neuroalpha 0.0.0-stage → 0.2.0

package/server/api/routes.js

@@ -0,0 +1,333 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import express from 'express';
+import { ROOT, strategyDefaults } from '../config.js';
+import { activeModelInfo } from '../llm/client.js';
+import { listProviders, getSelected, addProvider, updateProvider, deleteProvider, fetchRemoteModels, testProvider, selectModel } from '../llm/providers.js';
+import { listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle, setRunShowcase, listShowcaseRuns, countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal, listSettingsHistory } from '../db.js';
+import { PLANS, effectivePlan, publicUser, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createPromoCode, listPromoCodes, redeemPromoCode, parseCookies } from '../auth/index.js';
+import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments } from '../billing/yookassa.js';
+import { publicNotifyConfig, saveNotifyConfig, notifyUser } from '../notify/index.js';
+import { PARAMS } from '../params-meta.js';
+import { getSettings, updateSettings, resetSettings, revertSettingsChange } from '../settings.js';
+import { startModelResearch, cancelModelResearch, startStabilityCheck, cancelStabilityCheck } from '../model/research.js';
+import { forecastNow } from '../model/forecast.js';
+import { profilesInfo, startProfilesRefresh } from '../model/profiles.js';
+import { live } from '../model/live.js';
+import { brokersState, saveBrokerAccount, deleteBrokerAccount, syncBrokerAccount, prepareBrokerOrders, executeBrokerOrders, rejectBrokerOrders } from '../brokers/index.js';
+import { listNews } from '../news/index.js';
+import * as strategist from '../strategist/index.js';
+import { hub } from '../hub.js';
+
+export function createRouter() {
+  const r = express.Router();
+  const wrap = (fn) => (req, res) => Promise.resolve().then(() => fn(req, res)).catch((e) => res.status(400).json({ error: e.message }));
+
+  r.get('/config', (req, res) => res.json({
+    defaults: strategyDefaults, params: PARAMS,
+    llm: activeModelInfo(),
+    user: publicUser(req.user),
+    cloudMode: process.env.CLOUD_MODE === '1',
+    plans: PLANS,
+    notify: publicNotifyConfig(),
+    billing: { enabled: publicBillingConfig().enabled },
+  }));
+
+  // ---------- авторизация, профиль и тарифы ----------
+  const setCookie = (res, sid, maxAgeSec = 30 * 86400) => {
+    res.setHeader('Set-Cookie', `sid=${encodeURIComponent(sid)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}`);
+  };
+  r.get('/auth/me', (req, res) => res.json({
+    user: publicUser(req.user),
+    cloudMode: process.env.CLOUD_MODE === '1',
+    plans: PLANS,
+    notify: publicNotifyConfig(),
+    billing: { enabled: publicBillingConfig().enabled },
+  }));
+  r.post('/auth/register', wrap((req, res) => {
+    const u = registerUser(req.body || {});
+    const token = createSession(u.id);
+    setCookie(res, token);
+    res.json({ user: publicUser(u), token });
+  }));
+  r.post('/auth/login', wrap((req, res) => {
+    const u = loginUser(req.body || {});
+    const token = createSession(u.id);
+    setCookie(res, token);
+    res.json({ user: publicUser(u), token });
+  }));
+  r.post('/auth/logout', (req, res) => {
+    const cookies = parseCookies(req.headers?.cookie);
+    if (cookies.sid) deleteSession(cookies.sid);
+    setCookie(res, 'logged_out', 365 * 86400);
+    res.json({ ok: true });
+  });
+  r.post('/auth/notify-code', wrap((req, res) => {
+    if (!req.user) throw new Error('Войдите в аккаунт');
+    const code = ensureNotifyCode(req.user.id);
+    res.json({ code, notify: publicNotifyConfig() });
+  }));
+  r.post('/auth/notify-test', wrap(async (req, res) => {
+    if (!req.user) throw new Error('Войдите в аккаунт');
+    const sent = await notifyUser(req.user.id, 'НейроАльфа: тестовое уведомление успешно доставлено.');
+    if (!sent.tg && !sent.max) throw new Error('Сначала привяжите Telegram или MAX по вашему коду привязки');
