neuroalpha 0.5.17 → 0.5.19

package/public/styles.css

@@ -15,6 +15,9 @@
   --yellow: #d29922;
   --violet: #a371f7;
   --best-bg: #13241a;
+  --blocked-bg: rgba(244, 114, 182, 0.14);
+  --blocked-fg: #f472b6;
+  --blocked-border: rgba(244, 114, 182, 0.48);
   --flash-bg: #2a1f45;
   --chat-w: 38%;
   --accent-bg: rgba(88, 149, 255, 0.15);
@@ -36,6 +39,9 @@ body.light {
   --yellow: #9a6700;
   --violet: #8250df;
   --best-bg: #dcfce7;
+  --blocked-bg: #fce7f3;
+  --blocked-fg: #be185d;
+  --blocked-border: #f9a8d4;
   --flash-bg: #ede9fe;
   --accent-bg: rgba(36, 87, 214, 0.09);
   --hover-bg: #f0f3f6;
@@ -297,10 +303,13 @@ th, td { text-align: left; padding: 5px 8px; border-bottom: 1px solid var(--line
 th { color: var(--muted); font-weight: 500; }
 td.num, th.num { text-align: right; font-variant-numeric: tabular-nums; }
 tr.best td { background: var(--best-bg); }
+tr.fc-blocked td { background: var(--blocked-bg); }
+tr.fc-blocked td:first-child { box-shadow: inset 3px 0 0 var(--blocked-fg); }
 .tag { font-size: 11px; padding: 0 6px; border-radius: 4px; border: 1px solid var(--line); color: var(--muted); }
 .tag.ok { border-color: var(--green); color: var(--green); }
 .tag.no { border-color: var(--red); color: var(--red); }
 .tag.mid { border-color: var(--yellow); color: var(--yellow); }
+.tag.blocked { border-color: var(--blocked-border); color: var(--blocked-fg); background: var(--blocked-bg); font-weight: 500; }
 .stab-box { background: var(--panel); border: 1px solid var(--line); border-radius: 8px; padding: 10px 14px; margin: 8px 0 10px; font-size: 13px; }
 .stab-head { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
 .stab-chips { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 8px; }
@@ -583,7 +592,7 @@ details.hist-year-box[open] > summary { border-bottom: 1px solid var(--line); }
   background: var(--accent);
   border-radius: 4px;
 }
-
-/* Прогноз: две таблицы с общей сеткой колонок */
-.fc-table td, .fc-table th { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+/* Прогноз: две таблицы с общей сеткой колонок */
+.fc-table td, .fc-table th { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 

package/scripts/set-admin-password.mjs

@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
+// Задать email и пароль главного администратора (пользователь №1) или добавить/обновить второго (запасного) администратора (--add).
+//   ADMIN_PASS='…' node scripts/set-admin-password.mjs --email admin@neuroalpha.odant.org
+//   ADMIN_PASS='…' node scripts/set-admin-password.mjs --add --email backup@neuroalpha.odant.org --name "Запасной админ"
+//   kubectl exec -it deploy/neuroalpha-central -- env ADMIN_PASS='…' node scripts/set-admin-password.mjs --email admin@…
+// Пароль берётся из переменной ADMIN_PASS (чтобы не попадал в историю команд как аргумент).
