4bnode 4.0.9 → 4.1.1

package/skeleton/.4bnode/dev-api.js

@@ -6,9 +6,71 @@ import { promisify } from 'util';
 import { pathToFileURL } from 'url';
 const execAsync = promisify(exec);
 import crypto from 'crypto';
+// Shared, dependency-free code generation. This file is a verbatim copy of the
+// 4bnode package's lib/codegen.js, kept in sync by `npm run sync`. Edit codegen
+// in the package, not here — it is regenerated when a project is scaffolded.
+import {
+  toCamelCase,
+  toPascalCase,
+  sanitizeName,
+  addImportToContent,
+  insertCodeIntoContent,
+  buildInsertCode,
+  buildReadCode,
+  buildUpdateCode,
+  buildDeleteCode,
+  generateMongooseModel,
+  buildZodSchemaFile,
+  wireValidateIntoRouteContent,
+  addImportAfterLastImport,
+  insertBeforeListenContent,
+  AI_PLAN_SCHEMA,
+  AI_SYSTEM_PROMPT,
+  AI_PROVIDERS,
+  DEFAULT_AI_PROVIDER,
+  normalizeAiPlan,
+  buildCrudRouteFile,
+  addDepsToPackageJson,
+  extractRequestFields,
+  buildOpenApiSpec,
+  buildDocsRouter,
+  MAIL_PROVIDERS,
+  buildMailerService,
+} from './codegen.js';
 
 const router = express.Router();
 
+// ── Network restriction ─────────────────────────────────────────────────────
+// This router can write files and run shell commands — it is a remote-code-
+// execution surface. Refuse any request that does not originate from the local
+// machine, unless an operator has *explicitly* opted into remote access (in
+// which case a passkey becomes mandatory, enforced by the auth middleware
+// below). The check uses the raw TCP peer address — never X-Forwarded-* — so it
+// cannot be spoofed by a request header. Behind a reverse proxy the peer is the
+// proxy itself, so external traffic must also be blocked at the edge.
+// Defense-in-depth production kill-switch. The dashboard should never be mounted
+// in production (see index.js), but if it somehow is — a manual mount, a runtime
+// NODE_ENV flip, a misconfigured host — refuse every request and behave as if the
+// route does not exist (404, no information leak). Set _4BNODE_DASHBOARD=on to
+// force-enable (loopback + passkey still apply).
+const DASHBOARD_ENABLED =
+  process.env._4BNODE_DASHBOARD === 'on' ||
+  (process.env.NODE_ENV !== 'production' && process.env._4BNODE_DASHBOARD !== 'off');
+router.use((req, res, next) => {
+  if (!DASHBOARD_ENABLED) return res.status(404).end();
+  next();
+});
+
+const ALLOW_REMOTE = process.env._4BNODE_ALLOW_REMOTE === '1';
+function isLoopbackRequest(req) {
+  const ip = String((req.socket && req.socket.remoteAddress) || '').replace(/^::ffff:/, '');
+  return ip === '127.0.0.1' || ip === '::1';
+}
+router.use((req, res, next) => {
+  if (ALLOW_REMOTE || isLoopbackRequest(req)) return next();
+  return res.status(403).json({ error: 'The 4bnode dashboard is restricted to the local machine.' });
+});
+
 // ── Console Log Capture ─────────────────────────────────────────────────────
 const _logBuffer = [];
 const _logMaxSize = 500;
@@ -59,21 +121,86 @@ router.use('/assets', express.static(path.join(__4bnodeDir, 'assets')));
 function getPasskeyHash() {
   const file = path.join(__4bnodeDir, '.passkey');
   if (!fs.existsSync(file)) return null;
-  return fs.readFileSync(file, 'utf8').trim();
+  return fs.readFileSync(file, 'utf8').trim() || null;
 }
 
-function hashPasskey(pin) {
-  return crypto.createHash('sha256').update(pin).digest('hex');
+// Constant-time verification. Supports the current salted-scrypt format
+// (`scrypt$<saltHex>$<hashHex>`) and the legacy unsalted sha256 hex digest so
+// apps generated before the upgrade keep working.
+function verifyPasskey(candidate, stored) {
+  if (!candidate || !stored) return false;
+  try {
+    if (stored.startsWith('scrypt$')) {
+      const [, saltHex, hashHex] = stored.split('$');
+      const salt = Buffer.from(saltHex, 'hex');
+      const expected = Buffer.from(hashHex, 'hex');
+      const actual = crypto.scryptSync(String(candidate), salt, expected.length);
+      return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+    }
+    const expected = Buffer.from(stored, 'hex');
+    const actual = crypto.createHash('sha256').update(String(candidate)).digest();
+    return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+  } catch {
+    return false;
+  }
+}
+
+// Brute-force throttle. After AUTH_MAX_FAILS wrong guesses from one peer, lock it
+// out for AUTH_LOCK_MS. In-memory (clears on restart) — enough to stop online
+// guessing, which is the realistic attack once the dashboard is reachable.
+const AUTH_MAX_FAILS = 5;
+const AUTH_LOCK_MS = 60_000;
+const _authFails = new Map(); // ip -> { fails, lockedUntil }
+function authClientKey(req) {
+  return String((req.socket && req.socket.remoteAddress) || 'unknown').replace(/^::ffff:/, '');
+}
+function authLockState(req) {
+  const e = _authFails.get(authClientKey(req));
+  if (e && e.lockedUntil > Date.now()) {
+    return { locked: true, retryAfter: Math.ceil((e.lockedUntil - Date.now()) / 1000) };
+  }
+  return { locked: false, retryAfter: 0 };
+}
+function recordAuthFailure(req) {
+  const key = authClientKey(req);
+  const e = _authFails.get(key) || { fails: 0, lockedUntil: 0 };
+  e.fails += 1;
+  if (e.fails >= AUTH_MAX_FAILS) { e.lockedUntil = Date.now() + AUTH_LOCK_MS; e.fails = 0; }
+  _authFails.set(key, e);
+}
+function recordAuthSuccess(req) {
+  _authFails.delete(authClientKey(req));
 }
 
 // Verify passkey endpoint (no auth middleware needed here)
 router.post('/api/auth', (req, res) => {
-  const { passkey } = req.body;
+  const lock = authLockState(req);
+  if (lock.locked) {
+    res.set('Retry-After', String(lock.retryAfter));
+    return res.status(429).json({ error: `Too many attempts. Try again in ${lock.retryAfter}s.` });
+  }
+  const { passkey } = req.body || {};
   const stored = getPasskeyHash();
-  if (!stored) return res.json({ ok: true });
-  if (!passkey || hashPasskey(passkey) !== stored) {
+  if (!stored) {
+    // No passkey configured: permit only loopback dev. A missing passkey must
+    // never authenticate a remote caller (deny by default).
+    if (!isLoopbackRequest(req)) {
+      return res.status(401).json({ error: 'A dashboard passkey must be configured for remote access.' });
+    }
+    return res.json({ ok: true });
+  }
+  if (!verifyPasskey(passkey, stored)) {
+    // Only count a real guess (non-empty) so an unauthenticated page load that
+    // probes with an empty passkey doesn't burn the lockout budget.
+    if (passkey) recordAuthFailure(req);
+    const after = authLockState(req);
+    if (after.locked) {
+      res.set('Retry-After', String(after.retryAfter));
+      return res.status(429).json({ error: `Too many attempts. Try again in ${after.retryAfter}s.` });
+    }
     return res.status(401).json({ error: 'Invalid passkey' });
   }
+  recordAuthSuccess(req);
   res.json({ ok: true });
 });
 
@@ -83,40 +210,29 @@ router.use('/api', (req, res, next) => {
   // SSE endpoint handles its own auth via query param (EventSource can't send headers)
   if (req.path === '/logs/stream') return next();
   const stored = getPasskeyHash();
-  if (!stored) return next();
+  if (!stored) {
+    // Deny by default: a missing passkey may only pass for loopback dev, never
+    // for a remote caller (relevant when _4BNODE_ALLOW_REMOTE is enabled).
+    if (!isLoopbackRequest(req)) return res.status(401).json({ error: 'Unauthorized' });
+    return next();
+  }
+  const lock = authLockState(req);
+  if (lock.locked) {
+    res.set('Retry-After', String(lock.retryAfter));
+    return res.status(429).json({ error: 'Too many attempts. Try again later.' });
+  }
   const passkey = req.headers['x-passkey'];
-  if (!passkey || hashPasskey(passkey) !== stored) {
+  if (!verifyPasskey(passkey, stored)) {
+    if (passkey) recordAuthFailure(req);
     return res.status(401).json({ error: 'Unauthorized' });
   }
   next();
 });
 
