4bnode 3.5.3 → 4.0.2

package/skeleton/.4bnode/dev-api.js

@@ -0,0 +1,2930 @@
+import express from 'express';
+import fs from 'fs';
+import path from 'path';
+import { execSync, exec } from 'child_process';
+import { promisify } from 'util';
+const execAsync = promisify(exec);
+import crypto from 'crypto';
+
+const router = express.Router();
+
+// Serve dashboard UI and assets
+const __4bnodeDir = path.join(process.cwd(), '.4bnode');
+router.get('/', (req, res) => {
+  res.sendFile('ui.html', { root: __4bnodeDir });
+});
+router.use('/assets', express.static(path.join(__4bnodeDir, 'assets')));
+
+// ── Passkey Authentication ──────────────────────────────────────────────────
+function getPasskeyHash() {
+  const file = path.join(__4bnodeDir, '.passkey');
+  if (!fs.existsSync(file)) return null;
+  return fs.readFileSync(file, 'utf8').trim();
+}
+
+function hashPasskey(pin) {
+  return crypto.createHash('sha256').update(pin).digest('hex');
+}
+
+// Verify passkey endpoint (no auth middleware needed here)
+router.post('/api/auth', (req, res) => {
+  const { passkey } = req.body;
+  const stored = getPasskeyHash();
+  if (!stored) return res.json({ ok: true });
+  if (!passkey || hashPasskey(passkey) !== stored) {
+    return res.status(401).json({ error: 'Invalid passkey' });
+  }
+  res.json({ ok: true });
+});
+
+// Auth middleware — protect all /api/* routes below
+router.use('/api', (req, res, next) => {
+  if (req.path === '/auth') return next();
+  const stored = getPasskeyHash();
+  if (!stored) return next();
+  const passkey = req.headers['x-passkey'];
+  if (!passkey || hashPasskey(passkey) !== stored) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+  next();
+});
+
+// ---------------------------------------------------------------------------
+// Utility functions (self-contained, no external imports)
+// ---------------------------------------------------------------------------
+
+function toCamelCase(str) {
+  return str.replace(/-([a-z])/g, (g) => g[1].toUpperCase());
+}
+
+function toPascalCase(str) {
+  const camel = toCamelCase(str);
+  return camel.charAt(0).toUpperCase() + camel.slice(1);
+}
+
+function sanitizeName(input) {
+  if (!input || typeof input !== "string") {
+    throw new Error("Name is required.");
+  }
+  const trimmed = input.trim();
+  if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(trimmed)) {
+    throw new Error(
+      `Invalid name "${trimmed}". Use only letters, numbers, hyphens, and underscores. Must start with a letter.`
+    );
+  }
+  return trimmed;
+}
+
+function listModels() {
+  const modelsDir = path.join(process.cwd(), "src", "models");
+  if (!fs.existsSync(modelsDir)) {
+    return [];
+  }
+  return fs.readdirSync(modelsDir).filter((f) => f.endsWith(".js"));
+}
+
+function listRoutes() {
+  const routesDir = path.join(process.cwd(), "src", "routes");
+  if (!fs.existsSync(routesDir)) {
+    return [];
+  }
+  return fs.readdirSync(routesDir).filter((f) => f.endsWith(".js"));
+}
+
+function checkMongoConfig() {
+  const envPath = path.join(process.cwd(), ".env.development");
+  return (
+    fs.existsSync(envPath) &&
+    fs.readFileSync(envPath, "utf8").includes("MONGO_URI")
+  );
+}
+
+function getEnvValue(filePath, key) {
+  if (!fs.existsSync(filePath)) return '';
+  const content = fs.readFileSync(filePath, 'utf8');
+  const match = content.match(new RegExp(`^${key}=(.*)`, 'm'));
+  return match ? match[1].trim() : '';
+}
+
+function extractSchemaBlock(content) {
+  const marker = "new mongoose.Schema(";
+  const idx = content.indexOf(marker);
+  if (idx === -1) return null;
+  // Find the opening { after the marker
+  const braceStart = content.indexOf("{", idx + marker.length);
+  if (braceStart === -1) return null;
+  // Match balanced braces to find the outer schema object
+  let depth = 0;
+  for (let i = braceStart; i < content.length; i++) {
+    if (content[i] === "{") depth++;
+    else if (content[i] === "}") {
+      depth--;
+      if (depth === 0) return content.slice(braceStart + 1, i);
+    }
+  }
+  return null;
+}
+
+function getModelSchemaDetailed(modelName) {
+  const modelFilePath = path.join(
+    process.cwd(),
+    "src",
+    "models",
+    modelName + ".js"
+  );
+  if (!fs.existsSync(modelFilePath)) {
+    return [];
+  }
+
+  const content = fs.readFileSync(modelFilePath, "utf8");
+  const schemaContent = extractSchemaBlock(content);
+  if (!schemaContent) return [];
+  const fields = [];
+  // Match each field block: fieldName: { type: ..., required: ..., unique: ..., default: ... }
+  const fieldRegex = /(\w+)\s*:\s*\{([^}]*)\}/g;
+  let fm;
+  while ((fm = fieldRegex.exec(schemaContent)) !== null) {
+    const name = fm[1];
+    const props = fm[2];
+    const typeMatch = props.match(/type:\s*([\w.]+)/);
+    const type = typeMatch
+      ? typeMatch[1].replace("mongoose.Schema.Types.", "")
+      : "String";
+    const required = /required:\s*true/.test(props);
+    const unique = /unique:\s*true/.test(props);
+    const refMatch = props.match(/ref:\s*['"](\w+)['"]/);
+    const defaultMatch = props.match(/default:\s*(.+?)(?:,\s*\w+:|$)/);
+    const field = { name, type, required, unique };
+    if (refMatch) field.ref = refMatch[1];
+    if (defaultMatch) {
+      field.default = defaultMatch[1].trim();
+    }
+    fields.push(field);
+  }
+  return fields;
+}
+
+function getModelSchema(modelName) {
+  const modelFilePath = path.join(
+    process.cwd(),
+    "src",
+    "models",
+    modelName + ".js"
+  );
+  if (!fs.existsSync(modelFilePath)) {
+    return [];
+  }
+
+  const content = fs.readFileSync(modelFilePath, "utf8");
+  const schemaContent = extractSchemaBlock(content);
+  if (!schemaContent) return [];
+
+  const fieldRegex = /(\w+)\s*:\s*\{/g;
+  const fields = [];
+  let fieldMatch;
+  while ((fieldMatch = fieldRegex.exec(schemaContent)) !== null) {
+    fields.push(fieldMatch[1]);
+  }
+  return fields;
+}
+
+// ---------------------------------------------------------------------------
+// Route file manipulation functions
+// ---------------------------------------------------------------------------
+
+function addImportToRoute(filePath, importStatement) {
+  let content = fs.readFileSync(filePath, "utf8");
+  if (!content.includes(importStatement.trim())) {
+    content = importStatement.trim() + "\n" + content;
+    fs.writeFileSync(filePath, content, "utf8");
+  }
+  return content;
+}
+
+function insertCodeIntoRoute(filePath, codeBlock) {
+  let content = fs.readFileSync(filePath, "utf8");
+
+  // Prefer inserting before "export default router;" as it's more reliable
+  const exportIndex = content.lastIndexOf("export default router;");
+  if (exportIndex !== -1) {
+    content =
+      content.slice(0, exportIndex) +
+      codeBlock.trim() +
+      "\n\n" +
+      content.slice(exportIndex);
+  } else {
+    // Fallback to inserting before last "});"
+    const lastClose = content.lastIndexOf("});");
+    if (lastClose !== -1) {
+      content =
+        content.slice(0, lastClose) +
+        codeBlock.trim() +
+        "\n" +
+        content.slice(lastClose);
+    } else {
+      content += "\n" + codeBlock.trim() + "\n";
+    }
+  }
+
+  fs.writeFileSync(filePath, content, "utf8");
+}
+
+function detectHttpMethod(filePath) {
+  const content = fs.readFileSync(filePath, "utf8");
+  const methodRegex =
+    /router\.(get|post|put|patch|delete)\((['"`])\/.*?\2,\s*async\s*\(req,\s*res/;
+  const match = content.match(methodRegex);
+  return match ? match[1].toLowerCase() : "post";
+}
+
+function getRequestDataSource(method) {
+  return method === "get" || method === "delete" ? "req.query" : "req.body";
+}
+
+// ---------------------------------------------------------------------------
+// CRUD code builders
+// ---------------------------------------------------------------------------
+
+function buildInsertCode(pascalName, fields, dataSource) {
+  const assignments = fields
+    .map((f) => `    ${f}: ${dataSource}.${f}`)
+    .join(",\n");
+
+  let passwordLogic = "";
+  if (fields.includes("password")) {
+    passwordLogic = `
+  if (newData.password) {
+    const salt = await bcrypt.genSalt(10);
+    newData.password = await bcrypt.hash(newData.password, salt);
+  }`;
+  }
+
+  return `
+router.post('/create', async (req, res) => {
+  const newData = {
+${assignments}
+  };
+${passwordLogic}
+  try {
+    const newDocument = new ${pascalName}(newData);
+    await newDocument.save();
+    res.json({ message: 'Data inserted successfully', data: newDocument });
+  } catch (err) {
+    console.error(err);
+    res.status(500).json({ message: 'Server error' });
+  }
+});`;
+}
+
+function buildReadCode(pascalName) {
+  return `
+router.get('/', async (req, res) => {
+  try {
+    const documents = await ${pascalName}.find();
+    res.json({ data: documents });
+  } catch (err) {
+    console.error(err);
+    res.status(500).json({ message: 'Server error' });
+  }
+});
+
+router.get('/:id', async (req, res) => {
+  try {
+    const document = await ${pascalName}.findById(req.params.id);
+    if (!document) {
+      return res.status(404).json({ message: 'Document not found' });
+    }
+    res.json({ data: document });
+  } catch (err) {
+    console.error(err);
+    res.status(500).json({ message: 'Server error' });
+  }
+});`;
+}
+
+function buildUpdateCode(pascalName, fields, dataSource) {
+  const assignments = fields
+    .map((f) => `    ${f}: ${dataSource}.${f}`)
+    .join(",\n");
+
+  let passwordLogic = "";
+  if (fields.includes("password")) {
+    passwordLogic = `
+  if (updatedData.password) {
+    const salt = await bcrypt.genSalt(10);
+    updatedData.password = await bcrypt.hash(updatedData.password, salt);
+  }`;
+  }
+
+  return `
+router.put('/:id', async (req, res) => {
+  const updatedData = {
+${assignments}
+  };
+${passwordLogic}
+  try {
+    const updatedDocument = await ${pascalName}.findByIdAndUpdate(req.params.id, updatedData, { new: true });
+    if (!updatedDocument) {
+      return res.status(404).json({ message: 'Document not found' });
+    }
+    res.json({ message: 'Data updated successfully', data: updatedDocument });
+  } catch (err) {
+    console.error(err);
+    res.status(500).json({ message: 'Server error' });
+  }
+});`;
+}
+
+function buildDeleteCode(pascalName) {
+  return `
+router.delete('/:id', async (req, res) => {
+  try {
+    const deletedDocument = await ${pascalName}.findByIdAndDelete(req.params.id);
+    if (!deletedDocument) {
+      return res.status(404).json({ message: 'Document not found' });
+    }
+    res.json({ message: 'Data deleted successfully', data: deletedDocument });
+  } catch (err) {
+    console.error(err);
+    res.status(500).json({ message: 'Server error' });
+  }
+});`;
+}
+
+// ---------------------------------------------------------------------------
+// Schema file generation helper
+// ---------------------------------------------------------------------------
+
+function generateSchemaFileContent(pascalName, fields) {
+  const fieldLines = fields.map((f) => {
+    const type = f.type || 'String';
+    const parts = [type === 'ObjectId' ? 'type: mongoose.Schema.Types.ObjectId' : `type: ${type}`];
+    if (f.ref) parts.push(`ref: '${f.ref}'`);
+    if (f.required) parts.push('required: true');
+    if (f.unique) parts.push('unique: true');
+    if (f.default !== undefined && f.default !== '') parts.push(`default: ${f.default}`);
+    return `  ${f.name}: { ${parts.join(', ')} }`;
+  });
+
+  return `import mongoose from 'mongoose';
+
+const ${pascalName}Schema = new mongoose.Schema({
+${fieldLines.join(',\n')}
+}, { timestamps: true });
+
+const ${pascalName} = mongoose.model('${pascalName}', ${pascalName}Schema);
+
+export default ${pascalName};
+`;
+}
+
+// ---------------------------------------------------------------------------
+// API Routes
+// ---------------------------------------------------------------------------
+
+// GET /api/dashboard
+router.get('/api/dashboard', (req, res) => {
+  try {
+    const modelFiles = listModels();
+    const models = modelFiles.map((f) => {
+      const name = path.basename(f, '.js');
+      const fields = getModelSchemaDetailed(name);
+      return { name, fields };
+    });
+    const routes = listRoutes();
+    const mongoConfigured = checkMongoConfig();
+    const routesDirExists = fs.existsSync(path.join(process.cwd(), 'src', 'routes'));
+
+    let dbType = null;
+    const indexPath = path.join(process.cwd(), 'index.js');
+    if (fs.existsSync(indexPath)) {
+      const indexContent = fs.readFileSync(indexPath, 'utf8');
+      if (indexContent.includes('import connectDB') || indexContent.includes('mongoose')) {
+        dbType = 'mongodb';
+      }
+    }
+
+    const authConfigured = fs.existsSync(path.join(process.cwd(), 'src', 'middleware', 'auth.js'));
+
+    let mongoUri = '', mongoProdUri = '';
+    if (mongoConfigured) {
+      const devEnv = path.join(process.cwd(), '.env.development');
+      const prodEnv = path.join(process.cwd(), '.env.production');
+      mongoUri = getEnvValue(devEnv, 'MONGO_URI');
+      mongoProdUri = getEnvValue(prodEnv, 'MONGO_URI');
+    }
+
+    res.json({ models, routes, mongoConfigured, dbType, routesDirExists, authConfigured, mongoUri, mongoProdUri });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/models
+router.get('/api/models', (req, res) => {
+  try {
+    const modelFiles = listModels();
+    const names = modelFiles.map((f) => path.basename(f, '.js'));
+    res.json(names);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/models/:name
+router.get('/api/models/:name', (req, res) => {
+  try {
+    const name = req.params.name;
+    const fields = getModelSchemaDetailed(name);
+    res.json({ name, fields });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/models/:name/data — fetch stored documents from MongoDB collection
+router.get('/api/models/:name/data', async (req, res) => {
+  try {
+    const name = req.params.name;
+    const rawLimit = parseInt(req.query.limit);
+    const limit = rawLimit === 0 ? 0 : Math.min(rawLimit || 50, 500);
+    const skip = parseInt(req.query.skip) || 0;
+    const pascalName = toPascalCase(name);
+
+    // Dynamically import mongoose from the project's node_modules
+    const projectMongoose = path.join(process.cwd(), 'node_modules', 'mongoose', 'index.js');
+    if (!fs.existsSync(projectMongoose)) {
+      return res.status(400).json({ error: 'Mongoose is not installed. Set up MongoDB first.' });
+    }
+    const mongoose = (await import(projectMongoose)).default;
+
+    // Connect if not already connected
+    if (mongoose.connection.readyState === 0) {
+      const devEnv = path.join(process.cwd(), '.env.development');
+      const uri = getEnvValue(devEnv, 'MONGO_URI');
+      if (!uri) return res.status(400).json({ error: 'MONGO_URI not configured.' });
+      await mongoose.connect(uri);
+    }
+
+    const collection = mongoose.connection.db.collection(name + 's');
+    const total = await collection.countDocuments();
+    const query = collection.find({}).skip(skip);
+    if (limit > 0) query.limit(limit);
+    const docs = await query.toArray();
+
+    res.json({ docs, total, limit, skip });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/models/:name/share — generate shareable endpoint documentation
+router.get('/api/models/:name/share', (req, res) => {