+import { db } from '../server/db.js';
+import { hashPassword, ensureApiKey, createOrUpdateAdminUser } from '../server/auth/index.js';
+
+const i = process.argv.indexOf('--email');
+const iName = process.argv.indexOf('--name');
+const isAdd = process.argv.includes('--add') || process.argv.includes('--second');
+const email = String(i >= 0 ? process.argv[i + 1] : '').trim().toLowerCase();
+const name = iName >= 0 ? String(process.argv[iName + 1] || '').trim() : '';
+const pass = String(process.env.ADMIN_PASS || '');
+if (!email.includes('@') || pass.length < 10) {
+  console.error('Укажите --email и пароль не короче 10 символов в переменной ADMIN_PASS');
+  process.exit(1);
+}
+if (isAdd) {
+  const u = createOrUpdateAdminUser({ email, password: pass, name: name || 'Администратор' });
+  db.prepare('DELETE FROM sessions WHERE user_id = ?').run(u.id);
+  console.log(`✓ Запасной администратор (#${u.id}): ${u.email}. Прежние сессии этого аккаунта завершены.`);
+  process.exit(0);
+}
+db.prepare("UPDATE users SET email = ?, name = COALESCE(NULLIF(?, ''), name), pass_hash = ?, role = 'admin', plan = 'owner', plan_until = 0 WHERE id = 1").run(email, name, hashPassword(pass));
+ensureApiKey(1);
+db.prepare('DELETE FROM sessions WHERE user_id = 1').run();
+console.log(`✓ Главный администратор (#1): ${email}. Все прежние сессии администратора завершены.`);
+process.exit(0);

package/server/api/routes.js

@@ -6,13 +6,13 @@ import { ROOT, strategyDefaults } from '../config.js';
 import { activeModelInfo } from '../llm/client.js';
 import { listProviders, getSelected, addProvider, updateProvider, deleteProvider, fetchRemoteModels, testProvider, selectModel, resolveUpstreamForProxy, providerFetch } from '../llm/providers.js';
 import { listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle, setRunShowcase, listShowcaseRuns, countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal, listSettingsHistory, kvGet, kvSet, db, loadCandles } from '../db.js';
-import { PLANS, effectivePlan, publicUser, getUserById, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createPromoCode, listPromoCodes, redeemPromoCode, acceptUserOffer, createVipRequest, listVipRequests, parseCookies, publicOAuthConfig, saveOAuthConfig, startOAuthRedirect, completeOAuthCallback, verifyTelegramLoginWidget } from '../auth/index.js';
-import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments } from '../billing/yookassa.js';
+import { PLANS, effectivePlan, publicUser, getUserById, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createOrUpdateAdminUser, createPromoCode, listPromoCodes, redeemPromoCode, acceptUserOffer, createVipRequest, listVipRequests, parseCookies, publicOAuthConfig, saveOAuthConfig, startOAuthRedirect, completeOAuthCallback, verifyTelegramLoginWidget } from '../auth/index.js';
+import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments, listUserPayments } from '../billing/yookassa.js';
 import { publicNotifyConfig, getNotifyConfig, saveNotifyConfig, notifyUser, createTelegramLoginChallenge, checkTelegramLoginChallenge, handleMaxWebhook } from '../notify/index.js';
 import { PARAMS } from '../params-meta.js';
 import { getSettings, updateSettings, resetSettings, revertSettingsChange } from '../settings.js';
 import { startModelResearch, cancelModelResearch, startStabilityCheck, cancelStabilityCheck } from '../model/research.js';
-import { forecastNow, TIER1_LIQUID_SYMBOLS } from '../model/forecast.js';
+import { forecastNow, TIER1_LIQUID_SYMBOLS, symbolEdgeMult } from '../model/forecast.js';
 import { profilesInfo, startProfilesRefresh, TRAITS, loadProfiles } from '../model/profiles.js';
 import { ensureDividends } from '../data/moex.js';
 import { live } from '../model/live.js';
@@ -25,7 +25,7 @@ import { isCrossOrigin } from '../security.js';
 import { IS_CENTRAL, IS_INSTANCE, CENTRAL_URL, clientIp, isHttpsRequest } from '../role.js';
 import { consumeSsoToken } from '../instance/agent.js';
 import { IS_DESKTOP } from '../role.js';
-import { listInstances, createInstance, rotateInstanceKey, setInstanceTrading, setInstanceRevoked, deleteInstance, instanceByKey, instanceHeartbeat, cabinetInstances, ssoRedirectUrl, relayInstanceNotify, centralPublicKeyPem, createDesktopActivationCode, activateDesktopInstall, unbindInstall } from '../instance/central.js';
