neoagent 3.0.1-beta.7 → 3.0.1-beta.8

package/server/admin/billing.js

@@ -0,0 +1,292 @@
+'use strict';
+
+let _billingPlans = [];
+let _billingSubsOffset = 0;
+const BILLING_SUBS_LIMIT = 50;
+
+async function loadBilling() {
+  // Check if billing is enabled by probing the plans endpoint.
+  try {
+    const r = await fetch('/admin/api/billing/plans');
+    if (!r.ok) {
+      document.getElementById('billing-plans-content').innerHTML =
+        '<div class="empty">Billing is not enabled on this server. Set <code>NEOAGENT_BILLING_ENABLED=1</code> to enable it.</div>';
+      document.getElementById('billing-subs-content').innerHTML = '';
+      document.getElementById('nav-billing').style.display = '';
+      return;
+    }
+    const data = await r.json();
+    _billingPlans = data.plans || [];
+    renderPlansTable(_billingPlans);
+  } catch {
+    document.getElementById('billing-plans-content').innerHTML = '<div class="empty">Failed to load billing data.</div>';
+  }
+  document.getElementById('nav-billing').style.display = '';
+  _billingSubsOffset = 0;
+  await loadBillingSubscriptions();
+}
+
+// Show the billing nav item on load if billing is enabled.
+(async function checkBillingEnabled() {
+  try {
+    const r = await fetch('/admin/api/billing/plans');
+    if (r.ok) document.getElementById('nav-billing').style.display = '';
+  } catch {}
+})();
+
+function planRowHtml(plan) {
+  const id = escAttr(plan.id);
+  const intervalLabel = plan.interval ? `/ ${plan.interval}` : '';
+  const price = plan.price_cents === 0 ? 'Free' : `${(plan.price_cents / 100).toFixed(2)} ${(plan.currency || 'usd').toUpperCase()} ${intervalLabel}`;
+  const status = plan.is_active ? '<span style="color:var(--success)">Active</span>' : '<span style="color:var(--muted)">Inactive</span>';
+  return `
+    <tr data-plan-id="${id}">
+      <td><strong>${esc(plan.name)}</strong><br><small style="color:var(--muted)">${esc(plan.id)}</small></td>
+      <td>${esc(price)}</td>
+      <td>${plan.token_limit_4h != null ? fmtTokens(plan.token_limit_4h) : '<span style="color:var(--muted)">Default</span>'}</td>
+      <td>${plan.token_limit_weekly != null ? fmtTokens(plan.token_limit_weekly) : '<span style="color:var(--muted)">Default</span>'}</td>
+      <td><code style="font-size:11px">${esc(plan.stripe_price_id || '—')}</code></td>
+      <td>${status}</td>
+      <td>
+        <button class="btn btn-sm" onclick="billingEditPlan('${id}')">Edit</button>
+        <button class="btn btn-sm btn-danger" onclick="billingDeletePlan('${id}')">Delete</button>
+      </td>
+    </tr>`;
+}
+
+function renderPlansTable(plans) {
+  const el = document.getElementById('billing-plans-content');
+  if (!plans.length) {
+    el.innerHTML = '<div class="empty">No plans yet. Create one above.</div>';
+    return;
+  }
+  el.innerHTML = `
+    <table class="data-table">
+      <thead><tr>
+        <th>Plan</th><th>Price</th><th>4h Tokens</th><th>Weekly Tokens</th><th>Stripe Price ID</th><th>Status</th><th>Actions</th>
+      </tr></thead>
+      <tbody>${plans.map(planRowHtml).join('')}</tbody>
+    </table>`;
+}
+
+function billingShowNewPlanForm() {
+  billingOpenPlanModal(null);
+}
+
+function billingEditPlan(planId) {
+  const plan = _billingPlans.find((p) => p.id === planId);
+  billingOpenPlanModal(plan);
+}
+
+function billingOpenPlanModal(plan) {
+  const isNew = !plan;
+  const title = isNew ? 'New Plan' : `Edit Plan: ${plan.name}`;
+  const html = `
+    <div id="billing-plan-modal" style="position:fixed;inset:0;background:rgba(0,0,0,0.5);display:flex;align-items:center;justify-content:center;z-index:1000">
+      <div style="background:var(--card-bg);border-radius:12px;padding:28px;width:540px;max-height:90vh;overflow-y:auto;box-shadow:0 8px 32px rgba(0,0,0,0.3)">
+        <h2 style="margin:0 0 20px">${esc(title)}</h2>
+        <form id="billing-plan-form" onsubmit="billingPlanFormSubmit(event)">
+          <input type="hidden" id="bp-id" value="${esc(plan?.id || '')}">
+          <label class="form-label">Plan ID <small>(set once, used as identifier)</small></label>
+          <input class="form-input" id="bp-slug" value="${esc(plan?.id || '')}" ${isNew ? '' : 'disabled'} placeholder="plan_pro" style="margin-bottom:12px">
+          <label class="form-label">Name</label>
+          <input class="form-input" id="bp-name" value="${esc(plan?.name || '')}" required placeholder="Pro" style="margin-bottom:12px">
+          <label class="form-label">Description</label>
+          <input class="form-input" id="bp-desc" value="${esc(plan?.description || '')}" placeholder="Optional description" style="margin-bottom:12px">
+          <div style="display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-bottom:12px">