 // ---------------------------------------------------------------------------
-// Utility functions (self-contained, no external imports)
+// Utility functions (name helpers + code builders are imported from ./codegen.js)
 // ---------------------------------------------------------------------------
 
-function toCamelCase(str) {
-  return str.replace(/-([a-z])/g, (g) => g[1].toUpperCase());
-}
-
-function toPascalCase(str) {
-  const camel = toCamelCase(str);
-  return camel.charAt(0).toUpperCase() + camel.slice(1);
-}
-
-function sanitizeName(input) {
-  if (!input || typeof input !== "string") {
-    throw new Error("Name is required.");
-  }
-  const trimmed = input.trim();
-  if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(trimmed)) {
-    throw new Error(
-      `Invalid name "${trimmed}". Use only letters, numbers, hyphens, and underscores. Must start with a letter.`
-    );
-  }
-  return trimmed;
-}
-
 function listModels() {
   const modelsDir = path.join(process.cwd(), "src", "models");
   if (!fs.existsSync(modelsDir)) {
@@ -167,6 +283,41 @@ function extractSchemaBlock(content) {
   return null;
 }
 
+// The fields a route actually accepts in its body — used to generate a Zod schema
+// scoped to THAT route (not the whole model, which many routes share with differing
+// field subsets). Pulls types from the model where known; skips File fields (not in
+// req.body). Returns null when the route takes no validatable body.
+function routeValidatorFields(type, opts) {
+  const { findField, passwordField, hasPassword, registerFields, allFieldsCombined, modelName } = opts;
+  const modelFields = {};
+  try {
+    if (modelName) (getModelSchemaDetailed(sanitizeName(modelName)).fields || []).forEach((f) => { modelFields[f.name] = f; });
+  } catch {}
+  const make = (name, fallbackType, required) => {
+    const mf = modelFields[name];
+    return { name, type: (mf && mf.type) || fallbackType || 'String', required };
+  };
+  if (type === 'login') {
+    const fields = [make(findField, 'String', true)];
+    if (hasPassword) fields.push(make(passwordField, 'String', true));
+    return fields;
+  }
+  if (type === 'register') {
+    const regFields = (registerFields && registerFields.length) ? registerFields : [findField];
+    return regFields.map((f) => make(f, 'String', true));
+  }
+  if (type === 'crud' || type === 'methods') {
+    return (allFieldsCombined || [])
+      .filter((f) => f.type !== 'File')
+      .map((f) => {
+        const mf = modelFields[f.name];
+        const required = mf ? !!mf.required : f.required !== false;
+        return { name: f.name, type: (f.type && f.type !== 'File' && f.type) || (mf && mf.type) || 'String', required };
+      });
+  }
+  return null;
+}
+
 function getModelSchemaDetailed(modelName) {
   const modelFilePath = path.join(
     process.cwd(),
@@ -259,40 +410,21 @@ function getModelSchema(modelName) {
 // Route file manipulation functions
 // ---------------------------------------------------------------------------
 
+// File-based wrappers around the shared pure string helpers in codegen.js.
 function addImportToRoute(filePath, importStatement) {
-  let content = fs.readFileSync(filePath, "utf8");
-  if (!content.includes(importStatement.trim())) {
-    content = importStatement.trim() + "\n" + content;
+  const original = fs.readFileSync(filePath, "utf8");
+  const content = addImportToContent(original, importStatement);
+  if (content !== original) {
     fs.writeFileSync(filePath, content, "utf8");
   }
   return content;
 }
 
 function insertCodeIntoRoute(filePath, codeBlock) {
-  let content = fs.readFileSync(filePath, "utf8");
-
-  // Prefer inserting before "export default router;" as it's more reliable
-  const exportIndex = content.lastIndexOf("export default router;");
-  if (exportIndex !== -1) {
-    content =
-      content.slice(0, exportIndex) +
-      codeBlock.trim() +
-      "\n\n" +
-      content.slice(exportIndex);
-  } else {
-    // Fallback to inserting before last "});"
-    const lastClose = content.lastIndexOf("});");
-    if (lastClose !== -1) {
-      content =
-        content.slice(0, lastClose) +
-        codeBlock.trim() +
-        "\n" +
-        content.slice(lastClose);
-    } else {
-      content += "\n" + codeBlock.trim() + "\n";
-    }
-  }
-
+  const content = insertCodeIntoContent(
+    fs.readFileSync(filePath, "utf8"),
+    codeBlock
+  );
   fs.writeFileSync(filePath, content, "utf8");
 }
 
@@ -308,154 +440,10 @@ function getRequestDataSource(method) {
   return method === "get" || method === "delete" ? "req.query" : "req.body";
 }
 
-// ---------------------------------------------------------------------------
-// CRUD code builders
-// ---------------------------------------------------------------------------
-
-function buildInsertCode(pascalName, fields, dataSource) {
-  const assignments = fields
-    .map((f) => `    ${f}: ${dataSource}.${f}`)
-    .join(",\n");
-
-  let passwordLogic = "";
-  if (fields.includes("password")) {
-    passwordLogic = `
-  if (newData.password) {
-    const salt = await bcrypt.genSalt(10);
-    newData.password = await bcrypt.hash(newData.password, salt);
-  }`;
-  }
-
-  return `
-router.post('/create', async (req, res) => {
-  const newData = {
-${assignments}
-  };
-${passwordLogic}
-  try {
-    const newDocument = new ${pascalName}(newData);
-    await newDocument.save();
-    res.json({ message: 'Data inserted successfully', data: newDocument });
-  } catch (err) {
-    console.error(err);
-    res.status(500).json({ message: 'Server error' });
-  }
-});`;
-}
-
-function buildReadCode(pascalName) {
-  return `
-router.get('/', async (req, res) => {
-  try {
-    const documents = await ${pascalName}.find();
-    res.json({ data: documents });
-  } catch (err) {
-    console.error(err);
-    res.status(500).json({ message: 'Server error' });
-  }
-});
-
-router.get('/:id', async (req, res) => {
-  try {
-    const document = await ${pascalName}.findById(req.params.id);
-    if (!document) {
-      return res.status(404).json({ message: 'Document not found' });
-    }
-    res.json({ data: document });
-  } catch (err) {
-    console.error(err);
-    res.status(500).json({ message: 'Server error' });
-  }
-});`;
-}
-
-function buildUpdateCode(pascalName, fields, dataSource) {
-  const assignments = fields
-    .map((f) => `    ${f}: ${dataSource}.${f}`)
-    .join(",\n");
-
-  let passwordLogic = "";
-  if (fields.includes("password")) {
-    passwordLogic = `
-  if (updatedData.password) {
-    const salt = await bcrypt.genSalt(10);
-    updatedData.password = await bcrypt.hash(updatedData.password, salt);
-  }`;
-  }
-
-  return `
-router.put('/:id', async (req, res) => {
-  const updatedData = {
-${assignments}
-  };
-${passwordLogic}
-  try {
-    const updatedDocument = await ${pascalName}.findByIdAndUpdate(req.params.id, updatedData, { returnDocument: 'after' });
-    if (!updatedDocument) {
-      return res.status(404).json({ message: 'Document not found' });
-    }
-    res.json({ message: 'Data updated successfully', data: updatedDocument });
-  } catch (err) {
-    console.error(err);
-    res.status(500).json({ message: 'Server error' });
-  }
-});`;
-}
-
-function buildDeleteCode(pascalName) {
-  return `
-router.delete('/:id', async (req, res) => {
-  try {
-    const deletedDocument = await ${pascalName}.findByIdAndDelete(req.params.id);
-    if (!deletedDocument) {
-      return res.status(404).json({ message: 'Document not found' });
-    }
-    res.json({ message: 'Data deleted successfully', data: deletedDocument });
-  } catch (err) {
-    console.error(err);
-    res.status(500).json({ message: 'Server error' });
-  }
-});`;
-}
-
-// ---------------------------------------------------------------------------
-// Schema file generation helper
-// ---------------------------------------------------------------------------
-
-function generateSchemaFileContent(pascalName, fields, indexes = []) {
-  const fieldLines = fields.map((f) => {
-    const type = f.type || 'String';
-    const parts = [type === 'ObjectId' ? 'type: mongoose.Schema.Types.ObjectId' : `type: ${type}`];
-    if (f.ref) parts.push(`ref: '${f.ref}'`);
-    if (f.required) parts.push('required: true');
-    if (f.unique) parts.push('unique: true');
-    if (f.index) parts.push('index: true');
-    if (f.default !== undefined && f.default !== '') parts.push(`default: ${f.default}`);
-    return `  ${f.name}: { ${parts.join(', ')} }`;
-  });
-
-  // Add index lines
-  let indexLines = '';
-  for (const idx of indexes) {
-    const fieldObj = idx.fields.map(f => {
-      if (f.direction === 'text') return `${f.field}: 'text'`;
-      return `${f.field}: ${f.direction || 1}`;
-    }).join(', ');
-    const options = idx.unique ? ', { unique: true }' : '';
-    indexLines += `\n${pascalName}Schema.index({ ${fieldObj} }${options});`;
-  }
-
-  return `import mongoose from 'mongoose';
-
-const ${pascalName}Schema = new mongoose.Schema({
-${fieldLines.join(',\n')}
-}, { timestamps: true });
-${indexLines}
-const ${pascalName} = mongoose.model('${pascalName}', ${pascalName}Schema);
-
-export default ${pascalName};
-`;
-}
+// CRUD route builders and the Mongoose model generator are imported from
+// ./codegen.js. `generateSchemaFileContent` is kept as a thin alias so existing
+// call sites below remain unchanged.
+const generateSchemaFileContent = generateMongooseModel;
 