+import { listInstances, createInstance, rotateInstanceKey, setInstanceTrading, setInstanceRevoked, deleteInstance, instanceByKey, instanceHeartbeat, cabinetInstances, ensureUserCloudInstance, ssoRedirectUrl, relayInstanceNotify, centralPublicKeyPem, createDesktopActivationCode, activateDesktopInstall, unbindInstall } from '../instance/central.js';
 import { activateDesktop, instanceInfo } from '../instance/agent.js';
 import { isActivated } from '../instance/identity.js';
 
@@ -74,7 +74,7 @@ export function createRouter() {
     res.setHeader('Set-Cookie', `sid=${encodeURIComponent(sid)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure}`);
   };
   r.get('/auth/me', (req, res) => res.json({
-    user: req.user ? { ...publicUser(req.user), instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [] } : null,
+    user: req.user ? { ...publicUser(req.user), instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } : null,
     downloads: IS_CENTRAL ? {
       windows: process.env.DESKTOP_DOWNLOAD_WINDOWS || '',
       linux: process.env.DESKTOP_DOWNLOAD_LINUX || '',
@@ -221,10 +221,11 @@ export function createRouter() {
     if (!sent.tg && !sent.max) throw new Error('Сначала привяжите Telegram или MAX по вашему коду привязки');
     res.json({ ok: true, ...sent });
   }));
-  r.post('/auth/redeem-promo', wrap((req, res) => {
+  r.post('/auth/redeem-promo', wrap(async (req, res) => {
     if (!req.user) throw new Error('Войдите в аккаунт для активации кода или VIP-токена');
     const user = redeemPromoCode(req.user.id, req.body?.code);
-    res.json({ user });
+    if (IS_CENTRAL) await ensureUserCloudInstance(req.user.id).catch(() => {});
+    res.json({ user: { ...user, instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } });
   }));
   r.post('/auth/accept-offer', wrap((req, res) => {
     if (!req.user) throw new Error('Войдите в аккаунт');
@@ -277,12 +278,25 @@ export function createRouter() {
   }));
   r.post('/billing/verify', wrap(async (req, res) => {
     if (!req.user) throw new Error('Войдите в аккаунт');
-    if (req.body?.paymentId) return res.json(await verifyYookassaPayment(req.body.paymentId));
-    return res.json(await verifyUserLatestPayment(req.user.id));
+    const out = req.body?.paymentId
+      ? await verifyYookassaPayment(req.body.paymentId)
+      : await verifyUserLatestPayment(req.user.id);
+    if (IS_CENTRAL && out?.status === 'succeeded') {
+      await ensureUserCloudInstance(req.user.id).catch(() => {});
+    }
+    res.json({
+      ...out,
+      user: out?.user ? { ...out.user, instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } : null,
+    });
   }));
   r.post('/billing/yookassa/webhook', wrap(async (req, res) => {
     const pid = req.body?.object?.id;
-    if (pid) await verifyYookassaPayment(pid).catch(() => {});
+    if (pid) {
+      const out = await verifyYookassaPayment(pid).catch(() => null);
+      if (IS_CENTRAL && out?.status === 'succeeded' && out?.user?.id) {
+        await ensureUserCloudInstance(out.user.id).catch(() => {});
+      }
+    }
     res.json({ ok: true });
   }));
   r.post('/notify/max/webhook', wrap(async (req, res) => {
@@ -393,9 +407,15 @@ export function createRouter() {
     requireAdmin(req);
     res.json({ promos: createPromoCode(req.body || {}) });
   }));
-  r.post('/admin/user-plan', wrap((req, res) => {
+  r.post('/admin/user-plan', wrap(async (req, res) => {
+    requireAdmin(req);
+    const user = setUserPlan(req.body?.userId, req.body?.plan, req.body?.days || 30);
+    if (IS_CENTRAL) await ensureUserCloudInstance(req.body?.userId).catch(() => {});
+    res.json({ user, users: listAllUsers() });
+  }));
+  r.post('/admin/create-admin', wrap((req, res) => {
     requireAdmin(req);
-    res.json({ user: setUserPlan(req.body?.userId, req.body?.plan, req.body?.days || 30), users: listAllUsers() });
+    res.json({ user: createOrUpdateAdminUser(req.body || {}), users: listAllUsers() });
   }));
   r.post('/admin/billing', wrap((req, res) => {
     requireAdmin(req);