+            <div>
+              <label class="form-label">Price (cents)</label>
+              <input class="form-input" id="bp-price" type="number" min="0" value="${plan?.price_cents ?? 0}" required>
+            </div>
+            <div>
+              <label class="form-label">Currency</label>
+              <input class="form-input" id="bp-currency" value="${esc(plan?.currency || 'usd')}" placeholder="usd">
+            </div>
+          </div>
+          <div style="display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-bottom:12px">
+            <div>
+              <label class="form-label">Billing interval</label>
+              <select class="form-input" id="bp-interval">
+                <option value="month" ${plan?.interval === 'month' ? 'selected' : ''}>Monthly</option>
+                <option value="year" ${plan?.interval === 'year' ? 'selected' : ''}>Yearly</option>
+                <option value="" ${!plan?.interval ? 'selected' : ''}>One-time / Free</option>
+              </select>
+            </div>
+            <div>
+              <label class="form-label">Sort order</label>
+              <input class="form-input" id="bp-sort" type="number" value="${plan?.sort_order ?? 0}">
+            </div>
+          </div>
+          <label class="form-label">Stripe Price ID</label>
+          <input class="form-input" id="bp-stripe-price" value="${esc(plan?.stripe_price_id || '')}" placeholder="price_..." style="margin-bottom:12px">
+          <div style="display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-bottom:12px">
+            <div>
+              <label class="form-label">4h token limit <small>(blank = default)</small></label>
+              <input class="form-input" id="bp-tok-4h" type="number" min="0" value="${plan?.token_limit_4h ?? ''}" placeholder="2500000">
+            </div>
+            <div>
+              <label class="form-label">Weekly token limit <small>(blank = default)</small></label>
+              <input class="form-input" id="bp-tok-weekly" type="number" min="0" value="${plan?.token_limit_weekly ?? ''}" placeholder="10000000">
+            </div>
+          </div>
+          <label class="form-label">Allowed model IDs <small>(comma-separated; blank = all)</small></label>
+          <input class="form-input" id="bp-models" value="${esc((plan?.allowed_models || []).join(', '))}" placeholder="claude-opus-4-8, gpt-4o" style="margin-bottom:12px">
+          <label class="form-label">Features <small>(comma-separated, shown on pricing page)</small></label>
+          <input class="form-input" id="bp-features" value="${esc((plan?.features || []).join(', '))}" placeholder="Unlimited agents, Priority support" style="margin-bottom:16px">
+          <label style="display:flex;align-items:center;gap:8px;margin-bottom:20px;cursor:pointer">
+            <input type="checkbox" id="bp-active" ${!plan || plan.is_active ? 'checked' : ''}> Active
+          </label>
+          <div style="display:flex;gap:8px;justify-content:flex-end">
+            <button type="button" class="btn" onclick="billingClosePlanModal()">Cancel</button>
+            <button type="submit" class="btn btn-primary">${isNew ? 'Create' : 'Save'}</button>
+          </div>
+        </form>
+      </div>
+    </div>`;
+  document.body.insertAdjacentHTML('beforeend', html);
+}
+
+function billingClosePlanModal() {
+  document.getElementById('billing-plan-modal')?.remove();
+}
+
+async function billingPlanFormSubmit(e) {
+  e.preventDefault();
+  const id = document.getElementById('bp-id').value;
+  const slug = document.getElementById('bp-slug').value.trim();
+  const isNew = !id;
+
+  const parseTokenLimit = (val) => {
+    const n = parseInt(val, 10);
+    return isNaN(n) || val === '' ? null : n;
+  };
+  const parseModels = (val) => val.split(',').map((s) => s.trim()).filter(Boolean);
+  const parseFeatures = (val) => val.split(',').map((s) => s.trim()).filter(Boolean);
+
+  const body = {
+    id: isNew ? slug : undefined,
+    name: document.getElementById('bp-name').value.trim(),
+    description: document.getElementById('bp-desc').value.trim(),
+    price_cents: parseInt(document.getElementById('bp-price').value, 10),
+    currency: document.getElementById('bp-currency').value.trim() || 'usd',
+    interval: document.getElementById('bp-interval').value || null,
+    stripe_price_id: document.getElementById('bp-stripe-price').value.trim() || null,
+    token_limit_4h: parseTokenLimit(document.getElementById('bp-tok-4h').value),
+    token_limit_weekly: parseTokenLimit(document.getElementById('bp-tok-weekly').value),
+    allowed_models: parseModels(document.getElementById('bp-models').value),
+    features: parseFeatures(document.getElementById('bp-features').value),