+    res.json({ ok: true, ...sent });
+  }));
+  r.post('/auth/redeem-promo', wrap((req, res) => {
+    if (!req.user) throw new Error('Войдите в аккаунт для активации промокода');
+    const user = redeemPromoCode(req.user.id, req.body?.code);
+    res.json({ user });
+  }));
+  r.post('/auth/api-key/regenerate', wrap((req, res) => {
+    if (!req.user) throw new Error('Войдите в аккаунт');
+    const apiKey = ensureApiKey(req.user.id, true);
+    res.json({ apiKey, user: publicUser({ ...req.user, api_key: apiKey }) });
+  }));
+  // Проверка API-ключа внешним npx-клиентом
+  r.post('/license/verify', wrap((req, res) => {
+    const authHeader = String(req.headers?.authorization || '');
+    const key = String(req.body?.apiKey || (authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '') || '').trim();
+    const u = getUserByApiKey(key);
+    if (!u) return res.status(401).json({ valid: false, error: 'Неверный или отозванный API-ключ' });
+    const p = effectivePlan(u);
+    res.json({
+      valid: true,
+      email: u.email,
+      name: u.name,
+      plan: p.id,
+      planName: p.name,
+      planUntil: u.plan_until || 0,
+      limits: p,
+    });
+  }));
+  // Активация API-ключа облачной подписки на локальном npx-клиенте
+  r.post('/license/activate', wrap(async (req, res) => {
+    const lic = await activateLocalLicense(req.body?.apiKey, req.body?.cloudUrl);
+    res.json({ ok: true, license: lic, user: publicUser(req.user) });
+  }));
+
+  // ---------- оплата через ЮKassa ----------
+  r.post('/billing/checkout', wrap(async (req, res) => {
+    const origin = `${req.protocol}://${req.get('host')}`;
+    res.json(await createYookassaPayment({
+      user: req.user,
+      plan: req.body?.plan,
+      months: req.body?.months || 1,
+      returnOrigin: req.body?.returnOrigin || origin,
+    }));
+  }));
+  r.post('/billing/verify', wrap(async (req, res) => {
+    if (!req.user) throw new Error('Войдите в аккаунт');
+    if (req.body?.paymentId) return res.json(await verifyYookassaPayment(req.body.paymentId));
+    return res.json(await verifyUserLatestPayment(req.user.id));
+  }));
+  r.post('/billing/yookassa/webhook', wrap(async (req, res) => {
+    const pid = req.body?.object?.id;
+    if (pid) await verifyYookassaPayment(pid).catch(() => {});
+    res.json({ ok: true });
+  }));
+
+  // ---------- публичная витрина для лендинга ----------
+  r.get('/public/showcase', (req, res) => {
+    const runs = listShowcaseRuns().map((x) => {
+      const full = getRun(x.id);
+      return {
+        id: x.id,
+        title: x.params?._title || `Эталонная стратегия №${x.id}`,
+        params: { modelHorizon: x.params?.modelHorizon, modelTopK: x.params?.modelTopK, modelDirection: x.params?.modelDirection, modelType: x.params?.modelType },
+        metrics: x.metrics?.full || {},
+        oos: x.metrics?.model?.comparison?.[x.metrics?.model?.chosen || 'attention']?.outOfSample || {},
+        period: x.metrics?.period || {},
+        curve: full?.extra?.curves?.[x.metrics?.model?.chosen || 'attention']?.slice(-180) || [],
+        marketCurve: full?.extra?.curves?.market?.slice(-180) || [],
+      };
+    });
+    if (!runs.length) {
+      try {
+        const ref = JSON.parse(fs.readFileSync(path.join(ROOT, 'investor', 'данные.json'), 'utf8').replace(/^\uFEFF/, ''));
+        if (ref?.cmp?.attention?.full) {
+          runs.push({
+            id: 234,
+            title: 'Эталонная стратегия «Внимание через карту»',
+            params: { modelHorizon: 2, modelTopK: ref.params?.topK || 2, modelDirection: 'long', modelType: 'attention' },
+            metrics: ref.cmp.attention.full,
+            oos: ref.cmp.attention.oos || {},
+            period: ref.period || {},
+            curve: (ref.curves?.attention || []).slice(-180),
+            marketCurve: (ref.curves?.market || []).slice(-180),
+          });
+        }
+      } catch { /* ignore */ }
