Item'])) {
        foreach ($response['CallbackMetadata']['Item'] as $item) {
            if (is_array($item) && isset($item['Name'])) {
                $meta[(string) $item['Name']] = $item['Value'] ?? '';
            }
        }
    }
    $receipt = trim((string) ($meta['MpesaReceiptNumber'] ?? ''));
    $accountReference = trim((string) ($stkState['account_reference'] ?? (string) ($order['payment_ref'] ?? '')));
    return dsa_apply_mpesa_payment_success($pdo, $orderId, $receipt, $accountReference);
}

function dsa_try_confirm_gateway_payment(PDO $pdo, int $orderId, bool $force = false): bool
{
    if ($orderId <= 0) {
        return false;
    }
    $beforeStmt = $pdo->prepare("select status from orders where id = :id limit 1");
    $beforeStmt->execute([':id' => $orderId]);
    $beforeStatus = (string) ($beforeStmt->fetchColumn() ?: '');
    if (in_array($beforeStatus, ['paid', 'fulfilled'], true)) {
        return false;
    }
    dsa_try_sync_mpesa_payment_status($pdo, $orderId);
    dsa_sync_paid_signal_from_whmcs($pdo, $orderId, $force);
    $beforeStmt->execute([':id' => $orderId]);
    $afterStatus = (string) ($beforeStmt->fetchColumn() ?: '');

    return $beforeStatus === 'pending_payment' && in_array($afterStatus, ['paid', 'fulfilled'], true);
}

function dsa_order_payment_status_payload(PDO $pdo, int $orderId): array
{
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order) {
        return ['ok' => false, 'message' => 'Order not found.'];
    }
    $status = (string) ($order['status'] ?? 'pending_payment');
    $clientStatus = dsa_customer_order_status_label((array) $order);
    $paid = in_array($status, ['paid', 'fulfilled'], true);

    return [
        'ok' => true,
        'order_id' => $orderId,
        'status' => $status,
        'client_status' => $clientStatus,
        'paid' => $paid,
        'awaiting_confirmation' => ($status === 'pending_payment' && $clientStatus === 'payment_submitted'),
        'redirect_url' => $paid ? ('/client-area/order/' . $orderId) : '',
    ];
}

function dsa_payment_request_state_key(int $orderId): string
{
    return 'dsa_stk_state_' . max(0, $orderId);
}

function dsa_payment_request_state_get(int $orderId): array
{
    $key = dsa_payment_request_state_key($orderId);
    $raw = $_SESSION[$key] ?? null;
    if (!is_array($raw)) {
        return [];
    }
    return $raw;
}

function dsa_payment_request_state_set(int $orderId, array $state): void
{
    $_SESSION[dsa_payment_request_state_key($orderId)] = $state;
}

function dsa_payment_flow_state_clear(int $orderId): void
{
    if ($orderId <= 0) {
        return;
    }
    unset($_SESSION['dsa_payment_notice_' . $orderId]);
    unset($_SESSION[dsa_payment_request_state_key($orderId)]);
}

function dsa_build_paypal_checkout_url(PDO $pdo, array $order): string
{
    $customLink = trim((string) dsa_setting($pdo, 'payment_paypal_link', ''));
    $amount = number_format(((int) $order['amount_cents']) / 100, 2, '.', '');
    if ($customLink !== '') {
        $replacements = [
            '{amount}' => $amount,
            '{currency}' => (string) $order['currency'],
            '{order_id}' => (string) $order['id'],
            '{order_ref}' => 'ORDER-' . (string) $order['id'],
        ];
        return strtr($customLink, $replacements);
    }
    $businessEmail = trim((string) dsa_setting($pdo, 'payment_paypal_business_email', ''));
    if ($businessEmail === '') {
        return '';
    }
    $base = dsa_setting($pdo, 'payment_paypal_sandbox', '0') === '1'
        ? 'https://www.sandbox.paypal.com/cgi-bin/webscr'
        : 'https://www.paypal.com/cgi-bin/webscr';
    $returnUrl = dsa_app_base_url($pdo);
    if ($returnUrl === '') {
        return '';
    }
    $query = http_build_query([
        'cmd' => '_xclick',
        'business' => $businessEmail,
        'item_name' => (string) $order['product_name'],
        'amount' => $amount,
        'currency_code' => (string) $order['currency'],
        'custom' => 'ORDER-' . (string) $order['id'],
        'invoice' => 'ORDER-' . (string) $order['id'],
        'return' => $returnUrl . '/order/' . (int) $order['id'] . '/payment',
        'cancel_return' => $returnUrl . '/order/' . (int) $order['id'] . '/payment',
        'notify_url' => $returnUrl . '/payments/paypal/ipn',
    ]);
    return $base . '?' . $query;
}

function dsa_build_stripe_checkout_url(PDO $pdo, array $order): string
{
    $customLink = trim((string) dsa_setting($pdo, 'payment_stripe_link', ''));
    $amount = number_format(((int) $order['amount_cents']) / 100, 2, '.', '');
    if ($customLink !== '') {
        $replacements = [
            '{amount}' => $amount,
            '{currency}' => (string) $order['currency'],
            '{order_id}' => (string) $order['id'],
            '{order_ref}' => 'ORDER-' . (string) $order['id'],
        ];
        return strtr($customLink, $replacements);
    }
    
    $secretKey = trim((string) dsa_setting($pdo, 'payment_stripe_secret_key', ''));
    if ($secretKey === '') {
        return '';
    }
    
    $baseUrl = dsa_app_base_url($pdo);
    if ($baseUrl === '') {
        return '';
    }
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, 'https://api.stripe.com/v1/checkout/sessions');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_USERPWD, $secretKey . ':');
    
    $successUrl = $baseUrl . '/order/' . (int) $order['id'] . '/payment?gateway=stripe&session_id={CHECKOUT_SESSION_ID}';
    $cancelUrl = $baseUrl . '/order/' . (int) $order['id'] . '/payment';
    
    $fields = [
        'mode' => 'payment',
        'success_url' => $successUrl,
        'cancel_url' => $cancelUrl,
        'line_items[0][price_data][currency]' => strtolower((string) $order['currency']),
        'line_items[0][price_data][product_data][name]' => (string) $order['product_name'],
        'line_items[0][price_data][unit_amount]' => (int) $order['amount_cents'],
        'line_items[0][quantity]' => 1,
        'metadata[order_id]' => (string) $order['id'],
    ];
    
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($fields));
    
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($httpCode === 200 && $response) {
        $res = json_decode($response, true);
        if (isset($res['url'])) {
            return (string) $res['url'];
        }
    }
    
    return '';
}

function dsa_build_paystack_checkout_url(PDO $pdo, array $order): string
{
    $customLink = trim((string) dsa_setting($pdo, 'payment_paystack_link', ''));
    $amount = number_format(((int) $order['amount_cents']) / 100, 2, '.', '');
    if ($customLink !== '') {
        $replacements = [
            '{amount}' => $amount,
            '{currency}' => (string) $order['currency'],
            '{order_id}' => (string) $order['id'],
            '{order_ref}' => 'ORDER-' . (string) $order['id'],
        ];
        return strtr($customLink, $replacements);
    }
    
    $secretKey = trim((string) dsa_setting($pdo, 'payment_paystack_secret_key', ''));
    if ($secretKey === '') {
        return '';
    }
    
    $baseUrl = dsa_app_base_url($pdo);
    if ($baseUrl === '') {
        return '';
    }
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, 'https://api.paystack.co/transaction/initialize');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        'Authorization: Bearer ' . $secretKey,
        'Content-Type: application/json',
    ]);
    
    $reference = 'PAYSTACK-ORD-' . (int) $order['id'] . '-' . time();
    $callbackUrl = $baseUrl . '/order/' . (int) $order['id'] . '/payment?gateway=paystack';
    
    $fields = [
        'amount' => (int) $order['amount_cents'],
        'email' => 'customer-' . (int) $order['id'] . '@watu.com',
        'reference' => $reference,
        'callback_url' => $callbackUrl,
        'metadata' => [
            'order_id' => (string) $order['id'],
        ],
    ];
    
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($fields));
    
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($httpCode === 200 && $response) {
        $res = json_decode($response, true);
        if (isset($res['status']) && $res['status'] === true && isset($res['data']['authorization_url'])) {
            return (string) $res['data']['authorization_url'];
        }
    }
    
    return '';
}

function dsa_apply_gateway_payment_success(PDO $pdo, int $orderId, string $paymentRef): bool
{
    if ($orderId <= 0) {
        return false;
    }
    $stmt = $pdo->prepare("select id, status from orders where id = :id limit 1");
    $stmt->execute([':id' => $orderId]);
    $existing = $stmt->fetch();
    if (!$existing) {
        return false;
    }
    if ((string) ($existing['status'] ?? '') !== 'pending_payment') {
        return (string) ($existing['status'] ?? '') === 'paid' || (string) ($existing['status'] ?? '') === 'fulfilled';
    }
    $stmt = $pdo->prepare(
        "update orders
         set status = 'paid',
             payment_ref = :payment_ref,
             updated_at = datetime('now')
         where id = :id and status = 'pending_payment'"
    );
    $stmt->execute([
        ':id' => $orderId,
        ':payment_ref' => $paymentRef,
    ]);
    if ((int) $stmt->rowCount() <= 0) {
        return false;
    }
    dsa_payment_flow_state_clear($orderId);
    dsa_record_watupay_credit_for_order($pdo, $orderId);
    dsa_send_order_notification_email($pdo, $orderId, 'payment_received');
    if (dsa_demo_mode_active($pdo)) {
        dsa_demo_mode_mark_paid_no_provision($pdo, $orderId);
        return true;
    }
    dsa_on_order_became_paid($pdo, $orderId);
    return true;
}

function dsa_verify_stripe_payment_and_confirm(PDO $pdo, int $orderId, string $sessionId): void
{
    $secretKey = trim((string) dsa_setting($pdo, 'payment_stripe_secret_key', ''));
    if ($secretKey === '' || $sessionId === '') {
        return;
    }
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, 'https://api.stripe.com/v1/checkout/sessions/' . rawurlencode($sessionId));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_USERPWD, $secretKey . ':');
    
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($httpCode === 200 && $response) {
        $res = json_decode($response, true);
        if (isset($res['payment_status']) && $res['payment_status'] === 'paid') {
            dsa_apply_gateway_payment_success($pdo, $orderId, 'Stripe Session: ' . $sessionId);
        }
    }
}

function dsa_verify_paystack_payment_and_confirm(PDO $pdo, int $orderId): void
{
    $secretKey = trim((string) dsa_setting($pdo, 'payment_paystack_secret_key', ''));
    if ($secretKey === '') {
        return;
    }
    
    $reference = isset($_GET['reference']) ? (string) $_GET['reference'] : '';
    if ($reference === '') {
        $reference = isset($_GET['trxref']) ? (string) $_GET['trxref'] : '';
    }
    if ($reference === '') {
        return;
    }
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, 'https://api.paystack.co/transaction/verify/' . rawurlencode($reference));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        'Authorization: Bearer ' . $secretKey,
    ]);
    
    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    if ($httpCode === 200 && $response) {
        $res = json_decode($response, true);
        if (isset($res['status']) && $res['status'] === true && isset($res['data']['status']) && $res['data']['status'] === 'success') {
            $orderStmt = $pdo->prepare("select amount_cents from orders where id = :id limit 1");
            $orderStmt->execute([':id' => $orderId]);
            $amountCents = (int) $orderStmt->fetchColumn();
            $paystackAmount = (int) ($res['data']['amount'] ?? 0);
            
            if ($paystackAmount >= $amountCents) {
                dsa_apply_gateway_payment_success($pdo, $orderId, 'Paystack Ref: ' . $reference);
            }
        }
    }
}

function dsa_start_gateway_payment(PDO $pdo, int $orderId, string $inputPhone, bool $isResend = false): string
{
    $stmt = $pdo->prepare(
        "select o.id, o.product_id, o.status, o.amount_cents, o.currency, o.customer_phone, o.payment_method, o.payment_ref, o.updated_at,
                p.slug as product_slug, p.catalog_product_id as source_product_id, p.name as product_name
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id
         limit 1"
    );
    $stmt->execute([':id' => $orderId]);
    $order = $stmt->fetch();
    if (!$order) {
        return 'Order not found.';
    }
    if ((string) $order['status'] === 'fulfilled') {
        return 'Order is already fulfilled.';
    }
    $existingRef = trim((string) ($order['payment_ref'] ?? ''));
    $dispatchBufferSeconds = 4;
    $resendCooldownSeconds = 10;
    $requestWindowSeconds = 45;
    $paymentState = dsa_payment_request_state_get($orderId);
    $updatedAtTs = strtotime((string) ($order['updated_at'] ?? ''));
    $ageSeconds = null;
    if ($updatedAtTs !== false) {
        $ageSeconds = time() - (int) $updatedAtTs;
    }
    $resendAllowed = false;
    if ($isResend) {
        if (isset($paymentState['resend_available_at']) && time() >= (int) $paymentState['resend_available_at']) {
            $resendAllowed = true;
        } elseif ($ageSeconds !== null && $ageSeconds >= $resendCooldownSeconds) {
            $resendAllowed = true;
        }
    }
    if (!$resendAllowed && (string) $order['status'] === 'pending_payment' && $existingRef !== '' && stripos($existingRef, 'DSA-') === 0) {
        if ($ageSeconds !== null && $ageSeconds >= 0 && $ageSeconds < $dispatchBufferSeconds) {
            return 'Payment request is being dispatched. Please wait 4 seconds before trying again.';
        }
        if ($ageSeconds !== null && $ageSeconds >= 0 && $ageSeconds < $resendCooldownSeconds) {
            $remaining = $resendCooldownSeconds - $ageSeconds;
            return 'A payment request is already in progress. You can resend in about ' . max(1, (int) $remaining) . ' seconds.';
        }
    }
    $method = (string) ($order['payment_method'] ?? '');
    if ($method === 'paypal' || $method === 'paypal_basic') {
        $url = dsa_build_paypal_checkout_url($pdo, $order);
        if ($url === '') {
            return 'PayPal is not fully configured yet. Add PayPal business email or direct payment link in settings.';
        }
        header('Location: ' . $url);
        return '';
    }
    if ($method === 'stripe') {
        $url = dsa_build_stripe_checkout_url($pdo, $order);
        if ($url === '') {
            return 'Stripe Checkout is not fully configured yet.';
        }
        header('Location: ' . $url);
        return '';
    }
    if ($method === 'paystack') {
        $url = dsa_build_paystack_checkout_url($pdo, $order);
        if ($url === '') {
            return 'Paystack is not fully configured yet.';
        }
        header('Location: ' . $url);
        return '';
    }
    if (!in_array($method, ['mpesa_direct', 'watupay_mpesa'], true)) {
        return 'This is an offline payment. Follow the instructions shown above and submit payment proof.';
    }
    $config = dsa_mpesa_gateway_config($pdo, $method);
    if (!dsa_mpesa_gateway_ready($config)) {
        return ($method === 'watupay_mpesa' ? 'Watu Technology M-PESA' : 'Direct M-PESA') . ' gateway is not fully configured yet.';
    }
    $phone = dsa_resolve_gateway_payment_phone($pdo, $orderId, (array) $order, $inputPhone);
    if ($phone === '') {
        return 'Enter a valid M-PESA phone number (e.g. 07XXXXXXXX or 2547XXXXXXXX).';
    }
    $callbackUrl = dsa_gateway_callback_url($pdo, $method);
    if ($callbackUrl === '') {
        return 'Gateway callback is not configured correctly.';
    }
    $sourceProductId = dsa_order_source_product_id_for_order($pdo, (int) $order['id'], (array) $order);
    if ($sourceProductId <= 0) {
        return 'Order product mapping is missing. Sync catalog/product mapping before starting M-PESA payment.';
    }
    $order['source_product_id'] = $sourceProductId;
    $accountReference = dsa_order_account_reference_live($pdo, (array) $order);
    $result = dsa_mpesa_stk_push($config, $phone, (int) $order['amount_cents'], $accountReference, $callbackUrl);
    if (!empty($result['ok'])) {
        $now = time();
        $save = $pdo->prepare(
            "update orders
             set payment_ref = :payment_ref,
                 customer_phone = :customer_phone,
                 updated_at = datetime('now')
             where id = :id"
        );
        $save->execute([
            ':id' => (int) $order['id'],
            ':payment_ref' => $accountReference,
            ':customer_phone' => $phone,
        ]);
        dsa_payment_request_state_set((int) $order['id'], [
            'sent_at' => $now,
            'resend_available_at' => $now + $resendCooldownSeconds,
            'expires_at' => $now + $requestWindowSeconds,
            'checkout_request_id' => (string) ($result['checkout_request_id'] ?? ''),
            'phone' => $phone,
        ]);
        dsa_order_mpesa_stk_state_set($pdo, (int) $order['id'], [
            'checkout_request_id' => (string) ($result['checkout_request_id'] ?? ''),
            'merchant_request_id' => (string) ($result['merchant_request_id'] ?? ''),
            'gateway' => $method,
            'account_reference' => $accountReference,
            'phone' => $phone,
            'sent_at' => $now,
        ]);
        return 'M-PESA prompt sent. Enter PIN within 45 seconds.';
    }
    return (string) ($result['message'] ?? 'Could not start payment.');
}

function dsa_handle_mpesa_callback(PDO $pdo, array $payload): void
{
    dsa_mpesa_log_callback('received', [
        'result_code' => (int) ($payload['Body']['stkCallback']['ResultCode'] ?? -1),
        'checkout_request_id' => (string) ($payload['Body']['stkCallback']['CheckoutRequestID'] ?? ''),
    ]);
    if ((int) ($payload['Body']['stkCallback']['ResultCode'] ?? 1) !== 0) {
        return;
    }
    $meta = dsa_mpesa_extract_callback_metadata($payload);
    $accountReference = trim((string) ($meta['AccountReference'] ?? ''));
    if ($accountReference === '') {
        dsa_mpesa_log_callback('missing_account_reference', ['meta' => $meta]);
        return;
    }
    $orderId = dsa_extract_order_id_from_reference($accountReference);
    if ($orderId <= 0) {
        dsa_mpesa_log_callback('unknown_order_reference', ['account_reference' => $accountReference]);
        return;
    }
    $receipt = trim((string) ($meta['MpesaReceiptNumber'] ?? ''));
    $applied = dsa_apply_mpesa_payment_success($pdo, $orderId, $receipt, $accountReference);
    dsa_mpesa_log_callback($applied ? 'applied' : 'apply_failed', [
        'order_id' => $orderId,
        'receipt' => $receipt,
        'account_reference' => $accountReference,
    ]);
}

function dsa_handle_paypal_ipn(PDO $pdo, string $rawBody): void
{
    if ($rawBody === '') {
        return;
    }
    parse_str($rawBody, $postData);
    if (!is_array($postData) || count($postData) === 0) {
        return;
    }
    $verifyParams = $postData;
    $verifyParams['cmd'] = '_notify-validate';
    $verifyBody = http_build_query($verifyParams);
    $verifyUrl = dsa_setting($pdo, 'payment_paypal_sandbox', '0') === '1'
        ? 'https://ipnpb.sandbox.paypal.com/cgi-bin/webscr'
        : 'https://ipnpb.paypal.com/cgi-bin/webscr';
    $ch = curl_init($verifyUrl);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $verifyBody,
        CURLOPT_HTTPHEADER => ['Connection: Close', 'Content-Type: application/x-www-form-urlencoded'],
        CURLOPT_CONNECTTIMEOUT => 12,
        CURLOPT_TIMEOUT => 25,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_SSL_VERIFYHOST => 2,
    ]);
    $verifyResponse = curl_exec($ch);
    curl_close($ch);
    if (!is_string($verifyResponse) || stripos($verifyResponse, 'VERIFIED') === false) {
        return;
    }
    $paymentStatus = strtolower(trim((string) ($postData['payment_status'] ?? '')));
    if (!in_array($paymentStatus, ['completed', 'processed'], true)) {
        return;
    }
    $orderToken = trim((string) ($postData['custom'] ?? ($postData['invoice'] ?? '')));
    if (!preg_match('/(\d+)/', $orderToken, $m)) {
        return;
    }
    $orderId = (int) $m[1];
    if ($orderId <= 0) {
        return;
    }
    $txnId = trim((string) ($postData['txn_id'] ?? ''));
    $stmt = $pdo->prepare(
        "update orders
         set status = case when status = 'pending_payment' then 'paid' else status end,
             payment_ref = case when :payment_ref = '' then payment_ref else :payment_ref end,
             updated_at = datetime('now')
         where id = :id"
    );
    $stmt->execute([
        ':id' => $orderId,
        ':payment_ref' => $txnId,
    ]);
    dsa_record_watupay_credit_for_order($pdo, $orderId);
    if (dsa_demo_mode_active($pdo)) {
        dsa_demo_mode_mark_paid_no_provision($pdo, $orderId);
        return;
    }
    dsa_on_order_became_paid($pdo, $orderId);
}

function dsa_order_has_pending_stk_reference(string $paymentRef): bool
{
    $paymentRef = trim($paymentRef);
    return $paymentRef !== '' && preg_match('/^DSA-\d+-\d+$/i', $paymentRef) === 1;
}

function dsa_watu_pay_txn_syncable_for_dsa(string $txnStatus, string $mpesaCode, string $orderRef): bool
{
    return false;
}

function dsa_order_awaiting_watu_pay_reconciliation(array $order): bool
{
    return false;
}

function dsa_reset_order_for_new_watu_pay_dispatch(PDO $pdo, int $orderId, string $mpesaCode): void
{
    // Watu Pay reset logic has been retired.
}

function dsa_customer_order_status_label(array $order): string
{
    $status = (string) ($order['status'] ?? 'pending_payment');
    $paymentRef = trim((string) ($order['payment_ref'] ?? ''));
    $hasPendingStk = dsa_order_has_pending_stk_reference($paymentRef);
    $hasRealPaymentRef = ($paymentRef !== '' && !$hasPendingStk);
    $hasPaymentSignal = $hasRealPaymentRef
        || trim((string) ($order['payment_proof_path'] ?? '')) !== ''
        || $hasPendingStk;
    if ($status === 'pending_payment' && $hasPaymentSignal) {
        return 'payment_submitted';
    }
    if (
        in_array($status, ['paid', 'fulfilled'], true)
        && dsa_order_needs_whmcs_provisioning($order)
        && !dsa_order_whmcs_provisioning_complete($order)
    ) {
        return 'paid';
    }
    return $status;
}

function dsa_admin_order_status_options(): array
{
    return [
        'pending_payment' => 'Awaiting payment',
        'paid' => 'Paid — setting up service',
        'fulfilled' => 'Ready — service active',
        'cancelled' => 'Cancelled',
        'demo_simulated' => 'Demo simulated',
    ];
}

function dsa_admin_order_status_label(string $status): string
{
    $options = dsa_admin_order_status_options();
    return $options[$status] ?? ucwords(str_replace('_', ' ', $status));
}

function dsa_status_pill(string $status): string
{
    static $labels = [
        'pending_payment'   => 'Awaiting payment',
        'payment_submitted' => 'Payment in progress',
        'paid'              => 'Paid — setting up your service',
        'fulfilled'         => 'Ready — service active',
        'cancelled'         => 'Cancelled',
        'demo_simulated'    => 'Demo Simulated',
        'active'            => 'Active',
        'pending'           => 'Pending',
    ];
    $label = $labels[$status] ?? ucwords(str_replace('_', ' ', $status));
    $cssClass = 'pill pill-' . preg_replace('/[^a-z0-9_-]/', '', strtolower($status));
    return '<span class="' . dsa_h($cssClass) . '">' . dsa_h($label) . '</span>';
}

function dsa_customer_order_status_context(array $order): string
{
    $status = (string) ($order['status'] ?? 'pending_payment');
    $clientStatusLabel = dsa_customer_order_status_label($order);
    if ($clientStatusLabel === 'payment_submitted') {
        if (in_array($status, ['paid', 'fulfilled'], true) && dsa_order_needs_whmcs_provisioning($order)) {
            return 'Payment received — setting up your service on the platform.';
        }
        return 'We received your payment request and are waiting for confirmation.';
    }
    switch ($status) {
        case 'pending_payment':
            return 'Complete payment to activate your order.';
        case 'paid':
            return 'Payment confirmed — we are setting up your service.';
        case 'fulfilled':
            return 'Your service is active and ready to use.';
        case 'cancelled':
            return 'This order was cancelled.';
        default:
            return '';
    }
}

function dsa_render_cart_account(PDO $pdo, string $notice, array $state): void
{
    dsa_release_session_lock_if_safe();
    $draft = dsa_checkout_draft_load();
    if (!is_array($draft)) {
        header('Location: /cart');
        return;
    }
    $sessionClientLoggedIn = !empty($_SESSION['dsa_client_logged_in']) && (int) ($_SESSION['dsa_client_id'] ?? 0) > 0;
    $otpState = (array) ($state['otp_state'] ?? []);
    $otpSent = !empty($otpState['otp_sent']);
    $accountMode = trim((string) ($state['account_mode'] ?? ($_POST['account_mode'] ?? 'login')));
    if (!in_array($accountMode, ['login', 'register'], true)) {
        $accountMode = 'login';
    }
    $customerName = trim((string) ($state['customer_name'] ?? ($_POST['customer_name'] ?? '')));
    $customerEmail = trim((string) ($state['customer_email'] ?? ($_POST['customer_email'] ?? '')));
    $totalCents = (int) ($draft['total_cents'] ?? 0);
    $currency = (string) ($draft['currency'] ?? DSA_DEFAULT_CURRENCY);
    $html = '<div class="card">' . dsa_checkout_steps('account') . '<h1>Account</h1>';
    $html .= '<p class="muted">Step 2: sign in or create your account. Email verification is required before payment.</p>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= '<p><strong>Order total:</strong> ' . dsa_h(dsa_money($totalCents, $currency)) . '</p>';
    if ($sessionClientLoggedIn) {
        $clientEmail = (string) ($_SESSION['dsa_client_email'] ?? '');
        $html .= '<div class="notice">Signed in as <strong>' . dsa_h($clientEmail) . '</strong>.</div>';
        $html .= '<form method="post" action="/cart/account">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<div class="actions" style="margin-top:10px;">'
            . '<button class="btn" type="submit">Continue to payment</button>'
            . '<a class="btn-secondary" href="/cart">Back to cart</a>'
            . '<a class="btn-secondary" href="/client-area/logout">Sign out</a>'
            . '</div></form>';
    } else {
        $html .= '<form method="post" action="/cart/account">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<label>Account</label><select name="account_mode" id="account-mode-select">';
        $html .= '<option value="login"' . ($accountMode === 'login' ? ' selected' : '') . '>Sign in with existing account</option>';
        $html .= '<option value="register"' . ($accountMode === 'register' ? ' selected' : '') . '>Create new account</option>';
        $html .= '</select>';
        $registerFieldsStyle = ($accountMode === 'register') ? '' : ' style="display:none;"';
        $html .= '<div id="account-register-fields"' . $registerFieldsStyle . '>';
        $html .= '<label>Name *</label><input name="customer_name" id="customer_name" value="' . dsa_h($customerName) . '"' . ($accountMode === 'register' && !$otpSent ? ' required' : '') . '>';
        $html .= '</div>';
        $html .= '<label>Email *</label><input type="email" name="customer_email" value="' . dsa_h($customerEmail) . '" required>';
        if (!$otpSent) {
            $html .= '<label>Password *</label><input type="password" name="customer_password" minlength="8" required>';
            $html .= '<div id="account-register-password"' . $registerFieldsStyle . '>';
            $html .= '<label>Confirm Password *</label><input type="password" name="customer_password_confirm" id="customer_password_confirm" minlength="8"' . ($accountMode === 'register' ? ' required' : '') . '>';
            $html .= '</div>';
        }
        if ($otpSent) {
            $html .= dsa_checkout_render_otp_fields($otpState);
            if (function_exists('dsa_demo_mode_active') && dsa_demo_mode_active($pdo)) {
                $html .= '<p class="muted">Demo store: use verification code <strong>000000</strong>.</p>';
            }
        }
        $submitLabel = $otpSent ? 'Verify &amp; continue to payment' : 'Send verification code';
        $html .= '<div class="actions" style="margin-top:10px;">'
            . '<button class="btn" type="submit">' . $submitLabel . '</button>'
            . '<a class="btn-secondary" href="/cart">Back to cart</a>'
            . '</div></form>';
        $html .= '<script>(function(){function syncAccountMode(){var mode=document.getElementById("account-mode-select");var nameWrap=document.getElementById("account-register-fields");var passWrap=document.getElementById("account-register-password");var nameInput=document.getElementById("customer_name");var passConfirm=document.getElementById("customer_password_confirm");if(!mode){return;}var isRegister=mode.value==="register";if(nameWrap){nameWrap.style.display=isRegister?"":"none";}if(passWrap){passWrap.style.display=isRegister?"":"none";}if(nameInput){nameInput.required=isRegister' . ($otpSent ? '&&false' : '') . ';}if(passConfirm){passConfirm.required=isRegister;}}var sel=document.getElementById("account-mode-select");if(sel){sel.addEventListener("change",syncAccountMode);syncAccountMode();}})();</script>';
        $html .= '<p class="muted" style="margin-top:10px;">Already have an account elsewhere? <a href="/client-area/login?return=' . rawurlencode('/cart/account') . '">Client area login</a></p>';
    }
    $html .= '</div>';
    dsa_render_layout('Checkout account', $html);
}

function dsa_checkout_steps(string $active): string
{
    $steps = [
        'cart'         => 'Cart / Config',
        'account'      => 'Account',
        'payment'      => 'Payment',
        'confirmation' => 'Confirmation',
    ];
    $html = '<div class="checkout-steps">';
    $i = 0;
    foreach ($steps as $key => $label) {
        if ($i > 0) {
            $html .= '<span class="sep">›</span>';
        }
        $class = ($key === $active) ? 'step-active' : '';
        $html .= '<span class="' . ($class !== '' ? dsa_h($class) : '') . '">' . dsa_h($label) . '</span>';
        $i++;
    }
    $html .= '</div>';
    return $html;
}

function dsa_empty_state(string $title, string $text, string $btnLabel = '', string $btnHref = ''): string
{
    $html = '<div class="empty-state"><h3>' . dsa_h($title) . '</h3>';
    if ($text !== '') {
        $html .= '<p>' . dsa_h($text) . '</p>';
    }
    if ($btnLabel !== '' && $btnHref !== '') {
        $html .= '<div style="margin-top:16px"><a class="btn" href="' . dsa_h($btnHref) . '">' . dsa_h($btnLabel) . '</a></div>';
    }
    $html .= '</div>';
    return $html;
}

function dsa_consume_payment_notice(int $orderId): string
{
    if ($orderId <= 0) {
        return '';
    }
    $key = 'dsa_payment_notice_' . $orderId;
    if (!isset($_SESSION[$key]) || !is_string($_SESSION[$key])) {
        return '';
    }
    $notice = trim((string) $_SESSION[$key]);
    unset($_SESSION[$key]);
    return $notice;
}

function dsa_internal_perf_probe(PDO $pdo): void
{
    if (!headers_sent()) {
        header('Content-Type: application/json; charset=utf-8');
    }
    dsa_session_start_if_needed(true);
    $token = dsa_request_header('X-Release-Token');
    if ($token === '') {
        $token = dsa_request_header('X-Watu-Key');
    }
    if ($token === '') {
        $token = trim((string) ($_GET['token'] ?? $_POST['token'] ?? ''));
    }
    if (!dsa_release_token_is_valid($pdo, $token)) {
        http_response_code(403);
        echo json_encode(['ok' => false, 'message' => 'Invalid perf probe token.'], JSON_UNESCAPED_UNICODE);
        return;
    }

