(res, 200, { url: '/uploads/' + name, type: isVideo ? 'video' : 'image' });
}
// lead-capture page hooks (og tags + copy live in public/assets/join.js too)
const JOIN_ANGLES = {
  instant: { t: 'Paid before the page reloads.', d: 'A smart contract on Polygon splits every ad package the moment it sells. Same transaction, real wallets, public ledger. Join free by email.' },
  adspend: { t: 'You were buying ads anyway.', d: 'Here the ad spend in your line pays you, in the same transaction, on a public ledger. Seven formats, packages from $5. Join free.' },
  free: { t: 'Watch first. Spend never.', d: 'Join free, view a few ads, earn credits, run your first campaign for zero dollars. Every payout public on Polygon.' },
  ledger: { t: 'No back office. No payday.', d: 'Every payout is a public transaction on Polygon you can read yourself. Nothing is ever held. Join free by email.' },
  two: { t: 'Two buyers open level two.', d: 'Every direct buyer pays you 50 percent from their first package. Two qualifying buyers open level two, five open level three. Written in a verified contract.' }
};
function serveJoinPage(res, tok, angle, ang, setCookies) {
  let html;
  try { html = fs.readFileSync(path.join(PUBLIC_DIR, 'join.html'), 'utf8'); } catch (e) { res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' })); return res.end('Not found'); }
  const base = 'https://instantadpay.com';
  const url = base + '/join/' + tok + (angle ? '?v=' + angle : '');
  const title = ang ? ang.t : 'Advertise and earn. Paid on-chain, instantly.';
  const desc = ang ? ang.d : 'You are invited to InstantAdPay: real ad packages with same-transaction payouts on Polygon, every payment public. Join free by email.';
  const escA = t => String(t).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
  const og = '<meta property="og:type" content="website"><meta property="og:site_name" content="InstantAdPay">'
    + '<meta property="og:title" content="' + escA(title) + '"><meta property="og:description" content="' + escA(desc) + '">'
    + '<meta property="og:url" content="' + escA(url) + '">' // keeps ?v= so shares stay on the angle
    + '<meta property="og:image" content="' + base + '/banners/iap-hero-1200x630.png"><meta property="og:image:width" content="1200"><meta property="og:image:height" content="630">'
    + '<meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="' + escA(title) + '"><meta name="twitter:description" content="' + escA(desc) + '"><meta name="twitter:image" content="' + base + '/banners/iap-hero-1200x630.png">';
  html = html.replace(/<title>[^<]*<\/title>/, '<title>' + escA(title) + ' | InstantAdPay</title>' + og);
  const headers = { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store, must-revalidate' };
  if (setCookies && setCookies.length) headers['Set-Cookie'] = setCookies;
  res.writeHead(200, baseHeaders(headers));
  res.end(html);
}
async function frameCheck(url) {
  const h = await frameFetch(url, 0);
  if (h.error) return { ok: false, reason: 'We checked your URL and ' + h.error + '. Fix the URL and try again.' };
  if (h.status >= 400) return { ok: false, reason: 'Your URL answers with HTTP ' + h.status + '. Point the campaign at a working page.' };
  if (/deny|sameorigin/i.test(String(h.xfo)))
    return { ok: false, reason: 'That site blocks framing (X-Frame-Options), so it would show members a blank page in the ad viewer. Use a landing page that allows framing.' };
  const fa = /frame-ancestors\s+([^;]+)/i.exec(String(h.csp));
  if (fa && !fa[1].split(/\s+/).some(x => {
    const v = x.replace(/['"]/g, '').toLowerCase();
    return v === '*' || v === 'https:' || v.includes('instantadpay.com');
  }))
    return { ok: false, reason: 'That site blocks framing (CSP frame-ancestors), so it would show members a blank page in the ad viewer. Use a landing page that allows framing.' };
  return { ok: true };
}
async function boot() {
  await db.init({ dataDir: DATA_DIR }); // no-op without DATABASE_URL (JSON mode)
  chain.init({ onEvent: ev => { attachNames([ev]).then(a => pushFeed(a[0])).catch(() => pushFeed(ev)); emailOnEvent(ev).catch(() => {}); } });
  auth.init({ dataDir: DATA_DIR, chain, isProd: IS_PROD, site: 'instantadpay.com' });
  accounts.init({ dataDir: DATA_DIR });
  ads.init({ dataDir: DATA_DIR, chain });
  mailer.init({ dataDir: DATA_DIR });
  messages.init({ dataDir: DATA_DIR });
  reports.init({ dataDir: DATA_DIR });
  drip.init({ dataDir: DATA_DIR, mailer, accounts, chain, site: 'https://instantadpay.com' });
  chatbot.init({ dataDir: DATA_DIR, chain });
  setTimeout(() => ads.dailySweep().catch(e => console.error('sweep', e.message)), 60 * 1000);
  setInterval(() => ads.dailySweep().catch(e => console.error('sweep', e.message)), 60 * 60 * 1000);
  // follow-up email sequence: send whatever came due (every 10 min, first pass shortly after boot)
  setTimeout(() => drip.tick().catch(e => console.error('drip', e.message)), 30 * 1000);
  setInterval(() => drip.tick().catch(e => console.error('drip', e.message)), 10 * 60 * 1000);
  // NAS reconcile: pull syndicated delivery into the unified credit pool
  // (inert unless NAS_DB_* is set). Every 5 min after a short warm-up.
  if (ads.nasEnabled()) {
    console.log('NAS syndication enabled');
    setTimeout(() => ads.reconcileNas().catch(e => console.error('nas reconcile', e.message)), 90 * 1000);
    setInterval(() => ads.reconcileNas().catch(e => console.error('nas reconcile', e.message)), 5 * 60 * 1000);
  }
}

function siteConfig() {
  let saved = {};
  try { saved = JSON.parse(fs.readFileSync(SITE_FILE, 'utf8')); } catch (e) {}
  return Object.assign({
    siteName: 'InstantAdPay',
    tagline: 'Advertise and earn. Locked in code, not promises.',
    rehearsal: true // shows the testnet banner; flipped off at mainnet launch
  }, saved);
}