+    }
+    res.json({ runs, plans: PLANS });
+  });
+
+  // ---------- админ-панель (пользователи, оплаты, ЮKassa, боты Telegram и MAX, витрина) ----------
+  const requireAdmin = (req) => {
+    if (!req.user || req.user.role !== 'admin') throw new Error('Доступно только администратору платформы');
+  };
+  r.get('/admin/state', wrap((req, res) => {
+    requireAdmin(req);
+    res.json({ users: listAllUsers(), payments: listAllPayments(), promos: listPromoCodes(), billing: publicBillingConfig(), notify: publicNotifyConfig() });
+  }));
+  r.post('/admin/promo', wrap((req, res) => {
+    requireAdmin(req);
+    res.json({ promos: createPromoCode(req.body || {}) });
+  }));
+  r.post('/admin/user-plan', wrap((req, res) => {
+    requireAdmin(req);
+    res.json({ user: setUserPlan(req.body?.userId, req.body?.plan, req.body?.days || 30), users: listAllUsers() });
+  }));
+  r.post('/admin/billing', wrap((req, res) => {
+    requireAdmin(req);
+    res.json(saveBillingConfig(req.body || {}));
+  }));
+  r.post('/admin/notify', wrap((req, res) => {
+    requireAdmin(req);
+    res.json(saveNotifyConfig(req.body || {}));
+  }));
+  r.put('/runs/:id/showcase', wrap((req, res) => {
+    requireAdmin(req);
+    res.json(setRunShowcase(Number(req.params.id), Boolean(req.body?.showcase)));
+  }));
+
+  // ---------- модели ИИ ----------
+  const llmState = () => ({ providers: listProviders(), selected: getSelected(), active: activeModelInfo() });
+  const llmChanged = () => {
+    hub.emit({ type: 'llm:changed', llm: activeModelInfo() });
+    hub.emit({ type: 'chat:state', state: strategist.chatState() });
+  };
+  r.get('/llm/providers', wrap((req, res) => res.json(llmState())));
+  r.post('/llm/providers', wrap((req, res) => { const p = addProvider(req.body); llmChanged(); res.json({ provider: p, ...llmState() }); }));
+  r.put('/llm/providers/:id', wrap((req, res) => { const p = updateProvider(req.params.id, req.body); llmChanged(); res.json({ provider: p, ...llmState() }); }));
+  r.delete('/llm/providers/:id', wrap((req, res) => { deleteProvider(req.params.id); llmChanged(); res.json(llmState()); }));
+  r.get('/llm/providers/:id/remote-models', wrap(async (req, res) => res.json({ models: await fetchRemoteModels(req.params.id) })));
+  r.post('/llm/test', wrap(async (req, res) => res.json(await testProvider(req.body?.providerId, req.body?.model))));
+  r.post('/llm/select', wrap((req, res) => { selectModel(req.body?.providerId, req.body?.model); llmChanged(); res.json(llmState()); }));
+
+  // ---------- настройки ----------
+  r.get('/settings', (req, res) => res.json(getSettings()));
+  r.put('/settings', wrap((req, res) => res.json(updateSettings(req.body || {}, { source: 'user' }))));
+  r.post('/settings/reset', (req, res) => res.json(resetSettings('user')));
+  r.get('/settings/history', (req, res) => res.json(listSettingsHistory(Math.min(200, Number(req.query.limit) || 50))));
+  r.post('/settings/history/:id/revert', wrap((req, res) => res.json(revertSettingsChange(req.params.id))));
+
+  // ---------- исследования ----------
+  r.get('/runs', (req, res) => res.json(listRuns()));
+  r.get('/runs/:id', (req, res) => {
+    const run = getRun(Number(req.params.id));
+    if (!run) return res.status(404).json({ error: 'Не найдено' });
+    res.json({ ...run, trades: getTrades(run.id) });
+  });
+  r.put('/runs/:id/title', wrap((req, res) => {
+    const updated = updateRunTitle(Number(req.params.id), req.body?.title || '');
+    if (!updated) return res.status(404).json({ error: 'Не найдено' });
+    res.json(updated);
+  }));
+  r.post('/runs/:id/stability', wrap((req, res) => res.json(startStabilityCheck(Number(req.params.id)))));
+  r.post('/runs/:id/stability/cancel', (req, res) => res.json({ ok: cancelStabilityCheck(Number(req.params.id)) }));
+  r.delete('/runs/:id', wrap((req, res) => {
+    const run = getRun(Number(req.params.id));