+    sort_order: parseInt(document.getElementById('bp-sort').value, 10) || 0,
+    is_active: document.getElementById('bp-active').checked,
+  };
+
+  try {
+    const url = isNew ? '/admin/api/billing/plans' : `/admin/api/billing/plans/${encodeURIComponent(id)}`;
+    const method = isNew ? 'POST' : 'PUT';
+    const r = await fetch(url, { method, headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+    const data = await r.json();
+    if (!r.ok) { alert(data.error || 'Failed to save plan.'); return; }
+    billingClosePlanModal();
+    await loadBilling();
+  } catch (err) {
+    alert('Error: ' + err.message);
+  }
+}
+
+async function billingDeletePlan(planId) {
+  if (!confirm(`Delete plan "${planId}"? It will be deactivated (not hard-deleted).`)) return;
+  try {
+    const r = await fetch(`/admin/api/billing/plans/${encodeURIComponent(planId)}`, { method: 'DELETE' });
+    if (!r.ok) { const d = await r.json(); alert(d.error || 'Failed.'); return; }
+    await loadBilling();
+  } catch (err) {
+    alert('Error: ' + err.message);
+  }
+}
+
+async function loadBillingSubscriptions() {
+  const statusFilter = document.getElementById('billing-sub-status-filter')?.value || '';
+  const el = document.getElementById('billing-subs-content');
+  el.innerHTML = '<div class="empty"><span class="spinner"></span></div>';
+  try {
+    const params = new URLSearchParams({ limit: BILLING_SUBS_LIMIT, offset: _billingSubsOffset });
+    if (statusFilter) params.set('status', statusFilter);
+    const r = await fetch('/admin/api/billing/subscriptions?' + params);
+    if (!r.ok) { el.innerHTML = '<div class="empty">Failed to load subscriptions.</div>'; return; }
+    const data = await r.json();
+    renderSubsTable(data.subscriptions, data.total);
+  } catch {
+    el.innerHTML = '<div class="empty">Failed to load subscriptions.</div>';
+  }
+}
+
+function renderSubsTable(rows, total) {
+  const el = document.getElementById('billing-subs-content');
+  if (!rows.length) { el.innerHTML = '<div class="empty">No subscriptions found.</div>'; return; }
+  el.innerHTML = `
+    <table class="data-table">
+      <thead><tr>
+        <th>User</th><th>Plan</th><th>Status</th><th>Period end</th><th>Actions</th>
+      </tr></thead>
+      <tbody>${rows.map(subRowHtml).join('')}</tbody>
+    </table>`;
+
+  const pag = document.getElementById('billing-subs-pagination');
+  const hasPrev = _billingSubsOffset > 0;
+  const hasNext = _billingSubsOffset + BILLING_SUBS_LIMIT < total;
+  pag.innerHTML = `
+    <span style="color:var(--muted);font-size:13px">${total} total</span>
+    ${hasPrev ? `<button class="btn btn-sm" onclick="_billingSubsOffset-=${BILLING_SUBS_LIMIT};loadBillingSubscriptions()">← Prev</button>` : ''}
+    ${hasNext ? `<button class="btn btn-sm" onclick="_billingSubsOffset+=${BILLING_SUBS_LIMIT};loadBillingSubscriptions()">Next →</button>` : ''}`;
+}
+
+function subRowHtml(sub) {
+  const userLabel = esc(sub.display_name || sub.username || String(sub.user_id));
+  const email = sub.email ? `<br><small style="color:var(--muted)">${esc(sub.email)}</small>` : '';
+  const statusColor = { active: 'var(--success)', trialing: 'var(--warning, #f59e0b)', past_due: 'var(--error)', canceled: 'var(--muted)' }[sub.status] || 'var(--muted)';
+  const periodEnd = sub.current_period_end ? sub.current_period_end.slice(0, 10) : '—';
+  return `
+    <tr>
+      <td>${userLabel}${email}</td>
+      <td>${esc(sub.plan_name)}</td>
+      <td><span style="color:${statusColor}">${esc(sub.status)}</span></td>
+      <td>${periodEnd}</td>
+      <td><button class="btn btn-sm" onclick="billingOverrideSub(${sub.user_id})">Override</button></td>
+    </tr>`;
+}
+
+async function billingOverrideSub(userId) {
+  if (!_billingPlans.length) { alert('No plans available.'); return; }
+  const options = _billingPlans.filter((p) => p.is_active).map((p) => `${p.id} — ${p.name}`).join('\n');
+  const planId = prompt(`Enter plan ID to assign:\n\n${options}`);
+  if (!planId) return;
+  try {
+    const r = await fetch(`/admin/api/billing/users/${userId}/subscription`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ planId: planId.trim() }),
+    });
+    const data = await r.json();
+    if (!r.ok) { alert(data.error || 'Failed.'); return; }
+    await loadBillingSubscriptions();
+  } catch (err) {
+    alert('Error: ' + err.message);
+  }
+}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function esc(str) {
+  return String(str ?? '')
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+
+function escAttr(str) {
+  return esc(str);
+}
+
+function fmtTokens(n) {
+  if (n >= 1_000_000) return (n / 1_000_000).toFixed(1) + 'M';
+  if (n >= 1_000) return (n / 1_000).toFixed(0) + 'K';
+  return String(n);
+}