+  try {
+    const name = req.params.name;
+    const fields = getModelSchemaDetailed(name);
+    const routes = listRoutes();
+    const routeFile = routes.find(r => r === name + '.js' || r === name + 's.js');
+
+    let endpoints = [];
+    if (routeFile) {
+      const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+      const content = fs.readFileSync(filePath, 'utf8');
+      const regex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]/gi;
+      let m;
+      while ((m = regex.exec(content)) !== null) {
+        endpoints.push({ method: m[1].toUpperCase(), path: m[2] });
+      }
+    }
+
+    // Determine the route prefix
+    const indexPath = path.join(process.cwd(), 'index.js');
+    let prefix = '/api/' + name;
+    if (fs.existsSync(indexPath)) {
+      const indexContent = fs.readFileSync(indexPath, 'utf8');
+      const prefixMatch = indexContent.match(new RegExp(`app\\.use\\(['"](\\/[^'"]+)['"].*${routeFile ? routeFile.replace('.js', '') : name}`));
+      if (prefixMatch) prefix = prefixMatch[1];
+    }
+
+    res.json({ name, fields, endpoints, prefix, routeFile: routeFile || null });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/models
+router.post('/api/models', (req, res) => {
+  try {
+    if (!checkMongoConfig()) {
+      return res.status(400).json({ error: 'Database must be configured before creating schemas. Set up MongoDB first.' });
+    }
+
+    const { name, fields } = req.body;
+    const safeName = sanitizeName(name);
+    const pascalName = toPascalCase(safeName);
+
+    const modelsDir = path.join(process.cwd(), 'src', 'models');
+    if (!fs.existsSync(modelsDir)) {
+      fs.mkdirSync(modelsDir, { recursive: true });
+    }
+
+    const filePath = path.join(modelsDir, safeName + '.js');
+    if (fs.existsSync(filePath)) {
+      return res.status(409).json({ error: `Model "${safeName}" already exists.` });
+    }
+
+    const content = generateSchemaFileContent(pascalName, fields);
+    fs.writeFileSync(filePath, content, 'utf8');
+    res.json({ message: `Model "${safeName}" created.`, file: `src/models/${safeName}.js` });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// PUT /api/models/:name
+router.put('/api/models/:name', (req, res) => {
+  try {
+    const name = req.params.name;
+    const { fields } = req.body;
+    const pascalName = toPascalCase(name);
+
+    const filePath = path.join(process.cwd(), 'src', 'models', name + '.js');
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Model "${name}" not found.` });
+    }
+
+    const content = generateSchemaFileContent(pascalName, fields);
+    fs.writeFileSync(filePath, content, 'utf8');
+    res.json({ message: `Model "${name}" updated.`, file: `src/models/${name}.js` });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// DELETE /api/models/:name
+router.delete('/api/models/:name', (req, res) => {
+  try {
+    const name = req.params.name;
+    const filePath = path.join(process.cwd(), 'src', 'models', name + '.js');
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Model "${name}" not found.` });
+    }
+
+    fs.unlinkSync(filePath);
+    res.json({ message: `Model "${name}" deleted.` });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/routes
+router.get('/api/routes', (req, res) => {
+  try {
+    const routes = listRoutes();
+    res.json(routes);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/routes/:name/content
+router.get('/api/routes/:name/content', (req, res) => {
+  try {
+    const name = req.params.name;
+    const filePath = path.join(process.cwd(), 'src', 'routes', name);
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Route file "${name}" not found.` });
+    }
+
+    const content = fs.readFileSync(filePath, 'utf8');
+    res.json({ name, content });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// DELETE /api/routes/:name
+router.delete('/api/routes/:name', (req, res) => {
+  try {
+    const name = req.params.name;
+    const routeFile = name.endsWith('.js') ? name : name + '.js';
+    const safeName = routeFile.replace('.js', '');
+    const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
+    }
+
+    // Delete the route file
+    fs.unlinkSync(filePath);
+
+    // Send response BEFORE modifying index.js (nodemon restart kills connection)
+    res.json({ message: `Route "${safeName}" deleted successfully.` });
+
+    // Remove import and registration from index.js
+    const indexPath = path.join(process.cwd(), 'index.js');
+    if (fs.existsSync(indexPath)) {
+      let indexContent = fs.readFileSync(indexPath, 'utf8');
+      // Remove import line
+      indexContent = indexContent.replace(new RegExp(`import\\s+\\w+Router\\s+from\\s+['\"]\\./src/routes/${safeName}\\.js['\"];?\\n?`, 'g'), '');
+      // Remove app.use registration line
+      indexContent = indexContent.replace(new RegExp(`app\\.use\\(['\"][^'\"]*${safeName}['\"],\\s*\\w+Router\\);?\\n?`, 'g'), '');
+      fs.writeFileSync(indexPath, indexContent, 'utf8');
+    }
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// PUT /api/routes/:name/content — edit route source code
+// ---------------------------------------------------------------------------
+router.put('/api/routes/:name/content', (req, res) => {
+  try {
+    const name = req.params.name;
+    const { content } = req.body;
+    if (!content || typeof content !== 'string') {
+      return res.status(400).json({ error: 'Content is required.' });
+    }
+    const routeFile = name.endsWith('.js') ? name : name + '.js';
+    const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
+    }
+    fs.writeFileSync(filePath, content, 'utf8');
+    res.json({ message: `Route "${routeFile}" updated successfully.` });
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/routes/:name/add-method — add handlers to existing route
+// ---------------------------------------------------------------------------
+router.post('/api/routes/:name/add-method', async (req, res) => {
+  try {
+    const name = req.params.name.replace(/\.js$/, '');
+    const routeFile = name + '.js';
+    const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
+    }
+
+    const { routeType = 'methods', methods: methodList = [], modelName, loginField, passwordField, registerFields = [], selectedFields = [], customFields = [] } = req.body;
+    const pascalModel = modelName ? toPascalCase(modelName) : '';
+    const hasPassword = !!passwordField;
+    const findField = loginField || 'email';
+
+    let content = fs.readFileSync(filePath, 'utf8');
+
+    // Check for duplicate methods
+    const existingMethods = [];
+    const existCheck = /router\.(get|post|put|patch|delete)\(/gi;
+    let em;
+    while ((em = existCheck.exec(content)) !== null) existingMethods.push(em[1].toLowerCase());
+
+    const newMethods = methodList.filter(m => !existingMethods.includes(m.toLowerCase()));
+
+    // Helper: add import if not present
+    function addImport(imp) {
+      if (!content.includes(imp.split(' from ')[0])) {
+        const lastImport = content.lastIndexOf('import ');
+        const lineEnd = content.indexOf('\n', lastImport);
+        content = content.slice(0, lineEnd + 1) + imp + '\n' + content.slice(lineEnd + 1);
+      }
+    }
+
+    // Helper: insert handler before export
+    function insertHandler(handler) {
+      const exportIdx = content.lastIndexOf('export default router;');
+      if (exportIdx !== -1) {
+        content = content.slice(0, exportIdx) + handler + '\n\n' + content.slice(exportIdx);
+      } else {
+        content += '\n' + handler;
+      }
+    }
+
+    let handlers = '';
+    const packagesToInstall = [];
+
+    if (routeType === 'methods') {
+      if (newMethods.length === 0) {
+        return res.status(400).json({ error: 'All selected methods already exist in this route.' });
+      }
+
+      const allFields = [...selectedFields.map(f => typeof f === 'string' ? { name: f, type: 'String' } : f), ...customFields];
+      const fileFields = allFields.filter(f => f.type === 'File');
+      const bodyFields = allFields.filter(f => f.type !== 'File');
+      const hasFileFields = fileFields.length > 0;
+
+      if (hasFileFields) {
+        addImport("import multer from 'multer';");
+        if (!content.includes('const upload = multer')) {
+          content = content.replace('const router = express.Router();', "const router = express.Router();\n\nconst upload = multer({ dest: 'uploads/' });");
+        }
+        packagesToInstall.push('multer');
+      }
+
+      newMethods.forEach(m => {
+        const dataSource = (m === 'get' || m === 'delete') ? 'req.query' : 'req.body';
+        let mw = '';
+        let destruct = '';
+
+        if (hasFileFields && m !== 'get' && m !== 'delete') {
+          if (fileFields.length === 1) mw = `upload.single('${fileFields[0].name}'), `;
+          else mw = `upload.fields([${fileFields.map(f => `{ name: '${f.name}', maxCount: 1 }`).join(', ')}]), `;
+        }
+        if (bodyFields.length > 0) destruct += `  const { ${bodyFields.map(f => f.name).join(', ')} } = ${dataSource};\n`;
+        if (hasFileFields && m !== 'get' && m !== 'delete') {
+          if (fileFields.length === 1) destruct += `  const ${fileFields[0].name} = req.file;\n`;
+          else fileFields.forEach(f => { destruct += `  const ${f.name} = req.files?.['${f.name}']?.[0];\n`; });
+        }
+
+        if (allFields.length > 0) {
+          handlers += `\nrouter.${m}('/', ${mw}async (req, res) => {\n${destruct}\n  // TODO: Add your logic here\n\n  res.json({ msg: '${name} ${m.toUpperCase()} endpoint works' });\n});\n`;
+        } else {
+          handlers += `\nrouter.${m}('/', async (req, res) => {\n  res.json({ msg: '${name} ${m.toUpperCase()} endpoint works' });\n});\n`;
+        }
+      });
+
+    } else if (routeType === 'crud' && modelName) {
+      addImport(`import ${pascalModel} from '../models/${modelName}.js';`);
+      const crudMethods = newMethods.length > 0 ? newMethods : ['get', 'post', 'put', 'delete'].filter(m => !existingMethods.includes(m));
+
+      if (crudMethods.includes('get')) {
+        handlers += `\n// Get all\nrouter.get('/', async (req, res) => {\n  try {\n    const items = await ${pascalModel}.find();\n    res.json(items);\n  } catch (err) {\n    res.status(500).json({ message: err.message });\n  }\n});\n\n// Get by ID\nrouter.get('/:id', async (req, res) => {\n  try {\n    const item = await ${pascalModel}.findById(req.params.id);\n    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });\n    res.json(item);\n  } catch (err) {\n    res.status(500).json({ message: err.message });\n  }\n});\n`;
+      }
+      if (crudMethods.includes('post')) {
+        handlers += `\n// Create\nrouter.post('/', async (req, res) => {\n  try {\n    const item = new ${pascalModel}(req.body);\n    const saved = await item.save();\n    res.status(201).json(saved);\n  } catch (err) {\n    res.status(400).json({ message: err.message });\n  }\n});\n`;
+      }
+      if (crudMethods.includes('put')) {
+        handlers += `\n// Update\nrouter.put('/:id', async (req, res) => {\n  try {\n    const item = await ${pascalModel}.findByIdAndUpdate(req.params.id, req.body, { new: true, runValidators: true });\n    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });\n    res.json(item);\n  } catch (err) {\n    res.status(400).json({ message: err.message });\n  }\n});\n`;
+      }
+      if (crudMethods.includes('patch')) {
+        handlers += `\n// Partial Update\nrouter.patch('/:id', async (req, res) => {\n  try {\n    const item = await ${pascalModel}.findByIdAndUpdate(req.params.id, req.body, { new: true, runValidators: true });\n    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });\n    res.json(item);\n  } catch (err) {\n    res.status(400).json({ message: err.message });\n  }\n});\n`;
+      }
+      if (crudMethods.includes('delete')) {
+        handlers += `\n// Delete\nrouter.delete('/:id', async (req, res) => {\n  try {\n    const item = await ${pascalModel}.findByIdAndDelete(req.params.id);\n    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });\n    res.json({ message: '${pascalModel} deleted' });\n  } catch (err) {\n    res.status(500).json({ message: err.message });\n  }\n});\n`;
+      }
+
+    } else if (routeType === 'login' && modelName) {
+      addImport(`import ${pascalModel} from '../models/${modelName}.js';`);
+      if (hasPassword) { addImport("import bcrypt from 'bcrypt';"); packagesToInstall.push('bcrypt'); }
+      addImport("import jwt from 'jsonwebtoken';");
+      packagesToInstall.push('jsonwebtoken');
+
+      if (hasPassword) {
+        handlers += `\n// Login\nrouter.post('/', async (req, res) => {\n  try {\n    const { ${findField}, ${passwordField} } = req.body;\n    const ${modelName} = await ${pascalModel}.findOne({ ${findField} });\n    if (!${modelName}) return res.status(401).json({ message: 'Invalid credentials' });\n\n    const isMatch = await bcrypt.compare(${passwordField}, ${modelName}.${passwordField});\n    if (!isMatch) return res.status(401).json({ message: 'Invalid credentials' });\n\n    const token = jwt.sign({ id: ${modelName}._id }, process.env.JWT_SECRET, { expiresIn: '7d' });\n    res.json({ token, ${modelName}: { id: ${modelName}._id, ${findField}: ${modelName}.${findField} } });\n  } catch (err) {\n    res.status(500).json({ message: err.message });\n  }\n});\n`;
+      } else {
+        handlers += `\n// Login\nrouter.post('/', async (req, res) => {\n  try {\n    const { ${findField} } = req.body;\n    const ${modelName} = await ${pascalModel}.findOne({ ${findField} });\n    if (!${modelName}) return res.status(401).json({ message: 'Invalid credentials' });\n\n    const token = jwt.sign({ id: ${modelName}._id }, process.env.JWT_SECRET, { expiresIn: '7d' });\n    res.json({ token, ${modelName}: { id: ${modelName}._id, ${findField}: ${modelName}.${findField} } });\n  } catch (err) {\n    res.status(500).json({ message: err.message });\n  }\n});\n`;
+      }
+
+      // Ensure JWT_SECRET
+      const devEnv = path.join(process.cwd(), '.env.development');
+      const prodEnv = path.join(process.cwd(), '.env.production');
+      if (fs.existsSync(devEnv) && !fs.readFileSync(devEnv, 'utf8').includes('JWT_SECRET')) updateEnvFile(devEnv, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+      if (fs.existsSync(prodEnv) && !fs.readFileSync(prodEnv, 'utf8').includes('JWT_SECRET')) updateEnvFile(prodEnv, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+
+    } else if (routeType === 'register' && modelName) {
+      addImport(`import ${pascalModel} from '../models/${modelName}.js';`);
+      if (hasPassword) { addImport("import bcrypt from 'bcrypt';"); packagesToInstall.push('bcrypt'); }
+      addImport("import jwt from 'jsonwebtoken';");
+      packagesToInstall.push('jsonwebtoken');
+
+      const regFields = registerFields.length > 0 ? registerFields : [findField];
+      const allDestructured = regFields.join(', ');
+
+      if (hasPassword) {
+        const nonPwFields = regFields.filter(f => f !== passwordField);
