evaldoc 1.0.0

package/server.js

@@ -0,0 +1,3864 @@
+// Load environment variables FIRST
+require('dotenv').config();
+
+const express = require('express');
+const cors = require('cors');
+const path = require('path');
+const crypto = require('crypto');
+const QRCode = require('qrcode');
+
+// Shared Firebase Admin initialization
+const { admin, initializeFirebase } = require('./functions/src/firebase-init');
+
+// In test mode, firebase-admin is mocked by Jest — skip real credential loading
+if (process.env.NODE_ENV !== 'test') {
+  try {
+    const credential = process.env.GOOGLE_APPLICATION_CREDENTIALS
+      ? admin.credential.cert(require(process.env.GOOGLE_APPLICATION_CREDENTIALS))
+      : undefined;
+    initializeFirebase({ credential });
+    console.log('Firebase Admin initialized');
+  } catch (err) {
+    console.error('Firebase Admin initialization failed:', err.message);
+    console.log('\nTo fix: download a service account key from Firebase Console');
+    console.log('and set GOOGLE_APPLICATION_CREDENTIALS=./serviceAccountKey.json in .env\n');
+    process.exit(1);
+  }
+}
+
+// Import modules from functions directory
+const { TOPICS, TOPIC_KEYS, inferTopic } = require('./functions/src/topics');
+const {
+  analyzeInput,
+  analyzeOutput,
+  refusalMessage,
+  escalationMessage,
+  redactText
+} = require('./functions/src/safety');
+const { generateResponse } = require('./functions/src/llm');
+const { incrementAnalytics, getMonthKey } = require('./functions/src/analytics');
+const { checkMonthlyLimit } = require('./functions/src/limits');
+const { verifyAuthHeader } = require('./functions/src/auth');
+const {
+  createConnectAccount,
+  createAccountLink,
+  refreshAccountStatus,
+  setProviderPricing,
+  createCheckoutSession,
+  createPaymentIntent,
+  createSubscription,
+  cancelSubscription,
+  checkPaymentAccess,
+  getRevenueAnalytics,
+  handleStripeWebhook
+} = require('./functions/src/payment');
+const { stripe, hasStripeSecretKey } = require('./functions/src/stripe-config');
+const { handlePatientAPI } = require('./functions/src/patient-api');
+
+// Audit logging (HIPAA compliance)
+const { logAuditEvent } = require('./functions/src/audit');
+
+// Organizations & RBAC (multi-provider clinics)
+const orgs = require('./functions/src/orgs');
+
+// Centralized input validation
+const { validate } = require('./functions/src/validate');
+
+// Phase 2: Doctor Async Response Pipeline modules
+const { classifyConversation } = require('./functions/src/triage');
+const { generateDoctorDraft } = require('./functions/src/drafts');
+const {
+  notifyEscalation,
+  notifyDraftReady,
+  getNotifications,
+  getUnreadCount,
+  markNotificationRead,
+  markAllNotificationsRead,
+  generateDailyDigest
+} = require('./functions/src/notifications');
+const {
+  captureDoctorExample,
+  retrieveRelevantExamples,
+  getFeedbackStats
+} = require('./functions/src/feedback');
+
+const app = express();
+// Behind Cloud Run / a proxy, honor X-Forwarded-For so req.ip is the real
+// client (rate limiting keys on it) rather than the proxy address.
+app.set('trust proxy', true);
+const PORT = process.env.PORT || 8080;
+
+// Middleware
+
+// CORS — restrict to known origins; defaults to same-origin only
+const ALLOWED_ORIGINS = process.env.ALLOWED_ORIGINS
+  ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim())
+  : [];
+app.use(cors(ALLOWED_ORIGINS.length > 0
+  ? { origin: ALLOWED_ORIGINS }
+  : { origin: false }
+));
+
+// Security headers
+app.use((req, res, next) => {
+  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'DENY');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+  res.setHeader('Content-Security-Policy', [
+    "default-src 'self'",
+    "script-src 'self' https://js.stripe.com https://www.gstatic.com",
+    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+    "font-src 'self' https://fonts.gstatic.com",
+    "img-src 'self' data: https:",
+    "frame-src https://js.stripe.com",
+    "connect-src 'self' https://api.stripe.com https://firestore.googleapis.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com",
+    "object-src 'none'",
+    "base-uri 'self'"
+  ].join('; '));
+  next();
+});
+
+// Request correlation id — echoed back so client errors can be traced to a
+// specific server log line. Honors an inbound X-Request-Id if present.
+app.use((req, res, next) => {
+  const inbound = req.headers['x-request-id'];
+  req.requestId = (typeof inbound === 'string' && inbound.length <= 64 && /^[\w-]+$/.test(inbound))
+    ? inbound
+    : crypto.randomBytes(8).toString('hex');
+  res.setHeader('X-Request-Id', req.requestId);
+  next();
+});
+
+app.use((req, res, next) => {
+  if (req.path.startsWith('/api/')) {
+    const start = Date.now();
+    res.on('finish', () => {
+      const duration = Date.now() - start;
+      if (duration > 2000) {
+        console.warn(`[SLOW] [${req.requestId}] ${req.method} ${req.path} took ${duration}ms`);
+      }
+    });
+  }
+  next();
+});
+
+// Lightweight in-memory rate limiter (self-contained; accepts both the
+// { maxRequests } and express-rate-limit-style { max, message } option shapes
+// so all call sites work without pulling in an external dependency).
+const rateLimitStore = new Map();
+const RATE_LIMIT_WINDOW_MS = 60 * 1000; // 1 minute
+const RATE_LIMIT_CLEANUP_INTERVAL = 5 * 60 * 1000; // cleanup every 5 min
+
+function rateLimit({ maxRequests, max, windowMs = RATE_LIMIT_WINDOW_MS, message } = {}) {
+  const limit = typeof maxRequests === 'number' ? maxRequests : (typeof max === 'number' ? max : 30);
+  const body = message || { error: 'Too many requests. Please wait and try again.' };
+  return (req, res, next) => {
+    const ip = req.ip || req.connection.remoteAddress || 'unknown';
+    const key = `${ip}:${req.path}`;
+    const now = Date.now();
+    let entry = rateLimitStore.get(key);
+
+    if (!entry || now - entry.windowStart > windowMs) {
+      entry = { windowStart: now, count: 0 };
+    }
+
+    entry.count++;
+    rateLimitStore.set(key, entry);
+
+    if (entry.count > limit) {
+      return res.status(429).json(body);
+    }
+
+    res.setHeader('X-RateLimit-Limit', String(limit));
+    res.setHeader('X-RateLimit-Remaining', String(Math.max(0, limit - entry.count)));
+    next();
+  };
+}
+
+// Periodic cleanup of expired rate limit entries
+if (process.env.NODE_ENV !== 'test') {
+  setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of rateLimitStore) {
+      if (now - entry.windowStart > RATE_LIMIT_WINDOW_MS * 2) {
+        rateLimitStore.delete(key);
+      }
+    }
+  }, RATE_LIMIT_CLEANUP_INTERVAL);
+}
+
+// Rate limiting — public endpoints (config from origin/main, backed by the limiter above)
+const chatLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 12,
+  message: { error: 'Too many requests. Please wait a moment before trying again.' }
+});
+const publicLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 30,
+  message: { error: 'Too many requests. Please try again later.' }
+});
+app.use('/api/chat', chatLimiter);
+app.use('/api/waitlist', publicLimiter);
+app.use('/api/satisfaction', publicLimiter);
+app.use('/api/payment/create-checkout-session', publicLimiter);
+app.use('/api/payment/create-intent', publicLimiter);
+
+// Body parsing — capture the raw body for Stripe webhook signature verification
+// and cap request size.
+app.use(express.json({
+  limit: '100kb',
+  verify: (req, res, buf) => {
+    if (req.originalUrl === '/api/payment/webhook') {
+      req.rawBody = buf;
+    }
+  }
+}));
+app.use(express.urlencoded({ extended: true, limit: '100kb' }));
+
+if (typeof hasStripeSecretKey === 'function' && !hasStripeSecretKey()) {
+  console.warn('[Stripe] STRIPE_SECRET_KEY is not configured. Payment endpoints will fail until it is set.');
+}
+
+// Serve static files from public directory
+app.use(express.static(path.join(__dirname, 'public')));
+
+// Constants
+const HANDLE_REGEX = /^[a-z0-9][a-z0-9-]{2,29}$/;
+const RESERVED_HANDLES = new Set(['app', 'api', 'admin', 'static', 'public', 'functions', 'health']);
+const LAUNCH_DATE = new Date('2026-04-01T00:00:00Z');
+// Waitlist gating can be disabled for open self-serve / PLG growth.
+// Set WAITLIST_ENABLED=false to allow instant signups regardless of launch date.
+const WAITLIST_ENABLED = process.env.WAITLIST_ENABLED !== 'false';
+
+// Platform-admin allowlist (comma-separated Firebase UIDs). Fail-closed: if
+// unset, no one passes the platform-admin gate. Used for platform-wide views.
+const ADMIN_UIDS = new Set(
+  String(process.env.ADMIN_UIDS || '').split(',').map(s => s.trim()).filter(Boolean)
+);
+function isPlatformAdmin(uid) {
+  return ADMIN_UIDS.has(uid);
+}
+
+// Helper functions
+function nowTimestamp() {
+  return admin.firestore.FieldValue.serverTimestamp();
+}
+
+function sanitizeJsonObject(obj) {
+  if (obj === null || typeof obj !== 'object' || Array.isArray(obj)) return obj;
+  const clean = {};
+  for (const key of Object.keys(obj)) {
+    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
+    const val = obj[key];
+    clean[key] = (typeof val === 'object' && val !== null) ? sanitizeJsonObject(val) : val;
+  }
+  return clean;
+}
+
+function normalizeHandle(handle) {
+  return String(handle || '')
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '');
+}
+
+// Standard error response — always carries the request-correlation id so a
+// client-reported failure maps to a specific server log line.
+function sendError(req, res, status, message, extra) {
+  return res.status(status).json({ error: message, requestId: req.requestId, ...(extra || {}) });
+}
+
+async function requireAuth(req, res) {
+  const decoded = await verifyAuthHeader(req.headers.authorization || '');
+  if (!decoded) {
+    sendError(req, res, 401, 'Unauthorized');
+    return null;
+  }
+  return decoded;
+}
+
+// Auth + provider-ownership guard. Returns { user, providerDoc } or null
+// (having already sent 401/404). Centralizes the preamble that was repeated
+// across ~35 endpoints so an ownership check can never be silently omitted.
+async function requireProvider(req, res) {
+  const user = await requireAuth(req, res);
+  if (!user) return null;
+  const providerDoc = await findProviderByOwner(user.uid);
+  if (!providerDoc) {
+    sendError(req, res, 404, 'Provider not found');
+    return null;
+  }
+  return { user, providerDoc };
+}
+
+// Auth + org-membership guard, optionally enforcing an RBAC permission.
+// Returns the membership object or null (having sent 401/403/404).
+async function requireMembership(req, res, permission) {
+  const user = await requireAuth(req, res);
+  if (!user) return null;
+  const membership = await resolveMembership(user);
+  if (!membership) {
+    sendError(req, res, 404, 'No organization found');
+    return null;
+  }
+  if (permission && !orgs.can(membership.role, permission)) {
+    sendError(req, res, 403, 'You do not have permission to perform this action');
+    return null;
+  }
+  membership.user = user;
+  return membership;
+}
+
+async function findProviderByHandle(handle) {
+  const db = admin.firestore();
+  const snapshot = await db
+    .collection('providers')
+    .where('handle', '==', handle)
+    .limit(1)
+    .get();
+  if (snapshot.empty) return null;
+  return snapshot.docs[0];
+}
+
+async function findProviderByOwner(uid) {
+  if (!uid) {
+    throw new Error('User ID is required');
+  }
+  const db = admin.firestore();
+  const doc = await db.collection('providers').doc(uid).get();
+  if (!doc.exists) return null;
+  return doc;
+}
+
+/**
+ * Resolve the caller's organization membership.
+ *
+ * Lazily creates a "personal org" the first time an existing solo provider
+ * touches an org endpoint: orgId = providerId, the provider as sole `owner`.
+ * This keeps the entire solo flow non-breaking — nothing is created until a
+ * user actually engages with org features.
+ *
+ * Returns { orgId, org, role, providerId, member } or null if the user has not
+ * onboarded as a provider yet.
+ */
+async function resolveMembership(user) {
+  const db = admin.firestore();
+  const membershipDoc = await db.collection('memberships').doc(user.uid).get();
+
+  if (membershipDoc.exists) {
+    const { orgId, role } = membershipDoc.data();
+    const [orgDoc, memberDoc] = await Promise.all([
+      db.collection('organizations').doc(orgId).get(),
+      db.collection('organizations').doc(orgId).collection('members').doc(user.uid).get()
+    ]);
+    if (!orgDoc.exists) return null;
+    const member = memberDoc.exists ? memberDoc.data() : null;
+    return {
+      orgId,
+      org: { id: orgId, ...orgDoc.data() },
+      role: (member && member.role) || role,
+      providerId: member && member.providerId ? member.providerId : null,
+      member
+    };
+  }
+
+  // No membership yet — lazily create a personal org if the user is a provider.