// ---- helpers ----
const MIME = { '.html': 'text/html; charset=utf-8', '.css': 'text/css', '.js': 'text/javascript',
  '.png': 'image/png', '.jpg': 'image/jpeg', '.svg': 'image/svg+xml', '.webp': 'image/webp',
  '.ico': 'image/x-icon', '.json': 'application/json', '.mp4': 'video/mp4', '.woff2': 'font/woff2',
  '.gif': 'image/gif', '.webm': 'video/webm', '.txt': 'text/plain; charset=utf-8', '.xml': 'application/xml; charset=utf-8' };
const CSP = "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net 'sha256-NzvNrqk5jB9YZATwo5BF4JoRlJ02HsnFikbKXgEPdaQ='; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https:; media-src 'self' https: blob:; connect-src 'self' https://*.walletconnect.com wss://*.walletconnect.com https://*.walletconnect.org wss://*.walletconnect.org https://*.reown.com wss://*.reown.com https://*.reown.org wss://*.reown.org https://*.web3modal.org https://*.drpc.org https://*.publicnode.com https://*.coinbase.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.reown.com; form-action 'self'; frame-src https: http:";
function baseHeaders(extra) {
  return Object.assign({ 'Content-Security-Policy': CSP, 'X-Content-Type-Options': 'nosniff',
    'Referrer-Policy': 'strict-origin-when-cross-origin' }, extra || {});
}
function json(res, code, obj, extra) {
  const body = JSON.stringify(obj);
  res.writeHead(code, baseHeaders(Object.assign({ 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }, extra)));
  res.end(body);
}
function sendFile(res, file) {
  fs.readFile(file, (err, data) => {
    if (err) { res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' })); return res.end('Not found'); }
    const ext = path.extname(file).toLowerCase();
    res.writeHead(200, baseHeaders({ 'Content-Type': MIME[ext] || 'application/octet-stream',
      // HTML is never stored (so a fresh load always gets the current asset
      // versions — aggressive in-app wallet browsers were serving stale pages
      // that pointed at old, since-fixed JS); versioned assets cache for an hour.
      'Cache-Control': ext === '.html' ? 'no-store, must-revalidate' : 'public, max-age=3600' }));
    res.end(data);
  });
}
function readRaw(req, maxBytes) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    let n = 0;
    req.on('data', c => {
      n += c.length;
      if (n > maxBytes) { req.destroy(); reject(new Error('too big')); return; }
      chunks.push(c);
    });
    req.on('end', () => resolve(Buffer.concat(chunks)));
    req.on('error', reject);
  });
}
function readBody(req) {
  return new Promise((resolve, reject) => {
    let d = ''; let n = 0;
    req.on('data', c => { n += c.length; if (n > 64 * 1024) { req.destroy(); reject(new Error('too big')); } d += c; });
    req.on('end', () => { try { resolve(d ? JSON.parse(d) : {}); } catch (e) { reject(e); } });
    req.on('error', reject);
  });
}
function parseCookies(req) {
  const out = {};
  for (const p of (req.headers.cookie || '').split(';')) {
    const i = p.indexOf('='); if (i > 0) out[p.slice(0, i).trim()] = decodeURIComponent(p.slice(i + 1).trim());
  }
  return out;
}
function isAdmin(req) {
  const h = req.headers.authorization || '';
  if (h === 'Bearer ' + ADMIN_PASSWORD) return true;
  return !!adminFromRequest(req); // /admin portal session
}
// attach a memberId->username map to events so activity shows real people
async function attachNames(evts) {
  try {
    const ids = [];
    for (const ev of evts)
      for (const k of ['id', 'buyerId', 'recipientId', 'skippedId', 'sponsorId', 'newBuyerId', 'toId', 'memberId'])
        if (ev[k]) ids.push(ev[k]);
    const names = await accounts.namesForMembers(ids);
    if (!Object.keys(names).length) return evts;
    return evts.map(ev => Object.assign({}, ev, { names }));
  } catch (e) { return evts; }
}
// A sponsor token is a numeric chain id or a site share code. Codes resolve
// to the referrer's CURRENT chain id, so activation any time before the
// referral's first purchase still locks the line to them.
async function resolveSponsorToken(tok) {
  const t = String(tok || '').trim().toLowerCase();
  if (!t) return 0;
  if (/^\d+$/.test(t)) return Number(t);
  let acct = await accounts.byCode(t);
  if (!acct) acct = await accounts.byUsername(t); // vanity links: /join/<username>
  if (!acct || !acct.address) return 0;
  try { return await chain.memberIdByAccount(acct.address); } catch (e) { return 0; }
}
// The moment someone joins through a code, nudge its owner to activate.
// Email a member's sponsor the moment they get a new referral (free OR paid).
// Resolves the sponsor from the join token by member id, share code, or username,
// and notifies EVERY sponsor — activated or not (an active sponsor still wants to
// know their team grew). A referral is on the line from signup; it only counts
// toward qualification once it makes a $20+ purchase.
async function notifyNewReferral(ref, newAcct) {
  try {
    if (!mailer.hasKey()) return;
    const t = String(ref || '').trim().toLowerCase();
    if (!t) return;
    let owner = null;
    if (/^\d+$/.test(t)) { try { owner = await accounts.byMemberId(Number(t)); } catch (e) {} }
    if (!owner) { try { owner = await accounts.byCode(t); } catch (e) {} }
    if (!owner) { try { owner = await accounts.byUsername(t); } catch (e) {} }
    if (!owner || !owner.email) return;
    const who = newAcct && newAcct.username ? '@' + newAcct.username : 'A new member';
    let body = who + ' just joined InstantAdPay through your link — they are on your team from today.\n\n'
      + 'They count toward your qualification once they make a $20+ purchase.\n\n';
    if (!owner.address) body += 'Make sure payouts are switched on (one free wallet step) so you never miss a commission — '
      + 'the contract locks each buyer to their sponsor at their first purchase.\n\n';
    body += 'See your team: https://instantadpay.com/my\n\nInstantAdPay';
    mailer.send(owner.email, 'You have a new referral on InstantAdPay', body)
      .catch(e => console.error('referral notify failed', e.message));
  } catch (e) {}
}
// welcome email on a new account: onboarding steps + who their sponsor is
async function sendWelcome(email, ref) {
  try {
    if (!mailer.hasKey()) return;
    const spon = await accounts.sponsorOf(email);
    const who = spon ? (spon.username ? '@' + spon.username : 'member #' + (spon.memberId || 0)) : '';
    const sponsorLine = who ? ('You joined through ' + who + ', your sponsor. They are there to help you get started, and you can message them anytime from your dashboard.\n\n') : '';
    mailer.send(email, 'Welcome to InstantAdPay',
      'Your free InstantAdPay account is ready.\n\n' + sponsorLine
      + 'Getting started:\n'
      + '1. Pick your username and fill out your profile.\n'
      + '2. Grab your invite link and start sharing to build your line.\n'
      + '3. Explore the ad packages when you are ready. Every payout settles on-chain, straight to your wallet.\n\n'
      + 'Sign in anytime: https://instantadpay.com/my\n\nInstantAdPay').catch(() => {});
  } catch (e) {}
}
// on-chain event emails: a payout received, or a payout that passed you by
const weiToPol = w => { try { return (Number(BigInt(w) / (10n ** 14n)) / 10000).toString(); } catch (e) { return '?'; } };
async function emailOnEvent(ev) {
  if (!mailer.hasKey() || !ev) return;
  const notify = async (memberId, subject, body) => {
    if (!memberId) return;
    const a = await accounts.byMemberId(memberId);
    if (a && a.email) mailer.send(a.email, subject, body + '\n\nSee it on the live ledger: https://instantadpay.com/ledger\n\nInstantAdPay').catch(() => {});
  };
  if (ev.type === 'Purchase') {
    const cc = chain.getConfig();
    const txUrl = (cc.explorer ? cc.explorer.replace(/\/+$/, '') : 'https://polygonscan.com') + '/tx/' + ev.tx;
    let bal = ev.creditAmount;
    try { bal = await chain.creditBalance(ev.buyerId, ev.creditType); } catch (e) {}
    await notify(ev.buyerId, 'Your InstantAdPay purchase is confirmed',
      'Your purchase is complete and settled on-chain.\n\n' +
      'Ad credits added: ' + ev.creditAmount + '\n' +
      'Your ad-credit balance is now: ' + bal + '\n' +
      'Amount paid: ' + weiToPol(ev.paidWei) + ' POL\n\n' +
      'View your transaction on the blockchain:\n' + txUrl);
    // tell the buyer's DIRECT sponsor their referral just bought (upline earners
    // are separately notified by the TierPaid payout email when they earn)
    try {
      const buyer = await chain.member(ev.buyerId);
      if (buyer && buyer.sponsorId) {
        const sp = await accounts.byMemberId(buyer.sponsorId);
        if (sp && sp.email) {
          const ba = await accounts.byMemberId(ev.buyerId);
          const bn = ba && ba.username ? '@' + ba.username : 'One of your referrals';
          const usd = ('$' + (ev.priceCents / 100).toFixed(2)).replace(/\.00$/, '');
          const qual = ev.priceCents >= 2000
            ? ' This is a $20+ purchase, so it counts toward your qualification.'
            : ' (Purchases under $20 do not count toward qualification.)';
          mailer.send(sp.email, 'Your referral just bought an ad package',
            bn + ' just purchased a package (' + usd + ' — ' + ev.creditAmount + ' credits).' + qual + '\n\n' +
            'See your team and the live ledger: https://instantadpay.com/my\n\nInstantAdPay').catch(() => {});
        }
      }
    } catch (e) {}
  }
  else if (ev.type === 'TierPaid') await notify(ev.recipientId, 'You just got paid on InstantAdPay', 'A level-' + ev.tier + ' payout of ' + weiToPol(ev.amountWei) + ' POL just landed in your wallet.');
  else if (ev.type === 'AwardPaid') await notify(ev.toId, 'You just got paid on InstantAdPay', weiToPol(ev.amountWei) + ' POL just landed in your wallet.');
  else if (ev.type === 'PassedUp') await notify(ev.skippedId, 'A payout passed you by on InstantAdPay', 'A level-' + ev.tier + ' payout passed you by because you were not qualified yet. Get qualified so you catch the next one.');
}

// ---- live feed (SSE) ----
const feedClients = new Set();
function pushFeed(ev) {
  const line = 'data: ' + JSON.stringify(ev) + '\n\n';
  for (const res of feedClients) { try { res.write(line); } catch (e) { feedClients.delete(res); } }
}

// ---- server ----
const server = http.createServer(async (req, res) => {
  try {
    const u = new URL(req.url, 'http://x');
    const p = u.pathname;

    // -- join links: /join/<memberId or share code> — first-touch cookie.
    //    Codes resolve LATE (at buy time) to whatever chain id the referrer
    //    has by then, so free members refer from day one.
    let m = /^\/join\/([A-Za-z0-9_]{1,20})$/.exec(p);
    if (m && (req.method === 'GET' || req.method === 'HEAD')) {
      // lead-capture page: email first, wallet later. ?v=<angle> picks the hook
      // copy and is remembered so the account records which angle converted.
      const tok = m[1].toLowerCase();
      const cookies = parseCookies(req);
      const angle = String(u.searchParams.get('v') || '').toLowerCase();
      const ang = JOIN_ANGLES[angle] || null;
      const cookieTail = `; Path=/; SameSite=Lax; Max-Age=${180 * 24 * 3600}${IS_PROD ? '; Secure' : ''}`;
      const set = [];
      if (!cookies['iap.sponsor']) set.push('iap.sponsor=' + tok + cookieTail);
      if (ang) set.push('iap.angle=' + angle + cookieTail);
      return serveJoinPage(res, tok, ang ? angle : '', ang, set);
    }
    if (p === '/unsubscribe' && req.method === 'GET') {
      const r = await drip.unsubscribe(u.searchParams.get('e'), u.searchParams.get('t'));
      const msg = r.error ? r.error : 'Done. You will not get any more follow-up emails from InstantAdPay. Your account is unchanged.';
      res.writeHead(r.error ? 400 : 200, baseHeaders({ 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }));
      return res.end('<!doctype html><html><head><meta charset="utf-8"><title>InstantAdPay</title><link rel="stylesheet" href="/assets/site.css?v=20260909a"></head><body><div class="wrap" style="max-width:560px;padding:80px 22px"><a href="/"><img src="/logo.png" alt="InstantAdPay" style="height:34px"></a><h1 style="font-size:30px;margin:26px 0 12px">' + (r.error ? 'Hmm.' : 'Unsubscribed.') + '</h1><p>' + msg + '</p><p><a class="btn small sec" href="/my">Member area</a></p></div></body></html>');
    }