+        handlers += `\n// Register\nrouter.post('/', async (req, res) => {\n  try {\n    const { ${allDestructured} } = req.body;\n    const existing = await ${pascalModel}.findOne({ ${findField} });\n    if (existing) return res.status(400).json({ message: '${pascalModel} already exists' });\n\n    const salt = await bcrypt.genSalt(10);\n    const hashedPassword = await bcrypt.hash(${passwordField}, salt);\n    const item = new ${pascalModel}({ ${nonPwFields.join(', ')}, ${passwordField}: hashedPassword });\n    const saved = await item.save();\n\n    const token = jwt.sign({ id: saved._id }, process.env.JWT_SECRET, { expiresIn: '7d' });\n    res.status(201).json({ token, ${modelName}: { id: saved._id, ${findField}: saved.${findField} } });\n  } catch (err) {\n    res.status(400).json({ message: err.message });\n  }\n});\n`;
+      } else {
+        handlers += `\n// Register\nrouter.post('/', async (req, res) => {\n  try {\n    const { ${allDestructured} } = req.body;\n    const existing = await ${pascalModel}.findOne({ ${findField} });\n    if (existing) return res.status(400).json({ message: '${pascalModel} already exists' });\n\n    const item = new ${pascalModel}({ ${allDestructured} });\n    const saved = await item.save();\n\n    const token = jwt.sign({ id: saved._id }, process.env.JWT_SECRET, { expiresIn: '7d' });\n    res.status(201).json({ token, ${modelName}: { id: saved._id, ${findField}: saved.${findField} } });\n  } catch (err) {\n    res.status(400).json({ message: err.message });\n  }\n});\n`;
+      }
+
+      const devEnv = path.join(process.cwd(), '.env.development');
+      const prodEnv = path.join(process.cwd(), '.env.production');
+      if (fs.existsSync(devEnv) && !fs.readFileSync(devEnv, 'utf8').includes('JWT_SECRET')) updateEnvFile(devEnv, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+      if (fs.existsSync(prodEnv) && !fs.readFileSync(prodEnv, 'utf8').includes('JWT_SECRET')) updateEnvFile(prodEnv, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+    }
+
+    if (!handlers) {
+      return res.status(400).json({ error: 'Nothing to add.' });
+    }
+
+    // Install packages
+    if (packagesToInstall.length > 0) {
+      try { await execAsync(`npm install ${[...new Set(packagesToInstall)].join(' ')}`, { cwd: process.cwd() }); } catch {}
+    }
+
+    insertHandler(handlers);
+    fs.writeFileSync(filePath, content, 'utf8');
+
+    const label = routeType === 'methods' ? newMethods.map(m => m.toUpperCase()).join(', ') : routeType.toUpperCase();
+    res.json({ message: `${label} added to "${name}" route.`, content });
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/routes/:name/share — generate shareable endpoint docs with field metadata
+router.get('/api/routes/:name/share', (req, res) => {
+  try {
+    const name = req.params.name.replace(/\.js$/, '');
+    const routeFile = name + '.js';
+    const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
+    }
+    const content = fs.readFileSync(filePath, 'utf8');
+
+    // Determine the route prefix from index.js
+    const indexPath = path.join(process.cwd(), 'index.js');
+    let prefix = '/api/' + name;
+    if (fs.existsSync(indexPath)) {
+      const indexContent = fs.readFileSync(indexPath, 'utf8');
+      const prefixMatch = indexContent.match(new RegExp(`app\\.use\\(['"](\\/[^'"]+)['"].*${name}`));
+      if (prefixMatch) prefix = prefixMatch[1];
+    }
+
+    // Check if route imports a model
+    const modelImportMatch = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)['"]/);
+    let modelFields = [];
+    if (modelImportMatch) {
+      modelFields = getModelSchemaDetailed(modelImportMatch[2]);
+    }
+
+    // Parse each endpoint with body/query fields
+    const endpoints = [];
+    const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,\s*(?:auth\s*,\s*)?(?:async\s+)?(?:\([^)]*\)|\w+)\s*=>\s*\{([\s\S]*?)(?=\nrouter\.|$)/gi;
+    let m;
+    while ((m = epRegex.exec(content)) !== null) {
+      const method = m[1].toUpperCase();
+      const epath = m[2];
+      const body = m[3] || '';
+
+      const bodyFields = [];
+      const bodyMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.body/);
+      if (bodyMatch) {
+        bodyMatch[1].split(',').forEach(f => {
+          const fname = f.trim();
+          if (fname) {
+            const meta = modelFields.find(mf => mf.name === fname);
+            bodyFields.push({
+              name: fname,
+              type: meta?.type || 'String',
+              required: meta?.required || false,
+              unique: meta?.unique || false,
+            });
+          }
+        });
+      }
+
+      const queryFields = [];
+      const queryMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.query/);
+      if (queryMatch) {
+        queryMatch[1].split(',').forEach(f => {
+          const fname = f.trim();
+          if (fname) queryFields.push({ name: fname, type: 'String' });
+        });
+      }
+
+      // Check for params
+      const params = [];
+      const paramMatches = epath.match(/:(\w+)/g);
+      if (paramMatches) {
+        paramMatches.forEach(p => params.push(p.replace(':', '')));
+      }
+
+      endpoints.push({ method, path: epath, fullPath: prefix + (epath === '/' ? '' : epath), bodyFields, queryFields, params });
+    }
+
+    res.json({
+      name,
+      prefix,
+      routeFile,
+      modelName: modelImportMatch ? modelImportMatch[2] : null,
+      modelFields,
+      endpoints,
+    });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/crud/preview
+router.post('/api/crud/preview', (req, res) => {
+  try {
+    const { modelName, routeFile, operations } = req.body;
+    const pascalName = toPascalCase(modelName);
+    const fields = getModelSchema(modelName);
+    const routeFilePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+
+    let dataSource = 'req.body';
+    if (fs.existsSync(routeFilePath)) {
+      const method = detectHttpMethod(routeFilePath);
+      dataSource = getRequestDataSource(method);
+    }
+
+    const needsBcrypt = fields.includes('password') &&
+      (operations.includes('create') || operations.includes('update'));
+
+    let code = '';
+
+    // Import block
+    let importBlock = `import ${pascalName} from '../models/${modelName}.js';`;
+    if (needsBcrypt) {
+      importBlock = `import bcrypt from 'bcrypt';\n${importBlock}`;
+    }
+    code += importBlock + '\n';
+
+    if (operations.includes('create')) {
+      code += buildInsertCode(pascalName, fields, dataSource) + '\n';
+    }
+    if (operations.includes('read')) {
+      code += buildReadCode(pascalName) + '\n';
+    }
+    if (operations.includes('update')) {
+      code += buildUpdateCode(pascalName, fields, dataSource) + '\n';
+    }
+    if (operations.includes('delete')) {
+      code += buildDeleteCode(pascalName) + '\n';
+    }
+
+    res.json({ code });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/crud/generate
+router.post('/api/crud/generate', (req, res) => {
+  try {
+    const { modelName, routeFile, operations } = req.body;
+    const pascalName = toPascalCase(modelName);
+    const fields = getModelSchema(modelName);
+    const routeFilePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+
+    if (!fs.existsSync(routeFilePath)) {
+      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
+    }
+
+    if (fields.length === 0) {
+      return res.status(400).json({ error: 'No fields found in the selected model.' });
+    }
+
+    const method = detectHttpMethod(routeFilePath);
+    const dataSource = getRequestDataSource(method);
+    const needsBcrypt = fields.includes('password') &&
+      (operations.includes('create') || operations.includes('update'));
+
+    // Build import
+    let importBlock = `import ${pascalName} from '../models/${modelName}.js';`;
+    if (needsBcrypt) {
+      importBlock = `import bcrypt from 'bcrypt';\n${importBlock}`;
+    }
+    addImportToRoute(routeFilePath, importBlock);
+
+    // Add selected operations
+    const added = [];
+
+    if (operations.includes('create')) {
+      insertCodeIntoRoute(routeFilePath, buildInsertCode(pascalName, fields, dataSource));
+      added.push('POST /create');
+    }
+
+    if (operations.includes('read')) {
+      insertCodeIntoRoute(routeFilePath, buildReadCode(pascalName));
+      added.push('GET / and GET /:id');
+    }
+
+    if (operations.includes('update')) {
+      insertCodeIntoRoute(routeFilePath, buildUpdateCode(pascalName, fields, dataSource));
+      added.push('PUT /:id');
+    }
+
+    if (operations.includes('delete')) {
+      insertCodeIntoRoute(routeFilePath, buildDeleteCode(pascalName));
+      added.push('DELETE /:id');
+    }
+
+    res.json({
+      message: `CRUD operations added to ${routeFile}`,
+      model: modelName,
+      routes: added,
+    });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET /api/env
+router.get('/api/env', (req, res) => {
+  try {
+    const devEnv = path.join(process.cwd(), '.env.development');
+    const prodEnv = path.join(process.cwd(), '.env.production');
+    const devContent = fs.existsSync(devEnv) ? fs.readFileSync(devEnv, 'utf8') : '';
+    const prodContent = fs.existsSync(prodEnv) ? fs.readFileSync(prodEnv, 'utf8') : '';
+    res.json({ development: devContent, production: prodContent });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// PUT /api/env
+router.put('/api/env', (req, res) => {
+  try {
+    const { environment, content } = req.body;
+    if (!environment || !['development', 'production'].includes(environment)) {
+      return res.status(400).json({ error: 'Invalid environment. Must be "development" or "production".' });
+    }
+    const envPath = path.join(process.cwd(), `.env.${environment}`);
+    fs.writeFileSync(envPath, content, 'utf8');
+    res.json({ message: `Environment file (.env.${environment}) updated.` });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Index.js manipulation helpers
+// ---------------------------------------------------------------------------
+
+function readIndexFile() {
+  return fs.readFileSync(path.join(process.cwd(), 'index.js'), 'utf8');
+}
+
+function writeIndexFile(content) {
+  fs.writeFileSync(path.join(process.cwd(), 'index.js'), content, 'utf8');
+}
+
+function addImportToIndex(importLine) {
+  let content = readIndexFile();
+  if (content.includes(importLine.trim())) return;
+  const lines = content.split('\n');
+  let lastImportIdx = -1;
+  lines.forEach((line, i) => {
+    if (line.startsWith('import ')) lastImportIdx = i;
+  });
+  lines.splice(lastImportIdx + 1, 0, importLine.trim());
+  writeIndexFile(lines.join('\n'));
+}
+
+function insertBeforeListen(codeBlock) {
+  let content = readIndexFile();
+  const listenRegex = /(app|server)\.listen\(port/m;
+  let match = content.match(listenRegex);
+  if (!match) {
+    // Match the startServer() call, not the function declaration
+    match = content.match(/^startServer\(/m);
+  }
+  if (match) {
+    content = content.slice(0, match.index) + codeBlock.trim() + '\n' + content.slice(match.index);
+  }
+  writeIndexFile(content);
+}
+
+function replaceAppListen(newBlock) {
+  let content = readIndexFile();
+  if (content.includes('startServer(')) {
+    content = content.replace(/const listener = app\.listen\(tryPort\)/, 'const listener = server.listen(tryPort)');
+    if (!content.includes('server.listen(tryPort)')) {
+      content = content.replace(/app\.listen\(tryPort\)/, 'server.listen(tryPort)');
+    }
+  } else {
+    content = content.replace(/app\.listen\(port[\s\S]*?\}\);?\n?/m, newBlock.trim() + '\n');
+  }
+  writeIndexFile(content);
+}
+
+function removeSocketIOCode() {
+  let content = readIndexFile();
+  // Remove Socket.IO import
+  content = content.replace(/import\s*\{\s*Server\s*\}\s*from\s*["']socket\.io["'];\s*\n?/g, '');
+  // Remove http import only if WebSocket doesn't need it
+  if (!content.includes('WebSocketServer({ server')) {
+    content = content.replace(/import\s+http\s+from\s*["']http["'];\s*\n?/g, '');
+  }
+  // Remove server = http.createServer(app) only if WebSocket doesn't need it
+  if (!content.includes('WebSocketServer({ server')) {
+    content = content.replace(/const\s+server\s*=\s*http\.createServer\(app\);\s*\n?/g, '');
+  }
+  // Remove io setup block (use \n}); to match outer closing brace at column 0)
+  content = content.replace(/const\s+io\s*=\s*new\s+Server\(server[\s\S]*?\n\}\);\s*\n?/g, '');
+  // Remove io.on("connection"...) block (nested callbacks — match \n}); at column 0)
+  content = content.replace(/io\.on\(["']connection["'][\s\S]*?\n\}\);\s*\n?/g, '');
+  // Remove req.io middleware
+  content = content.replace(/app\.use\(\(req,\s*res,\s*next\)\s*=>\s*\{\s*\n?\s*req\.io\s*=\s*io;\s*\n?\s*next\(\);\s*\n?\s*\}\);\s*\n?/g, '');
+  // Replace server.listen back to app.listen if no WebSocket uses server
+  if (!content.includes('WebSocketServer({ server') && content.includes('server.listen(port')) {
+    content = content.replace(/server\.listen\(port[\s\S]*?\n\}\);?\s*\n?/m, `app.listen(port, () => {
+  console.log(\`Server is running on port \${port}\`);
+});\n`);
+  }
+  // Clean up multiple blank lines
+  content = content.replace(/\n{3,}/g, '\n\n');
+  writeIndexFile(content);
+}
+
+function removeWebSocketCode() {
+  let content = readIndexFile();
+  // Remove ws import
+  content = content.replace(/import\s*\{\s*WebSocketServer\s*\}\s*from\s*['"]ws['"];\s*\n?/g, '');
+  // Remove WebSocketServer setup (both same-port and separate-port)
+  content = content.replace(/const\s+wss\s*=\s*new\s+WebSocketServer\(\{[\s\S]*?\n?\}\);\s*\n?/g, '');
+  // Remove wss.on('connection'...) block (nested callbacks — match \n}); at column 0)
+  content = content.replace(/wss\.on\(['"]connection['"][\s\S]*?\n\}\);\s*\n?/g, '');
+  // Remove console.log for WS port
+  content = content.replace(/console\.log\(['"]WebSocket server running on port.*?['"]?\);\s*\n?/g, '');
+  // Remove http import only if Socket.IO doesn't need it
+  if (!content.includes('new Server(server')) {
+    content = content.replace(/import\s+http\s+from\s*['"]http['"];\s*\n?/g, '');
+  }
+  // Remove server = http.createServer(app) only if Socket.IO doesn't need it
+  if (!content.includes('new Server(server')) {
+    content = content.replace(/const\s+server\s*=\s*http\.createServer\(app\);\s*\n?/g, '');
+    // Replace server.listen back to app.listen
+    if (content.includes('server.listen(port')) {
+      content = content.replace(/server\.listen\(port[\s\S]*?\n\}\);?\s*\n?/m, `app.listen(port, () => {
+  console.log(\`Server is running on port \${port}\`);
+});\n`);
+    }
+  }
+  // Clean up multiple blank lines
+  content = content.replace(/\n{3,}/g, '\n\n');
+  writeIndexFile(content);
+}
+
+function updateEnvFile(filePath, key, value) {
+  if (fs.existsSync(filePath)) {
+    let content = fs.readFileSync(filePath, 'utf8');
+    const regex = new RegExp(`^${key}=.*`, 'm');
+    if (regex.test(content)) {
+      content = content.replace(regex, `${key}=${value}`);
+    } else {
+      content = content.trimEnd() + '\n' + `${key}=${value}\n`;
+    }
+    fs.writeFileSync(filePath, content, 'utf8');
+  } else {
+    fs.writeFileSync(filePath, `${key}=${value}\n`, 'utf8');
+  }
+}
+
+// ---------------------------------------------------------------------------
+// GET /api/status
+// ---------------------------------------------------------------------------
+router.get('/api/status', (req, res) => {
+  try {
+    const indexPath = path.join(process.cwd(), 'index.js');
+    const indexContent = fs.existsSync(indexPath) ? fs.readFileSync(indexPath, 'utf8') : '';
+