+    if (run?.status === 'running') throw new Error('Эксперимент ещё идёт — сначала отмените его');
+    deleteRun(Number(req.params.id));
+    res.json({ ok: true });
+  }));
+  // Очистка истории прогонов: оставить ровно keep лучших по итогу (0 — удалить все завершённые), идущие не трогать
+  r.post('/runs/cleanup', wrap((req, res) => {
+    const raw = Number(req.body?.keep);
+    const keep = Number.isFinite(raw) ? Math.max(0, Math.min(50, Math.floor(raw))) : 0;
+    const all = allRuns();
+    const done = all.filter((r) => r.mode === 'model' && r.status === 'done');
+    const ranked = [...done].sort((a, b) => (b.metrics?.full?.returnPct ?? -1e9) - (a.metrics?.full?.returnPct ?? -1e9));
+    const keepSet = new Set(ranked.slice(0, keep).map((r) => r.id));
+    let deleted = 0;
+    for (const r of all) {
+      if (r.mode !== 'model' || r.status === 'running' || keepSet.has(r.id)) continue;
+      deleteRun(r.id);
+      deleted++;
+    }
+    res.json({ deleted, kept: [...keepSet] });
+  }));
+
+  r.post('/model/research', wrap((req, res) => {
+    const plan = effectivePlan(req.user);
+    if (countUserRunsToday() >= plan.maxRunsPerDay) {
+      throw new Error(`Достигнут дневной лимит исследований по тарифу «${plan.name}» (${plan.maxRunsPerDay} в сутки). Перейдите на тариф «Инвестор» или «Профи».`);
+    }
+    const body = req.body || {};
+    const merged = { ...getSettings(), ...body };
+    if ((merged.modelUseTransformer || merged.modelType === 'transformer') && !plan.allowTransformer) {
+      throw new Error('Обучение нейросети-трансформера доступно на тарифе «Профи / Лаборатория».');
+    }
+    const { runId, reused } = startModelResearch(merged, { source: 'user', force: !!body.force });
+    res.json({ runId, reused: !!reused });
+  }));
+  r.post('/model/:id/cancel', (req, res) => res.json({ ok: cancelModelResearch(Number(req.params.id)) }));
+  r.get('/model/forecast', wrap(async (req, res) => res.json(await forecastNow(getSettings(), { force: req.query.force === '1' }))));
+
+  // ---------- описания компаний (текстовая карта) ----------
+  r.get('/profiles', wrap(async (req, res) => res.json(await profilesInfo())));
+  r.post('/profiles/refresh', wrap((req, res) => res.json(startProfilesRefresh())));
+
+  // ---------- живая проверка (несколько виртуальных счетов) ----------
+  r.get('/live/status', (req, res) => res.json(live.status()));
+  r.post('/live/start', wrap(async (req, res) => {
+    const plan = effectivePlan(req.user);
+    const b = req.body || {};
+    const runId = await live.start(getSettings(), { source: 'user', baseRunId: b.baseRunId || null, name: b.name || '', capital: b.capital || null, maxAccounts: plan.maxVirtualAccounts });
+    res.json({ runId, status: live.status() });
+  }));
+  r.post('/live/stop', (req, res) => res.json({ ok: live.stop(req.body?.runId || null), status: live.status() }));
+  r.delete('/live/:id', (req, res) => res.json({ ok: live.remove(Number(req.params.id)), status: live.status() }));
+
+  // ---------- брокерские счета (Т-Банк, Финам, Алор, БКС) ----------
+  r.get('/brokers', (req, res) => res.json(brokersState()));
+  r.post('/brokers', wrap((req, res) => {
+    const plan = effectivePlan(req.user);
+    const cur = brokersState().accounts.length;
+    if (!req.body?.id && cur >= plan.maxBrokerAccounts) {
+      throw new Error(`По вашему тарифу «${plan.name}» доступно подключение до ${plan.maxBrokerAccounts} брокерских счетов. Перейдите на тариф «Инвестор» или «Профи».`);
+    }
+    res.json(saveBrokerAccount(req.body || {}));
+  }));
+  r.put('/brokers/:id', wrap((req, res) => res.json(saveBrokerAccount({ ...(req.body || {}), id: req.params.id }))));
+  r.delete('/brokers/:id', wrap((req, res) => res.json(deleteBrokerAccount(req.params.id))));
+  r.post('/brokers/:id/sync', wrap(async (req, res) => res.json(await syncBrokerAccount(req.params.id))));
+  r.post('/brokers/:id/prepare', wrap(async (req, res) => res.json(await prepareBrokerOrders(req.params.id))));