@@ -636,6 +656,7 @@ export function createRouter() {
     const vocabHit = vocabList.find((v) => v.symbol === sym);
     const fcRow = fc?.rows?.find((x) => x.symbol === sym) || null;
     const isTier1 = TIER1_LIQUID_SYMBOLS.has(sym);
+    const tierMult = symbolEdgeMult(sym);
 
     // 10-минутные свечи за последние 30 дней (для детального просмотра 1Д / 1Н / 1М) + дневной ряд за всё время (1Г / Все)
     const nowTs = Date.now();
@@ -727,8 +748,8 @@ export function createRouter() {
       yearChangePct,
       tier: isTier1 ? 1 : 2,
       tierLabel: isTier1 ? '1-й эшелон (высокая ликвидность)' : '2-й эшелон',
-      buyThresholdPct: isTier1 ? Math.max(fc?.buyThresholdPct || 0.30, 0.30) : Math.max(fc?.buyThresholdPct || 0.30, 0.35),
-      shortThresholdPct: isTier1 ? Math.max(fc?.shortThresholdPct || 0.31, 0.31) : Math.max(fc?.shortThresholdPct || 0.31, 0.36),
+      buyThresholdPct: fcRow?.buyThresholdPct ?? round(Math.max((fc?.buyThresholdPct || 0.413) * tierMult, 0.30), 3),
+      shortThresholdPct: fcRow?.shortThresholdPct ?? round(Math.max((fc?.shortThresholdPct || 0.516) * tierMult, 0.31), 3),
       shortAllowedByBroker: shortableMap[sym] !== undefined ? Boolean(shortableMap[sym]) : null,
       specs: {
         lotSize: sp.lotSize,
@@ -748,6 +769,12 @@ export function createRouter() {
         signal: Boolean(fcRow.signal),
         shortSignal: Boolean(fcRow.shortSignal),
         shortBlockedByBroker: Boolean(fcRow.shortBlockedByBroker),
+        shortBlockedBySqueeze: Boolean(fcRow.shortBlockedBySqueeze),
+        buyBlockedByDip: Boolean(fcRow.buyBlockedByDip),
+        buyBlockedByDiv: fcRow.buyBlockedByDiv || null,
+        shortBlockedByDiv: fcRow.shortBlockedByDiv || null,
+        buyBlockedByNews: fcRow.buyBlockedByNews || null,
+        shortBlockedByNews: fcRow.shortBlockedByNews || null,
         selfPct: fcRow.selfPct ?? 0,
         influences: (fcRow.influences || []).map((inf) => {
           const infRow = fc?.rows?.find((x) => x.symbol === inf.symbol);

package/server/auth/index.js

@@ -281,7 +281,7 @@ export function effectivePlan(user) {
     if (process.env.LOCAL_STRICT_LICENSE === '1') return PLANS.none;
     return PLANS.owner;
   }
-  if (user.role === 'admin' || user.plan === 'owner') return PLANS[user.plan] || PLANS.owner;
+  if (user.id === 1 || user.role === 'admin' || user.plan === 'owner') return PLANS.owner;
   const p = PLANS[user.plan] || PLANS.none;
   if (p.id !== 'none' && user.plan_until > 0 && user.plan_until < Date.now()) return PLANS.none;
   return p;
@@ -445,9 +445,36 @@ export function listAllUsers() {
 
 export function setUserPlan(userId, plan, days = 30) {
   if (!(plan in PLANS)) throw new Error(`Неизвестный тариф: ${plan}`);
+  const uid = Number(userId);
+  if (!uid) throw new Error('Некорректный ID пользователя');
   const until = (plan === 'none' || plan === 'owner') ? 0 : Date.now() + Math.max(1, Number(days) || 30) * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(plan, until, Number(userId));
-  return publicUser(getUserById(userId));
+  // Тариф «Хозяин» (owner) даёт права администратора (role = 'admin'); главный владелец (id = 1) всегда сохраняет роль admin
+  const role = (plan === 'owner' || uid === 1) ? 'admin' : 'user';
+  db.prepare('UPDATE users SET plan = ?, plan_until = ?, role = ? WHERE id = ?').run(plan, until, role, uid);
+  return publicUser(getUserById(uid));
+}
+
+export function createOrUpdateAdminUser({ email, password, name }) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  if (!cleanEmail || !cleanEmail.includes('@')) throw new Error('Укажите корректный email администратора');
+  const existing = db.prepare('SELECT * FROM users WHERE email = ?').get(cleanEmail);
+  const cleanPass = String(password || '').trim();
+  if (existing) {
+    if (cleanPass && cleanPass.length < 6) throw new Error('Пароль должен быть не короче 6 символов');
+    const nextHash = cleanPass ? hashPassword(cleanPass) : existing.pass_hash;
+    const nextName = String(name || '').trim() || existing.name || 'Администратор';
+    db.prepare("UPDATE users SET name = ?, pass_hash = ?, role = 'admin', plan = 'owner', plan_until = 0 WHERE id = ?")