 // ---------------------------------------------------------------------------
 // API Routes
@@ -610,6 +598,7 @@ router.post('/api/models', (req, res) => {
 
     const content = generateSchemaFileContent(pascalName, fields, indexes);
     fs.writeFileSync(filePath, content, 'utf8');
+    refreshDocsSpec();
     res.json({ message: `Model "${safeName}" created.`, file: `src/models/${safeName}.js` });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -630,6 +619,7 @@ router.put('/api/models/:name', (req, res) => {
 
     const content = generateSchemaFileContent(pascalName, fields, indexes);
     fs.writeFileSync(filePath, content, 'utf8');
+    refreshDocsSpec();
     res.json({ message: `Model "${name}" updated.`, file: `src/models/${name}.js` });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -646,6 +636,7 @@ router.delete('/api/models/:name', (req, res) => {
     }
 
     fs.unlinkSync(filePath);
+    refreshDocsSpec();
     res.json({ message: `Model "${name}" deleted.` });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -692,6 +683,7 @@ router.delete('/api/routes/:name', (req, res) => {
 
     // Delete the route file
     fs.unlinkSync(filePath);
+    refreshDocsSpec();
 
     // Send response BEFORE modifying index.js (nodemon restart kills connection)
     res.json({ message: `Route "${safeName}" deleted successfully.` });
@@ -711,27 +703,6 @@ router.delete('/api/routes/:name', (req, res) => {
   }
 });
 
-// PUT /api/routes/:name/content — edit route source code
-// ---------------------------------------------------------------------------
-router.put('/api/routes/:name/content', (req, res) => {
-  try {
-    const name = req.params.name;
-    const { content } = req.body;
-    if (!content || typeof content !== 'string') {
-      return res.status(400).json({ error: 'Content is required.' });
-    }
-    const routeFile = name.endsWith('.js') ? name : name + '.js';
-    const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
-    if (!fs.existsSync(filePath)) {
-      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
-    }
-    fs.writeFileSync(filePath, content, 'utf8');
-    res.json({ message: `Route "${routeFile}" updated successfully.` });
-  } catch (err) {
-    if (!res.headersSent) res.status(500).json({ error: err.message });
-  }
-});
-
 // ---------------------------------------------------------------------------
 // POST /api/routes/:name/add-method — add handlers to existing route
 // ---------------------------------------------------------------------------
@@ -921,11 +892,12 @@ router.post('/api/routes/:name/add-method', async (req, res) => {
 
     // Install packages
     if (packagesToInstall.length > 0) {
-      try { await execAsync(`npm install ${[...new Set(packagesToInstall)].join(' ')}`, { cwd: process.cwd() }); } catch {}
+      await installDeps([...new Set(packagesToInstall)]);
     }
 
     insertHandler(handlers);
     fs.writeFileSync(filePath, content, 'utf8');
+    refreshDocsSpec();
 
     const label = routeType === 'methods' ? newMethods.map(m => m.toUpperCase()).join(', ') : routeType.toUpperCase();
     res.json({ message: `${label} added to "${name}" route.`, content });
@@ -934,91 +906,6 @@ router.post('/api/routes/:name/add-method', async (req, res) => {
   }
 });
 
-// GET /api/routes/:name/share — generate shareable endpoint docs with field metadata
-router.get('/api/routes/:name/share', (req, res) => {
-  try {
-    const name = req.params.name.replace(/\.js$/, '');
-    const routeFile = name + '.js';
-    const filePath = path.join(process.cwd(), 'src', 'routes', routeFile);
-    if (!fs.existsSync(filePath)) {
-      return res.status(404).json({ error: `Route file "${routeFile}" not found.` });
-    }
-    const content = fs.readFileSync(filePath, 'utf8');
-
-    // Determine the route prefix from index.js
-    const indexPath = path.join(process.cwd(), 'index.js');
-    let prefix = '/api/' + name;
-    if (fs.existsSync(indexPath)) {
-      const indexContent = fs.readFileSync(indexPath, 'utf8');
-      const prefixMatch = indexContent.match(new RegExp(`app\\.use\\(['"](\\/[^'"]+)['"].*${name}`));
-      if (prefixMatch) prefix = prefixMatch[1];
-    }
-
-    // Check if route imports a model
-    const modelImportMatch = content.match(/import\s+(\w+)\s+from\s+['"]\.\.\/models\/(\w+)['"]/);
-    let modelFields = [];
-    if (modelImportMatch) {
-      modelFields = getModelSchemaDetailed(modelImportMatch[2]).fields;
-    }
-
-    // Parse each endpoint with body/query fields
-    const endpoints = [];
-    const epRegex = /router\.(get|post|put|patch|delete)\(\s*['"`](\/[^'"`]*?)['"`]\s*,\s*(?:auth\s*,\s*)?(?:async\s+)?(?:\([^)]*\)|\w+)\s*=>\s*\{([\s\S]*?)(?=\nrouter\.|$)/gi;
-    let m;
-    while ((m = epRegex.exec(content)) !== null) {
-      const method = m[1].toUpperCase();
-      const epath = m[2];
-      const body = m[3] || '';
-
-      const bodyFields = [];
-      const bodyMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.body/);
-      if (bodyMatch) {
-        bodyMatch[1].split(',').forEach(f => {
-          const fname = f.trim();
-          if (fname) {
-            const meta = modelFields.find(mf => mf.name === fname);
-            bodyFields.push({
-              name: fname,
-              type: meta?.type || 'String',
-              required: meta?.required || false,
-              unique: meta?.unique || false,
-            });
-          }
-        });
-      }
-
-      const queryFields = [];
-      const queryMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.query/);
-      if (queryMatch) {
-        queryMatch[1].split(',').forEach(f => {
-          const fname = f.trim();
-          if (fname) queryFields.push({ name: fname, type: 'String' });
-        });
-      }
-
-      // Check for params
-      const params = [];
-      const paramMatches = epath.match(/:(\w+)/g);
-      if (paramMatches) {
-        paramMatches.forEach(p => params.push(p.replace(':', '')));
-      }
-
-      endpoints.push({ method, path: epath, fullPath: prefix + (epath === '/' ? '' : epath), bodyFields, queryFields, params });
-    }
-
-    res.json({
-      name,
-      prefix,
-      routeFile,
-      modelName: modelImportMatch ? modelImportMatch[2] : null,
-      modelFields,
-      endpoints,
-    });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
 // ---------------------------------------------------------------------------
 // POST /api/crud/preview
 router.post('/api/crud/preview', (req, res) => {
@@ -1161,30 +1048,13 @@ function writeIndexFile(content) {
   fs.writeFileSync(path.join(process.cwd(), 'index.js'), content, 'utf8');
 }
 
+// File-based wrappers around the shared pure index.js transforms in codegen.js.
 function addImportToIndex(importLine) {
-  let content = readIndexFile();
-  if (content.includes(importLine.trim())) return;
-  const lines = content.split('\n');
-  let lastImportIdx = -1;
-  lines.forEach((line, i) => {
-    if (line.startsWith('import ')) lastImportIdx = i;
-  });
-  lines.splice(lastImportIdx + 1, 0, importLine.trim());
-  writeIndexFile(lines.join('\n'));
+  writeIndexFile(addImportAfterLastImport(readIndexFile(), importLine));
 }
 
 function insertBeforeListen(codeBlock) {
-  let content = readIndexFile();
-  const listenRegex = /(app|server)\.listen\(port/m;
-  let match = content.match(listenRegex);
-  if (!match) {
-    // Match the startServer() call, not the function declaration
-    match = content.match(/^startServer\(/m);
-  }
-  if (match) {
-    content = content.slice(0, match.index) + codeBlock.trim() + '\n' + content.slice(match.index);
-  }
-  writeIndexFile(content);
+  writeIndexFile(insertBeforeListenContent(readIndexFile(), codeBlock));
 }
 
 function replaceAppListen(newBlock) {
@@ -1273,6 +1143,26 @@ function updateEnvFile(filePath, key, value) {
   }
 }
 