    // -- public API
    if (p === '/api/config' && req.method === 'GET') {
      const c = chain.getConfig();
      return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId,
        chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0],
        emailAuth: mailer.hasKey() || !IS_PROD }, siteConfig()));
    }
    if (p === '/api/moonpay-url' && req.method === 'GET') {
      // Card on-ramp deep link. With MoonPay keys set — PUBLIC key via
      // MOONPAY_PUBLIC_KEY env or site config, SECRET key via MOONPAY_SECRET_KEY
      // env ONLY (never site config, since /api/config exposes siteConfig) —
      // returns a SIGNED checkout URL prefilled with the buyer's own wallet and
      // a POL amount; otherwise a generic MoonPay buy page. Zero custody either
      // way: MoonPay is merchant of record and the crypto goes straight to the
      // buyer's wallet — this site never touches or holds anyone's money.
      const addr = (u.searchParams.get('address') || '').trim();
      let pol = Math.round(Number(u.searchParams.get('pol')) || 0);
      if (!pol || pol < 30) pol = 30;
      if (pol > 100000) pol = 100000;
      const pk = (process.env.MOONPAY_PUBLIC_KEY || siteConfig().moonpayPublicKey || '').trim();
      const sk = (process.env.MOONPAY_SECRET_KEY || '').trim();
      if (pk && sk && /^0x[0-9a-fA-F]{40}$/.test(addr)) {
        const qs = '?apiKey=' + encodeURIComponent(pk) + '&currencyCode=pol_polygon&walletAddress=' + encodeURIComponent(addr) + '&quoteCurrencyAmount=' + pol;
        const sig = crypto.createHmac('sha256', sk).update(qs).digest('base64');
        return json(res, 200, { url: 'https://buy.moonpay.com/' + qs + '&signature=' + encodeURIComponent(sig), signed: true, pol });
      }
      return json(res, 200, { url: 'https://www.moonpay.com/buy/pol', signed: false, pol });
    }
    if (p === '/api/catalog' && req.method === 'GET') {
      return json(res, 200, { products: await chain.catalog() });
    }
    if (p === '/api/feed' && req.method === 'GET') {
      return json(res, 200, { events: await attachNames(chain.recentEvents(Number(u.searchParams.get('n')) || 100)) });
    }
    if (p === '/api/feed/live' && req.method === 'GET') {
      res.writeHead(200, baseHeaders({ 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-store', Connection: 'keep-alive' }));
      res.write(': connected\n\n');
      feedClients.add(res);
      req.on('close', () => feedClients.delete(res));
      return;
    }
    m = /^\/api\/tx\/(0x[0-9a-fA-F]{64})$/.exec(p);
    if (m && req.method === 'GET') {
      // tx relay so the browser never talks to the RPC directly (CSP stays 'self').
      // Serves both the wallet's waitTx poll (found/status) and the built-in
      // /tx/<hash> viewer (full details + decoded events).
      try {
        const r = await chain.rpc('eth_getTransactionReceipt', [m[1]]);
        if (!r) return json(res, 200, { found: false });
        const out = { found: true, status: r.status, blockNumber: r.blockNumber, gasUsed: r.gasUsed };
        try {
          const t = await chain.rpc('eth_getTransactionByHash', [m[1]]);
          if (t) { out.from = t.from; out.to = t.to; out.valueWei = BigInt(t.value || '0x0').toString(); }
        } catch (e) {}
        try {
          const blk = await chain.rpc('eth_getBlockByNumber', [r.blockNumber, false]);
          if (blk) out.ts = blk.timestamp;
        } catch (e) {}
        try {
          out.events = await attachNames((r.logs || []).map(chain.decodeLog).filter(Boolean)
            .map(ev => Object.assign(ev, { tx: m[1] })));
        } catch (e) { out.events = []; }
        return json(res, 200, out);
      } catch (e) { return json(res, 200, { found: false, rpcError: true }); }
    }
    if (p === '/api/sponsor' && req.method === 'GET') {
      // The account's stored sponsor is authoritative — it persists across
      // devices, cleared cookies, and return visits. Fall back to the first-touch
      // cookie only for anonymous visitors with no account sponsor yet. (Reading
      // the cookie alone was orphaning buyers to root when the cookie was absent.)
      const s = await auth.fromRequest(req);
      const acct = s && s.email ? await accounts.byEmail(s.email) : null;
      const tok = (acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor'] || '';
      let sponsorId = await resolveSponsorToken(tok);
      // orphan fallback: an unresolvable/absent sponsor (dead link, no link) lands
      // the new member under the configured catch position (#1) instead of root
      if (!sponsorId && (!acct || acct.memberId !== (Number(siteConfig().defaultSponsorId) || 1))) sponsorId = Number(siteConfig().defaultSponsorId) || 1;
      let name = null, avatarUrl = null;
      if (tok) {
        const t = tok.toLowerCase();
        let a = await accounts.byCode(t); if (!a) a = await accounts.byUsername(t);
        if (!a && /^\d+$/.test(tok)) a = await accounts.byMemberId(Number(tok));
        if (a) { name = a.username ? '@' + a.username : (a.memberId ? 'member #' + a.memberId : null); avatarUrl = a.avatarUrl || null; }
      }
      return json(res, 200, { ref: tok, sponsorId, invited: !!tok, name, avatarUrl });
    }
    if (p === '/api/stats' && req.method === 'GET') {
      let members = 0; try { members = await chain.memberCount(); } catch (e) {}
      return json(res, 200, Object.assign({ onchainMembers: members, siteAccounts: await accounts.count() }, chain.totals()));
    }

    // -- 24/7 assistant
    if (p === '/api/chat' && req.method === 'POST') {
      const ip = req.socket.remoteAddress || 'x';
      if (chatLimited(ip)) return json(res, 429, { error: 'Give it a minute, then ask again.' });
      const b = await readBody(req);
      const r = await chatbot.answer(b.message, b.history);
      return json(res, r.error ? 400 : 200, r);
    }

    // -- accounts: email + password is the normal join path (wallet comes
    //    out only at purchase / payout-activation time and gets linked then)
    if (p === '/api/signup' && req.method === 'POST') {
      const b = await readBody(req);
      const ref = parseCookies(req)['iap.sponsor'] || ''; // first-touch attribution
      const r = await accounts.signup(b.email, b.password, ref);
      if (r.error) return json(res, 400, r);
      // sponsor is notified once the new member picks a username (onboarding),
      // so the email can name them — see /api/my/profile
      if (b.newsletter) sendy.subscribe(r.account.email, r.account.username || '').catch(() => {}); // pre-checked opt-in, silent
      const token = await auth.mintSession({ email: r.account.email });
      return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
    }
    if (p === '/api/login' && req.method === 'POST') {
      const b = await readBody(req);
      const r = await accounts.login(b.email, b.password);
      if (r.error) return json(res, 400, r);
      let memberId = 0;
      if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (e) {} }
      const token = await auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
      return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
    }

    // -- passwordless: email code sign-in (signup and login are the same act)
    if (p === '/api/auth/email/start' && req.method === 'POST') {
      const b = await readBody(req);
      const e = String(b.email || '').trim().toLowerCase();
      if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)) return json(res, 400, { error: 'That email address does not look right.' });
      const prev = emailCodes.get(e);
      if (prev && Date.now() < prev.nextAt) return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' });
      const code = String(Math.floor(100000 + Math.random() * 900000));
      emailCodes.set(e, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 });
      if (mailer.hasKey()) {
        try { await mailer.sendCode(e, code); } catch (err) {
          console.error('sendCode failed', err.message);
          return json(res, 502, { error: 'Could not send the email. Try again in a minute.' });
        }
        return json(res, 200, { ok: true, sent: true });
      }
      if (!IS_PROD) return json(res, 200, { ok: true, sent: false, devCode: code });
      return json(res, 503, { error: 'Email sign-in is not configured yet.' });
    }
    if (p === '/api/auth/email/verify' && req.method === 'POST') {
      const b = await readBody(req);
      const e = String(b.email || '').trim().toLowerCase();
      const rec = emailCodes.get(e);
      if (!rec || rec.exp < Date.now()) return json(res, 400, { error: 'Code expired. Request a fresh one.' });
      rec.tries += 1;
      if (rec.tries > 6) { emailCodes.delete(e); return json(res, 400, { error: 'Too many tries. Request a fresh code.' }); }
      if (String(b.code || '').trim() !== rec.code) return json(res, 400, { error: 'That code does not match.' });
      emailCodes.delete(e);
      const ref = parseCookies(req)['iap.sponsor'] || '';
      const via = parseCookies(req)['iap.angle'] || '';
      const r = await accounts.ensure(e, ref, via); // first touch wins; existing accounts unchanged
      if (r.error) return json(res, 400, r);
      // the lead is in the door: queue the getting-started sequence (opt-in box is pre-checked on both forms)
      if (r.created && (b.followups || b.newsletter)) drip.enqueue(e, ref, via).catch(() => {});
      // a wallet-only session (signed with a wallet, no account) finishing setup:
      // adopt that wallet into the email account so member #, purchases and
      // payouts stay attached, then retire the wallet-only session
      const prior = await auth.fromRequest(req);
      if (prior && prior.address && !prior.email) {
        const lr = await accounts.linkWallet(e, prior.address);
        if (lr.error) return json(res, 400, lr);
        r.account = lr.account || await accounts.byEmail(e);
        await auth.logout(req);
      }
      if (r.created) { sendWelcome(e, ref).catch(() => {}); } // sponsor notified at username set (/api/my/profile)
      if (r.created && b.newsletter) sendy.subscribe(r.account.email, r.account.username || '').catch(() => {}); // pre-checked opt-in, silent, new joins only
      let memberId = 0;
      if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (err) {} }
      const token = await auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
      return json(res, 200, { ok: true, account: r.account, created: !!r.created }, { 'Set-Cookie': auth.sessionCookie(token) });
    }

    // -- wallet auth: link-to-account when an email session exists, or
    //    wallet-first sign-in (no UI door since 2026-09-09; a wallet-only session
    //    is walked to the email card, which adopts the wallet on verify)
    if (p === '/api/auth/challenge' && req.method === 'POST') {
      const b = await readBody(req);
      const r = auth.makeChallenge(b.address);
      return json(res, r.error ? 400 : 200, r);
    }
    if (p === '/api/auth/verify' && req.method === 'POST') {
      const b = await readBody(req);
      const r = await auth.verifyChallenge(b.address, b.signature);
      if (r.error) return json(res, 400, r);
      let memberId = 0;
      try { memberId = await chain.memberIdByAccount(r.address); } catch (e) {}
      const s = await auth.fromRequest(req);
      if (s && s.email) {
        const lr = await accounts.linkWallet(s.email, r.address);
        if (lr.error) return json(res, 400, lr);
        await auth.updateSession(s.token, { address: r.address, memberId });
        return json(res, 200, { ok: true, linked: true, address: r.address, memberId });
      }
      const acct = await accounts.byAddress(r.address);
      const token = await auth.mintSession({ email: acct ? acct.email : null, address: r.address, memberId });
      return json(res, 200, { ok: true, address: r.address, memberId },
        { 'Set-Cookie': auth.sessionCookie(token) });
    }
    if (p === '/api/auth/logout' && req.method === 'POST') {
      await auth.logout(req);
      return json(res, 200, { ok: true }, { 'Set-Cookie': auth.clearCookie() });
    }
    if (p === '/api/gas' && req.method === 'GET') {
      try { return json(res, 200, await chain.suggestedFees()); }
      catch (e) { return json(res, 200, {}); }
    }

    if (p === '/api/me' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s) return json(res, 200, { signedIn: false });
      const memberId = await auth.refreshMemberId(s);
      const acct = (s.email && await accounts.byEmail(s.email)) || (s.address && await accounts.byAddress(s.address)) || null;
      let sponsorId = await resolveSponsorToken((acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor']);
      const _defSpon = Number(siteConfig().defaultSponsorId) || 1;
      if (!sponsorId && memberId !== _defSpon) sponsorId = _defSpon; // orphan fallback → #1 (never self-sponsor)
      if (memberId && acct && acct.memberId !== memberId) accounts.setMemberId(acct.email, memberId).catch(() => {});
      const out = { signedIn: true, email: s.email || (acct && acct.email) || null,
        address: s.address || (acct && acct.address) || null, memberId,
        username: (acct && acct.username) || null,
        refCode: (acct && acct.code) || null, sponsorId,
        // profile + line-banner fields so the Profile pane repopulates on reload (were being saved but not returned)
        avatarUrl: (acct && acct.avatarUrl) || null, bio: (acct && acct.bio) || null,
        socials: (acct && acct.socials) || null,
        wallOffers: parseWallOffers(acct),
        lineBannerUrl: (acct && acct.lineBannerUrl) || null, lineTargetUrl: (acct && acct.lineTargetUrl) || null };
      if (memberId) {
        try {
          const mm = await chain.member(memberId);
          out.buyerCount = mm.buyerCount;
          out.onchainSponsorId = mm.sponsorId;
          out.credits = await chain.creditBalance(memberId, 0);
        } catch (e) { out.chainReadError = true; }
      }
      return json(res, 200, out);
    }