package/server/admin/index.html

@@ -900,6 +900,14 @@
         Users
       </button>
 
+      <button class="nav-item" id="nav-billing" data-page="billing" onclick="showPage('billing',this)" style="display:none">
+        <svg viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+          <path d="M4 4a2 2 0 00-2 2v1h16V6a2 2 0 00-2-2H4z"/>
+          <path fill-rule="evenodd" d="M18 9H2v5a2 2 0 002 2h12a2 2 0 002-2V9zM4 13a1 1 0 011-1h1a1 1 0 110 2H5a1 1 0 01-1-1zm5-1a1 1 0 100 2h1a1 1 0 100-2H9z" clip-rule="evenodd"/>
+        </svg>
+        Billing
+      </button>
+
       <button class="nav-item" data-page="sql" onclick="showPage('sql',this)">
         <svg viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
           <path fill-rule="evenodd" d="M3 5a2 2 0 012-2h10a2 2 0 012 2v10a2 2 0 01-2 2H5a2 2 0 01-2-2V5zm11 1H6v8l4-2 4 2V6z" clip-rule="evenodd"/>
@@ -1189,6 +1197,34 @@
       </div>
     </section>
 
+    <section id="page-billing" class="page" aria-label="Billing">
+      <div class="page-header"><h1>Billing</h1></div>
+      <div class="cards">
+        <div class="card">
+          <div class="card-title">Subscription Plans</div>
+          <div style="margin-bottom:12px">
+            <button class="btn btn-primary" onclick="billingShowNewPlanForm()">+ New Plan</button>
+          </div>
+          <div id="billing-plans-content"><div class="empty"><span class="spinner"></span></div></div>
+        </div>
+        <div class="card">
+          <div class="card-title">User Subscriptions</div>
+          <div style="margin-bottom:12px;display:flex;gap:8px;align-items:center">
+            <select id="billing-sub-status-filter" onchange="loadBillingSubscriptions()" style="padding:6px 10px;border-radius:6px;border:1px solid var(--border);background:var(--input-bg);color:var(--text)">
+              <option value="">All statuses</option>
+              <option value="active">Active</option>
+              <option value="trialing">Trialing</option>
+              <option value="past_due">Past due</option>
+              <option value="canceled">Canceled</option>
+            </select>
+            <button class="btn" onclick="loadBillingSubscriptions()">Refresh</button>
+          </div>
+          <div id="billing-subs-content"><div class="empty"><span class="spinner"></span></div></div>
+          <div id="billing-subs-pagination" style="margin-top:12px;display:flex;gap:8px;align-items:center"></div>
+        </div>
+      </div>
+    </section>
+
   </main>
 