+  const providerDoc = await findProviderByOwner(user.uid);
+  if (!providerDoc) return null;
+
+  const orgId = providerDoc.id;
+  const provider = providerDoc.data();
+  const orgData = {
+    ownerUid: user.uid,
+    name: provider.displayName ? `${provider.displayName}'s Practice` : 'My Practice',
+    type: 'personal',
+    plan: provider.plan || 'free',
+    seats: 1,
+    createdAt: nowTimestamp(),
+    updatedAt: nowTimestamp()
+  };
+  const memberData = {
+    uid: user.uid,
+    email: user.email || null,
+    role: 'owner',
+    providerId: orgId,
+    status: 'active',
+    joinedAt: nowTimestamp()
+  };
+
+  await db.collection('organizations').doc(orgId).set(orgData, { merge: true });
+  await db.collection('organizations').doc(orgId).collection('members').doc(user.uid).set(memberData);
+  await db.collection('memberships').doc(user.uid).set({ orgId, role: 'owner' });
+
+  return { orgId, org: { id: orgId, ...orgData }, role: 'owner', providerId: orgId, member: memberData };
+}
+
+/** Count active (non-invited) members in an org. */
+async function countActiveMembers(orgId) {
+  const db = admin.firestore();
+  const snap = await db.collection('organizations').doc(orgId).collection('members')
+    .where('status', '==', 'active').get();
+  return snap.size;
+}
+
+async function findConversation({ providerId, sessionId }) {
+  const db = admin.firestore();
+  const snapshot = await db
+    .collection('conversations')
+    .where('providerId', '==', providerId)
+    .where('sessionId', '==', sessionId)
+    .orderBy('createdAt', 'desc')
+    .limit(1)
+    .get();
+
+  if (snapshot.empty) return null;
+  return snapshot.docs[0];
+}
+
+function resolveTopic({ requestedTopic, enabledTopics, message }) {
+  if (requestedTopic && enabledTopics.includes(requestedTopic)) {
+    return requestedTopic;
+  }
+  const inferred = inferTopic(message);
+  if (enabledTopics.includes(inferred)) {
+    return inferred;
+  }
+  return enabledTopics[0] || TOPIC_KEYS[0];
+}
+
+function mapProviderPublic(provider) {
+  return {
+    handle: provider.handle,
+    displayName: provider.displayName,
+    specialty: provider.specialty,
+    country: provider.country,
+    locale: provider.locale,
+    photoUrl: provider.photoUrl || null,
+    logoUrl: provider.logoUrl || null,
+    brandPrimaryColor: provider.brandPrimaryColor || null,
+    brandSecondaryColor: provider.brandSecondaryColor || null,
+    welcomeMessage: provider.welcomeMessage || null,
+    enabledTopics: provider.enabledTopics || TOPIC_KEYS,
+    contactInfo: provider.contactInfo || null,
+    businessHours: provider.businessHours || null,
+    isPreview: provider.status === 'preview',
+    isVerified: provider.verificationStatus === 'verified'
+  };
+}
+
+function mapProviderPrivate(provider) {
+  return {
+    id: provider.id,
+    ownerUid: provider.ownerUid,
+    handle: provider.handle,
+    displayName: provider.displayName,
+    specialty: provider.specialty,
+    country: provider.country,
+    locale: provider.locale,
+    photoUrl: provider.photoUrl || null,
+    logoUrl: provider.logoUrl || null,
+    brandPrimaryColor: provider.brandPrimaryColor || null,
+    brandSecondaryColor: provider.brandSecondaryColor || null,
+    welcomeMessage: provider.welcomeMessage || null,
+    enabledTopics: provider.enabledTopics || TOPIC_KEYS,
+    contactInfo: provider.contactInfo || null,
+    businessHours: provider.businessHours || null,
+    status: provider.status,
+    plan: provider.plan,
+    monthlyChatLimit: provider.monthlyChatLimit,
+    monthlyChatCount: provider.monthlyChatCount || 0,
+    monthlyChatCountMonth: provider.monthlyChatCountMonth || null,
+    totalChatCount: provider.totalChatCount || 0,
+    totalEscalationCount: provider.totalEscalationCount || 0,
+    stripeAccountId: provider.stripeAccountId || null,
+    stripeOnboardingComplete: provider.stripeOnboardingComplete || false,
+    pricingModel: provider.pricingModel || null,
+    paymentEnabled: provider.paymentEnabled || false,
+    perChatPrice: provider.perChatPrice || null,
+    subscriptionPrice: provider.subscriptionPrice || null,
+    verificationStatus: provider.verificationStatus || 'pending'
+  };
+}
+
+function sanitizeTopics(topics) {
+  if (!Array.isArray(topics)) return null;
+  const filtered = topics.filter((topic) => TOPIC_KEYS.includes(topic));
+  return filtered.length ? filtered : null;
+}
+
+const HEX_COLOR_REGEX = /^#[0-9a-fA-F]{6}$/;
+
+function stripHtml(str) {
+  return String(str).replace(/<[^>]*>/g, '').trim();
+}
+
+function sanitizeContactInfo(ci) {
+  if (!ci || typeof ci !== 'object') return null;
+  const clean = {};
+  if (ci.phone) clean.phone = stripHtml(String(ci.phone)).replace(/[^0-9+\-() .ext]/gi, '').substring(0, 30);
+  if (ci.email) {
+    const email = String(ci.email).trim().toLowerCase();
+    if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) clean.email = email;
+  }
+  if (ci.address) clean.address = stripHtml(ci.address).substring(0, 200);
+  return Object.keys(clean).length ? clean : null;
+}
+
+function sanitizeProviderUpdate(body) {
+  const update = {};
+  if (body.displayName !== undefined) {
+    const name = stripHtml(body.displayName).substring(0, 100);
+    if (name) update.displayName = name;
+  }
+  if (body.specialty !== undefined) {
+    update.specialty = stripHtml(body.specialty).substring(0, 100);
+  }
+  if (body.country !== undefined) update.country = stripHtml(body.country).substring(0, 60);
+  if (body.locale !== undefined) update.locale = String(body.locale).trim().substring(0, 10);
+  if (body.photoUrl !== undefined) update.photoUrl = body.photoUrl ? String(body.photoUrl).trim() : null;
+  if (body.logoUrl !== undefined) update.logoUrl = body.logoUrl ? String(body.logoUrl).trim() : null;
+  if (body.brandPrimaryColor !== undefined) {
+    const c = String(body.brandPrimaryColor).trim();
+    if (HEX_COLOR_REGEX.test(c)) update.brandPrimaryColor = c;
+  }
+  if (body.brandSecondaryColor !== undefined) {
+    const c = String(body.brandSecondaryColor).trim();
+    if (HEX_COLOR_REGEX.test(c)) update.brandSecondaryColor = c;
+  }
+  if (body.welcomeMessage !== undefined) update.welcomeMessage = stripHtml(body.welcomeMessage).substring(0, 500);
+  if (body.contactInfo !== undefined) {
+    update.contactInfo = body.contactInfo === null ? null : sanitizeContactInfo(body.contactInfo);
+  }
+  if (body.businessHours !== undefined && (body.businessHours === null || typeof body.businessHours === 'object')) {
+    update.businessHours = body.businessHours ? sanitizeJsonObject(body.businessHours) : null;
+  }
+
+  const topics = sanitizeTopics(body.enabledTopics);
+  if (topics) update.enabledTopics = topics;
+
+  if (body.status && ['draft', 'preview', 'published', 'suspended'].includes(body.status)) {
+    update.status = body.status;
+  }
+
+  return update;
+}
+
+// ============================================
+// API ROUTES
+// ============================================
+
+// Health check
+const serverStartTime = Date.now();
+app.get('/health', async (req, res) => {
+  const health = {
+    ok: true,
+    timestamp: Date.now(),
+    uptime: Math.floor((Date.now() - serverStartTime) / 1000),
+    memory: Math.round(process.memoryUsage().rss / 1024 / 1024)
+  };
+
+  if (req.query.deep === 'true') {
+    try {
+      const db = admin.firestore();
+      await db.collection('providers').limit(1).get();
+      health.database = 'connected';
+    } catch {
+      health.database = 'error';
+      health.ok = false;
+    }
+  }
+
+  res.status(health.ok ? 200 : 503).json(health);
+});
+
+// Patient API routes
+app.all('/api/patient/*', async (req, res) => {
+  try {
+    const authHeader = req.headers.authorization || '';
+    const user = await verifyAuthHeader(authHeader);
+
+    if (!user) {
+      return res.status(401).json({ error: 'Unauthorized' });
+    }
+
+    // Build a modified request object with the /api prefix stripped from path
+    // (req.path is a read-only getter in Express, so we override via Object.defineProperty)
+    const strippedPath = req.path.replace('/api', '');
+    Object.defineProperty(req, 'path', { value: strippedPath, writable: true, configurable: true });
+
+    await handlePatientAPI(req, res, user);
+  } catch (error) {
+    console.error('Patient API error:', error);
+    if (!res.headersSent) {
+      res.status(500).json({ error: 'Internal server error' });
+    }
+  }
+});
+
+// Analytics endpoint (admin only)
+app.get('/api/admin/analytics', rateLimit({ maxRequests: 10, windowMs: 60000 }), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    // Platform-wide analytics is admin-only (leaks every provider's data otherwise).
+    if (!isPlatformAdmin(user.uid)) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
+    const validPeriods = ['all', 'today', 'week', 'month'];
+    const timePeriod = validPeriods.includes(req.query.period) ? req.query.period : 'all';
+    const db = admin.firestore();
+
+    // Calculate date filter based on period
+    let dateFilter = null;
+    const now = new Date();
+
+    switch (timePeriod) {
+      case 'today':
+        dateFilter = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+        break;
+      case 'week':
+        dateFilter = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000);
+        break;
+      case 'month':
+        dateFilter = new Date(now.getFullYear(), now.getMonth(), 1);
+        break;
+      case 'quarter':
+        const quarterStartMonth = Math.floor(now.getMonth() / 3) * 3;
+        dateFilter = new Date(now.getFullYear(), quarterStartMonth, 1);
+        break;
+    }
+
+    // Get providers (bounded to avoid loading an unbounded set into memory).
+    const providersSnapshot = await db.collection('providers').limit(5000).get();
+    const providers = [];
+
+    for (const doc of providersSnapshot.docs) {
+      const providerData = doc.data();
+      const providerId = doc.id;
+
+      // Get conversation stats for this provider
+      let conversationsQuery = db
+        .collection('conversations')
+        .where('providerId', '==', providerId);
+
+      if (dateFilter) {
+        conversationsQuery = conversationsQuery.where('createdAt', '>=', dateFilter);
+      }
+
+      const conversationsSnapshot = await conversationsQuery.get();
+      const conversationCount = conversationsSnapshot.size;
+
+      // Get unique patients (sessionIds)
+      const uniqueSessionIds = new Set();
+      conversationsSnapshot.docs.forEach(doc => {
+        const sessionId = doc.data().sessionId;
+        if (sessionId) uniqueSessionIds.add(sessionId);
+      });
+
+      // Get total message count for this provider
+      let messageCount = 0;
+      for (const convoDoc of conversationsSnapshot.docs) {
+        const messagesSnapshot = await convoDoc.ref.collection('messages').get();
+        messageCount += messagesSnapshot.size;
+      }
+
+      providers.push({
+        id: providerId,
+        displayName: providerData.displayName || 'Unnamed Doctor',
+        email: providerData.email,
+        handle: providerData.handle,
+        specialty: providerData.specialty,
+        status: providerData.status || 'draft',
+        createdAt: providerData.createdAt,
+        conversationCount,
+        uniquePatients: uniqueSessionIds.size,
+        messageCount
+      });
+    }
+
+    // Calculate summary statistics
+    const totalDoctors = providers.length;
+    const activeDoctors = providers.filter(p => p.status === 'published').length;
+    const totalConversations = providers.reduce((sum, p) => sum + p.conversationCount, 0);
+
+    // Get unique patients across all providers
+    const allUniqueSessionIds = new Set();
+    let conversationsQuery = db.collection('conversations');
+    if (dateFilter) {
+      conversationsQuery = conversationsQuery.where('createdAt', '>=', dateFilter);
+    }
+    const allConversationsSnapshot = await conversationsQuery.get();
+    allConversationsSnapshot.docs.forEach(doc => {
+      const sessionId = doc.data().sessionId;
+      if (sessionId) allUniqueSessionIds.add(sessionId);
+    });
+
+    res.json({
+      summary: {
+        totalDoctors,
+        activeDoctors,
+        totalConversations,
+        uniquePatients: allUniqueSessionIds.size
+      },
+      doctors: providers,
+      period: timePeriod
+    });
+  } catch (error) {
+    console.error('Error getting analytics:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get provider by handle (public)
+app.get('/api/provider', async (req, res) => {
+  try {
+    const handle = normalizeHandle(req.query.handle || '');
+    if (!handle) {
+      return res.status(400).json({ error: 'handle is required' });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+    if (provider.status === 'suspended') {
+      return res.status(403).json({ error: 'This provider has been suspended.' });
+    }
+    // 'preview' resolves publicly so providers get an instant working link
+    // before credential verification completes (marked isPreview to the client).
+    if (provider.status !== 'published' && provider.status !== 'preview') {
+      return res.status(403).json({ error: 'This provider is not currently available.' });
+    }
+
+    res.json(mapProviderPublic(provider));
+  } catch (error) {
+    console.error('Error getting provider:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Search providers (public)
+app.get('/api/search-providers', rateLimit({ maxRequests: 30, windowMs: 60000 }), async (req, res) => {
+  try {
+    const query = (req.query.q || '').trim().toLowerCase();
+
+    if (!query || query.length < 2) {
+      return res.status(400).json({ error: 'Query must be at least 2 characters' });
+    }
+
+    const db = admin.firestore();
+
+    // Search by displayName and specialty
+    // Note: Firestore doesn't support full-text search, so we'll fetch all published providers
+    // and filter in memory. For production, consider Algolia or similar.
+    const snapshot = await db
+      .collection('providers')
+      .where('status', '==', 'published')
+      .limit(50)
+      .get();
+
+    if (snapshot.empty) {
+      return res.json({ providers: [] });
+    }
+
+    // Filter results based on query matching displayName or specialty
+    const providers = snapshot.docs
+      .map(doc => {
+        const data = doc.data();
+        return {
+          handle: data.handle,
+          displayName: data.displayName || 'Unknown Provider',
+          specialty: data.specialty || 'General Practice',
+          country: data.country || null
+        };
+      })
+      .filter(provider => {
+        const nameMatch = provider.displayName.toLowerCase().includes(query);
+        const specialtyMatch = provider.specialty.toLowerCase().includes(query);
+        const handleMatch = (provider.handle || '').toLowerCase().includes(query);
+        return nameMatch || specialtyMatch || handleMatch;
+      })
+      .slice(0, 10); // Return max 10 results
+
+    res.json({ providers });
+  } catch (error) {
+    console.error('Error searching providers:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Generate QR code for a provider's public chat page (public, no auth required)
+app.get('/api/qr/:handle', rateLimit({ maxRequests: 30, windowMs: 60000 }), async (req, res) => {
+  try {
+    const handle = normalizeHandle(req.params.handle);
+    if (!handle) {
+      return res.status(400).json({ error: 'Invalid handle' });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+    // Consistent with /api/provider: preview links are live (the chat page
+    // discloses the unverified state), so their QR codes resolve too.
+    if (provider.status !== 'published' && provider.status !== 'preview') {
+      return res.status(403).json({ error: 'Provider is not available' });
+    }
+
+    // Build the public chat URL for this provider
+    const baseUrl = process.env.BASE_URL || `${req.protocol}://${req.get('host')}`;
+    const chatUrl = `${baseUrl}/${handle}`;
+
+    // Generate QR code as PNG buffer
+    const qrBuffer = await QRCode.toBuffer(chatUrl, {
+      type: 'png',
+      width: 300,
+      margin: 2,
+      errorCorrectionLevel: 'M'
+    });
+
+    res.setHeader('Content-Type', 'image/png');
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.send(qrBuffer);
+  } catch (error) {
+    console.error('Error generating QR code:', error);
+    res.status(500).json({ error: 'Failed to generate QR code' });
+  }
+});
+
+// Get current authenticated provider
+app.get('/api/me', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const data = providerDoc.data();
+    res.json(mapProviderPrivate({ id: providerDoc.id, ...data }));
+  } catch (error) {
+    console.error('Error getting current provider:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Create provider
+app.post('/api/provider', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    // Waitlist gate: block signups until launch date unless email is approved.
+    // Disabled entirely when WAITLIST_ENABLED=false (open self-serve).