+// Record packages in package.json so the app stays installable even if the live
+// `npm install` below is offline/interrupted. Always call this BEFORE npm install.
+function recordDeps(names, dev = false) {
+  try {
+    const pkgPath = path.join(process.cwd(), 'package.json');
+    if (!fs.existsSync(pkgPath)) return;
+    const list = Array.isArray(names) ? names : [names];
+    const { content, changed } = addDepsToPackageJson(fs.readFileSync(pkgPath, 'utf8'), list, { dev });
+    if (changed) fs.writeFileSync(pkgPath, content, 'utf8');
+  } catch {}
+}
+
+// Record deps then run npm install (best-effort). Replaces bare execAsync('npm install …').
+async function installDeps(names, { dev = false } = {}) {
+  const list = (Array.isArray(names) ? names : [names]).filter(Boolean);
+  if (list.length === 0) return;
+  recordDeps(list, dev);
+  try { await execAsync(`npm install ${dev ? '-D ' : ''}${list.join(' ')}`, { cwd: process.cwd() }); } catch {}
+}
+
 // ---------------------------------------------------------------------------
 // GET /api/status
 // ---------------------------------------------------------------------------
@@ -1288,19 +1178,392 @@ router.get('/api/status', (req, res) => {
     const websocketConfigured = indexContent.includes('setupWebSocket') || indexContent.includes('WebSocketServer') || indexContent.includes("from 'ws'");
     const serialportConfigured = indexContent.includes('SerialPort') || indexContent.includes("from 'serialport'");
 
+    const mwExists = (f) => fs.existsSync(path.join(process.cwd(), 'src', 'middleware', f));
+    const security = {
+      helmet: indexContent.includes("from 'helmet'") || indexContent.includes('app.use(helmet'),
+      rateLimit: indexContent.includes("from 'express-rate-limit'") || indexContent.includes('rateLimit('),
+      errorHandler: mwExists('errorHandler.js'),
+      roles: mwExists('roles.js'),
+      apiKey: mwExists('apiKey.js'),
+      validation: mwExists('validate.js'),
+    };
+
+    // Folder name, sanitized into a valid default database name (Mongo db names
+    // can't contain / \ . " $ * < > : | ? or spaces).
+    const appName = (path.basename(process.cwd()) || 'app')
+      .replace(/[^a-zA-Z0-9_-]/g, '-').replace(/-+/g, '-').replace(/^-|-$/g, '').toLowerCase() || 'app';
+
     res.json({
+      appName,
       mongoConfigured,
       routesDirExists,
       authMiddlewareExists,
       socketConfigured,
       websocketConfigured,
-      serialportConfigured
+      serialportConfigured,
+      security,
+      aiConfigured: !!getActiveAiKey(),
+      jobsConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'jobs', 'scheduler.js')),
+      docsConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'docs.js')),
+      deployConfigured: fs.existsSync(path.join(process.cwd(), 'Dockerfile')),
+      mailConfigured: fs.existsSync(path.join(process.cwd(), 'src', 'services', 'mailer.js')),
+      testsConfigured: fs.existsSync(path.join(process.cwd(), 'vitest.config.js'))
     });
   } catch (err) {
     res.status(500).json({ error: err.message });
   }
 });
 