    $routesRaw = trim((string) ($_GET['routes'] ?? $_POST['routes'] ?? ''));
    $selected = [];
    if ($routesRaw !== '') {
        foreach (explode(',', $routesRaw) as $part) {
            $key = strtolower(trim((string) $part));
            if ($key !== '') {
                $selected[$key] = true;
            }
        }
    }
    if (count($selected) === 0) {
        $selected = [
            'admin_dashboard' => true,
            'admin_orders' => true,
            'client_dashboard' => true,
            'cart' => true,
        ];
    }

    $results = [];
    $sessionBackup = isset($_SESSION) && is_array($_SESSION) ? $_SESSION : [];
    $requestUriBackup = (string) ($_SERVER['REQUEST_URI'] ?? '');
    $requestMethodBackup = (string) ($_SERVER['REQUEST_METHOD'] ?? 'GET');
    $getBackup = $_GET ?? [];
    $postBackup = $_POST ?? [];

    foreach (array_keys($selected) as $routeKey) {
        $result = dsa_internal_perf_probe_route($pdo, $routeKey);
        if ($result !== null) {
            $results[$routeKey] = $result;
        }
        $_SESSION = $sessionBackup;
        $_GET = $getBackup;
        $_POST = $postBackup;
        $_SERVER['REQUEST_URI'] = $requestUriBackup;
        $_SERVER['REQUEST_METHOD'] = $requestMethodBackup;
    }

    echo json_encode([
        'ok' => true,
        'generated_at' => date('c'),
        'results' => $results,
    ], JSON_UNESCAPED_UNICODE);
}

function dsa_internal_perf_probe_route(PDO $pdo, string $routeKey): ?array
{
    $routeKey = strtolower(trim($routeKey));
    $started = microtime(true);
    $bytes = 0;
    $error = '';
    $ok = true;

    try {
        ob_start();
        if ($routeKey === 'admin_dashboard') {
            $admin = $pdo->query("select username from admin_users order by id asc limit 1")->fetch();
            if (!$admin) {
                throw new RuntimeException('No admin user found.');
            }
            $_SESSION['dsa_admin_logged_in'] = true;
            $_SESSION['dsa_admin_username'] = (string) ($admin['username'] ?? DSA_ADMIN_USERNAME);
            $_SERVER['REQUEST_URI'] = '/admin?section=dashboard';
            $_SERVER['REQUEST_METHOD'] = 'GET';
            dsa_render_admin($pdo, '', 'all', 'dashboard');
        } elseif ($routeKey === 'admin_orders') {
            $admin = $pdo->query("select username from admin_users order by id asc limit 1")->fetch();
            if (!$admin) {
                throw new RuntimeException('No admin user found.');
            }
            $_SESSION['dsa_admin_logged_in'] = true;
            $_SESSION['dsa_admin_username'] = (string) ($admin['username'] ?? DSA_ADMIN_USERNAME);
            $_SERVER['REQUEST_URI'] = '/admin?section=orders&filter=all';
            $_SERVER['REQUEST_METHOD'] = 'GET';
            dsa_render_admin($pdo, '', 'all', 'orders');
        } elseif ($routeKey === 'client_dashboard') {
            $clientStmt = $pdo->query(
                "select c.id, c.email
                 from customers c
                 left join orders o on o.customer_id = c.id
                 group by c.id
                 order by count(o.id) desc, c.id desc
                 limit 1"
            );
            $client = $clientStmt ? $clientStmt->fetch() : false;
            if (!$client) {
                throw new RuntimeException('No customer found.');
            }
            $_SESSION['dsa_client_logged_in'] = true;
            $_SESSION['dsa_client_id'] = (int) ($client['id'] ?? 0);
            $_SESSION['dsa_client_email'] = (string) ($client['email'] ?? '');
            $_SERVER['REQUEST_URI'] = '/client-area';
            $_SERVER['REQUEST_METHOD'] = 'GET';
            dsa_render_client_dashboard($pdo, '');
        } elseif ($routeKey === 'cart') {
            $firstProduct = $pdo->query("select slug from products where status = 'active' order by id desc limit 1")->fetch();
            $slug = trim((string) ($firstProduct['slug'] ?? ''));
            if ($slug !== '') {
                $_SESSION['dsa_cart'] = [$slug => 1];
            } else {
                $_SESSION['dsa_cart'] = [];
            }
            $_SERVER['REQUEST_URI'] = '/cart';
            $_SERVER['REQUEST_METHOD'] = 'GET';
            dsa_render_cart($pdo, '');
        } else {
            ob_end_clean();
            return null;
        }
        $output = ob_get_clean();
        $bytes = strlen((string) $output);
    } catch (Throwable $e) {
        $ok = false;
        $error = (string) $e->getMessage();
        if (ob_get_level() > 0) {
            ob_end_clean();
        }
    }

    $elapsedMs = (microtime(true) - $started) * 1000;
    return [
        'ok' => $ok,
        'elapsed_ms' => round($elapsedMs, 2),
        'bytes' => $bytes,
        'error' => $error,
    ];
}

function dsa_render_login(string $error): void
{
    $html = '<div class="card"><h1>Admin Login</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    $html .= '<form method="post" action="/admin/login">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<label>Username</label><input name="username" required>';
    $html .= '<label>Password</label><input type="password" name="password" required>';
    $html .= '<div style="margin-top:10px"><button class="btn" type="submit">Login</button></div></form>';
    $html .= '<p style="margin-top:10px"><a href="/admin/forgot-password">Forgot password?</a></p>';
    $html .= '</div>';
    dsa_render_auth_layout('Admin login', $html);
}

function dsa_render_admin_forgot_password(string $error, string $notice): void
{
    $html = '<div class="card"><h1>Forgot Password</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= '<p class="muted">Enter your admin username to request a password reset link.</p>';
    $html .= '<form method="post" action="/admin/forgot-password">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<label>Username</label><input name="username" required>';
    $html .= '<div style="margin-top:10px"><button class="btn" type="submit">Send Reset Link</button></div></form>';
    $html .= '<p style="margin-top:10px"><a href="/admin/login">Back to login</a></p>';
    $html .= '</div>';
    dsa_render_auth_layout('Admin forgot password', $html);
}

function dsa_render_admin_reset_password(string $token, string $error, string $notice): void
{
    $html = '<div class="card"><h1>Reset Admin Password</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    if ($token === '') {
        $html .= '<p class="muted">Request a new reset link from the forgot password page.</p>';
        $html .= '<p><a href="/admin/forgot-password">Go to forgot password</a></p>';
        $html .= '</div>';
        dsa_render_auth_layout('Admin reset password', $html);
        return;
    }
    $html .= '<form method="post" action="/admin/reset-password">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<input type="hidden" name="token" value="' . dsa_h($token) . '">';
    $html .= '<label>New Password</label><input type="password" name="new_password" minlength="10" required>';
    $html .= '<label>Confirm Password</label><input type="password" name="confirm_password" minlength="10" required>';
    $html .= '<div style="margin-top:10px"><button class="btn" type="submit">Update Password</button></div></form>';
    $html .= '<p style="margin-top:10px"><a href="/admin/login">Back to login</a></p>';
    $html .= '</div>';
    dsa_render_auth_layout('Admin reset password', $html);
}

function dsa_render_client_login(string $error): void
{
    $returnTo = trim((string) ($_GET['return'] ?? ''));
    if ($returnTo === '' || $returnTo[0] !== '/' || strpos($returnTo, '//') !== false) {
        $returnTo = '';
    }
    $html = '<div class="card"><h1>Client Area Login</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    $html .= '<form method="post" action="/client-area/login">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    if ($returnTo !== '') {
        $html .= '<input type="hidden" name="return" value="' . dsa_h($returnTo) . '">';
    }
    $html .= '<label>Email</label><input type="email" name="email" required>';
    $html .= '<label>Password</label><input type="password" name="password" required>';
    $html .= '<div style="margin-top:10px"><button class="btn" type="submit">Login</button></div></form>';
    $html .= '<p style="margin-top:10px"><a href="/client-area/forgot-password">Forgot password?</a></p>';
    $html .= '</div>';
    dsa_render_layout('Client login', $html);
}

function dsa_whmcs_credits_default_summary(): array
{
    return [
        'ok' => false,
        'available_cents' => 0,
        'queued_cents' => 0,
        'paid_out_cents' => 0,
        'currency' => DSA_DEFAULT_CURRENCY,
        'payout_channel' => '',
        'payout_target' => '',
        'payout_timing' => '',
        'payout_schedule' => '',
        'message' => dsa_ui_label('credits.not_loaded'),
    ];
}

function dsa_whmcs_credits_local(PDO $pdo): array
{
    $summary = dsa_whmcs_credits_default_summary();
    $cachedRaw = trim((string) dsa_setting($pdo, 'whmcs_credits_cache_json', ''));
    if ($cachedRaw === '') {
        return $summary;
    }
    $cached = json_decode($cachedRaw, true);
    if (!is_array($cached)) {
        return $summary;
    }
    return array_merge($summary, $cached);
}

function dsa_whmcs_credits_store_payload(PDO $pdo, array $credits, string $message = ''): array
{
    $summary = dsa_whmcs_credits_default_summary();
    $summary['ok'] = true;
    $summary['available_cents'] = (int) ($credits['available_cents'] ?? 0);
    $summary['queued_cents'] = (int) ($credits['queued_cents'] ?? 0);
    $summary['paid_out_cents'] = (int) ($credits['paid_out_cents'] ?? 0);
    $summary['currency'] = strtoupper(trim((string) ($credits['currency'] ?? DSA_DEFAULT_CURRENCY)));
    $summary['payout_channel'] = trim((string) ($credits['payout_channel'] ?? ''));
    $summary['payout_target'] = trim((string) ($credits['payout_target'] ?? ''));
    $summary['payout_timing'] = trim((string) ($credits['payout_timing'] ?? ''));
    $summary['payout_schedule'] = trim((string) ($credits['payout_schedule'] ?? ''));
    if ($summary['payout_channel'] === '') {
        $summary['payout_channel'] = trim((string) dsa_setting($pdo, 'watupay_payout_channel', ''));
    }
    if ($summary['payout_target'] === '') {
        $summary['payout_target'] = trim((string) dsa_setting($pdo, 'watupay_payout_target', ''));
    }
    if ($summary['payout_timing'] === '') {
        $summary['payout_timing'] = trim((string) dsa_setting($pdo, 'watupay_payout_timing', 'manual'));
    }
    if ($summary['payout_schedule'] === '' && $summary['payout_timing'] === 'scheduled') {
        $summary['payout_schedule'] = trim((string) dsa_setting($pdo, 'watupay_payout_schedule', ''));
    }
    $summary['message'] = $message !== '' ? $message : 'Stored locally.';
    dsa_setting_set($pdo, 'whmcs_credits_cache_at', (string) time());
    dsa_setting_set($pdo, 'whmcs_credits_cache_json', json_encode($summary, JSON_UNESCAPED_UNICODE));
    return $summary;
}

function dsa_whmcs_credits_refresh_from_whmcs(PDO $pdo): array
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    $identifier = trim(dsa_setting($pdo, 'catalog_sync_whmcs_identifier', ''));
    $secret = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', ''));
    if ($apiUrl === '' || $identifier === '' || $secret === '') {
        $summary = dsa_whmcs_credits_local($pdo);
        $summary['message'] = 'Source API credentials are not configured.';
        return $summary;
    }
    if (stripos($apiUrl, 'client-catalog.php') === false) {
        $summary = dsa_whmcs_credits_local($pdo);
        $summary['message'] = 'Credits are only available from the Watu catalog endpoint.';
        return $summary;
    }
    $key = $secret !== '' ? $secret : $identifier;
    $http = dsa_http_get_with_watu_key($apiUrl, $key);
    $raw = (string) ($http['body'] ?? '');
    if (empty($http['ok']) || trim($raw) === '') {
        $summary = dsa_whmcs_credits_local($pdo);
        $summary['message'] = dsa_ui_label('credits.reach_failed');
        return $summary;
    }
    $json = json_decode($raw, true);
    if (!is_array($json) || empty($json['ok'])) {
        $summary = dsa_whmcs_credits_local($pdo);
        $summary['message'] = dsa_ui_label('credits.invalid_data');
        return $summary;
    }
    $credits = $json['credits'] ?? null;
    if (!is_array($credits)) {
        $summary = dsa_whmcs_credits_local($pdo);
        $summary['message'] = 'Credits are not available in source response.';
        return $summary;
    }
    return dsa_whmcs_credits_store_payload($pdo, $credits, dsa_ui_label('credits.synced_from_account'));
}

function dsa_whmcs_credits_summary(PDO $pdo): array
{
    return dsa_whmcs_credits_local($pdo);
}

function dsa_admin_payout_summary_card_html(PDO $pdo): string
{
    $balance = dsa_payout_balance_summary($pdo);
    $currency = (string) ($balance['currency'] ?? DSA_DEFAULT_CURRENCY);
    $available = (int) ($balance['available_for_payout_cents'] ?? 0);
    $pending = (int) ($balance['pending_settlement_cents'] ?? 0);
    return '<div class="card"><h2>' . dsa_h(dsa_ui_label('payouts.section_title')) . '</h2>'
        . '<p><strong>' . dsa_h(dsa_ui_label('payouts.available_for_payout')) . ':</strong> '
        . dsa_h(dsa_money($available, $currency)) . '</p>'
        . '<p class="muted">' . dsa_h(dsa_ui_label('payouts.pending_settlement')) . ': '
        . dsa_h(dsa_money($pending, $currency)) . '</p>'
        . '<p><a class="btn-secondary" href="/admin?section=payments">' . dsa_h(dsa_ui_label('payouts.section_title')) . '</a></p>'
        . '</div>';
}

function dsa_admin_credits_card_html(PDO $pdo, array $whmcsCredits, string $returnSection): string
{
    $cacheAt = (int) dsa_setting($pdo, 'whmcs_credits_cache_at', '0');
    $lastUpdated = $cacheAt > 0 ? date('Y-m-d H:i:s', $cacheAt) : 'never';
    $refreshForm = '<form method="post" action="/admin/credits/refresh" style="display:inline;margin-left:8px;">'
        . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
        . '<input type="hidden" name="return_section" value="' . dsa_h($returnSection) . '">'
        . '<button class="btn-secondary" type="submit">' . dsa_h(dsa_ui_label('credits.refresh_button')) . '</button></form>';
    if (!empty($whmcsCredits['ok'])) {
        $creditCurrency = (string) ($whmcsCredits['currency'] ?? DSA_DEFAULT_CURRENCY);
        return '<div class="card"><h2>Watu Credits</h2>'
            . '<p><strong>Available Credit:</strong> ' . dsa_h(dsa_money((int) ($whmcsCredits['available_cents'] ?? 0), $creditCurrency)) . $refreshForm . '</p>'
            . '<p class="muted">Queued payouts: ' . dsa_h(dsa_money((int) ($whmcsCredits['queued_cents'] ?? 0), $creditCurrency))
            . ' | Paid out: ' . dsa_h(dsa_money((int) ($whmcsCredits['paid_out_cents'] ?? 0), $creditCurrency)) . '</p>'
            . '<p class="muted">Payout destination: ' . dsa_h((string) (($whmcsCredits['payout_channel'] ?? '') !== '' ? $whmcsCredits['payout_channel'] : 'not set'))
            . ' - ' . dsa_h((string) (($whmcsCredits['payout_target'] ?? '') !== '' ? $whmcsCredits['payout_target'] : 'not set')) . '</p>'
            . '<p class="muted">Payout mode: ' . dsa_h((string) ($whmcsCredits['payout_timing'] ?? 'manual'))
            . (((string) ($whmcsCredits['payout_timing'] ?? '') === 'scheduled' && (string) ($whmcsCredits['payout_schedule'] ?? '') !== '')
                ? (' (' . dsa_h((string) $whmcsCredits['payout_schedule']) . ')') : '') . '</p>'
            . '<p class="muted">Stored locally | Last updated: ' . dsa_h($lastUpdated) . '</p>'
            . '</div>';
    }
    return '<div class="card"><h2>Watu Credits</h2>'
        . '<p class="muted">' . dsa_h(dsa_ui_normalize_legacy_message((string) ($whmcsCredits['message'] ?? 'Credits not loaded yet.'))) . $refreshForm . '</p>'
        . '<p class="muted">Last updated: ' . dsa_h($lastUpdated) . '</p></div>';
}

function dsa_order_dispatch_url(PDO $pdo): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '' || stripos($apiUrl, 'client-catalog.php') === false) {
        return '';
    }
    return str_replace('client-catalog.php', 'client-order-intake.php', $apiUrl);
}

function dsa_order_payment_status_url(PDO $pdo): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '' || stripos($apiUrl, 'client-catalog.php') === false) {
        return '';
    }
    return str_replace('client-catalog.php', 'client-payment-status.php', $apiUrl);
}

function dsa_order_dispatch_status_url(PDO $pdo): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '' || stripos($apiUrl, 'client-catalog.php') === false) {
        return '';
    }
    return str_replace('client-catalog.php', 'client-order-status.php', $apiUrl);
}

function dsa_order_provision_url(PDO $pdo): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '' || stripos($apiUrl, 'client-catalog.php') === false) {
        return '';
    }
    return str_replace('client-catalog.php', 'client-order-provision.php', $apiUrl);
}

function dsa_whitelabel_manage_url(PDO $pdo): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '' || stripos($apiUrl, 'client-catalog.php') === false) {
        return '';
    }
    return str_replace('client-catalog.php', 'client-whitelabel-domain.php', $apiUrl);
}
function dsa_watu_clientarea_url(PDO $pdo, string $page = ''): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '') {
        return '';
    }
    $pos = stripos($apiUrl, '/modules/');
    if ($pos !== false) {
        $base = substr($apiUrl, 0, $pos);
    } else {
        $base = 'https://watutechnology.com';
    }
    return rtrim($base, '/') . '/' . ltrim($page, '/');
}


function dsa_manage_whitelabel_domain(PDO $pdo, string $domain, bool $enforce): array
{
    $url = dsa_whitelabel_manage_url($pdo);
    $secret = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($url === '' || $secret === '') {
        return [
            'ok' => false,
            'message' => dsa_ui_label('domain_service.reach_failed'),
            'status' => [],
        ];
    }
    $payload = http_build_query([
        'watu_key' => $secret,
        'domain' => strtolower(trim($domain)),
        'enforce' => $enforce ? '1' : '0',
    ]);
    $http = dsa_http_post_form($url, $payload, 8, 3);
    $raw = (string) ($http['body'] ?? '');
    if (empty($http['ok']) || trim($raw) === '') {
        return [
            'ok' => false,
            'message' => dsa_ui_label('domain_service.request_failed_prefix', ['detail' => (string) ($http['error'] ?? 'unknown error')]),
            'status' => [],
        ];
    }
    $json = json_decode($raw, true);
    if (!is_array($json)) {
        return [
            'ok' => false,
            'message' => dsa_ui_label('domain_service.invalid_json'),
            'status' => [],
        ];
    }
    return [
        'ok' => !empty($json['ok']),
        'message' => trim((string) ($json['message'] ?? '')),
        'status' => is_array($json['status'] ?? null) ? $json['status'] : [],
    ];
}

function dsa_whitelabel_background_refresh(PDO $pdo, string $method, string $path, string $section = ''): void
{
    if (strtoupper(trim($method)) !== 'GET') {
        return;
    }
  // Only run while viewing Branding — never block login or unrelated admin pages.
    if ($section !== 'branding') {
        return;
    }
    if (!dsa_custom_storefront_domain_enabled($pdo)) {
        return;
    }
    if (!($path === '/admin' || strpos($path, '/admin/') === 0)) {
        return;
    }
    if (empty($_SESSION['dsa_admin_logged_in'])) {
        return;
    }
    if ($path === '/internal' || strpos($path, '/internal/') === 0) {
        return;
    }
    if (in_array($path, ['/payments/mpesa/callback', '/payments/paypal/ipn', '/setup-internal.php'], true)) {
        return;
    }
    $pendingDomain = dsa_normalize_domain((string) dsa_setting($pdo, 'whitelabel_pending_domain', ''));
    $pendingEnforce = dsa_setting($pdo, 'whitelabel_pending_enforce', '') === '1';
    if ($pendingDomain === '') {
        if (dsa_setting($pdo, 'force_whitelabel_domain', '0') !== '1') {
            return;
        }
        $domain = dsa_normalize_domain((string) dsa_setting($pdo, 'whitelabel_domain', ''));
        if ($domain === '' || !dsa_whitelabel_is_subdomain($domain)) {
            return;
        }
        $pendingDomain = $domain;
        $pendingEnforce = true;
        dsa_setting_set($pdo, 'whitelabel_pending_domain', $pendingDomain);
        dsa_setting_set($pdo, 'whitelabel_pending_enforce', '1');
        dsa_setting_set($pdo, 'whitelabel_pending_requested_at', (string) time());
    }
    if (!dsa_whitelabel_is_subdomain($pendingDomain)) {
        return;
    }
    $statusRaw = trim((string) dsa_setting($pdo, 'whitelabel_last_sync_json', ''));
    if ($statusRaw !== '') {
        $status = json_decode($statusRaw, true);
        if (is_array($status)) {
            $ready = !empty($status['status']['ready']);
            $statusDomain = dsa_normalize_domain((string) ($status['status']['domain'] ?? ''));
            if ($ready && $statusDomain === $pendingDomain) {
                dsa_setting_set($pdo, 'whitelabel_pending_domain', '');
                dsa_setting_set($pdo, 'whitelabel_pending_enforce', '');
                dsa_setting_set($pdo, 'whitelabel_pending_requested_at', '0');
                return;
            }
        }
    }
    $now = time();
    $lastCheckedAt = (int) dsa_setting($pdo, 'whitelabel_last_background_check_at', '0');
    if ($lastCheckedAt > 0 && ($now - $lastCheckedAt) < 300) {
        return;
    }
    register_shutdown_function(static function () use ($pdo, $pendingDomain, $pendingEnforce, $now): void {
        if (function_exists('fastcgi_finish_request')) {
            @fastcgi_finish_request();
        }
        dsa_setting_set($pdo, 'whitelabel_last_background_check_at', (string) $now);
        $sync = dsa_manage_whitelabel_domain($pdo, $pendingDomain, $pendingEnforce);
        dsa_setting_set($pdo, 'whitelabel_last_sync_message', (string) ($sync['message'] ?? ''));
        dsa_setting_set($pdo, 'whitelabel_last_sync_json', json_encode($sync, JSON_UNESCAPED_UNICODE));
        if (!$pendingEnforce) {
            dsa_setting_set($pdo, 'whitelabel_pending_domain', '');
            dsa_setting_set($pdo, 'whitelabel_pending_enforce', '');
            dsa_setting_set($pdo, 'whitelabel_pending_requested_at', '0');
        } else {
            $syncStatus = is_array($sync['status'] ?? null) ? (array) ($sync['status'] ?? []) : [];
            $ready = !empty($syncStatus['ready']);
            $statusDomain = dsa_normalize_domain((string) ($syncStatus['domain'] ?? ''));
            if ($ready && $statusDomain === $pendingDomain) {
                dsa_setting_set($pdo, 'whitelabel_pending_domain', '');
                dsa_setting_set($pdo, 'whitelabel_pending_enforce', '');
                dsa_setting_set($pdo, 'whitelabel_pending_requested_at', '0');
            }
        }
    });
}

function dsa_http_post_json_with_watu_key(string $url, string $watuKey, array $payload): array
{
    $url = trim($url);
    $watuKey = trim($watuKey);
    if ($url === '' || $watuKey === '') {
        return ['ok' => false, 'body' => '', 'error' => 'Missing URL or key.', 'status' => 0];
    }
    $body = json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_INVALID_UTF8_SUBSTITUTE);
    if ($body === false) {
        return ['ok' => false, 'body' => '', 'error' => 'Could not encode payload.', 'status' => 0];
    }
    if (!function_exists('curl_init')) {
        return ['ok' => false, 'body' => '', 'error' => 'cURL is not available.', 'status' => 0];
    }
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST => true,
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
            'Accept: application/json',
            'X-Watu-Key: ' . $watuKey,
        ],
        CURLOPT_POSTFIELDS => $body,
        CURLOPT_CONNECTTIMEOUT => 10,
        CURLOPT_TIMEOUT => 30,
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_SSL_VERIFYHOST => false,
    ]);
    $resp = curl_exec($ch);
    $err = $resp === false ? (string) curl_error($ch) : '';
    $status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return [
        'ok' => ($resp !== false && $status >= 200 && $status < 300),
        'body' => $resp !== false ? (string) $resp : '',
        'error' => $err !== '' ? $err : ($status > 0 ? ('HTTP ' . $status) : ''),
        'status' => $status,
    ];
}