+    if (WAITLIST_ENABLED && new Date() < LAUNCH_DATE) {
+      const db = admin.firestore();
+      const approved = await db.collection('waitlist')
+        .where('email', '==', (user.email || '').toLowerCase())
+        .where('approved', '==', true)
+        .limit(1)
+        .get();
+      if (approved.empty) {
+        return res.status(403).json({
+          error: 'EvalDoc launches April 1, 2026. Join the waitlist at evaldoctor.ai to be notified.',
+          code: 'WAITLIST_REQUIRED',
+          launchDate: LAUNCH_DATE.toISOString()
+        });
+      }
+    }
+
+    const existing = await findProviderByOwner(user.uid);
+    if (existing) {
+      return res.status(409).json({ error: 'Provider already exists' });
+    }
+
+    const body = req.body || {};
+    const rawHandle = normalizeHandle(body.handle);
+    if (!rawHandle || !HANDLE_REGEX.test(rawHandle) || RESERVED_HANDLES.has(rawHandle)) {
+      return res.status(400).json({ error: 'Invalid handle' });
+    }
+
+    const displayName = stripHtml(body.displayName || '').substring(0, 100);
+    if (!displayName) {
+      return res.status(400).json({ error: 'Display name is required' });
+    }
+    const specialty = stripHtml(body.specialty || '').substring(0, 100);
+    if (!specialty) {
+      return res.status(400).json({ error: 'Specialty is required' });
+    }
+
+    const licenseNumber = String(body.licenseNumber || '').trim();
+    if (licenseNumber && licenseNumber.length < 3) {
+      return res.status(400).json({ error: 'License number must be at least 3 characters' });
+    }
+
+    const brandPrimary = body.brandPrimaryColor && HEX_COLOR_REGEX.test(String(body.brandPrimaryColor).trim())
+      ? String(body.brandPrimaryColor).trim() : '#0e1a14';
+    const brandSecondary = body.brandSecondaryColor && HEX_COLOR_REGEX.test(String(body.brandSecondaryColor).trim())
+      ? String(body.brandSecondaryColor).trim() : '#4fb3a4';
+
+    const enabledTopics = sanitizeTopics(body.enabledTopics) || TOPIC_KEYS;
+    const providerData = {
+      ownerUid: user.uid,
+      handle: rawHandle,
+      displayName,
+      specialty,
+      country: stripHtml(body.country || '').substring(0, 60),
+      locale: String(body.locale || 'en').trim(),
+      photoUrl: body.photoUrl || null,
+      logoUrl: body.logoUrl || null,
+      brandPrimaryColor: brandPrimary,
+      brandSecondaryColor: brandSecondary,
+      welcomeMessage: stripHtml(body.welcomeMessage || 'Welcome. Choose a topic to get started.').substring(0, 500),
+      contactInfo: sanitizeContactInfo(body.contactInfo),
+      businessHours: body.businessHours || null,
+      enabledTopics,
+      // New doctor verification fields
+      licenseNumber: String(body.licenseNumber || '').trim(),
+      certificateUrl: body.certificateUrl || null,
+      certificateFileName: (body.certificateFileName || '').replace(/[/\\]/g, '_').slice(0, 255) || null,
+      verificationStatus: 'pending', // pending, verified, rejected — always starts as pending
+      // Payment/billing fields (set by billing setup later)
+      pricingModel: body.pricingModel || null, // Will be set during billing setup
+      paymentEnabled: body.paymentEnabled || false,
+      subscriptionPrice: body.subscriptionPrice || 0,
+      perChatPrice: body.perChatPrice || 0,
+      stripeAccountId: body.stripeAccountId || null,
+      stripeOnboardingComplete: body.stripeOnboardingComplete || false,
+      // Start in 'preview' so the provider has an instant, shareable working link
+      // (clearly marked as an unverified preview) before verification completes.
+      status: 'preview',
+      plan: 'free',
+      monthlyChatLimit: 50,
+      monthlyChatCount: 0,
+      monthlyChatCountMonth: getMonthKey(),
+      totalChatCount: 0,
+      totalEscalationCount: 0,
+      createdAt: nowTimestamp(),
+      updatedAt: nowTimestamp()
+    };
+
+    const db = admin.firestore();
+    const providerRef = db.collection('providers').doc(user.uid);
+    const handleRef = db.collection('handles').doc(rawHandle);
+
+    try {
+      await db.runTransaction(async (tx) => {
+        const handleDoc = await tx.get(handleRef);
+        if (handleDoc.exists) {
+          throw new Error('HANDLE_TAKEN');
+        }
+        tx.set(handleRef, {
+          providerId: providerRef.id,
+          createdAt: nowTimestamp()
+        });
+        tx.set(providerRef, providerData);
+      });
+    } catch (err) {
+      if (err.message === 'HANDLE_TAKEN') {
+        return res.status(409).json({ error: 'Handle already taken' });
+      }
+      throw err;
+    }
+
+    res.json(mapProviderPrivate({ id: providerRef.id, ...providerData }));
+  } catch (error) {
+    console.error('Error creating provider:', error);
+    res.status(500).json({ error: 'Unable to create provider' });
+  }
+});
+
+// Update provider
+app.post('/api/provider/update', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const update = sanitizeProviderUpdate(req.body || {});
+    if (!Object.keys(update).length) {
+      return res.status(400).json({ error: 'No valid fields to update' });
+    }
+
+    // Full public publishing requires verified credentials. Doctors can use
+    // 'preview' status immediately for a working link while verification is pending.
+    if (update.status === 'published') {
+      const currentData = providerDoc.data();
+      if (currentData.verificationStatus !== 'verified') {
+        return res.status(403).json({
+          error: 'Your credentials are still being verified. You can share your preview link now and switch to fully published once verification completes.',
+          code: 'VERIFICATION_REQUIRED',
+          previewAvailable: true
+        });
+      }
+    }
+
+    update.updatedAt = nowTimestamp();
+    await providerDoc.ref.set(update, { merge: true });
+
+    const updated = await providerDoc.ref.get();
+    res.json(mapProviderPrivate({ id: updated.id, ...updated.data() }));
+  } catch (error) {
+    console.error('Error updating provider:', error);
+    res.status(500).json({ error: 'Unable to update provider' });
+  }
+});
+
+// Verification status — self-serve transparency (Phase 1)
+// Returns where the provider is in the credential-verification journey,
+// an estimated SLA, and what action (if any) they can take next.
+const VERIFICATION_SLA_HOURS = 48;
+app.get('/api/provider/verification-status', async (req, res) => {
+  try {
+    const ctx = await requireProvider(req, res);
+    if (!ctx) return;
+    const p = ctx.providerDoc.data();
+    const status = p.verificationStatus || 'pending';
+
+    const messages = {
+      pending: `Your credentials are under review. Most reviews complete within ${VERIFICATION_SLA_HOURS} hours. You can share your preview link in the meantime.`,
+      verified: 'Your credentials are verified. You can publish your public link.',
+      rejected: 'We could not verify your credentials. Please review the reason and resubmit.'
+    };
+
+    res.json({
+      verificationStatus: status,
+      slaHours: VERIFICATION_SLA_HOURS,
+      message: messages[status] || messages.pending,
+      canResubmit: status === 'rejected',
+      canUsePreview: status !== 'verified',
+      rejectionReason: status === 'rejected' ? (p.verificationRejectionReason || null) : null,
+      hasCertificate: !!p.certificateUrl,
+      submittedAt: p.createdAt || null
+    });
+  } catch (error) {
+    console.error('Verification status error:', error);
+    res.status(500).json({ error: 'Unable to load verification status' });
+  }
+});
+
+// Onboarding checklist — guided activation (Phase 1)
+// Computes which setup steps are done so the dashboard can render a checklist
+// and a single clear "next action" instead of a blank page.
+app.get('/api/provider/onboarding-status', async (req, res) => {
+  try {
+    const ctx = await requireProvider(req, res);
+    if (!ctx) return;
+    const p = ctx.providerDoc.data();
+
+    const steps = [
+      { key: 'profile', label: 'Add your name and specialty', done: !!(p.displayName && p.specialty) },
+      { key: 'branding', label: 'Customize your branding', done: !!(p.welcomeMessage && p.brandPrimaryColor) },
+      { key: 'topics', label: 'Choose your topics', done: Array.isArray(p.enabledTopics) && p.enabledTopics.length > 0 },
+      { key: 'credentials', label: 'Upload your medical license', done: !!p.certificateUrl },
+      { key: 'preview', label: 'Share your preview link', done: p.status === 'preview' || p.status === 'published' },
+      { key: 'billing', label: 'Set up payments (optional)', done: !!p.stripeOnboardingComplete, optional: true },
+      { key: 'published', label: 'Go live (after verification)', done: p.status === 'published' }
+    ];
+
+    const required = steps.filter(s => !s.optional);
+    const completedRequired = required.filter(s => s.done).length;
+    const nextStep = steps.find(s => !s.done && !s.optional) || null;
+
+    res.json({
+      steps,
+      completedRequired,
+      totalRequired: required.length,
+      percentComplete: Math.round((completedRequired / required.length) * 100),
+      nextStep: nextStep ? { key: nextStep.key, label: nextStep.label } : null,
+      isComplete: completedRequired === required.length
+    });
+  } catch (error) {
+    console.error('Onboarding status error:', error);
+    res.status(500).json({ error: 'Unable to load onboarding status' });
+  }
+});
+
+// Export all account data — GDPR right to data portability (Phase 2)
+app.get('/api/account/export', async (req, res) => {
+  try {
+    const ctx = await requireProvider(req, res);
+    if (!ctx) return;
+    const { user, providerDoc } = ctx;
+    const providerId = providerDoc.id;
+    const db = admin.firestore();
+
+    const [threadsSnap, convosSnap] = await Promise.all([
+      db.collection('threads').where('doctorId', '==', providerId).limit(1000).get(),
+      db.collection('conversations').where('providerId', '==', providerId).limit(1000).get()
+    ]);
+
+    const exportData = {
+      exportedAt: new Date().toISOString(),
+      account: { uid: user.uid, email: user.email || null },
+      provider: mapProviderPrivate({ id: providerId, ...providerDoc.data() }),
+      threads: threadsSnap.docs.map(d => ({ id: d.id, ...d.data() })),
+      conversations: convosSnap.docs.map(d => ({ id: d.id, ...d.data() })),
+      counts: { threads: threadsSnap.size, conversations: convosSnap.size }
+    };
+
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('Content-Disposition', `attachment; filename="evaldoc-export-${providerId}.json"`);
+    res.json(exportData);
+  } catch (error) {
+    console.error('Account export error:', error);
+    res.status(500).json({ error: 'Unable to export account data' });
+  }
+});
+
+// Delete account — GDPR right to erasure (Phase 2)
+// Cascades: provider doc, handle reservation, threads (+messages), conversations.
+app.delete('/api/account', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    // Require explicit confirmation to prevent accidental deletion.
+    if (!req.body || req.body.confirm !== 'DELETE') {
+      return res.status(400).json({ error: 'Confirmation required. Send { "confirm": "DELETE" } to proceed.' });
+    }
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+    const providerId = providerDoc.id;
+    const p = providerDoc.data();
+    const db = admin.firestore();
+
+    // Delete threads and their message subcollections
+    const threadsSnap = await db.collection('threads').where('doctorId', '==', providerId).limit(1000).get();
+    for (const threadDoc of threadsSnap.docs) {
+      const msgsSnap = await threadDoc.ref.collection('messages').limit(1000).get();
+      const batch = db.batch();
+      msgsSnap.docs.forEach(m => batch.delete(m.ref));
+      batch.delete(threadDoc.ref);
+      await batch.commit();
+    }
+
+    // Delete conversations and their message subcollections
+    const convosSnap = await db.collection('conversations').where('providerId', '==', providerId).limit(1000).get();
+    for (const convoDoc of convosSnap.docs) {
+      const msgsSnap = await convoDoc.ref.collection('messages').limit(1000).get();
+      const batch = db.batch();
+      msgsSnap.docs.forEach(m => batch.delete(m.ref));
+      batch.delete(convoDoc.ref);
+      await batch.commit();
+    }
+
+    // Release the handle reservation and delete the provider record
+    if (p.handle) {
+      await db.collection('handles').doc(p.handle).delete().catch(() => {});
+    }
+    await providerDoc.ref.delete();
+
+    logAuditEvent({
+      action: 'account_deleted',
+      actorId: user.uid,
+      actorType: 'doctor',
+      resourceType: 'provider',
+      resourceId: providerId,
+      meta: { threadsDeleted: threadsSnap.size, conversationsDeleted: convosSnap.size }
+    }).catch(() => {});
+
+    res.json({
+      success: true,
+      deleted: { provider: providerId, threads: threadsSnap.size, conversations: convosSnap.size }
+    });
+  } catch (error) {
+    console.error('Account deletion error:', error);
+    res.status(500).json({ error: 'Unable to delete account' });
+  }
+});
+
+// Public pricing — business-model transparency (Phase 3)
+// Primary model is B2B SaaS (the provider/clinic subscribes). Patient-pay is an
+// optional per-provider add-on. This endpoint powers a public pricing page.
+const SAAS_PLANS = [
+  {
+    key: 'free', name: 'Free', priceMonthly: 0, currency: 'usd',
+    seats: 1, monthlyChatLimit: 50,
+    features: ['1 provider', '50 patient chats/mo', 'Safety pipeline', 'Basic analytics', 'Branded link + QR']
+  },
+  {
+    key: 'pro', name: 'Pro', priceMonthly: 29, currency: 'usd',
+    seats: 1, monthlyChatLimit: 0,
+    features: ['Unlimited patient chats', 'Custom branding', 'Full analytics', 'AI draft replies', 'Priority verification']
+  },
+  {
+    key: 'clinic', name: 'Clinic', priceMonthly: 99, currency: 'usd',
+    seats: 5, monthlyChatLimit: 0,
+    features: ['Up to 5 providers', 'Team inbox', 'Shared analytics', 'Clinic branding', 'Volume support']
+  },
+  {
+    key: 'enterprise', name: 'Enterprise', priceMonthly: null, currency: 'usd',
+    seats: null, monthlyChatLimit: 0,
+    features: ['Unlimited providers', 'SSO/SAML', 'Data residency', 'DPA & BAA', 'Dedicated support', 'Custom SLAs']
+  }
+];
+
+app.get('/api/pricing', (req, res) => {
+  res.json({
+    model: 'b2b_saas',
+    description: 'Providers and clinics subscribe to EvalDoc. Patient-pay is an optional add-on configured per provider.',
+    plans: SAAS_PLANS,
+    patientPayAddOn: {
+      available: true,
+      platformFeePercent: 10,
+      note: 'Optional. Providers may charge patients per chat or via subscription. Platform fee applies on top of payment-processor fees.'
+    }
+  });
+});
+
+// Patient-facing cost for a specific provider (public)
+app.get('/api/pricing/:handle', async (req, res) => {
+  try {
+    const handle = normalizeHandle(req.params.handle);
+    if (!handle) return res.status(400).json({ error: 'Invalid handle' });
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) return res.status(404).json({ error: 'Provider not found' });
+
+    const p = providerDoc.data();
+    // Don't expose pricing for providers that aren't live (no enumeration of drafts).