+// ---------------------------------------------------------------------------
+// API Key management — named keys + metadata in src/api-keys.json. This file
+// ships with the app (unlike .4bnode), and the apiKey middleware reads it live,
+// so generate/revoke take effect without a restart. Writing a .json file is not
+// watched by nodemon, so no restart is triggered here either.
+// ---------------------------------------------------------------------------
+function apiKeysFilePath() {
+  return path.join(process.cwd(), 'src', 'api-keys.json');
+}
+function readApiKeys() {
+  try {
+    const p = apiKeysFilePath();
+    if (fs.existsSync(p)) {
+      const list = JSON.parse(fs.readFileSync(p, 'utf8'));
+      if (Array.isArray(list)) return list;
+    }
+  } catch {}
+  return [];
+}
+function writeApiKeys(list) {
+  const p = apiKeysFilePath();
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, JSON.stringify(list, null, 2) + '\n', 'utf8');
+}
+function genApiKey(label) {
+  return {
+    id: crypto.randomBytes(8).toString('hex'),
+    label: (String(label || '').trim() || 'Untitled').slice(0, 60),
+    key: 'sk_' + crypto.randomBytes(24).toString('hex'),
+    createdAt: new Date().toISOString(),
+  };
+}
+
+// GET/POST rate-limit config — stored in .env (read by index.js at startup).
+router.get('/api/security/rate-limit', (req, res) => {
+  try {
+    const envPath = path.join(process.cwd(), '.env');
+    const windowMs = Number(getEnvValue(envPath, 'RATE_LIMIT_WINDOW_MS')) || 15 * 60 * 1000;
+    const max = Number(getEnvValue(envPath, 'RATE_LIMIT_MAX')) || 100;
+    res.json({ windowMinutes: Math.max(1, Math.round(windowMs / 60000)), max });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+router.post('/api/security/rate-limit', (req, res) => {
+  try {
+    const envPath = path.join(process.cwd(), '.env');
+    const windowMinutes = Math.max(1, Math.min(1440, Number(req.body && req.body.windowMinutes) || 15));
+    const max = Math.max(1, Math.min(1000000, Number(req.body && req.body.max) || 100));
+    updateEnvFile(envPath, 'RATE_LIMIT_WINDOW_MS', String(windowMinutes * 60000));
+    updateEnvFile(envPath, 'RATE_LIMIT_MAX', String(max));
+    res.json({ message: 'Rate limit updated.', windowMinutes, max });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// GET — list keys + whether the apiKey middleware is configured
+router.get('/api/security/api-keys', (req, res) => {
+  try {
+    const configured = fs.existsSync(path.join(process.cwd(), 'src', 'middleware', 'apiKey.js'));
+    res.json({ configured, keys: readApiKeys() });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST — generate a new named key
+router.post('/api/security/api-keys', (req, res) => {
+  try {
+    const list = readApiKeys();
+    const key = genApiKey(req.body && req.body.label);
+    list.push(key);
+    writeApiKeys(list);
+    res.json({ message: 'API key generated.', key });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// PATCH — rename a key
+router.patch('/api/security/api-keys/:id', (req, res) => {
+  try {
+    const list = readApiKeys();
+    const key = list.find((k) => k.id === req.params.id);
+    if (!key) return res.status(404).json({ error: 'Key not found.' });
+    key.label = (String((req.body && req.body.label) || '').trim() || key.label).slice(0, 60);
+    writeApiKeys(list);
+    res.json({ message: 'API key renamed.', key });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// DELETE — revoke a key
+router.delete('/api/security/api-keys/:id', (req, res) => {
+  try {
+    const before = readApiKeys();
+    const after = before.filter((k) => k.id !== req.params.id);
+    if (after.length === before.length) return res.status(404).json({ error: 'Key not found.' });
+    writeApiKeys(after);
+    res.json({ message: 'API key revoked.' });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// AI Builder — describe a backend in English, generate models + CRUD routes
+// ---------------------------------------------------------------------------
+// Currently selected provider (AI_PROVIDER in .env), validated against AI_PROVIDERS.
+function getAiProvider() {
+  const fromFile = getEnvValue(path.join(process.cwd(), '.env'), 'AI_PROVIDER');
+  const id = (fromFile && fromFile.trim()) || (process.env.AI_PROVIDER && process.env.AI_PROVIDER.trim()) || DEFAULT_AI_PROVIDER;
+  return AI_PROVIDERS[id] ? id : DEFAULT_AI_PROVIDER;
+}
+
+function getProviderKey(providerId) {
+  const provider = AI_PROVIDERS[providerId];
+  if (!provider) return '';
+  const fromEnv = process.env[provider.keyEnv];
+  if (fromEnv && fromEnv.trim()) return fromEnv.trim();
+  return getEnvValue(path.join(process.cwd(), '.env'), provider.keyEnv);
+}
+
+// Active provider's API key (used by the plan endpoint).
+function getActiveAiKey() {
+  return getProviderKey(getAiProvider());
+}
+
+// Effective model: explicit AI_MODEL override, else the active provider's default.
+function getAiModel(providerId) {
+  const fromFile = getEnvValue(path.join(process.cwd(), '.env'), 'AI_MODEL');
+  const override = (fromFile && fromFile.trim()) || (process.env.AI_MODEL && process.env.AI_MODEL.trim());
+  return override || AI_PROVIDERS[providerId].defaultModel;
+}
+
+// Fields for a route's model — from the plan if present, else from an existing model on disk.
+function fieldsForModel(modelName, plan) {
+  const inPlan = (plan.models || []).find((m) => m.name === modelName);
+  if (inPlan) return inPlan.fields.map((f) => f.name);
+  return getModelSchema(modelName);
+}
+
+// ── OpenAI: chat completions with a forced function call ──
+async function callOpenAIPlan(prompt, model, apiKey) {
+  const resp = await fetch('https://api.openai.com/v1/chat/completions', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
+    body: JSON.stringify({
+      model,
+      messages: [
+        { role: 'system', content: AI_SYSTEM_PROMPT },
+        { role: 'user', content: prompt },
+      ],
+      tools: [{ type: 'function', function: { name: 'emit_plan', description: 'Emit the backend plan to generate.', parameters: AI_PLAN_SCHEMA } }],
+      tool_choice: { type: 'function', function: { name: 'emit_plan' } },
+    }),
+  });
+  let data;
+  try { data = await resp.json(); } catch { data = null; }
+  if (!resp.ok) {
+    const e = new Error((data && data.error && data.error.message) || `OpenAI API error (${resp.status})`);
+    e.status = resp.status === 401 ? 401 : 502;
+    throw e;
+  }
+  const toolCall = data?.choices?.[0]?.message?.tool_calls?.[0];
+  if (!toolCall?.function?.arguments) throw new Error('The model did not return a structured plan. Try rephrasing.');
+  try { return JSON.parse(toolCall.function.arguments); }
+  catch { throw new Error('The model returned an unparseable plan. Try again.'); }
+}
+
+// ── Anthropic: messages with a forced tool call ──
+async function callAnthropicPlan(prompt, model, apiKey) {
+  const resp = await fetch('https://api.anthropic.com/v1/messages', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' },
+    body: JSON.stringify({
+      model,
+      max_tokens: 4096,
+      system: AI_SYSTEM_PROMPT,
+      tools: [{ name: 'emit_plan', description: 'Emit the backend plan to generate.', input_schema: AI_PLAN_SCHEMA }],
+      tool_choice: { type: 'tool', name: 'emit_plan' },
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+  let data;
+  try { data = await resp.json(); } catch { data = null; }
+  if (!resp.ok) {
+    const e = new Error((data && data.error && data.error.message) || `Anthropic API error (${resp.status})`);
+    e.status = resp.status === 401 ? 401 : 502;
+    throw e;
+  }
+  const toolUse = Array.isArray(data.content) ? data.content.find((c) => c.type === 'tool_use') : null;
+  if (!toolUse) throw new Error('The model did not return a structured plan. Try rephrasing.');
+  return toolUse.input;
+}
+
+// Dispatch a plan request to the active provider.
+async function callAiPlan(prompt) {
+  const providerId = getAiProvider();
+  const apiKey = getProviderKey(providerId);
+  if (!apiKey) {
+    const e = new Error(`No ${AI_PROVIDERS[providerId].label} API key configured. Add it in AI Builder settings.`);
+    e.status = 400;
+    throw e;
+  }
+  const model = getAiModel(providerId);
+  return providerId === 'anthropic'
+    ? callAnthropicPlan(prompt, model, apiKey)
+    : callOpenAIPlan(prompt, model, apiKey);
+}
+
+// GET /api/ai/config — active provider, effective model, and per-provider status
+router.get('/api/ai/config', (req, res) => {
+  try {
+    const provider = getAiProvider();
+    const providers = Object.values(AI_PROVIDERS).map((p) => ({
+      id: p.id,
+      label: p.label,
+      keyPlaceholder: p.keyPlaceholder,
+      keysUrl: p.keysUrl,
+      defaultModel: p.defaultModel,
+      configured: !!getProviderKey(p.id),
+    }));
+    res.json({ provider, model: getAiModel(provider), providers });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/ai/key — save a provider's API key and make it the active provider
+router.post('/api/ai/key', (req, res) => {
+  try {
+    const providerId = (req.body && req.body.provider ? String(req.body.provider) : '').trim();
+    const key = (req.body && req.body.key ? String(req.body.key) : '').trim();
+    const provider = AI_PROVIDERS[providerId];
+    if (!provider) return res.status(400).json({ error: 'Unknown provider.' });
+    if (!key) return res.status(400).json({ error: 'API key is required.' });
+
+    const envPath = path.join(process.cwd(), '.env');
+    updateEnvFile(envPath, provider.keyEnv, key);
+    updateEnvFile(envPath, 'AI_PROVIDER', providerId);
+    process.env[provider.keyEnv] = key; // usable immediately, no restart
+    process.env.AI_PROVIDER = providerId;
+    res.json({ message: `${provider.label} key saved and selected.`, provider: providerId });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/ai/provider — switch the active provider (key must already exist)
+router.post('/api/ai/provider', (req, res) => {
+  try {
+    const providerId = (req.body && req.body.provider ? String(req.body.provider) : '').trim();
+    const provider = AI_PROVIDERS[providerId];
+    if (!provider) return res.status(400).json({ error: 'Unknown provider.' });
+    if (!getProviderKey(providerId)) {
+      return res.status(400).json({ error: `Add a ${provider.label} key first.` });
+    }
+    updateEnvFile(path.join(process.cwd(), '.env'), 'AI_PROVIDER', providerId);
+    process.env.AI_PROVIDER = providerId;
+    res.json({ message: `Switched to ${provider.label}.`, provider: providerId });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// POST /api/ai/plan — turn a prompt into a normalized plan + code previews
+router.post('/api/ai/plan', async (req, res) => {
+  try {
+    const prompt = (req.body && req.body.prompt ? String(req.body.prompt) : '').trim();
+    if (!prompt) return res.status(400).json({ error: 'Describe what you want to build.' });
+
+    const raw = await callAiPlan(prompt);
+    const plan = normalizeAiPlan(raw);
+    if (plan.models.length === 0 && plan.routes.length === 0) {
+      return res.status(422).json({ error: 'Could not derive a buildable plan. Try being more specific.' });
+    }
+
+    const preview = {
+      summary: plan.summary,
+      models: plan.models.map((m) => ({
+        name: m.name,
+        fields: m.fields,
+        code: generateMongooseModel(toPascalCase(m.name), m.fields),
+      })),
+      routes: plan.routes.map((r) => ({
+        name: r.name,
+        model: r.model,
+        operations: r.operations,
+        code: buildCrudRouteFile(r.name, r.model, fieldsForModel(r.model, plan), r.operations),
+      })),
+    };
+    res.json({ plan, preview });
+  } catch (err) {
+    res.status(err.status || 500).json({ error: err.message });
+  }
+});
+
+// POST /api/ai/apply — generate the model + route files from an approved plan
+router.post('/api/ai/apply', async (req, res) => {
+  try {
+    const plan = normalizeAiPlan(req.body && req.body.plan ? req.body.plan : {});
+    if (plan.models.length === 0 && plan.routes.length === 0) {
+      return res.status(400).json({ error: 'Empty plan.' });
+    }
+    if (!checkMongoConfig()) {
+      return res.status(400).json({ error: 'Configure MongoDB before generating models.' });
+    }
+
+    const created = { models: [], routes: [], skipped: [] };
+
+    const modelsDir = path.join(process.cwd(), 'src', 'models');
+    fs.mkdirSync(modelsDir, { recursive: true });
+    for (const m of plan.models) {
+      const file = path.join(modelsDir, m.name + '.js');
+      if (fs.existsSync(file)) { created.skipped.push('model:' + m.name); continue; }
+      fs.writeFileSync(file, generateMongooseModel(toPascalCase(m.name), m.fields), 'utf8');
+      created.models.push(m.name);
+    }
+
+    const routesDir = path.join(process.cwd(), 'src', 'routes');
+    fs.mkdirSync(routesDir, { recursive: true });
+    for (const r of plan.routes) {
+      const file = path.join(routesDir, r.name + '.js');
+      if (fs.existsSync(file)) { created.skipped.push('route:' + r.name); continue; }
+      const fields = fieldsForModel(r.model, plan);
+      fs.writeFileSync(file, buildCrudRouteFile(r.name, r.model, fields, r.operations), 'utf8');
+      created.routes.push(r.name);
+      const camel = toCamelCase(r.name);
+      addImportToIndex(`import ${camel}Router from './src/routes/${r.name}.js';`);
+      const reg = `app.use('/api/${r.name}', ${camel}Router);`;
+      if (!readIndexFile().includes(reg)) insertBeforeListen(reg);
+    }
+
+    const anyPassword = plan.routes.some((r) => fieldsForModel(r.model, plan).includes('password'));
+    if (anyPassword) {
+      await installDeps(['bcrypt']);
+    }
+
+    res.json({
+      message: `Generated ${created.models.length} model(s) and ${created.routes.length} route(s).`,
+      ...created,
+    });
+  } catch (err) {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // POST /api/add-api
 // ---------------------------------------------------------------------------
@@ -1334,6 +1597,7 @@ router.post('/api/add-api', async (req, res) => {
     const needsMulter = allFieldsCombined.some(f => f.type === 'File');
     if (needsMulter) packagesToInstall.push('multer');
     if (packagesToInstall.length > 0) {
+      recordDeps(packagesToInstall);
       await execAsync(`npm install ${packagesToInstall.join(' ')}`, { cwd: process.cwd() });
     }
 