    if (p === '/api/my/dashboard' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s) return json(res, 401, { error: 'Sign in first.' });
      const memberId = await auth.refreshMemberId(s);
      const acct = (s.email && await accounts.byEmail(s.email)) || (s.address && await accounts.byAddress(s.address)) || null;
      if (memberId && acct && acct.memberId !== memberId) accounts.setMemberId(acct.email, memberId).catch(() => {});
      const out = { memberId, email: s.email || (acct && acct.email) || null,
        address: s.address || (acct && acct.address) || null,
        username: (acct && acct.username) || null,
        refCode: (acct && acct.code) || null, credits: 0, buyerCount: 0,
        earnedWei: '0', earnCount: 0, referrals: [], welcomeCredits: 0 };
      if (out.email) {
        // welcome credits unlock via the welcome tour when an upline with a
        // line banner exists; members with no tour to walk get them instantly
        const welcomed = await ads.welcomeGranted(out.email);
        const tour = welcomed ? [] : (await uplineSlides(out.email)).filter(a => a.lineTargetUrl);
        if (welcomed || !tour.length) out.welcomeCredits = await ads.grantWelcome(out.email);
        else { out.welcomeCredits = 0; out.gauntletPending = true; }
      }
      if (out.email) out.inboxUnread = await ads.unreadCount(out.email); // delivers pending solos too
      if (out.email) { // sponsor chat: presence heartbeat + unread + my availability + direct sponsor
        accounts.touchSeen(out.email).catch(() => {});
        out.chatUnread = await messages.chatUnread(out.email);
        out.chatAvailable = (acct && acct.chatAvailable !== false);
        const spon = await accounts.sponsorOf(out.email);
        if (spon && spon.email) out.sponsor = {
          email: spon.email,
          name: spon.username ? '@' + spon.username : (spon.memberId ? 'member #' + spon.memberId : 'your sponsor'),
          online: (Date.now() - (spon.lastSeen || 0)) < 60000,
          available: spon.chatAvailable !== false };
      }
      if (out.email) { // unmissable login modal when the upline sent a message
        const un = await messages.newestUnread(out.email);
        if (un) {
          const nm = un.fromMember ? await accounts.namesForMembers([un.fromMember]) : {};
          out.sponsorMsg = { id: un.id, subject: un.subject, body: un.body,
            fromName: (un.fromMember && nm[un.fromMember]) ? '@' + nm[un.fromMember] : (un.fromMember ? 'member #' + un.fromMember : 'your sponsor') };
        }
      }
      if (memberId) {
        try {
          const mm = await chain.member(memberId);
          out.buyerCount = mm.buyerCount;
          out.credits = await ads.availableCredits(memberId);
        } catch (e) { out.chainReadError = true; }
        let earned = 0n, n = 0;
        for (const ev of chain.recentEvents(600)) {
          if ((ev.type === 'TierPaid' && ev.recipientId === memberId) || (ev.type === 'AwardPaid' && ev.toId === memberId)) {
            earned += BigInt(ev.amountWei); n += 1;
          }
        }
        out.earnedWei = earned.toString();
        out.earnCount = n;
      }
      // achievement milestones (same ladder as the Overview stepper) + one-time credit
      // bonuses — computed AFTER buyerCount is read from chain above (else always 0)
      {
        const bc = out.buyerCount || 0;
        const reached = [];
        if (out.memberId) reached.push('payouts');
        if (bc >= 1) reached.push('firstBuyer');
        if (bc >= 2) reached.push('level2');
        if (bc >= 5) reached.push('level3');
        out.milestonesReached = reached;
        if (out.email && reached.length) out.milestonesGranted = await ads.grantMilestones(out.email, reached);
      }
      // who joined through this member: their invite link uses username when set,
      // else code, and the numeric id once on-chain — match all three
      const refs = [];
      if (acct && acct.code) refs.push(acct.code);
      if (acct && acct.username) refs.push(acct.username);
      if (memberId) refs.push(String(memberId));
      const joined = await accounts.listByReferrer(refs);
      out.referrals = joined.map(r => ({
        name: r.username || r.email.replace(/^(.).*(@.*)$/, '$1***$2'), // username, else privacy mask
        joined: r.created,
        status: r.address ? 'wallet linked' : 'joined free'
      }));
      out.isAdmin = !!(ADMIN_EMAIL && out.email && String(out.email).toLowerCase() === ADMIN_EMAIL); // shows the Admin link
      out.wallUnlocked = wallUnlockedFor(out.buyerCount || 0); // how many wall positions are the member's own
      return json(res, 200, out);
    }
    if (p === '/api/my/profile' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const before = await accounts.byEmail(s.email);
      const r = await accounts.setUsername(s.email, b.username);
      // First time a username is set (onboarding): now there's a real name to
      // show, so notify the sponsor here rather than at signup (where it'd just
      // say "a new member"). Fires once — only on the empty→set transition.
      if (!r.error && before && !before.username && b.username) {
        const acct = await accounts.byEmail(s.email);
        notifyNewReferral(acct && acct.sponsorRef, acct).catch(() => {});
      }
      return json(res, r.error ? 400 : 200, r);
    }
    // -- earn credits by viewing ads (attention-gated daily claim)
    if (p === '/api/my/earn' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      return json(res, 200, await ads.viewStatus(s.email));
    }
    // fraud-guarded view flow: the server issues a single-use token when it
    // serves the ad, and only counts the view if the dwell elapsed on the
    // SERVER clock. Client-side focus tracking pauses the countdown; this is
    // the floor a script cannot cheat past.
    if (p === '/api/my/earnview' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const status = await ads.viewStatus(s.email);
      if (status.views >= status.target || status.claimed) return json(res, 200, { ad: null, status });
      const type = String(u.searchParams.get('type') || 'banner');
      // members never see (or earn from) their own campaigns in the viewer
      const ad = await ads.serve(type === 'text' ? 'text' : 'banner', { excludeEmail: s.email });
      if (!ad) return json(res, 200, { ad: null, status });
      const token = crypto.randomBytes(16).toString('hex');
      // the viewer tab frames the advertiser's REAL url (no click counted for a paid view)
      earnTokens.set(s.email, { token, ts: Date.now(), adId: ad.id,
        targetUrl: await ads.targetOf(ad.id), adName: ad.title || ad.name || null });
      return json(res, 200, { ad, token, viewUrl: '/view/' + token, status });
    }
    // the viewer tab asks where to point the frame (does not consume the token)
    if (p === '/api/my/viewinfo' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const t = earnTokens.get(s.email);
      if (!t || t.token !== String(u.searchParams.get('token') || ''))
        return json(res, 400, { error: 'That view is no longer open. Head back to the dashboard and load the next ad.' });
      return json(res, 200, { targetUrl: t.targetUrl, adName: t.adName || null,
        dwell: ads.rates().viewDwellSeconds || 10 });
    }
    // human check: handed out only once the dwell has elapsed on the SERVER clock
    if (p === '/api/my/viewchallenge' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const t = earnTokens.get(s.email);
      if (!t || t.token !== String(u.searchParams.get('token') || ''))
        return json(res, 400, { error: 'That view is no longer open.' });
      const dwellMs = (ads.rates().viewDwellSeconds || 10) * 1000;
      const age = Date.now() - t.ts;
      if (age < dwellMs - 400) return json(res, 200, { early: true, wait: Math.ceil((dwellMs - age) / 1000) });
      if (age > 5 * 60 * 1000) { earnTokens.delete(s.email); return json(res, 400, { error: 'That ad went stale. Load a fresh one.' }); }
      const pick = CAPTCHA.slice().sort(() => Math.random() - 0.5).slice(0, 5);
      const answer = Math.floor(Math.random() * pick.length);
      t.challenge = { answer };
      return json(res, 200, { prompt: pick[answer][1], options: pick.map(x => x[0]) });
    }
    if (p === '/api/my/adview' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const t = earnTokens.get(s.email);
      const dwellMs = (ads.rates().viewDwellSeconds || 10) * 1000;
      if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That view did not check out. Load the next ad and let it finish.' });
      const age = Date.now() - t.ts;
      if (age < dwellMs - 400) return json(res, 400, { error: 'Watch the full ad first.' });
      if (age > 5 * 60 * 1000) { earnTokens.delete(s.email); return json(res, 400, { error: 'That ad went stale. Load a fresh one.' }); }
      // the human check must be solved on the same token
      if (!t.challenge) return json(res, 400, { error: 'Finish the quick check first.', retry: true });
      if (Number(b.answer) !== t.challenge.answer) {
        t.attempts = (t.attempts || 0) + 1;
        t.challenge = null; // force a fresh challenge for the next try
        if (t.attempts >= 3) { earnTokens.delete(s.email); return json(res, 400, { error: 'Three misses — that view is void. Head back and load the next ad.' }); }
        return json(res, 400, { error: 'Wrong pick.', retry: true });
      }
      earnTokens.delete(s.email); // single use
      return json(res, 200, await ads.recordView(s.email));
    }
    if (p === '/api/my/claim' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const r = await ads.claimDaily(s.email);
      return json(res, r.error ? 400 : 200, r);
    }
    // -- downline lineage: 3 levels, usernames+IDs; email only for directs
    if (p === '/api/my/line' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const levels = await accounts.downline(s.email, 3);
      // what each person has paid THIS member so far: sum of TierPaid events where
      // this member is the recipient and that person is the buyer (all indexed events)
      const myId = await auth.refreshMemberId(s);
      const earnedBy = {};
      if (myId) {
        for (const ev of chain.recentEvents(1e9)) {
          if (ev.type === 'TierPaid' && ev.recipientId === myId && ev.buyerId)
            earnedBy[ev.buyerId] = (BigInt(earnedBy[ev.buyerId] || '0') + BigInt(ev.amountWei)).toString();
        }
      }
      const out = levels.map(L => ({ level: L.level, members: L.members.map(m => ({
        memberId: m.memberId || 0,
        name: m.username ? '@' + m.username : m.memberId ? 'member #' + m.memberId : 'member',
        email: L.level === 1 ? m.email : null, // directs only
        joined: m.created,
        earnedWei: (m.memberId && earnedBy[m.memberId]) || '0' })) }));
      return json(res, 200, { levels: out, counts: out.map(L => L.members.length) });
    }
    // -- broadcast a message to your downline (1/day), on-site inbox + email
    if (p === '/api/my/broadcast' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const subject = String(b.subject || '').trim().slice(0, 160);
      const body = ads.sanitizeRich(b.body);
      const plain = body.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim();
      if (!subject) return json(res, 400, { error: 'Give your message a subject.' });
      if (plain.length < 10) return json(res, 400, { error: 'Write a message first.' });
      const last = await messages.lastBroadcastAt(s.email);
      if (Date.now() - last < 24 * 3600 * 1000)
        return json(res, 429, { error: 'You can send one broadcast a day. Try again in ' + Math.ceil((24 * 3600 * 1000 - (Date.now() - last)) / 3600000) + 'h.' });
      const depth = b.scope === 'direct' ? 1 : 3;
      const levels = await accounts.downline(s.email, depth);
      const recipients = [...new Set(levels.flatMap(L => L.members.map(m => m.email)).filter(Boolean))];
      if (!recipients.length) return json(res, 400, { error: 'No one in your line to message yet.' });
      const memberId = s.memberId || await auth.refreshMemberId(s);
      await messages.deliver(memberId, s.email, recipients, subject, body);
      // email each recipient too (best-effort; never blocks the on-site delivery)
      if (mailer.hasKey()) {
        const who = (await accounts.byEmail(s.email));
        const from = who && who.username ? '@' + who.username : 'your sponsor';
        for (const to of recipients) {
          mailer.send(to, 'Message from ' + from + ': ' + subject,
            plain + '\n\n— sent via your InstantAdPay upline. Read it in your dashboard: https://instantadpay.com/my#line')
            .catch(() => {});
        }
      }
      return json(res, 200, { ok: true, sent: recipients.length });
    }
    // -- sponsor messages: this member's inbox from their upline
    if (p === '/api/my/messages' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const items = await messages.inbox(s.email);
      const names = await accounts.namesForMembers([...new Set(items.map(i => i.fromMember).filter(Boolean))]);
      for (const i of items) i.fromName = (i.fromMember && names[i.fromMember]) ? '@' + names[i.fromMember]
        : i.fromMember ? 'member #' + i.fromMember : 'your upline';
      return json(res, 200, { items, unread: items.filter(i => !i.read).length });
    }
    m = /^\/api\/my\/messages\/(\d+)\/read$/.exec(p);
    if (m && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      return json(res, 200, await messages.markRead(s.email, m[1]));
    }