+  r.post('/brokers/:id/execute', wrap(async (req, res) => res.json(await executeBrokerOrders(req.params.id))));
+  r.post('/brokers/:id/reject', wrap((req, res) => res.json(rejectBrokerOrders(req.params.id))));
+
+  // ---------- новости (только для прогноза «сейчас» и живой проверки) ----------
+  r.get('/news', (req, res) => res.json({
+    items: listNews({ symbol: req.query.symbol || undefined, hours: Number(req.query.hours) || 72, limit: Number(req.query.limit) || 30 }),
+  }));
+
+  // ---------- журнал гипотез ----------
+  r.get('/journal', (req, res) => res.json(listJournal(500)));
+  r.post('/journal', wrap((req, res) => {
+    const id = addJournal({ ...req.body, source: 'user' });
+    hub.emit({ type: 'journal:update' });
+    res.json({ id });
+  }));
+  r.delete('/journal/:id', (req, res) => { deleteJournal(Number(req.params.id)); hub.emit({ type: 'journal:update' }); res.json({ ok: true }); });
+
+  // ---------- чат со Стратегом ----------
+  r.get('/chat', (req, res) => res.json(strategist.history()));
+  r.post('/chat/send', wrap((req, res) => {
+    const plan = effectivePlan(req.user);
+    if (countUserChatToday() >= plan.maxChatPerDay) {
+      throw new Error(`Достигнут дневной лимит сообщений ИИ-Стратегу по тарифу «${plan.name}» (${plan.maxChatPerDay} в сутки).`);
+    }
+    res.json({ message: strategist.sendUserMessage(req.body?.text, req.body?.mode) });
+  }));
+  r.post('/chat/action', wrap((req, res) => {
+    const { msgId, callId, decision, comment } = req.body || {};
+    strategist.resolveAction(Number(msgId), String(callId), decision, comment);
+    res.json({ ok: true });
+  }));
+  r.post('/chat/stop', (req, res) => { strategist.stopAgent(); res.json({ ok: true }); });
+  r.post('/chat/mode', wrap((req, res) => { strategist.setMode(req.body?.mode, req.body?.budget); res.json(strategist.chatState()); }));
+  r.post('/chat/new', (req, res) => { strategist.resetConversation(); res.json(strategist.history()); });
+
+  return r;
+}

package/server/auth/index.js

@@ -0,0 +1,340 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { ROOT, DATA_DIR } from '../config.js';
+import { db, kvGet, kvSet, registerUidResolver } from '../db.js';
+
+const ctx = new AsyncLocalStorage();
+registerUidResolver(() => ctx.getStore()?.user?.id || 1);
+
+// ---------- шифрование секретов (AES-256-GCM) ----------
+let masterKey = null;
+function getMasterKey() {
+  if (masterKey) return masterKey;
+  const envKey = (process.env.MASTER_KEY || '').trim();
+  if (envKey) {
+    masterKey = crypto.createHash('sha256').update(envKey).digest();
+    return masterKey;
+  }
+  const keyPath = path.join(DATA_DIR, '.master.key');
+  try {
+    if (fs.existsSync(keyPath)) {
+      const hex = fs.readFileSync(keyPath, 'utf8').trim();
+      if (hex.length >= 64) { masterKey = Buffer.from(hex.slice(0, 64), 'hex'); return masterKey; }
+    }
+    const rnd = crypto.randomBytes(32);
+    fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs.writeFileSync(keyPath, rnd.toString('hex'), { mode: 0o600 });
+    masterKey = rnd;
+  } catch {
+    masterKey = crypto.createHash('sha256').update(ROOT).digest();
+  }
+  return masterKey;
+}
+
+export function encryptSecret(plain) {
+  const s = String(plain ?? '').trim();
+  if (!s) return '';
+  if (s.startsWith('enc:v1:')) return s;
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', getMasterKey(), iv);
+  const enc = Buffer.concat([cipher.update(s, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `enc:v1:${iv.toString('hex')}:${tag.toString('hex')}:${enc.toString('hex')}`;
+}
+
+export function decryptSecret(val) {
+  const s = String(val ?? '').trim();
+  if (!s) return '';
+  if (!s.startsWith('enc:v1:')) return s;
+  try {
+    const [, , ivHex, tagHex, encHex] = s.split(':');
+    const decipher = crypto.createDecipheriv('aes-256-gcm', getMasterKey(), Buffer.from(ivHex, 'hex'));
+    decipher.setAuthTag(Buffer.from(tagHex, 'hex'));