+    if (p.status !== 'published' && p.status !== 'preview') {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+    const paid = !!p.paymentEnabled && p.pricingModel && p.pricingModel !== 'free';
+    res.json({
+      handle,
+      free: !paid,
+      pricingModel: paid ? p.pricingModel : 'free',
+      perChatPrice: paid ? (p.perChatPrice || 0) : 0,
+      subscriptionPrice: paid ? (p.subscriptionPrice || 0) : 0,
+      currency: p.currency || 'usd'
+    });
+  } catch (error) {
+    console.error('Provider pricing error:', error);
+    res.status(500).json({ error: 'Unable to load pricing' });
+  }
+});
+
+// ============================================
+// ORGANIZATIONS & TEAM (multi-provider clinics) — Phase A/B
+// ============================================
+
+// Current org + members + seat usage
+app.get('/api/org', async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res);
+    if (!membership) return;
+
+    const db = admin.firestore();
+    const membersSnap = await db.collection('organizations').doc(membership.orgId)
+      .collection('members').get();
+    const members = membersSnap.docs.map(d => {
+      const m = d.data();
+      return { uid: m.uid, email: m.email, role: m.role, status: m.status, providerId: m.providerId || null };
+    });
+    const activeCount = members.filter(m => m.status === 'active').length;
+
+    res.json({
+      org: {
+        id: membership.org.id,
+        name: membership.org.name,
+        type: membership.org.type,
+        plan: membership.org.plan,
+        seats: membership.org.seats
+      },
+      role: membership.role,
+      members,
+      seatLimit: orgs.seatLimitForPlan(membership.org.plan),
+      seatsRemaining: orgs.seatsRemaining(membership.org.plan, activeCount),
+      activeMembers: activeCount
+    });
+  } catch (error) {
+    console.error('Get org error:', error);
+    res.status(500).json({ error: 'Unable to load organization' });
+  }
+});
+
+// Invite a member
+app.post('/api/org/invite', express.json(), async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res, 'members.invite');
+    if (!membership) return;
+    const user = membership.user;
+
+    const { ok, value } = validate({
+      email: { type: 'email', required: true },
+      role: { type: 'string', default: 'clinician', maxLength: 20 }
+    }, req.body || {});
+    if (!ok) {
+      return sendError(req, res, 400, 'A valid email is required');
+    }
+    const email = value.email;
+    const role = value.role;
+    if (!orgs.canAssignRole(membership.role, role)) {
+      return sendError(req, res, 403, `You cannot assign the role "${role}"`);
+    }
+
+    // Seat enforcement: active members + outstanding pending invites must fit the plan.
+    const db = admin.firestore();
+    const activeCount = await countActiveMembers(membership.orgId);
+    const pendingSnap = await db.collection('invitations')
+      .where('orgId', '==', membership.orgId)
+      .where('status', '==', 'pending').get();
+    const projected = activeCount + pendingSnap.size;
+    if (!orgs.hasSeatAvailable(membership.org.plan, projected)) {
+      return res.status(402).json({
+        error: 'No seats available on your current plan. Upgrade to add more members.',
+        code: 'SEAT_LIMIT_REACHED',
+        seatLimit: orgs.seatLimitForPlan(membership.org.plan)
+      });
+    }
+
+    const token = crypto.randomBytes(24).toString('hex');
+    const invite = {
+      orgId: membership.orgId,
+      email,
+      role,
+      token,
+      status: 'pending',
+      invitedBy: user.uid,
+      createdAt: nowTimestamp(),
+      expiresAt: Date.now() + 7 * 24 * 60 * 60 * 1000
+    };
+    await db.collection('invitations').doc(token).set(invite);
+
+    logAuditEvent({
+      action: 'member_invited', actorId: user.uid, actorType: 'doctor',
+      resourceType: 'organization', resourceId: membership.orgId, meta: { email, role }
+    }).catch(() => {});
+
+    res.json({ success: true, invite: { email, role, token, status: 'pending', expiresAt: invite.expiresAt } });
+  } catch (error) {
+    console.error('Invite member error:', error);
+    res.status(500).json({ error: 'Unable to send invite' });
+  }
+});
+
+// Accept an invite (the invited, authenticated user calls this)
+app.post('/api/org/invite/accept', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const token = String(req.body.token || '').trim();
+    if (!token) return res.status(400).json({ error: 'Invite token is required' });
+
+    const db = admin.firestore();
+    const inviteDoc = await db.collection('invitations').doc(token).get();
+    if (!inviteDoc.exists) return res.status(404).json({ error: 'Invite not found' });
+    const invite = inviteDoc.data();
+
+    if (invite.status !== 'pending') return res.status(409).json({ error: 'This invite is no longer valid' });
+    if (invite.expiresAt && Date.now() > invite.expiresAt) {
+      await inviteDoc.ref.set({ status: 'expired' }, { merge: true });
+      return res.status(410).json({ error: 'This invite has expired' });
+    }
+    if ((user.email || '').toLowerCase() !== invite.email) {
+      return res.status(403).json({ error: 'This invite was sent to a different email address' });
+    }
+
+    // One active org per user in v1.
+    const existing = await db.collection('memberships').doc(user.uid).get();
+    if (existing.exists && existing.data().orgId !== invite.orgId) {
+      return res.status(409).json({ error: 'You already belong to an organization' });
+    }
+
+    // Re-check seat availability at accept time (guards against races).
+    const activeCount = await countActiveMembers(invite.orgId);
+    const orgDoc = await db.collection('organizations').doc(invite.orgId).get();
+    if (!orgDoc.exists) return res.status(404).json({ error: 'Organization no longer exists' });
+    if (!orgs.hasSeatAvailable(orgDoc.data().plan, activeCount)) {
+      return res.status(402).json({ error: 'No seats available', code: 'SEAT_LIMIT_REACHED' });
+    }
+
+    const memberData = {
+      uid: user.uid, email: user.email || null, role: invite.role,
+      providerId: null, status: 'active', joinedAt: nowTimestamp()
+    };
+    await db.collection('organizations').doc(invite.orgId).collection('members').doc(user.uid).set(memberData);
+    await db.collection('memberships').doc(user.uid).set({ orgId: invite.orgId, role: invite.role });
+    await inviteDoc.ref.set({ status: 'accepted', acceptedAt: nowTimestamp(), acceptedBy: user.uid }, { merge: true });
+
+    res.json({ success: true, orgId: invite.orgId, role: invite.role });
+  } catch (error) {
+    console.error('Accept invite error:', error);
+    res.status(500).json({ error: 'Unable to accept invite' });
+  }
+});
+
+// List members
+app.get('/api/org/members', async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res);
+    if (!membership) return;
+
+    const db = admin.firestore();
+    const snap = await db.collection('organizations').doc(membership.orgId).collection('members').get();
+    res.json({ members: snap.docs.map(d => {
+      const m = d.data();
+      return { uid: m.uid, email: m.email, role: m.role, status: m.status };
+    }) });
+  } catch (error) {
+    console.error('List members error:', error);
+    res.status(500).json({ error: 'Unable to list members' });
+  }
+});
+
+// Change a member's role
+app.patch('/api/org/members/:uid', express.json(), async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res, 'members.role');
+    if (!membership) return;
+    const user = membership.user;
+
+    const targetUid = req.params.uid;
+    const newRole = String(req.body.role || '');
+    const db = admin.firestore();
+    const targetRef = db.collection('organizations').doc(membership.orgId).collection('members').doc(targetUid);
+    const targetDoc = await targetRef.get();
+    if (!targetDoc.exists) return res.status(404).json({ error: 'Member not found' });
+
+    const targetRole = targetDoc.data().role;
+    if (!orgs.canManageMember(membership.role, targetRole)) {
+      return res.status(403).json({ error: 'You cannot manage this member' });
+    }
+    if (!orgs.canAssignRole(membership.role, newRole)) {
+      return res.status(403).json({ error: `You cannot assign the role "${newRole}"` });
+    }
+
+    await targetRef.set({ role: newRole }, { merge: true });
+    await db.collection('memberships').doc(targetUid).set({ orgId: membership.orgId, role: newRole }, { merge: true });
+
+    logAuditEvent({
+      action: 'member_role_changed', actorId: user.uid, actorType: 'doctor',
+      resourceType: 'organization', resourceId: membership.orgId, meta: { targetUid, from: targetRole, to: newRole }
+    }).catch(() => {});
+
+    res.json({ success: true, uid: targetUid, role: newRole });
+  } catch (error) {
+    console.error('Change role error:', error);
+    res.status(500).json({ error: 'Unable to change role' });
+  }
+});
+
+// Remove a member
+app.delete('/api/org/members/:uid', async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res, 'members.remove');
+    if (!membership) return;
+    const user = membership.user;
+
+    const targetUid = req.params.uid;
+    if (targetUid === user.uid) {
+      return res.status(400).json({ error: 'Use account deletion to remove yourself' });
+    }
+
+    const db = admin.firestore();
+    const targetRef = db.collection('organizations').doc(membership.orgId).collection('members').doc(targetUid);
+    const targetDoc = await targetRef.get();
+    if (!targetDoc.exists) return res.status(404).json({ error: 'Member not found' });
+
+    if (!orgs.canManageMember(membership.role, targetDoc.data().role)) {
+      return res.status(403).json({ error: 'You cannot remove this member' });
+    }
+
+    await targetRef.delete();
+    await db.collection('memberships').doc(targetUid).delete().catch(() => {});
+
+    logAuditEvent({
+      action: 'member_removed', actorId: user.uid, actorType: 'doctor',
+      resourceType: 'organization', resourceId: membership.orgId, meta: { targetUid }
+    }).catch(() => {});
+
+    res.json({ success: true, removed: targetUid });
+  } catch (error) {
+    console.error('Remove member error:', error);
+    res.status(500).json({ error: 'Unable to remove member' });
+  }
+});
+
+// Collect the provider ids owned by members of an org.
+async function orgProviderIds(orgId) {
+  const db = admin.firestore();
+  const snap = await db.collection('organizations').doc(orgId).collection('members').get();
+  return snap.docs.map(d => d.data().providerId).filter(Boolean);
+}
+
+// Clinic-wide inbox — every patient thread across the org's providers.
+// RBAC: only owner/admin (inbox.viewAll). Clinicians use their own /api/doctor/threads.
+app.get('/api/org/inbox', async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res, 'inbox.viewAll');
+    if (!membership) return;
+
+    const providerIds = await orgProviderIds(membership.orgId);
+    if (!providerIds.length) return res.json({ threads: [] });
+
+    const limit = Math.min(parseInt(req.query.limit, 10) || 50, 100);
+    const db = admin.firestore();
+    // Firestore 'in' supports up to 10 values; clinic seat caps keep us well under.
+    const snapshot = await db.collection('threads')
+      .where('doctorId', 'in', providerIds.slice(0, 10))
+      .orderBy('lastMessageAt', 'desc')
+      .limit(limit)
+      .get();
+
+    const threads = snapshot.docs.map(d => {
+      const t = d.data();
+      return {
+        id: d.id, doctorId: t.doctorId, status: t.status,
+        triageCategory: t.triageCategory, isEscalated: t.isEscalated,
+        lastUserMessage: t.lastUserMessage, lastMessageAt: t.lastMessageAt,
+        patientName: t.patientName || t.clientName || null
+      };
+    });
+    res.json({ threads, providerCount: providerIds.length });
+  } catch (error) {
+    console.error('Org inbox error:', error);
+    res.status(500).json({ error: 'Unable to load clinic inbox' });
+  }
+});
+
+// Clinic-wide aggregate analytics across all the org's providers.
+app.get('/api/org/analytics', async (req, res) => {
+  try {
+    const membership = await requireMembership(req, res, 'inbox.viewAll');
+    if (!membership) return;
+
+    const db = admin.firestore();
+    const membersSnap = await db.collection('organizations').doc(membership.orgId).collection('members').get();
+    const providerIds = membersSnap.docs.map(d => d.data().providerId).filter(Boolean);
+
+    let totalChats = 0, totalEscalations = 0;
+    // Fetch all member providers in parallel rather than serially (N+1 → 1 round-trip fan-out).