    // ── SPONSOR CHAT (two-way): presence-aware 1:1 threads up/down the line ──
    const chatOnline = ts => (Date.now() - (ts || 0)) < 60000;
    const chatName = a => !a ? 'member' : (a.username ? '@' + a.username : (a.memberId ? 'member #' + a.memberId : 'member'));
    // lightweight presence heartbeat (called on a timer while the dashboard is open)
    if (p === '/api/my/ping' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 200, { ok: true, chatUnread: 0 });
      accounts.touchSeen(s.email).catch(() => {});
      return json(res, 200, { ok: true, chatUnread: await messages.chatUnread(s.email) });
    }
    // training center content (admin-curated via data/training.json)
    if (p === '/api/training' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s) return json(res, 401, { error: 'Sign in first.' });
      let items = [];
      try { const j = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'training.json'), 'utf8')); if (Array.isArray(j)) items = j; } catch (e) {}
      if (!items.length) items = [{ title: 'Getting started with InstantAdPay',
        desc: 'How the platform works, how every payout splits on-chain to real wallets, and how to build your line.',
        docUrl: 'https://instantadpay.com/' }];
      return json(res, 200, { items });
    }
    // daily login bonus (once/day, gentle streak) — granted after the login flow
    if (p === '/api/my/login-bonus' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      return json(res, 200, await ads.grantLoginBonus(s.email));
    }
    // -- rehearsal test-POL faucet: top a connected wallet up to 10 test-POL
    //    (anvil_setBalance, no key needed). Rehearsal-only, rate-limited.
    if (p === '/api/my/faucet' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s) return json(res, 401, { error: 'Sign in first.' });
      if (!siteConfig().rehearsal) return json(res, 400, { error: 'The faucet is only open during the rehearsal.' });
      const b = await readBody(req);
      const addr = String(b.address || '').trim().toLowerCase();
      if (!/^0x[0-9a-f]{40}$/.test(addr)) return json(res, 400, { error: 'Connect your wallet first.' });
      // Amoy is a public testnet: testers fund their own connected wallet from
      // the public Amoy faucet (no server-minted balance). We just echo the
      // address + faucet link; the client copies the address and opens it.
      let balHex = '0x0'; try { balHex = await chain.rpc('eth_getBalance', [addr, 'latest']); } catch (e) {}
      return json(res, 200, { ok: true, faucetUrl: 'https://faucet.polygon.technology/', address: addr, balanceWei: BigInt(balHex || '0x0').toString() });
    }
    // -- report an ad (auto-approved ads need a safety valve): store + notify admin
    if (p === '/api/report-ad' && req.method === 'POST') {
      const b = await readBody(req);
      if (!Number(b.campaignId)) return json(res, 400, { error: 'Which ad?' });
      const s = await auth.fromRequest(req);
      const who = (s && s.email) || '';
      const rec = await reports.add(b.campaignId, who, b.reason, b.note);
      try {
        const adminEmail = process.env.ADMIN_EMAIL || ''; // private env only — siteConfig is exposed via /api/config
        if (adminEmail && mailer.hasKey()) {
          mailer.send(adminEmail, 'Ad reported on InstantAdPay (campaign #' + rec.campaignId + ')',
            'A member flagged an ad.\n\nCampaign: #' + rec.campaignId + '\nReason: ' + rec.reason
            + '\nReported by: ' + (who || 'anonymous') + '\nNote: ' + (String(b.note || '').slice(0, 500) || '(none)')
            + '\n\nPause or review it from the admin.').catch(() => {});
        }
      } catch (e) {}
      return json(res, 200, { ok: true });
    }
    if (p === '/api/my/chat/send' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const me = s.email.toLowerCase();
      const b = await readBody(req);
      const to = String(b.to || '').trim().toLowerCase();
      const text = String(b.body || '').replace(/<[^>]*>/g, '').replace(/\s+$/, '').slice(0, 2000).trim();
      if (!to || to === me) return json(res, 400, { error: 'Pick who to message.' });
      if (!text) return json(res, 400, { error: 'Write a message first.' });
      const target = await accounts.byEmail(to);
      if (!target) return json(res, 404, { error: 'No such member.' });
      // authorize: existing thread, my direct sponsor, or someone in my downline
      let ok = (await messages.thread(me, to, 0, 1)).length > 0;
      if (!ok) { const spon = await accounts.sponsorOf(me); ok = !!(spon && spon.email && spon.email.toLowerCase() === to); }
      if (!ok) ok = await accounts.isDownlineOf(me, to);
      if (!ok) return json(res, 403, { error: 'You can only message your direct sponsor or someone in your line.' });
      if ((await accounts.getMutes(to)).map(x => String(x).toLowerCase()).includes(me))
        return json(res, 403, { error: 'They are not accepting messages from you right now.' });
      const memberId = s.memberId || await auth.refreshMemberId(s);
      const msg = await messages.sendChat(memberId, me, to, text);
      // email only when they are offline AND I have not messaged them in ~10 min (no mid-chat spam)
      try {
        if (mailer.hasKey() && !chatOnline(target.lastSeen)) {
          const mine = (await messages.thread(me, to, 0, 400)).filter(x => x.id !== msg.id && String(x.fromEmail).toLowerCase() === me);
          const lastMineTs = mine.length ? mine[mine.length - 1].sent : 0;
          if (Date.now() - lastMineTs > 10 * 60 * 1000) {
            const who = await accounts.byEmail(me);
            const from = who && who.username ? '@' + who.username : 'someone in your InstantAdPay line';
            mailer.send(to, 'New message from ' + from,
              text.slice(0, 400) + '\n\n— reply in your dashboard: https://instantadpay.com/my').catch(() => {});
          }
        }
      } catch (e) {}
      return json(res, 200, { ok: true, message: { id: msg.id, sent: msg.sent, fromMe: true, body: text } });
    }
    if (p === '/api/my/chat/thread' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const me = s.email.toLowerCase();
      const other = String(u.searchParams.get('with') || '').trim().toLowerCase();
      const after = Number(u.searchParams.get('after')) || 0;
      if (!other) return json(res, 400, { error: 'Who with?' });
      // may view a thread I'm party to (existing), or one I'm allowed to start
      let ok = (await messages.thread(me, other, 0, 1)).length > 0;
      if (!ok) { const spon = await accounts.sponsorOf(me); ok = !!(spon && spon.email && spon.email.toLowerCase() === other); }
      if (!ok) ok = await accounts.isDownlineOf(me, other);
      if (!ok) return json(res, 403, { error: 'Not your conversation.' });
      const msgs = await messages.thread(me, other, after, 300);
      await messages.markChatRead(me, other);
      accounts.touchSeen(me).catch(() => {});
      const oa = await accounts.byEmail(other);
      const iMute = (await accounts.getMutes(me)).map(x => String(x).toLowerCase()).includes(other);
      const theyMuteMe = (await accounts.getMutes(other)).map(x => String(x).toLowerCase()).includes(me);
      return json(res, 200, {
        messages: msgs.map(x => ({ id: x.id, fromMe: String(x.fromEmail).toLowerCase() === me, body: x.body, sent: x.sent })),
        otherName: chatName(oa), online: oa ? chatOnline(oa.lastSeen) : false,
        available: oa ? oa.chatAvailable !== false : true, iMute, blocked: theyMuteMe,
        canMute: await accounts.isDownlineOf(me, other) });
    }
    if (p === '/api/my/chat/threads' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const list = await messages.threadList(s.email.toLowerCase());
      for (const t of list) {
        const a = await accounts.byEmail(t.email);
        t.name = chatName(a); t.online = a ? chatOnline(a.lastSeen) : false;
      }
      list.sort((x, y) => (y.last.sent || 0) - (x.last.sent || 0));
      const meAcct = await accounts.byEmail(s.email);
      return json(res, 200, { threads: list, available: meAcct ? meAcct.chatAvailable !== false : true });
    }
    if (p === '/api/my/chat/available' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      return json(res, 200, await accounts.setChatAvailable(s.email, !!b.available));
    }
    if (p === '/api/my/chat/mute' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const target = String(b.email || '').trim().toLowerCase();
      if (!target) return json(res, 400, { error: 'Who?' });
      const allowed = (await accounts.isDownlineOf(s.email, target)) || (await messages.thread(s.email.toLowerCase(), target, 0, 1)).length > 0;
      if (!allowed) return json(res, 403, { error: 'You can only mute someone in your line.' });
      return json(res, 200, await accounts.setMute(s.email, target, !!b.muted));
    }
    // -- featured rotation: the live featured links + dilution stats
    if (p === '/api/featured' && req.method === 'GET') {
      const items = await ads.serveFeatured();
      const names = await accounts.namesForMembers([...new Set(items.map(i => i.memberId).filter(Boolean))]);
      for (const i of items) i.by = (i.memberId && names[i.memberId]) ? '@' + names[i.memberId] : (i.memberId ? 'member #' + i.memberId : null);
      return json(res, 200, { items });
    }
    if (p === '/api/featured/stats' && req.method === 'GET') {
      return json(res, 200, await ads.featuredStats());
    }
    // -- QR code (SVG) for any InstantAdPay URL — used on bio/wall pages
    if (p === '/api/qr' && req.method === 'GET') {
      const data = String(u.searchParams.get('d') || '').slice(0, 300);
      if (!QR || !data) { res.writeHead(404, baseHeaders()); return res.end(); }
      try {
        const svg = await QR.toString(data, { type: 'svg', margin: 1, width: 240,
          color: { dark: '#0e7d5f', light: '#f2fbf8' } }); // mint-green modules, still high-contrast for reliable scanning
        res.writeHead(200, baseHeaders({ 'Content-Type': 'image/svg+xml', 'Cache-Control': 'public, max-age=3600' }));
        return res.end(svg);
      } catch (e) { res.writeHead(500, baseHeaders()); return res.end(); }
    }
    // -- profile: avatar + bio
    if (p === '/api/my/profile-details' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const avatar = b.avatarUrl === undefined ? undefined : String(b.avatarUrl || '').trim();
      if (avatar && !/^(\/uploads\/[a-z0-9]{24}\.(png|jpg|webp|gif)|https:\/\/[^\s]+)$/i.test(avatar))
        return json(res, 400, { error: 'Avatar must be an uploaded image or an https image URL.' });
      const bio = b.bio === undefined ? undefined : String(b.bio || '').trim().slice(0, 600);
      // socials: {platform: url}; keep only known platforms with valid https urls
      let socials;
      if (b.socials !== undefined) {
        const PLAT = ['facebook', 'twitter', 'youtube', 'instagram', 'tiktok', 'telegram', 'linkedin', 'website'];
        const clean = {};
        for (const p of PLAT) {
          const v = String((b.socials && b.socials[p]) || '').trim();
          if (v && /^https:\/\/[^\s]+$/i.test(v) && v.length <= 200) clean[p] = v;
        }
        socials = Object.keys(clean).length ? JSON.stringify(clean) : null;
      }
      const r = await accounts.setProfile(s.email, avatar, bio, socials);
      return json(res, r.error ? 400 : 200, r);
    }
    // -- wall positions 2 & 3: the member's own offers, unlocked at 2 / 5 qualifying buyers
    if (p === '/api/my/wall-offers' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const src = Array.isArray(b.offers) ? b.offers.slice(0, 2) : [];
      const out = [];
      for (let i = 0; i < 2; i++) {
        const o = src[i] || {};
        const targetUrl = String(o.targetUrl || '').trim();
        const bannerUrl = String(o.bannerUrl || '').trim();
        const title = String(o.title || '').trim().slice(0, 60);
        if (targetUrl && !/^https:\/\/[^\s]+$/i.test(targetUrl)) return json(res, 400, { error: 'Position ' + (i + 2) + ': the link must start with https://' });
        if (bannerUrl && !/^(\/uploads\/[a-z0-9]{24}\.(png|jpg|webp|gif)|https:\/\/[^\s]+)$/i.test(bannerUrl)) return json(res, 400, { error: 'Position ' + (i + 2) + ': banner must be an uploaded image or an https image URL.' });
        out.push(targetUrl ? { title: title || null, bannerUrl: bannerUrl || null, targetUrl } : null);
      }
      const r = await accounts.setWallOffers(s.email, out.some(Boolean) ? JSON.stringify(out) : null);
      return json(res, r.error ? 400 : 200, r);
    }
    // -- line banner: the member's viral slot on welcome tours + their wall
    if (p === '/api/my/linebanner' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const target = String(b.targetUrl || '').trim();
      if (!/^https?:\/\/[^\s]+$/i.test(target)) return json(res, 400, { error: 'Destination URL must start with http(s)://' });
      const fc = await frameCheck(target); // welcome tours frame it full screen
      if (!fc.ok) return json(res, 400, { error: fc.reason });
      const banner = String(b.bannerUrl || '').trim();
      if (banner && !/^(\/uploads\/[a-z0-9]{24}\.(png|jpg|webp|gif)|https:\/\/[^\s]+)$/i.test(banner))
        return json(res, 400, { error: 'Banner must be an uploaded image or an https image URL.' });
      const r = await accounts.setLineBanner(s.email, banner || null, target);
      return json(res, r.error ? 400 : 200, r);
    }
    // -- welcome tour (gauntlet): meet the 3-level upline, then unlock welcome credits
    if (p === '/api/my/gauntlet' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      if (await ads.welcomeGranted(s.email)) return json(res, 200, { pending: false });
      const slides = (await uplineSlides(s.email)).filter(a => a.lineTargetUrl)
        .map((a, i) => ({ name: a.username ? '@' + a.username : a.memberId ? 'member #' + a.memberId : 'a member',
          bannerUrl: a.lineBannerUrl || null, targetUrl: a.lineTargetUrl }));
      if (!slides.length) return json(res, 200, { pending: false });
      const token = crypto.randomBytes(16).toString('hex');
      gauntletTokens.set(s.email, { token, ts: Date.now(), n: slides.length });
      return json(res, 200, { pending: true, slides, dwell: 10, token });
    }
    if (p === '/api/my/gauntlet/complete' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const t = gauntletTokens.get(s.email);
      if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That tour is no longer open. Reload and try again.' });
      if (Date.now() - t.ts < t.n * 10 * 1000 - 1500) return json(res, 400, { error: 'Give each site its ten seconds first.' });
      gauntletTokens.delete(s.email);
      await ads.grantWelcome(s.email);
      return json(res, 200, { ok: true, credited: ads.rates().welcomeCredits || 0 });
    }
    // -- public banner wall
    m = /^\/api\/wall\/([A-Za-z0-9_]{1,20})$/.exec(p);
    if (m && req.method === 'GET') {
      const tok = m[1].toLowerCase();
      let a = await accounts.byUsername(tok);
      if (!a) a = await accounts.byCode(tok);
      if (!a) return json(res, 404, { error: 'No wall under that name.' });
      const ownName = a.username ? '@' + a.username : a.memberId ? 'member #' + a.memberId : 'a member';
      let bc = 0;
      if (a.memberId) { try { bc = (await chain.member(a.memberId)).buyerCount || 0; } catch (e) {} }
      const unlocked = wallUnlockedFor(bc);
      const offers = parseWallOffers(a);
      // uplines with a live banner, in order (an upline with nothing set is skipped, not shown empty)
      const ups = (await uplineSlides(a.email, 2)).filter(x => x.lineTargetUrl)
        .map(x => ({ name: x.username ? '@' + x.username : x.memberId ? 'member #' + x.memberId : 'a member',
          bannerUrl: x.lineBannerUrl || null, targetUrl: x.lineTargetUrl, upline: true }));
      const adAds = getAdminWallAds(); let ai = 0;
      const houseAd = () => { if (!adAds.length) return null; const ad = adAds[ai++ % adAds.length]; return { name: ad.name || 'InstantAdPay', bannerUrl: ad.bannerUrl || null, targetUrl: ad.targetUrl || 'https://instantadpay.com/', admin: true }; };
      const ladder = [{ name: ownName, bannerUrl: a.lineBannerUrl || null, targetUrl: a.lineTargetUrl || null, own: true }];
      for (let i = 1; i < 3; i++) {
        const o = offers[i - 1];
        if (i < unlocked && o && o.targetUrl) { ladder.push({ name: (o.title || ownName), bannerUrl: o.bannerUrl || null, targetUrl: o.targetUrl, own: true }); continue; }
        const u = ups.shift(); if (u) { ladder.push(u); continue; }
        const h = houseAd(); if (h) ladder.push(h);
      }
      const finalLadder = ladder.slice(0, 3);
      // the wall owner's achievement badge (their highest reached tier)
      let badge = null;
      if (a.memberId) {
        const t = bc >= 5 ? ['nexus', 'Nexus'] : bc >= 2 ? ['circuit', 'Circuit'] : bc >= 1 ? ['surge', 'Surge'] : ['spark', 'Spark'];
        badge = { img: '/badges/badge-' + t[0] + '.jpg?v=2', label: t[1] };
      }
      const joinPath = '/join/' + (a.username || a.code);
      let socials = null; try { socials = a.socials ? JSON.parse(a.socials) : null; } catch (e) {}
      return json(res, 200, { name: a.username ? '@' + a.username : 'member #' + (a.memberId || 0),
        avatarUrl: a.avatarUrl || null, bio: a.bio || null, socials, badge,
        joinUrl: joinPath, qrUrl: '/api/qr?d=' + encodeURIComponent('https://instantadpay.com' + joinPath), ladder: finalLadder, unlocked, buyerCount: bc });
    }
    // -- watch-to-earn video ads: serve one, then reward a server-clock-verified watch
    if (p === '/api/my/videos' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const status = await ads.videoStatus(s.email);
      if (status.left <= 0) return json(res, 200, { ad: null, status });
      const orientation = String(u.searchParams.get('orientation') || ''); // 'portrait' = Shorts reel, 'landscape' = Watch videos tab
      const ad = await ads.serveVideo({ excludeEmail: s.email, orientation }); // never your own video
      if (!ad) return json(res, 200, { ad: null, status });
      const token = crypto.randomBytes(16).toString('hex');
      videoTokens.set(s.email, { token, ts: Date.now(), id: ad.id, secs: ad.watchSecs });
      return json(res, 200, { ad, token, status });
    }
    if (p === '/api/my/videowatch' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const t = videoTokens.get(s.email);
      if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That video is no longer open. Load the next one.' });
      const age = Date.now() - t.ts;
      if (age < t.secs * 1000 - 600) return json(res, 400, { error: 'Watch the full video first.' });
      if (age > t.secs * 1000 + 10 * 60 * 1000) { videoTokens.delete(s.email); return json(res, 400, { error: 'That watch went stale. Load a fresh video.' }); }
      videoTokens.delete(s.email); // single use
      if (await ads.hasWatchedVideoToday(s.email, t.id)) // once-per-day-per-video: no double earning
        return json(res, 200, { ok: true, credited: 0, status: await ads.videoStatus(s.email), already: true });
      const tier = await ads.chargeVideoView(t.id); // charge advertiser; null if it ran dry
      if (!tier) return json(res, 200, { ok: true, credited: 0, status: await ads.videoStatus(s.email), gone: true });
      await ads.addEarned(s.email, tier.reward);
      await ads.markVideoSeen(s.email, t.id);
      const status = await ads.recordVideoWatch(s.email);
      return json(res, 200, { ok: true, credited: tier.reward, status });
    }
    // -- verified visits: view a member's site (new tab) for the dwell, pass a
    // human check, and it counts as one guaranteed unique visit for the pack
    if (p === '/api/my/visits' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const status = await ads.visitStatus(s.email);
      if (status.count >= status.cap) return json(res, 200, { ad: null, status });
      const ad = await ads.serveVisit(s.email);
      if (!ad) return json(res, 200, { ad: null, status });
      const token = crypto.randomBytes(16).toString('hex');
      visitTokens.set(s.email, { token, ts: Date.now(), id: ad.id });
      return json(res, 200, { ad, token, status });
    }
    if (p === '/api/my/visitchallenge' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const t = visitTokens.get(s.email);
      if (!t || t.token !== String(u.searchParams.get('token') || '')) return json(res, 400, { error: 'That visit is no longer open.' });
      const dwellMs = (ads.rates().visitDwellSeconds || 8) * 1000;
      const age = Date.now() - t.ts;
      if (age < dwellMs - 400) return json(res, 200, { early: true, wait: Math.ceil((dwellMs - age) / 1000) });
      if (age > 5 * 60 * 1000) { visitTokens.delete(s.email); return json(res, 400, { error: 'That visit went stale. Load a fresh one.' }); }
      const pick = CAPTCHA.slice().sort(() => Math.random() - 0.5).slice(0, 5);
      const answer = Math.floor(Math.random() * pick.length);
      t.challenge = { answer };
      return json(res, 200, { prompt: pick[answer][1], options: pick.map(x => x[0]) });
    }
    if (p === '/api/my/visitdone' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const b = await readBody(req);
      const t = visitTokens.get(s.email);
      if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That visit did not check out. Load the next one.' });
      const dwellMs = (ads.rates().visitDwellSeconds || 8) * 1000;
      if (Date.now() - t.ts < dwellMs - 400) return json(res, 400, { error: 'Give the site the full visit first.' });
      if (!t.challenge) return json(res, 400, { error: 'Finish the quick check first.', retry: true });
      if (Number(b.answer) !== t.challenge.answer) { t.challenge = null; return json(res, 400, { error: 'Wrong pick.', retry: true }); }
      visitTokens.delete(s.email);
      const r = await ads.completeVisit(s.email, t.id);
      if (r.error) return json(res, 400, r);
      return json(res, 200, Object.assign(r, { status: await ads.visitStatus(s.email) }));
    }
    // -- onsite solo ads: member inbox with read rewards
    if (p === '/api/my/inbox' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const r = await ads.inboxList(s.email);
      const names = await accounts.namesForMembers([...new Set(r.items.map(i => i.fromMemberId).filter(Boolean))]);
      for (const i of r.items) i.fromName = (i.fromMemberId && names[i.fromMemberId]) ? '@' + names[i.fromMemberId]
        : i.fromMemberId ? 'member #' + i.fromMemberId : 'a member';
      return json(res, 200, r);
    }
    m = /^\/api\/my\/inbox\/(\d+)$/.exec(p);
    if (m && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const r = await ads.inboxOpen(s.email, m[1]);
      if (!r.error) {
        const names = r.fromMemberId ? await accounts.namesForMembers([r.fromMemberId]) : {};
        r.fromName = (r.fromMemberId && names[r.fromMemberId]) ? '@' + names[r.fromMemberId]
          : r.fromMemberId ? 'member #' + r.fromMemberId : 'a member';
      }
      return json(res, r.error ? 404 : 200, r);
    }
    // media upload for solo ads: raw body, size-capped, magic-byte verified
    if (p === '/api/my/upload' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      return handleUpload(req, res, s.email);
    }
    m = /^\/api\/my\/inbox\/(\d+)\/visit$/.exec(p);
    if (m && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const r = await ads.markSoloVisit(s.email, m[1]);
      return json(res, r.error ? 400 : 200, r);
    }
    m = /^\/api\/my\/inbox\/(\d+)\/claim$/.exec(p);
    if (m && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const r = await ads.claimSoloRead(s.email, m[1]);
      return json(res, r.error ? 400 : 200, r);
    }
    if (p === '/api/my/activity' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s) return json(res, 401, { error: 'Sign in first.' });
      const id = s.memberId || await auth.refreshMemberId(s);
      if (!id) return json(res, 200, { memberId: 0, earnings: [], purchases: [], referrals: [] });
      const evs = chain.recentEvents(600);
      return json(res, 200, {
        memberId: id,
        earnings: await attachNames(evs.filter(e => (e.type === 'TierPaid' && e.recipientId === id) || (e.type === 'AwardPaid' && e.toId === id))),
        purchases: await attachNames(evs.filter(e => e.type === 'Purchase' && e.buyerId === id)),
        referrals: await attachNames(evs.filter(e => (e.type === 'MemberActivated' && e.sponsorId === id) || (e.type === 'BuyerCounted' && e.sponsorId === id)))
      });
    }