+    const mongoConfigured = indexContent.includes("import connectDB") || indexContent.includes("connectDB");
+    const routesDirExists = fs.existsSync(path.join(process.cwd(), 'src', 'routes'));
+    const authMiddlewareExists = fs.existsSync(path.join(process.cwd(), 'src', 'middleware', 'auth.js'));
+    const socketConfigured = indexContent.includes('setupSocketIO') || indexContent.includes('socket.io') || indexContent.includes('Server(server');
+    const websocketConfigured = indexContent.includes('setupWebSocket') || indexContent.includes('WebSocketServer') || indexContent.includes("from 'ws'");
+    const serialportConfigured = indexContent.includes('SerialPort') || indexContent.includes("from 'serialport'");
+
+    res.json({
+      mongoConfigured,
+      routesDirExists,
+      authMiddlewareExists,
+      socketConfigured,
+      websocketConfigured,
+      serialportConfigured
+    });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/add-api
+// ---------------------------------------------------------------------------
+router.post('/api/add-api', async (req, res) => {
+  try {
+    const { name, pathPrefix = '/api/', routeType, methods = [], modelName, loginField, passwordField, registerFields = [], selectedFields = [], customFields = [] } = req.body;
+    // Legacy support: single method field
+    const method = req.body.method;
+
+    const safeName = sanitizeName(name);
+    const camelName = toCamelCase(safeName);
+    const pascalModel = modelName ? toPascalCase(modelName) : '';
+    const type = routeType || (method ? 'methods' : 'plain');
+    const methodList = method ? [method] : methods;
+    const hasPassword = !!passwordField;
+
+    const routesDir = path.join(process.cwd(), 'src', 'routes');
+    if (!fs.existsSync(routesDir)) {
+      fs.mkdirSync(routesDir, { recursive: true });
+    }
+
+    const routeFilePath = path.join(routesDir, safeName + '.js');
+
+    // Install packages if needed
+    const packagesToInstall = [];
+    if (type === 'login' || type === 'register') {
+      if (hasPassword) packagesToInstall.push('bcrypt');
+      packagesToInstall.push('jsonwebtoken');
+    }
+    const allFieldsCombined = [...selectedFields.map(f => typeof f === 'string' ? { name: f, type: 'String' } : f), ...customFields];
+    const needsMulter = allFieldsCombined.some(f => f.type === 'File');
+    if (needsMulter) packagesToInstall.push('multer');
+    if (packagesToInstall.length > 0) {
+      await execAsync(`npm install ${packagesToInstall.join(' ')}`, { cwd: process.cwd() });
+    }
+
+    // Build imports
+    let imports = "import express from 'express';\n";
+    if ((type === 'login' || type === 'register') && hasPassword) {
+      imports += "import bcrypt from 'bcrypt';\n";
+    }
+    if (type === 'login' || type === 'register') {
+      imports += "import jwt from 'jsonwebtoken';\n";
+    }
+    if ((type === 'login' || type === 'register' || type === 'crud') && modelName) {
+      imports += `import ${pascalModel} from '../models/${modelName}.js';\n`;
+    } else if (type === 'methods' && modelName && selectedFields.length > 0) {
+      imports += `import ${pascalModel} from '../models/${modelName}.js';\n`;
+    }
+
+    // Build handlers
+    let handlers = '';
+    const findField = loginField || 'email';
+
+    if (type === 'plain') {
+      handlers += `
+// Add your route handlers here
+// Example: router.get('/', (req, res) => res.json({ message: '${safeName} works' }));
+`;
+    } else if (type === 'methods') {
+      // Combine selected model fields + custom fields
+      const allFields = [...selectedFields.map(f => typeof f === 'string' ? { name: f, type: 'String' } : f), ...customFields];
+      const hasFileFields = allFields.some(f => f.type === 'File');
+      const isMultipart = hasFileFields;
+      const bodyFields = allFields.filter(f => f.type !== 'File');
+      const fileFields = allFields.filter(f => f.type === 'File');
+
+      if (isMultipart) {
+        imports += "import multer from 'multer';\n";
+      }
+
+      methodList.forEach(m => {
+        const dataSource = (m === 'get' || m === 'delete') ? 'req.query' : 'req.body';
+        let middlewareStr = '';
+        let destructLines = '';
+
+        if (isMultipart && m !== 'get' && m !== 'delete') {
+          if (fileFields.length === 0) {
+            middlewareStr = 'upload.none(), ';
+          } else if (fileFields.length === 1) {
+            middlewareStr = `upload.single('${fileFields[0].name}'), `;
+          } else {
+            const fieldsArg = fileFields.map(f => `{ name: '${f.name}', maxCount: 1 }`).join(', ');
+            middlewareStr = `upload.fields([${fieldsArg}]), `;
+          }
+        }
+
+        if (bodyFields.length > 0) {
+          const fieldNames = bodyFields.map(f => f.name).join(', ');
+          destructLines += `  const { ${fieldNames} } = ${dataSource};\n`;
+        }
+        if (fileFields.length > 0 && m !== 'get' && m !== 'delete') {
+          if (fileFields.length === 1) {
+            destructLines += `  const ${fileFields[0].name} = req.file;\n`;
+          } else {
+            fileFields.forEach(f => {
+              destructLines += `  const ${f.name} = req.files?.['${f.name}']?.[0];\n`;
+            });
+          }
+        }
+
+        if (allFields.length > 0) {
+          handlers += `
+router.${m}('/', ${middlewareStr}async (req, res) => {
+${destructLines}
+  // TODO: Add your logic here
+
+  res.json({ msg: '${safeName} ${m.toUpperCase()} endpoint works' });
+});
+`;
+        } else {
+          handlers += `
+router.${m}('/', async (req, res) => {
+  res.json({ msg: '${safeName} ${m.toUpperCase()} endpoint works' });
+});
+`;
+        }
+      });
+
+      if (isMultipart) {
+        // Add multer setup after router declaration
+        handlers = `\nconst upload = multer({ dest: 'uploads/' });\n` + handlers;
+      }
+    } else if (type === 'crud' && modelName) {
+      const crudMethods = methodList.length > 0 ? methodList : ['get', 'post', 'put', 'delete'];
+
+      if (crudMethods.includes('get')) {
+        handlers += `
+// Get all
+router.get('/', async (req, res) => {
+  try {
+    const items = await ${pascalModel}.find();
+    res.json(items);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+
+// Get by ID
+router.get('/:id', async (req, res) => {
+  try {
+    const item = await ${pascalModel}.findById(req.params.id);
+    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });
+    res.json(item);
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+`;
+      }
+
+      if (crudMethods.includes('post')) {
+        handlers += `
+// Create
+router.post('/', async (req, res) => {
+  try {
+    const item = new ${pascalModel}(req.body);
+    const saved = await item.save();
+    res.status(201).json(saved);
+  } catch (err) {
+    res.status(400).json({ message: err.message });
+  }
+});
+`;
+      }
+
+      if (crudMethods.includes('put')) {
+        handlers += `
+// Update
+router.put('/:id', async (req, res) => {
+  try {
+    const item = await ${pascalModel}.findByIdAndUpdate(req.params.id, req.body, { new: true, runValidators: true });
+    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });
+    res.json(item);
+  } catch (err) {
+    res.status(400).json({ message: err.message });
+  }
+});
+`;
+      }
+
+      if (crudMethods.includes('patch')) {
+        handlers += `
+// Partial Update
+router.patch('/:id', async (req, res) => {
+  try {
+    const item = await ${pascalModel}.findByIdAndUpdate(req.params.id, req.body, { new: true, runValidators: true });
+    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });
+    res.json(item);
+  } catch (err) {
+    res.status(400).json({ message: err.message });
+  }
+});
+`;
+      }
+
+      if (crudMethods.includes('delete')) {
+        handlers += `
+// Delete
+router.delete('/:id', async (req, res) => {
+  try {
+    const item = await ${pascalModel}.findByIdAndDelete(req.params.id);
+    if (!item) return res.status(404).json({ message: '${pascalModel} not found' });
+    res.json({ message: '${pascalModel} deleted' });
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+`;
+      }
+    } else if (type === 'register' && modelName) {
+      const regFields = registerFields.length > 0 ? registerFields : [findField];
+      const allDestructured = regFields.join(', ');
+      const pwFieldName = hasPassword ? passwordField : null;
+      const nonPwFields = regFields.filter(f => f !== pwFieldName);
+
+      if (hasPassword) {
+        const assignFields = nonPwFields.map(f => f).join(', ');
+        handlers += `
+// Register
+router.post('/', async (req, res) => {
+  try {
+    const { ${allDestructured} } = req.body;
+    const existing = await ${pascalModel}.findOne({ ${findField} });
+    if (existing) return res.status(400).json({ message: '${pascalModel} already exists' });
+
+    const salt = await bcrypt.genSalt(10);
+    const hashedPassword = await bcrypt.hash(${pwFieldName}, salt);
+    const item = new ${pascalModel}({ ${assignFields}, ${pwFieldName}: hashedPassword });
+    const saved = await item.save();
+
+    const token = jwt.sign({ id: saved._id }, process.env.JWT_SECRET, { expiresIn: '7d' });
+    res.status(201).json({ token, ${modelName}: { id: saved._id, ${findField}: saved.${findField} } });
+  } catch (err) {
+    res.status(400).json({ message: err.message });
+  }
+});
+`;
+      } else {
+        handlers += `
+// Register
+router.post('/', async (req, res) => {
+  try {
+    const { ${allDestructured} } = req.body;
+    const existing = await ${pascalModel}.findOne({ ${findField} });
+    if (existing) return res.status(400).json({ message: '${pascalModel} already exists' });
+
+    const item = new ${pascalModel}({ ${allDestructured} });
+    const saved = await item.save();
+
+    const token = jwt.sign({ id: saved._id }, process.env.JWT_SECRET, { expiresIn: '7d' });
+    res.status(201).json({ token, ${modelName}: { id: saved._id, ${findField}: saved.${findField} } });
+  } catch (err) {
+    res.status(400).json({ message: err.message });
+  }
+});
+`;
+      }
+    } else if (type === 'login' && modelName) {
+      if (hasPassword) {
+        handlers += `
+// Login
+router.post('/', async (req, res) => {
+  try {
+    const { ${findField}, ${passwordField} } = req.body;
+    const ${modelName} = await ${pascalModel}.findOne({ ${findField} });
+    if (!${modelName}) return res.status(404).json({ message: '${pascalModel} not found' });
+
+    const isMatch = await bcrypt.compare(${passwordField}, ${modelName}.${passwordField});
+    if (!isMatch) return res.status(400).json({ message: 'Invalid credentials' });
+
+    const token = jwt.sign({ id: ${modelName}._id }, process.env.JWT_SECRET, { expiresIn: '7d' });
+    res.json({ token, ${modelName}: { id: ${modelName}._id, ${findField}: ${modelName}.${findField} } });
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+`;
+      } else {
+        handlers += `
+// Login
+router.post('/', async (req, res) => {
+  try {
+    const { ${findField} } = req.body;
+    const ${modelName} = await ${pascalModel}.findOne({ ${findField} });
+    if (!${modelName}) return res.status(404).json({ message: '${pascalModel} not found' });
+
+    const token = jwt.sign({ id: ${modelName}._id }, process.env.JWT_SECRET, { expiresIn: '7d' });
+    res.json({ token, ${modelName}: { id: ${modelName}._id, ${findField}: ${modelName}.${findField} } });
+  } catch (err) {
+    res.status(500).json({ message: err.message });
+  }
+});
+`;
+      }
+    }
+
+    const content = `${imports}
+const router = express.Router();
+${handlers}
+export default router;
+`;
+
+    fs.writeFileSync(routeFilePath, content, 'utf8');
+
+    const label = type === 'methods' ? methodList.map(m => m.toUpperCase()).join(', ') : type === 'crud' ? 'CRUD (' + (methodList.length > 0 ? methodList.map(m => m.toUpperCase()).join(', ') : 'ALL') + ')' : type === 'plain' ? 'PLAIN' : type.toUpperCase();
+
+    // Ensure JWT_SECRET exists in env files for login/register routes
+    if (type === 'login' || type === 'register') {
+      const devEnv = path.join(process.cwd(), '.env.development');
+      const prodEnv = path.join(process.cwd(), '.env.production');
+      const devContent = fs.existsSync(devEnv) ? fs.readFileSync(devEnv, 'utf8') : '';
+      const prodContent = fs.existsSync(prodEnv) ? fs.readFileSync(prodEnv, 'utf8') : '';
+      if (!devContent.includes('JWT_SECRET')) {
+        updateEnvFile(devEnv, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+      }
+      if (!prodContent.includes('JWT_SECRET')) {
+        updateEnvFile(prodEnv, 'JWT_SECRET', crypto.randomBytes(32).toString('hex'));
+      }
+    }
+
+    // Send response BEFORE modifying index.js (nodemon restart kills connection)
+    res.json({
+      message: `Route "${safeName}" created with ${label} endpoints.`,
+      file: `src/routes/${safeName}.js`
+    });
+
+    // Build clean path: ensure prefix ends with / and no double slashes
+    let prefix = pathPrefix || '/api/';
+    if (!prefix.endsWith('/')) prefix += '/';
+    const fullPath = (prefix + safeName).replace(/\/+/g, '/');
+
+    // Update index.js (triggers nodemon restart)
+    const importLine = `import ${camelName}Router from './src/routes/${safeName}.js';`;
+    addImportToIndex(importLine);
+
+    const routeRegistration = `app.use('${fullPath}', ${camelName}Router);`;
+    let indexContent = readIndexFile();
+    if (!indexContent.includes(routeRegistration)) {
+      insertBeforeListen(routeRegistration);
+    }
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/add-mongo
+// ---------------------------------------------------------------------------
+router.post('/api/add-mongo', async (req, res) => {
+  try {
+    const uri = (req.body.uri || '').trim();
+    const prodUri = (req.body.prodUri || '').trim();
+    const alreadyConfigured = checkMongoConfig();
+
+    if (!uri) {
+      return res.status(400).json({ error: 'MongoDB URI is required' });
+    }
+
+    // Update env files
+    const devEnv = path.join(process.cwd(), '.env.development');
+    const prodEnv = path.join(process.cwd(), '.env.production');
+    updateEnvFile(devEnv, 'MONGO_URI', uri);
+    updateEnvFile(prodEnv, 'MONGO_URI', prodUri || uri);
+
+    if (alreadyConfigured) {
+      // Edit mode — just update env files, no need to reinstall or modify index.js
+      res.json({
+        message: 'MongoDB connection updated. Restart the server to apply changes.',
+        files: ['.env.development', '.env.production']
+      });
+      return;
+    }
+
+    // First-time setup: install mongoose, create db.js, modify index.js
+    await execAsync('npm install mongoose', { cwd: process.cwd() });
+
+    const dbDir = path.join(process.cwd(), 'src');
+    if (!fs.existsSync(dbDir)) {
+      fs.mkdirSync(dbDir, { recursive: true });
+    }
+
+    const dbContent = `import mongoose from 'mongoose';
+
+const connectDB = async () => {
+  try {
+    const conn = await mongoose.connect(process.env.MONGO_URI);
+    console.log(\`MongoDB connected: \${conn.connection.host}\`);
+  } catch (err) {
+    console.error('MongoDB connection error:', err.message);
+    console.error('Check your MONGO_URI in .env.development and ensure MongoDB is running.');
+  }
+};
+
+export default connectDB;
+`;
+    fs.writeFileSync(path.join(dbDir, 'db.js'), dbContent, 'utf8');
+