+    const providerDocs = await Promise.all(
+      providerIds.map(pid => db.collection('providers').doc(pid).get())
+    );
+    const perProvider = [];
+    for (const pDoc of providerDocs) {
+      if (!pDoc.exists) continue;
+      const p = pDoc.data();
+      const chats = p.totalChatCount || 0;
+      const esc = p.totalEscalationCount || 0;
+      totalChats += chats;
+      totalEscalations += esc;
+      perProvider.push({ providerId: pDoc.id, displayName: p.displayName || null, handle: p.handle || null, chats, escalations: esc });
+    }
+
+    res.json({
+      memberCount: membersSnap.size,
+      providerCount: providerIds.length,
+      totalChats,
+      totalEscalations,
+      escalationRate: totalChats > 0 ? Math.round((totalEscalations / totalChats) * 100) : 0,
+      perProvider
+    });
+  } catch (error) {
+    console.error('Org analytics error:', error);
+    res.status(500).json({ error: 'Unable to load clinic analytics' });
+  }
+});
+
+// Doctor thread API routes - with triage filtering (Component 2)
+app.get('/api/doctor/threads', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const limit = Math.min(parseInt(req.query.limit, 10) || 50, 100);
+    const status = req.query.status || null;
+    const triage = req.query.triage || null;
+    const search = req.query.q ? String(req.query.q).trim().toLowerCase() : null;
+
+    const db = admin.firestore();
+    let query = db
+      .collection('threads')
+      .where('doctorId', '==', providerDoc.id);
+
+    if (status) {
+      query = query.where('status', '==', status);
+    }
+
+    if (triage) {
+      query = query.where('triageCategory', '==', triage);
+    }
+
+    const fetchLimit = search ? 200 : limit;
+    const snapshot = await query
+      .orderBy('lastMessageAt', 'desc')
+      .limit(fetchLimit)
+      .get();
+
+    let threads = snapshot.docs.map((doc) => ({ id: doc.id, ...doc.data() }));
+
+    if (search) {
+      threads = threads.filter(t => {
+        const fields = [
+          t.patientName, t.clientName, t.patientEmail, t.clientEmail,
+          t.lastUserMessage, t.topic
+        ].filter(Boolean).map(f => String(f).toLowerCase());
+        return fields.some(f => f.includes(search));
+      }).slice(0, limit);
+    }
+
+    res.json({ threads });
+  } catch (error) {
+    console.error('Get threads error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+app.get('/api/doctor/thread/:threadId', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const threadId = req.params.threadId;
+    const db = admin.firestore();
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (!threadDoc.exists || threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Thread not found' });
+    }
+
+    const messagesSnapshot = await threadDoc.ref
+      .collection('messages')
+      .orderBy('createdAt', 'asc')
+      .limit(100)
+      .get();
+
+    const messages = messagesSnapshot.docs.map((doc) => ({
+      id: doc.id,
+      ...doc.data()
+    }));
+
+    // Mark as read by doctor
+    await threadDoc.ref.update({ unreadByDoctor: 0 });
+
+    // Audit log — doctor accessed patient thread
+    logAuditEvent({
+      action: 'view_thread',
+      actorId: user.uid,
+      actorType: 'doctor',
+      resourceType: 'thread',
+      resourceId: threadId
+    }).catch(() => {});
+
+    res.json({
+      thread: { id: threadDoc.id, ...threadDoc.data() },
+      messages
+    });
+  } catch (error) {
+    console.error('Get thread error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+app.post('/api/doctor/message', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { threadId, message, override } = req.body;
+
+    if (!threadId || !message) {
+      return res.status(400).json({ error: 'threadId and message are required' });
+    }
+    if (String(message).length > 10000) {
+      return res.status(400).json({ error: 'Message exceeds maximum length of 10000 characters' });
+    }
+
+    const db = admin.firestore();
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (!threadDoc.exists || threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Thread not found' });
+    }
+
+    // Add doctor's message
+    const messageData = {
+      threadId,
+      role: 'doctor',
+      message,
+      isDoctorManual: true,
+      doctorUserId: user.uid,
+      readByPatient: false,
+      readByDoctor: true,
+      wasFiltered: false,
+      isAiGenerated: false,
+      createdAt: admin.firestore.FieldValue.serverTimestamp()
+    };
+
+    await threadDoc.ref.collection('messages').add(messageData);
+
+    // Update thread
+    const threadData = threadDoc.data();
+    const updates = {
+      lastMessageAt: admin.firestore.FieldValue.serverTimestamp(),
+      lastMessageText: message.substring(0, 100),
+      lastMessageRole: 'doctor',
+      messageCount: admin.firestore.FieldValue.increment(1),
+      unreadByPatient: admin.firestore.FieldValue.increment(1),
+      updatedAt: admin.firestore.FieldValue.serverTimestamp(),
+      // Clear draft when doctor sends a manual message
+      aiDraftStatus: threadData.aiDraftResponse ? 'rejected' : null
+    };
+
+    if (override) {
+      updates.doctorOverride = true;
+    }
+
+    await threadDoc.ref.update(updates);
+
+    // Fire-and-forget: Capture doctor response as training signal (Component 5)
+    (async () => {
+      try {
+        // Get the patient's last message from the thread
+        const recentMessages = await threadDoc.ref.collection('messages')
+          .orderBy('createdAt', 'desc')
+          .limit(5)
+          .get();
+
+        const patientMsg = recentMessages.docs
+          .map(d => d.data())
+          .find(m => m.role === 'patient' || m.role === 'user');
+
+        if (patientMsg) {
+          await captureDoctorExample({
+            doctorId: providerDoc.id,
+            threadId,
+            topic: threadData.currentTopic,
+            patientMessage: patientMsg.message || patientMsg.content,
+            doctorResponse: message,
+            wasAiDraft: false,
+            aiDraftOriginal: null
+          });
+        }
+      } catch (err) {
+        console.error('[Feedback] Failed to capture doctor example:', err.message);
+      }
+    })();
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Send message error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+app.patch('/api/doctor/thread/:threadId', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const threadId = req.params.threadId;
+
+    const db = admin.firestore();
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (!threadDoc.exists || threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Thread not found' });
+    }
+
+    const updates = {};
+    const validStatuses = ['active', 'resolved', 'closed', 'archived'];
+    if (req.body.status && validStatuses.includes(req.body.status)) updates.status = req.body.status;
+    if (req.body.doctorOverride !== undefined) updates.doctorOverride = req.body.doctorOverride;
+    if (req.body.isEscalated !== undefined) updates.isEscalated = req.body.isEscalated;
+    // Allow manual triage override (Component 2)
+    if (req.body.triageCategory) {
+      const validCategories = ['urgent', 'needs_review', 'informational', 'resolved'];
+      if (validCategories.includes(req.body.triageCategory)) {
+        updates.triageCategory = req.body.triageCategory;
+        updates.triageConfidence = 1.0;
+        updates.triageReason = 'Manual override by doctor';
+        updates.triageUpdatedAt = admin.firestore.FieldValue.serverTimestamp();
+      }
+    }
+
+    if (Object.keys(updates).length > 0) {
+      updates.updatedAt = admin.firestore.FieldValue.serverTimestamp();
+      await threadDoc.ref.update(updates);
+    }
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Update thread error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get conversations (legacy)
+app.get('/api/conversations', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const limit = Math.min(parseInt(req.query.limit, 10) || 30, 50);
+    const offset = Math.max(parseInt(req.query.offset, 10) || 0, 0);
+    const filterEscalated = req.query.escalated;
+    const filterTopic = req.query.topic;
+    const filterSatisfaction = req.query.satisfaction;
+    const search = (req.query.q || '').toLowerCase().trim();
+    const db = admin.firestore();
+    let query = db
+      .collection('conversations')
+      .where('providerId', '==', providerDoc.id);
+
+    if (filterEscalated === 'true') {
+      query = query.where('isEscalated', '==', true);
+    }
+    if (filterTopic && TOPIC_KEYS.includes(filterTopic)) {
+      query = query.where('topic', '==', filterTopic);
+    }
+
+    query = query.orderBy('updatedAt', 'desc');
+
+    if (offset > 0) {
+      const skipSnap = await query.limit(offset).get();
+      if (!skipSnap.empty) {
+        const lastDoc = skipSnap.docs[skipSnap.docs.length - 1];
+        query = query.startAfter(lastDoc);
+      }
+    }
+
+    const snapshot = await query.limit(limit + 1).get();
+    const hasMore = snapshot.docs.length > limit;
+    const resultDocs = hasMore ? snapshot.docs.slice(0, limit) : snapshot.docs;
+
+    let conversations = resultDocs.map((doc) => ({ id: doc.id, ...doc.data() }));
+
+    if (search) {
+      conversations = conversations.filter(c =>
+        (c.lastUserMessage || '').toLowerCase().includes(search) ||
+        (c.clientName || '').toLowerCase().includes(search)
+      );
+    }
+
+    if (filterSatisfaction === 'high') {
+      conversations = conversations.filter(c => c.satisfactionRating >= 4);
+    } else if (filterSatisfaction === 'low') {
+      conversations = conversations.filter(c => c.satisfactionRating >= 1 && c.satisfactionRating <= 2);
+    } else if (filterSatisfaction === 'none') {
+      conversations = conversations.filter(c => !c.satisfactionRating);
+    }
+
+    res.json({ conversations, hasMore, offset, limit });
+  } catch (error) {
+    console.error('Error getting conversations:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get single conversation with messages (by ID in path)
+app.get('/api/conversation/:id', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const conversationId = String(req.params.id || '').trim();
+    if (!conversationId) {
+      return res.status(400).json({ error: 'Conversation id required' });
+    }
+
+    const db = admin.firestore();
+    const convoRef = db.collection('conversations').doc(conversationId);
+    const convoDoc = await convoRef.get();
+    if (!convoDoc.exists || convoDoc.data().providerId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+
+    const messagesSnapshot = await convoRef
+      .collection('messages')
+      .orderBy('createdAt', 'asc')
+      .limit(100)
+      .get();
+
+    const messages = messagesSnapshot.docs.map((doc) => ({
+      role: doc.data().role,
+      content: doc.data().content || doc.data().message,
+      createdAt: doc.data().createdAt
+    }));
+
+    const convoData = convoDoc.data();
+    res.json({
+      id: convoDoc.id,
+      topic: convoData.topic || null,
+      isEscalated: convoData.isEscalated || false,
+      satisfaction: convoData.satisfaction || null,
+      createdAt: convoData.createdAt,
+      updatedAt: convoData.updatedAt,
+      messages
+    });
+  } catch (error) {
+    console.error('Error getting conversation:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Doctor replies to a conversation
+app.post('/api/conversation/:id/reply', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const conversationId = String(req.params.id || '').trim();
+    if (!conversationId) {
+      return res.status(400).json({ error: 'Conversation id required' });
+    }
+
+    const { message } = req.body;
+    const trimmedMessage = String(message || '').trim();
+    if (!trimmedMessage) {
+      return res.status(400).json({ error: 'message is required' });
+    }
+    if (trimmedMessage.length > 10000) {
+      return res.status(400).json({ error: 'Message exceeds maximum length of 10000 characters' });
+    }
+
+    const db = admin.firestore();
+    const convoRef = db.collection('conversations').doc(conversationId);
+    const convoDoc = await convoRef.get();
+
+    if (!convoDoc.exists || convoDoc.data().providerId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+
+    // Add doctor's message to the conversation's messages subcollection
+    await convoRef.collection('messages').add({
+      role: 'doctor',
+      content: trimmedMessage,
+      isDoctorManual: true,
+      doctorUserId: user.uid,
+      createdAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    // Update conversation metadata
+    await convoRef.update({
+      lastAssistantMessage: trimmedMessage,
+      lastMessageAt: admin.firestore.FieldValue.serverTimestamp(),
+      updatedAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Error sending doctor reply:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get single conversation with messages (by ID in query - legacy)
+app.get('/api/conversation', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const conversationId = String(req.query.id || '').trim();
+    if (!conversationId) {
+      return res.status(400).json({ error: 'Conversation id required' });
+    }
+
+    const db = admin.firestore();
+    const convoRef = db.collection('conversations').doc(conversationId);
+    const convoDoc = await convoRef.get();
+    if (!convoDoc.exists || convoDoc.data().providerId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+
+    const messagesSnapshot = await convoRef
+      .collection('messages')
+      .orderBy('createdAt', 'asc')
+      .limit(100)
+      .get();
+
+    const messages = messagesSnapshot.docs.map((doc) => doc.data());
+    res.json({ conversation: { id: convoDoc.id, ...convoDoc.data() }, messages });
+  } catch (error) {
+    console.error('Error getting conversation:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get analytics
+app.get('/api/analytics', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const db = admin.firestore();
+    const snapshot = await db
+      .collection('providers')
+      .doc(providerDoc.id)
+      .collection('analyticsDaily')
+      .orderBy('updatedAt', 'desc')
+      .limit(14)
+      .get();
+
+    const daily = snapshot.docs.map((doc) => ({ date: doc.id, ...doc.data() }));
+
+    const questionBuckets = {};
+    const topicCounts = {};
+    daily.forEach((entry) => {
+      const buckets = entry.questionBuckets || {};
+      Object.entries(buckets).forEach(([key, value]) => {
+        questionBuckets[key] = (questionBuckets[key] || 0) + value;
+      });
+      const topics = entry.topicCounts || {};
+      Object.entries(topics).forEach(([key, value]) => {
+        topicCounts[key] = (topicCounts[key] || 0) + value;
+      });
+    });
+
+    const topQuestions = Object.entries(questionBuckets)
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, 5)
+      .map(([question, count]) => ({ question, count }));
+
+    const topTopics = Object.entries(topicCounts)
+      .sort((a, b) => b[1] - a[1])
+      .slice(0, 5)
+      .map(([topic, count]) => ({ topic, count }));
+
+    let satisfactionSum = 0;
+    let satisfactionCount = 0;
+    let totalChatCount = 0;
+    let totalEscalations = 0;
+    const allSessions = new Set();
+    daily.forEach((entry) => {
+      satisfactionSum += entry.satisfactionSum || 0;
+      satisfactionCount += entry.satisfactionCount || 0;
+      totalChatCount += entry.chatCount || 0;
+      totalEscalations += entry.escalationCount || 0;
+      // Unique sessions: new writer stores a `sessions` map ({id:true});
+      // keep array support for any legacy daily docs.
+      if (entry.sessions && typeof entry.sessions === 'object') {
+        Object.keys(entry.sessions).forEach(s => allSessions.add(s));
+      } else if (Array.isArray(entry.uniqueSessions)) {
+        entry.uniqueSessions.forEach(s => allSessions.add(s));
+      }
+    });
+
+    // Count total threads for this provider
+    const threadsSnapshot = await db.collection('threads')
+      .where('doctorId', '==', providerDoc.id)
+      .select()
+      .limit(1000)
+      .get();
+    const totalConversations = threadsSnapshot.size;
+
+    const providerData = providerDoc.data();
+
+    const escalationRate = totalChatCount > 0 ? Number(((totalEscalations / totalChatCount) * 100).toFixed(1)) : 0;
+    const resolvedCount = (providerData.draftsAccepted || 0) + (providerData.draftsEdited || 0);
+    const totalDrafts = resolvedCount + (providerData.draftsRejected || 0);
+    const resolutionRate = totalDrafts > 0 ? Number(((resolvedCount / totalDrafts) * 100).toFixed(1)) : null;
+
+    res.json({
+      provider: mapProviderPrivate({ id: providerDoc.id, ...providerData }),
+      daily,
+      topQuestions,
+      topTopics,
+      totalConversations,
+      uniquePatients: allSessions.size,
+      totalChatCount,
+      totalEscalations,
+      escalationRate,
+      resolutionRate,
+      satisfaction: {
+        average: satisfactionCount > 0 ? (satisfactionSum / satisfactionCount).toFixed(1) : null,
+        count: satisfactionCount
+      },
+      draftMetrics: {
+        accepted: providerData.draftsAccepted || 0,
+        edited: providerData.draftsEdited || 0,
+        rejected: providerData.draftsRejected || 0
+      }
+    });
+  } catch (error) {
+    console.error('Error getting analytics:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get safety events for provider
+app.get('/api/safety-events', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) return res.status(404).json({ error: 'Provider not found' });
+
+    const db = admin.firestore();
+    const limit = Math.min(parseInt(req.query.limit, 10) || 20, 100);
+    const snapshot = await db.collection('safetyEvents')
+      .where('providerId', '==', providerDoc.id)
+      .orderBy('createdAt', 'desc')
+      .limit(limit)
+      .get();
+
+    const events = snapshot.docs.map(doc => ({ id: doc.id, ...doc.data() }));
+    res.json({ events });
+  } catch (error) {
+    console.error('Error getting safety events:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Submit satisfaction rating
+app.post('/api/satisfaction', rateLimit({ maxRequests: 10, windowMs: 60000 }), async (req, res) => {
+  try {
+    const body = req.body || {};
+    const conversationId = String(body.conversationId || '').trim();
+    const sessionId = String(body.sessionId || '').trim();
+    const rating = Number(body.rating);
+
+    if (!conversationId || !sessionId || !Number.isFinite(rating) || rating < 1 || rating > 5) {
+      return res.status(400).json({ error: 'conversationId, sessionId and rating (1-5) are required' });
+    }
+
+    const db = admin.firestore();
+
+    // Ownership check: the rater must own the session tied to this conversation.
+    // The chat flow returns a thread id; legacy flows use the conversations
+    // collection. Verify against whichever exists — and never create a doc
+    // (set/merge on a missing id would let anyone fabricate conversations).