    // -- ad engine (spec §8b v1: banners, text, login ads)
    if (p === '/api/ads/slot' && req.method === 'GET') {
      const t = String(u.searchParams.get('type') || 'banner');
      const ad = await ads.serve(t, { width: Number(u.searchParams.get('w')) || 0, height: Number(u.searchParams.get('h')) || 0 });
      // login ads: the member clicks "Open Ad" (a real, counted click into a
      // new tab) while the countdown runs on our interstitial page
      if (ad && t === 'login') ad.dwell = ads.rates().loginDwellSeconds || 10;
      return json(res, 200, { ad });
    }
    m = /^\/api\/ads\/click\/(\d+)$/.exec(p);
    if (m && req.method === 'GET') {
      const target = await ads.click(m[1]);
      if (!target) { res.writeHead(404, baseHeaders()); return res.end(); }
      res.writeHead(302, baseHeaders({ Location: target }));
      return res.end();
    }
    if (p === '/api/my/campaigns' && req.method === 'GET') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const memberId = await auth.refreshMemberId(s);
      const out = { campaigns: await ads.listCampaigns(s.email), rates: ads.rates(), bannerSizes: ads.bannerSizes() };
      out.purchasedCredits = memberId ? await ads.availableCredits(memberId) : 0;
      out.earnedCredits = await ads.earnedBalance(s.email);
      out.availableCredits = out.purchasedCredits + out.earnedCredits;
      return json(res, 200, out);
    }
    if (p === '/api/my/campaigns' && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const memberId = await auth.refreshMemberId(s); // 0 is fine: earned credits fund banner/text
      const b = await readBody(req);
      if (!['login', 'solo', 'video', 'featured'].includes(String(b.type || ''))) { // banner/text surf views frame the target; login/video/solo/featured open in a new tab or play in our own player
        const fc = await frameCheck(b.targetUrl);
        if (!fc.ok) return json(res, 400, { error: fc.reason });
      }
      const r = await ads.createCampaign(s.email, memberId, b);
      return json(res, r.error ? 400 : 200, r);
    }
    m = /^\/api\/my\/campaigns\/(\d+)\/topup$/.exec(p);
    if (m && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const memberId = await auth.refreshMemberId(s);
      const b = await readBody(req);
      const r = await ads.topUpCampaign(s.email, memberId, m[1], b.credits);
      return json(res, r.error ? 400 : 200, r);
    }
    m = /^\/api\/my\/campaigns\/(\d+)\/(pause|resume)$/.exec(p);
    if (m && req.method === 'POST') {
      const s = await auth.fromRequest(req);
      if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
      const r = await ads.setStatus(s.email, m[1], m[2] === 'pause' ? 'paused' : 'active');
      return json(res, r.error ? 400 : 200, r);
    }