   <script src="/admin/admin.js"></script>
@@ -1196,5 +1232,6 @@
   <script src="/admin/users.js"></script>
   <script src="/admin/sql.js"></script>
   <script src="/admin/access.js"></script>
+  <script src="/admin/billing.js"></script>
 </body>
 </html>

package/server/db/database.js

@@ -1328,6 +1328,7 @@ for (const col of [
   "ALTER TABLE memory_facts ADD COLUMN invalidated_at TEXT",
   "ALTER TABLE memory_facts ADD COLUMN status TEXT DEFAULT 'active'",
   "ALTER TABLE memory_facts ADD COLUMN supersedes_fact_id TEXT",
+  "ALTER TABLE users ADD COLUMN billing_override_plan_id TEXT",
 ]) {
   try { db.exec(col); } catch { /* column already exists */ }
 }

package/server/http/routes.js

@@ -48,6 +48,15 @@ function registerApiRoutes(app) {
     }
   }
 
+  // Billing routes are mounted conditionally — only when billing is enabled.
+  // The webhook must be mounted before express.json() consumes the raw body;
+  // billing_webhook.js applies express.raw() inline for its own route.
+  const { isBillingEnabled } = require('../services/billing/config');
+  if (isBillingEnabled()) {
+    app.use('/api/billing/webhook', require('../routes/billing_webhook'));
+    app.use('/api/billing', require('../routes/billing'));
+  }
+
   setupTelnyxWebhook(app);
 
   app.get('/api/health', requireAuth, (req, res) => {

package/server/middleware/requireBilling.js

@@ -0,0 +1,12 @@
+'use strict';
+
+const { isBillingEnabled } = require('../services/billing/config');
+
+function requireBilling(req, res, next) {
+  if (!isBillingEnabled()) {
+    return res.status(404).json({ error: 'Billing is not enabled on this server.' });
+  }
+  next();
+}
+
+module.exports = { requireBilling };

package/server/public/.last_build_id

@@ -1 +1 @@
-60f1b48c2d24c4a137efc1a6529d413f
+dc90ac758721f68d16ff899fbce82971

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"77e2e94772b6eb43759e34ed1ad7da4674e19c
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "2202305600" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "3960040413" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/public/main.dart.js

@@ -135597,7 +135597,7 @@ r===$&&A.b()
 p.push(A.jV(q,A.jd(!1,new A.a_(B.uM,A.db(new A.cC(B.jA,new A.a89(r,q),q),q,q),q),!1,B.I,!0),q,q,0,0,0,q))}r=!1
 if(!s.ay)if(!s.ch){r=s.e
 r===$&&A.b()
-r=B.b.u("mqj7s6w1-467cdbb").length!==0&&r.b}if(r){r=s.d
+r=B.b.u("mqjy0ig5-61a79c0").length!==0&&r.b}if(r){r=s.d
 r===$&&A.b()
 r=r.aP&&!r.ai?84:0
 s=s.e
@@ -141319,7 +141319,7 @@ $S:0}
 A.a_p.prototype={}
 A.T7.prototype={
 nd(a){var s=this
-if(B.b.u("mqj7s6w1-467cdbb").length===0||s.a!=null)return
+if(B.b.u("mqjy0ig5-61a79c0").length===0||s.a!=null)return
 s.B_()
 s.a=A.ot(B.S2,new A.bde(s))},
 B_(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f
@@ -141337,7 +141337,7 @@ if(!t.f.b(k)){s=1
 break}i=J.a3(k,"buildId")
 h=i==null?null:B.b.u(J.p(i))
 j=h==null?"":h
-if(J.bj(j)===0||J.e(j,"mqj7s6w1-467cdbb")){s=1
+if(J.bj(j)===0||J.e(j,"mqjy0ig5-61a79c0")){s=1
 break}n.b=!0
 n.F()
 p=2
@@ -141354,7 +141354,7 @@ case 2:return A.i(o.at(-1),r)}})
 return A.k($async$B_,r)},
 vI(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f,e,d,c,b,a,a0,a1
 var $async$vI=A.h(function(a2,a3){if(a2===1){o.push(a3)
-s=p}for(;;)switch(s){case 0:if(B.b.u("mqj7s6w1-467cdbb").length===0||n.c){s=1
+s=p}for(;;)switch(s){case 0:if(B.b.u("mqjy0ig5-61a79c0").length===0||n.c){s=1
 break}n.c=!0
 n.F()
 p=4