function dsa_call_whmcs_extension_order(PDO $pdo, int $product_id): array
{
    $empty = ['ok' => false, 'invoice_id' => 0, 'invoice_url' => '', 'error' => ''];
    if ($product_id <= 0) {
        return array_merge($empty, ['error' => 'Invalid product_id']);
    }
    $apiUrl     = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    $identifier = trim(dsa_setting($pdo, 'catalog_sync_whmcs_identifier', ''));
    $serviceId  = (int) dsa_setting($pdo, 'tenant_whmcs_service_id', '0');
    if ($apiUrl === '' || $identifier === '' || $serviceId <= 0) {
        return array_merge($empty, ['error' => dsa_ui_label('extension.account_not_linked')]);
    }
    $endpointUrl = str_replace('client-catalog.php', 'client-extension-order.php', $apiUrl);
    if (!function_exists('curl_init')) {
        return array_merge($empty, ['error' => 'cURL is not available']);
    }
    $payload = json_encode([
        'identifier' => $identifier,
        'service_id' => $serviceId,
        'product_id' => $product_id,
    ], JSON_UNESCAPED_UNICODE);
    if ($payload === false) {
        return array_merge($empty, ['error' => 'Could not encode request']);
    }
    $ch = curl_init($endpointUrl);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST           => true,
        CURLOPT_HTTPHEADER     => ['Content-Type: application/json', 'Accept: application/json'],
        CURLOPT_POSTFIELDS     => $payload,
        CURLOPT_CONNECTTIMEOUT => 10,
        CURLOPT_TIMEOUT        => 30,
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_SSL_VERIFYHOST => false,
    ]);
    $resp   = curl_exec($ch);
    $status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $curlErr = $resp === false ? (string) curl_error($ch) : '';
    curl_close($ch);
    if ($resp === false || $curlErr !== '') {
        return array_merge($empty, ['error' => 'Network error: ' . $curlErr]);
    }
    $json = json_decode((string) $resp, true);
    if (!is_array($json)) {
        return array_merge($empty, ['error' => dsa_ui_label('extension.billing_unreachable')]);
    }
    if (!empty($json['ok'])) {
        return [
            'ok'          => true,
            'invoice_id'  => (int) ($json['invoice_id'] ?? 0),
            'invoice_url' => (string) ($json['invoice_url'] ?? ''),
            'error'       => '',
        ];
    }
    return array_merge($empty, ['error' => (string) ($json['error'] ?? 'Unknown bridge error')]);
}

function dsa_dispatch_tenant_context(PDO $pdo): array
{
    return [
        'tenant_domain' => trim((string) dsa_setting($pdo, 'system_origin_domain', '')),
        'tenant_service_id' => (int) dsa_setting($pdo, 'tenant_whmcs_service_id', '0'),
    ];
}

function dsa_order_item_missing_provisioning(array $product, array $provisioningInput): ?string
{
    $profile = dsa_normalize_provisioning_profile((string) ($product['provisioning_profile'] ?? 'none'));
    $rules = dsa_parse_provisioning_rules($product);
    $fields = $rules['checkout_fields'] ?? [];
    if (!is_array($fields) || count($fields) === 0) {
        if ($profile === 'domain_registration') {
            $fields = [['key' => 'domain', 'required' => true, 'source' => 'domain']];
        } elseif ($profile === 'hosting_custom_username') {
            $fields = [['key' => 'username', 'required' => true, 'source' => 'service_username', 'mode' => 'provided']];
        } elseif ($profile === 'hosting_auto_username') {
            return null;
        } else {
            return null;
        }
    }
    foreach ($fields as $field) {
        if (!is_array($field)) {
            continue;
        }
        $key = trim((string) ($field['key'] ?? ''));
        if ($key === '') {
            continue;
        }
        $required = !empty($field['required']);
        $source = strtolower(trim((string) ($field['source'] ?? 'customfield')));
        $mode = strtolower(trim((string) ($field['mode'] ?? '')));
        if (($source === 'service_username' || $key === 'username') && $mode === 'auto') {
            continue;
        }
        if (!$required) {
            continue;
        }
        if ($source === 'domain' || $source === 'service_domain' || $key === 'domain') {
            $domain = dsa_domain_normalize_input((string) ($provisioningInput['domain'] ?? ''), (string) ($rules['default_tld'] ?? ''));
            if ($domain === '') {
                return 'Missing required domain for ' . trim((string) ($product['product_name'] ?? $product['name'] ?? 'product')) . '.';
            }
            continue;
        }
        if ($source === 'service_username' || $key === 'username') {
            $username = strtolower(trim((string) ($provisioningInput['username'] ?? '')));
            if ($username === '' || !preg_match('/^[a-z][a-z0-9]{2,15}$/', $username)) {
                return 'Missing required username for ' . trim((string) ($product['product_name'] ?? $product['name'] ?? 'product')) . '.';
            }
            continue;
        }
        if (trim((string) ($provisioningInput[$key] ?? '')) === '') {
            return 'Missing required provisioning field "' . dsa_provisioning_field_display_label($field) . '" for '
                . trim((string) ($product['product_name'] ?? $product['name'] ?? 'product')) . '.';
        }
    }
    return null;
}

function dsa_validate_order_dispatch_provisioning(PDO $pdo, int $orderId): ?string
{
    if ($orderId <= 0) {
        return 'Invalid order.';
    }
    $items = dsa_order_dispatch_items($pdo, $orderId);
    if (count($items) === 0) {
        return null;
    }
    foreach ($items as $item) {
        if (!is_array($item)) {
            continue;
        }
        $productId = (int) ($item['product_id'] ?? 0);
        $product = [
            'provisioning_profile' => 'none',
            'provisioning_rules_json' => '{}',
            'product_name' => (string) ($item['product_name'] ?? ''),
        ];
        if ($productId > 0) {
            $stmt = $pdo->prepare("select name, provisioning_profile, provisioning_rules_json from products where id = :id limit 1");
            $stmt->execute([':id' => $productId]);
            $row = $stmt->fetch();
            if ($row) {
                $product['provisioning_profile'] = (string) ($row['provisioning_profile'] ?? 'none');
                $product['provisioning_rules_json'] = (string) ($row['provisioning_rules_json'] ?? '{}');
                if (trim((string) ($product['product_name'] ?? '')) === '') {
                    $product['product_name'] = (string) ($row['name'] ?? '');
                }
            }
        }
        $missing = dsa_order_item_missing_provisioning($product, (array) ($item['provisioning_input'] ?? []));
        if ($missing !== null) {
            return $missing;
        }
    }
    return null;
}

function dsa_order_dispatch_items(PDO $pdo, int $orderId): array
{
    if ($orderId <= 0) {
        return [];
    }
    $stmt = $pdo->prepare(
        "select oi.id, oi.product_id, oi.qty, oi.unit_amount_cents, oi.line_amount_cents, oi.currency,
                oi.provisioning_input_json,
                coalesce(nullif(trim(oi.product_name), ''), p.name) as product_name,
                p.slug as product_slug
         from order_items oi
         left join products p on p.id = oi.product_id
         where oi.order_id = :order_id
         order by oi.id asc"
    );
    $stmt->execute([':order_id' => $orderId]);
    $rows = $stmt->fetchAll();
    if (!is_array($rows) || count($rows) === 0) {
        return [];
    }
    $out = [];
    foreach ($rows as $row) {
        $qty = max(1, (int) ($row['qty'] ?? 1));
        $unit = max(0, (int) ($row['unit_amount_cents'] ?? 0));
        if ($unit <= 0 && (int) ($row['line_amount_cents'] ?? 0) > 0) {
            $unit = (int) round(((int) ($row['line_amount_cents'] ?? 0)) / $qty);
        }
        $provisioningInput = json_decode((string) ($row['provisioning_input_json'] ?? '{}'), true);
        if (!is_array($provisioningInput)) {
            $provisioningInput = [];
        }
        $out[] = [
            'product_id' => (int) ($row['product_id'] ?? 0),
            'product_slug' => (string) ($row['product_slug'] ?? ''),
            'product_name' => (string) ($row['product_name'] ?? ''),
            'qty' => $qty,
            'unit_amount_cents' => $unit,
            'currency' => (string) ($row['currency'] ?? DSA_DEFAULT_CURRENCY),
            'provisioning_input' => $provisioningInput,
        ];
    }
    return $out;
}

function dsa_dispatch_paid_order_to_whmcs(PDO $pdo, int $orderId): array
{
    $result = ['ok' => false, 'message' => 'Dispatch skipped.'];
    $maybeOrder = dsa_get_order_with_product($pdo, $orderId);
    if ($maybeOrder && count(dsa_order_invoice_payment_target((array) $maybeOrder)) > 0) {
        dsa_apply_invoice_payment_to_whmcs($pdo, $orderId);
        $refreshed = dsa_get_order_with_product($pdo, $orderId) ?: $maybeOrder;
        return [
            'ok' => (string) ($refreshed['whmcs_dispatch_status'] ?? '') === 'provisioned',
            'message' => (string) ($refreshed['whmcs_dispatch_message'] ?? 'Invoice payment processed.'),
            'status' => (string) ($refreshed['whmcs_dispatch_status'] ?? ''),
        ];
    }
    if (dsa_demo_mode_blocks_provisioning($pdo)) {
        $message = dsa_demo_mode_paid_notice();
        $pdo->prepare(
            "update orders
             set whmcs_dispatch_status = 'demo_paid_no_provision',
                 whmcs_dispatch_message = :message,
                 whmcs_dispatched_at = datetime('now'),
                 updated_at = datetime('now')
             where id = :id"
        )->execute([':id' => $orderId, ':message' => $message]);
        return ['ok' => true, 'message' => $message, 'status' => 'demo_paid_no_provision'];
    }
    if (dsa_setting($pdo, 'order_dispatch_enabled', '1') !== '1') {
        return ['ok' => false, 'message' => 'Order dispatch is disabled.'];
    }
    $provisioningError = dsa_validate_order_dispatch_provisioning($pdo, $orderId);
    if ($provisioningError !== null) {
        $stmt = $pdo->prepare(
            "update orders
             set whmcs_dispatch_status = 'failed',
                 whmcs_dispatch_message = :message,
                 whmcs_dispatched_at = datetime('now'),
                 updated_at = datetime('now')
             where id = :id"
        );
        $stmt->execute([':id' => $orderId, ':message' => $provisioningError]);
        return ['ok' => false, 'message' => $provisioningError];
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || !in_array((string) ($order['status'] ?? ''), ['paid', 'fulfilled'], true)) {
        return ['ok' => false, 'message' => 'Order is not paid yet.'];
    }
    $paymentRef = trim((string) ($order['payment_ref'] ?? ''));
    if (dsa_order_has_real_mpesa_reference($paymentRef)) {
        dsa_reset_order_for_new_watu_pay_dispatch($pdo, $orderId, $paymentRef);
        $order = dsa_get_order_with_product($pdo, $orderId) ?: $order;
    }
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    if (
        !dsa_order_has_pending_stk_reference($paymentRef)
        && (int) ($order['whmcs_invoice_id'] ?? 0) > 0
        && in_array($dispatchStatus, ['invoice_created', 'invoice_paid', 'provisioned'], true)
        && dsa_order_dispatch_already_completed_for_payment($pdo, (array) $order)
    ) {
        return ['ok' => true, 'message' => dsa_ui_label('dispatch.already_dispatched')];
    }
    if ($dispatchStatus === 'dispatching') {
        $dispatchedAtTs = strtotime((string) ($order['whmcs_dispatched_at'] ?? ''));
        $dispatchAgeSeconds = $dispatchedAtTs !== false ? (time() - (int) $dispatchedAtTs) : 9999;
        if ($dispatchAgeSeconds >= 0 && $dispatchAgeSeconds < 120) {
            return ['ok' => true, 'message' => 'Dispatch already in progress.'];
        }
    }
    if (dsa_order_has_pending_stk_reference($paymentRef)) {
        $pdo->prepare(
            "update orders
             set whmcs_order_id = 0,
                 whmcs_invoice_id = 0,
                 whmcs_service_id = 0,
                 whmcs_dispatch_status = '',
                 whmcs_dispatch_message = '',
                 whmcs_dispatched_at = '',
                 updated_at = datetime('now')
             where id = :id"
        )->execute([':id' => $orderId]);
    }
    $claimStmt = $pdo->prepare(
        "update orders
         set whmcs_dispatch_status = 'dispatching',
             whmcs_dispatched_at = datetime('now'),
             updated_at = datetime('now')
         where id = :id
           and coalesce(whmcs_dispatch_status, '') not in ('invoice_created', 'invoice_paid', 'provisioned', 'dispatching')"
    );
    $claimStmt->execute([':id' => $orderId]);
    if ((int) $claimStmt->rowCount() <= 0) {
        $order = dsa_get_order_with_product($pdo, $orderId);
        if (
            $order
            && !dsa_order_has_pending_stk_reference(trim((string) ($order['payment_ref'] ?? '')))
            && (int) ($order['whmcs_invoice_id'] ?? 0) > 0
            && dsa_order_dispatch_already_completed_for_payment($pdo, (array) $order)
        ) {
            return ['ok' => true, 'message' => dsa_ui_label('dispatch.already_dispatched')];
        }
        return ['ok' => true, 'message' => 'Dispatch already in progress.'];
    }

    $dispatchUrl = dsa_order_dispatch_url($pdo);
    $watuKey = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($dispatchUrl === '' || $watuKey === '') {
        $stmt = $pdo->prepare(
            "update orders
             set whmcs_dispatch_status = 'failed',
                 whmcs_dispatch_message = :message,
                 whmcs_dispatched_at = datetime('now'),
                 updated_at = datetime('now')
             where id = :id"
        );
        $msg = 'Dispatch endpoint/key not configured.';
        $stmt->execute([':id' => $orderId, ':message' => $msg]);
        return ['ok' => false, 'message' => $msg];
    }

    $items = dsa_order_dispatch_items($pdo, $orderId);
    if (count($items) === 0) {
        $items = [[
            'product_id' => (int) ($order['product_id'] ?? 0),
            'product_slug' => (string) ($order['product_slug'] ?? ''),
            'product_name' => (string) ($order['product_name'] ?? ''),
            'qty' => 1,
            'unit_amount_cents' => (int) ($order['amount_cents'] ?? 0),
            'currency' => (string) ($order['currency'] ?? DSA_DEFAULT_CURRENCY),
        ]];
    }
    $firstWhmcsOrderId = 0;
    $firstWhmcsInvoiceId = 0;
    $firstWhmcsServiceId = 0;
    $firstServiceDetails = [];
    $firstServiceAssets = [];
    $allOk = true;
    $messageParts = [];
    $finalStatus = 'failed';
    $lineNo = 0;
    $dsaOrderRef = dsa_order_account_reference_live($pdo, (array) $order);
    if (strpos($dsaOrderRef, 'DSA-0-') === 0) {
        $dsaOrderRef = '';
    }
    $tenantContext = dsa_dispatch_tenant_context($pdo);
    foreach ($items as $item) {
        $qty = max(1, (int) ($item['qty'] ?? 1));
        for ($unitNo = 1; $unitNo <= $qty; $unitNo++) {
            $lineNo++;
            $externalRef = dsa_order_dispatch_external_ref($orderId, $lineNo, $paymentRef);
            $payload = [
                'order_id' => $orderId,
                'external_order_ref' => $externalRef,
                'amount_cents' => (int) ($item['unit_amount_cents'] ?? 0),
                'currency' => (string) ($item['currency'] ?? DSA_DEFAULT_CURRENCY),
                'tenant_payment_method' => (string) ($order['payment_method'] ?? ''),
                'payment_ref' => (string) ($order['payment_ref'] ?? ''),
                'dsa_order_ref' => $dsaOrderRef,
                'customer_name' => (string) ($order['customer_name'] ?? ''),
                'customer_email' => (string) ($order['customer_email'] ?? ''),
                'customer_phone' => (string) ($order['customer_phone'] ?? ''),
                'product_slug' => (string) ($item['product_slug'] ?? ''),
                'product_name' => (string) ($item['product_name'] ?? ''),
                'product_sku' => strpos((string) ($item['product_slug'] ?? ''), 'watu-sku-') === 0 ? substr((string) $item['product_slug'], strlen('watu-sku-')) : '',
                'provision_input' => (array) ($item['provisioning_input'] ?? []),
                'domain' => '',
                'demo_mode' => dsa_demo_mode_active($pdo),
                'tenant_domain' => (string) ($tenantContext['tenant_domain'] ?? ''),
                'tenant_service_id' => (int) ($tenantContext['tenant_service_id'] ?? 0),
            ];
            $http = dsa_http_post_json_with_watu_key($dispatchUrl, $watuKey, $payload);
            $bodyJson = json_decode((string) ($http['body'] ?? ''), true);
            $status = trim((string) ($bodyJson['status'] ?? 'failed'));
            $message = trim((string) ($bodyJson['message'] ?? ($http['error'] ?? 'Dispatch failed.')));
            $whmcsOrderId = (int) ($bodyJson['whmcs_order_id'] ?? 0);
            $whmcsInvoiceId = (int) ($bodyJson['whmcs_invoice_id'] ?? 0);
            $whmcsServiceId = (int) ($bodyJson['whmcs_service_id'] ?? 0);
            $serviceDetails = is_array($bodyJson['service_details'] ?? null) ? (array) $bodyJson['service_details'] : [];
            $serviceAssets = is_array($bodyJson['service_assets'] ?? null) ? (array) $bodyJson['service_assets'] : [];
            if ($firstWhmcsOrderId <= 0 && $whmcsOrderId > 0) {
                $firstWhmcsOrderId = $whmcsOrderId;
            }
            if ($firstWhmcsInvoiceId <= 0 && $whmcsInvoiceId > 0) {
                $firstWhmcsInvoiceId = $whmcsInvoiceId;
            }
            if ($firstWhmcsServiceId <= 0 && $whmcsServiceId > 0) {
                $firstWhmcsServiceId = $whmcsServiceId;
            }
            if (count($firstServiceDetails) === 0 && count($serviceDetails) > 0) {
                $firstServiceDetails = $serviceDetails;
            }
            if (count($firstServiceAssets) === 0 && count($serviceAssets) > 0) {
                $firstServiceAssets = $serviceAssets;
            }
            if (empty($http['ok'])) {
                $allOk = false;
            }
            $messageParts[] = 'line ' . $lineNo . ': ' . ($message !== '' ? $message : 'dispatched');
            if (in_array($status, ['provisioned', 'invoice_paid', 'invoice_created'], true)) {
                $finalStatus = $status;
            }
        }
    }
    $message = implode(' | ', $messageParts);
    if ($message === '') {
        $message = 'Dispatch finished with no response.';
    }
    if (!$allOk && $finalStatus === 'failed') {
        $finalStatus = 'failed';
    }

    $stmt = $pdo->prepare(
        "update orders
         set whmcs_order_id = :whmcs_order_id,
             whmcs_invoice_id = :whmcs_invoice_id,
             whmcs_service_id = :whmcs_service_id,
             whmcs_dispatch_status = :whmcs_dispatch_status,
             whmcs_dispatch_message = :whmcs_dispatch_message,
             service_details_json = :service_details_json,
             whmcs_dispatched_at = datetime('now'),
             updated_at = datetime('now')
         where id = :id"
    );
    $stmt->execute([
        ':id' => $orderId,
        ':whmcs_order_id' => $firstWhmcsOrderId,
        ':whmcs_invoice_id' => $firstWhmcsInvoiceId,
        ':whmcs_service_id' => $firstWhmcsServiceId,
        ':whmcs_dispatch_status' => $finalStatus,
        ':whmcs_dispatch_message' => $message,
        ':service_details_json' => json_encode($firstServiceDetails, JSON_UNESCAPED_UNICODE),
    ]);

    dsa_order_store_dispatch_assets($pdo, $orderId, [
        'service_assets' => $firstServiceAssets,
        'service_details' => $firstServiceDetails,
        'whmcs_domain_id' => (int) ($firstServiceAssets['whmcs_domain_id'] ?? 0),
    ]);
    if (
        $allOk
        && in_array($finalStatus, ['invoice_created', 'invoice_paid', 'provisioned'], true)
        && dsa_order_has_real_mpesa_reference($paymentRef)
    ) {
        dsa_setting_set($pdo, dsa_order_dispatched_payment_ref_setting_key($orderId), $paymentRef);
    }

    return [
        'ok' => $allOk,
        'message' => $message !== '' ? $message : 'Dispatch completed.',
        'status' => $finalStatus,
        'whmcs_invoice_id' => $firstWhmcsInvoiceId,
    ];
}

function dsa_backfill_service_details(PDO $pdo, int $limit = 500): array
{
    $limit = max(1, min(2000, $limit));
    $dispatchUrl = dsa_order_dispatch_url($pdo);
    $watuKey = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($dispatchUrl === '' || $watuKey === '') {
        return ['ok' => false, 'message' => 'Backfill failed: dispatch endpoint/key not configured.'];
    }
    $stmt = $pdo->prepare(
        "select o.id
         from orders o
         where o.whmcs_service_id > 0
           and trim(coalesce(o.service_details_json, '')) in ('', '{}')
         order by o.id desc
         limit " . (int) $limit
    );
    $stmt->execute([]);
    $rows = $stmt->fetchAll() ?: [];
    if (count($rows) === 0) {
        return ['ok' => true, 'message' => 'Service details backfill complete: no pending orders found.'];
    }

    $updated = 0;
    $skipped = 0;
    $failed = 0;
    foreach ($rows as $row) {
        $orderId = (int) ($row['id'] ?? 0);
        if ($orderId <= 0) {
            $skipped++;
            continue;
        }
        $order = dsa_get_order_with_product($pdo, $orderId);
        if (!$order) {
            $skipped++;
            continue;
        }
        $items = dsa_order_dispatch_items($pdo, $orderId);
        if (count($items) === 0) {
            $items = [[
                'product_slug' => (string) ($order['product_slug'] ?? ''),
                'product_name' => (string) ($order['product_name'] ?? ''),
                'unit_amount_cents' => (int) ($order['amount_cents'] ?? 0),
                'currency' => (string) ($order['currency'] ?? DSA_DEFAULT_CURRENCY),
                'provisioning_input' => [],
            ]];
        }
        $item = $items[0];
        $dsaOrderRef = dsa_order_account_reference_live($pdo, (array) $order);
        if (strpos($dsaOrderRef, 'DSA-0-') === 0) {
            $dsaOrderRef = '';
        }
        $payload = array_merge([
            'order_id' => $orderId,
            'external_order_ref' => 'tenant-order-' . $orderId . '-line-1',
            'amount_cents' => (int) ($item['unit_amount_cents'] ?? (int) ($order['amount_cents'] ?? 0)),
            'currency' => (string) ($item['currency'] ?? (string) ($order['currency'] ?? DSA_DEFAULT_CURRENCY)),
            'tenant_payment_method' => (string) ($order['payment_method'] ?? ''),
            'payment_ref' => (string) ($order['payment_ref'] ?? ''),
            'dsa_order_ref' => $dsaOrderRef,
            'customer_name' => (string) ($order['customer_name'] ?? ''),
            'customer_email' => (string) ($order['customer_email'] ?? ''),
            'customer_phone' => (string) ($order['customer_phone'] ?? ''),
            'product_slug' => (string) ($item['product_slug'] ?? ''),
            'product_name' => (string) ($item['product_name'] ?? ''),
            'product_sku' => strpos((string) ($item['product_slug'] ?? ''), 'watu-sku-') === 0 ? substr((string) ($item['product_slug'] ?? ''), strlen('watu-sku-')) : '',
            'provision_input' => (array) ($item['provisioning_input'] ?? []),
            'domain' => '',
            'demo_mode' => dsa_demo_mode_active($pdo),
        ], dsa_dispatch_tenant_context($pdo));
        $http = dsa_http_post_json_with_watu_key($dispatchUrl, $watuKey, $payload);
        $bodyJson = json_decode((string) ($http['body'] ?? ''), true);
        $serviceDetails = is_array($bodyJson['service_details'] ?? null) ? (array) $bodyJson['service_details'] : [];
        if (count($serviceDetails) === 0) {
            $failed++;
            continue;
        }
        $upd = $pdo->prepare("update orders set service_details_json = :json, updated_at = datetime('now') where id = :id");
        $upd->execute([
            ':id' => $orderId,
            ':json' => json_encode($serviceDetails, JSON_UNESCAPED_UNICODE),
        ]);
        $updated++;
    }
    return [
        'ok' => true,
        'message' => 'Service details backfill complete: updated ' . $updated . ', skipped ' . $skipped . ', failed ' . $failed . '.',
    ];
}

function dsa_sync_paid_signal_from_whmcs(PDO $pdo, int $orderId, bool $force = false): void
{
    if ($orderId <= 0) {
        return;
    }
    $stmt = $pdo->prepare(
        "select o.id, o.product_id, o.status, o.payment_method, o.payment_ref, p.slug as product_slug, p.catalog_product_id as source_product_id
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id
         limit 1"
    );
    $stmt->execute([':id' => $orderId]);
    $order = $stmt->fetch();
    if (!$order) {
        return;
    }
    $orderStatus = (string) ($order['status'] ?? '');
    if (in_array($orderStatus, ['paid', 'fulfilled'], true) && !dsa_order_awaiting_watu_pay_reconciliation($order)) {
        return;
    }
    $paymentMethod = (string) ($order['payment_method'] ?? '');
    if (!in_array($paymentMethod, ['watupay_mpesa', 'mpesa_direct'], true)) {
        return;
    }
    if (!dsa_order_paid_sync_should_probe($pdo, $orderId, $force)) {
        return;
    }
    $statusUrl = dsa_order_payment_status_url($pdo);
    $watuKey = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($statusUrl === '' || $watuKey === '') {
        return;
    }
    $orderRef = dsa_order_account_reference_live($pdo, (array) $order);
    if (strpos($orderRef, 'DSA-0-') === 0) {
        $sourceProductId = dsa_order_source_product_id_for_order($pdo, (int) ($order['id'] ?? 0), (array) $order);
        if ($sourceProductId > 0) {
            $order['source_product_id'] = $sourceProductId;
            $orderRef = dsa_order_account_reference($order);
        }
    }
    $existingRef = trim((string) ($order['payment_ref'] ?? ''));
    if ($existingRef !== '' && stripos($existingRef, 'DSA-') === 0) {
        $orderRef = $existingRef;
    }
    $sep = strpos($statusUrl, '?') === false ? '?' : '&';
    $lookupUrl = $statusUrl . $sep . 'order_ref=' . rawurlencode($orderRef);
    $http = dsa_http_get_with_watu_key($lookupUrl, $watuKey);
    if (empty($http['ok']) || trim((string) ($http['body'] ?? '')) === '') {
        return;
    }
    $json = json_decode((string) $http['body'], true);
    if (!is_array($json) || empty($json['ok']) || empty($json['payment_found'])) {
        return;
    }
    $txnStatus = strtolower(trim((string) ($json['status'] ?? '')));
    $mpesaCode = trim((string) ($json['mpesa_code'] ?? ''));
    if (!dsa_watu_pay_txn_syncable_for_dsa($txnStatus, $mpesaCode, $orderRef)) {
        return;
    }
    dsa_reset_order_for_new_watu_pay_dispatch($pdo, $orderId, $mpesaCode);
    $upd = $pdo->prepare(
        "update orders
         set status = 'paid',
             payment_ref = case when :payment_ref = '' then payment_ref else :payment_ref end,
             updated_at = datetime('now')
         where id = :id"
    );
    $upd->execute([
        ':id' => $orderId,
        ':payment_ref' => $mpesaCode,
    ]);
    dsa_record_watupay_credit_for_order($pdo, $orderId);
    dsa_send_order_notification_email($pdo, $orderId, 'payment_received');
    dsa_payment_flow_state_clear($orderId);
    if (dsa_demo_mode_active($pdo)) {
        dsa_demo_mode_mark_paid_no_provision($pdo, $orderId);
        return;
    }
    dsa_on_order_became_paid($pdo, $orderId);
}

function dsa_order_paid_sync_should_probe(PDO $pdo, int $orderId, bool $force = false): bool
{
    if ($orderId <= 0) {
        return false;
    }
    if ($force) {
        return true;
    }
    static $requestMemo = [];
    $memoKey = (string) spl_object_id($pdo) . '|' . (string) $orderId;
    $now = time();
    if (isset($requestMemo[$memoKey]) && ($now - (int) $requestMemo[$memoKey]) < 15) {
        return false;
    }
    $requestMemo[$memoKey] = $now;
    $settingKey = 'order_paid_sync_checked_at_' . $orderId;
    $lastCheckedAt = (int) dsa_setting($pdo, $settingKey, '0');
    if ($lastCheckedAt > 0 && ($now - $lastCheckedAt) < 30) {
        return false;
    }
    dsa_setting_set($pdo, $settingKey, (string) $now);
    return true;
}