@@ -1645,12 +1909,27 @@ router.post('/', async (req, res) => {
       }
     }
 
-    const content = `${imports}
+    let content = `${imports}
 const router = express.Router();
 ${handlers}
 export default router;
 `;
 
+    // Per-route validation: generate a Zod schema from the fields THIS route
+    // accepts (not the whole model — one model is used by many routes, each with a
+    // different subset of fields). Named after the route (e.g. login → loginSchema),
+    // it's wired into the route's write endpoints. File fields are skipped (they're
+    // not in req.body). Types come from the model where known.
+    const validatorFields = routeValidatorFields(type, {
+      findField, passwordField, hasPassword, registerFields, allFieldsCombined, modelName,
+    });
+    if (validatorFields && validatorFields.length) {
+      const validatorsDir = path.join(process.cwd(), 'src', 'validators');
+      fs.mkdirSync(validatorsDir, { recursive: true });
+      fs.writeFileSync(path.join(validatorsDir, safeName + '.js'), buildZodSchemaFile(safeName, validatorFields), 'utf8');
+      content = wireValidateIntoRouteContent(content, safeName);
+    }
+
     fs.writeFileSync(routeFilePath, content, 'utf8');
 
     const label = type === 'methods' ? methodList.map(m => m.toUpperCase()).join(', ') : type === 'crud' ? 'CRUD (' + (methodList.length > 0 ? methodList.map(m => m.toUpperCase()).join(', ') : 'ALL') + ')' : type === 'plain' ? 'PLAIN' : type.toUpperCase();
@@ -1683,6 +1962,7 @@ export default router;
     if (!indexContent.includes(routeRegistration)) {
       insertBeforeListen(routeRegistration);
     }
+    refreshDocsSpec();
   } catch (err) {
     if (!res.headersSent) res.status(500).json({ error: err.message });
   }
@@ -1712,6 +1992,7 @@ router.post('/api/add-mongo', async (req, res) => {
     }
 
     // First-time setup: install mongoose, create db.js, modify index.js
+    recordDeps(['mongoose']);
     await execAsync('npm install mongoose', { cwd: process.cwd() });
 
     const dbDir = path.join(process.cwd(), 'src');
@@ -1768,6 +2049,7 @@ router.post('/api/add-login', async (req, res) => {
 
     // Install packages FIRST before modifying files
     const packages = hasPassword ? 'jsonwebtoken bcrypt' : 'jsonwebtoken';
+    recordDeps(String(packages).split(/\s+/).filter(Boolean));
     await execAsync(`npm install ${packages}`, { cwd: process.cwd() });
 
     // Create src/middleware/auth.js if it doesn't exist
@@ -1919,6 +2201,7 @@ router.post('/api/add-socket', async (req, res) => {
     const currentContent = readIndexFile();
     const hasWebSocket = currentContent.includes('setupWebSocket') || currentContent.includes('WebSocketServer');
 
+    recordDeps(['socket.io']);
     if (hasWebSocket) {
       try { await execAsync('npm uninstall ws && npm install socket.io', { cwd: process.cwd() }); } catch {
         try { await execAsync('npm install socket.io', { cwd: process.cwd() }); } catch {}
@@ -2035,6 +2318,7 @@ router.post('/api/add-websocket', async (req, res) => {
     const currentContent = readIndexFile();
     const hasSocketIO = currentContent.includes('setupSocketIO') || currentContent.includes('socket.io');
 
+    recordDeps(['ws']);
     if (hasSocketIO) {
       try { await execAsync('npm uninstall socket.io && npm install ws', { cwd: process.cwd() }); } catch {
         try { await execAsync('npm install ws', { cwd: process.cwd() }); } catch {}
@@ -2186,6 +2470,7 @@ router.post('/api/add-serialport', async (req, res) => {
     // Install FIRST before modifying index.js
     const indexContent = readIndexFile();
     if (!indexContent.includes("from 'serialport'")) {
+      recordDeps(['serialport', '@serialport/parser-readline']);
       await execAsync('npm install serialport @serialport/parser-readline', { cwd: process.cwd() });
     }
 
@@ -2450,23 +2735,13 @@ router.get('/api/api-tester/routes', (req, res) => {
         const bodyFields = [];
         const queryFields = [];
         const fileFields = [];
-        const bodyMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.body/);
-        if (bodyMatch) {
-          bodyMatch[1].split(',').forEach(f => {
-            const fname = f.trim();
-            if (fname) {
-              const meta = modelFields.find(mf => mf.name === fname);
-              bodyFields.push({ name: fname, type: meta?.type || 'String', required: meta?.required || false, unique: meta?.unique || false });
-            }
-          });
-        }
-        const queryMatch = body.match(/const\s*\{\s*([^}]+)\}\s*=\s*req\.query/);
-        if (queryMatch) {
-          queryMatch[1].split(',').forEach(f => {
-            const fname = f.trim();
-            if (fname) queryFields.push({ name: fname, type: 'String' });
-          });
-        }
+        extractRequestFields(body, 'body').forEach(fname => {
+          const meta = modelFields.find(mf => mf.name === fname);
+          bodyFields.push({ name: fname, type: meta?.type || 'String', required: meta?.required || false, unique: meta?.unique || false });
+        });
+        extractRequestFields(body, 'query').forEach(fname => {
+          queryFields.push({ name: fname, type: 'String' });
+        });
         // Detect file fields from multer middleware and req.file/req.files
         const uploadSingleMatch = body.match(/upload\.single\(\s*['"](\w+)['"]\s*\)/);
         if (uploadSingleMatch) fileFields.push({ name: uploadSingleMatch[1] });
@@ -2513,381 +2788,6 @@ router.get('/api/api-tester/routes', (req, res) => {
   }
 });
 