package/server/routes/admin.js

@@ -773,6 +773,116 @@ router.put('/api/users/:id/rate-limits', requireAdminAuth, express.json(), (req,
   }
 });
 
+// --- Billing admin routes (only when billing is enabled) ---
+
+(function registerBillingRoutes() {
+  const { isBillingEnabled } = require('../services/billing/config');
+  if (!isBillingEnabled()) return;
+
+  const billingPlans = require('../services/billing/plans');
+  const billingSubscriptions = require('../services/billing/subscriptions');
+
+  // Plans CRUD
+  router.get('/api/billing/plans', requireAdminAuth, (req, res) => {
+    try {
+      res.json({ plans: billingPlans.listPlans({ includeInactive: true }) });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  router.post('/api/billing/plans', requireAdminAuth, express.json(), (req, res) => {
+    try {
+      const plan = billingPlans.createPlan(req.body);
+      res.status(201).json({ plan });
+    } catch (err) {
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.put('/api/billing/plans/:id', requireAdminAuth, express.json(), (req, res) => {
+    try {
+      const plan = billingPlans.updatePlan(req.params.id, req.body);
+      if (!plan) return res.status(404).json({ error: 'Plan not found.' });
+      res.json({ plan });
+    } catch (err) {
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.delete('/api/billing/plans/:id', requireAdminAuth, (req, res) => {
+    try {
+      billingPlans.deletePlan(req.params.id);
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // Subscription browser (all users)
+  router.get('/api/billing/subscriptions', requireAdminAuth, (req, res) => {
+    try {
+      const db = require('../db/database');
+      const limit = Math.min(parseInt(req.query.limit || '50', 10), 200);
+      const offset = parseInt(req.query.offset || '0', 10);
+      const status = req.query.status || null;
+
+      const where = status ? "WHERE s.status = ?" : "";
+      const params = status ? [status, limit, offset] : [limit, offset];
+
+      const rows = db.prepare(`
+        SELECT s.*, u.username, u.email, u.display_name,
+               p.name AS plan_name, p.price_cents, p.currency
+        FROM user_subscriptions s
+        JOIN users u ON u.id = s.user_id
+        JOIN billing_plans p ON p.id = s.plan_id
+        ${where}
+        ORDER BY s.updated_at DESC
+        LIMIT ? OFFSET ?
+      `).all(...params);
+
+      const total = db.prepare(
+        `SELECT COUNT(*) AS n FROM user_subscriptions s ${where}`,
+      ).get(...(status ? [status] : [])).n;
+
+      res.json({ subscriptions: rows, total, limit, offset });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // Per-user subscription management
+  router.get('/api/billing/users/:id/subscription', requireAdminAuth, (req, res) => {
+    try {
+      const sub = billingSubscriptions.getActiveSubscription(parseInt(req.params.id, 10));
+      res.json({ subscription: sub });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  router.post('/api/billing/users/:id/subscription', requireAdminAuth, express.json(), (req, res) => {
+    try {
+      const userId = parseInt(req.params.id, 10);
+      const { planId, status } = req.body;
+      if (!planId) return res.status(400).json({ error: 'planId is required.' });
+      const sub = billingSubscriptions.adminSetSubscription(userId, planId, status);
+      res.json({ subscription: sub });
+    } catch (err) {
+      res.status(err.statusCode || 500).json({ error: err.message });
+    }
+  });
+
+  router.delete('/api/billing/users/:id/subscription', requireAdminAuth, (req, res) => {
+    try {
+      billingSubscriptions.adminCancelSubscription(parseInt(req.params.id, 10));
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+})();
+
 // --- Static files ---
 
 router.use(express.static(ADMIN_DIR));