+      .run(nextName, nextHash, existing.id);
+    ensureApiKey(existing.id);
+    return publicUser(getUserById(existing.id));
+  }
+  if (cleanPass.length < 6) throw new Error('Для нового администратора укажите пароль не короче 6 символов');
+  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+  const apiKey = generateApiKey();
+  const cleanName = String(name || '').trim() || 'Администратор';
+  const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, notify_code, api_key, offer_accepted_at, created_at)
+    VALUES (?, ?, ?, 'admin', 'owner', 0, ?, ?, ?, ?)`).run(cleanEmail, cleanName, hashPassword(cleanPass), code, apiKey, Date.now(), Date.now());
+  return publicUser(getUserById(Number(r.lastInsertRowid)));
 }
 
 // ---------- промокоды и персональные VIP-токены ----------
@@ -480,7 +507,11 @@ export function redeemPromoCode(userId, rawCode) {
   const u = getUserById(userId);
   const baseTs = u.plan === promo.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
   const nextUntil = baseTs + promo.days * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ?, offer_accepted_at = COALESCE(NULLIF(offer_accepted_at, 0), ?) WHERE id = ?').run(promo.plan, nextUntil, Date.now(), u.id);
+  if (u.id === 1 || u.role === 'admin') {
+    db.prepare('UPDATE users SET offer_accepted_at = COALESCE(NULLIF(offer_accepted_at, 0), ?) WHERE id = ?').run(Date.now(), u.id);
+  } else {
+    db.prepare('UPDATE users SET plan = ?, plan_until = ?, offer_accepted_at = COALESCE(NULLIF(offer_accepted_at, 0), ?) WHERE id = ?').run(promo.plan, nextUntil, Date.now(), u.id);
+  }
   db.prepare('UPDATE promocodes SET used_count = used_count + 1 WHERE code = ?').run(promo.code);
   db.prepare('INSERT INTO promocode_uses (code, user_id, used_at) VALUES (?, ?, ?)').run(promo.code, u.id, Date.now());
   return publicUser(getUserById(userId));

package/server/billing/yookassa.js

@@ -1,133 +1,142 @@
-// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
-import crypto from 'node:crypto';
-import { db, kvGet, kvSet } from '../db.js';
-import { PLANS, encryptSecret, decryptSecret, getUserById, publicUser } from '../auth/index.js';
-
-export function getBillingConfig() {
-  const saved = kvGet('yookassaConfig') || {};
-  const shopId = String(saved.shopId || process.env.YOOKASSA_SHOP_ID || '').trim();
-  const secretKey = decryptSecret(saved.secretKey || '') || String(process.env.YOOKASSA_SECRET_KEY || '').trim();
-  const sendReceipt = saved.sendReceipt !== undefined ? Boolean(saved.sendReceipt) : (process.env.YOOKASSA_RECEIPT === '1');
-  const vatCode = Number(saved.vatCode || process.env.YOOKASSA_VAT_CODE || 1);
-  return { shopId, secretKey, sendReceipt, vatCode, enabled: Boolean(shopId && secretKey) };
-}
-
-export function publicBillingConfig() {
-  const c = getBillingConfig();
-  return { shopId: c.shopId, hasSecret: Boolean(c.secretKey), sendReceipt: c.sendReceipt, vatCode: c.vatCode, enabled: c.enabled, plans: PLANS };
-}
-
-export function saveBillingConfig(input = {}) {
-  const prev = kvGet('yookassaConfig') || {};
-  const next = {
-    shopId: String(input.shopId ?? prev.shopId ?? '').trim(),
-    secretKey: input.clearSecret ? '' : (input.secretKey && String(input.secretKey).trim() ? encryptSecret(input.secretKey) : (prev.secretKey || '')),