/** @return array{success:bool,message:string} */
function dsa_admin_sync_order_watupay(PDO $pdo, int $orderId): array
{
    if ($orderId <= 0) {
        return ['success' => false, 'message' => 'Invalid order ID.'];
    }
    $stmt = $pdo->prepare(
        "select o.id, o.status, o.payment_method, o.payment_ref, o.product_id, p.slug as product_slug, p.catalog_product_id as source_product_id
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id
         limit 1"
    );
    $stmt->execute([':id' => $orderId]);
    $order = $stmt->fetch();
    if (!$order) {
        return ['success' => false, 'message' => 'Order not found.'];
    }
    $status = (string) ($order['status'] ?? '');
    if (in_array($status, ['paid', 'fulfilled'], true)) {
        return ['success' => true, 'message' => 'Order #' . $orderId . ' is already ' . dsa_admin_order_status_label($status) . '.'];
    }
    $paymentMethod = (string) ($order['payment_method'] ?? '');
    if (!in_array($paymentMethod, ['watupay_mpesa', 'mpesa_direct'], true)) {
        return ['success' => false, 'message' => 'Order #' . $orderId . ' is not a Watu Technology M-PESA / gateway order.'];
    }
    $orderRef = dsa_order_account_reference_live($pdo, (array) $order);
    if (strpos($orderRef, 'DSA-0-') === 0) {
        $sourceProductId = dsa_order_source_product_id_for_order($pdo, $orderId, (array) $order);
        if ($sourceProductId > 0) {
            $order['source_product_id'] = $sourceProductId;
            $orderRef = dsa_order_account_reference($order);
        }
    }
    $existingRef = trim((string) ($order['payment_ref'] ?? ''));
    if ($existingRef !== '' && stripos($existingRef, 'DSA-') === 0) {
        $orderRef = $existingRef;
    }
    $statusUrl = dsa_order_payment_status_url($pdo);
    $watuKey = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($statusUrl === '' || $watuKey === '') {
        return ['success' => false, 'message' => 'Watu Technology M-PESA sync is not configured (missing bridge URL or Watu key).'];
    }
    $sep = strpos($statusUrl, '?') === false ? '?' : '&';
    $lookupUrl = $statusUrl . $sep . 'order_ref=' . rawurlencode($orderRef);
    $http = dsa_http_get_with_watu_key($lookupUrl, $watuKey);
    if (empty($http['ok'])) {
        return ['success' => false, 'message' => 'Could not reach Watu Technology payment status API for ref ' . $orderRef . '.'];
    }
    $json = json_decode(trim((string) ($http['body'] ?? '')), true);
    if (!is_array($json) || empty($json['ok'])) {
        return ['success' => false, 'message' => 'Invalid response from Watu Technology payment gateway for ref ' . $orderRef . '.'];
    }
    if (empty($json['payment_found'])) {
        return [
            'success' => false,
            'message' => 'No transaction found for ref ' . $orderRef . '. '
                . 'Check gateway admin — use Corrected acc if the payer typed the wrong account, then Close (DSA sync).',
        ];
    }
    $txnStatus = strtolower(trim((string) ($json['status'] ?? '')));
    $mpesaCode = trim((string) ($json['mpesa_code'] ?? ''));
    if (!dsa_watu_pay_txn_syncable_for_dsa($txnStatus, $mpesaCode, $orderRef)) {
        return [
            'success' => false,
            'message' => 'Watu Technology M-PESA has ref ' . $orderRef . ' but status is "' . $txnStatus . '" (needs open/closed with M-PESA code).',
        ];
    }
    dsa_sync_paid_signal_from_whmcs($pdo, $orderId, true);
    $stmt->execute([':id' => $orderId]);
    $after = $stmt->fetch();
    $afterStatus = (string) ($after['status'] ?? '');
    if (in_array($afterStatus, ['paid', 'fulfilled'], true)) {
        return [
            'success' => true,
            'message' => 'Order #' . $orderId . ' synced from Watu Technology M-PESA (' . $orderRef . ') → ' . dsa_admin_order_status_label($afterStatus) . '.',
        ];
    }

    return [
        'success' => false,
        'message' => 'Watu Technology M-PESA payment is closed for ' . $orderRef . ' but order #' . $orderId . ' did not update. Check dispatch logs.',
    ];
}

function dsa_whmcs_extract_price_cents(array $remote, string &$currency): int
{
    $pricing = $remote['pricing'] ?? [];
    if (!is_array($pricing) || count($pricing) === 0) {
        return 0;
    }
    foreach ($pricing as $currencyCode => $plans) {
        if (!is_array($plans)) {
            continue;
        }
        $currency = strtoupper((string) $currencyCode);
        foreach (['monthly', 'quarterly', 'semiannually', 'annually', 'biennially', 'triennially', 'onetime'] as $period) {
            $value = (string) ($plans[$period] ?? '-1.00');
            $amount = dsa_parse_whmcs_money($value);
            if ($amount > 0) {
                return (int) round($amount * 100);
            }
        }
    }
    return 0;
}

function dsa_normalize_provisioning_profile(string $value): string
{
    $profile = strtolower(trim($value));
    $allowed = ['none', 'hosting_auto_username', 'hosting_custom_username', 'domain_registration'];
    return in_array($profile, $allowed, true) ? $profile : 'none';
}

function dsa_parse_provisioning_rules(array $product): array
{
    $raw = trim((string) ($product['provisioning_rules_json'] ?? '{}'));
    if ($raw === '') {
        $raw = '{}';
    }
    $decoded = json_decode($raw, true);
    if (!is_array($decoded)) {
        $decoded = [];
    }
    $defaultTld = trim((string) ($decoded['default_tld'] ?? ''));
    if ($defaultTld !== '' && $defaultTld[0] !== '.') {
        $defaultTld = '.' . $defaultTld;
    }
    $decoded['default_tld'] = strtolower($defaultTld);
    $fields = $decoded['checkout_fields'] ?? [];
    if (!is_array($fields)) {
        $fields = [];
    }
    $decoded['checkout_fields'] = $fields;
    return $decoded;
}

function dsa_build_provisioning_rules_json_from_post(array $post): string
{
    $defaultTld = strtolower(trim((string) ($post['provision_default_tld'] ?? '')));
    if ($defaultTld !== '' && $defaultTld[0] !== '.') {
        $defaultTld = '.' . $defaultTld;
    }
    if ($defaultTld !== '' && !preg_match('/^\.[a-z0-9-]{2,20}$/', $defaultTld)) {
        $defaultTld = '';
    }
    return json_encode(['default_tld' => $defaultTld], JSON_UNESCAPED_UNICODE);
}

function dsa_domain_normalize_input(string $raw, string $defaultTld = ''): string
{
    $domain = strtolower(trim($raw));
    if ($domain === '') {
        return '';
    }
    $domain = preg_replace('/\s+/', '', $domain) ?? '';
    if ($domain === '') {
        return '';
    }
    if (!preg_match('/^[a-z0-9][a-z0-9-]*\.[a-z0-9.-]+$/', $domain)) {
        return '';
    }
    return $domain;
}

function dsa_domain_is_reserved(string $domain): bool
{
    $domain = strtolower(trim($domain));
    if ($domain === '') {
        return false;
    }
    static $reserved = [
        'example.com',
        'example.org',
        'example.net',
        'example.edu',
        'example.gov',
        'test.com',
        'test.example',
        'invalid',
        'localhost',
    ];
    if (in_array($domain, $reserved, true)) {
        return true;
    }
    if (preg_match('/\.(example|invalid|test|localhost)$/', $domain) === 1) {
        return true;
    }
    return false;
}

function dsa_domain_reserved_error(string $domain): string
{
    return 'The domain "' . $domain . '" is reserved and cannot be used for provisioning. Enter your real domain name.';
}

function dsa_provision_post_value(array $post, string $key, string $cartSlug = ''): string
{
    if ($cartSlug !== '') {
        $bag = $post['provision_field'] ?? [];
        if (is_array($bag) && is_array($bag[$cartSlug] ?? null)) {
            return trim((string) (($bag[$cartSlug])[$key] ?? ''));
        }
    } else {
        $bag = $post['provision_field'] ?? [];
        if (is_array($bag)) {
            return trim((string) ($bag[$key] ?? ''));
        }
    }
    if ($key === 'domain') {
        if ($cartSlug !== '' && is_array($post['provision_domain'] ?? null)) {
            return trim((string) (($post['provision_domain'])[$cartSlug] ?? ''));
        }
        return trim((string) ($post['provision_domain'] ?? ''));
    }
    if ($key === 'username') {
        if ($cartSlug !== '' && is_array($post['provision_username'] ?? null)) {
            return trim((string) (($post['provision_username'])[$cartSlug] ?? ''));
        }
        return trim((string) ($post['provision_username'] ?? ''));
    }
    return '';
}

function dsa_collect_provisioning_input(array $product, array $post, string $cartSlug = ''): array
{
    $contract = dsa_provisioning_contract_from_product($product);
    if (empty($contract['sync_pulled'])) {
        return ['ok' => false, 'error' => 'Product configuration is incomplete. Please contact the store.', 'input' => []];
    }
    $rules = $contract['rules'];
    $fields = $rules['checkout_fields'] ?? [];
    if (!is_array($fields)) {
        $fields = [];
    }
    $input = [];
    foreach ($fields as $field) {
        if (!is_array($field)) {
            continue;
        }
        $key = trim((string) ($field['key'] ?? ''));
        if ($key === '') {
            continue;
        }
        $required = !empty($field['required']);
        $source = strtolower(trim((string) ($field['source'] ?? 'customfield')));
        $mode = strtolower(trim((string) ($field['mode'] ?? '')));
        $value = dsa_provision_post_value($post, $key, $cartSlug);
        if ($source === 'domain' || $source === 'service_domain' || $key === 'domain') {
            $domain = dsa_domain_normalize_input($value, (string) ($rules['default_tld'] ?? ''));
            if ($domain === '' && $required) {
                return ['ok' => false, 'error' => 'Please enter a valid domain (e.g. example.com).', 'input' => []];
            }
            if ($domain !== '' && dsa_domain_is_reserved($domain)) {
                return ['ok' => false, 'error' => dsa_domain_reserved_error($domain), 'input' => []];
            }
            if ($domain !== '') {
                $input['domain'] = $domain;
            }
            continue;
        }
        if ($source === 'service_username' || $key === 'username') {
            if ($mode === 'auto') {
                $input['username_mode'] = 'auto';
                continue;
            }
            $username = strtolower($value);
            if ($username === '' && !$required) {
                continue;
            }
            if (!preg_match('/^[a-z][a-z0-9]{2,15}$/', $username)) {
                return ['ok' => false, 'error' => 'Please enter a valid username (3-16 chars, letters/numbers, starts with a letter).', 'input' => []];
            }
            $input['username'] = $username;
            $input['username_mode'] = 'provided';
            continue;
        }
        if ($value === '') {
            if ($required) {
                return ['ok' => false, 'error' => 'Please fill all required provisioning fields.', 'input' => []];
            }
            continue;
        }
        $input[$key] = $value;
    }
    return ['ok' => true, 'error' => '', 'input' => $input];
}

function dsa_provisioning_field_display_label(array $field): string
{
    $key = trim((string) ($field['key'] ?? ''));
    $label = trim((string) ($field['label'] ?? ''));
    if ($label !== '' && strpos($label, '|') !== false) {
        $parts = explode('|', $label, 2);
        $label = trim((string) ($parts[1] ?? $parts[0]));
    }
    if ($label === '' || $label === $key) {
        if (strpos($key, '|') !== false) {
            $parts = explode('|', $key, 2);
            return trim((string) ($parts[1] ?? $parts[0]));
        }
        return $key;
    }
    return $label;
}

function dsa_render_product_provisioning_fields(array $product, string $cartSlug = '', array $post = []): string
{
    $contract = dsa_provisioning_contract_from_product($product);
    if (empty($contract['sync_pulled'])) {
        return '<div class="card" style="margin-top:10px;border-color:#f59e0b;"><p class="notice">Provisioning rules were not synced for this product. Run catalog sync in admin before checkout.</p></div>';
    }
    $rules = $contract['rules'];
    $fields = $rules['checkout_fields'] ?? [];
    if (!is_array($fields) || count($fields) === 0) {
        return '';
    }
    $html = '<div class="card" style="margin-top:10px;">';
    foreach ($fields as $field) {
        if (!is_array($field)) {
            continue;
        }
        $key = trim((string) ($field['key'] ?? ''));
        if ($key === '') {
            continue;
        }
        $label = dsa_provisioning_field_display_label($field);
        $required = !empty($field['required']);
        $source = strtolower(trim((string) ($field['source'] ?? 'customfield')));
        $mode = strtolower(trim((string) ($field['mode'] ?? '')));
        if (($source === 'service_username' || $key === 'username') && $mode === 'auto') {
            $html .= '<p class="muted">Username will be auto-generated at provisioning time.</p>';
            continue;
        }
        $inputType = strtolower(trim((string) ($field['input'] ?? 'text')));
        $name = $cartSlug !== '' ? ('provision_field[' . $cartSlug . '][' . $key . ']') : ('provision_field[' . $key . ']');
        $value = dsa_provision_post_value($post, $key, $cartSlug);
        $isTextarea = $inputType === 'textarea';
        $placeholder = '';
        if ($source === 'domain' || $source === 'service_domain' || $key === 'domain') {
            $placeholder = 'example.com';
        } elseif ($source === 'service_username' || $key === 'username') {
            $placeholder = 'yourusername';
        }
        if ($isTextarea) {
            $html .= '<label>' . dsa_h($label) . ($required ? ' *' : '') . '</label><textarea name="' . dsa_h($name) . '" rows="2"' . ($required ? ' required' : '') . '>' . dsa_h($value) . '</textarea>';
        } else {
            $type = $inputType === 'password' ? 'password' : 'text';
            $html .= '<label>' . dsa_h($label) . ($required ? ' *' : '') . '</label><input type="' . dsa_h($type) . '" name="' . dsa_h($name) . '" value="' . dsa_h($value) . '"' . ($placeholder !== '' ? (' placeholder="' . dsa_h($placeholder) . '"') : '') . ($required ? ' required' : '') . '>';
        }
        $desc = trim((string) ($field['description'] ?? ''));
        if ($desc !== '') {
            $html .= '<p class="muted">' . dsa_h($desc) . '</p>';
        }
    }
    $html .= '</div>';
    return $html;
}

function dsa_guess_default_tld(string $name): string
{
    if (preg_match('/(\.[a-z]{2,20})/i', $name, $m)) {
        return strtolower((string) ($m[1] ?? '.com'));
    }
    return '.com';
}

function dsa_build_admin_url(array $params): string
{
    $query = http_build_query($params);
    return '/admin' . ($query !== '' ? ('?' . $query) : '');
}

function dsa_truncate_text(string $value, int $maxLength = 140): string
{
    $text = trim($value);
    if ($maxLength < 4 || strlen($text) <= $maxLength) {
        return $text;
    }
    return rtrim(substr($text, 0, $maxLength - 3)) . '...';
}

function dsa_render_admin(PDO $pdo, string $notice, string $filter = 'all', string $section = 'dashboard'): void
{
    dsa_release_session_lock_if_safe();
    if ($notice === '' && trim((string) ($_GET['notice'] ?? '')) !== '') {
        $notice = trim((string) $_GET['notice']);
    }
    $allowedSections = ['dashboard', 'catalog', 'custom-services', 'products', 'orders', 'customers', 'support', 'notifications', 'payments', 'payouts', 'branding', 'analytics', 'settings'];
    if (!in_array($section, $allowedSections, true)) {
        $section = 'dashboard';
    }
    $forceWatuPayTab = false;
    if ($section === 'payouts') {
        $section = 'payments';
        $forceWatuPayTab = true;
    }
    $catalogCategory = trim((string) ($_GET['catalog_category'] ?? 'all'));
    if ($catalogCategory === '') {
        $catalogCategory = 'all';
    }
    $catalogState = trim((string) ($_GET['catalog_state'] ?? 'all'));
    if (!in_array($catalogState, ['all', 'enabled', 'not_enabled'], true)) {
        $catalogState = 'all';
    }
    $catalogQuery = trim((string) ($_GET['catalog_q'] ?? ''));
    $catalogPage = (int) ($_GET['catalog_page'] ?? 1);
    if ($catalogPage < 1) {
        $catalogPage = 1;
    }
    $catalogPerPage = 5;
    $ordersQuery = trim((string) ($_GET['orders_q'] ?? ''));
    $ordersPage = max(1, (int) ($_GET['orders_page'] ?? 1));
    $ordersPerPage = 40;
    $ordersTotal = 0;
    $ordersPages = 1;
    $customersQuery = trim((string) ($_GET['customers_q'] ?? ''));
    $customersStatus = trim((string) ($_GET['customers_status'] ?? 'all'));
    if (!in_array($customersStatus, ['all', 'with_orders', 'without_orders'], true)) {
        $customersStatus = 'all';
    }
    $customersSort = trim((string) ($_GET['customers_sort'] ?? 'recent'));
    if (!in_array($customersSort, ['recent', 'name', 'email', 'orders'], true)) {
        $customersSort = 'recent';
    }
    $focusCustomerId = (int) ($_GET['customer_id'] ?? 0);

    $catalog = [];
    $products = [];
    $productCategories = [];
    $productsCategory = trim((string) ($_GET['products_category'] ?? 'all'));
    if ($productsCategory === '') {
        $productsCategory = 'all';
    }
    $orders = [];
    $customers = [];
    $dashboardCatalogCount = 0;
    $dashboardProductsCount = 0;
    $dashboardOrdersCount = 0;
    $catalogCategories = [];
    $catalogTotal = 0;
    $catalogPages = 1;
    $needsCatalog = in_array($section, ['catalog'], true);
    $needsProducts = in_array($section, ['products'], true);
    $needsOrders = in_array($section, ['orders'], true);
    $needsCustomers = in_array($section, ['customers'], true);
    $needsNotifications = in_array($section, ['notifications'], true);
    $needsDashboardCounts = ($section === 'dashboard');
    $notificationTemplateCatalog = [];

    if ($needsCatalog) {
        $catalogCategories = $pdo->query("select distinct category from watu_catalog_products order by category asc")->fetchAll(PDO::FETCH_COLUMN) ?: [];
        $catalogCategories = array_values(array_filter(array_map('strval', $catalogCategories), static function ($value) {
            return trim($value) !== '';
        }));
        $catalogBaseSql = "from watu_catalog_products c left join products p on p.catalog_product_id = c.id";
        $catalogWhereParts = [];
        $catalogParams = [];
        if ($catalogCategory !== 'all') {
            $catalogWhereParts[] = "c.category = :category";
            $catalogParams[':category'] = $catalogCategory;
        }
        if ($catalogState === 'enabled') {
            $catalogWhereParts[] = "p.id is not null";
        } elseif ($catalogState === 'not_enabled') {
            $catalogWhereParts[] = "p.id is null";
        }
        if ($catalogQuery !== '') {
            $catalogWhereParts[] = "(lower(c.name) like :search or lower(c.slug) like :search or lower(c.description) like :search)";
            $catalogParams[':search'] = '%' . strtolower($catalogQuery) . '%';
        }
        $catalogWhereSql = count($catalogWhereParts) > 0 ? (' where ' . implode(' and ', $catalogWhereParts)) : '';
        $catalogTotalStmt = $pdo->prepare("select count(*) " . $catalogBaseSql . $catalogWhereSql);
        $catalogTotalStmt->execute($catalogParams);
        $catalogTotal = (int) $catalogTotalStmt->fetchColumn();
        if ($needsCatalog) {
            $catalogPages = max(1, (int) ceil($catalogTotal / $catalogPerPage));
            if ($catalogPage > $catalogPages) {
                $catalogPage = $catalogPages;
            }
            $catalogOffset = ($catalogPage - 1) * $catalogPerPage;
            $catalogSql = "select c.id, c.slug, c.name, c.category, c.description, c.cost_cents, c.currency, c.status,
                                 c.provisioning_profile, c.provisioning_rules_json,
                                 p.id as enabled_product_id, p.price_cents as sell_price_cents, p.status as sell_status "
                . $catalogBaseSql
                . $catalogWhereSql
                . " order by c.category asc, c.name asc limit " . (int) $catalogPerPage . " offset " . (int) $catalogOffset;
            $catalogStmt = $pdo->prepare($catalogSql);
            $catalogStmt->execute($catalogParams);
            $catalog = $catalogStmt->fetchAll();
        }
    }

    if ($needsProducts) {
        $productCategories = $pdo->query("select distinct category from products order by category asc")->fetchAll(PDO::FETCH_COLUMN) ?: [];
        $productCategories = array_values(array_filter(array_map('strval', $productCategories), static function ($value) {
            return trim($value) !== '';
        }));
        $productsWhere = '';
        $productsParams = [];
        if ($productsCategory !== 'all') {
            $productsWhere = ' where category = :category';
            $productsParams[':category'] = $productsCategory;
        }
        $productsStmt = $pdo->prepare(
            "select id, slug, name, category, description, cost_cents, price_cents, currency, status, product_source,
                    price_monthly_cents, price_annual_cents, billing_cycles_json
             from products"
            . $productsWhere
            . " order by category asc, name asc limit 200"
        );
        $productsStmt->execute($productsParams);
        $products = $productsStmt->fetchAll() ?: [];
    }

    if (!in_array($filter, ['all', 'pending_proof', 'paid', 'fulfilled', 'cancelled'], true)) {
        $filter = 'all';
    }
    if ($needsOrders) {
        $ordersWhereParts = [];
            $ordersParams = [];
            if ($filter === 'pending_proof') {
                $ordersWhereParts[] = "o.status = 'pending_payment'";
            } elseif ($filter === 'paid') {
                $ordersWhereParts[] = "o.status = 'paid'";
            } elseif ($filter === 'fulfilled') {
                $ordersWhereParts[] = "o.status = 'fulfilled'";
            } elseif ($filter === 'cancelled') {
                $ordersWhereParts[] = "o.status = 'cancelled'";
            }
            if ($ordersQuery !== '') {
                $ordersWhereParts[] = "(cast(o.id as text) like :oq or lower(o.customer_email) like :oq or lower(o.customer_name) like :oq)";
                $ordersParams[':oq'] = '%' . strtolower($ordersQuery) . '%';
            }
            $ordersWhereSql = count($ordersWhereParts) > 0 ? ('where ' . implode(' and ', $ordersWhereParts)) : '';
            $ordersTotalStmt = $pdo->prepare("select count(*) from orders o join products p on p.id = o.product_id " . $ordersWhereSql);
            $ordersTotalStmt->execute($ordersParams);
            $ordersTotal = (int) $ordersTotalStmt->fetchColumn();
            $ordersPages = max(1, (int) ceil($ordersTotal / $ordersPerPage));
            if ($ordersPage > $ordersPages) {
                $ordersPage = $ordersPages;
            }
            $ordersOffset = ($ordersPage - 1) * $ordersPerPage;
            $ordersStmt = $pdo->prepare(
                "select o.id, o.customer_id, o.customer_name, o.customer_email, o.customer_phone, o.amount_cents, o.currency, o.status, o.payment_ref, o.payment_method, o.payment_proof_path,
                        o.delivery_value, o.created_at, o.whmcs_order_id, o.whmcs_invoice_id, o.whmcs_service_id, o.whmcs_dispatch_status, o.whmcs_dispatch_message, o.whmcs_dispatched_at,
                        p.name as product_name, p.slug as product_slug, p.catalog_product_id, p.provisioning_profile, p.fulfillment_type as fulfillment_type
                 from orders o
                 join products p on p.id = o.product_id
                 " . $ordersWhereSql . "
                 order by o.id desc
                 limit " . (int) $ordersPerPage . " offset " . (int) $ordersOffset
            );
            $ordersStmt->execute($ordersParams);
            $orders = $ordersStmt->fetchAll();
            foreach ($orders as $idx => $orderRow) {
                if (dsa_order_repair_premature_fulfillment($pdo, (int) ($orderRow['id'] ?? 0))) {
                    $orders[$idx]['status'] = 'paid';
                }
            }
    }

    if ($needsCustomers) {
        $customersWhereParts = [];
        $customersParams = [];
        if ($customersQuery !== '') {
            $customersWhereParts[] = "(lower(c.name) like :search or lower(c.email) like :search or lower(ifnull(c.phone,'')) like :search)";
            $customersParams[':search'] = '%' . strtolower($customersQuery) . '%';
        }
        $customersHavingSql = '';
        if ($customersStatus === 'with_orders') {
            $customersHavingSql = ' having count(o.id) > 0';
        } elseif ($customersStatus === 'without_orders') {
            $customersHavingSql = ' having count(o.id) = 0';
        }
        $customersWhereSql = count($customersWhereParts) > 0 ? (' where ' . implode(' and ', $customersWhereParts)) : '';
        $customersOrderSql = ' order by max(c.updated_at) desc, c.id desc';
        if ($customersSort === 'name') {
            $customersOrderSql = ' order by lower(c.name) asc, c.id desc';
        } elseif ($customersSort === 'email') {
            $customersOrderSql = ' order by lower(c.email) asc, c.id desc';
        } elseif ($customersSort === 'orders') {
            $customersOrderSql = ' order by count(o.id) desc, max(c.updated_at) desc, c.id desc';
        }
        $customersStmt = $pdo->prepare(
            "select c.id, c.name, c.email, c.phone, c.created_at, c.updated_at,
                    count(o.id) as order_count,
                    coalesce(sum(o.amount_cents), 0) as total_spend_cents,
                    max(o.created_at) as last_order_at
             from customers c
             left join orders o on o.customer_id = c.id"
            . $customersWhereSql
            . " group by c.id"
            . $customersHavingSql
            . $customersOrderSql
            . " limit 120"
        );
        $customersStmt->execute($customersParams);
        $customers = $customersStmt->fetchAll();
    }

    if ($needsNotifications) {
        $notificationTemplateCatalog = dsa_notification_templates($pdo);
    }

    $recentActivityOrders = [];
    if ($needsDashboardCounts) {
        $catalogCountStmt = $pdo->query("select count(*) from watu_catalog_products");
        $productsCountStmt = $pdo->query("select count(*) from products");
        $ordersCountStmt = $pdo->query("select count(*) from orders");
        $dashboardCatalogCount = (int) ($catalogCountStmt ? $catalogCountStmt->fetchColumn() : 0);
        $dashboardProductsCount = (int) ($productsCountStmt ? $productsCountStmt->fetchColumn() : 0);
        $dashboardOrdersCount = (int) ($ordersCountStmt ? $ordersCountStmt->fetchColumn() : 0);
        $recentActivityStmt = $pdo->query(
            "select o.id, o.status, o.amount_cents, o.currency, o.updated_at, o.customer_email, p.name as product_name
             from orders o join products p on p.id = o.product_id
             order by o.updated_at desc limit 8"
        );
        $recentActivityOrders = $recentActivityStmt ? $recentActivityStmt->fetchAll() : [];
    }

    $focusCustomer = null;
    $focusCustomerOrders = [];
    if ($focusCustomerId > 0) {
        $focusStmt = $pdo->prepare(
            "select c.id, c.name, c.email, c.phone, c.created_at, c.updated_at,
                    count(o.id) as order_count,
                    coalesce(sum(o.amount_cents), 0) as total_spend_cents,
                    max(o.created_at) as last_order_at
             from customers c
             left join orders o on o.customer_id = c.id
             where c.id = :id
             group by c.id
             limit 1"
        );
        $focusStmt->execute([':id' => $focusCustomerId]);
        $focusCustomer = $focusStmt->fetch();
        if ($focusCustomer) {
            $focusOrdersStmt = $pdo->prepare(
                "select o.id, o.status, o.amount_cents, o.currency, o.created_at, o.payment_method, p.name as product_name
                 from orders o
                 join products p on p.id = o.product_id
                 where o.customer_id = :customer_id
                 order by o.id desc
                 limit 20"
            );
            $focusOrdersStmt->execute([':customer_id' => $focusCustomerId]);
            $focusCustomerOrders = $focusOrdersStmt->fetchAll();
        }
    }
    dsa_settings_prefetch($pdo);