    // -- admin portal: email magic-code sign-in, allowlisted to ADMIN_EMAIL
    if (p === '/api/admin/auth/start' && req.method === 'POST') {
      const b = await readBody(req);
      const e = String(b.email || '').trim().toLowerCase();
      if (!ADMIN_EMAIL) return json(res, 503, { error: 'ADMIN_EMAIL is not set on the server.' });
      if (!e || e !== ADMIN_EMAIL) return json(res, 403, { error: 'That address is not the admin.' });
      const k = 'admin:' + e;
      const prev = emailCodes.get(k);
      if (prev && Date.now() < prev.nextAt) return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' });
      const code = String(Math.floor(100000 + Math.random() * 900000));
      emailCodes.set(k, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 });
      if (mailer.hasKey()) {
        try { await mailer.sendCode(e, code); } catch (err) {
          console.error('admin sendCode failed', err.message);
          return json(res, 502, { error: 'Could not send the email. Try again in a minute.' });
        }
        return json(res, 200, { ok: true, sent: true });
      }
      if (!IS_PROD) return json(res, 200, { ok: true, sent: false, devCode: code });
      return json(res, 503, { error: 'Email sign-in is not configured yet.' });
    }
    if (p === '/api/admin/auth/verify' && req.method === 'POST') {
      const b = await readBody(req);
      const e = String(b.email || '').trim().toLowerCase();
      const k = 'admin:' + e;
      const rec = emailCodes.get(k);
      if (!rec || rec.exp < Date.now()) return json(res, 400, { error: 'Code expired. Request a fresh one.' });
      rec.tries += 1;
      if (rec.tries > 6) { emailCodes.delete(k); return json(res, 400, { error: 'Too many tries. Request a fresh code.' }); }
      if (String(b.code || '').trim() !== rec.code) return json(res, 400, { error: 'That code does not match.' });
      emailCodes.delete(k);
      if (e !== ADMIN_EMAIL) return json(res, 403, { error: 'That address is not the admin.' });
      const token = mintAdminSession(e);
      return json(res, 200, { ok: true, email: e }, { 'Set-Cookie': adminCookie(token) });
    }
    if (p === '/api/admin/auth/logout' && req.method === 'POST') {
      dropAdminSession(req);
      return json(res, 200, { ok: true }, { 'Set-Cookie': clearAdminCookie() });
    }
    if (p === '/api/admin/me' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 200, { admin: false });
      return json(res, 200, { admin: true, email: ADMIN_EMAIL });
    }
    if (p === '/api/admin/overview' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const camps = await ads.adminList();
      const byStatus = {}, byType = {};
      for (const c of camps) { byStatus[c.status] = (byStatus[c.status] || 0) + 1; byType[c.type] = (byType[c.type] || 0) + 1; }
      let memberCount = null; try { memberCount = await chain.memberCount(); } catch (e) {}
      const cc = chain.getConfig();
      return json(res, 200, { accounts: await accounts.count(), memberCount, campaigns: camps.length,
        house: camps.filter(c => c.house).length, byStatus, byType,
        openReports: await reports.openCount(), pendingBurns: (await ads.pendingBurns()).length,
        followups: await drip.stats(),
        chain: { contract: cc.contract, chainId: cc.chainId, chainName: cc.chainName, explorer: cc.explorer },
        site: siteConfig(), rates: ads.rates() });
    }
    if (p === '/api/admin/members' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { members: await accounts.listAll(500) });
    }
    if (p === '/api/admin/members' && req.method === 'PATCH') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      if (!b.email) return json(res, 400, { error: 'Which member?' });
      const r = await accounts.setSponsorRef(b.email, b.sponsorRef);
      return json(res, r.error ? 400 : 200, r);
    }
    if (p === '/api/admin/campaigns' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { campaigns: await ads.adminList(), rates: ads.rates(), bannerSizes: ads.bannerSizes(), houseOwner: ads.HOUSE_OWNER });
    }
    if (p === '/api/admin/campaigns' && req.method === 'POST') { // free house ad
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      if (!['login', 'solo', 'video', 'featured'].includes(String(b.type || ''))) {
        const fc = await frameCheck(b.targetUrl);
        if (!fc.ok) return json(res, 400, { error: fc.reason });
      }
      const r = await ads.createHouseCampaign(b);
      return json(res, r.error ? 400 : 200, r);
    }
    m = /^\/api\/admin\/campaigns\/(\d+)\/(pause|resume)$/.exec(p);
    if (m && req.method === 'POST') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const r = await ads.adminSetStatus(m[1], m[2] === 'pause' ? 'paused' : 'active');
      return json(res, r.error ? 400 : 200, r);
    }
    if (p === '/api/admin/reports' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { reports: await reports.list(200) });
    }
    m = /^\/api\/admin\/reports\/(\d+)\/resolve$/.exec(p);
    if (m && req.method === 'POST') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, await reports.resolve(m[1]));
    }
    if (p === '/api/admin/upload' && req.method === 'POST') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return handleUpload(req, res, 'admin');
    }
    if (p === '/api/admin/rates' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { rates: ads.rates() });
    }
    if (p === '/api/admin/drip' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { sequence: drip.sequence(), defaults: drip.DEFAULT_SEQUENCE, stats: await drip.stats(), mailReady: mailer.hasKey() });
    }
    if (p === '/api/admin/drip' && req.method === 'PATCH') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      const r = b.reset ? drip.resetSequence() : drip.setSequence(b.sequence);
      return json(res, r.error ? 400 : 200, r);
    }
    if (p === '/api/admin/drip/test' && req.method === 'POST') { // send one step to the admin inbox
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      if (!ADMIN_EMAIL) return json(res, 400, { error: 'ADMIN_EMAIL is not set.' });
      if (!mailer.hasKey()) return json(res, 400, { error: 'No mail key on the server.' });
      try { const r = await drip.sendStep(ADMIN_EMAIL, Number(b.step) || 0, ADMIN_EMAIL); return json(res, r.error ? 400 : 200, r); }
      catch (e) { return json(res, 502, { error: 'Send failed: ' + e.message }); }
    }
    // wall fallback ads: shown in wall positions a member has not earned or filled, when no upline banner exists
    if (p === '/api/admin/wall-ads' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      let saved = null; try { saved = JSON.parse(fs.readFileSync(path.join(DATA_DIR, 'admin-wall-ads.json'), 'utf8')); } catch (e) {}
      return json(res, 200, { ads: Array.isArray(saved) ? saved : [], defaults: getAdminWallAds(), usingDefaults: !Array.isArray(saved) || !saved.length });
    }
    if (p === '/api/admin/wall-ads' && req.method === 'PATCH') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      const src = Array.isArray(b.ads) ? b.ads.slice(0, 20) : [];
      const out = [];
      for (const o of src) {
        const name = String((o && o.name) || '').trim().slice(0, 60);
        const targetUrl = String((o && o.targetUrl) || '').trim();
        const bannerUrl = String((o && o.bannerUrl) || '').trim();
        if (!targetUrl) continue;
        if (!/^https:\/\/[^\s]+$/i.test(targetUrl)) return json(res, 400, { error: 'Every wall ad needs an https:// link (' + (name || targetUrl) + ').' });
        if (bannerUrl && !/^(\/uploads\/[a-z0-9]{24}\.(png|jpg|webp|gif)|https:\/\/[^\s]+)$/i.test(bannerUrl)) return json(res, 400, { error: 'Banner must be an uploaded image or an https image URL (' + (name || targetUrl) + ').' });
        out.push({ name: name || 'InstantAdPay', targetUrl, bannerUrl: bannerUrl || null });
      }
      const file = path.join(DATA_DIR, 'admin-wall-ads.json');
      if (out.length) fs.writeFileSync(file, JSON.stringify(out, null, 2)); else { try { fs.unlinkSync(file); } catch (e) {} }
      return json(res, 200, { ok: true, ads: out, usingDefaults: !out.length });
    }
    if (p === '/api/admin/site' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { site: siteConfig() });
    }