+    return Buffer.concat([decipher.update(Buffer.from(encHex, 'hex')), decipher.final()]).toString('utf8');
+  } catch {
+    return '';
+  }
+}
+
+// ---------- хэширование паролей (scrypt) ----------
+export function hashPassword(password) {
+  const salt = crypto.randomBytes(16).toString('hex');
+  const hash = crypto.scryptSync(String(password), salt, 64).toString('hex');
+  return `${salt}:${hash}`;
+}
+
+export function verifyPassword(password, stored) {
+  if (!stored || !stored.includes(':')) return false;
+  const [salt, hex] = stored.split(':');
+  const hash = crypto.scryptSync(String(password), salt, 64);
+  const target = Buffer.from(hex, 'hex');
+  return hash.length === target.length && crypto.timingSafeEqual(hash, target);
+}
+
+// ---------- пользователи и сессии ----------
+export const PLANS = {
+  free: { id: 'free', name: 'Старт (Витрина)', priceRub: 0, maxRunsPerDay: 2, maxVirtualAccounts: 1, maxBrokerAccounts: 0, maxChatPerDay: 10, allowTransformer: false },
+  investor: { id: 'investor', name: 'Инвестор (Автопилот)', priceRub: 3900, maxRunsPerDay: 30, maxVirtualAccounts: 3, maxBrokerAccounts: 2, maxChatPerDay: 150, allowTransformer: false },
+  pro: { id: 'pro', name: 'Профи / Лаборатория', priceRub: 9900, maxRunsPerDay: 500, maxVirtualAccounts: 5, maxBrokerAccounts: 5, maxChatPerDay: 1000, allowTransformer: true },
+};
+
+export function generateApiKey() {
+  return `na_live_${crypto.randomBytes(16).toString('hex')}`;
+}
+
+export function ensureApiKey(userId, regenerate = false) {
+  const u = getUserById(userId);
+  if (!u) throw new Error('Пользователь не найден');
+  if (u.api_key && !regenerate) return u.api_key;
+  const key = generateApiKey();
+  db.prepare('UPDATE users SET api_key = ? WHERE id = ?').run(key, u.id);
+  return key;
+}
+
+export function getUserByApiKey(apiKey) {
+  const clean = String(apiKey || '').trim();
+  if (!clean.startsWith('na_live_')) return null;
+  return db.prepare('SELECT * FROM users WHERE api_key = ?').get(clean) || null;
+}
+
+// ---------- синхронизация лицензии для локального запуска (npx neuroalpha --key ...) ----------
+export function getLocalLicense() {
+  return kvGet('cloudLicense') || null;
+}
+
+export async function activateLocalLicense(apiKey, cloudUrl = '') {
+  const cleanKey = String(apiKey || '').trim();
+  if (!cleanKey.startsWith('na_live_')) throw new Error('Ключ должен начинаться с na_live_…');
+  const baseUrl = String(cloudUrl || process.env.CLOUD_URL || '').trim().replace(/\/+$/, '');
+  // 1) если ключ есть в этой же БД — проверяем напрямую
+  const localUser = getUserByApiKey(cleanKey);
+  if (localUser) {
+    const p = effectivePlan(localUser);
+    const lic = {
+      apiKey: cleanKey,
+      cloudUrl: baseUrl || 'local',
+      email: localUser.email,
+      name: localUser.name,
+      plan: p.id,
+      planName: p.name,
+      planUntil: localUser.plan_until || 0,
+      verifiedAt: Date.now(),
+    };
+    kvSet('cloudLicense', lic);
+    return lic;
+  }
+  // 2) иначе проверяем об облачный сервер
+  if (!baseUrl) throw new Error('Ключ не найден локально. Укажите адрес облачного сервера или активируйте ключ на сайте');
+  const r = await fetch(`${baseUrl}/api/license/verify`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${cleanKey}` },
+    body: JSON.stringify({ apiKey: cleanKey }),
+    signal: AbortSignal.timeout(15000),
+  });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok || !j.valid) throw new Error(j.error || `Не удалось проверить ключ (HTTP ${r.status})`);
+  const lic = {
+    apiKey: cleanKey,
+    cloudUrl: baseUrl,
+    email: j.email,
+    name: j.name,
+    plan: j.plan || 'free',
+    planName: j.planName || PLANS[j.plan]?.name || 'Старт',
+    planUntil: j.planUntil || 0,
+    verifiedAt: Date.now(),
+  };
+  kvSet('cloudLicense', lic);
+  // применяем тариф к локальному пользователю #1
+  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = 1').run(lic.plan, lic.planUntil);