    $needsBrandingData = ($section === 'branding');
    $needsPaymentData = ($section === 'payments');
    $needsPayoutData = in_array($section, ['payouts', 'dashboard'], true);
    $needsSyncData = ($section === 'catalog');

    $payInstructions = '';
    $brandTitle = DSA_APP_NAME;
    $brandTagline = DSA_DEFAULT_BRAND_TAGLINE;
    $heroTitle = DSA_DEFAULT_HERO_TITLE;
    $heroSubtitle = DSA_DEFAULT_HERO_SUBTITLE;
    $emailLogoUrl = '';
    $emailPrimaryColor = '#2563eb';
    $siteThemeSetting = 'dark';
    $siteAccentColor = '#2563eb';
    $sitePresetSetting = 'custom';
    $presetDefs = dsa_theme_presets();
    $siteUiTheme = 'store';
    $themeExtStatus = ['elite' => false, 'rebel' => false, 'powerhouse' => false, 'warmth' => false];
    $emailFooterText = '';
    $whiteLabelDomain = '';
    $systemOriginDomain = '';
    $forceWhitelabelDomain = false;
    $whitelabelLastSyncMessage = '';
    $whitelabelLastBackgroundCheckAt = 0;
    $whitelabelPendingDomain = '';
    $whitelabelPendingEnforce = false;
    $whitelabelLastBackgroundText = '';
    $whitelabelLastSync = [];
    $paymentMethodCashEnabled = true;
    $paymentMethodBankEnabled = false;
    $paymentMethodCustomEnabled = false;
    $paymentMethodPaypalEnabled = false;
    $paymentMethodWatuPayEnabled = false;
    $paymentMethodMpesaDirectEnabled = false;
    $paymentBankInstructions = '';
    $paymentCustomLabel = 'Custom Manual';
    $paymentCustomInstructions = '';
    $paymentPaypalLink = '';
    $paymentPaypalBusinessEmail = '';
    $paymentPaypalSandbox = false;
    $paymentWatuPayConsumerKey = '';
    $paymentWatuPayConsumerSecret = '';
    $paymentWatuPayShortcode = '';
    $paymentWatuPayPasskey = '';
    $paymentWatuPayTillNumber = '';
    $paymentWatuPayUseTill = false;
    $paymentWatuPaySandbox = false;
    $watupayPayoutChannel = 'phone';
    $watupayPayoutTarget = '';
    $watupayPayoutTiming = 'manual';
    $watupayPayoutSchedule = '';
    $paymentWatuPayInstructions = '';
    $paymentMpesaDirectLabel = 'Lipa na M-PESA';
    $paymentMpesaDirectInstructions = '';
    $paymentMpesaConsumerKey = '';
    $paymentMpesaConsumerSecret = '';
    $paymentMpesaShortcode = '';
    $paymentMpesaPasskey = '';
    $paymentMpesaTillNumber = '';
    $paymentMpesaUseTill = false;
    $paymentMpesaSandbox = false;
    $paymentCustomMethodsText = '';
    $catalogSyncLastAt = '';
    $catalogSyncApiUrl = '';
    $catalogSyncIdentifier = '';
    $catalogSyncSecret = '';
    $catalogSyncDefaultMarkupPercent = '30';
    $catalogSyncAutoApplyMarkup = true;
    $catalogSyncPullPaymentOptions = true;
    $catalogSyncPreserveStoreOverrides = true;
    $catalogSyncAutoEnabled = false;
    $catalogSyncIntervalMinutes = 60;
    $catalogSyncLastAutoAt = '';
    $catalogSyncLastAutoResult = '';
    $allowCustomProductCreate = true;
    $releaseUpdaterEnabled = false;
    $releaseManifestUrl = '';
    $releaseCurrentVersion = '';
    $releaseLastUpdateAt = '';
    $releaseLastUpdateResult = '';
    $releaseUpdaterToken = '';

    if ($needsPayoutData) {
        // Loaded via dsa_payout_balance_summary in section renderers.
    }

    if ($needsBrandingData) {
        $brandTitle = dsa_setting($pdo, 'brand_title', DSA_APP_NAME);
        $brandTagline = dsa_setting($pdo, 'brand_tagline', DSA_DEFAULT_BRAND_TAGLINE);
        $heroTitle = dsa_setting($pdo, 'hero_title', DSA_DEFAULT_HERO_TITLE);
        $heroSubtitle = dsa_setting($pdo, 'hero_subtitle', DSA_DEFAULT_HERO_SUBTITLE);
        $emailLogoUrl = dsa_brand_logo_url($pdo);
        $emailPrimaryColor = dsa_setting($pdo, 'email_primary_color', '#2563eb');
        if (!preg_match('/^#[0-9a-fA-F]{6}$/', (string) $emailPrimaryColor)) {
            $emailPrimaryColor = '#2563eb';
        }
        $siteThemeSetting = dsa_setting($pdo, 'site_theme', 'dark');
        if (!in_array($siteThemeSetting, ['dark', 'light'], true)) {
            $siteThemeSetting = 'dark';
        }
        $siteAccentColor = dsa_setting($pdo, 'site_accent_color', '#2563eb');
        if (!preg_match('/^#[0-9a-fA-F]{6}$/', (string) $siteAccentColor)) {
            $siteAccentColor = '#2563eb';
        }
        $sitePresetSetting = dsa_setting($pdo, 'site_preset', 'custom');
        if (!isset($presetDefs[$sitePresetSetting])) {
            $sitePresetSetting = 'custom';
        }
        $siteUiTheme = dsa_setting($pdo, 'site_ui_theme', 'store');
        if (!in_array($siteUiTheme, ['store', 'elite', 'rebel', 'powerhouse', 'warmth'], true)) {
            $siteUiTheme = 'store';
        }
        $themeExtStatus = [
            'elite'      => dsa_extension_active($pdo, 'theme_elite'),
            'rebel'      => dsa_extension_active($pdo, 'theme_rebel'),
            'powerhouse' => dsa_extension_active($pdo, 'theme_powerhouse'),
            'warmth'     => dsa_extension_active($pdo, 'theme_warmth'),
        ];
        if ($siteUiTheme !== 'store' && !($themeExtStatus[$siteUiTheme] ?? false)) {
            $siteUiTheme = 'store';
        }
        $emailFooterText = dsa_setting($pdo, 'email_footer_text', '');
        $whiteLabelDomain = dsa_setting($pdo, 'whitelabel_domain', '');
        $systemOriginDomain = dsa_setting($pdo, 'system_origin_domain', '');
        $forceWhitelabelDomain = dsa_setting($pdo, 'force_whitelabel_domain', '0') === '1';
        $whitelabelLastSyncMessage = dsa_setting($pdo, 'whitelabel_last_sync_message', '');
        if (stripos((string) $whitelabelLastSyncMessage, 'cpanel') !== false) {
            $whitelabelLastSyncMessage = 'Domain mapping active. Save or check status to refresh readiness.';
        }
        $whitelabelLastSyncMessage = str_ireplace(
            ['Click Save again shortly to refresh readiness.', 'Click Save again to refresh readiness.'],
            'Readiness checks are auto-refreshing on this page.',
            (string) $whitelabelLastSyncMessage
        );
        $whitelabelLastBackgroundCheckAt = (int) dsa_setting($pdo, 'whitelabel_last_background_check_at', '0');
        $whitelabelPendingDomain = dsa_normalize_domain((string) dsa_setting($pdo, 'whitelabel_pending_domain', ''));
        $whitelabelPendingEnforce = dsa_setting($pdo, 'whitelabel_pending_enforce', '') === '1';
        if ($whitelabelLastBackgroundCheckAt > 0) {
            $ago = max(0, time() - $whitelabelLastBackgroundCheckAt);
            $whitelabelLastBackgroundText = $ago < 60 ? ($ago . 's ago') : (floor($ago / 60) . 'm ago');
        }
        $whitelabelLastSyncRaw = dsa_setting($pdo, 'whitelabel_last_sync_json', '');
        $whitelabelLastSync = json_decode((string) $whitelabelLastSyncRaw, true);
        if (!is_array($whitelabelLastSync)) {
            $whitelabelLastSync = [];
        }
        $syncStatus = is_array($whitelabelLastSync['status'] ?? null) ? (array) ($whitelabelLastSync['status'] ?? []) : [];
    }

    if ($needsPaymentData) {
        $whmcsCredits = dsa_whmcs_credits_local($pdo);
        $creditCurrency = (string) ($whmcsCredits['currency'] ?? 'KES');
        $creditAmountCents = (int) ($whmcsCredits['available_cents'] ?? 0);
        $creditFormatted = dsa_money($creditAmountCents, $creditCurrency);
        $addCreditsUrl = dsa_watu_clientarea_url($pdo, 'clientarea.php?action=addfunds');
        if ($addCreditsUrl === '') {
            $addCreditsUrl = 'https://watutechnology.com/clientarea.php?action=addfunds';
        }

        $storeCurrency = dsa_store_currency($pdo);
        $payInstructions = dsa_setting($pdo, 'pay_instructions', '');
        $paymentMethodOfflinePlatformAllowed = dsa_offline_payment_platform_allowed($pdo);
        $paymentMethodPaypalPlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'paypal');
        $paymentMethodPaypalBasicPlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'paypal_basic');
        $paymentMethodPaypalCheckoutPlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'paypal_checkout');
        $paymentMethodWatuPayPlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'watupay_mpesa');
        $paymentMethodMpesaDirectPlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'mpesa_direct');
        $paymentMethodOfflineEnabled = $paymentMethodOfflinePlatformAllowed && dsa_offline_payment_tenant_enabled($pdo);
        $paymentMethodPaypalEnabled = $paymentMethodPaypalPlatformAllowed && dsa_setting($pdo, 'payment_method_paypal_enabled', '0') === '1';
        
        $rawBasic = dsa_setting($pdo, 'payment_method_paypal_basic_enabled', '');
        if ($rawBasic === '') {
            $rawBasic = dsa_setting($pdo, 'payment_method_paypal_enabled', '0');
        }
        $rawCheckout = dsa_setting($pdo, 'payment_method_paypal_checkout_enabled', '');
        if ($rawCheckout === '') {
            $rawCheckout = dsa_setting($pdo, 'payment_method_paypal_enabled', '0');
        }
        $paymentMethodPaypalBasicEnabled = $paymentMethodPaypalBasicPlatformAllowed && $rawBasic === '1';
        $paymentMethodPaypalCheckoutEnabled = $paymentMethodPaypalCheckoutPlatformAllowed && $rawCheckout === '1';
        $paymentMethodWatuPayEnabled = $paymentMethodWatuPayPlatformAllowed && dsa_setting($pdo, 'payment_method_watupay_mpesa_enabled', '0') === '1';
        $paymentMethodMpesaDirectEnabled = $paymentMethodMpesaDirectPlatformAllowed && dsa_setting($pdo, 'payment_method_mpesa_direct_enabled', '0') === '1';
        $paymentBankInstructions = dsa_setting($pdo, 'payment_bank_instructions', '');
        $paymentCustomLabel = dsa_setting($pdo, 'payment_custom_label', 'Custom Manual');
        $paymentCustomInstructions = dsa_setting($pdo, 'payment_custom_instructions', '');
        $paymentPaypalLink = dsa_setting($pdo, 'payment_paypal_link', '');
        $paymentPaypalBusinessEmail = dsa_setting($pdo, 'payment_paypal_business_email', '');
        $paymentPaypalClientId = dsa_setting($pdo, 'payment_paypal_client_id', '');
        $paymentPaypalClientSecret = dsa_setting($pdo, 'payment_paypal_client_secret', '');
        $paymentPaypalSandbox = dsa_setting($pdo, 'payment_paypal_sandbox', '0') === '1';

        $paymentMethodStripePlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'stripe');
        $paymentMethodPaystackPlatformAllowed = dsa_platform_payment_method_allowed($pdo, 'paystack');
        $paymentMethodStripeEnabled = $paymentMethodStripePlatformAllowed && dsa_setting($pdo, 'payment_method_stripe_enabled', '0') === '1';
        $paymentMethodPaystackEnabled = $paymentMethodPaystackPlatformAllowed && dsa_setting($pdo, 'payment_method_paystack_enabled', '0') === '1';
        
        $paymentStripeLink = dsa_setting($pdo, 'payment_stripe_link', '');
        $paymentStripePublishableKey = dsa_setting($pdo, 'payment_stripe_publishable_key', '');
        $paymentStripeSecretKey = dsa_setting($pdo, 'payment_stripe_secret_key', '');
        $paymentStripeWebhookSecret = dsa_setting($pdo, 'payment_stripe_webhook_secret', '');
        $paymentStripeSandbox = dsa_setting($pdo, 'payment_stripe_sandbox', '0') === '1';

        $paymentPaystackLink = dsa_setting($pdo, 'payment_paystack_link', '');
        $paymentPaystackPublicKey = dsa_setting($pdo, 'payment_paystack_public_key', '');
        $paymentPaystackSecretKey = dsa_setting($pdo, 'payment_paystack_secret_key', '');
        $paymentPaystackSandbox = dsa_setting($pdo, 'payment_paystack_sandbox', '0') === '1';
        $paymentWatuPayConsumerKey = dsa_setting($pdo, 'payment_watupay_consumer_key', '');
        $paymentWatuPayConsumerSecret = dsa_setting($pdo, 'payment_watupay_consumer_secret', '');
        $paymentWatuPayShortcode = dsa_setting($pdo, 'payment_watupay_shortcode', '');
        $paymentWatuPayPasskey = dsa_setting($pdo, 'payment_watupay_passkey', '');
        $paymentWatuPayTillNumber = dsa_setting($pdo, 'payment_watupay_till_number', '');
        $paymentWatuPayUseTill = dsa_setting($pdo, 'payment_watupay_use_till', '0') === '1';
        $paymentWatuPaySandbox = dsa_setting($pdo, 'payment_watupay_sandbox', '0') === '1';
        $paymentWatuPayInstructions = dsa_setting($pdo, 'payment_watupay_instructions', '');
        $paymentMpesaDirectLabel = dsa_setting($pdo, 'payment_mpesa_direct_label', 'Lipa na M-PESA');
        $paymentMpesaDirectInstructions = dsa_setting($pdo, 'payment_mpesa_direct_instructions', '');
        $paymentMpesaConsumerKey = dsa_setting($pdo, 'payment_mpesa_consumer_key', '');
        $paymentMpesaConsumerSecret = dsa_setting($pdo, 'payment_mpesa_consumer_secret', '');
        $paymentMpesaShortcode = dsa_setting($pdo, 'payment_mpesa_shortcode', '');
        $paymentMpesaPasskey = dsa_setting($pdo, 'payment_mpesa_passkey', '');
        $paymentMpesaTillNumber = dsa_setting($pdo, 'payment_mpesa_till_number', '');
        $paymentMpesaUseTill = dsa_setting($pdo, 'payment_mpesa_use_till', '0') === '1';
        $paymentMpesaSandbox = dsa_setting($pdo, 'payment_mpesa_sandbox', '0') === '1';
        $rawCustomMethods = trim(dsa_setting($pdo, 'payment_custom_methods_json', '[]'));
        $parsedCustomMethods = json_decode($rawCustomMethods, true);
        if (is_array($parsedCustomMethods)) {
            $lines = [];
            foreach ($parsedCustomMethods as $row) {
                if (!is_array($row)) {
                    continue;
                }
                $label = trim((string) ($row['label'] ?? ''));
                if ($label === '') {
                    continue;
                }
                $instructions = trim((string) ($row['instructions'] ?? ''));
                $lines[] = $instructions !== '' ? ($label . '|' . $instructions) : $label;
            }
            $paymentCustomMethodsText = implode("\n", $lines);
        }
    }

    if ($needsSyncData) {
        $catalogSyncDefaultMarkupPercent = dsa_setting($pdo, 'catalog_sync_default_markup_percent', '30');
        $allowCustomProductCreate = dsa_setting($pdo, 'allow_custom_product_create', '1') === '1';
    }

    $html = '<div class="card"><h1>Admin Dashboard</h1><p class="muted">Signed in as ' . dsa_h((string) ($_SESSION['dsa_admin_username'] ?? '')) . ' | <a href="/admin/logout">Logout</a></p>';
    if ($notice !== '') {
        if (strpos($notice, '<') !== false && strpos($notice, '>') !== false) {
            $html .= '<p class="notice">' . strip_tags($notice, '<a><strong><br><em><b><i><p>') . '</p>';
        } else {
            $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
        }
    }
    $html .= '<div class="section-tabs">'
        . '<a class="btn-secondary" href="/admin?section=dashboard">Dashboard</a>'
        . '<a class="btn-secondary" href="/admin?section=catalog">Catalog</a>'
        . '<a class="btn-secondary" href="/admin?section=custom-services">Custom Services</a>'
        . '<a class="btn-secondary" href="/admin?section=orders&filter=' . rawurlencode($filter) . '">Orders</a>'
        . '<a class="btn-secondary" href="/admin?section=customers">Customers</a>'
        . '<a class="btn-secondary" href="/admin?section=support">Support</a>'
        . '<a class="btn-secondary" href="/admin?section=notifications">Notifications</a>'
        . '<a class="btn-secondary" href="/admin?section=payments">Payment methods</a>'
        . '<a class="btn-secondary" href="/admin?section=branding">Branding</a>'
        . '<a class="btn-secondary" href="/admin?section=analytics">Analytics</a>'
        . '<a class="btn-secondary" href="/admin?section=settings">Settings</a>'
        . '</div>';
    $html .= '</div>';

    if ($section === 'dashboard') {
        $html .= '<div class="card"><h2>Overview</h2><div class="kpi-grid">'
            . '<div class="kpi"><strong>' . dsa_h((string) $dashboardCatalogCount) . '</strong><span class="muted">Catalog products</span></div>'
            . '<div class="kpi"><strong>' . dsa_h((string) $dashboardProductsCount) . '</strong><span class="muted">Store products</span></div>'
            . '<div class="kpi"><strong>' . dsa_h((string) $dashboardOrdersCount) . '</strong><span class="muted">Total orders</span></div>'
            . '</div></div>';
        if (count($recentActivityOrders) > 0) {
            $html .= '<div class="card"><h2>Recent Activity</h2>';
            $html .= '<div class="table-wrap"><table><thead><tr><th>Order</th><th>Product</th><th>Customer</th><th>Amount</th><th>Status</th><th>Updated</th></tr></thead><tbody>';
            foreach ($recentActivityOrders as $ra) {
                $raStatus = (string) ($ra['status'] ?? 'pending_payment');
                $html .= '<tr class="row-' . dsa_h(preg_replace('/[^a-z0-9_-]/', '', strtolower($raStatus))) . '">'
                    . '<td><a href="/admin?section=orders&orders_q=' . urlencode((string) $ra['id']) . '">#' . dsa_h((string) $ra['id']) . '</a></td>'
                    . '<td>' . dsa_h((string) ($ra['product_name'] ?? '')) . '</td>'
                    . '<td><span class="muted">' . dsa_h((string) ($ra['customer_email'] ?? '')) . '</span></td>'
                    . '<td>' . dsa_h(dsa_money((int) ($ra['amount_cents'] ?? 0), (string) ($ra['currency'] ?? DSA_DEFAULT_CURRENCY))) . '</td>'
                    . '<td>' . dsa_status_pill($raStatus) . '</td>'
                    . '<td><span class="muted" style="font-size:12px;">' . dsa_h((string) ($ra['updated_at'] ?? '')) . '</span></td>'
                    . '</tr>';
            }
            $html .= '</tbody></table></div></div>';
        }
        $html .= dsa_admin_payout_summary_card_html($pdo);
    }

    if ($section === 'branding') {
        $html .= '<div class="card"><h2>Branding &amp; Domain</h2>'
            . '<p class="muted" style="margin-bottom:18px;">Customize your storefront identity, logos, and custom domain mapping below.</p>';

        $html .= '<div class="brand-tabs-header">'
            . '<button type="button" class="brand-tab-btn active" data-brandtab="brandpane-theme" onclick="switchBrandTab(\'brandpane-theme\')">🎨 Theme &amp; Copy</button>'
            . '<button type="button" class="brand-tab-btn" data-brandtab="brandpane-logo" onclick="switchBrandTab(\'brandpane-logo\')">🏢 Logo &amp; Email</button>'
            . '<button type="button" class="brand-tab-btn" data-brandtab="brandpane-whitelabel" onclick="switchBrandTab(\'brandpane-whitelabel\')">🏷️ White Label</button>'
            . '<button type="button" class="brand-tab-btn" data-brandtab="brandpane-domain" onclick="switchBrandTab(\'brandpane-domain\')">🌐 Custom Domain</button>'
            . '</div>';

        $html .= '<style>'
            . '.brand-tabs-header { display: flex; gap: 8px; margin-bottom: 24px; border-bottom: 1px solid var(--border); padding-bottom: 12px; flex-wrap: wrap; }'
            . '.brand-tab-btn { background: var(--btn-sec-bg); color: var(--text-muted); border: 1px solid var(--border); padding: 8px 16px; border-radius: 999px; font-size: 13px; cursor: pointer; font-weight: 500; transition: all 0.15s ease; }'
            . '.brand-tab-btn:hover { color: var(--text); border-color: var(--border-inp); }'
            . '.brand-tab-btn.active { background: var(--accent); color: #fff; border-color: var(--accent); font-weight: 600; }'
            . '.brand-tab-pane { display: none; }'
            . '.brand-tab-pane.active { display: block; }'
            . '</style>';

        $html .= '<form method="post" action="/admin/branding" enctype="multipart/form-data"><input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';

        // Pane 1: Theme & Copy
        $html .= '<div id="brandpane-theme" class="brand-tab-pane active">';
        $html .= '<h3 style="margin-bottom:4px;">Storefront Theme &amp; Copy</h3>';
        $html .= '<p class="muted" style="margin-bottom:16px;">Configure your store name, tagline copy, and pick your active storefront design theme system.</p>';

        $html .= '<label>Brand Title</label><input name="brand_title" value="' . dsa_h($brandTitle) . '" maxlength="120">';
        $html .= '<p class="muted" style="margin:4px 0 14px 0;">Store name in the header and emails.</p>';
        $html .= '<h4 style="margin:16px 0 4px 0;font-size:14px;color:var(--text-h2);">Homepage Hero Copy</h4>';
        $html .= '<p class="muted" style="margin:0 0 12px 0;">Text above the Browse Products / View Services buttons. Lead with premium digital products and professional services — not hosting or domains first.</p>';
        $html .= '<label>Tagline (pill)</label><input name="brand_tagline" value="' . dsa_h($brandTagline) . '" maxlength="160">';
        $html .= '<label style="margin-top:12px;">Headline</label><input name="hero_title" value="' . dsa_h($heroTitle) . '" maxlength="200">';
        $html .= '<label style="margin-top:12px;">Supporting text</label><textarea name="hero_subtitle" rows="4" maxlength="600" style="width:100%;box-sizing:border-box;">' . dsa_h($heroSubtitle) . '</textarea>';

        // Store Theme picker
        $html .= '<hr style="border:none;border-top:1px solid var(--border);margin:18px 0 14px 0;">';
        $html .= '<h4 style="margin:0 0 4px 0;font-size:14px;color:var(--text-h2);">Store Theme</h4>';
        $html .= '<p class="muted" style="margin:0 0 14px 0;">Choose a complete visual identity for your store. Paid themes require an active extension — locked themes show a purchase link.</p>';

        $uiThemeCards = [
            'store'      => ['label' => 'The Store',      'desc' => 'Clean, modern, professional. Always free.',    'accent' => '#2563eb', 'bg' => '#0b1020', 'textc' => '#e5e7eb'],
            'elite'      => ['label' => 'The Elite',       'desc' => 'Luxury editorial. Playfair Display. Gold.',    'accent' => '#c9a84c', 'bg' => '#0a0a0a', 'textc' => '#f5f5f0'],
            'rebel'      => ['label' => 'The Rebel',       'desc' => 'Bold studio. Space Grotesk. Purple.',          'accent' => '#7c3aed', 'bg' => '#ffffff', 'textc' => '#111111'],
            'powerhouse' => ['label' => 'The Powerhouse',  'desc' => 'Dev-first. JetBrains Mono. Cyan.',            'accent' => '#00d4aa', 'bg' => '#0d1117', 'textc' => '#e6edf3'],
            'warmth'     => ['label' => 'The Warmth',      'desc' => 'Boutique. Plus Jakarta Sans. Amber.',         'accent' => '#d97706', 'bg' => '#faf8f5', 'textc' => '#2c2416'],
        ];
        $html .= '<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(180px,1fr));gap:10px;margin-bottom:8px;">';
        foreach ($uiThemeCards as $thKey => $th) {
            $isFree = ($thKey === 'store');
            $isUnlocked = $isFree || ($themeExtStatus[$thKey] ?? false);
            $isActive = ($siteUiTheme === $thKey);
            $borderCol = $isActive ? 'var(--accent)' : 'var(--border)';
            $cardStyle = 'border:2px solid ' . $borderCol . ';border-radius:10px;overflow:hidden;'
                . ($isUnlocked ? 'cursor:pointer;' : 'cursor:default;opacity:.65;')
                . 'transition:border-color .2s;user-select:none;';
            $lockedAttr = $isUnlocked ? '' : ' data-locked="1" data-theme-name="' . dsa_h($th['label']) . '"';
            $html .= '<div class="ui-theme-card' . ($isActive ? ' preset-active' : '') . '"'
                . ' data-theme-key="' . dsa_h($thKey) . '"' . $lockedAttr
                . ' style="' . dsa_h($cardStyle) . '">';
            // Swatch
            $html .= '<div style="height:56px;background:' . dsa_h($th['bg']) . ';display:flex;align-items:center;padding:0 12px;gap:8px;position:relative;">';
            $html .= '<div style="width:10px;height:10px;border-radius:2px;background:' . dsa_h($th['accent']) . ';flex-shrink:0;"></div>';
            $html .= '<div style="height:3px;flex:1;border-radius:2px;background:' . dsa_h($th['accent']) . '33;"></div>';
            $html .= '<div style="padding:3px 8px;border-radius:4px;background:' . dsa_h($th['accent']) . ';color:' . ($th['bg'] === '#ffffff' ? '#111111' : '#ffffff') . ';font-size:10px;font-weight:700;white-space:nowrap;">Buy</div>';
            if (!$isUnlocked) {
                $html .= '<div style="position:absolute;inset:0;background:rgba(0,0,0,0.35);display:flex;align-items:center;justify-content:center;font-size:20px;">&#128274;</div>';
            }
            $html .= '</div>';
            // Info
            $html .= '<div style="padding:10px 12px;">';
            $html .= '<strong style="display:block;font-size:13px;font-weight:600;color:var(--text-h2);">' . dsa_h($th['label']) . '</strong>';
            $html .= '<span style="font-size:11px;color:var(--text-muted);">' . dsa_h($th['desc']) . '</span>';
            if (!$isFree && !$isUnlocked) {
                $html .= '<div style="margin-top:6px;font-size:11px;color:var(--accent);">Purchase ' . dsa_h($th['label']) . ' to unlock</div>';
            }
            $html .= '</div>';
            if ($isUnlocked) {
                $html .= '<input type="radio" name="site_ui_theme" value="' . dsa_h($thKey) . '"' . ($isActive ? ' checked' : '') . ' style="display:none;">';
            }
            $html .= '</div>';
        }
        $html .= '</div>';
        // Theme picker JS
        $html .= '<script>(function(){'
            . 'var cards=document.querySelectorAll(".ui-theme-card[data-theme-key]");'
            . 'cards.forEach(function(card){'
            .   'if(card.getAttribute("data-locked")){return;}'
            .   'card.addEventListener("click",function(){'
            .     'cards.forEach(function(c){c.style.borderColor="var(--border)";c.classList.remove("preset-active");});'
            .     'card.style.borderColor="var(--accent)";'
            .     'card.classList.add("preset-active");'
            .     'var radio=card.querySelector("input[type=radio]");'
            .     'if(radio){radio.checked=true;}'
            .     'var key=card.getAttribute("data-theme-key");'
            .     'var appearSection=document.getElementById("store-appearance-section");'
            .     'if(appearSection){appearSection.style.display=(key==="store")?"":"none";}'
            .   '});'
            . '});'
            . '})();</script>';