+    // Send response BEFORE modifying index.js (nodemon restart kills connection)
+    res.json({
+      message: 'MongoDB setup complete.',
+      files: ['src/db.js', '.env.development', '.env.production', 'index.js']
+    });
+
+    // Modify index.js LAST (triggers nodemon restart)
+    addImportToIndex("import connectDB from './src/db.js';");
+    let indexContent = readIndexFile();
+    if (!indexContent.includes('connectDB()')) {
+      const appExpress = "const app = express();";
+      const idx = indexContent.indexOf(appExpress);
+      if (idx !== -1) {
+        indexContent = indexContent.slice(0, idx) + 'connectDB();\n' + indexContent.slice(idx);
+        writeIndexFile(indexContent);
+      }
+    }
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/add-login
+// ---------------------------------------------------------------------------
+router.post('/api/add-login', async (req, res) => {
+  try {
+    const { routeFile, modelName, fields, tokenExpiry } = req.body;
+    const pascalModel = toPascalCase(modelName);
+    const hasPassword = fields.includes('password');
+
+    // Install packages FIRST before modifying files
+    const packages = hasPassword ? 'jsonwebtoken bcrypt' : 'jsonwebtoken';
+    await execAsync(`npm install ${packages}`, { cwd: process.cwd() });
+
+    // Create src/middleware/auth.js if it doesn't exist
+    const middlewareDir = path.join(process.cwd(), 'src', 'middleware');
+    const authFilePath = path.join(middlewareDir, 'auth.js');
+    if (!fs.existsSync(authFilePath)) {
+      if (!fs.existsSync(middlewareDir)) {
+        fs.mkdirSync(middlewareDir, { recursive: true });
+      }
+      const authContent = `import jwt from 'jsonwebtoken';
+
+const auth = (req, res, next) => {
+  const token = req.header('Authorization')?.replace('Bearer ', '');
+  if (!token) {
+    return res.status(401).json({ message: 'No token, authorization denied' });
+  }
+  try {
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    req.user = decoded;
+    next();
+  } catch (err) {
+    res.status(401).json({ message: 'Token is not valid' });
+  }
+};
+
+export default auth;
+`;
+      fs.writeFileSync(authFilePath, authContent, 'utf8');
+    }
+
+    // Build login endpoint code
+    const fieldsDestructure = fields.join(', ');
+
+    let passwordCheck = '';
+    if (hasPassword) {
+      passwordCheck = `
+    const isMatch = await bcrypt.compare(password, user.password);
+    if (!isMatch) {
+      return res.status(400).json({ message: 'Invalid credentials' });
+    }`;
+    }
+
+    let tokenCode = '';
+    if (tokenExpiry) {
+      tokenCode = `    const token = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '15m' });
+    const refreshToken = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '7d' });
+    res.json({ token, refreshToken });`;
+    } else {
+      tokenCode = `    const token = jwt.sign(payload, process.env.JWT_SECRET);
+    res.json({ token });`;
+    }
+
+    const loginCode = `
+router.post('/login', async (req, res) => {
+  const { ${fieldsDestructure} } = req.body;
+  try {
+    const user = await ${pascalModel}.findOne({ ${fields[0]}: ${fields[0]} });
+    if (!user) {
+      return res.status(404).json({ message: 'User not found' });
+    }${passwordCheck}
+    const payload = { id: user._id };
+${tokenCode}
+  } catch (err) {
+    console.error(err);
+    res.status(500).json({ message: 'Server error' });
+  }
+});
+`;
+
+    // Add login endpoint to the selected route file
+    const routeFilePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+    if (!fs.existsSync(routeFilePath)) {
+      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
+    }
+
+    // Add imports to route file
+    addImportToRoute(routeFilePath, "import jwt from 'jsonwebtoken';");
+    if (hasPassword) {
+      addImportToRoute(routeFilePath, "import bcrypt from 'bcrypt';");
+    }
+    addImportToRoute(routeFilePath, `import ${pascalModel} from '../models/${modelName}.js';`);
+
+    // Insert login code
+    insertCodeIntoRoute(routeFilePath, loginCode);
+
+    // If tokenExpiry, create refresh-token route
+    if (tokenExpiry) {
+      const refreshRouteDir = path.join(process.cwd(), 'src', 'routes');
+      const refreshFilePath = path.join(refreshRouteDir, 'refresh-token.js');
+      if (!fs.existsSync(refreshFilePath)) {
+        const refreshContent = `import express from 'express';
+import jwt from 'jsonwebtoken';
+
+const router = express.Router();
+
+router.post('/', async (req, res) => {
+  const { refreshToken } = req.body;
+  if (!refreshToken) {
+    return res.status(401).json({ message: 'Refresh token required' });
+  }
+  try {
+    const decoded = jwt.verify(refreshToken, process.env.JWT_SECRET);
+    const payload = { id: decoded.id };
+    const token = jwt.sign(payload, process.env.JWT_SECRET, { expiresIn: '15m' });
+    res.json({ token });
+  } catch (err) {
+    res.status(401).json({ message: 'Invalid refresh token' });
+  }
+});
+
+export default router;
+`;
+        fs.writeFileSync(refreshFilePath, refreshContent, 'utf8');
+
+        // Register in index.js
+        addImportToIndex("import refreshTokenRouter from './src/routes/refresh-token.js';");
+        const routeReg = "app.use('/api/refresh-token', refreshTokenRouter);";
+        let idxContent = readIndexFile();
+        if (!idxContent.includes(routeReg)) {
+          insertBeforeListen(routeReg);
+        }
+      }
+    }
+
+    // Generate JWT secrets and update env files
+    const devSecret = crypto.randomBytes(32).toString('hex');
+    const prodSecret = crypto.randomBytes(32).toString('hex');
+    const devEnv = path.join(process.cwd(), '.env.development');
+    const prodEnv = path.join(process.cwd(), '.env.production');
+    updateEnvFile(devEnv, 'JWT_SECRET', devSecret);
+    updateEnvFile(prodEnv, 'JWT_SECRET', prodSecret);
+
+    const filesModified = ['src/middleware/auth.js', `src/routes/${routeFile}`, '.env.development', '.env.production'];
+    if (tokenExpiry) filesModified.push('src/routes/refresh-token.js');
+
+    // Send response BEFORE index.js modifications (nodemon restart kills connection)
+    res.json({
+      message: 'JWT authentication setup complete.',
+      files: filesModified
+    });
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/add-socket — create src/services/socket.js
+// ---------------------------------------------------------------------------
+router.post('/api/add-socket', async (req, res) => {
+  try {
+    const { corsOrigins } = req.body;
+
+    // Install packages first
+    const currentContent = readIndexFile();
+    const hasWebSocket = currentContent.includes('setupWebSocket') || currentContent.includes('WebSocketServer');
+
+    if (hasWebSocket) {
+      try { await execAsync('npm uninstall ws && npm install socket.io', { cwd: process.cwd() }); } catch {
+        try { await execAsync('npm install socket.io', { cwd: process.cwd() }); } catch {}
+      }
+    } else {
+      await execAsync('npm install socket.io', { cwd: process.cwd() });
+    }
+
+    // Send response before modifying files
+    res.json({ message: 'Socket.IO setup complete.', files: ['src/services/socket.js', 'index.js'] });
+
+    // Build cors origin value
+    let originValue;
+    if (corsOrigins === '*') originValue = '"*"';
+    else originValue = JSON.stringify(corsOrigins.split(',').map(s => s.trim()));
+
+    // Create src/services/socket.js
+    const servicesDir = path.join(process.cwd(), 'src', 'services');
+    if (!fs.existsSync(servicesDir)) fs.mkdirSync(servicesDir, { recursive: true });
+
+    const socketFile = `import { Server } from "socket.io";
+import http from "http";
+
+export function setupSocketIO(app) {
+  const server = http.createServer(app);
+
+  const io = new Server(server, {
+    cors: {
+      origin: ${originValue},
+      methods: ["GET", "POST"],
+    },
+  });
+
+  io.on("connection", (socket) => {
+    console.log("A user connected");
+    socket.on("disconnect", () => {
+      console.log("User disconnected");
+    });
+  });
+
+  // Make io accessible in routes via req.io
+  app.use((req, res, next) => {
+    req.io = io;
+    next();
+  });
+
+  return { server, io };
+}
+`;
+
+    fs.writeFileSync(path.join(servicesDir, 'socket.js'), socketFile, 'utf8');
+
+    // Remove old WebSocket service file if present
+    const wsFile = path.join(servicesDir, 'websocket.js');
+    if (fs.existsSync(wsFile)) fs.unlinkSync(wsFile);
+
+    // Update index.js — clean approach
+    let content = readIndexFile();
+
+    // Remove old inline socket.io/websocket code
+    content = content.replace(/import\s*\{\s*Server\s*\}\s*from\s*["']socket\.io["'];\s*\n?/g, '');
+    content = content.replace(/import\s*\{\s*WebSocketServer\s*\}\s*from\s*['"]ws['"];\s*\n?/g, '');
+    content = content.replace(/import\s+http\s+from\s*["']http["'];\s*\n?/g, '');
+    content = content.replace(/const\s+server\s*=\s*http\.createServer\(app\);\s*\n?/g, '');
+    content = content.replace(/const\s+io\s*=\s*new\s+Server\(server[\s\S]*?\n\}\);\s*\n?/g, '');
+    content = content.replace(/io\.on\(["']connection["'][\s\S]*?\n\}\);\s*\n?/g, '');
+    content = content.replace(/app\.use\(\(req,\s*res,\s*next\)\s*=>\s*\{\s*\n?\s*req\.io\s*=\s*io;\s*\n?\s*next\(\);\s*\n?\s*\}\);\s*\n?/g, '');
+    content = content.replace(/const\s+wss\s*=\s*new\s+WebSocketServer\(\{[\s\S]*?\n?\}\);\s*\n?/g, '');
+    content = content.replace(/wss\.on\(['"]connection['"][\s\S]*?\n\}\);\s*\n?/g, '');
+    content = content.replace(/console\.log\(['"]WebSocket server running on port.*?['"]?\);\s*\n?/g, '');
+    // Remove old import lines for services
+    content = content.replace(/import\s*\{\s*setupSocketIO\s*\}\s*from\s*['"]\.\/src\/services\/socket\.js['"];\s*\n?/g, '');
+    content = content.replace(/import\s*\{\s*setupWebSocket\s*\}\s*from\s*['"]\.\/src\/services\/websocket\.js['"];\s*\n?/g, '');
+    content = content.replace(/const\s*\{\s*server[^}]*\}\s*=\s*setupSocketIO\(app\);\s*\n?/g, '');
+    content = content.replace(/const\s*\{\s*server[^}]*\}\s*=\s*setupWebSocket\(app\);\s*\n?/g, '');
+    content = content.replace(/setupWebSocket\(app[^)]*\);\s*\n?/g, '');
+
+    // Add import for socket service
+    const lastImport = content.lastIndexOf('import ');
+    const lineEnd = content.indexOf('\n', lastImport);
+    content = content.slice(0, lineEnd + 1) + 'import { setupSocketIO } from "./src/services/socket.js";\n' + content.slice(lineEnd + 1);
+
+    // Add setup call before listen
+    const listenIdx = content.search(/\/\/ ── Start Server|async function startServer|function startServer/);
+    if (listenIdx !== -1) {
+      content = content.slice(0, listenIdx) + 'const { server } = setupSocketIO(app);\n\n' + content.slice(listenIdx);
+    }
+
+    // Replace app.listen with server.listen in startServer
+    content = content.replace('const listener = app.listen(tryPort)', 'const listener = server.listen(tryPort)');
+    // Also handle direct app.listen
+    if (content.includes('app.listen(port') && !content.includes('startServer')) {
+      content = content.replace(/app\.listen\(port[\s\S]*?\}\);?\n?/m, 'server.listen(port, () => {\n  console.log(`Server is running on port ${port}`);\n});\n');
+    }
+
+    // Revert server.listen back to app.listen for old-style
+    content = content.replace('server.listen(port', 'server.listen(port');
+
+    content = content.replace(/\n{3,}/g, '\n\n');
+    writeIndexFile(content);
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/add-websocket — create src/services/websocket.js
+// ---------------------------------------------------------------------------
+router.post('/api/add-websocket', async (req, res) => {
+  try {
+    const { samePort, wsPort } = req.body;
+
+    // Install packages first
+    const currentContent = readIndexFile();
+    const hasSocketIO = currentContent.includes('setupSocketIO') || currentContent.includes('socket.io');
+
+    if (hasSocketIO) {
+      try { await execAsync('npm uninstall socket.io && npm install ws', { cwd: process.cwd() }); } catch {
+        try { await execAsync('npm install ws', { cwd: process.cwd() }); } catch {}
+      }
+    } else {
+      await execAsync('npm install ws', { cwd: process.cwd() });
+    }
+
+    // Send response before modifying files
+    res.json({ message: 'WebSocket setup complete.', files: ['src/services/websocket.js', 'index.js'] });
+
+    // Create src/services/websocket.js
+    const servicesDir = path.join(process.cwd(), 'src', 'services');
+    if (!fs.existsSync(servicesDir)) fs.mkdirSync(servicesDir, { recursive: true });
+
+    let wsFileContent;
+    if (samePort) {
+      wsFileContent = `import { WebSocketServer } from "ws";
+import http from "http";
+
+export function setupWebSocket(app) {
+  const server = http.createServer(app);
+  const wss = new WebSocketServer({ server });
+
+  wss.on("connection", (ws) => {
+    console.log("WebSocket client connected");
+    ws.on("message", (message) => {
+      console.log("Received:", message.toString());
+    });
+    ws.on("close", () => {
+      console.log("WebSocket client disconnected");
+    });
+  });
+
+  return { server, wss };
+}
+`;
+    } else {
+      const p = wsPort || 8080;
+      wsFileContent = `import { WebSocketServer } from "ws";
+
+export function setupWebSocket() {
+  const wss = new WebSocketServer({ port: ${p} });
+
+  wss.on("connection", (ws) => {
+    console.log("WebSocket client connected");
+    ws.on("message", (message) => {
+      console.log("Received:", message.toString());
+    });
+    ws.on("close", () => {
+      console.log("WebSocket client disconnected");
+    });
+  });
+
+  console.log("WebSocket server running on port ${p}");
+  return { wss };
+}
+`;
+    }
+
+    fs.writeFileSync(path.join(servicesDir, 'websocket.js'), wsFileContent, 'utf8');
+
+    // Remove old Socket.IO service file if present
+    const sioFile = path.join(servicesDir, 'socket.js');
+    if (fs.existsSync(sioFile)) fs.unlinkSync(sioFile);
+
+    // Update index.js — clean approach
+    let content = readIndexFile();
+
+    // Remove old inline socket.io/websocket code
+    content = content.replace(/import\s*\{\s*Server\s*\}\s*from\s*["']socket\.io["'];\s*\n?/g, '');
+    content = content.replace(/import\s*\{\s*WebSocketServer\s*\}\s*from\s*['"]ws['"];\s*\n?/g, '');
+    content = content.replace(/import\s+http\s+from\s*["']http["'];\s*\n?/g, '');
+    content = content.replace(/const\s+server\s*=\s*http\.createServer\(app\);\s*\n?/g, '');
+    content = content.replace(/const\s+io\s*=\s*new\s+Server\(server[\s\S]*?\n\}\);\s*\n?/g, '');
+    content = content.replace(/io\.on\(["']connection["'][\s\S]*?\n\}\);\s*\n?/g, '');
+    content = content.replace(/app\.use\(\(req,\s*res,\s*next\)\s*=>\s*\{\s*\n?\s*req\.io\s*=\s*io;\s*\n?\s*next\(\);\s*\n?\s*\}\);\s*\n?/g, '');
+    content = content.replace(/const\s+wss\s*=\s*new\s+WebSocketServer\(\{[\s\S]*?\n?\}\);\s*\n?/g, '');
+    content = content.replace(/wss\.on\(['"]connection['"][\s\S]*?\n\}\);\s*\n?/g, '');
+    content = content.replace(/console\.log\(['"]WebSocket server running on port.*?['"]?\);\s*\n?/g, '');
+    // Remove old service imports
+    content = content.replace(/import\s*\{\s*setupSocketIO\s*\}\s*from\s*['"]\.\/src\/services\/socket\.js['"];\s*\n?/g, '');