    // -- admin (Bearer ADMIN_PASSWORD, or the /admin portal session)
    if (p === '/api/admin/burns' && req.method === 'GET') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      return json(res, 200, { pending: await ads.pendingBurns() });
    }
    if (p === '/api/admin/burns/mark' && req.method === 'POST') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      const r = await ads.markBurned(b.id, b.tx);
      return json(res, r.error ? 400 : 200, r);
    }
    if (p === '/api/admin/rates' && req.method === 'PATCH') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      return json(res, 200, { ok: true, rates: ads.setRates(b) });
    }

    if (p === '/api/admin/site' && req.method === 'PATCH') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      const cur = siteConfig();
      fs.writeFileSync(SITE_FILE, JSON.stringify(Object.assign(cur, b), null, 2));
      return json(res, 200, { ok: true, site: siteConfig() });
    }
    if (p === '/api/admin/chain' && req.method === 'PATCH') {
      if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
      const b = await readBody(req);
      const file = path.join(DATA_DIR, 'config.json');
      let cur = {}; try { cur = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) {}
      fs.writeFileSync(file, JSON.stringify(Object.assign(cur, b), null, 2));
      chain.reloadConfig();
      return json(res, 200, { ok: true, config: chain.getConfig() });
    }

    // -- pages (HEAD answered like GET so link previewers and crawlers see 200; Node drops the body)
    if (req.method === 'GET' || req.method === 'HEAD') {
      if (p === '/') return sendFile(res, path.join(PUBLIC_DIR, 'index.html'));
      if (p === '/ledger') return sendFile(res, path.join(PUBLIC_DIR, 'ledger.html'));
      if (p === '/contract') return sendFile(res, path.join(PUBLIC_DIR, 'contract.html'));
      if (p === '/terms') return sendFile(res, path.join(PUBLIC_DIR, 'terms.html'));
      if (p === '/privacy') return sendFile(res, path.join(PUBLIC_DIR, 'privacy.html'));
      if (p === '/disclaimer') return sendFile(res, path.join(PUBLIC_DIR, 'disclaimer.html'));
      if (p === '/my') return sendFile(res, path.join(PUBLIC_DIR, 'my.html'));
      if (p === '/admin') return sendFile(res, path.join(PUBLIC_DIR, 'admin.html'));
      if (p === '/shorts') return sendFile(res, path.join(PUBLIC_DIR, 'shorts.html'));
      if (/^\/view\/[a-f0-9]{32}$/.test(p)) return sendFile(res, path.join(PUBLIC_DIR, 'view.html'));
      m = /^\/uploads\/([a-z0-9]{24}\.(?:png|jpg|webp|gif|mp4|webm))$/.exec(p);
      if (m) return sendFile(res, path.join(UPLOADS_DIR, m[1]));
      if (/^\/tx\/0x[0-9a-fA-F]{64}$/.test(p)) return sendFile(res, path.join(PUBLIC_DIR, 'tx.html'));
      m = /^\/wall\/([A-Za-z0-9_]{1,20})$/.exec(p);
      if (m) { // server-inject per-member OG tags so shared bio links preview correctly (crawlers don't run JS)
        try {
          const tok = m[1].toLowerCase();
          let a = await accounts.byUsername(tok); if (!a) a = await accounts.byCode(tok);
          let html = fs.readFileSync(path.join(PUBLIC_DIR, 'wall.html'), 'utf8');
          if (a) {
            const nm = a.username ? '@' + a.username : 'member #' + (a.memberId || 0);
            const esc = t => String(t || '').replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
            const title = nm + ' on InstantAdPay';
            const desc = a.bio ? esc(a.bio).slice(0, 200) : 'Join ' + nm + '’s line on InstantAdPay — instant on-chain ad payouts, free to join.';
            const img = a.avatarUrl && /^https:/.test(a.avatarUrl) ? a.avatarUrl : 'https://instantadpay.com/banners/iap-hero-1200x630.png';
            const url = 'https://instantadpay.com/wall/' + (a.username || a.code);
            const og = [
              '<meta property="og:type" content="profile">',
              '<meta property="og:site_name" content="InstantAdPay">',
              '<meta property="og:url" content="' + url + '">',
              '<meta property="og:title" content="' + esc(title) + '">',
              '<meta property="og:description" content="' + desc + '">',
              '<meta property="og:image" content="' + esc(img) + '">',
              '<meta name="twitter:card" content="summary_large_image">',
              '<meta name="twitter:title" content="' + esc(title) + '">',
              '<meta name="twitter:description" content="' + desc + '">',
              '<meta name="twitter:image" content="' + esc(img) + '">',
              '<meta name="description" content="' + desc + '">',
              '<link rel="canonical" href="' + url + '">'
            ].join('\n');
            html = html.replace('<title>Banner wall | InstantAdPay</title>', '<title>' + esc(title) + '</title>').replace('<!--OG-->', og);
          }
          res.writeHead(200, baseHeaders({ 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache' }));
          return res.end(html);
        } catch (e) { return sendFile(res, path.join(PUBLIC_DIR, 'wall.html')); }
      }
      const safe = path.normalize(p).replace(/^([.\\/])+/, '');
      const file = path.join(PUBLIC_DIR, safe);
      if (file.startsWith(PUBLIC_DIR) && fs.existsSync(file) && fs.statSync(file).isFile()) return sendFile(res, file);
    }

    res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' }));
    res.end('Not found');
  } catch (e) {
    console.error('request error', req.url, e.message);
    try { json(res, 500, { error: 'server error' }); } catch (_) {}
  }
});
boot().then(() => {
  server.listen(PORT, () => console.log(`InstantAdPay site on :${PORT} — chain: ${chain.getConfig().chainName} — store: ${db.enabled() ? 'MySQL' : 'volume JSON'}`));
}).catch(e => { console.error('boot failed:', e.message); process.exit(1); });