-// ---------------------------------------------------------------------------
-// Reports — schema info & Excel generation
-// ---------------------------------------------------------------------------
-router.get('/api/reports/schema-info', (req, res) => {
-  try {
-    const modelFiles = listModels();
-    const models = modelFiles.map(f => {
-      const name = path.basename(f, '.js');
-      const detail = getModelSchemaDetailed(name);
-      const fields = Array.isArray(detail) ? detail : detail.fields;
-      return { name, fields: fields.map(field => {
-        const result = { ...field };
-        if (field.type === 'ObjectId' && field.ref) {
-          const refDetail = getModelSchemaDetailed(field.ref);
-          const refFields = Array.isArray(refDetail) ? refDetail : refDetail.fields;
-          result.refFields = refFields.map(rf => rf.name);
-        }
-        return result;
-      })};
-    });
-    res.json({ models });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-// Date formatting helper
-function formatDateValue(val, format, tz) {
-  if (!(val instanceof Date)) {
-    try { val = new Date(val); } catch { return String(val); }
-    if (isNaN(val.getTime())) return String(val);
-  }
-  if (format === 'ISO') return val.toISOString();
-  if (format === 'UNIX') return Math.floor(val.getTime() / 1000);
-  const isAmPm = format.includes(' A');
-  const opts = { timeZone: tz || 'UTC', hour12: isAmPm };
-  const parts = {};
-  try {
-    const fmt = new Intl.DateTimeFormat('en-US', { ...opts, year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', second: '2-digit' });
-    fmt.formatToParts(val).forEach(p => { parts[p.type] = p.value; });
-  } catch { return val.toISOString(); }
-  const Y = parts.year, M = parts.month, D = parts.day;
-  const H = parts.hour, m = parts.minute, s = parts.second;
-  const ampm = parts.dayPeriod || '';
-  const time = isAmPm ? `${H}:${m}:${s} ${ampm}` : `${H}:${m}:${s}`;
-  // Normalize hour for 24h (en-US with hour12:false gives "24" for midnight, fix to "00")
-  const H24 = !isAmPm && H === '24' ? '00' : H;
-  const time24 = `${H24}:${m}:${s}`;
-  switch (format) {
-    case 'YYYY-MM-DD HH:mm:ss': return `${Y}-${M}-${D} ${time24}`;
-    case 'DD/MM/YYYY HH:mm:ss': return `${D}/${M}/${Y} ${time24}`;
-    case 'MM/DD/YYYY HH:mm:ss': return `${M}/${D}/${Y} ${time24}`;
-    case 'YYYY-MM-DD hh:mm:ss A': return `${Y}-${M}-${D} ${time}`;
-    case 'DD/MM/YYYY hh:mm:ss A': return `${D}/${M}/${Y} ${time}`;
-    case 'MM/DD/YYYY hh:mm:ss A': return `${M}/${D}/${Y} ${time}`;
-    case 'YYYY-MM-DD': return `${Y}-${M}-${D}`;
-    case 'DD/MM/YYYY': return `${D}/${M}/${Y}`;
-    case 'MM/DD/YYYY': return `${M}/${D}/${Y}`;
-    default: return `${Y}-${M}-${D} ${time24}`;
-  }
-}
-
-function formatVal(val, dateFormat, timezone) {
-  if (val === null || val === undefined) return null;
-  // Native Date
-  if (val instanceof Date) return formatDateValue(val, dateFormat, timezone);
-  // String that looks like ISO date
-  if (typeof val === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(val)) return formatDateValue(val, dateFormat, timezone);
-  // Non-null objects (BSON types from MongoDB driver)
-  if (typeof val === 'object') {
-    const str = val.toString();
-    // BSON Date — toString gives a date string, or has getTime
-    if (typeof val.getTime === 'function') return formatDateValue(new Date(val.getTime()), dateFormat, timezone);
-    // ObjectId or other BSON — toString gives hex string
-    if (str && str !== '[object Object]') return str;
-    return JSON.stringify(val);
-  }
-  return val;
-}
-
-router.post('/api/reports/preview', async (req, res) => {
-  try {
-    const { name, fields = [], systemFields = [], populatedFields = {}, dateFormat = 'YYYY-MM-DD HH:mm:ss', timezone = 'UTC', fieldPrefixes = {} } = req.body;
-    if (!name) return res.status(400).json({ error: 'Model name required' });
-
-    const projectMongoose = path.join(process.cwd(), 'node_modules', 'mongoose', 'index.js');
-    if (!fs.existsSync(projectMongoose)) return res.status(400).json({ error: 'Mongoose not installed.' });
-    const mongoose = (await import(pathToFileURL(projectMongoose).href)).default;
-    if (mongoose.connection.readyState === 0) {
-      const uri = getEnvValue(path.join(process.cwd(), '.env'), 'MONGO_URI');
-      if (!uri) return res.status(400).json({ error: 'MONGO_URI not configured.' });
-      await mongoose.connect(uri);
-    }
-
-    const collection = mongoose.connection.db.collection(name + 's');
-    const rawDocs = await collection.find({}).limit(10).toArray();
-    // Convert BSON to plain JSON objects for reliable field access
-    const docs = JSON.parse(JSON.stringify(rawDocs));
-
-    // Populate referenced fields
-    const lookups = {};
-    for (const [refField, subFields] of Object.entries(populatedFields)) {
-      if (!subFields || subFields.length === 0) continue;
-      const detail = getModelSchemaDetailed(name);
-      const schemaFields = detail.fields || [];
-      const fieldDef = schemaFields.find(f => f.name === refField);
-      if (!fieldDef || !fieldDef.ref) continue;
-      const ids = [...new Set(docs.map(d => d[refField]).filter(Boolean).map(id => typeof id === 'object' ? (id.$oid || id.toString()) : String(id)))];
-      if (ids.length === 0) continue;
-      const { ObjectId } = mongoose.Types;
-      const rawRefDocs = await mongoose.connection.db.collection(fieldDef.ref + 's')
-        .find({ _id: { $in: ids.map(id => { try { return new ObjectId(id); } catch { return id; } }) } }).toArray();
-      const refDocs = JSON.parse(JSON.stringify(rawRefDocs));
-      const map = {};
-      for (const rd of refDocs) {
-        const rdId = typeof rd._id === 'object' ? (rd._id.$oid || rd._id) : rd._id;
-        map[String(rdId)] = rd;
-      }
-      lookups[refField] = { subFields, map };
-    }
-
-    function applyPrefix(key, val) {
-      if (val === null || val === undefined) return val;
-      const prefix = fieldPrefixes[key];
-      return prefix ? prefix + val : val;
-    }
-
-    const rows = docs.map(doc => {
-      const row = {};
-      // System fields first
-      for (const sf of systemFields) {
-        let val = doc[sf];
-        if (val && typeof val === 'object' && val.$oid) val = val.$oid;
-        if (val && typeof val === 'object' && val.$date) val = val.$date;
-        row[sf] = applyPrefix(sf, formatVal(val, dateFormat, timezone));
-      }
-      // Model fields
-      for (const f of fields) {
-        let val = doc[f];
-        if (val && typeof val === 'object' && val.$oid) val = val.$oid;
-        if (val && typeof val === 'object' && val.$date) val = val.$date;
-        row[f] = applyPrefix(f, formatVal(val, dateFormat, timezone));
-      }
-      // Populated ref fields
-      for (const [refField, { subFields, map }] of Object.entries(lookups)) {
-        let refId = doc[refField];
-        if (refId && typeof refId === 'object' && refId.$oid) refId = refId.$oid;
-        const refDoc = refId ? map[String(refId)] : null;
-        for (const sf of subFields) {
-          const colKey = refField + '.' + sf;
-          let val = refDoc ? refDoc[sf] : null;
-          if (val && typeof val === 'object' && val.$oid) val = val.$oid;
-          if (val && typeof val === 'object' && val.$date) val = val.$date;
-          row[colKey] = applyPrefix(colKey, formatVal(val, dateFormat, timezone));
-        }
-      }
-      return row;
-    });
-
-    // Reorder columns if columnOrder provided
-    const columnOrder = req.body.columnOrder;
-    if (columnOrder && columnOrder.length > 0) {
-      const ordered = rows.map(row => {
-        const r = {};
-        columnOrder.forEach(col => { if (col in row) r[col] = row[col]; });
-        return r;
-      });
-      return res.json({ rows: ordered });
-    }
-    res.json({ rows });
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-router.post('/api/reports/generate', async (req, res) => {
-  try {
-    const { models: reportModels, filename, dateFormat = 'YYYY-MM-DD HH:mm:ss', timezone = 'UTC' } = req.body;
-    if (!reportModels || !reportModels.length) {
-      return res.status(400).json({ error: 'No models selected' });
-    }
-
-    // Try to import xlsx-js-style (supports styling) or fall back to xlsx
-    let XLSX;
-    try {
-      const styledPkg = path.join(process.cwd(), 'node_modules', 'xlsx-js-style');
-      const plainPkg = path.join(process.cwd(), 'node_modules', 'xlsx');
-      if (!fs.existsSync(styledPkg)) {
-        await execAsync('npm install xlsx-js-style', { cwd: process.cwd() });
-      }
-      // Use createRequire for CJS packages
-      const { createRequire } = await import('module');
-      const require = createRequire(process.cwd() + '/');
-      XLSX = fs.existsSync(styledPkg) ? require('xlsx-js-style') : require('xlsx');
-    } catch (e) {