-    sendReceipt: input.sendReceipt !== undefined ? Boolean(input.sendReceipt) : Boolean(prev.sendReceipt),
-    vatCode: Number(input.vatCode ?? prev.vatCode ?? 1) || 1,
-  };
-  kvSet('yookassaConfig', next);
-  return publicBillingConfig();
-}
-
-export async function createYookassaPayment({ user, plan, months = 1, returnOrigin = 'http://localhost:3000' }) {
-  if (!user) throw new Error('Войдите в аккаунт для оформления подписки');
-  const planObj = PLANS[plan];
-  if (!planObj || planObj.priceRub <= 0) throw new Error('Выберите платный тариф (Инвестор или Профи)');
-  const m = Math.max(1, Math.min(12, Math.floor(Number(months) || 1)));
-  const discount = m >= 12 ? 0.8 : m >= 3 ? 0.9 : 1;
-  const amountRub = Math.round(planObj.priceRub * m * discount);
-  const cfg = getBillingConfig();
-  if (!cfg.enabled) throw new Error('Платёжный шлюз ЮKassa ещё не настроен администратором (укажите Shop ID и секретный ключ)');
-
-  const description = `Подписка «${planObj.name}» на ${m} мес. (${user.email})`;
-  const payload = {
-    amount: { value: amountRub.toFixed(2), currency: 'RUB' },
-    capture: true,
-    confirmation: {
-      type: 'redirect',
-      return_url: `${returnOrigin.replace(/\/+$/, '')}/?payment_check=1`,
-    },
-    description,
-    metadata: { userId: String(user.id), plan, months: String(m) },
-  };
-  if (cfg.sendReceipt && user.email) {
-    payload.receipt = {
-      customer: { email: user.email },
-      items: [{
-        description: description.slice(0, 128),
-        quantity: '1.00',
-        amount: { value: amountRub.toFixed(2), currency: 'RUB' },
-        vat_code: cfg.vatCode,
-        payment_mode: 'full_payment',
-        payment_subject: 'service',
-      }],
-    };
-  }
-
-  const auth = Buffer.from(`${cfg.shopId}:${cfg.secretKey}`).toString('base64');
-  const r = await fetch('https://api.yookassa.ru/v3/payments', {
-    method: 'POST',
-    headers: {
-      Authorization: `Basic ${auth}`,
-      'Idempotence-Key': crypto.randomUUID(),
-      'Content-Type': 'application/json',
-    },
-    body: JSON.stringify(payload),
-    signal: AbortSignal.timeout(20000),
-  });
-  const j = await r.json().catch(() => ({}));
-  if (!r.ok || !j.id) throw new Error(j.description || `Ошибка ЮKassa: HTTP ${r.status}`);
-
-  db.prepare(`INSERT OR REPLACE INTO payments (id, user_id, plan, months, amount_rub, status, created_at, raw)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(j.id, user.id, plan, m, amountRub, j.status || 'pending', Date.now(), JSON.stringify(j));
-
-  return {
-    paymentId: j.id,
-    status: j.status,
-    amountRub,
-    confirmationUrl: j.confirmation?.confirmation_url || null,
-  };
-}
-
-function applyPaidSubscription(payRow, remoteObj) {
-  if (!payRow || payRow.status === 'succeeded') return;
-  const u = getUserById(payRow.user_id);
-  if (!u) return;
-  const baseTs = u.plan === payRow.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
-  const nextUntil = baseTs + (Number(payRow.months) || 1) * 30 * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(payRow.plan, nextUntil, u.id);
-  db.prepare('UPDATE payments SET status = ?, paid_at = ?, raw = ? WHERE id = ?')