+    let targetRef = null;
+    const threadDoc = await db.collection('threads').doc(conversationId).get();
+    if (threadDoc.exists) {
+      if (threadDoc.data().sessionId !== sessionId) {
+        return res.status(403).json({ error: 'Forbidden' });
+      }
+      targetRef = threadDoc.ref;
+    } else {
+      const convoDoc = await db.collection('conversations').doc(conversationId).get();
+      if (!convoDoc.exists) {
+        return res.status(404).json({ error: 'Conversation not found' });
+      }
+      if (convoDoc.data().sessionId !== sessionId) {
+        return res.status(403).json({ error: 'Forbidden' });
+      }
+      targetRef = convoDoc.ref;
+    }
+
+    await targetRef.set({ satisfaction: rating, updatedAt: nowTimestamp() }, { merge: true });
+
+    res.json({ ok: true });
+  } catch (error) {
+    console.error('Error submitting satisfaction:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get chat history for a patient session (reads from unified threads collection)
+app.get('/api/chat/history', rateLimit({ maxRequests: 30, windowMs: 60000 }), async (req, res) => {
+  try {
+    const handle = String(req.query.handle || '').trim();
+    const sessionId = String(req.query.sessionId || '').trim();
+    const limit = Math.min(parseInt(req.query.limit, 10) || 50, 100);
+    const offset = Math.max(parseInt(req.query.offset, 10) || 0, 0);
+
+    if (!handle || !sessionId) {
+      return res.status(400).json({ error: 'handle and sessionId are required' });
+    }
+
+    const db = admin.firestore();
+
+    // Look up provider by handle
+    const handleDoc = await db.collection('handles').doc(handle).get();
+    if (!handleDoc.exists) {
+      return res.json({ messages: [], hasMore: false });
+    }
+    const providerId = handleDoc.data().providerId;
+
+    // Try unified thread first
+    const threadId = `thread_anon_${sessionId}_${providerId}`;
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (threadDoc.exists) {
+      let msgQuery = threadDoc.ref
+        .collection('messages')
+        .orderBy('createdAt', 'asc');
+
+      if (offset > 0) {
+        const skipSnap = await msgQuery.limit(offset).get();
+        if (!skipSnap.empty) {
+          msgQuery = msgQuery.startAfter(skipSnap.docs[skipSnap.docs.length - 1]);
+        }
+      }
+
+      const messagesSnapshot = await msgQuery.limit(limit + 1).get();
+      const hasMore = messagesSnapshot.docs.length > limit;
+      const docs = hasMore ? messagesSnapshot.docs.slice(0, limit) : messagesSnapshot.docs;
+
+      const messages = docs.map(doc => {
+        const data = doc.data();
+        return {
+          role: data.role === 'patient' ? 'user' : (data.role === 'ai' ? 'assistant' : data.role),
+          content: data.content || data.message,
+          createdAt: data.createdAt
+        };
+      });
+
+      return res.json({ conversationId: threadId, messages, hasMore });
+    }
+
+    // Fallback: check legacy conversations collection
+    const convosSnapshot = await db.collection('conversations')
+      .where('providerId', '==', providerId)
+      .where('sessionId', '==', sessionId)
+      .limit(5)
+      .get();
+
+    if (convosSnapshot.empty) {
+      return res.json({ messages: [], hasMore: false });
+    }
+
+    const convoDoc = convosSnapshot.docs.sort((a, b) => {
+      const aTime = a.data().lastMessageAt?._seconds || 0;
+      const bTime = b.data().lastMessageAt?._seconds || 0;
+      return bTime - aTime;
+    })[0];
+
+    let msgQuery = convoDoc.ref
+      .collection('messages')
+      .orderBy('createdAt', 'asc');
+
+    if (offset > 0) {
+      const skipSnap = await msgQuery.limit(offset).get();
+      if (!skipSnap.empty) {
+        msgQuery = msgQuery.startAfter(skipSnap.docs[skipSnap.docs.length - 1]);
+      }
+    }
+
+    const messagesSnapshot = await msgQuery.limit(limit + 1).get();
+    const hasMore = messagesSnapshot.docs.length > limit;
+    const docs = hasMore ? messagesSnapshot.docs.slice(0, limit) : messagesSnapshot.docs;
+
+    const messages = docs.map(doc => ({
+      role: doc.data().role,
+      content: doc.data().content,
+      createdAt: doc.data().createdAt
+    }));
+
+    res.json({ conversationId: convoDoc.id, messages, hasMore });
+  } catch (error) {
+    console.error('Error fetching chat history:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Chat endpoint (main conversation handler) - Unified model: writes to threads collection
+app.post('/api/chat', rateLimit({ maxRequests: 20, windowMs: 60000 }), async (req, res) => {
+  try {
+    const body = req.body || {};
+    const handle = normalizeHandle(body.handle || '');
+    const message = String(body.message || '').trim();
+    const sessionId = String(body.sessionId || '').trim();
+    const requestedTopic = body.topic ? String(body.topic) : null;
+    // Strip HTML from patient-supplied identity fields — they render in the
+    // authenticated doctor console, so raw markup would be a stored-XSS vector.
+    const clientName = body.clientName ? stripHtml(String(body.clientName)).substring(0, 120) : null;
+    const clientPhone = body.clientPhone ? stripHtml(String(body.clientPhone)).substring(0, 40) : null;
+    let clientEmail = body.clientEmail ? stripHtml(String(body.clientEmail)).trim().toLowerCase() : null;
+    if (clientEmail && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(clientEmail)) clientEmail = null;
+
+    if (!handle || !message || !sessionId) {
+      return res.status(400).json({ error: 'handle, sessionId, and message are required' });
+    }
+    if (message.length > 5000) {
+      return res.status(400).json({ error: 'Message too long (max 5000 characters)' });
+    }
+
+    const MAX_MESSAGE_LENGTH = 5000;
+    if (message.length > MAX_MESSAGE_LENGTH) {
+      return res.status(400).json({ error: `Message too long. Maximum ${MAX_MESSAGE_LENGTH} characters.` });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+    if (provider.status === 'suspended') {
+      return res.status(403).json({ error: 'This provider has been suspended and is not accepting chats at this time.' });
+    }
+    if (provider.status !== 'published' && provider.status !== 'preview') {
+      return res.status(403).json({ error: 'This provider is not currently accepting chats. Please check back later.' });
+    }
+
+    // Check monthly limit FIRST — clearer error than payment required
+    const limitCheck = await checkMonthlyLimit({ providerDoc });
+    if (!limitCheck.allowed) {
+      return res.status(429).json({ error: limitCheck.message });
+    }
+
+    if (limitCheck.resetNeeded) {
+      const db0 = admin.firestore();
+      await db0.runTransaction(async (tx) => {
+        const freshDoc = await tx.get(providerDoc.ref);
+        const freshData = freshDoc.data();
+        if (freshData.monthlyChatCountMonth !== limitCheck.currentMonth) {
+          tx.update(providerDoc.ref, {
+            monthlyChatCount: 0,
+            monthlyChatCountMonth: limitCheck.currentMonth,
+            updatedAt: nowTimestamp()
+          });
+        }
+      });
+    }
+
+    // Payment access check (after limit check)
+    if (provider.paymentEnabled && provider.pricingModel !== 'free') {
+      const accessResult = await checkPaymentAccess({
+        providerId: providerDoc.id,
+        patientId: sessionId,
+        conversationId: body.conversationId || null
+      });
+
+      if (!accessResult.hasAccess) {
+        return res.status(402).json({
+          error: 'Payment required',
+          paymentRequired: true,
+          paymentConfig: {
+            pricingModel: provider.pricingModel,
+            subscriptionPrice: provider.subscriptionPrice || 0,
+            perChatPrice: provider.perChatPrice || 0,
+            currency: provider.currency || 'usd',
+            handle,
+            stripePublishableKey: process.env.STRIPE_PUBLISHABLE_KEY
+          }
+        });
+      }
+    }
+
+    const enabledTopics = Array.isArray(provider.enabledTopics)
+      ? provider.enabledTopics
+      : TOPIC_KEYS;
+    const topicKey = resolveTopic({
+      requestedTopic,
+      enabledTopics,
+      message
+    });
+    const topicConfig = TOPICS[topicKey] || TOPICS[TOPIC_KEYS[0]];
+
+    const inputSafety = await analyzeInput(message, topicConfig);
+    const db = admin.firestore();
+
+    // Unified model: use threads collection for all conversations (anonymous + authenticated)
+    const threadId = `thread_anon_${sessionId}_${providerDoc.id}`;
+    const threadRef = db.collection('threads').doc(threadId);
+    const threadDoc = await threadRef.get();
+
+    if (!threadDoc.exists) {
+      // Create new thread for anonymous patient
+      const threadData = {
+        patientId: `anon_${sessionId}`,
+        patientEmail: clientEmail || null,
+        patientName: clientName || null,
+        patientPhoto: null,
+        patientSource: 'anonymous',
+        sessionId,
+        clientPhone: clientPhone || null,
+
+        doctorId: providerDoc.id,
+        doctorName: provider.displayName,
+        doctorHandle: handle,
+
+        status: 'active',
+        isEscalated: false,
+        doctorOverride: false,
+
+        lastMessageAt: nowTimestamp(),
+        lastMessageText: null,
+        lastMessageRole: null,
+
+        unreadByPatient: 0,
+        unreadByDoctor: 0,
+        messageCount: 0,
+
+        currentTopic: topicKey,
+
+        isPaid: false,
+        paymentId: null,
+
+        // Phase 2 fields
+        triageCategory: null,
+        triageConfidence: null,
+        triageReason: null,
+        triageUpdatedAt: null,
+
+        aiDraftResponse: null,
+        aiDraftGeneratedAt: null,
+        aiDraftStatus: null,
+
+        lastDoctorNotifiedAt: null,
+        doctorResponseFedBack: false,
+        feedbackProcessedAt: null,
+
+        createdAt: nowTimestamp(),
+        updatedAt: nowTimestamp()
+      };
+
+      await threadRef.set(threadData);
+    } else {
+      // Update existing thread with client contact info if provided
+      const updateData = { updatedAt: nowTimestamp() };
+      const existingData = threadDoc.data();
+
+      if (clientName && !existingData.patientName) updateData.patientName = clientName;
+      if (clientEmail && !existingData.patientEmail) updateData.patientEmail = clientEmail;
+      if (clientPhone && !existingData.clientPhone) updateData.clientPhone = clientPhone;
+      if (topicKey) updateData.currentTopic = topicKey;
+
+      await threadRef.update(updateData);
+    }
+
+    const messagesRef = threadRef.collection('messages');
+    const redactedInput = redactText(message);
+
+    // Fetch conversation history (last 10 messages) for multi-turn context
+    const historySnapshot = await messagesRef
+      .orderBy('createdAt', 'asc')
+      .limitToLast(10)
+      .get();
+
+    const conversationHistory = historySnapshot.docs.map(doc => {
+      const data = doc.data();
+      return {
+        role: (data.role === 'user' || data.role === 'patient') ? 'user' : 'assistant',
+        content: data.content || data.message
+      };
+    });
+
+    // Save patient message
+    await messagesRef.add({
+      threadId,
+      role: 'patient',
+      message: redactedInput,
+      content: redactedInput,
+      safetyFlags: inputSafety.flags,
+      readByPatient: true,
+      readByDoctor: false,
+      isAiGenerated: false,
+      createdAt: nowTimestamp()
+    });
+
+    let responseText = '';
+    let escalated = inputSafety.escalated;
+    let safetyFlags = [...inputSafety.flags];
+
+    if (inputSafety.blocked) {
+      responseText = refusalMessage();
+      safetyFlags.push('blocked_input');
+    } else {
+      // Retrieve doctor examples for personalized responses (Component 5)
+      let doctorExamples = [];
+      try {
+        doctorExamples = await retrieveRelevantExamples({
+          doctorId: providerDoc.id,
+          topic: topicKey,
+          limit: 3
+        });
+      } catch (err) {
+        console.error('Failed to retrieve doctor examples:', err.message);
+      }
+
+      // Generate LLM response with conversation history + doctor examples
+      responseText = await generateResponse({
+        topicConfig, message, provider, conversationHistory, doctorExamples
+      });
+      const outputSafety = analyzeOutput(responseText, topicConfig);
+      if (outputSafety.blocked) {
+        responseText = refusalMessage();
+        safetyFlags = safetyFlags.concat(outputSafety.flags);
+      }
+
+      // Add urgent care notice if escalated
+      if (inputSafety.escalated) {
+        responseText = `⚠️ URGENT: ${escalationMessage()}\n\n${responseText}`;
+        safetyFlags.push('escalated');
+      }
+    }
+
+    responseText = `${responseText} ${topicConfig.disclaimer}`.trim();
+    const redactedOutput = redactText(responseText);
+
+    // Save AI response
+    await messagesRef.add({
+      threadId,
+      role: 'ai',
+      message: redactedOutput,
+      content: redactedOutput,
+      safetyFlags,
+      readByPatient: true,
+      readByDoctor: false,
+      isAiGenerated: true,
+      createdAt: nowTimestamp()
+    });
+
+    // Safety events
+    if (inputSafety.flags.length) {
+      await db.collection('safetyEvents').add({
+        providerId: providerDoc.id,
+        threadId,
+        eventType: inputSafety.blocked ? 'blocked_input' : 'pii_detected',
+        details: { flags: inputSafety.flags },
+        createdAt: nowTimestamp()
+      });
+    }
+
+    if (safetyFlags.includes('blocked_output')) {
+      await db.collection('safetyEvents').add({
+        providerId: providerDoc.id,
+        threadId,
+        eventType: 'blocked_output',
+        details: { flags: safetyFlags },
+        createdAt: nowTimestamp()
+      });
+    }
+
+    if (escalated) {
+      await db.collection('safetyEvents').add({
+        providerId: providerDoc.id,
+        threadId,
+        eventType: 'escalated',
+        details: { reason: 'red_flag' },
+        createdAt: nowTimestamp()
+      });
+    }
+
+    // Update thread metadata
+    const threadUpdate = {
+      isEscalated: escalated || false,
+      lastMessageAt: nowTimestamp(),
+      lastMessageText: redactedInput.substring(0, 100),
+      lastMessageRole: 'ai',
+      messageCount: admin.firestore.FieldValue.increment(2),
+      unreadByDoctor: admin.firestore.FieldValue.increment(1),
+      updatedAt: nowTimestamp()
+    };
+    if (escalated) {
+      threadUpdate.escalationReason = inputSafety.blocked ? 'blocked_input' : 'red_flag';
+    }
+    await threadRef.update(threadUpdate);
+
+    // Fire-and-forget: Triage classification (Component 2)
+    const allMessages = [
+      ...conversationHistory,
+      { role: 'user', content: redactedInput },
+      { role: 'assistant', content: redactedOutput }
+    ];
+
+    classifyConversation({ messages: allMessages, isEscalated: escalated })
+      .then(async (triage) => {
+        console.log(`[Triage] Thread ${threadId}: ${triage.category} (${triage.confidence})`);
+        const triageUpdate = {
+          triageCategory: triage.category,
+          triageConfidence: triage.confidence,
+          triageReason: triage.reason,
+          triageUpdatedAt: admin.firestore.FieldValue.serverTimestamp()
+        };
+        await threadRef.update(triageUpdate);
+
+        // If urgent or needs_review, generate doctor draft (Component 3)
+        if (triage.category === 'urgent' || triage.category === 'needs_review') {
+          try {
+            let draftExamples = [];
+            try {
+              draftExamples = await retrieveRelevantExamples({
+                doctorId: providerDoc.id,
+                topic: topicKey,
+                limit: 3
+              });
+            } catch (e) { /* ignore */ }
+
+            const draftResult = await generateDoctorDraft({
+              messages: allMessages,
+              provider,
+              topic: topicKey,
+              triageCategory: triage.category,
+              doctorExamples: draftExamples
+            });
+
+            if (draftResult) {
+              await threadRef.update({
+                aiDraftResponse: draftResult.draft,
+                aiDraftGeneratedAt: admin.firestore.FieldValue.serverTimestamp(),
+                aiDraftStatus: 'pending'
+              });
+              console.log(`[Drafts] Generated draft for thread ${threadId}`);
+
+              // Notify doctor about draft (Component 4)
+              notifyDraftReady({
+                doctorId: providerDoc.id,
+                threadId,
+                patientName: clientName
+              }).catch(err => console.error('[Notifications] Draft notification failed:', err.message));
+            }
+          } catch (draftErr) {
+            console.error('[Drafts] Draft generation failed:', draftErr.message);
+          }
+
+          // Notify escalation (Component 4)
+          if (triage.category === 'urgent') {
+            notifyEscalation({
+              doctorId: providerDoc.id,
+              threadId,
+              patientName: clientName,
+              reason: triage.reason
+            }).catch(err => console.error('[Notifications] Escalation notification failed:', err.message));
+          }
+        }
+      })
+      .catch(err => console.error('[Triage] Classification failed:', err.message));
+
+    // Increment provider monthly chat count (critical for billing/limit enforcement)
+    try {
+      await providerDoc.ref.update({
+        monthlyChatCount: admin.firestore.FieldValue.increment(1),
+        updatedAt: nowTimestamp()
+      });
+    } catch (countErr) {
+      console.error('Monthly count increment failed:', countErr.message);
+    }
+
+    // Analytics
+    try {
+      await incrementAnalytics({
+        providerId: providerDoc.id,
+        sessionId,
+        escalated,
+        satisfaction: null,
+        topicKey,
+        message: redactedInput
+      });
+    } catch (analyticsErr) {
+      console.error('Analytics update failed:', analyticsErr.message);
+    }
+
+    // Audit log — record PHI access
+    logAuditEvent({
+      action: 'chat_message',
+      actorId: sessionId,
+      actorType: 'patient',
+      resourceType: 'thread',
+      resourceId: threadId,
+      meta: { providerId: providerDoc.id, escalated, topicKey }
+    }).catch(() => {});
+
+    res.json({
+      conversationId: threadId,
+      response: redactedOutput,
+      escalation: escalated,
+      safetyFlags,
+      topic: topicKey
+    });
+  } catch (error) {
+    console.error('Error in chat:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// ============================================
+// PHASE 2: DOCTOR ASYNC RESPONSE PIPELINE ENDPOINTS