        // Site appearance
        $appearDisplay = ($siteUiTheme === 'store') ? '' : 'display:none;';
        $html .= '<div id="store-appearance-section" style="' . $appearDisplay . '">';
        $html .= '<hr style="border:none;border-top:1px solid var(--border);margin:18px 0 14px 0;">';
        $html .= '<h4 style="margin-bottom:12px;font-size:14px;color:var(--text-h2);">Store Appearance</h4>';
        $html .= '<p class="muted" style="margin:0 0 10px 0;">These controls apply to The Store theme only. Paid themes have fixed palettes.</p>';
        $html .= '<label>Color Theme</label>';
        $html .= '<div style="display:flex;gap:12px;margin-bottom:4px;">';
        $darkChecked  = $siteThemeSetting === 'dark'  ? ' checked' : '';
        $lightChecked = $siteThemeSetting === 'light' ? ' checked' : '';
        $html .= '<label style="display:flex;align-items:center;gap:6px;cursor:pointer;margin:0;color:var(--text);">'
            . '<input type="radio" name="site_theme" value="dark"' . $darkChecked . ' style="width:auto;"> Dark</label>';
        $html .= '<label style="display:flex;align-items:center;gap:6px;cursor:pointer;margin:0;color:var(--text);">'
            . '<input type="radio" name="site_theme" value="light"' . $lightChecked . ' style="width:auto;"> Light</label>';
        $html .= '</div>';
        $html .= '<p class="muted" style="margin:2px 0 10px 0;">Controls the background and text colors for all pages of your store.</p>';
        $html .= '<label>Store Accent Color <span class="muted" style="font-weight:400;">(buttons, badges, active links)</span></label>';
        $html .= '<div style="display:flex;align-items:center;gap:10px;margin-bottom:4px;">';
        $html .= '<input type="color" id="site_accent_color_input" name="site_accent_color" value="' . dsa_h($siteAccentColor) . '" style="width:60px;height:42px;padding:4px;cursor:pointer;">';
        $html .= '<span id="accent-preview-btn" style="display:inline-block;padding:8px 16px;border-radius:10px;background:' . dsa_h($siteAccentColor) . ';color:#fff;font-size:13px;font-weight:600;transition:background .15s;">Preview Button</span>';
        $html .= '<span id="accent-preview-badge" style="display:inline-flex;align-items:center;justify-content:center;min-width:18px;height:18px;padding:0 6px;border-radius:999px;background:' . dsa_h($siteAccentColor) . ';color:#fff;font-size:11px;font-weight:700;">3</span>';
        $html .= '</div>';
        $html .= '<script>(function(){'
            . 'var inp=document.getElementById("site_accent_color_input");'
            . 'var btn=document.getElementById("accent-preview-btn");'
            . 'var badge=document.getElementById("accent-preview-badge");'
            . 'if(!inp||!btn||!badge)return;'
            . 'inp.addEventListener("input",function(){'
            . '  btn.style.background=inp.value;'
            . '  badge.style.background=inp.value;'
            . '});'
            . '})();</script>';
        $html .= '</div>'; // end #store-appearance-section

        $html .= '<div style="margin-top:18px;padding-top:14px;border-top:1px solid var(--border);"><button id="branding-save-btn-1" class="btn" type="submit">Save Settings</button></div>';
        $html .= '</div>'; // end Pane 1

        // Pane 2: Logo & Email
        $html .= '<div id="brandpane-logo" class="brand-tab-pane">';
        $html .= '<h3 style="margin-bottom:4px;">Logo &amp; Email Customization</h3>';
        $html .= '<p class="muted" style="margin-bottom:16px;">Upload your high-resolution store logo and brand your transaction email templates.</p>';

        if ($emailLogoUrl !== '') {
            $html .= '<p class="muted" style="margin:8px 0 4px 0;">Current Logo</p>';
            $html .= '<img src="' . dsa_h((string) $emailLogoUrl) . '" alt="Current logo" style="max-width:180px;max-height:80px;display:block;margin-bottom:8px;border:1px solid var(--border);border-radius:8px;padding:4px;background:var(--bg-surface);">';
        }
        $html .= '<label>Logo Upload (optional)</label><input type="file" name="email_logo_file" accept=".png,.jpg,.jpeg,.webp,.gif,.svg">';
        if ($emailLogoUrl !== '') {
            $html .= '<label style="margin-top:8px;display:flex;align-items:center;gap:8px;"><input type="checkbox" name="remove_email_logo" value="1" style="width:auto;"> Remove current logo</label>';
        }
        $html .= '<label style="margin-top:12px;">Email Accent Color <span class="muted" style="font-weight:400;">(used in email templates only)</span></label><input type="color" name="email_primary_color" value="' . dsa_h($emailPrimaryColor) . '" style="max-width:120px;height:42px;padding:4px;">';
        $html .= '<label style="margin-top:12px;">Email Footer Text</label><textarea name="email_footer_text" rows="2">' . dsa_h($emailFooterText) . '</textarea>';
        $html .= '<div style="margin-top:18px;padding-top:14px;border-top:1px solid var(--border);"><button id="branding-save-btn-2" class="btn" type="submit">Save Settings</button></div>';
        $html .= '</div>'; // end Pane 2

        $html .= '</form>'; // end the multipart form!

        $whiteLabelEnabled = dsa_white_label_enabled($pdo);
        $tierUpgradeUrl = dsa_tier_upgrade_url($pdo);

        // Pane 3: White Label
        $html .= '<div id="brandpane-whitelabel" class="brand-tab-pane">';
        $html .= '<h3 style="margin-bottom:4px;">White Label Settings</h3>';
        $html .= '<p class="muted" style="margin-bottom:16px;">Remove the "Powered by Watu Technology" branding footer from your storefront customer portal and checkout pages.</p>';

        if ($whiteLabelEnabled) {
            $html .= '<div style="display:inline-flex;align-items:center;gap:6px;background:rgba(22,101,52,0.1);border:1px solid #16a34a;color:#22c55e;padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;margin-bottom:12px;">'
                . '<span>🟢 Active (Branding Hidden)</span>'
                . '</div>';
            $html .= '<p class="muted">Your store is running with clean white-label templates. No Watu branding is shown to your shoppers.</p>';
        } else {
            $html .= '<div style="display:inline-flex;align-items:center;gap:6px;background:rgba(255,255,255,0.02);border:1px solid var(--border);color:var(--text-muted);padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;margin-bottom:12px;">'
                . '<span>🔒 Locked (Powered by Watu Active)</span>'
                . '</div>';
            $html .= '<p class="muted">Your storefront footer displays "Powered by Watu Technology". Upgrading your pricing plan unlocks seamless white-label custom themes.</p>';
            $html .= '<p style="margin-top:14px;"><a class="btn" href="' . dsa_h($tierUpgradeUrl) . '" target="_blank" rel="noopener">Upgrade to Unlock White Label</a></p>';
        }
        $html .= '</div>'; // end Pane 3

        $customDomainEnabled = dsa_custom_storefront_domain_enabled($pdo);
        $demoWhitelabelLocked = dsa_demo_mode_active($pdo);
        $customDomainLocked = $demoWhitelabelLocked || !$customDomainEnabled;

        // Pane 4: Custom Domain
        $html .= '<div id="brandpane-domain" class="brand-tab-pane">';
        $html .= '<h3 style="margin-bottom:4px;">Custom Domain Mapping</h3>';
        $html .= '<p class="muted" style="margin-bottom:16px;">Brand your entire checkout URL by mapping your custom subdomain (e.g., <code>store.yourbrand.com</code>) directly to your tenant store instance.</p>';

        if ($customDomainEnabled && !$demoWhitelabelLocked) {
            $html .= '<div style="display:inline-flex;align-items:center;gap:6px;background:rgba(22,101,52,0.1);border:1px solid #16a34a;color:#22c55e;padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;margin-bottom:12px;">'
                . '<span>🟢 Enabled on Your Plan</span>'
                . '</div>';
        } else {
            $html .= '<div style="display:inline-flex;align-items:center;gap:6px;background:rgba(255,255,255,0.02);border:1px solid var(--border);color:var(--text-muted);padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;margin-bottom:12px;">'
                . '<span>🔒 Feature Locked</span>'
                . '</div>';
            if (!$customDomainEnabled) {
                $html .= '<p class="muted" style="margin-bottom:12px;">Custom subdomain mapping is included on the <strong>Pro</strong> tier plan. Upgrade to map your own web address.</p>';
                $html .= '<p style="margin-bottom:16px;"><a class="btn" href="' . dsa_h($tierUpgradeUrl) . '" target="_blank" rel="noopener">Upgrade Plan</a></p>';
            } else if ($demoWhitelabelLocked) {
                $html .= '<p class="muted" style="margin-bottom:14px;">Custom domain configuration is locked on this demo store environment.</p>';
            }
        }

        $html .= '<form method="post" action="/admin/branding/whitelabel"><input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $whitelabelDomainInputAttrs = $customDomainLocked ? ' readonly disabled' : '';
        $forceWhitelabelInputAttrs = ($forceWhitelabelDomain ? ' checked' : '') . ($customDomainLocked ? ' disabled' : '');
        
        $html .= '<label>Custom Domain Name</label><input name="whitelabel_domain" value="' . dsa_h($whiteLabelDomain) . '" placeholder="store.yourcompany.com"' . $whitelabelDomainInputAttrs . '>';
        $html .= '<label style="display:flex;align-items:center;gap:8px;margin-top:12px;"><input type="checkbox" name="force_whitelabel_domain" value="1" style="width:auto;"' . $forceWhitelabelInputAttrs . '> Force browser traffic to white-label domain</label>';
        $html .= '<p class="muted" style="margin:4px 0 14px 0;">Automatically redirects shoppers to your custom domain once the DNS records are validated and SSL certificate is issued.</p>';
        
        $html .= '<label style="margin-top:12px;">' . dsa_h(dsa_ui_label('branding.origin_domain_label')) . '</label>';
        $html .= '<div style="padding:10px 12px;border:1px solid #334155;border-radius:10px;background:#0f172a;color:#94a3b8;font-family:monospace;font-size:13px;margin-bottom:14px;">'
            . dsa_h($systemOriginDomain !== '' ? $systemOriginDomain : 'Not set')
            . '</div>';
            
        $html .= '<div style="margin-top:14px;display:flex;gap:8px;flex-wrap:wrap;align-items:center;">';
        if ($customDomainLocked) {
            $html .= '<button id="whitelabel-save-btn" class="btn" type="submit" disabled>Save &amp; Apply Domain</button>';
        } else {
            $html .= '<button id="whitelabel-save-btn" class="btn" type="submit">Save &amp; Apply Domain</button>';
        }
        $html .= '<button id="whitelabel-check-btn" class="btn-secondary" type="button"' . ($customDomainLocked ? ' disabled' : '') . '>Check Status</button>';
        $html .= '</div></form>';
        
        $html .= '<script>(function(){var btn=document.getElementById("whitelabel-check-btn");if(!btn){return;}btn.addEventListener("click",function(){btn.disabled=true;btn.textContent="Checking...";var csrf=' . json_encode(dsa_csrf_token()) . ';fetch("/admin/branding/whitelabel-status",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","Accept":"application/json"},body:"csrf="+encodeURIComponent(csrf),credentials:"same-origin"}).then(function(){window.location.reload();}).catch(function(){btn.disabled=false;btn.textContent="Check Status";});});})();</script>';

        if (count($syncStatus) > 0) {
            $mappingOk = !empty($syncStatus['mapping_ok']);
            $dnsOk = !empty($syncStatus['dns_ok']);
            $sslOk = !empty($syncStatus['ssl_ok']);
            $mappingState = $mappingOk ? 'OK' : 'Pending';
            $dnsState = $dnsOk ? 'OK' : 'Pending';
            $sslState = $sslOk ? 'OK' : 'Pending';
            $domainStatusValue = trim((string) ($syncStatus['domain'] ?? $whiteLabelDomain));
            $cnameTargetValue = trim((string) ($syncStatus['cname_target'] ?? ''));
            $expectedIpValue = trim((string) ($syncStatus['expected_ip'] ?? ''));
            $isEnforceMode = !empty($syncStatus['enforce']);
            $isReady = !empty($syncStatus['ready']);
            $redirectState = 'OFF';
            $redirectNote = 'Redirect is disabled. Both domains can be used.';
            if ($isEnforceMode && $isReady) {
                $redirectState = 'ACTIVE';
                $redirectNote = 'Redirect is active. Browser traffic is forced to the white-label domain.';
            } elseif ($isEnforceMode) {
                $redirectState = 'ARMED';
                $redirectNote = 'Redirect is armed and waiting for readiness checks to complete.';
            }
            $html .= '<div style="margin-top:14px;padding:12px;border:1px solid #334155;border-radius:10px;background:#0f172a;">';
            $html .= '<p class="muted" style="margin:0 0 6px 0;"><strong>White-label readiness status</strong></p>';
            $html .= '<p class="muted" style="margin:0;">Mapping: ' . dsa_h($mappingState) . ' | DNS: ' . dsa_h($dnsState) . ' | SSL: ' . dsa_h($sslState) . '</p>';
            $html .= '<p class="muted" style="margin:6px 0 0 0;">Redirect mode: <strong>' . dsa_h($redirectState) . '</strong> - ' . dsa_h($redirectNote) . '</p>';
            if ($isEnforceMode && !$isReady) {
                $progressParts = [
                    $mappingOk ? 'Binding done' : 'Binding pending',
                    $dnsOk ? 'DNS done' : 'DNS pending',
                    $sslOk ? 'SSL done' : 'SSL pending',
                ];
                $html .= '<p class="muted" style="margin:6px 0 0 0;">Progress: ' . dsa_h(implode(' -> ', $progressParts)) . '</p>';
            }
            if ($whitelabelLastSyncMessage !== '') {
                $html .= '<p class="muted" style="margin:6px 0 0 0;">Latest check: ' . dsa_h(dsa_ui_normalize_legacy_message((string) $whitelabelLastSyncMessage)) . '</p>';
            }
            if ($isEnforceMode && $domainStatusValue !== '') {
                $html .= '<div style="margin-top:10px;padding:10px;border:1px solid #334155;border-radius:10px;background:#111827;">';
                $html .= '<p class="muted" style="margin:0 0 6px 0;"><strong>How to complete setup</strong></p>';
                $html .= '<ol style="margin:0 0 0 18px;padding:0;">';
                if ($cnameTargetValue !== '') {
                    $html .= '<li class="muted">Create/update a <strong>CNAME</strong> from <code>' . dsa_h($domainStatusValue) . '</code> to <code>' . dsa_h($cnameTargetValue) . '</code>.</li>';
                } elseif ($expectedIpValue !== '') {
                    $html .= '<li class="muted">Create/update an <strong>A</strong> record for <code>' . dsa_h($domainStatusValue) . '</code> to <code>' . dsa_h($expectedIpValue) . '</code>.</li>';
                } else {
                    $html .= '<li class="muted">Create/update an <strong>A</strong> record for <code>' . dsa_h($domainStatusValue) . '</code> to your tenant server IP.</li>';
                }
                $html .= '<li class="muted">Wait for DNS propagation, then click <strong>Check Status</strong> or save again.</li>';
                $html .= '</ol></div>';
            }
            $html .= '</div>';
        }
        $html .= '</div>'; // end Pane 4

        // Tabs javascript logic
        $html .= '<script>(function(){'
            . 'window.switchBrandTab = function(paneId) {'
            . '  document.querySelectorAll(".brand-tab-pane").forEach(function(el){ el.style.display="none"; el.classList.remove("active"); });'
            . '  document.querySelectorAll(".brand-tab-btn").forEach(function(el){ el.classList.remove("active"); });'
            . '  var target=document.getElementById(paneId);'
            . '  if(target){ target.style.display="block"; target.classList.add("active"); }'
            . '  var btn=document.querySelector(\'[data-brandtab="\' + paneId + \'"]\');'
            . '  if(btn) btn.classList.add("active");'
            . '  localStorage.setItem("dsa_active_brand_tab", paneId);'
            . '};'
            . 'var form=document.querySelector(\'form[action="/admin/branding"]\');'
            . 'if(form){'
            . '  form.addEventListener("submit", function(){'
            . '    var btn1=document.getElementById("branding-save-btn-1");'
            . '    var btn2=document.getElementById("branding-save-btn-2");'
            . '    if(btn1){ btn1.disabled=true; btn1.textContent="Saving..."; }'
            . '    if(btn2){ btn2.disabled=true; btn2.textContent="Saving..."; }'
            . '  });'
            . '}'
            . 'var savedBrandTab = localStorage.getItem("dsa_active_brand_tab") || "brandpane-theme";'
            . 'switchBrandTab(savedBrandTab);'
            . '})();</script>';

        $html .= '</div>'; // closes the outer card!
    }

    if ($section === 'settings') {
        $visibleAdmins = dsa_admin_users_visible($pdo);
        $isSuperadmin = dsa_admin_is_superadmin($pdo);
        $html .= '<div class="card"><h2>Admin users</h2>';
        if ($isSuperadmin) {
            $html .= '<p class="muted">You are the superadmin. Demo admins can browse the store admin but cannot change catalog, orders, or settings. Other admins cannot see each other.</p>';
            if (count($visibleAdmins) > 0) {
                $html .= '<div class="table-wrap" style="margin-top:12px;"><table><thead><tr><th>Username</th><th>Email</th><th>Role</th><th>Added</th></tr></thead><tbody>';
                foreach ($visibleAdmins as $adminRow) {
                    $html .= '<tr><td>' . dsa_h((string) ($adminRow['username'] ?? '')) . '</td>'
                        . '<td>' . dsa_h((string) ($adminRow['email'] ?? '')) . '</td>'
                        . '<td>' . dsa_h((string) ($adminRow['role'] ?? DSA_ADMIN_ROLE_ADMIN)) . '</td>'
                        . '<td>' . dsa_h((string) ($adminRow['created_at'] ?? '')) . '</td></tr>';
                }
                $html .= '</tbody></table></div>';
            }
            if (dsa_multiple_admins_tier_allowed($pdo)) {
                $html .= '<form method="post" action="/admin/users/create" style="margin-top:16px;">'
                    . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                    . '<label>Email for new admin</label>'
                    . '<input type="email" name="email" required placeholder="name@company.com">'
                    . '<p class="muted" style="margin-top:8px;">We generate a username and one-time password. In demo mode, catalog and settings stay read-only for all admins.</p>'
                    . '<div style="margin-top:8px"><button class="btn" type="submit">Add admin</button></div>'
                    . '</form>';
            } else {
                $tierUpgradeUrl = dsa_tier_upgrade_url($pdo);
                $html .= '<div style="margin-top:16px;padding:14px 16px;background:rgba(255,255,255,0.02);border:1px dashed var(--border);border-radius:10px;text-align:center;">'
                    . '<p class="muted" style="margin:0 0 10px 0;font-size:13px;">🔒 <strong>Multiple Admin Accounts</strong> is a premium feature not available on ' . dsa_h(dsa_plan_tier_label(null, $pdo)) . '.</p>'
                    . '<p style="margin:0;"><a class="btn-secondary" href="' . dsa_h($tierUpgradeUrl) . '" target="_blank" rel="noopener" style="font-size:12px;padding:5px 12px;display:inline-block;">Upgrade your plan to unlock multiple admins</a></p>'
                    . '</div>';
            }
        } else {
            $self = $visibleAdmins[0] ?? dsa_admin_current($pdo);
            $html .= '<p class="muted">Your personal admin account. Other demo admins are hidden from this list.</p>';
            if (is_array($self)) {
                $html .= '<p><strong>Username:</strong> ' . dsa_h((string) ($self['username'] ?? '')) . '<br>'
                    . '<strong>Email:</strong> ' . dsa_h((string) ($self['email'] ?? '')) . '</p>';
            }
        }
        $html .= '</div>';

        if (dsa_demo_mode_active($pdo)) {
            $html .= '<div class="card"><h2>Change Admin Password</h2>';
            $html .= '<p class="muted">Password changes are disabled on this demo store.</p></div>';
        } else {
            $html .= '<div class="card"><h2>Change Admin Password</h2>';
            $html .= '<form method="post" action="/admin/password"><input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
            $html .= '<label>New Password</label><input type="password" name="new_password" minlength="10" required>';
            $html .= '<div style="margin-top:8px"><button class="btn" type="submit">Update Password</button></div></form></div>';
        }
        // Extensions card
        $extPlanTier = dsa_normalize_plan_tier((string) dsa_setting($pdo, 'plan_tier', 'core'));
        $extTierLabel = dsa_plan_tier_label($extPlanTier);
        $extServiceId = (int) dsa_setting($pdo, 'tenant_whmcs_service_id', '0');
        $extUpgradeUrl = $extServiceId > 0
            ? 'https://watutechnology.com/web-portal/clientarea.php?action=upgrade&id=' . $extServiceId
            : 'https://watutechnology.com/web-portal/clientarea.php';
        $extThemes = [
            201 => ['feature' => 'theme_elite',      'name' => 'Elite Theme',       'desc' => 'A bold, high-impact storefront theme for established brands.'],
            208 => ['feature' => 'theme_rebel',      'name' => 'Rebel Theme',       'desc' => 'Edgy, modern design for stores that want to stand out.'],
            209 => ['feature' => 'theme_powerhouse', 'name' => 'Powerhouse Theme',  'desc' => 'Clean, conversion-optimised layout for high-volume stores.'],
            210 => ['feature' => 'theme_warmth',     'name' => 'Warmth Theme',      'desc' => 'Friendly, inviting design for community-focused businesses.'],
        ];
        $extKeyRows = $pdo->query("SELECT feature, status, expires_at, redeemed_at FROM extension_keys ORDER BY redeemed_at DESC")->fetchAll();
        $extActiveFeatures = [];
        foreach ($extKeyRows as $ek) {
            if ((string) ($ek['status'] ?? '') === 'active') {
                $extActiveFeatures[(string) ($ek['feature'] ?? '')] = true;
            }
        }
        $html .= '<div class="card">';
        $html .= '<div style="display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px;margin-bottom:4px;">';
        $html .= '<h2 style="margin:0;">Extensions</h2>';
        $html .= '<span style="font-size:13px;color:#9ca3af;">Your plan: <strong style="color:#e5e7eb;">' . dsa_h($extTierLabel) . '</strong></span>';
        $html .= '</div>';
        $html .= '<p class="muted" style="margin-bottom:16px;">Add premium theme extensions to your store. Each theme is $15/month billed through your Watu account.</p>';
        $html .= '<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px;margin-bottom:20px;">';
        foreach ($extThemes as $extPid => $extInfo) {
            $extFeature = $extInfo['feature'];
            $extIsActive = dsa_extension_active($pdo, $extFeature);
            $extPendingInvoiceId = (int) dsa_setting($pdo, 'pending_invoice_' . $extFeature, '0');
            $extHasPending = $extPendingInvoiceId > 0;
            $html .= '<div style="border:1px solid #374151;border-radius:8px;padding:14px;background:#1f2937;">';
            $html .= '<div style="font-weight:600;margin-bottom:4px;">' . dsa_h($extInfo['name']) . '</div>';
            $html .= '<div style="font-size:12px;color:#9ca3af;margin-bottom:10px;">' . dsa_h($extInfo['desc']) . '</div>';
            $html .= '<div style="font-size:13px;color:#d1d5db;margin-bottom:10px;">$15/mo</div>';
            if ($extIsActive) {
                $html .= '<span style="background:#166534;color:#bbf7d0;padding:3px 10px;border-radius:999px;font-size:12px;">Active</span>';
            } elseif ($extHasPending) {
                $extCatalogApiUrl = dsa_setting($pdo, 'catalog_sync_whmcs_api_url', '');
                $extWhmcsBase = '';
                if ($extCatalogApiUrl !== '') {
                    $extWhmcsBase = preg_replace('#/modules/.*#', '', $extCatalogApiUrl);
                }
                $extInvoiceLink = $extWhmcsBase !== ''
                    ? ($extWhmcsBase . '/viewinvoice.php?id=' . $extPendingInvoiceId)
                    : '';
                $html .= '<span style="background:#78350f;color:#fde68a;padding:3px 10px;border-radius:999px;font-size:12px;">Invoice Pending</span>';
                if ($extInvoiceLink !== '') {
                    $html .= ' <a href="' . dsa_h($extInvoiceLink) . '" target="_blank" rel="noopener" style="font-size:12px;color:#fbbf24;">Pay Now</a>';
                }
            } else {
                $html .= '<form method="post" action="/admin/extension/purchase" style="display:inline;">'
                    . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                    . '<input type="hidden" name="product_id" value="' . $extPid . '">'
                    . '<button class="btn" type="submit" style="font-size:13px;padding:4px 14px;">Add</button>'
                    . '</form>';
            }
            $html .= '</div>';
        }
        $html .= '</div>';
        if (!empty($extKeyRows)) {
            $html .= '<details style="margin-bottom:12px;"><summary style="cursor:pointer;font-size:13px;color:#9ca3af;">Active extension records</summary>';
            $html .= '<div class="table-wrap" style="margin-top:8px;"><table><thead><tr><th>Feature</th><th>Status</th><th>Expires</th><th>Activated</th></tr></thead><tbody>';
            foreach ($extKeyRows as $ek) {
                $ekStatus = (string) ($ek['status'] ?? 'unknown');
                $pillStyle = match($ekStatus) {
                    'active'     => 'background:#166534;color:#bbf7d0;',
                    'suspended'  => 'background:#7c2d12;color:#fed7aa;',
                    'terminated' => 'background:#374151;color:#9ca3af;',
                    'grace'      => 'background:#78350f;color:#fde68a;',
                    default      => 'background:#374151;color:#9ca3af;',
                };
                $statusPill = '<span style="' . $pillStyle . 'padding:2px 8px;border-radius:999px;font-size:12px;">' . dsa_h($ekStatus) . '</span>';
                $html .= '<tr><td>' . dsa_h((string) ($ek['feature'] ?? '')) . '</td>'
                    . '<td>' . $statusPill . '</td>'
                    . '<td>' . dsa_h((string) ($ek['expires_at'] ?? '')) . '</td>'
                    . '<td>' . dsa_h((string) ($ek['redeemed_at'] ?? '')) . '</td></tr>';
            }
            $html .= '</tbody></table></div></details>';
        }
        $html .= '<p style="font-size:13px;color:#9ca3af;">Want more features? <a href="' . dsa_h($extUpgradeUrl) . '" target="_blank" rel="noopener">Upgrade your plan</a></p>';
        $html .= '</div>';
    }

    if ($section === 'payments') {
        $html .= '<div class="card"><h2>Payment methods & Payouts</h2><p class="muted">Configure checkout payment gateways, customer pay instructions, and manage your custodian M-PESA payout withdrawals all in one unified console.</p>';
        if (trim(dsa_setting($pdo, 'platform_payment_allowlist_synced_at', '')) !== '') {
            $html .= '<p class="muted">Methods disabled by Launchpad cannot be enabled here.</p>';
        }
        if (!dsa_tier_allows_payment_method($pdo, 'offline')) {
            $html .= '<p class="muted">DSA plan stores only offer Watu Technology M-PESA at checkout. Upgrade to Pro for all payment methods.</p>';
        }