+    content = content.replace(/import\s*\{\s*setupWebSocket\s*\}\s*from\s*['"]\.\/src\/services\/websocket\.js['"];\s*\n?/g, '');
+    content = content.replace(/const\s*\{\s*server[^}]*\}\s*=\s*setupSocketIO\(app\);\s*\n?/g, '');
+    content = content.replace(/const\s*\{\s*server[^}]*\}\s*=\s*setupWebSocket\(app\);\s*\n?/g, '');
+    content = content.replace(/setupWebSocket\(app[^)]*\);\s*\n?/g, '');
+    content = content.replace(/setupWebSocket\(\);\s*\n?/g, '');
+
+    // Add import for websocket service
+    const lastImport = content.lastIndexOf('import ');
+    const lineEnd = content.indexOf('\n', lastImport);
+    content = content.slice(0, lineEnd + 1) + 'import { setupWebSocket } from "./src/services/websocket.js";\n' + content.slice(lineEnd + 1);
+
+    // Add setup call before listen
+    const listenIdx = content.search(/\/\/ ── Start Server|async function startServer|function startServer/);
+    if (listenIdx !== -1) {
+      if (samePort) {
+        content = content.slice(0, listenIdx) + 'const { server } = setupWebSocket(app);\n\n' + content.slice(listenIdx);
+        // Replace app.listen with server.listen
+        content = content.replace('const listener = app.listen(tryPort)', 'const listener = server.listen(tryPort)');
+        if (content.includes('app.listen(port') && !content.includes('startServer')) {
+          content = content.replace(/app\.listen\(port[\s\S]*?\}\);?\n?/m, 'server.listen(port, () => {\n  console.log(`Server is running on port ${port}`);\n});\n');
+        }
+      } else {
+        content = content.slice(0, listenIdx) + 'setupWebSocket();\n\n' + content.slice(listenIdx);
+      }
+    }
+
+    content = content.replace(/\n{3,}/g, '\n\n');
+    writeIndexFile(content);
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// GET /api/serialports — list configured serial ports from index.js
+// ---------------------------------------------------------------------------
+router.get('/api/serialports', (req, res) => {
+  try {
+    const indexPath = path.join(process.cwd(), 'index.js');
+    if (!fs.existsSync(indexPath)) return res.json([]);
+    const content = fs.readFileSync(indexPath, 'utf8');
+    const ports = [];
+    // Match: const varName = new SerialPort({ path: '...', baudRate: 9600 })
+    const regex = /const\s+(\w+)\s*=\s*new\s+SerialPort\(\{\s*\n?\s*path:\s*(?:process\.env\.\w+\s*\|\|\s*)?['"]([^'"]+)['"]\s*,\s*\n?\s*baudRate:\s*(?:parseInt\(process\.env\.\w+\)\s*\|\|\s*)?(\d+)/g;
+    let m;
+    while ((m = regex.exec(content)) !== null) {
+      ports.push({ name: m[1], path: m[2], baudRate: parseInt(m[3]) });
+    }
+    res.json(ports);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// POST /api/add-serialport — add a named serial port connection
+// ---------------------------------------------------------------------------
+router.post('/api/add-serialport', async (req, res) => {
+  try {
+    const name = (req.body.name || 'serialPort').replace(/[^a-zA-Z0-9_]/g, '');
+    const portPath = req.body.portPath || '/dev/ttyUSB0';
+    const baud = req.body.baudRate || 9600;
+    const parserName = name + 'Parser';
+    const envPathKey = name.toUpperCase() + '_PATH';
+    const envBaudKey = name.toUpperCase() + '_BAUD';
+
+    // Install FIRST before modifying index.js
+    const indexContent = readIndexFile();
+    if (!indexContent.includes("from 'serialport'")) {
+      await execAsync('npm install serialport @serialport/parser-readline', { cwd: process.cwd() });
+    }
+
+    // Update env files
+    const devEnv = path.join(process.cwd(), '.env.development');
+    const prodEnv = path.join(process.cwd(), '.env.production');
+    updateEnvFile(devEnv, envPathKey, portPath);
+    updateEnvFile(devEnv, envBaudKey, String(baud));
+    updateEnvFile(prodEnv, envPathKey, portPath);
+    updateEnvFile(prodEnv, envBaudKey, String(baud));
+
+    // Send response BEFORE modifying index.js
+    res.json({
+      message: 'Serial port "' + name + '" added.',
+      files: ['index.js', '.env.development', '.env.production']
+    });
+
+    // Modify index.js LAST
+    addImportToIndex("import { SerialPort } from 'serialport';");
+    addImportToIndex("import { ReadlineParser } from '@serialport/parser-readline';");
+
+    const serialCode = `const ${name} = new SerialPort({
+  path: process.env.${envPathKey} || '${portPath}',
+  baudRate: parseInt(process.env.${envBaudKey}) || ${baud}
+});
+
+const ${parserName} = ${name}.pipe(new ReadlineParser({ delimiter: '\\r\\n' }));
+
+${name}.on('open', () => {
+  console.log('${name}: port opened');
+});
+
+${parserName}.on('data', (data) => {
+  console.log('${name} data:', data);
+});
+
+${name}.on('error', (err) => {
+  console.error('${name} error:', err.message);
+});`;
+
+    let current = readIndexFile();
+    if (!current.includes(`const ${name} = new SerialPort`)) {
+      insertBeforeListen(serialCode);
+    }
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// DELETE /api/serialports/:name — remove a serial port from index.js
+// ---------------------------------------------------------------------------
+router.delete('/api/serialports/:name', (req, res) => {
+  try {
+    const name = req.params.name;
+    const parserName = name + 'Parser';
+    let content = readIndexFile();
+
+    // Remove the SerialPort block: const name = new SerialPort({...});
+    content = content.replace(new RegExp(`const\\s+${name}\\s*=\\s*new\\s+SerialPort\\(\\{[\\s\\S]*?\\}\\);\\s*\\n?`, 'g'), '');
+    // Remove parser line
+    content = content.replace(new RegExp(`const\\s+${parserName}\\s*=\\s*${name}\\.pipe[\\s\\S]*?;\\s*\\n?`, 'g'), '');
+    // Remove event handlers
+    content = content.replace(new RegExp(`${name}\\.on\\(['"]open['"][\\s\\S]*?\\}\\);\\s*\\n?`, 'g'), '');
+    content = content.replace(new RegExp(`${parserName}\\.on\\(['"]data['"][\\s\\S]*?\\}\\);\\s*\\n?`, 'g'), '');
+    content = content.replace(new RegExp(`${name}\\.on\\(['"]error['"][\\s\\S]*?\\}\\);\\s*\\n?`, 'g'), '');
+
+    // If no more SerialPort instances, remove imports
+    if (!content.includes('new SerialPort')) {
+      content = content.replace(/import\s*\{\s*SerialPort\s*\}\s*from\s*['"]serialport['"];\s*\n?/g, '');
+      content = content.replace(/import\s*\{\s*ReadlineParser\s*\}\s*from\s*['"]@serialport\/parser-readline['"];\s*\n?/g, '');
+    }
+
+    // Clean up multiple blank lines
+    content = content.replace(/\n{3,}/g, '\n\n');
+    writeIndexFile(content);
+
+    // Remove env vars
+    const envPathKey = name.toUpperCase() + '_PATH';
+    const envBaudKey = name.toUpperCase() + '_BAUD';
+    for (const envFile of ['.env.development', '.env.production']) {
+      const envPath = path.join(process.cwd(), envFile);
+      if (fs.existsSync(envPath)) {
+        let envContent = fs.readFileSync(envPath, 'utf8');
+        envContent = envContent.replace(new RegExp(`^${envPathKey}=.*\\n?`, 'm'), '');
+        envContent = envContent.replace(new RegExp(`^${envBaudKey}=.*\\n?`, 'm'), '');
+        fs.writeFileSync(envPath, envContent, 'utf8');
+      }
+    }
+
+    res.json({ message: 'Serial port "' + name + '" removed.' });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// API Tester — field configs (stored in .4bnode/tester-fields.json)
+// ---------------------------------------------------------------------------
+const testerFieldsPath = path.join(process.cwd(), '.4bnode', 'tester-fields.json');
+
+function loadTesterFields() {
+  try {
+    if (fs.existsSync(testerFieldsPath)) return JSON.parse(fs.readFileSync(testerFieldsPath, 'utf8'));
+  } catch {}
+  return {};
+}
+
+function saveTesterFields(data) {
+  const dir = path.dirname(testerFieldsPath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(testerFieldsPath, JSON.stringify(data, null, 2), 'utf8');
+}
+
+const testerDataPath = path.join(process.cwd(), '.4bnode', 'tester-data.json');
+
+function loadTesterData() {
+  try {
+    if (fs.existsSync(testerDataPath)) return JSON.parse(fs.readFileSync(testerDataPath, 'utf8'));
+  } catch {}
+  return { tests: [], responses: {} };
+}
+
+function saveTesterData(data) {
+  const dir = path.dirname(testerDataPath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(testerDataPath, JSON.stringify(data, null, 2), 'utf8');
+}
+
+// GET /api/api-tester/data — load saved tests and responses
+router.get('/api/api-tester/data', (req, res) => {
+  res.json(loadTesterData());
+});
+
+// PUT /api/api-tester/data — save tests and responses
+router.put('/api/api-tester/data', (req, res) => {
+  const { tests, responses } = req.body;
+  saveTesterData({ tests: tests || [], responses: responses || {} });
+  res.json({ message: 'Saved' });
+});
+
+// GET /api/api-tester/fields/:routeKey — get saved fields for a route
+router.get('/api/api-tester/fields/:routeKey', (req, res) => {
+  const all = loadTesterFields();
+  const key = decodeURIComponent(req.params.routeKey);
+  res.json({ fields: all[key] || null });
+});
+
+// PUT /api/api-tester/fields/:routeKey — save fields for a route
+router.put('/api/api-tester/fields/:routeKey', (req, res) => {
+  const { fields } = req.body;
+  const key = decodeURIComponent(req.params.routeKey);
+  const all = loadTesterFields();
+  all[key] = fields;
+  saveTesterFields(all);
+  res.json({ message: 'Fields saved' });
+});
+
+// ---------------------------------------------------------------------------
+// API Tester — proxy requests to avoid CORS issues
+// ---------------------------------------------------------------------------
+router.post('/api/api-tester/send', async (req, res) => {
+  try {
+    const { method, url, headers: reqHeaders, body: reqBody, bodyType = 'json', formFields = [] } = req.body;
+    if (!url) return res.status(400).json({ error: 'URL is required' });
+
+    const fetchOpts = { method: (method || 'GET').toUpperCase() };
+    const headers = { ...(reqHeaders || {}) };
+
+    if (['POST', 'PUT', 'PATCH'].includes(fetchOpts.method)) {
+      if (bodyType === 'form-data' && formFields.length > 0) {
+        // Build multipart form data
+        const boundary = '----4bnode' + crypto.randomBytes(8).toString('hex');
+        let bodyParts = [];
+        for (const field of formFields) {
+          if (!field.key?.trim()) continue;
+          if (field.fileData) {
+            // File field (base64 encoded data)
+            const fileBuffer = Buffer.from(field.fileData, 'base64');
+            bodyParts.push(
+              `--${boundary}\r\nContent-Disposition: form-data; name="${field.key}"; filename="${field.fileName || 'file'}"\r\nContent-Type: ${field.fileType || 'application/octet-stream'}\r\n\r\n`
+            );
+            bodyParts.push(fileBuffer);
+            bodyParts.push('\r\n');
+          } else {
+            bodyParts.push(
+              `--${boundary}\r\nContent-Disposition: form-data; name="${field.key}"\r\n\r\n${field.value || ''}\r\n`
+            );
+          }
+        }
+        bodyParts.push(`--${boundary}--\r\n`);
+        // Combine string and buffer parts
+        const bufferParts = bodyParts.map(p => typeof p === 'string' ? Buffer.from(p) : p);
+        fetchOpts.body = Buffer.concat(bufferParts);
+        headers['Content-Type'] = `multipart/form-data; boundary=${boundary}`;
+      } else if (bodyType === 'x-www-form-urlencoded' && formFields.length > 0) {
+        fetchOpts.body = formFields
+          .filter(f => f.key?.trim())
+          .map(f => encodeURIComponent(f.key) + '=' + encodeURIComponent(f.value || ''))
+          .join('&');
+        headers['Content-Type'] = 'application/x-www-form-urlencoded';
+      } else if (bodyType === 'binary' && reqBody) {
+        // Binary body (base64 encoded)
+        fetchOpts.body = Buffer.from(reqBody, 'base64');
+      } else if (reqBody) {
+        fetchOpts.body = typeof reqBody === 'string' ? reqBody : JSON.stringify(reqBody);
+      }
+    }
+
+    // Remove Content-Type for form-data (let boundary be set correctly)
+    if (bodyType === 'form-data') {
+      // Already set above with boundary
+    }
+
+    fetchOpts.headers = headers;
+
+    const start = Date.now();
+    const response = await fetch(url, fetchOpts);
+    const elapsed = Date.now() - start;
+    const text = await response.text();
+    const respHeaders = {};
+    response.headers.forEach((v, k) => { respHeaders[k] = v; });
+    res.json({
+      status: response.status,
+      statusText: response.statusText,
+      headers: respHeaders,
+      body: text,
+      time: elapsed,
+      size: Buffer.byteLength(text),
+    });
+  } catch (err) {
+    res.json({ status: 0, statusText: 'Connection Error', body: err.message, headers: {}, time: 0, size: 0 });
+  }
+});
+
+// GET /api/api-tester/routes — list all routes with endpoints for import
+router.get('/api/api-tester/routes', (req, res) => {
+  try {
+    const routes = listRoutes();
+    const result = [];
+    const indexPath = path.join(process.cwd(), 'index.js');
+    const indexContent = fs.existsSync(indexPath) ? fs.readFileSync(indexPath, 'utf8') : '';
+
+    routes.forEach(routeFile => {
+      const name = routeFile.replace('.js', '');
+      const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
+      if (!fs.existsSync(filePath)) return;
+      const content = fs.readFileSync(filePath, 'utf8');
+
+      let prefix = '/api/' + name;
+      const prefixMatch = indexContent.match(new RegExp(`app\\.use\\(['"](\\/[^'"]+)['"].*${name}`));
+      if (prefixMatch) prefix = prefixMatch[1];
+
+      const modelImportMatch = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)['"]/);
+      let modelFields = [];
+      if (modelImportMatch) {
+        modelFields = getModelSchemaDetailed(modelImportMatch[2]);
+      }
+
+      const endpoints = [];
+      const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,([\s\S]*?)(?=\nrouter\.|$)/gi;
+      let m;
+      while ((m = epRegex.exec(content)) !== null) {
+        const method = m[1].toUpperCase();
+        const epath = m[2];
+        const body = m[3] || '';
+        const bodyFields = [];
+        const queryFields = [];
+        const fileFields = [];
+        const bodyMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.body/);
+        if (bodyMatch) {
+          bodyMatch[1].split(',').forEach(f => {
+            const fname = f.trim();
+            if (fname) {
+              const meta = modelFields.find(mf => mf.name === fname);
+              bodyFields.push({ name: fname, type: meta?.type || 'String', required: meta?.required || false, unique: meta?.unique || false });
+            }
+          });
+        }
+        const queryMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.query/);
+        if (queryMatch) {
+          queryMatch[1].split(',').forEach(f => {
+            const fname = f.trim();
+            if (fname) queryFields.push({ name: fname, type: 'String' });
+          });
+        }
+        // Detect file fields from multer middleware and req.file/req.files
+        const uploadSingleMatch = body.match(/upload\.single\(\s*['"](\w+)['"]\s*\)/);
+        if (uploadSingleMatch) fileFields.push({ name: uploadSingleMatch[1] });
+        const uploadFieldsRegex = /name:\s*['"](\w+)['"]/g;
+        const uploadFieldsBlock = body.match(/upload\.fields\(\s*\[([\s\S]*?)\]\s*\)/);
+        if (uploadFieldsBlock) {
+          let ufm;
+          while ((ufm = uploadFieldsRegex.exec(uploadFieldsBlock[1])) !== null) {