+// ============================================
+
+// --- Component 3: AI Draft Management ---
+
+// Accept AI draft (optionally with edits)
+app.post('/api/doctor/draft/accept', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { threadId, editedMessage } = req.body;
+    if (!threadId) {
+      return res.status(400).json({ error: 'threadId is required' });
+    }
+
+    const db = admin.firestore();
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (!threadDoc.exists || threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Thread not found' });
+    }
+
+    const threadData = threadDoc.data();
+    if (!threadData.aiDraftResponse) {
+      return res.status(400).json({ error: 'No draft available' });
+    }
+
+    // Use edited message or original draft
+    const finalMessage = editedMessage ? String(editedMessage).trim() : threadData.aiDraftResponse;
+
+    // Add as doctor message
+    await threadDoc.ref.collection('messages').add({
+      threadId,
+      role: 'doctor',
+      message: finalMessage,
+      isDoctorManual: false,
+      doctorUserId: user.uid,
+      readByPatient: false,
+      readByDoctor: true,
+      wasFiltered: false,
+      isAiGenerated: true,
+      aiDraftAccepted: true,
+      createdAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    const draftAction = editedMessage ? 'edited' : 'accepted';
+    await threadDoc.ref.update({
+      aiDraftStatus: draftAction,
+      lastMessageAt: admin.firestore.FieldValue.serverTimestamp(),
+      lastMessageText: finalMessage.substring(0, 100),
+      lastMessageRole: 'doctor',
+      messageCount: admin.firestore.FieldValue.increment(1),
+      unreadByPatient: admin.firestore.FieldValue.increment(1),
+      updatedAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    // Track draft acceptance metrics on provider
+    const draftMetricField = draftAction === 'accepted' ? 'draftsAccepted' : 'draftsEdited';
+    providerDoc.ref.update({
+      [draftMetricField]: admin.firestore.FieldValue.increment(1)
+    }).catch(() => {});
+
+    // Capture as feedback (Component 5)
+    (async () => {
+      try {
+        const recentMessages = await threadDoc.ref.collection('messages')
+          .orderBy('createdAt', 'desc')
+          .limit(5)
+          .get();
+
+        const patientMsg = recentMessages.docs
+          .map(d => d.data())
+          .find(m => m.role === 'patient' || m.role === 'user');
+
+        if (patientMsg) {
+          await captureDoctorExample({
+            doctorId: providerDoc.id,
+            threadId,
+            topic: threadData.currentTopic,
+            patientMessage: patientMsg.message || patientMsg.content,
+            doctorResponse: finalMessage,
+            wasAiDraft: true,
+            aiDraftOriginal: threadData.aiDraftResponse
+          });
+        }
+      } catch (err) {
+        console.error('[Feedback] Failed to capture draft acceptance:', err.message);
+      }
+    })();
+
+    logAuditEvent({
+      action: editedMessage ? 'draft_edited' : 'draft_accepted',
+      actorId: user.uid,
+      actorType: 'doctor',
+      resourceType: 'thread',
+      resourceId: threadId,
+      meta: { providerId: providerDoc.id }
+    }).catch(() => {});
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Accept draft error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Reject AI draft
+app.post('/api/doctor/draft/reject', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { threadId } = req.body;
+    if (!threadId) {
+      return res.status(400).json({ error: 'threadId is required' });
+    }
+
+    const db = admin.firestore();
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (!threadDoc.exists || threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Thread not found' });
+    }
+
+    await threadDoc.ref.update({
+      aiDraftStatus: 'rejected',
+      updatedAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    providerDoc.ref.update({
+      draftsRejected: admin.firestore.FieldValue.increment(1)
+    }).catch(() => {});
+
+    logAuditEvent({
+      action: 'draft_rejected',
+      actorId: user.uid,
+      actorType: 'doctor',
+      resourceType: 'thread',
+      resourceId: threadId,
+      meta: { providerId: providerDoc.id }
+    }).catch(() => {});
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Reject draft error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Regenerate AI draft
+app.post('/api/doctor/draft/regenerate', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { threadId } = req.body;
+    if (!threadId) {
+      return res.status(400).json({ error: 'threadId is required' });
+    }
+
+    const db = admin.firestore();
+    const threadDoc = await db.collection('threads').doc(threadId).get();
+
+    if (!threadDoc.exists || threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(404).json({ error: 'Thread not found' });
+    }
+
+    const threadData = threadDoc.data();
+    const provider = providerDoc.data();
+
+    // Get thread messages for context
+    const messagesSnapshot = await threadDoc.ref.collection('messages')
+      .orderBy('createdAt', 'asc')
+      .limit(20)
+      .get();
+
+    const messages = messagesSnapshot.docs.map(doc => {
+      const data = doc.data();
+      return {
+        role: (data.role === 'patient' || data.role === 'user') ? 'user' : 'assistant',
+        content: data.content || data.message
+      };
+    });
+
+    // Get doctor examples
+    let doctorExamples = [];
+    try {
+      doctorExamples = await retrieveRelevantExamples({
+        doctorId: providerDoc.id,
+        topic: threadData.currentTopic,
+        limit: 3
+      });
+    } catch (e) { /* ignore */ }
+
+    const draftResult = await generateDoctorDraft({
+      messages,
+      provider,
+      topic: threadData.currentTopic,
+      triageCategory: threadData.triageCategory || 'needs_review',
+      doctorExamples
+    });
+
+    if (!draftResult) {
+      return res.status(500).json({ error: 'Failed to generate draft' });
+    }
+
+    await threadDoc.ref.update({
+      aiDraftResponse: draftResult.draft,
+      aiDraftGeneratedAt: admin.firestore.FieldValue.serverTimestamp(),
+      aiDraftStatus: 'pending',
+      updatedAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    logAuditEvent({
+      action: 'draft_regenerated',
+      actorId: user.uid,
+      actorType: 'doctor',
+      resourceType: 'thread',
+      resourceId: threadId,
+      meta: { providerId: providerDoc.id }
+    }).catch(() => {});
+
+    res.json({ success: true, draft: draftResult.draft });
+  } catch (error) {
+    console.error('Regenerate draft error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// --- Component 4: Notification Endpoints ---
+
+// Get notifications
+app.get('/api/doctor/notifications', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const limit = Math.min(parseInt(req.query.limit, 10) || 20, 50);
+    const notifications = await getNotifications({ doctorId: providerDoc.id, limit });
+    const unreadCount = await getUnreadCount({ doctorId: providerDoc.id });
+
+    res.json({ notifications, unreadCount });
+  } catch (error) {
+    console.error('Get notifications error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Mark notification as read
+app.post('/api/doctor/notifications/read', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { notificationId } = req.body;
+
+    if (notificationId) {
+      await markNotificationRead({ notificationId, doctorId: providerDoc.id });
+    } else {
+      await markAllNotificationsRead({ doctorId: providerDoc.id });
+    }
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Mark notification read error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Update notification preferences
+app.post('/api/doctor/notifications/preferences', express.json(), async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const prefs = req.body || {};
+    const validPrefs = {};
+
+    if (typeof prefs.emailEnabled === 'boolean') validPrefs.emailEnabled = prefs.emailEnabled;
+    if (typeof prefs.pushEnabled === 'boolean') validPrefs.pushEnabled = prefs.pushEnabled;
+    if (typeof prefs.escalationNotify === 'boolean') validPrefs.escalationNotify = prefs.escalationNotify;
+    if (typeof prefs.unreadNotify === 'boolean') validPrefs.unreadNotify = prefs.unreadNotify;
+    if (typeof prefs.dailyDigestEnabled === 'boolean') validPrefs.dailyDigestEnabled = prefs.dailyDigestEnabled;
+    if (typeof prefs.unreadDelayMinutes === 'number') validPrefs.unreadDelayMinutes = Math.max(1, Math.min(60, prefs.unreadDelayMinutes));
+    if (typeof prefs.email === 'string') validPrefs.email = prefs.email.trim();
+
+    await providerDoc.ref.update({
+      notificationPreferences: validPrefs,
+      updatedAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    logAuditEvent({
+      action: 'notification_preferences_updated',
+      actorId: user.uid,
+      actorType: 'doctor',
+      resourceType: 'provider',
+      resourceId: providerDoc.id,
+      meta: { preferences: validPrefs }
+    }).catch(() => {});
+
+    res.json({ success: true, preferences: validPrefs });
+  } catch (error) {
+    console.error('Update notification preferences error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Trigger daily digest (can be called by cron/scheduler)
+app.post('/api/internal/daily-digest', rateLimit({ maxRequests: 5, windowMs: 3600000 }), express.json(), async (req, res) => {
+  try {
+    // Require INTERNAL_API_KEY — deny access if not configured or mismatch.
+    // Use a constant-time comparison to avoid leaking the key via timing.
+    const apiKey = String(req.headers['x-api-key'] || '');
+    const expected = String(process.env.INTERNAL_API_KEY || '');
+    const valid = expected.length > 0 &&
+      apiKey.length === expected.length &&
+      crypto.timingSafeEqual(Buffer.from(apiKey), Buffer.from(expected));
+    if (!valid) {
+      return res.status(401).json({ error: 'Unauthorized' });
+    }
+
+    const db = admin.firestore();
+    const providersSnapshot = await db.collection('providers')
+      .where('status', '==', 'published')
+      .get();
+
+    const results = [];
+    for (const doc of providersSnapshot.docs) {
+      const prefs = doc.data().notificationPreferences || {};
+      if (prefs.dailyDigestEnabled !== false) {
+        const result = await generateDailyDigest({ doctorId: doc.id });
+        results.push({ doctorId: doc.id, result });
+      }
+    }
+
+    res.json({ success: true, digests: results.length });
+  } catch (error) {
+    console.error('Daily digest error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// --- Component 5: Feedback Stats ---
+
+// Get feedback statistics for a doctor
+app.get('/api/doctor/feedback/stats', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const stats = await getFeedbackStats({ doctorId: providerDoc.id });
+    res.json(stats);
+  } catch (error) {
+    console.error('Get feedback stats error:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// ============================================
+// WAITLIST
+// ============================================
+
+// Public: check launch status
+app.get('/api/launch-status', (req, res) => {
+  const now = new Date();
+  res.json({
+    launchDate: LAUNCH_DATE.toISOString(),
+    isOpen: now >= LAUNCH_DATE
+  });
+});
+
+// Public: join waitlist
+app.post('/api/waitlist', rateLimit({ maxRequests: 5, windowMs: 60000 }), async (req, res) => {
+  try {
+    const { ok, value } = validate({
+      email: { type: 'email', required: true },
+      name: { type: 'string', maxLength: 100 },
+      specialty: { type: 'string', maxLength: 100 },
+      country: { type: 'string', maxLength: 60 }
+    }, req.body || {});
+    if (!ok) {
+      return res.status(400).json({ error: 'Valid email required' });
+    }
+
+    const db = admin.firestore();
+    // Deduplicate by email (validator already lowercased + trimmed it)
+    const existing = await db.collection('waitlist').where('email', '==', value.email).limit(1).get();
+    if (!existing.empty) {
+      return res.json({ status: 'already_registered' });
+    }
+
+    await db.collection('waitlist').add({
+      email: value.email,
+      name: value.name || null,
+      specialty: value.specialty || null,
+      country: value.country || null,
+      approved: false,
+      createdAt: admin.firestore.FieldValue.serverTimestamp()
+    });
+
+    console.log(`[Waitlist] New signup: ${value.email}`);
+    res.json({ status: 'registered' });
+  } catch (error) {
+    console.error('Waitlist signup error:', error);
+    res.status(500).json({ error: 'Failed to join waitlist' });
+  }
+});
+
+// ============================================
+// STRIPE DIAGNOSTICS
+// ============================================
+
+// Check Stripe configuration and connectivity (requires auth)
+app.get('/api/stripe/diagnostics', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const checks = {
+      paymentConfigured: !!process.env.STRIPE_SECRET_KEY,
+      mode: process.env.STRIPE_SECRET_KEY
+        ? (process.env.STRIPE_SECRET_KEY.startsWith('sk_live_') ? 'live' : 'test')
+        : null,
+      webhookConfigured: !!process.env.STRIPE_WEBHOOK_SECRET,
+      apiReachable: false
+    };
+
+    try {
+      await stripe.accounts.list({ limit: 1 });
+      checks.apiReachable = true;
+    } catch (err) {
+      checks.apiReachable = false;
+    }
+
+    res.json(checks);
+  } catch (error) {
+    res.status(500).json({ error: 'Diagnostics check failed' });
+  }
+});
+
+// ============================================
+// STRIPE CONNECT API ENDPOINTS
+// ============================================
+
+// Create Stripe Connect account for provider
+app.post('/api/stripe/create-connect-account', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+
+    // Check if already has Connect account
+    if (provider.stripeAccountId) {
+      return res.json({
+        accountId: provider.stripeAccountId,
+        onboardingStatus: provider.stripeOnboardingStatus || 'PENDING'
+      });
+    }
+
+    const result = await createConnectAccount({
+      providerId: providerDoc.id,
+      email: user.email,
+      displayName: provider.displayName,
+      country: provider.country || 'US'
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error creating Connect account:', error);
+    res.status(500).json({ error: 'Failed to create Connect account' });
+  }
+});
+
+// Create onboarding link for Connect account
+app.post('/api/stripe/create-account-link', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+
+    if (!provider.stripeAccountId) {
+      return res.status(400).json({ error: 'No Stripe Connect account found' });
+    }
+
+    const result = await createAccountLink({
+      stripeAccountId: provider.stripeAccountId,
+      providerId: providerDoc.id
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error creating account link:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Refresh Connect account status
+app.post('/api/stripe/refresh-account-status', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+
+    if (!provider.stripeAccountId) {
+      return res.status(400).json({ error: 'No Stripe Connect account found' });
+    }
+
+    const result = await refreshAccountStatus({
+      providerId: providerDoc.id,
+      stripeAccountId: provider.stripeAccountId
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error refreshing account status:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Set provider pricing (creates Stripe Products/Prices)
+app.post('/api/stripe/set-pricing', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+
+    if (!provider.stripeAccountId) {
+      return res.status(400).json({ error: 'Must complete Stripe Connect onboarding first' });
+    }
+
+    if (!provider.chargesEnabled) {
+      return res.status(400).json({ error: 'Stripe account not yet approved for charges' });
+    }
+
+    const { currency = 'usd', prices } = req.body;
+    const validCurrencies = ['usd', 'eur', 'gbp', 'cad', 'aud'];
+
+    if (!validCurrencies.includes(String(currency).toLowerCase())) {
+      return res.status(400).json({ error: `Invalid currency. Supported: ${validCurrencies.join(', ')}` });
+    }
+
+    if (!prices || typeof prices !== 'object' || Array.isArray(prices)) {
+      return res.status(400).json({ error: 'Invalid prices format' });
+    }
+
+    for (const [key, val] of Object.entries(prices)) {
+      if (typeof val === 'number' && (val < 0 || val > 100000)) {
+        return res.status(400).json({ error: `Price "${key}" must be between 0 and 100000` });
+      }
+    }
+
+    const result = await setProviderPricing({
+      providerId: providerDoc.id,
+      stripeAccountId: provider.stripeAccountId,
+      currency,
+      prices,
+      displayName: provider.displayName
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error setting pricing:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// ============================================
+// PAYMENT API ENDPOINTS
+// ============================================
+
+// Get provider pricing configuration
+app.get('/api/payment/config/:handle', async (req, res) => {
+  try {
+    const handle = normalizeHandle(req.params.handle);
+    const providerDoc = await findProviderByHandle(handle);
+
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+    if (provider.status !== 'published' && provider.status !== 'preview') {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    res.json({
+      pricingModel: provider.pricingModel || 'free',
+      subscriptionPrice: provider.subscriptionPrice || 0,
+      perChatPrice: provider.perChatPrice || 0,
+      paymentEnabled: provider.paymentEnabled || false,
+      currency: provider.currency || 'usd',
+      stripePublishableKey: process.env.STRIPE_PUBLISHABLE_KEY
+    });
+  } catch (error) {
+    console.error('Error getting payment config:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Update provider pricing configuration (requires auth)
+app.post('/api/payment/update-pricing', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const {
+      pricingModel,
+      subscriptionPrice,
+      perChatPrice,
+      paymentEnabled
+    } = req.body;
+
+    // Validate pricing model
+    const validModels = ['free', 'subscription', 'per-chat', 'hybrid'];
+    if (pricingModel && !validModels.includes(pricingModel)) {
+      return res.status(400).json({ error: 'Invalid pricing model' });
+    }
+
+    // Validate prices — coerce to a finite number first so string inputs like
+    // "999999" can't slip past the numeric range check and be stored verbatim.