        // Consolidated Pre-paid Credits Banner above the navigation menu
        $html .= '<div class="card" style="background:rgba(255,193,7,0.08);border:1px solid rgba(255,193,7,0.25);padding:14px;border-radius:10px;margin-bottom:20px;font-size:13px;line-height:1.45;color:var(--text);">';
        $html .= '<h3 style="margin-top:0;margin-bottom:8px;font-size:14px;font-weight:600;display:flex;align-items:center;gap:6px;">⚠️ How Direct Checkout &amp; Delivery Works</h3>';
        $html .= '<ol style="margin:0 0 10px 0;padding-left:20px;display:flex;flex-direction:column;gap:6px;">';
        $html .= '<li><strong>Customer Orders:</strong> Your customer places an order on your storefront and pays you directly.</li>';
        $html .= '<li><strong>Watu Invoice Generated:</strong> Your store automatically creates a purchase invoice on Watu for the order.';
        $html .= '<ul style="margin:4px 0 0 0;padding-left:20px;list-style-type:disc;display:flex;flex-direction:column;gap:2px;">';
        $html .= '<li><em>If pre-paid credit is present:</em> The system uses it to pay the invoice instantly.</li>';
        $html .= '<li><em>If no credit is present:</em> You will need to pay the invoice manually.</li>';
        $html .= '</ul></li>';
        $html .= '<li><strong>Order Delivered:</strong> Once the invoice is paid (automatically or manually), the products are delivered to your customer.</li>';
        $html .= '</ol>';
        $html .= '<div style="background: rgba(230, 81, 0, 0.07); border-left: 3px solid #e65100; padding: 10px 14px; border-radius: 0 6px 6px 0; margin: 12px 0; font-size:12.5px; line-height:1.45; color: #ffb74d; font-weight: 500;">💡 <strong>Important:</strong> To ensure instant, automated delivery for your customers, please maintain a pre-paid credit balance.</div>';
        $html .= '<div style="margin-top:12px;display:flex;align-items:center;gap:12px;border-top:1px solid rgba(255,193,7,0.15);padding-top:12px;justify-content:space-between;flex-wrap:wrap;">';
        $html .= '<span><strong>Available Credit:</strong> <span style="color:#e65100;font-size:14px;font-weight:700;">' . dsa_h($creditFormatted) . '</span></span>';
        $html .= '<a class="btn" href="' . dsa_h($addCreditsUrl) . '" target="_blank" rel="noopener" style="padding:5px 12px;font-size:12px;background:#e65100;color:#fff;border:none;border-radius:6px;text-decoration:none;font-weight:600;display:inline-flex;align-items:center;gap:4px;box-shadow:0 1px 3px rgba(0,0,0,0.1);">➕ Add Credits</a>';
        $html .= '</div>';
        $html .= '</div>';

        $html .= '
        <style>
          .pay-subtab-nav {
              display: flex;
              gap: 8px;
              border-bottom: 1px solid var(--border);
              padding-bottom: 10px;
              margin-bottom: 20px;
              flex-wrap: wrap;
          }
          .pay-tab-btn {
              background: var(--btn-sec-bg);
              color: var(--text-muted);
              border: 1px solid var(--border);
              padding: 6px 14px;
              border-radius: 999px;
              font-size: 13px;
              cursor: pointer;
              font-weight: 500;
              transition: all 0.15s ease;
          }
          .pay-tab-btn:hover {
              color: var(--text);
              border-color: var(--border-inp);
          }
          .pay-tab-btn.active {
              background: var(--accent);
              color: #fff;
              border-color: var(--accent);
              font-weight: 600;
          }
          .pay-tab-pane {
              display: none;
              animation: fadeInPayTab 0.15s ease-in-out;
          }
          .pay-tab-pane.active {
              display: block;
          }
          @keyframes fadeInPayTab {
              from { opacity: 0; transform: translateY(4px); }
              to { opacity: 1; transform: translateY(0); }
          }
          .advanced-offline-card {
              margin-top: 16px;
              border: 1px solid var(--border);
              border-radius: 10px;
              background: var(--bg-surface);
              overflow: hidden;
          }
          .advanced-offline-summary {
              cursor: pointer;
              padding: 10px 14px;
              font-weight: 600;
              font-size: 13px;
              color: var(--text-muted);
              user-select: none;
              background: var(--btn-sec-bg);
          }
          .advanced-offline-summary:hover {
              color: var(--text);
          }
          .advanced-offline-content {
              padding: 14px;
              border-top: 1px solid var(--border);
          }
          .inner-tab-nav {
              display: flex;
              gap: 8px;
              border-bottom: 1px solid var(--border);
              padding-bottom: 8px;
              margin-bottom: 18px;
              margin-top: 14px;
          }
          .inner-tab-btn {
              background: none;
              border: none;
              color: var(--text-muted);
              padding: 6px 14px;
              font-size: 13px;
              cursor: pointer;
              border-radius: 6px;
              font-weight: 500;
              transition: all 0.15s ease;
          }
          .inner-tab-btn:hover {
              color: var(--text);
              background: var(--btn-sec-bg);
          }
          .inner-tab-btn.active {
              color: #fff;
              background: var(--accent);
              font-weight: 600;
          }
          .inner-tab-pane {
              display: none;
              animation: fadeInPayTab 0.15s ease-in-out;
          }
          .inner-tab-pane.active {
              display: block;
          }
        </style>
        ';

        $html .= '<form method="post" action="/admin/payments"><input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';

        // Horizontal navigation (made Offline Payment active since General is moved to Catalog)
        $html .= '<div class="pay-subtab-nav">';
        $html .= '<button type="button" class="pay-tab-btn active" data-paytab="paytab-offline" onclick="switchPayTab(\'paytab-offline\')">Offline Payment</button>';
        $html .= '<button type="button" class="pay-tab-btn" data-paytab="paytab-mpesa" onclick="switchPayTab(\'paytab-mpesa\')">Direct M-PESA</button>';
        if ($paymentMethodPaypalCheckoutPlatformAllowed) {
            $html .= '<button type="button" class="pay-tab-btn" data-paytab="paytab-paypal-checkout" onclick="switchPayTab(\'paytab-paypal-checkout\')">PayPal Checkout</button>';
        }
        if ($paymentMethodPaypalBasicPlatformAllowed) {
            $html .= '<button type="button" class="pay-tab-btn" data-paytab="paytab-paypal-basic" onclick="switchPayTab(\'paytab-paypal-basic\')">PayPal Basic (Legacy)</button>';
        }
        if ($paymentMethodStripePlatformAllowed) {
            $html .= '<button type="button" class="pay-tab-btn" data-paytab="paytab-stripe" onclick="switchPayTab(\'paytab-stripe\')">Stripe Checkout</button>';
        }
        if ($paymentMethodPaystackPlatformAllowed) {
            $html .= '<button type="button" class="pay-tab-btn" data-paytab="paytab-paystack" onclick="switchPayTab(\'paytab-paystack\')">Paystack</button>';
        }
        $html .= '</div>';

        // Tab 2: Offline Payment (Super Simplified & Cleaned Up)
        $html .= '<div id="paytab-offline" class="pay-tab-pane active">';
        $html .= '<div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:12px; gap:8px; flex-wrap:wrap;">';
        $html .= '<h3 style="margin:0;">Offline payment</h3>';
        $html .= '<a href="' . dsa_get_payment_kb_article_link($pdo, 'Payment Setup Guide: Bank Transfer & Offline Payments') . '" target="_blank" style="font-size:12.5px; font-weight:500; color:var(--primary); text-decoration:none; display:inline-flex; align-items:center; gap:6px;">📖 View Setup Guide</a>';
        $html .= '</div>';
        $html .= '<label style="display:flex;align-items:center;gap:8px;"><input id="pay-offline-enabled" type="checkbox" name="payment_method_offline_enabled" value="1" style="width:auto;"' . ($paymentMethodOfflineEnabled ? ' checked' : '') . ($paymentMethodOfflinePlatformAllowed ? '' : ' disabled') . '> ' . dsa_h(dsa_offline_payment_label()) . dsa_payment_method_disabled_html($pdo, 'offline', $paymentMethodOfflinePlatformAllowed) . '</label>';
        
        $html .= '<div id="pay-offline-fields" style="margin-top:10px;">';
        $html .= '<label>General offline payment instructions</label><textarea name="pay_instructions" rows="3" placeholder="Enter offline payment checkout instructions here...">' . dsa_h($payInstructions) . '</textarea>';
        $html .= '</div>'; // End pay-offline-fields
        $html .= '</div>'; // End paytab-offline
 
        // Tab 4: Direct M-PESA
        $html .= '<div id="paytab-mpesa" class="pay-tab-pane">';
        $html .= '<div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:12px; gap:8px; flex-wrap:wrap;">';
        $html .= '<h3 style="margin:0;">Direct M-PESA</h3>';
        $html .= '<a href="' . dsa_get_payment_kb_article_link($pdo, 'Payment Setup Guide: Direct M-PESA') . '" target="_blank" style="font-size:12.5px; font-weight:500; color:var(--primary); text-decoration:none; display:inline-flex; align-items:center; gap:6px;">📖 View Setup Guide</a>';
        $html .= '</div>';
        $html .= '<label style="display:flex;align-items:center;gap:8px;"><input id="pay-mpesa-enabled" type="checkbox" name="payment_method_mpesa_direct_enabled" value="1" style="width:auto;"' . ($paymentMethodMpesaDirectEnabled ? ' checked' : '') . ($paymentMethodMpesaDirectPlatformAllowed ? '' : ' disabled') . '> Direct M-PESA (C2B / Lipa na M-PESA)' . dsa_payment_method_disabled_html($pdo, 'mpesa_direct', $paymentMethodMpesaDirectPlatformAllowed) . '</label>';
        $html .= '<div id="pay-mpesa-fields" style="margin-top:10px;">';
        $html .= '<label>Display Label</label><input name="payment_mpesa_direct_label" value="' . dsa_h($paymentMpesaDirectLabel) . '" placeholder="Lipa na M-PESA">';
        $html .= '<label>Payment Instructions</label><textarea name="payment_mpesa_direct_instructions" rows="2" placeholder="Your paybill/till/lipa na mpesa details">' . dsa_h($paymentMpesaDirectInstructions) . '</textarea>';
        $html .= '<div class="row"><div><label>M-PESA Consumer Key</label><input name="payment_mpesa_consumer_key" value="' . dsa_h($paymentMpesaConsumerKey) . '"></div><div><label>M-PESA Consumer Secret</label><input name="payment_mpesa_consumer_secret" value="' . dsa_h($paymentMpesaConsumerSecret) . '"></div></div>';
        $html .= '<div class="row"><div><label>M-PESA Shortcode</label><input name="payment_mpesa_shortcode" value="' . dsa_h($paymentMpesaShortcode) . '"></div><div><label>M-PESA Passkey</label><input name="payment_mpesa_passkey" value="' . dsa_h($paymentMpesaPasskey) . '"></div></div>';
        $html .= '<div class="row"><div><label>M-PESA Till Number (optional)</label><input name="payment_mpesa_till_number" value="' . dsa_h($paymentMpesaTillNumber) . '"></div><div></div></div>';
        $html .= '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;"><input type="checkbox" name="payment_mpesa_use_till" value="1" style="width:auto;"' . ($paymentMpesaUseTill ? ' checked' : '') . '> Use Till (Buy Goods) instead of Paybill</label>';
        $html .= '<label style="display:flex;align-items:center;gap:8px;"><input type="checkbox" name="payment_mpesa_sandbox" value="1" style="width:auto;"' . ($paymentMpesaSandbox ? ' checked' : '') . '> M-PESA Sandbox Mode</label>';
        $html .= '</div>';
        $html .= '</div>';
 
        // Maintain a hidden legacy unified field so we do not break any existing code that expects it
        $html .= '<input type="hidden" name="payment_method_paypal_enabled" value="' . ($paymentMethodPaypalEnabled ? '1' : '0') . '">';
 
        // Tab 5: PayPal Checkout
        if ($paymentMethodPaypalCheckoutPlatformAllowed) {
            $html .= '<div id="paytab-paypal-checkout" class="pay-tab-pane" style="display:none;">';
            $html .= '<div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:12px; gap:8px; flex-wrap:wrap;">';
            $html .= '<h3 style="margin:0;">PayPal Checkout</h3>';
            $html .= '<a href="' . dsa_get_payment_kb_article_link($pdo, 'Payment Setup Guide: PayPal Checkout') . '" target="_blank" style="font-size:12.5px; font-weight:500; color:var(--primary); text-decoration:none; display:inline-flex; align-items:center; gap:6px;">📖 View Setup Guide</a>';
            $html .= '</div>';
            $html .= '<div id="pay-paypal-checkout-fields" style="margin-top:10px; display:flex; flex-direction:column; gap:16px;">';
            $html .= '<div style="border: 1px solid var(--border); border-radius: 8px; padding: 16px; background: rgba(255,255,255,0.02);">';
            $html .= '<label style="display:flex;align-items:center;gap:8px;margin-bottom:12px;"><input id="pay-paypal-checkout-enabled" type="checkbox" name="payment_method_paypal_checkout_enabled" value="1" style="width:auto;"' . ($paymentMethodPaypalCheckoutEnabled ? ' checked' : '') . ($paymentMethodPaypalCheckoutPlatformAllowed ? '' : ' disabled') . '> <strong>Enable PayPal Checkout</strong>' . dsa_payment_method_disabled_html($pdo, 'paypal_checkout', $paymentMethodPaypalCheckoutPlatformAllowed) . '</label>';
            $html .= '<h4 style="margin:0 0 10px 0; font-size:14px; font-weight:600;">PayPal Checkout (Modern REST API - Recommended)</h4>';
            $html .= '<div style="display:flex; flex-direction:column; gap:10px;">';
            $html .= '<div><label style="font-size:12px; margin-bottom:4px; display:block;">PayPal Client ID</label><input name="payment_paypal_client_id" value="' . dsa_h($paymentPaypalClientId) . '" placeholder="Enter Client ID"></div>';
            $html .= '<div><label style="font-size:12px; margin-bottom:4px; display:block;">PayPal Client Secret</label><input type="password" name="payment_paypal_client_secret" value="' . dsa_h($paymentPaypalClientSecret) . '" placeholder="Enter Client Secret"></div>';
            $html .= '</div>';
            $html .= '</div>';
            $html .= '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;"><input id="pay-paypal-checkout-sandbox" type="checkbox" name="payment_paypal_sandbox" value="1" style="width:auto;"' . ($paymentPaypalSandbox ? ' checked' : '') . '> PayPal Sandbox / Test Mode</label>';
            $html .= '</div>';
            $html .= '</div>';
        }
 
        // Tab 5b: PayPal Basic (Legacy)
        if ($paymentMethodPaypalBasicPlatformAllowed) {
            $html .= '<div id="paytab-paypal-basic" class="pay-tab-pane" style="display:none;">';
            $html .= '<div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:12px; gap:8px; flex-wrap:wrap;">';
            $html .= '<h3 style="margin:0;">PayPal Basic (Legacy)</h3>';
            $html .= '<a href="' . dsa_get_payment_kb_article_link($pdo, 'Payment Setup Guide: PayPal Basic (Legacy)') . '" target="_blank" style="font-size:12.5px; font-weight:500; color:var(--primary); text-decoration:none; display:inline-flex; align-items:center; gap:6px;">📖 View Setup Guide</a>';
            $html .= '</div>';
            $html .= '<div id="pay-paypal-basic-fields" style="margin-top:10px; display:flex; flex-direction:column; gap:16px;">';
            $html .= '<div style="border: 1px solid var(--border); border-radius: 8px; padding: 16px; background: rgba(255,255,255,0.02);">';
            $html .= '<label style="display:flex;align-items:center;gap:8px;margin-bottom:12px;"><input id="pay-paypal-basic-enabled" type="checkbox" name="payment_method_paypal_basic_enabled" value="1" style="width:auto;"' . ($paymentMethodPaypalBasicEnabled ? ' checked' : '') . ($paymentMethodPaypalBasicPlatformAllowed ? '' : ' disabled') . '> <strong>Enable PayPal Basic (Legacy)</strong>' . dsa_payment_method_disabled_html($pdo, 'paypal_basic', $paymentMethodPaypalBasicPlatformAllowed) . '</label>';
            $html .= '<div style="background: rgba(245, 158, 11, 0.1); border-left: 4px solid #f59e0b; padding: 12px; border-radius: 0 4px 4px 0; margin-bottom: 14px; font-size:11.5px; line-height:1.5; color: #f59e0b;">';
            $html .= '⚠️ <strong>PayPal Basic (Website Payments Standard) is deprecated by PayPal and will be fully shut down in January 2027.</strong> Redirection-based payments using just an email address will stop working at that point. We strongly recommend configuring <strong>PayPal Checkout</strong> using API credentials to avoid service disruption. <a href="https://www.paypal.com/ae/webapps/mpp/web-payments-standard-faq" target="_blank" style="text-decoration:underline; font-weight:bold; color: #f59e0b;">Read official PayPal FAQ announcement</a>.';
            $html .= '</div>';
            $html .= '<h4 style="margin:0 0 10px 0; font-size:14px; font-weight:600;">PayPal Basic (Legacy Email - Deprecated)</h4>';
            $html .= '<div style="display:flex; flex-direction:column; gap:10px;">';
            $html .= '<div><label style="font-size:12px; margin-bottom:4px; display:block;">PayPal Business Email</label><input name="payment_paypal_business_email" value="' . dsa_h($paymentPaypalBusinessEmail) . '" placeholder="PayPal Business Email"></div>';
            $html .= '<div><label style="font-size:12px; margin-bottom:4px; display:block;">Optional direct PayPal link override</label><input name="payment_paypal_link" value="' . dsa_h($paymentPaypalLink) . '" placeholder="Optional direct PayPal link override"></div>';
            $html .= '</div>';
            $html .= '</div>';
            $html .= '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;"><input id="pay-paypal-basic-sandbox" type="checkbox" name="payment_paypal_sandbox" value="1" style="width:auto;"' . ($paymentPaypalSandbox ? ' checked' : '') . '> PayPal Sandbox / Test Mode</label>';
            $html .= '</div>';
            $html .= '</div>';
        }
 
        // Tab 6: Stripe Checkout
        if ($paymentMethodStripePlatformAllowed) {
            $html .= '<div id="paytab-stripe" class="pay-tab-pane" style="display:none;">';
            $html .= '<div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:12px; gap:8px; flex-wrap:wrap;">';
            $html .= '<h3 style="margin:0;">Stripe Checkout</h3>';
            $html .= '<a href="' . dsa_get_payment_kb_article_link($pdo, 'Payment Setup Guide: Stripe Checkout') . '" target="_blank" style="font-size:12.5px; font-weight:500; color:var(--primary); text-decoration:none; display:inline-flex; align-items:center; gap:6px;">📖 View Setup Guide</a>';
            $html .= '</div>';
            $html .= '<label style="display:flex;align-items:center;gap:8px;"><input id="pay-stripe-enabled" type="checkbox" name="payment_method_stripe_enabled" value="1" style="width:auto;"' . ($paymentMethodStripeEnabled ? ' checked' : '') . '> Enable Stripe Checkout' . dsa_payment_method_disabled_html($pdo, 'stripe', $paymentMethodStripePlatformAllowed) . '</label>';
            $html .= '<div id="pay-stripe-fields" style="margin-top:10px;">';
            $html .= '<label>Stripe Publishable Key</label><input name="payment_stripe_publishable_key" value="' . dsa_h($paymentStripePublishableKey) . '" placeholder="pk_live_...">';
            $html .= '<label>Stripe Secret Key</label><input type="password" name="payment_stripe_secret_key" value="' . dsa_h($paymentStripeSecretKey) . '" placeholder="sk_live_...">';
            $html .= '<label>Stripe Webhook Secret (Optional)</label><input name="payment_stripe_webhook_secret" value="' . dsa_h($paymentStripeWebhookSecret) . '" placeholder="whsec_...">';
            $html .= '<label>Optional direct Stripe payment link / checkout URL override</label><input name="payment_stripe_link" value="' . dsa_h($paymentStripeLink) . '" placeholder="https://checkout.stripe.com/pay/..."><p class="muted" style="margin:4px 0 14px 0;font-size:11px;">Supports placeholders: <code>{amount}</code>, <code>{currency}</code>, <code>{order_id}</code>, <code>{order_ref}</code></p>';
            $html .= '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;"><input type="checkbox" name="payment_stripe_sandbox" value="1" style="width:auto;"' . ($paymentStripeSandbox ? ' checked' : '') . '> Stripe Sandbox / Test Mode</label>';
            $html .= '</div>';
            $html .= '</div>';
        }
 
        // Tab 7: Paystack
        if ($paymentMethodPaystackPlatformAllowed) {
            $html .= '<div id="paytab-paystack" class="pay-tab-pane" style="display:none;">';
            $html .= '<div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:12px; gap:8px; flex-wrap:wrap;">';
            $html .= '<h3 style="margin:0;">Paystack</h3>';
            $html .= '<a href="' . dsa_get_payment_kb_article_link($pdo, 'Payment Setup Guide: Paystack') . '" target="_blank" style="font-size:12.5px; font-weight:500; color:var(--primary); text-decoration:none; display:inline-flex; align-items:center; gap:6px;">📖 View Setup Guide</a>';
            $html .= '</div>';
            $html .= '<label style="display:flex;align-items:center;gap:8px;"><input id="pay-paystack-enabled" type="checkbox" name="payment_method_paystack_enabled" value="1" style="width:auto;"' . ($paymentMethodPaystackEnabled ? ' checked' : '') . '> Enable Paystack' . dsa_payment_method_disabled_html($pdo, 'paystack', $paymentMethodPaystackPlatformAllowed) . '</label>';
            $html .= '<div id="pay-paystack-fields" style="margin-top:10px;">';
            $html .= '<label>Paystack Public Key</label><input name="payment_paystack_public_key" value="' . dsa_h($paymentPaystackPublicKey) . '" placeholder="pk_live_...">';
            $html .= '<label>Paystack Secret Key</label><input type="password" name="payment_paystack_secret_key" value="' . dsa_h($paymentPaystackSecretKey) . '" placeholder="sk_live_...">';
            $html .= '<label>Optional direct Paystack payment link / checkout URL override</label><input name="payment_paystack_link" value="' . dsa_h($paymentPaystackLink) . '" placeholder="https://paystack.com/pay/..."><p class="muted" style="margin:4px 0 14px 0;font-size:11px;">Supports placeholders: <code>{amount}</code>, <code>{currency}</code>, <code>{order_id}</code>, <code>{order_ref}</code></p>';
            $html .= '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;"><input type="checkbox" name="payment_paystack_sandbox" value="1" style="width:auto;"' . ($paymentPaystackSandbox ? ' checked' : '') . '> Paystack Sandbox / Test Mode</label>';
            $html .= '</div>';
            $html .= '</div>';
        }

        $html .= '<div style="margin-top:20px;border-top:1px solid var(--border);padding-top:14px;"><button class="btn" type="submit">Save payment methods</button></div></form>';

        // Append the separate Payouts Panel container outside the payments configuration form
        $html .= '<div id="paytab-watupay-payouts" style="display:none; margin-top:24px; border-top:1px dashed var(--border); padding-top: 24px;">';
        $html .= dsa_admin_payouts_section_html($pdo);
        $html .= '</div>';

        $html .= '</div>';

        // Navigation script
        $html .= '
        <script>
        (function(){
            window.switchPayTab = function(tabId) {
                document.querySelectorAll(".pay-tab-pane").forEach(function(el){ el.style.display = "none"; el.classList.remove("active"); });
                document.querySelectorAll(".pay-tab-btn").forEach(function(el){ el.classList.remove("active"); });
                var target = document.getElementById(tabId);
                if (target) {
                    target.style.display = "block";
                    target.classList.add("active");
                }
                var btn = document.querySelector(\'[data-paytab="\' + tabId + \'"]\');
                if (btn) btn.classList.add("active");
                localStorage.setItem("dsa_active_pay_tab", tabId);
            };

            window.switchInnerTab = function(paneId) {
                document.querySelectorAll(".inner-tab-pane").forEach(function(el){ el.style.display = "none"; el.classList.remove("active"); });
                document.querySelectorAll(".inner-tab-btn").forEach(function(el){ el.classList.remove("active"); });
                var target = document.getElementById(paneId);
                if (target) {
                    target.style.display = "block";
                    target.classList.add("active");
                }
                var btn = document.querySelector(\'[data-innertab="\' + paneId + \'"]\');
                if (btn) btn.classList.add("active");
                localStorage.setItem("dsa_active_watu_inner_tab", paneId);
            };

            function t(id, show) {
                var el = document.getElementById(id);
                if (el) el.style.display = show ? "" : "none";
            }

            function sync() {
                var offline = document.getElementById("pay-offline-enabled");
                var mpesa = document.getElementById("pay-mpesa-enabled");
                var stripe = document.getElementById("pay-stripe-enabled");
                var paystack = document.getElementById("pay-paystack-enabled");
                t("pay-offline-fields", !!(offline && offline.checked));
                t("pay-mpesa-fields", !!(mpesa && mpesa.checked));
                t("pay-stripe-fields", !!(stripe && stripe.checked));
                t("pay-paystack-fields", !!(paystack && paystack.checked));
            }

            ["pay-offline-enabled", "pay-paypal-checkout-enabled", "pay-paypal-basic-enabled", "pay-mpesa-enabled", "pay-stripe-enabled", "pay-paystack-enabled"].forEach(function(id){
                var el = document.getElementById(id);
                if (el) el.addEventListener("change", sync);
            });

            // Sync PayPal sandbox checkboxes
            var cbSandboxCheckout = document.getElementById("pay-paypal-checkout-sandbox");
            var cbSandboxBasic = document.getElementById("pay-paypal-basic-sandbox");
            if (cbSandboxCheckout && cbSandboxBasic) {
                cbSandboxCheckout.addEventListener("change", function() {
                    cbSandboxBasic.checked = cbSandboxCheckout.checked;
                });
                cbSandboxBasic.addEventListener("change", function() {
                    cbSandboxCheckout.checked = cbSandboxBasic.checked;
                });
            }

            sync();

            // Move Payouts Panel into its beautiful nested Inner Sub-Tab Pane B
            var payoutsSource = document.getElementById("paytab-watupay-payouts");
            var payoutsDest = document.getElementById("watu-payouts-pane");
            if (payoutsSource && payoutsDest) {
                payoutsDest.innerHTML = ""; // Clear loading placeholder
                payoutsDest.appendChild(payoutsSource);
                payoutsSource.style.display = "block";
                payoutsSource.style.borderTop = "none";
                payoutsSource.style.paddingTop = "0";
                payoutsSource.style.marginTop = "0";
            }

            // Restore active outer tab (Upgrading old dsa_active_pay_tab value "paytab-paypal")
            var savedTab = ' . ($forceWatuPayTab ? '"paytab-watupay"' : 'localStorage.getItem("dsa_active_pay_tab") || "paytab-offline"') . ';
            if (savedTab === "paytab-paypal") {
                savedTab = "paytab-paypal-checkout";
            }
            switchPayTab(savedTab);

            // Restore active inner tab
            var savedInnerTab = localStorage.getItem("dsa_active_watu_inner_tab") || "watu-settings-pane";
            switchInnerTab(savedInnerTab);
        })();
        </script>
        ';
    }

    if ($section === 'analytics') {
        $html .= dsa_admin_analytics_section_html($pdo);
    }

    if ($section === 'notifications') {
        $syncSource = trim((string) dsa_setting($pdo, 'notifications_source', 'whmcs_templates'));
        $syncAt = trim((string) dsa_setting($pdo, 'notifications_synced_at', ''));
        $html .= '<div class="card"><h2>Email Notifications</h2><p class="muted">' . dsa_h(dsa_ui_label('notifications.templates_synced')) . '</p>';
        $html .= '<p class="muted">Source: ' . dsa_h($syncSource) . ($syncAt !== '' ? ' | Last sync: ' . dsa_h($syncAt) : '') . '</p>';
        $groupedTemplates = [];
        foreach ($notificationTemplateCatalog as $templateKey => $tpl) {
            $categoryKey = (string) ($tpl['category_key'] ?? 'general');
            $categoryLabel = (string) ($tpl['category_label'] ?? 'General Messages');
            if (!isset($groupedTemplates[$categoryKey])) {
                $groupedTemplates[$categoryKey] = ['label' => $categoryLabel, 'items' => []];
            }
            $groupedTemplates[$categoryKey]['items'][$templateKey] = $tpl;
        }
        $html .= '<form method="post" action="/admin/notifications" style="margin-top:12px;">'
            . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        foreach ($groupedTemplates as $category) {
            $html .= '<div class="card" style="margin-top:10px;"><h3 style="margin-top:0;">' . dsa_h((string) ($category['label'] ?? 'Templates')) . '</h3>';
            foreach ((array) ($category['items'] ?? []) as $templateKey => $tpl) {
                $label = (string) ($tpl['template_label'] ?? $templateKey);
                $enabled = !empty($tpl['enabled']);
                $html .= '<div style="border:1px solid #334155;border-radius:10px;padding:12px;margin-top:10px;">'
                    . '<label style="display:flex;align-items:center;gap:8px;"><input type="checkbox" name="notifications[' . dsa_h($templateKey) . '][enabled]" value="1" style="width:auto;"' . ($enabled ? ' checked' : '') . '> ' . dsa_h($label) . '</label>'
                    . '</div>';
            }
            $html .= '</div>';
        }
        $html .= '<p class="muted">' . dsa_h(dsa_ui_label('notifications.templates_managed')) . '</p>';
        $html .= '<div style="margin-top:10px;"><button class="btn" type="submit">Save Notification Visibility</button></div></form>';
        $html .= '</div>';
    }

    if ($section === 'catalog') {
        $storeCurrency = dsa_store_currency($pdo);
        $html .= '<style>
          /* Unified layout scoping for Catalog administration */
          .catalog-section {
              display: flex;
              flex-direction: column;
              gap: 20px;
          }
          