+            if (!fileFields.find(f => f.name === ufm[1])) fileFields.push({ name: ufm[1] });
+          }
+        }
+        // Also detect from req.file / req.files assignments
+        const singleFileMatch = body.match(/const\s+(\w+)\s*=\s*req\.file\b/);
+        if (singleFileMatch && !fileFields.find(f => f.name === singleFileMatch[1])) fileFields.push({ name: singleFileMatch[1] });
+        const multiFileRegex = /const\s+(\w+)\s*=\s*req\.files\??\[?\s*\[?['"]([\w]+)['"]\]?/g;
+        let fm;
+        while ((fm = multiFileRegex.exec(body)) !== null) {
+          if (!fileFields.find(f => f.name === fm[1])) fileFields.push({ name: fm[1] });
+        }
+
+        const hasAuth = /auth\s*,/.test(m[0]);
+        const params = [];
+        const paramRegex = /:(\w+)/g;
+        let pm;
+        while ((pm = paramRegex.exec(epath)) !== null) params.push(pm[1]);
+
+        endpoints.push({
+          method,
+          path: epath,
+          fullPath: prefix + (epath === '/' ? '' : epath),
+          bodyFields,
+          queryFields,
+          fileFields,
+          params,
+          hasAuth,
+        });
+      }
+      const hasAuth = content.includes("import auth");
+      result.push({ name, routeFile, prefix, endpoints, hasAuth });
+    });
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Share Collection — save and serve standalone shared page
+// ---------------------------------------------------------------------------
+const sharedDir = path.join(process.cwd(), '.4bnode', 'shared');
+
+router.post('/api/api-tester/share-collection', (req, res) => {
+  try {
+    const { tests, responses } = req.body;
+    if (!tests?.length) return res.status(400).json({ error: 'No tests to share' });
+    if (!fs.existsSync(sharedDir)) fs.mkdirSync(sharedDir, { recursive: true });
+    let appName = 'API Collection';
+    try { appName = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8')).name || appName; } catch {}
+    // Use fixed ID so the share URL stays the same — always updates the same file
+    const id = crypto.createHash('md5').update(appName).digest('hex').slice(0, 12);
+    fs.writeFileSync(path.join(sharedDir, id + '.json'), JSON.stringify({ tests, responses, appName, createdAt: new Date().toISOString() }));
+    res.json({ id });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.get('/shared/:id', (req, res) => {
+  try {
+    const filePath = path.join(sharedDir, req.params.id + '.json');
+    if (!fs.existsSync(filePath)) return res.status(404).send('Collection not found');
+    const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!data.tests) data.tests = [];
+    if (!data.responses) data.responses = {};
+    const rawAppName = data.appName || 'My App';
+    // Convert kebab-case/snake_case to Title Case: "test-app" → "Test App"
+    const appName = rawAppName.replace(/[-_]/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
+
+    const safeJson = (obj) => JSON.stringify(obj).replace(/<\//g, '<\\/').replace(/<!--/g, '<\\!--');
+    const escHtml = (s) => String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+    const safeAppName = escHtml(appName);
+
+    const html = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${safeAppName} - API Documentation</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+body{font-family:'Inter',-apple-system,BlinkMacSystemFont,sans-serif;background:#0f1117;color:#e2e8f0;min-height:100vh;display:flex;flex-direction:column}
+.topbar{height:52px;background:#161b26;border-bottom:1px solid #1e2433;display:flex;align-items:center;padding:0 24px;gap:12px;flex-shrink:0}
+.topbar-name{font-size:16px;font-weight:700;background:linear-gradient(135deg,#a78bfa,#7c3aed);-webkit-background-clip:text;-webkit-text-fill-color:transparent}
+.topbar-sep{width:1px;height:22px;background:#1e2433;margin:0 8px}
+.topbar-label{font-size:12px;color:#64748b;font-weight:500}
+.topbar-count{font-size:10px;padding:3px 10px;border-radius:10px;background:rgba(124,58,237,0.15);color:#a78bfa;font-weight:600;margin-left:auto}
+.topbar-date{font-size:10px;color:#475569}
+.layout{display:flex;flex:1;overflow:hidden}
+.sidebar{width:300px;min-width:300px;background:#161b26;border-right:1px solid #1e2433;display:flex;flex-direction:column;overflow:hidden}
+.sidebar-header{padding:14px 18px;border-bottom:1px solid #1e2433;font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:0.8px;color:#475569;display:flex;justify-content:space-between;align-items:center}
+.sidebar-search{padding:8px 12px;border-bottom:1px solid #1e2433}
+.sidebar-search input{width:100%;padding:7px 12px;background:#0f1117;border:1px solid #1e2433;border-radius:6px;color:#e2e8f0;font-size:12px;outline:none}
+.sidebar-search input:focus{border-color:#7c3aed}
+.sidebar-search input::placeholder{color:#475569}
+.sidebar-list{flex:1;overflow-y:auto}
+.sidebar-item{padding:10px 14px;cursor:pointer;border-bottom:1px solid rgba(30,36,51,0.5);display:flex;align-items:center;gap:10px;transition:all 0.12s;border-left:3px solid transparent}
+.sidebar-item:hover{background:rgba(124,58,237,0.06)}
+.sidebar-item.active{background:rgba(124,58,237,0.1);border-left-color:#7c3aed}
+.sidebar-child{padding:8px 14px 8px 48px;cursor:pointer;border-bottom:1px solid rgba(30,36,51,0.3);display:flex;align-items:center;gap:8px;transition:all 0.12s;border-left:3px solid transparent}
+.sidebar-child:hover{background:rgba(124,58,237,0.06)}
+.sidebar-child.active{background:rgba(124,58,237,0.1);border-left-color:#7c3aed}
+.mb{font-size:9px;font-weight:700;padding:3px 7px;border-radius:4px;font-family:'SF Mono','Fira Code',monospace;text-transform:uppercase;flex-shrink:0;letter-spacing:0.3px}
+.mb-get{background:rgba(52,211,153,0.15);color:#34d399}
+.mb-post{background:rgba(245,158,11,0.15);color:#f59e0b}
+.mb-put{background:rgba(59,130,246,0.15);color:#3b82f6}
+.mb-patch{background:rgba(139,92,246,0.15);color:#8b5cf6}
+.mb-delete{background:rgba(248,113,113,0.15);color:#f87171}
+.item-name{font-size:12px;font-weight:500;flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.item-arrow{font-size:10px;color:#475569;width:14px;text-align:center;flex-shrink:0}
+.item-badge{font-size:9px;padding:2px 7px;border-radius:8px;background:rgba(124,58,237,0.15);color:#a78bfa;font-weight:600}
+.sb{font-size:9px;font-weight:700;padding:3px 7px;border-radius:4px;font-family:'SF Mono','Fira Code',monospace;flex-shrink:0}
+.s2{background:rgba(52,211,153,0.15);color:#34d399}
+.s3{background:rgba(96,165,250,0.15);color:#60a5fa}
+.s4{background:rgba(251,191,36,0.15);color:#fbbf24}
+.s5{background:rgba(248,113,113,0.15);color:#f87171}
+.s0{background:rgba(248,113,113,0.15);color:#f87171}
+.child-label{font-size:11px;color:#94a3b8;flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.child-time{font-size:10px;color:#475569;flex-shrink:0}
+.main{flex:1;display:flex;flex-direction:column;overflow:hidden}
+.main-content{flex:1;overflow-y:auto;padding:24px}
+.empty-state{display:flex;flex-direction:column;align-items:center;justify-content:center;height:100%;color:#475569;gap:12px}
+.empty-state svg{width:48px;height:48px;stroke:#2d3548;stroke-width:1.5;fill:none}
+.card{background:#161b26;border:1px solid #1e2433;border-radius:10px;padding:18px;margin-bottom:16px}
+.card-header{display:flex;align-items:center;gap:10px;margin-bottom:16px;padding-bottom:14px;border-bottom:1px solid #1e2433}
+.endpoint-url{font-family:'SF Mono','Fira Code',monospace;font-size:13px;color:#e2e8f0;background:#0f1117;padding:10px 14px;border-radius:8px;border:1px solid #1e2433;margin-bottom:16px;display:flex;align-items:center;gap:10px;justify-content:space-between}
+.endpoint-url code{flex:1;word-break:break-all}
+.copy-btn{padding:5px 12px;border:1px solid #1e2433;border-radius:6px;background:#0f1117;color:#94a3b8;font-size:11px;cursor:pointer;font-family:inherit;transition:all 0.15s;white-space:nowrap}
+.copy-btn:hover{border-color:#7c3aed;color:#a78bfa}
+.stitle{font-size:10px;font-weight:700;text-transform:uppercase;letter-spacing:0.8px;color:#475569;margin-bottom:10px}
+pre{font-family:'SF Mono','Fira Code',monospace;font-size:12px;line-height:1.7;color:#94a3b8;white-space:pre-wrap;word-break:break-word;background:#0f1117;padding:14px;border-radius:8px;border:1px solid #1e2433;position:relative}
+.field-row{display:flex;align-items:center;gap:8px;padding:8px 12px;background:#0f1117;border-radius:6px;margin-bottom:4px;border:1px solid #1e2433}
+.field-name{font-family:'SF Mono','Fira Code',monospace;font-size:12px;font-weight:500;color:#e2e8f0;min-width:120px}
+.field-type{font-size:10px;padding:2px 7px;border-radius:4px;background:rgba(124,58,237,0.12);color:#a78bfa;font-weight:500}
+.field-req{font-size:10px;padding:2px 7px;border-radius:4px;background:rgba(52,211,153,0.12);color:#34d399;font-weight:600}
+.field-uniq{font-size:10px;padding:2px 7px;border-radius:4px;background:rgba(251,191,36,0.12);color:#fbbf24;font-weight:600}
+.code-tabs{display:flex;gap:0;border-bottom:1px solid #1e2433;margin-bottom:0}
+.code-tab{padding:7px 16px;font-size:11px;font-weight:500;color:#475569;background:none;border:none;cursor:pointer;border-bottom:2px solid transparent;font-family:inherit;transition:all 0.15s}
+.code-tab:hover{color:#94a3b8}
+.code-tab.active{color:#a78bfa;border-bottom-color:#7c3aed;font-weight:600}
+.header-row{display:flex;padding:6px 12px;font-size:12px;gap:12px;border-bottom:1px solid rgba(30,36,51,0.5)}
+.header-key{font-family:'SF Mono','Fira Code',monospace;font-size:11px;font-weight:600;color:#a78bfa;min-width:160px}
+.header-val{font-family:'SF Mono','Fira Code',monospace;font-size:11px;color:#94a3b8;word-break:break-all}
+.type-sio{background:rgba(52,211,153,0.15);color:#34d399}
+.type-ws{background:rgba(96,165,250,0.15);color:#60a5fa}
+.dir-recv{background:rgba(52,211,153,0.15);color:#34d399}
+.dir-sent{background:rgba(245,158,11,0.15);color:#f59e0b}
+.dir-sys{background:rgba(148,163,184,0.15);color:#94a3b8}
+@keyframes spin{to{transform:rotate(360deg)}}
+.spinner{width:16px;height:16px;border:2px solid #1e2433;border-top-color:#7c3aed;border-radius:50%;animation:spin 0.6s linear infinite;display:inline-block}
+</style></head><body>
+<div class="topbar">
+  <span class="topbar-name">${safeAppName}</span>
+  <span class="topbar-sep"></span>
+  <span class="topbar-label">API Documentation</span>
+  <span class="topbar-count">${data.tests.length} endpoint${data.tests.length !== 1 ? 's' : ''}</span>
+  <span class="topbar-date">Shared ${new Date(data.createdAt).toLocaleDateString('en-US', { month: 'short', day: 'numeric', year: 'numeric' })}</span>
+</div>
+<div class="layout">
+  <div class="sidebar">
+    <div class="sidebar-header"><span>Endpoints</span></div>
+    <div class="sidebar-search"><input id="search-inp" placeholder="Search endpoints..." /></div>
+    <div class="sidebar-list" id="sidebar-list"></div>
+  </div>
+  <div class="main">
+    <div class="main-content" id="main-content">
+      <div class="empty-state">
+        <svg viewBox="0 0 24 24"><path d="M13 2L3 14h9l-1 8 10-12h-9l1-8z"/></svg>
+        <span style="font-size:14px;font-weight:500">Select an endpoint from the sidebar</span>
+        <span style="font-size:12px">View request details, example code, and saved responses</span>
+      </div>
+    </div>
+  </div>
+</div>
+<script id="shared-data" type="application/json">${safeJson({ tests: data.tests, responses: data.responses || {} })}</script>
+<script>
+(function(){
+  var _d = JSON.parse(document.getElementById('shared-data').textContent);
+  var tests = _d.tests;
+  var responses = _d.responses;
+  var activeTestId = null;
+  var activeRespId = null;
+  var expanded = {};
+  var activeCodeTab = {};
+  var searchQuery = '';
+
+  tests.forEach(function(t){ t.id = String(t.id); });
+  var normResp = {};
+  Object.keys(responses).forEach(function(k){
+    var key = String(k);
+    var arr = responses[k];
+    if (Array.isArray(arr)) arr.forEach(function(r){ r.id = String(r.id); });
+    normResp[key] = arr;
+  });
+  responses = normResp;
+
+  function esc(s) { return (s||'').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;'); }
+
+  // Copy via event delegation
+  document.addEventListener('click', function(e) {
+    var btn = e.target.closest('[data-copy]');
+    if (!btn) return;
+    var target = btn.getAttribute('data-copy');
+    var text = '';
+    if (target === 'prev-pre') {
+      var pre = btn.closest('div').querySelector('pre');
+      if (pre) text = pre.textContent;
+    } else if (target === 'url') {
+      var code = btn.closest('.endpoint-url');
+      if (code) text = code.querySelector('code').textContent;
+    }
+    if (text) {
+      navigator.clipboard.writeText(text);
+      var orig = btn.textContent;
+      btn.textContent = 'Copied!';
+      btn.style.color = '#34d399';
+      setTimeout(function(){ btn.textContent = orig; btn.style.color = ''; }, 1500);
+    }
+  });
+
+  // Generate code snippets
+  var _isForm = function(t) { return (t.bodyType === 'form-data' || t.bodyType === 'x-www-form-urlencoded') && t.formFields && t.formFields.length > 0; };
+  var _hasBody = function(t) { return ['POST','PUT','PATCH'].indexOf(t.method) !== -1; };
+
+  function genCurl(t) {
+    var nl = String.fromCharCode(10);
+    var bs = String.fromCharCode(92);
+    var c = 'curl -X ' + t.method + " '" + t.url + "'";
+    if (_isForm(t)) {
+      t.formFields.forEach(function(f) {
+        if (!f.key) return;
+        if (f.type === 'file') {
+          c += ' ' + bs + nl + "  -F '" + f.key + "=@/path/to/" + (f.fileName || 'file') + "'";
+        } else {
+          c += ' ' + bs + nl + "  -F '" + f.key + '=' + (f.value || '') + "'";
+        }
+      });
+    } else {
+      if (t.headers) t.headers.forEach(function(h) { if (h.key) c += ' ' + bs + nl + "  -H '" + h.key + ': ' + (h.value||'') + "'"; });
+      if (t.body && _hasBody(t)) {
+        c += ' ' + bs + nl + "  -d '" + t.body.replace(/'/g, "'") + "'";
+      }
+    }
+    return c;
+  }
+  function genFetch(t) {
+    var nl = String.fromCharCode(10);
+    var lines = [];
+    if (_isForm(t)) {
+      lines.push('const formData = new FormData();');
+      t.formFields.forEach(function(f) {
+        if (!f.key) return;
+        if (f.type === 'file') {
+          lines.push("formData.append('" + f.key + "', fileInput.files[0]); // " + (f.fileName || 'file'));
+        } else {
+          lines.push("formData.append('" + f.key + "', '" + (f.value || '') + "');");
+        }
+      });
+      lines.push('');
+      lines.push("fetch('" + t.url + "', {");
+      lines.push("  method: '" + t.method + "',");
+      lines.push('  body: formData,');
+      lines.push('})');
+    } else {
+      lines.push("fetch('" + t.url + "', {");
+      lines.push("  method: '" + t.method + "',");
+      var hdrs = {};
+      if (t.headers) t.headers.forEach(function(h) { if (h.key) hdrs[h.key] = h.value || ''; });
+      if (Object.keys(hdrs).length > 0) lines.push('  headers: ' + JSON.stringify(hdrs, null, 4) + ',');
+      if (t.body && _hasBody(t)) {
+        var formatted = t.body;
+        try { formatted = JSON.stringify(JSON.parse(t.body)); } catch(e) {}
+        lines.push('  body: JSON.stringify(' + formatted + '),');
+      }
+      lines.push('})');
+    }
+    lines.push('.then(res => res.json())');
+    lines.push('.then(data => console.log(data))');