+  return lic;
+}
+
+export function effectivePlan(user) {
+  if (!user) return PLANS.free;
+  // В локальном режиме (npx): если активирован лицензионный ключ — действует тариф подписки;
+  // если ADMIN_ALL_PRO=1 или это явно админ облака — действует его тариф
+  if (process.env.CLOUD_MODE !== '1' && user.id === 1) {
+    const lic = getLocalLicense();
+    if (lic?.plan && PLANS[lic.plan]) {
+      if (lic.plan !== 'free' && lic.planUntil > 0 && lic.planUntil < Date.now()) return PLANS.free;
+      return PLANS[lic.plan];
+    }
+    if (process.env.LOCAL_STRICT_LICENSE === '1') return PLANS.free;
+    return PLANS.pro;
+  }
+  if (user.role === 'admin') return PLANS.pro;
+  const p = PLANS[user.plan] || PLANS.free;
+  if (p.id !== 'free' && user.plan_until > 0 && user.plan_until < Date.now()) return PLANS.free;
+  return p;
+}
+
+export function publicUser(u) {
+  if (!u) return null;
+  if (!u.api_key) {
+    try { u.api_key = ensureApiKey(u.id); } catch { /* ignore */ }
+  }
+  const plan = effectivePlan(u);
+  return {
+    id: u.id,
+    email: u.email,
+    name: u.name || 'Инвестор',
+    role: u.role || 'user',
+    plan: plan.id,
+    planName: plan.name,
+    planUntil: u.plan_until || 0,
+    limits: plan,
+    apiKey: u.api_key || null,
+    tgConnected: Boolean(u.tg_chat_id),
+    maxConnected: Boolean(u.max_chat_id),
+    notifyCode: u.notify_code || null,
+    localLicense: process.env.CLOUD_MODE !== '1' ? getLocalLicense() : null,
+    createdAt: u.created_at,
+  };
+}
+
+export function getUserById(id) {
+  return db.prepare('SELECT * FROM users WHERE id = ?').get(Number(id));
+}
+
+export function currentUser() {
+  const store = ctx.getStore();
+  if (store?.user) return store.user;
+  return getUserById(1);
+}
+
+export function currentUserId() {
+  const store = ctx.getStore();
+  return store?.user?.id || 1;
+}
+
+export function runWithUser(user, fn) {
+  return ctx.run({ user }, fn);
+}
+
+export function parseCookies(cookieHeader = '') {
+  const out = {};
+  for (const part of String(cookieHeader || '').split(';')) {
+    const i = part.indexOf('=');
+    if (i > 0) out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
+  }
+  return out;
+}
+
+export function userFromRequest(req) {
+  const cookies = parseCookies(req.headers?.cookie);
+  const authHeader = String(req.headers?.authorization || '');
+  const apiKeyHeader = String(req.headers?.['x-api-key'] || '').trim();
+  const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : '';
+  const apiCandidate = apiKeyHeader || (bearer.startsWith('na_live_') ? bearer : '');
+  if (apiCandidate) {
+    const byKey = getUserByApiKey(apiCandidate);
+    if (byKey) return byKey;
+  }
+  const token = cookies.sid || bearer;
+  if (token) {
+    const sess = db.prepare('SELECT * FROM sessions WHERE token = ? AND expires_at > ?').get(token, Date.now());
+    if (sess) {
+      const u = getUserById(sess.user_id);
+      if (u) return u;
+    }
+  }
+  // В локальном режиме (без CLOUD_MODE=1) по умолчанию открывается владелец (id = 1)
+  if (process.env.CLOUD_MODE !== '1' && cookies.sid !== 'logged_out') {
+    return getUserById(1);
+  }
+  return null;
+}
+
+export function createSession(userId, days = 30) {
+  const token = crypto.randomBytes(24).toString('hex');
+  const now = Date.now();
+  db.prepare('INSERT INTO sessions (token, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
+    .run(token, Number(userId), now, now + days * 86400000);
+  return token;
+}
+
+export function deleteSession(token) {
+  if (!token) return;
+  db.prepare('DELETE FROM sessions WHERE token = ?').run(String(token));
+}
+
+export function registerUser({ email, password, name }) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  if (!cleanEmail || !cleanEmail.includes('@')) throw new Error('Укажите корректный email');
+  if (!password || String(password).length < 6) throw new Error('Пароль должен быть не короче 6 символов');