-    .run('succeeded', Date.now(), JSON.stringify(remoteObj || {}), payRow.id);
-}
-
-export async function verifyYookassaPayment(paymentId) {
-  const row = db.prepare('SELECT * FROM payments WHERE id = ?').get(String(paymentId));
-  if (!row) throw new Error('Платёж не найден');
-  if (row.status === 'succeeded') return { status: 'succeeded', user: publicUser(getUserById(row.user_id)) };
-  const cfg = getBillingConfig();
-  if (!cfg.enabled) throw new Error('ЮKassa не настроена');
-  const auth = Buffer.from(`${cfg.shopId}:${cfg.secretKey}`).toString('base64');
-  const r = await fetch(`https://api.yookassa.ru/v3/payments/${encodeURIComponent(row.id)}`, {
-    headers: { Authorization: `Basic ${auth}` },
-    signal: AbortSignal.timeout(15000),
-  });
-  const j = await r.json().catch(() => ({}));
-  if (!r.ok) throw new Error(j.description || `HTTP ${r.status}`);
-  if (j.status === 'succeeded' && j.paid) {
-    applyPaidSubscription(row, j);
-  } else if (j.status && j.status !== row.status) {
-    db.prepare('UPDATE payments SET status = ?, raw = ? WHERE id = ?').run(j.status, JSON.stringify(j), row.id);
-  }
-  return { status: j.status, user: publicUser(getUserById(row.user_id)) };
-}
-
-export async function verifyUserLatestPayment(userId) {
-  const row = db.prepare("SELECT * FROM payments WHERE user_id = ? AND status = 'pending' ORDER BY created_at DESC LIMIT 1").get(Number(userId));
-  if (!row) return { status: 'none', user: publicUser(getUserById(userId)) };
-  return verifyYookassaPayment(row.id);
-}
-
-export function listAllPayments(limit = 100) {
-  return db.prepare(`SELECT p.id, p.user_id, u.email, p.plan, p.months, p.amount_rub, p.status, p.created_at, p.paid_at
-    FROM payments p LEFT JOIN users u ON u.id = p.user_id ORDER BY p.created_at DESC LIMIT ?`).all(limit);
-}
+// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
+import crypto from 'node:crypto';
+import { db, kvGet, kvSet } from '../db.js';
+import { PLANS, encryptSecret, decryptSecret, getUserById, publicUser } from '../auth/index.js';
+
+export function getBillingConfig() {
+  const saved = kvGet('yookassaConfig') || {};
+  const shopId = String(saved.shopId || process.env.YOOKASSA_SHOP_ID || '').trim();
+  const secretKey = decryptSecret(saved.secretKey || '') || String(process.env.YOOKASSA_SECRET_KEY || '').trim();
+  const sendReceipt = saved.sendReceipt !== undefined ? Boolean(saved.sendReceipt) : (process.env.YOOKASSA_RECEIPT === '1');
+  const vatCode = Number(saved.vatCode || process.env.YOOKASSA_VAT_CODE || 1);
+  return { shopId, secretKey, sendReceipt, vatCode, enabled: Boolean(shopId && secretKey) };
+}
+
+export function publicBillingConfig() {
+  const c = getBillingConfig();
+  return { shopId: c.shopId, hasSecret: Boolean(c.secretKey), sendReceipt: c.sendReceipt, vatCode: c.vatCode, enabled: c.enabled, plans: PLANS };
+}
+
+export function saveBillingConfig(input = {}) {
+  const prev = kvGet('yookassaConfig') || {};
+  const next = {
+    shopId: String(input.shopId ?? prev.shopId ?? '').trim(),
+    secretKey: input.clearSecret ? '' : (input.secretKey && String(input.secretKey).trim() ? encryptSecret(input.secretKey) : (prev.secretKey || '')),
+    sendReceipt: input.sendReceipt !== undefined ? Boolean(input.sendReceipt) : Boolean(prev.sendReceipt),
+    vatCode: Number(input.vatCode ?? prev.vatCode ?? 1) || 1,
+  };
+  kvSet('yookassaConfig', next);
+  return publicBillingConfig();
+}
+
+export async function createYookassaPayment({ user, plan, months = 1, returnOrigin = 'http://localhost:3000' }) {
+  if (!user) throw new Error('Войдите в аккаунт для оформления подписки');
+  const planObj = PLANS[plan];
+  if (!planObj || planObj.priceRub <= 0) throw new Error('Выберите платный тариф (Инвестор или Профи)');
+  const m = Math.max(1, Math.min(12, Math.floor(Number(months) || 1)));
+  const discount = m >= 12 ? 0.8 : m >= 3 ? 0.9 : 1;
+  const amountRub = Math.round(planObj.priceRub * m * discount);
+  const cfg = getBillingConfig();
+  if (!cfg.enabled) throw new Error('Платёжный шлюз ЮKassa ещё не настроен администратором (укажите Shop ID и секретный ключ)');
+
+  const description = `Подписка «${planObj.name}» на ${m} мес. (${user.email})`;
+  const payload = {