+    let subPrice, chatPrice;
+    if (subscriptionPrice !== undefined) {
+      subPrice = Number(subscriptionPrice);
+      if (!Number.isFinite(subPrice) || subPrice < 0 || subPrice > 10000) {
+        return res.status(400).json({ error: 'Invalid subscription price' });
+      }
+    }
+    if (perChatPrice !== undefined) {
+      chatPrice = Number(perChatPrice);
+      if (!Number.isFinite(chatPrice) || chatPrice < 0 || chatPrice > 1000) {
+        return res.status(400).json({ error: 'Invalid per-chat price' });
+      }
+    }
+
+    const updates = {
+      updatedAt: nowTimestamp()
+    };
+
+    if (pricingModel !== undefined) updates.pricingModel = pricingModel;
+    if (subscriptionPrice !== undefined) updates.subscriptionPrice = subPrice;
+    if (perChatPrice !== undefined) updates.perChatPrice = chatPrice;
+    if (paymentEnabled !== undefined) updates.paymentEnabled = paymentEnabled;
+    if (!updates.currency) updates.currency = 'usd';
+
+    await providerDoc.ref.update(updates);
+
+    res.json({ ok: true, updates });
+  } catch (error) {
+    console.error('Error updating pricing:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Create payment intent for per-chat payment
+app.post('/api/payment/create-intent', rateLimit({ maxRequests: 15, windowMs: 60000 }), async (req, res) => {
+  try {
+    const { handle, sessionId, conversationId } = req.body;
+
+    if (!handle || !sessionId) {
+      return res.status(400).json({ error: 'handle and sessionId required' });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+    if (!provider.paymentEnabled || !provider.perChatPrice) {
+      return res.status(400).json({ error: 'Per-chat payment not enabled' });
+    }
+
+    if (!provider.stripeAccountId) {
+      return res.status(400).json({ error: 'Provider has not set up payments yet' });
+    }
+
+    if (!provider.chargesEnabled) {
+      return res.status(400).json({ error: 'Provider payment account not yet approved' });
+    }
+
+    const result = await createPaymentIntent({
+      providerId: providerDoc.id,
+      patientId: sessionId,
+      amount: provider.perChatPrice,
+      currency: provider.currency || 'usd',
+      metadata: { conversationId },
+      stripeAccountId: provider.stripeAccountId
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error creating payment intent:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Create Stripe Checkout Session for subscription (Connect)
+app.post('/api/payment/create-checkout-session', rateLimit({ maxRequests: 15, windowMs: 60000 }), async (req, res) => {
+  try {
+    const { handle, sessionId, interval = 'month' } = req.body;
+
+    const VALID_INTERVALS = ['month', 'year'];
+    if (!handle || !sessionId) {
+      return res.status(400).json({ error: 'handle and sessionId required' });
+    }
+    if (!VALID_INTERVALS.includes(interval)) {
+      return res.status(400).json({ error: 'interval must be month or year' });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+
+    // Check Stripe Connect setup
+    if (!provider.stripeAccountId) {
+      return res.status(400).json({ error: 'Provider has not set up payments yet' });
+    }
+
+    if (!provider.chargesEnabled) {
+      return res.status(400).json({ error: 'Provider payment account not yet approved' });
+    }
+
+    if (!provider.stripePriceIds || !provider.stripePriceIds[interval]) {
+      return res.status(400).json({ error: `${interval} subscription not available` });
+    }
+
+    const result = await createCheckoutSession({
+      providerId: providerDoc.id,
+      patientId: sessionId,
+      interval,
+      stripeAccountId: provider.stripeAccountId,
+      stripePriceId: provider.stripePriceIds[interval]
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error creating checkout session:', error);
+    res.status(500).json({ error: 'Unable to create checkout session' });
+  }
+});
+
+// Create subscription (legacy - for backwards compatibility)
+app.post('/api/payment/create-subscription', rateLimit({ maxRequests: 15, windowMs: 60000 }), async (req, res) => {
+  try {
+    const { handle, sessionId } = req.body;
+
+    if (!handle || !sessionId) {
+      return res.status(400).json({ error: 'handle and sessionId required' });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+    if (!provider.paymentEnabled || !provider.subscriptionPrice) {
+      return res.status(400).json({ error: 'Subscription payment not enabled' });
+    }
+
+    const result = await createSubscription({
+      providerId: providerDoc.id,
+      patientId: sessionId,
+      priceAmount: provider.subscriptionPrice,
+      currency: provider.currency || 'usd'
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error creating subscription:', error);
+    res.status(500).json({ error: 'Unable to create subscription' });
+  }
+});
+
+// Cancel subscription (requires auth)
+app.post('/api/payment/cancel-subscription', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const { subscriptionId, cancelAtPeriodEnd } = req.body;
+
+    if (!subscriptionId) {
+      return res.status(400).json({ error: 'subscriptionId required' });
+    }
+
+    // Ownership check: the caller's provider must own this subscription,
+    // otherwise a doctor could cancel any subscription by id (IDOR).
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+    const db = admin.firestore();
+    const subSnap = await db.collection('subscriptions')
+      .where('stripeSubscriptionId', '==', subscriptionId)
+      .limit(1)
+      .get();
+    if (subSnap.empty || subSnap.docs[0].data().providerId !== providerDoc.id) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
+    const result = await cancelSubscription({
+      subscriptionId,
+      cancelAtPeriodEnd: cancelAtPeriodEnd !== false
+    });
+
+    res.json({ ok: true, subscription: result });
+  } catch (error) {
+    console.error('Error canceling subscription:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Check payment access
+app.post('/api/payment/check-access', rateLimit({ maxRequests: 30, windowMs: 60000 }), async (req, res) => {
+  try {
+    const { handle, sessionId, conversationId } = req.body;
+
+    if (!handle || !sessionId) {
+      return res.status(400).json({ error: 'handle and sessionId required' });
+    }
+
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const provider = providerDoc.data();
+
+    // If payment not enabled, allow access
+    if (!provider.paymentEnabled || provider.pricingModel === 'free') {
+      return res.json({ hasAccess: true, type: 'free' });
+    }
+
+    const result = await checkPaymentAccess({
+      providerId: providerDoc.id,
+      patientId: sessionId,
+      conversationId
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error checking payment access:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get revenue analytics (requires auth)
+app.get('/api/payment/revenue', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { startDate, endDate } = req.query;
+
+    const result = await getRevenueAnalytics({
+      providerId: providerDoc.id,
+      startDate: startDate ? admin.firestore.Timestamp.fromDate(new Date(startDate)) : null,
+      endDate: endDate ? admin.firestore.Timestamp.fromDate(new Date(endDate)) : null
+    });
+
+    res.json(result);
+  } catch (error) {
+    console.error('Error getting revenue analytics:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get transaction history (requires auth)
+app.get('/api/payment/transactions', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const db = admin.firestore();
+    const limit = Math.min(Math.max(parseInt(req.query.limit) || 50, 1), 200);
+
+    const snapshot = await db
+      .collection('transactions')
+      .where('providerId', '==', providerDoc.id)
+      .orderBy('createdAt', 'desc')
+      .limit(limit)
+      .get();
+
+    const transactions = snapshot.docs.map(doc => ({
+      id: doc.id,
+      ...doc.data(),
+      createdAt: doc.data().createdAt?.toDate().toISOString()
+    }));
+
+    res.json({ transactions });
+  } catch (error) {
+    console.error('Error getting transactions:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Delete conversation (provider only)
+app.delete('/api/conversations/:threadId', async (req, res) => {
+  try {
+    const user = await requireAuth(req, res);
+    if (!user) return;
+
+    const providerDoc = await findProviderByOwner(user.uid);
+    if (!providerDoc) {
+      return res.status(404).json({ error: 'Provider not found' });
+    }
+
+    const { threadId } = req.params;
+    if (!threadId) {
+      return res.status(400).json({ error: 'threadId is required' });
+    }
+
+    const db = admin.firestore();
+    const threadRef = db.collection('threads').doc(threadId);
+    const threadDoc = await threadRef.get();
+
+    if (!threadDoc.exists) {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+
+    if (threadDoc.data().doctorId !== providerDoc.id) {
+      return res.status(403).json({ error: 'Not authorized to delete this conversation' });
+    }
+
+    // Delete all messages in the thread
+    const messagesSnapshot = await threadRef.collection('messages').get();
+    const batch = db.batch();
+    messagesSnapshot.docs.forEach(doc => batch.delete(doc.ref));
+    batch.delete(threadRef);
+    await batch.commit();
+
+    logAuditEvent({
+      action: 'conversation_deleted',
+      actorId: user.uid,
+      actorType: 'provider',
+      resourceType: 'thread',
+      resourceId: threadId,
+      meta: { providerId: providerDoc.id }
+    }).catch(() => {});
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Error deleting conversation:', error);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Stripe webhook endpoint
+app.post('/api/payment/webhook', async (req, res) => {
+  const sig = req.headers['stripe-signature'];
+  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
+
+  if (!webhookSecret) {
+    console.error('Webhook secret not configured');
+    return res.status(500).send('Webhook secret not configured');
+  }
+
+  let event;
+
+  try {
+    const payload = req.rawBody || Buffer.from(JSON.stringify(req.body || {}));
+    event = stripe.webhooks.constructEvent(payload, sig, webhookSecret);
+  } catch (err) {
+    console.error('Webhook signature verification failed:', err.message);
+    return res.status(400).send(`Webhook Error: ${err.message}`);
+  }
+
+  try {
+    await handleStripeWebhook(event);
+  } catch (error) {
+    // Log but don't return 500 — returning 500 causes Stripe to retry
+    // the webhook for up to 72 hours, creating a retry storm
+    console.error('Error handling webhook:', error);
+  }
+  res.json({ received: true });
+});
+
+// ============================================
+// FRONTEND ROUTES
+// ============================================
+
+// Serve provider console at /app
+app.get('/app/inbox', (req, res) => {
+  res.sendFile(path.join(__dirname, 'public/app/inbox.html'));
+});
+
+app.get('/app*', (req, res) => {
+  res.sendFile(path.join(__dirname, 'public/app/index.html'));
+});
+
+// Serve patient chat page for handle-based URLs
+app.get('/:handle', async (req, res) => {
+  const handle = req.params.handle;
+  // Don't serve chat page for special paths
+  if (handle === 'api' || handle === 'health' || handle === 'favicon.ico' || handle === 'find-doctor.html') {
+    return res.status(404).json({ error: 'Not found' });
+  }
+  // Pre-launch: redirect doctor profile clicks to the waitlist
+  if (new Date() < LAUNCH_DATE) {
+    return res.redirect('/#waitlist');
+  }
+  // Validate handle exists before serving chat page
+  try {
+    const providerDoc = await findProviderByHandle(handle);
+    if (!providerDoc) {
+      return res.status(404).sendFile(path.join(__dirname, 'public/404.html'));
+    }
+  } catch (err) {
+    // On error, still serve chat.html and let client handle it
+  }
+  res.sendFile(path.join(__dirname, 'public/chat.html'));
+});
+
+// Fallback for root
+app.get('/', (req, res) => {
+  res.sendFile(path.join(__dirname, 'public/index.html'));
+});
+
+// 404 handler
+app.use((req, res) => {
+  if (req.accepts('html')) {
+    return res.status(404).sendFile(path.join(__dirname, 'public/404.html'));
+  }
+  res.status(404).json({ error: 'Not found' });
+});
+
+// Error handler
+app.use((err, req, res, next) => {
+  const rid = req && req.requestId ? req.requestId : 'no-rid';
+  console.error(`Unhandled error [${rid}]:`, err);
+  // Never leak internals; return the correlation id so support can trace it.
+  res.status(500).json({ error: 'Internal server error', requestId: rid });
+});
+
+// Start server (skip in test environment — supertest handles it)
+if (process.env.NODE_ENV !== 'test') {
+  // Stability net: log async faults instead of dying silently. A managed
+  // platform can still restart on a true crash, but a single bad async path
+  // should not take the whole service down without a trace.
+  process.on('unhandledRejection', (reason) => {
+    console.error('[unhandledRejection]', reason && reason.stack ? reason.stack : reason);
+  });
+  process.on('uncaughtException', (err) => {
+    console.error('[uncaughtException]', err && err.stack ? err.stack : err);
+  });
+
+  app.listen(PORT, () => {
+    console.log(`\n🏥 EvalDoc Server Running\n`);
+    console.log(`   Local:            http://localhost:${PORT}`);
+    console.log(`   Provider Console: http://localhost:${PORT}/app`);
+    console.log(`   Health Check:     http://localhost:${PORT}/health\n`);
+    console.log(`Press Ctrl+C to stop\n`);
+  });
+}
+
+module.exports = app;