+  const existing = db.prepare('SELECT id FROM users WHERE email = ?').get(cleanEmail);
+  if (existing) throw new Error('Пользователь с таким email уже зарегистрирован');
+  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+  const apiKey = generateApiKey();
+  const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, notify_code, api_key, created_at)
+    VALUES (?, ?, ?, 'user', 'free', 0, ?, ?, ?)`).run(cleanEmail, String(name || cleanEmail.split('@')[0]).trim(), hashPassword(password), code, apiKey, Date.now());
+  return getUserById(Number(r.lastInsertRowid));
+}
+
+export function loginUser({ email, password }) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  const u = db.prepare('SELECT * FROM users WHERE email = ?').get(cleanEmail);
+  if (!u || !verifyPassword(password, u.pass_hash)) throw new Error('Неверный email или пароль');
+  return u;
+}
+
+export function ensureNotifyCode(userId) {
+  const u = getUserById(userId);
+  if (!u) throw new Error('Пользователь не найден');
+  if (u.notify_code) return u.notify_code;
+  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+  db.prepare('UPDATE users SET notify_code = ? WHERE id = ?').run(code, u.id);
+  return code;
+}
+
+export function listAllUsers() {
+  return db.prepare('SELECT * FROM users ORDER BY id ASC').all().map(publicUser);
+}
+
+export function setUserPlan(userId, plan, days = 30) {
+  if (!(plan in PLANS)) throw new Error(`Неизвестный тариф: ${plan}`);
+  const until = plan === 'free' ? 0 : Date.now() + Math.max(1, Number(days) || 30) * 86400000;
+  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(plan, until, Number(userId));
+  return publicUser(getUserById(userId));
+}
+
+// ---------- промокоды ----------
+export function createPromoCode({ code, plan = 'investor', days = 14, maxUses = 50 }) {
+  const clean = String(code || '').trim().toUpperCase().replace(/[^A-Z0-9_-]/g, '');
+  if (clean.length < 3) throw new Error('Код должен содержать минимум 3 символа (латиница/цифры)');
+  if (!(plan in PLANS) || plan === 'free') throw new Error('Выберите тариф Инвестор или Профи');
+  const d = Math.max(1, Math.min(365, Math.round(Number(days) || 14)));
+  const m = Math.max(1, Math.min(10000, Math.round(Number(maxUses) || 50)));
+  db.prepare(`INSERT OR REPLACE INTO promocodes (code, plan, days, max_uses, used_count, created_at)
+    VALUES (?, ?, ?, ?, COALESCE((SELECT used_count FROM promocodes WHERE code = ?), 0), ?)`).run(clean, plan, d, m, clean, Date.now());
+  return listPromoCodes();
+}
+
+export function listPromoCodes() {
+  return db.prepare('SELECT * FROM promocodes ORDER BY created_at DESC').all();
+}
+
+export function redeemPromoCode(userId, rawCode) {
+  if (!userId) throw new Error('Войдите в аккаунт для активации промокода');
+  const clean = String(rawCode || '').trim().toUpperCase();
+  const promo = db.prepare('SELECT * FROM promocodes WHERE UPPER(code) = ?').get(clean);
+  if (!promo) throw new Error('Промокод не найден');
+  if (promo.used_count >= promo.max_uses) throw new Error('Лимит активаций этого промокода исчерпан');
+  const already = db.prepare('SELECT 1 FROM promocode_uses WHERE code = ? AND user_id = ?').get(promo.code, Number(userId));
+  if (already) throw new Error('Вы уже активировали этот промокод');
+  const u = getUserById(userId);
+  const baseTs = u.plan === promo.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
+  const nextUntil = baseTs + promo.days * 86400000;
+  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(promo.plan, nextUntil, u.id);
+  db.prepare('UPDATE promocodes SET used_count = used_count + 1 WHERE code = ?').run(promo.code);
+  db.prepare('INSERT INTO promocode_uses (code, user_id, used_at) VALUES (?, ?, ?)').run(promo.code, u.id, Date.now());
+  return publicUser(getUserById(userId));
+}
+
+export function authMiddleware(req, res, next) {
+  const u = userFromRequest(req);
+  req.user = u;
+  return runWithUser(u, () => next());
+}