+    amount: { value: amountRub.toFixed(2), currency: 'RUB' },
+    capture: true,
+    confirmation: {
+      type: 'redirect',
+      return_url: `${returnOrigin.replace(/\/+$/, '')}/landing?payment_check=1`,
+    },
+    description,
+    metadata: { userId: String(user.id), plan, months: String(m) },
+  };
+  if (cfg.sendReceipt && user.email) {
+    payload.receipt = {
+      customer: { email: user.email },
+      items: [{
+        description: description.slice(0, 128),
+        quantity: '1.00',
+        amount: { value: amountRub.toFixed(2), currency: 'RUB' },
+        vat_code: cfg.vatCode,
+        payment_mode: 'full_payment',
+        payment_subject: 'service',
+      }],
+    };
+  }
+
+  const auth = Buffer.from(`${cfg.shopId}:${cfg.secretKey}`).toString('base64');
+  const r = await fetch('https://api.yookassa.ru/v3/payments', {
+    method: 'POST',
+    headers: {
+      Authorization: `Basic ${auth}`,
+      'Idempotence-Key': crypto.randomUUID(),
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(20000),
+  });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok || !j.id) throw new Error(j.description || `Ошибка ЮKassa: HTTP ${r.status}`);
+
+  db.prepare(`INSERT OR REPLACE INTO payments (id, user_id, plan, months, amount_rub, status, created_at, raw)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(j.id, user.id, plan, m, amountRub, j.status || 'pending', Date.now(), JSON.stringify(j));
+
+  return {
+    paymentId: j.id,
+    status: j.status,
+    amountRub,
+    confirmationUrl: j.confirmation?.confirmation_url || null,
+  };
+}
+
+function applyPaidSubscription(payRow, remoteObj) {
+  if (!payRow || payRow.status === 'succeeded') return;
+  const u = getUserById(payRow.user_id);
+  if (!u) return;
+  const baseTs = u.plan === payRow.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
+  const nextUntil = baseTs + (Number(payRow.months) || 1) * 30 * 86400000;
+  // Главный владелец и администраторы сохраняют полный тариф owner
+  if (u.id !== 1 && u.role !== 'admin') {
+    db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(payRow.plan, nextUntil, u.id);
+  }
+  db.prepare('UPDATE payments SET status = ?, paid_at = ?, raw = ? WHERE id = ?')
+    .run('succeeded', Date.now(), JSON.stringify(remoteObj || {}), payRow.id);
+}
+
+export async function verifyYookassaPayment(paymentId) {
+  const row = db.prepare('SELECT * FROM payments WHERE id = ?').get(String(paymentId));
+  if (!row) throw new Error('Платёж не найден');
+  if (row.status === 'succeeded') return { status: 'succeeded', user: publicUser(getUserById(row.user_id)) };
+  const cfg = getBillingConfig();
+  if (!cfg.enabled) throw new Error('ЮKassa не настроена');
+  const auth = Buffer.from(`${cfg.shopId}:${cfg.secretKey}`).toString('base64');
+  const r = await fetch(`https://api.yookassa.ru/v3/payments/${encodeURIComponent(row.id)}`, {
+    headers: { Authorization: `Basic ${auth}` },
+    signal: AbortSignal.timeout(15000),
+  });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(j.description || `HTTP ${r.status}`);
+  if (j.status === 'succeeded' && j.paid) {
+    applyPaidSubscription(row, j);
+  } else if (j.status && j.status !== row.status) {
+    db.prepare('UPDATE payments SET status = ?, raw = ? WHERE id = ?').run(j.status, JSON.stringify(j), row.id);
+  }
+  return { status: j.status, user: publicUser(getUserById(row.user_id)) };
+}
+
+export async function verifyUserLatestPayment(userId) {
+  const row = db.prepare("SELECT * FROM payments WHERE user_id = ? AND status = 'pending' ORDER BY created_at DESC LIMIT 1").get(Number(userId));
+  if (!row) return { status: 'none', user: publicUser(getUserById(userId)) };
+  return verifyYookassaPayment(row.id);
+}
+
+export function listAllPayments(limit = 100) {
+  return db.prepare(`SELECT p.id, p.user_id, u.email, p.plan, p.months, p.amount_rub, p.status, p.created_at, p.paid_at
+    FROM payments p LEFT JOIN users u ON u.id = p.user_id ORDER BY p.created_at DESC LIMIT ?`).all(limit);
+}
+
+export function listUserPayments(userId, limit = 20) {
+  if (!userId) return [];
+  return db.prepare(`SELECT id, plan, months, amount_rub, status, created_at, paid_at
+    FROM payments WHERE user_id = ? ORDER BY created_at DESC LIMIT ?`).all(Number(userId), limit);
+}