+    lines.push('.catch(err => console.error(err));');
+    return lines.join(nl);
+  }
+  function genAxios(t) {
+    var nl = String.fromCharCode(10);
+    var m = t.method.toLowerCase();
+    var hdrs = {};
+    if (t.headers) t.headers.forEach(function(h) { if (h.key) hdrs[h.key] = h.value || ''; });
+    var lines = [];
+    if (_isForm(t)) {
+      lines.push('const formData = new FormData();');
+      t.formFields.forEach(function(f) {
+        if (!f.key) return;
+        if (f.type === 'file') {
+          lines.push("formData.append('" + f.key + "', fileInput.files[0]); // " + (f.fileName || 'file'));
+        } else {
+          lines.push("formData.append('" + f.key + "', '" + (f.value || '') + "');");
+        }
+      });
+      lines.push('');
+      lines.push("const { data } = await axios." + m + "('" + t.url + "', formData, {");
+      lines.push("  headers: { 'Content-Type': 'multipart/form-data' },");
+      lines.push('});');
+    } else if (_hasBody(t) && t.body) {
+      var d = t.body;
+      try { d = JSON.stringify(JSON.parse(d), null, 2); } catch(e) {}
+      lines.push('const { data } = await axios.' + m + '(');
+      lines.push("  '" + t.url + "',");
+      lines.push('  ' + d.split(nl).join(nl + '  '));
+      if (Object.keys(hdrs).length > 0) lines.push('  , { headers: ' + JSON.stringify(hdrs) + ' }');
+      lines.push(');');
+    } else {
+      lines.push("const { data } = await axios." + m + "('" + t.url + "'");
+      if (Object.keys(hdrs).length > 0) lines.push('  , { headers: ' + JSON.stringify(hdrs) + ' }');
+      lines.push(');');
+    }
+    lines.push('console.log(data);');
+    return lines.join(nl);
+  }
+
+  function filteredTests() {
+    if (!searchQuery) return tests;
+    var q = searchQuery.toLowerCase();
+    return tests.filter(function(t) {
+      return (t.name||'').toLowerCase().includes(q) || (t.url||'').toLowerCase().includes(q) || (t.method||'').toLowerCase().includes(q);
+    });
+  }
+
+  function renderSidebar() {
+    var sb = document.getElementById('sidebar-list');
+    var h = '';
+    var ft = filteredTests();
+    ft.forEach(function(t) {
+      var resps = responses[t.id] || [];
+      var isActive = activeTestId === t.id && !activeRespId;
+      var isExp = expanded[t.id];
+      var tt = t.type || 'rest';
+      h += '<div class="sidebar-item' + (isActive ? ' active' : '') + '" data-test="' + t.id + '">';
+      if (resps.length > 0) h += '<span class="item-arrow">' + (isExp ? '&#9660;' : '&#9654;') + '</span>';
+      else h += '<span class="item-arrow"></span>';
+      if (tt === 'socketio') h += '<span class="mb type-sio">SIO</span>';
+      else if (tt === 'websocket') h += '<span class="mb type-ws">WS</span>';
+      else h += '<span class="mb mb-' + (t.method||'GET').toLowerCase() + '">' + (t.method||'GET') + '</span>';
+      h += '<span class="item-name">' + esc(t.name) + '</span>';
+      if (resps.length > 0) h += '<span class="item-badge">' + resps.length + '</span>';
+      h += '</div>';
+      if (isExp && resps.length > 0) {
+        resps.forEach(function(r) {
+          var isRActive = activeRespId === r.id && activeTestId === t.id;
+          var isSocket = r.dir;
+          h += '<div class="sidebar-child' + (isRActive ? ' active' : '') + '" data-test="' + t.id + '" data-resp="' + r.id + '">';
+          if (isSocket) {
+            var dirCls = r.dir === 'received' ? 'dir-recv' : r.dir === 'sent' ? 'dir-sent' : 'dir-sys';
+            h += '<span class="sb ' + dirCls + '">' + (r.dir === 'received' ? '&#8595;' : r.dir === 'sent' ? '&#8593;' : '&#9679;') + '</span>';
+          } else {
+            h += '<span class="sb s' + Math.floor(r.status/100) + '">' + r.status + '</span>';
+          }
+          h += '<span class="child-label">' + esc(r.label) + '</span>';
+          if (!isSocket && r.time) h += '<span class="child-time">' + r.time + 'ms</span>';
+          h += '</div>';
+        });
+      }
+    });
+    if (ft.length === 0) h = '<div style="padding:20px;text-align:center;color:#475569;font-size:12px">No endpoints found</div>';
+    sb.innerHTML = h;
+  }
+
+  // Search
+  document.getElementById('search-inp').addEventListener('input', function(e) {
+    searchQuery = e.target.value;
+    renderSidebar();
+  });
+
+  document.getElementById('sidebar-list').addEventListener('click', function(e) {
+    var el = e.target.closest('.sidebar-item, .sidebar-child');
+    if (!el) return;
+    var testId = el.getAttribute('data-test');
+    var respId = el.getAttribute('data-resp');
+    if (respId) {
+      activeTestId = testId; activeRespId = respId;
+      renderSidebar(); renderRespView(testId, respId);
+    } else {
+      var wasActive = activeTestId === testId && !activeRespId;
+      activeTestId = testId; activeRespId = null;
+      var resps = responses[testId] || [];
+      if (resps.length > 0) { if (wasActive) expanded[testId] = !expanded[testId]; else expanded[testId] = true; }
+      renderSidebar(); renderTestView(testId);
+    }
+  });
+
+  function renderTestView(id) {
+    var t = tests.find(function(x){ return x.id === id; });
+    if (!t) return;
+    var tt = t.type || 'rest';
+    var main = document.getElementById('main-content');
+
+    if (tt === 'socketio' || tt === 'websocket') {
+      var h = '<div class="card"><div class="card-header">';
+      if (tt === 'socketio') h += '<span class="mb type-sio" style="font-size:11px;padding:4px 10px">Socket.IO</span>';
+      else h += '<span class="mb type-ws" style="font-size:11px;padding:4px 10px">WebSocket</span>';
+      h += '<span style="font-size:16px;font-weight:600">' + esc(t.name) + '</span></div>';
+      h += '<div class="stitle">Connection URL</div>';
+      h += '<div class="endpoint-url"><code>' + esc(t.url) + '</code><button class="copy-btn" data-copy="url">Copy</button></div>';
+      if (tt === 'socketio' && t.event) { h += '<div class="stitle">Emit Event</div><pre style="margin-bottom:16px">' + esc(t.event) + '</pre>'; }
+      if (t.data || t.message) {
+        h += '<div class="stitle">' + (tt === 'socketio' ? 'Event Data' : 'Message') + '</div>';
+        var d = t.data || t.message || ''; try { d = JSON.stringify(JSON.parse(d), null, 2); } catch(e) {}
+        h += '<pre style="margin-bottom:16px">' + esc(d) + '</pre>';
+      }
+      if (tt === 'socketio' && t.listeners && t.listeners.length > 0) {
+        h += '<div class="stitle">Listeners</div><div style="display:flex;flex-wrap:wrap;gap:6px">';
+        t.listeners.forEach(function(l) { h += '<span style="font-size:11px;padding:4px 10px;border-radius:6px;background:rgba(52,211,153,0.1);color:#34d399">' + esc(l) + '</span>'; });
+        h += '</div>';
+      }
+      h += '</div>'; main.innerHTML = h; return;
+    }
+
+    var mc = { GET:'#34d399', POST:'#f59e0b', PUT:'#3b82f6', PATCH:'#8b5cf6', DELETE:'#f87171' };
+    var formatted = t.body || '';
+    try { formatted = JSON.stringify(JSON.parse(formatted), null, 2); } catch(e) {}
+    var hasBody = ['POST','PUT','PATCH'].indexOf(t.method) !== -1;
+    var isFormData = t.bodyType === 'form-data' || t.bodyType === 'x-www-form-urlencoded';
+    var hasFormFields = t.formFields && t.formFields.length > 0;
+    var hasJsonBody = hasBody && t.body;
+    var bodyFields = [];
+    if (hasJsonBody && !isFormData) { try { var bo = JSON.parse(t.body); bodyFields = Object.keys(bo); } catch(e) {} }
+
+    var h = '';
+    // Header
+    h += '<div class="card"><div class="card-header">';
+    h += '<span class="mb mb-' + t.method.toLowerCase() + '" style="font-size:12px;padding:4px 10px">' + t.method + '</span>';
+    h += '<span style="font-size:16px;font-weight:600">' + esc(t.name) + '</span>';
+    if (isFormData) h += '<span style="font-size:10px;padding:3px 8px;border-radius:4px;background:rgba(245,158,11,0.12);color:#f59e0b;font-weight:600;margin-left:8px">' + (t.bodyType === 'form-data' ? 'multipart/form-data' : 'x-www-form-urlencoded') + '</span>';
+    h += '</div>';
+
+    // URL
+    h += '<div class="endpoint-url"><code>' + esc(t.url) + '</code><button class="copy-btn" data-copy="url">Copy URL</button></div>';
+
+    // Headers
+    if (t.headers && t.headers.length > 0) {
+      h += '<div class="stitle">Headers</div>';
+      h += '<div style="background:#0f1117;border:1px solid #1e2433;border-radius:8px;margin-bottom:16px;overflow:hidden">';
+      t.headers.forEach(function(hdr) {
+        if (!hdr.key) return;
+        h += '<div class="header-row"><span class="header-key">' + esc(hdr.key) + '</span><span class="header-val">' + esc(hdr.value||'') + '</span></div>';
+      });
+      h += '</div>';
+    }
+
+    // Form Data Fields
+    if (hasFormFields) {
+      h += '<div class="stitle">Request Fields <span style="font-weight:400;text-transform:none;letter-spacing:0;color:#64748b">(' + (t.bodyType || 'form-data') + ')</span></div>';
+      t.formFields.forEach(function(f) {
+        if (!f.key) return;
+        var isFile = f.type === 'file';
+        h += '<div class="field-row">';
+        h += '<span class="field-name">' + esc(f.key) + '</span>';
+        if (isFile) {
+          h += '<span class="field-type" style="background:rgba(245,158,11,0.12);color:#f59e0b">File</span>';
+        } else {
+          h += '<span class="field-type">Text</span>';
+        }
+        if (f.value && !isFile) h += '<span style="font-size:11px;color:#64748b;font-family:monospace;margin-left:auto">' + esc(f.value) + '</span>';
+        h += '</div>';
+      });
+      h += '<div style="margin-top:12px"></div>';
+    }
+
+    // JSON Body Fields
+    if (!isFormData && hasJsonBody && bodyFields.length > 0) {
+      h += '<div class="stitle">Body Fields</div>';
+      var bodyObj = JSON.parse(t.body);
+      bodyFields.forEach(function(f) {
+        var val = bodyObj[f];
+        var type = typeof val === 'number' ? 'Number' : typeof val === 'boolean' ? 'Boolean' : 'String';
+        h += '<div class="field-row"><span class="field-name">' + esc(f) + '</span><span class="field-type">' + type + '</span></div>';
+      });
+      h += '<div style="margin-top:12px"></div>';
+    }
+
+    // Request Body Example (JSON only)
+    if (!isFormData && hasJsonBody) {
+      h += '<div class="stitle">Request Body Example</div>';
+      h += '<pre style="margin-bottom:16px">' + esc(formatted) + '</pre>';
+    }
+
+    // Code Snippets
+    var codeTab = activeCodeTab[id] || 'curl';
+    h += '<div class="stitle">Code Examples</div>';
+    h += '<div style="background:#0f1117;border:1px solid #1e2433;border-radius:8px;overflow:hidden;margin-bottom:16px">';
+    h += '<div class="code-tabs">';
+    ['curl','fetch','axios'].forEach(function(tab) {
+      h += '<button class="code-tab' + (codeTab === tab ? ' active' : '') + '" data-codetab="' + tab + '" data-testid="' + id + '">' + (tab === 'curl' ? 'cURL' : tab.charAt(0).toUpperCase() + tab.slice(1)) + '</button>';
+    });
+    h += '</div>';
+    var code = codeTab === 'curl' ? genCurl(t) : codeTab === 'fetch' ? genFetch(t) : genAxios(t);
+    h += '<div style="position:relative"><pre style="border:none;border-radius:0;margin:0">' + esc(code) + '</pre>';
+    h += '<button class="copy-btn" style="position:absolute;top:8px;right:8px" data-copy="prev-pre">Copy</button>';
+    h += '</div></div>';
+
+    h += '</div>';
+
+    // Saved Responses
+    var resps = responses[id] || [];
+    if (resps.length > 0) {
+      h += '<div class="stitle" style="margin-top:8px">Saved Responses (' + resps.length + ')</div>';
+      resps.forEach(function(r) {
+        var sc = Math.floor(r.status/100);
+        var body = r.body || ''; try { body = JSON.stringify(JSON.parse(body), null, 2); } catch(e) {}
+        h += '<div class="card" style="padding:0;overflow:hidden">';
+        h += '<div style="padding:10px 16px;border-bottom:1px solid #1e2433;display:flex;align-items:center;gap:10px">';
+        h += '<span class="sb s' + sc + '" style="font-size:11px;padding:3px 8px">' + r.status + ' ' + esc(r.statusText||'') + '</span>';
+        h += '<span style="font-size:13px;font-weight:500">' + esc(r.label) + '</span>';
+        if (r.time) h += '<span style="font-size:11px;color:#475569;margin-left:auto">' + r.time + 'ms</span>';
+        h += '</div>';
+        if (r.requestBody && r.requestBody.trim()) {
+          var rb = r.requestBody; try { rb = JSON.stringify(JSON.parse(rb), null, 2); } catch(e) {}
+          h += '<div style="padding:12px 16px;border-bottom:1px solid #1e2433"><div class="stitle" style="margin-bottom:6px">Request Body</div><pre style="margin:0">' + esc(rb) + '</pre></div>';
+        }
+        h += '<div style="padding:12px 16px"><div class="stitle" style="margin-bottom:6px">Response Body</div><pre style="margin:0">' + esc(body) + '</pre></div>';
+        h += '</div>';
+      });
+    }
+
+    main.innerHTML = h;
+  }
+
+  function renderRespView(testId, respId) {
+    var resps = responses[testId] || [];
+    var r = resps.find(function(x){ return x.id === respId; });
+    if (!r) return;
+    var main = document.getElementById('main-content');
+    var t = tests.find(function(x){ return x.id === testId; });
+    var isSocket = r.dir;
+
+    var h = '<div class="card"><div class="card-header">';
+    if (isSocket) {
+      var dirCls = r.dir === 'received' ? 'dir-recv' : r.dir === 'sent' ? 'dir-sent' : 'dir-sys';
+      h += '<span class="sb ' + dirCls + '" style="font-size:12px;padding:4px 10px">' + (r.dir === 'received' ? 'Received' : r.dir === 'sent' ? 'Sent' : 'System') + '</span>';
+    } else {
+      h += '<span class="sb s' + Math.floor(r.status/100) + '" style="font-size:12px;padding:4px 10px">' + r.status + ' ' + esc(r.statusText||'') + '</span>';
+    }
+    h += '<span style="font-size:16px;font-weight:600">' + esc(r.label) + '</span>';
+    if (!isSocket && r.time) h += '<span style="font-size:11px;color:#475569;margin-left:auto">' + r.time + 'ms</span>';
+    h += '</div>';
+
+    if (t) { h += '<div class="endpoint-url" style="margin-bottom:16px"><code>' + esc(t.url) + '</code></div>'; }
+
+    if (!isSocket && r.requestBody && r.requestBody.trim()) {
+      var rb = r.requestBody; try { rb = JSON.stringify(JSON.parse(rb), null, 2); } catch(e) {}
+      h += '<div class="stitle">Request Body</div><pre style="margin-bottom:16px">' + esc(rb) + '</pre>';
+    }
+    var body = r.body || ''; try { body = JSON.stringify(JSON.parse(body), null, 2); } catch(e) {}
+    h += '<div class="stitle">' + (isSocket ? 'Data' : 'Response Body') + '</div><pre>' + esc(body) + '</pre>';
+    h += '</div>';
+
+    main.innerHTML = h;
+  }
+
+  // Code tab switching
+  document.getElementById('main-content').addEventListener('click', function(e) {
+    var tab = e.target.closest('[data-codetab]');
+    if (tab) {
+      var testId = tab.getAttribute('data-testid');
+      activeCodeTab[testId] = tab.getAttribute('data-codetab');
+      renderTestView(testId);
+      return;
+    }
+  });
+
+  renderSidebar();
+  if (tests.length > 0) {
+    activeTestId = tests[0].id;
+    var firstResps = responses[tests[0].id] || [];
+    if (firstResps.length > 0) expanded[tests[0].id] = true;
+    renderSidebar();
+    renderTestView(tests[0].id);
+  }
+})();
+</script></body></html>`;
+
+    res.type('html').send(html);
+  } catch (err) {
+    res.status(500).send('Error loading collection');
+  }
+});
+
+export default router;