-      return res.status(400).json({ error: 'Failed to load xlsx. Run: npm install xlsx-js-style' });
-    }
-
-    // Connect to MongoDB
-    const projectMongoose = path.join(process.cwd(), 'node_modules', 'mongoose', 'index.js');
-    if (!fs.existsSync(projectMongoose)) {
-      return res.status(400).json({ error: 'Mongoose is not installed.' });
-    }
-    const mongoose = (await import(pathToFileURL(projectMongoose).href)).default;
-    if (mongoose.connection.readyState === 0) {
-      const uri = getEnvValue(path.join(process.cwd(), '.env'), 'MONGO_URI');
-      if (!uri) return res.status(400).json({ error: 'MONGO_URI not configured.' });
-      await mongoose.connect(uri);
-    }
-
-    const wb = XLSX.utils.book_new();
-
-    for (const rm of reportModels) {
-      const collectionName = rm.name + 's';
-      const collection = mongoose.connection.db.collection(collectionName);
-      const rowLimit = req.body.limit > 0 ? Math.min(req.body.limit, 50000) : 10000;
-      const rawDocs = await collection.find({}).limit(rowLimit).toArray();
-      const docs = JSON.parse(JSON.stringify(rawDocs));
-
-      // Build lookup maps for populated fields
-      const lookups = {};
-      if (rm.populatedFields) {
-        for (const [refField, subFields] of Object.entries(rm.populatedFields)) {
-          if (!subFields || subFields.length === 0) continue;
-          const detail = getModelSchemaDetailed(rm.name);
-          const schemaFields = detail.fields || [];
-          const fieldDef = schemaFields.find(f => f.name === refField);
-          if (!fieldDef || !fieldDef.ref) continue;
-
-          const ids = [...new Set(docs.map(d => d[refField]).filter(Boolean).map(id => typeof id === 'object' ? (id.$oid || id) : String(id)))];
-          if (ids.length === 0) continue;
-
-          const { ObjectId } = mongoose.Types;
-          const rawRefDocs = await mongoose.connection.db.collection(fieldDef.ref + 's')
-            .find({ _id: { $in: ids.map(id => { try { return new ObjectId(id); } catch { return id; } }) } }).toArray();
-          const refDocs = JSON.parse(JSON.stringify(rawRefDocs));
-
-          const map = {};
-          for (const rd of refDocs) {
-            const rdId = typeof rd._id === 'object' ? (rd._id.$oid || rd._id) : rd._id;
-            map[String(rdId)] = rd;
-          }
-          lookups[refField] = { subFields, map };
-        }
-      }
-
-      // Build rows
-      const sysFields = rm.systemFields || [];
-      const rmPrefixes = rm.fieldPrefixes || {};
-      function applyRmPrefix(key, val) {
-        if (val === null || val === undefined || val === '') return val;
-        const prefix = rmPrefixes[key];
-        return prefix ? prefix + val : val;
-      }
-      const rows = docs.map(doc => {
-        const row = {};
-        // System fields first
-        for (const sf of sysFields) {
-          let val = doc[sf];
-          if (val && typeof val === 'object' && val.$oid) val = val.$oid;
-          if (val && typeof val === 'object' && val.$date) val = val.$date;
-          const fv = formatVal(val, dateFormat, timezone);
-          row[sf] = applyRmPrefix(sf, fv === null ? '' : fv);
-        }
-        // Model fields
-        for (const field of rm.fields) {
-          let val = doc[field];
-          if (val && typeof val === 'object' && val.$oid) val = val.$oid;
-          if (val && typeof val === 'object' && val.$date) val = val.$date;
-          const fv = formatVal(val, dateFormat, timezone);
-          row[field] = applyRmPrefix(field, fv === null ? '' : fv);
-        }
-        // Populated ref fields
-        for (const [refField, { subFields, map }] of Object.entries(lookups)) {
-          let refId = doc[refField];
-          if (refId && typeof refId === 'object' && refId.$oid) refId = refId.$oid;
-          const refDoc = refId ? map[String(refId)] : null;
-          for (const sf of subFields) {
-            const colKey = refField + '.' + sf;
-            let val = refDoc ? refDoc[sf] : null;
-            if (val && typeof val === 'object' && val.$oid) val = val.$oid;
-            if (val && typeof val === 'object' && val.$date) val = val.$date;
-            const fv = formatVal(val, dateFormat, timezone);
-            row[colKey] = applyRmPrefix(colKey, fv === null ? '' : fv);
-          }
-        }
-        return row;
-      });
-
-      // Reorder columns if columnOrder provided
-      const colOrder = rm.columnOrder;
-      const headerLabels = rm.headerLabels || {};
-      let finalRows = rows;
-      if (colOrder && colOrder.length > 0) {
-        finalRows = rows.map(row => {
-          const r = {};
-          colOrder.forEach(col => {
-            const label = headerLabels[col] || col;
-            if (col in row) r[label] = row[col];
-          });
-          return r;
-        });
-      } else if (Object.keys(headerLabels).length > 0) {
-        finalRows = rows.map(row => {
-          const r = {};
-          Object.keys(row).forEach(col => {
-            const label = headerLabels[col] || col;
-            r[label] = row[col];
-          });
-          return r;
-        });
-      }
-
-      // Build headers with custom labels
-      const rawHeaders = colOrder && colOrder.length > 0 ? colOrder : Object.keys(rows[0] || {});
-      const displayHeaders = rawHeaders.map(h => headerLabels[h] || h);
-
-      // Create worksheet with explicit column order
-      const ws = XLSX.utils.json_to_sheet(finalRows, { header: displayHeaders });
-
-      // Professional styling
-      const range = XLSX.utils.decode_range(ws['!ref'] || 'A1');
-      // Style header row — bold with background
-      const thinBorder = { style: "thin", color: { rgb: "B4C6E7" } };
-      const allBorders = { top: thinBorder, bottom: thinBorder, left: thinBorder, right: thinBorder };
-      const headerBorder = { top: { style: "thin", color: { rgb: "2F5597" } }, bottom: { style: "thin", color: { rgb: "2F5597" } }, left: { style: "thin", color: { rgb: "2F5597" } }, right: { style: "thin", color: { rgb: "2F5597" } } };
-      // Style header row
-      for (let C = range.s.c; C <= range.e.c; C++) {
-        const addr = XLSX.utils.encode_cell({ r: 0, c: C });
-        if (!ws[addr]) continue;
-        ws[addr].s = {
-          font: { bold: true, color: { rgb: "FFFFFF" }, sz: 12, name: "Calibri" },
-          fill: { fgColor: { rgb: "4472C4" } },
-          alignment: { horizontal: "center", vertical: "center" },
-          border: headerBorder,
-        };
-      }
-      // Alternate row colors with full borders
-      for (let R = 1; R <= range.e.r; R++) {
-        const isEven = R % 2 === 0;
-        for (let C = range.s.c; C <= range.e.c; C++) {
-          const addr = XLSX.utils.encode_cell({ r: R, c: C });
-          if (!ws[addr]) ws[addr] = { v: '', t: 's' };
-          ws[addr].s = {
-            fill: isEven ? { fgColor: { rgb: "D6E4F0" } } : { fgColor: { rgb: "FFFFFF" } },
-            font: { sz: 11, color: { rgb: "333333" }, name: "Calibri" },
-            alignment: { vertical: "center" },
-            border: allBorders,
-          };
-        }
-      }
-      // Column widths with breathing room
-      ws['!cols'] = displayHeaders.map((key, i) => {
-        const rawKey = rawHeaders[i];
-        const maxLen = Math.max(key.length, ...finalRows.map(r => String(r[key] || '').length).slice(0, 100));
-        return { wch: maxLen + 4 };
-      });
-      // Row heights — uniform for all rows
-      const totalRows = range.e.r + 1;
-      ws['!rows'] = Array.from({ length: totalRows }, () => ({ hpt: 26 }));
-
-      const sheetName = rm.name.length > 31 ? rm.name.slice(0, 31) : rm.name;
-      XLSX.utils.book_append_sheet(wb, ws, sheetName);
-    }
-
-    const buf = XLSX.write(wb, { type: 'buffer', bookType: 'xlsx' });
-    const fname = (filename || 'report') + '.xlsx';
-    res.setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
-    res.setHeader('Content-Disposition', 'attachment; filename="' + fname + '"');
-    res.send(Buffer.from(buf));
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
 // ---------------------------------------------------------------------------
 // Logs — history, SSE stream, clear
 // ---------------------------------------------------------------------------
@@ -2899,8 +2799,14 @@ router.get('/api/logs/stream', (req, res) => {
   // EventSource can't send custom headers, so verify passkey from query param
   const stored = getPasskeyHash();
   if (stored) {
+    const lock = authLockState(req);
+    if (lock.locked) {
+      res.set('Retry-After', String(lock.retryAfter));
+      return res.status(429).json({ error: 'Too many attempts. Try again later.' });
+    }
     const pk = req.query.passkey;
-    if (!pk || hashPasskey(pk) !== stored) {
+    if (!verifyPasskey(pk, stored)) {
+      if (pk) recordAuthFailure(req);
       return res.status(401).json({ error: 'Unauthorized' });
     }
   }