          /* Form Controls Normalization */
          .catalog-section select,
          .catalog-section input[type="text"],
          .catalog-section input[type="number"] {
              height: 40px !important;
              padding: 6px 12px !important;
              background-color: #0f172a !important; /* dark slate */
              border: 1px solid #334155 !important;
              border-radius: 6px !important;
              color: #f1f5f9 !important;
              font-size: 13px !important;
              box-sizing: border-box !important;
              transition: border-color 0.2s, box-shadow 0.2s;
              width: 100%;
          }
          .catalog-section select:focus,
          .catalog-section input[type="text"]:focus,
          .catalog-section input[type="number"]:focus {
              border-color: #3b82f6 !important;
              box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.25) !important;
              outline: none !important;
          }
          
          /* Standardized heights and styles for buttons */
          .catalog-section .btn,
          .catalog-section .btn-secondary {
              height: 40px !important;
              padding: 0 16px !important;
              font-size: 13px !important;
              font-weight: 600 !important;
              border-radius: 6px !important;
              display: inline-flex !important;
              align-items: center !important;
              justify-content: center !important;
              gap: 6px !important;
              cursor: pointer !important;
              transition: all 0.2s ease !important;
              white-space: nowrap !important;
              box-sizing: border-box !important;
              text-decoration: none !important;
          }
          .catalog-section .btn {
              background-color: #2563eb !important;
              color: #ffffff !important;
              border: none !important;
          }
          .catalog-section .btn:hover {
              background-color: #1d4ed8 !important;
              box-shadow: 0 4px 12px rgba(37, 99, 235, 0.25) !important;
          }
          .catalog-section .btn-secondary {
              background-color: transparent !important;
              color: #94a3b8 !important;
              border: 1px solid #334155 !important;
          }
          .catalog-section .btn-secondary:hover {
              background-color: #1e293b !important;
              border-color: #475569 !important;
              color: #f8fafc !important;
          }
          
          /* Hide number input spin-buttons completely */
          .catalog-section input[type="number"]::-webkit-outer-spin-button,
          .catalog-section input[type="number"]::-webkit-inner-spin-button {
              -webkit-appearance: none !important;
              margin: 0 !important;
          }
          .catalog-section input[type="number"] {
              -moz-appearance: textfield !important;
          }
          
          /* Currency Prefix Input Group */
          .dsa-input-currency-group {
              position: relative;
              display: inline-flex;
              align-items: center;
              width: 100%;
              min-width: 120px;
          }
          .dsa-input-currency-group .dsa-input-currency-addon {
              position: absolute;
              left: 10px;
              font-size: 11px;
              font-weight: 700;
              color: #64748b; /* slate-500 */
              pointer-events: none;
              text-transform: uppercase;
              letter-spacing: 0.05em;
          }
          .dsa-input-currency-group input[type="number"] {
              padding-left: 44px !important;
              text-align: left;
          }
          
          /* Grid filter layout */
          .catalog-filter-grid {
              display: grid;
              grid-template-columns: 2fr 1fr 1fr auto;
              gap: 16px;
              align-items: flex-end;
          }
          @media (max-width: 900px) {
              .catalog-filter-grid {
                  grid-template-columns: 1fr;
                  gap: 12px;
              }
              .catalog-filter-grid .btn-container {
                  display: flex;
                  gap: 8px;
                  width: 100%;
                  margin-top: 4px;
              }
              .catalog-filter-grid .btn-container button,
              .catalog-filter-grid .btn-container a {
                  flex: 1;
              }
          }
          
          /* Responsive table card wrapper */
          .dsa-table-responsive {
              overflow-x: auto;
              border-radius: 8px;
              border: 1px solid #1e293b;
              background-color: #0b0f19;
              box-shadow: 0 4px 15px rgba(0, 0, 0, 0.25);
              margin-top: 14px;
          }
          .dsa-table-responsive table {
              width: 100%;
              border-collapse: collapse;
              margin: 0;
          }
          .dsa-table-responsive th {
              background-color: #0f172a;
              color: #94a3b8;
              font-weight: 600;
              padding: 12px 16px;
              text-transform: uppercase;
              font-size: 11px;
              letter-spacing: 0.05em;
              border-bottom: 1px solid #1e293b;
              text-align: left;
          }
          .dsa-table-responsive td {
              padding: 14px 16px;
              border-bottom: 1px solid #1e293b;
              vertical-align: middle;
          }
          .dsa-table-responsive tbody tr {
              transition: background-color 0.15s ease;
          }
          .dsa-table-responsive tbody tr:hover {
              background-color: rgba(37, 99, 235, 0.03);
          }
          
          /* Badges */
          .badge-explain {
              display: inline-flex;
              align-items: center;
              padding: 3px 8px;
              border-radius: 6px;
              font-size: 10px;
              font-weight: 700;
              text-transform: uppercase;
              letter-spacing: 0.05em;
          }
          .badge-explain-persistent {
              background-color: rgba(37, 99, 235, 0.12);
              color: #60a5fa;
              border: 1px solid rgba(37, 99, 235, 0.25);
          }
          .badge-explain-batch {
              background-color: rgba(245, 158, 11, 0.12);
              color: #fbbf24;
              border: 1px solid rgba(245, 158, 11, 0.25);
          }
          
          /* Settings container grid */
          .flex-settings-container {
              display: grid;
              grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
              gap: 16px;
              margin-top: 16px;
          }
          .setting-subcard {
              margin-top: 0;
              padding: 20px !important;
              border: 1px solid #1e293b;
              border-radius: 8px;
              background-color: #0b0f19;
              transition: border-color 0.2s, box-shadow 0.2s;
          }
          .setting-subcard:hover {
              border-color: #334155;
              box-shadow: 0 4px 15px rgba(0,0,0,0.15);
          }
          
          .form-item-group {
              display: flex;
              flex-direction: column;
              gap: 6px;
          }
          .form-item-group label {
              font-size: 11px;
              font-weight: 600;
              text-transform: uppercase;
              color: #94a3b8;
              letter-spacing: 0.05em;
          }
          
          /* Bulk Pricing Row items */
          .bulk-pricing-row {
              display: flex;
              gap: 16px;
              margin-bottom: 16px;
              flex-wrap: wrap;
          }
          .bulk-pricing-row > div {
              flex: 1;
              min-width: 220px;
          }
        </style>';

        $html .= '<div class="catalog-section">';
        $html .= '<div class="card"><h2>Watu Product Catalog</h2><p class="muted">Choose products to sell, set your sell prices, and keep margins visible.</p>';

        $html .= '<form method="get" action="/admin" style="margin:0;"><input type="hidden" name="section" value="catalog"><div class="catalog-filter-grid">'
            . '<div class="form-item-group"><label>Search products</label><input name="catalog_q" value="' . dsa_h($catalogQuery) . '" placeholder="Search by name, slug, description"></div>'
            . '<div class="form-item-group"><label>Category filter</label><select name="catalog_category"><option value="all">all categories</option>';
        foreach ($catalogCategories as $cat) {
            $html .= '<option value="' . dsa_h($cat) . '"' . ($catalogCategory === $cat ? ' selected' : '') . '>' . dsa_h($cat) . '</option>';
        }
        $html .= '</select></div>'
            . '<div class="form-item-group"><label>Visibility</label><select name="catalog_state"><option value="all"' . ($catalogState === 'all' ? ' selected' : '') . '>all</option><option value="enabled"' . ($catalogState === 'enabled' ? ' selected' : '') . '>enabled in store</option><option value="not_enabled"' . ($catalogState === 'not_enabled' ? ' selected' : '') . '>not enabled</option></select></div>'
            . '<div class="btn-container" style="display:flex;gap:8px;"><button class="btn" type="submit">Apply</button><a class="btn-secondary" href="/admin?section=catalog">Reset</a></div>'
            . '</div></form>';

        $showingFrom = $catalogTotal > 0 ? ($catalogOffset + 1) : 0;
        $showingTo = min($catalogOffset + count($catalog), $catalogTotal);
        $html .= '<p class="muted" style="margin-top:14px; font-weight:500;">Showing ' . dsa_h((string) $showingFrom) . '-' . dsa_h((string) $showingTo) . ' of ' . dsa_h((string) $catalogTotal) . ' products.</p>';
        
        $html .= '<div class="dsa-table-responsive"><table><thead><tr><th style="width:35%;">Product</th><th style="width:15%;">Category</th><th style="width:15%;">Provisioning</th><th style="width:12%;">Buy Cost</th><th style="width:12%;">Sell Price</th><th style="width:11%;">Status</th><th style="width:10%;">Action</th></tr></thead><tbody>';
        $ratesJson = dsa_setting($pdo, 'catalog_sync_currency_rates', '[]');
        $rates = json_decode($ratesJson, true) ?: [];
        $storeCurrency = dsa_store_currency($pdo);

        foreach ($catalog as $row) {
            $costInStore = dsa_convert_currency((int) $row['cost_cents'], (string) $row['currency'], $storeCurrency, $rates);
            $sellPrice = (int) ($row['sell_price_cents'] ?? $costInStore);
            $sellStatus = (string) ($row['sell_status'] ?? 'active');
            $margin = $sellPrice - $costInStore;
            $provBadge = dsa_provisioning_admin_badge((array) $row);
            
            $html .= '<tr><td><strong style="color:#f8fafc; font-size:14px;">' . dsa_h((string) $row['name']) . '</strong><br><span class="muted" style="font-size:11px;">/' . dsa_h((string) $row['slug']) . '</span><br><span class="muted" style="display:block;margin-top:4px;line-height:1.4;font-size:12px;">' . dsa_h(dsa_truncate_text((string) $row['description'], 120)) . '</span></td>';
            $html .= '<td><span style="font-size:13px;color:#cbd5e1;">' . dsa_h((string) ($row['category'] ?? 'General')) . '</span></td>';
            $html .= '<td><span style="display:inline-block;padding:4px 8px;border-radius:4px;font-size:11px;font-weight:600;line-height:1.25;' . dsa_h($provBadge['style']) . '">' . dsa_h($provBadge['label']) . '</span></td>';

            // Buy Cost formatting
            $buyCostHtml = '<strong style="color:#f8fafc;font-size:13px;">' . dsa_h(dsa_money((int) $row['cost_cents'], (string) $row['currency'])) . '</strong>';
            if (strtoupper(trim((string) $row['currency'])) !== $storeCurrency) {
                $buyCostHtml .= '<br><span class="muted" style="font-size:11px;font-weight:500;">(~ ' . dsa_h(dsa_money($costInStore, $storeCurrency)) . ')</span>';
            }
            $html .= '<td>' . $buyCostHtml . '</td>';

            $marginColorStyle = $margin >= 0 ? 'color:#10b981;' : 'color:#f87171;';
            $marginLabel = 'Profit: ' . dsa_money($margin, $storeCurrency);

            $html .= '<td><form method="post" action="/admin/catalog/enable" style="margin:0;display:flex;flex-direction:column;gap:4px;">'
                . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                . '<input type="hidden" name="catalog_id" value="' . dsa_h((string) $row['id']) . '">'
                . '<input type="hidden" name="catalog_category" value="' . dsa_h($catalogCategory) . '">'
                . '<input type="hidden" name="catalog_state" value="' . dsa_h($catalogState) . '">'
                . '<input type="hidden" name="catalog_q" value="' . dsa_h($catalogQuery) . '">'
                . '<input type="hidden" name="catalog_page" value="' . dsa_h((string) $catalogPage) . '">'
                . '<div class="dsa-input-currency-group">'
                . '<span class="dsa-input-currency-addon">' . dsa_h($storeCurrency) . '</span>'
                . '<input type="number" name="sell_price_amount" step="0.01" min="0" value="' . dsa_h(number_format($sellPrice / 100, 2, '.', '')) . '">'
                . '</div>'
                . '<div style="margin-top:4px;font-weight:600;font-size:11px;' . $marginColorStyle . '">' . dsa_h($marginLabel) . '</div></td>';
            $html .= '<td><select name="status" style="width:100%; min-width:90px;"><option value="active"' . ($sellStatus === 'active' ? ' selected' : '') . '>active</option><option value="inactive"' . ($sellStatus === 'inactive' ? ' selected' : '') . '>inactive</option></select></td>';
            $html .= '<td><button class="btn" type="submit" style="width:100%;font-size:12px;padding:6px 12px;height:34px !important;">' . ((int) ($row['enabled_product_id'] ?? 0) > 0 ? 'Update' : 'Enable') . '</button></form></td></tr>';
        }
        if (count($catalog) === 0) {
            $html .= '<tr><td colspan="7" style="text-align:center;padding:24px;"><span class="muted">No catalog products match the current filters.</span></td></tr>';
        }
        $html .= '</tbody></table></div>';

        $html .= '<div class="pagination">';
        if ($catalogPage > 1) {
            $html .= '<a class="btn-secondary" href="' . dsa_h(dsa_build_admin_url([
                'section' => 'catalog',
                'catalog_category' => $catalogCategory,
                'catalog_state' => $catalogState,
                'catalog_q' => $catalogQuery,
                'catalog_page' => $catalogPage - 1,
            ])) . '">Previous</a>';
        }
        $html .= '<span class="muted" style="font-weight:600;font-size:13px;">Page ' . dsa_h((string) $catalogPage) . ' of ' . dsa_h((string) $catalogPages) . '</span>';
        if ($catalogPage < $catalogPages) {
            $html .= '<a class="btn-secondary" href="' . dsa_h(dsa_build_admin_url([
                'section' => 'catalog',
                'catalog_category' => $catalogCategory,
                'catalog_state' => $catalogState,
                'catalog_q' => $catalogQuery,
                'catalog_page' => $catalogPage + 1,
            ])) . '">Next</a>';
        }
        $html .= '</div></div>';

        // Bulk Pricing section
        $html .= '<div class="card" style="margin-top:0;">'
            . '<div style="display:flex;align-items:center;margin-bottom:12px;flex-wrap:wrap;gap:12px;">'
            . '<h2 style="margin:0;">Bulk Pricing</h2>'
            . '<span class="badge-explain badge-explain-batch">One-Time Batch Run</span>'
            . '</div>'
            . '<p class="muted" style="margin-top:-4px;margin-bottom:18px;font-size:13px;">Apply immediate price modifications to existing catalog items matching your selected Scope.</p>'
            . '<form method="post" action="/admin/products/bulk-pricing" style="margin:0;">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<input type="hidden" name="catalog_category" value="' . dsa_h($catalogCategory) . '">';
        $html .= '<input type="hidden" name="catalog_state" value="' . dsa_h($catalogState) . '">';
        $html .= '<input type="hidden" name="catalog_q" value="' . dsa_h($catalogQuery) . '">';
        $html .= '<input type="hidden" name="catalog_page" value="' . dsa_h((string) $catalogPage) . '">';
        $html .= '<div class="bulk-pricing-row">'
            . '<div class="form-item-group"><label>Scope</label><select name="scope"><option value="filtered_catalog">current filtered catalog results</option><option value="all_catalog">all catalog items</option></select></div>'
            . '<div class="form-item-group"><label>Markup (%) over buy cost</label><input type="number" step="0.01" name="markup_percent" value="' . dsa_h((string) $catalogSyncDefaultMarkupPercent) . '"></div>'
            . '</div>';
        $html .= '<div class="bulk-pricing-row">'
            . '<div class="form-item-group"><label>Status override (optional)</label><select name="status"><option value="">no change</option><option value="active">active</option><option value="inactive">inactive</option></select></div>'
            . '</div>';
        $html .= '<div style="margin-top:14px"><button class="btn" type="submit">Apply Bulk Pricing</button></div></form></div>';

        $html .= '<div class="flex-settings-container">';
        
        // Card 1: Store Currency
        $html .= '<div class="setting-subcard" style="display:flex;flex-direction:column;justify-content:between;">';
        $html .= '<h3 style="margin-top:0;margin-bottom:4px;font-size:15px;font-weight:600;color:#f8fafc;">Store Currency</h3>';
        $html .= '<p class="muted" style="margin:0 0 16px 0;font-size:12px;line-height:1.4;">Catalog prices sync in this currency. Re-syncs after changing.</p>';
        $html .= '<form method="post" action="/admin/catalog/currency" style="margin:0;margin-top:auto;">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<div style="display:flex;gap:10px;">';
        $html .= '<select name="store_currency" style="margin-bottom:0;flex:1;">';
        foreach (dsa_supported_store_currencies() as $currencyOption) {
            $selected = $storeCurrency === $currencyOption ? ' selected' : '';
            $html .= '<option value="' . dsa_h($currencyOption) . '"' . $selected . '>' . dsa_h($currencyOption) . '</option>';
        }
        $html .= '</select>';
        $html .= '<button class="btn" type="submit" style="white-space:nowrap;">Save Currency</button>';
        $html .= '</div>';
        $html .= '</form>';
        $html .= '</div>';

        // Card 2: Default Catalog Markup
        $html .= '<div class="setting-subcard" style="display:flex;flex-direction:column;justify-content:between;">';
        $html .= '<div style="display:flex;align-items:center;margin-bottom:4px;flex-wrap:wrap;gap:8px;">'
            . '<h3 style="margin:0;font-size:15px;font-weight:600;color:#f8fafc;">Default Catalog Markup</h3>'
            . '<span class="badge-explain badge-explain-persistent">Persistent Config</span>'
            . '</div>';
        $html .= '<p class="muted" style="margin:0 0 16px 0;font-size:12px;line-height:1.4;">Profit margin automatically applied during automated daily syncs of newly imported catalog items.</p>';
        $html .= '<form method="post" action="/admin/catalog/markup-default" style="margin:0;margin-top:auto;">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<div style="display:flex;gap:10px;">';
        $html .= '<input type="number" step="0.01" name="catalog_sync_default_markup_percent" value="' . dsa_h((string) $catalogSyncDefaultMarkupPercent) . '" style="margin-bottom:0;flex:1;">';
        $html .= '<button class="btn" type="submit" style="white-space:nowrap;">Save Markup</button>';
        $html .= '</div>';
        $html .= '</form>';
        $html .= '</div>';

        $html .= '</div>'; /* end of flex-settings-container */
        $html .= '</div>'; /* end of catalog-section */
    }

    if ($section === 'custom-services') {
        $html .= dsa_render_admin_custom_services_section($pdo, '');
    }

    if ($section === 'products') {
        $html .= '<div class="card"><h2>Products</h2><p class="muted">All enabled storefront products — from Watu catalog sync and custom services.</p><p><a class="btn" href="/admin?section=catalog">Open Catalog</a> <a class="btn-secondary" href="/admin?section=custom-services">Custom Services</a></p></div>';

        $html .= '<div class="card"><h2>Enabled Products</h2><form method="get" action="/admin"><input type="hidden" name="section" value="products"><label>Category filter</label><select name="products_category"><option value="all">all categories</option>';
        foreach ($productCategories as $cat) {
            $html .= '<option value="' . dsa_h($cat) . '"' . ($productsCategory === $cat ? ' selected' : '') . '>' . dsa_h($cat) . '</option>';
        }
        $html .= '</select><div style="margin-top:8px"><button class="btn" type="submit">Apply Filter</button></div></form>';
        $html .= '<table><thead><tr><th>ID</th><th>Name</th><th>Source</th><th>Category</th><th>Buy Cost</th><th>Sell Price</th><th>Status</th></tr></thead><tbody>';
        foreach ($products as $p) {
            $marginCents = (int) $p['price_cents'] - (int) ($p['cost_cents'] ?? 0);
            $sourceBadge = dsa_product_source_badge_html((string) ($p['product_source'] ?? 'catalog'));
            $html .= '<tr><td>' . dsa_h((string) $p['id']) . '</td><td>' . dsa_h((string) $p['name']) . '<br><span class="muted">/' . dsa_h((string) $p['slug']) . '</span></td><td>' . $sourceBadge . '</td><td>' . dsa_h((string) ($p['category'] ?? 'General')) . '</td><td>' . dsa_h(dsa_money((int) ($p['cost_cents'] ?? 0), (string) $p['currency'])) . '</td><td>' . dsa_h(dsa_money((int) $p['price_cents'], (string) $p['currency'])) . '<br><span class="muted">Margin: ' . dsa_h(dsa_money($marginCents, (string) $p['currency'])) . '</span></td><td>' . dsa_h((string) $p['status']) . '</td></tr>';
        }
        if (count($products) === 0) {
            $html .= '<tr><td colspan="7"><span class="muted">No enabled products yet. Use Catalog or Custom Services.</span></td></tr>';
        }
        $html .= '</tbody></table></div>';
    }

    if ($section === 'orders') {
        $html .= '<div class="card"><h2>Orders</h2>';
        $html .= '<form method="get" action="/admin" style="margin-bottom:12px;">'
            . '<input type="hidden" name="section" value="orders">'
            . '<div class="row-4">'
            . '<div><label>Search</label><input name="orders_q" value="' . dsa_h($ordersQuery) . '" placeholder="Order ID, customer email or name"></div>'
            . '<div><label>Status</label><select name="filter">'
            . '<option value="all"' . ($filter === 'all' ? ' selected' : '') . '>All</option>'
            . '<option value="pending_proof"' . ($filter === 'pending_proof' ? ' selected' : '') . '>Payment in progress</option>'
            . '<option value="paid"' . ($filter === 'paid' ? ' selected' : '') . '>Paid — setting up service</option>'
            . '<option value="fulfilled"' . ($filter === 'fulfilled' ? ' selected' : '') . '>Ready — service active</option>'
            . '<option value="cancelled"' . ($filter === 'cancelled' ? ' selected' : '') . '>Cancelled</option>'
            . '</select></div>'
            . '<div style="display:flex;align-items:flex-end;gap:8px"><button class="btn" type="submit">Apply</button><a class="btn-secondary" href="/admin?section=orders">Reset</a></div>'
            . '<div style="display:flex;align-items:flex-end;">'
            . '<form method="post" action="/admin/orders/backfill-service-details" style="margin:0;">'
            . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
            . '<button class="btn-secondary" type="submit">' . dsa_h(dsa_ui_label('orders.backfill_service_details')) . '</button></form>'
            . '</div>'
            . '</div></form>';
        $html .= '<p class="muted">Showing ' . dsa_h((string) count($orders)) . ' of ' . dsa_h((string) $ordersTotal) . ' orders (page ' . dsa_h((string) $ordersPage) . ' of ' . dsa_h((string) $ordersPages) . ')</p>';
        $html .= '<div class="table-wrap"><table><thead><tr><th>ID</th><th>Product</th><th>Customer</th><th>Amount</th><th>Status</th><th>' . dsa_h(dsa_ui_label('orders.lifecycle_dispatch')) . '</th><th>' . dsa_h(dsa_ui_label('orders.lifecycle_billing')) . '</th><th>' . dsa_h(dsa_ui_label('orders.lifecycle_provisioning')) . '</th><th>Proof</th><th>Manage</th></tr></thead><tbody>';
        foreach ($orders as $o) {
            $proofLink = trim((string) ($o['payment_proof_path'] ?? ''));
            $proofCell = $proofLink !== '' ? '<a href="' . dsa_h($proofLink) . '" target="_blank">View proof</a>' : '<span class="muted">none</span>';
            $adminOrderStatus = (string) $o['status'];
            $displayStatus = dsa_customer_order_status_label((array) $o);
            $statusContext = dsa_customer_order_status_context((array) $o);
            $statusLabel = dsa_status_pill($displayStatus);
            if ($displayStatus !== $adminOrderStatus) {
                $statusLabel .= '<br><span class="muted">Stored as: ' . dsa_h(dsa_admin_order_status_label($adminOrderStatus)) . '</span>';
            }
            if ($statusContext !== '') {
                $statusLabel .= '<br><span class="muted">' . dsa_h($statusContext) . '</span>';
            }
            if ((string) ($o['payment_method'] ?? '') !== '') {
                $statusLabel .= '<br><span class="muted">Method: ' . dsa_h((string) $o['payment_method']) . '</span>';
            }
            if ((string) ($o['delivery_value'] ?? '') !== '') {
                $statusLabel .= '<br><span class="muted">Delivery: ' . dsa_h((string) $o['delivery_value']) . '</span>';
            }
            $paymentMethod = (string) ($o['payment_method'] ?? '');
            $isGateway = dsa_is_gateway_payment_method($paymentMethod);
            $canApprovePayment = dsa_admin_can_approve_order_payment((array) $o);
            $canEditPaymentRef = dsa_admin_can_edit_order_payment_ref((array) $o);
            $paymentRefRaw = (string) ($o['payment_ref'] ?? '');
            $paymentRefValue = dsa_h($paymentRefRaw);
            $statusOptions = $isGateway
                ? dsa_admin_gateway_order_status_options($adminOrderStatus)
                : dsa_admin_order_status_options();
            if (
                $adminOrderStatus === 'paid'
                && dsa_order_needs_whmcs_provisioning((array) $o)
                && !dsa_order_whmcs_provisioning_complete((array) $o)
            ) {
                unset($statusOptions['fulfilled']);
            }
            $lifecycleCells = dsa_admin_lifecycle_status_cells((array) $o);
            $dispatchCell = $lifecycleCells['dispatch'];
            $billingCell = $lifecycleCells['billing'];
            $provisioningCell = $lifecycleCells['provisioning'];
            $canDispatch = dsa_admin_can_dispatch_order($pdo, (array) $o);
            $manage = '<form method="post" action="/admin/orders/update" class="admin-order-manage-form">'
                . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                . '<input type="hidden" name="id" value="' . dsa_h((string) $o['id']) . '">';
            if ($canEditPaymentRef) {
                $manage .= '<label>Payment reference</label>'
                    . '<input name="payment_ref" value="' . $paymentRefValue . '" placeholder="M-PESA code from customer proof">';
            } else {
                $manage .= '<p class="muted" style="margin:0 0 8px;"><strong>Payment reference</strong><br>'
                    . ($paymentRefRaw !== '' ? dsa_h($paymentRefRaw) : 'Assigned when customer starts payment')
                    . '</p>';
                if ($isGateway) {
                    $manage .= '<p class="muted" style="margin:0 0 8px;">Watu Technology M-PESA / gateway order — payment confirms automatically when M-PESA is received. Reference cannot be edited here.</p>';
                }
            }
            $manage .= '<label>Status</label><select name="status">';
            foreach ($statusOptions as $st => $stLabel) {
                $manage .= '<option value="' . dsa_h($st) . '"' . ($adminOrderStatus === $st ? ' selected' : '') . '>' . dsa_h($stLabel) . '</option>';
            }
            $manage .= '</select><div class="actions" style="margin-top:8px;flex-wrap:wrap;">'
                . '<button class="btn" type="submit">Save order</button>';
            if ($isGateway && $adminOrderStatus === 'pending_payment') {
                $manage .= '<button class="btn-secondary" type="submit" formaction="/admin/orders/sync-payment" title="' . dsa_h(dsa_ui_label('orders.sync_watupay_title')) . '">'
                    . dsa_h(dsa_ui_label('orders.sync_watupay')) . '</button>';
            }
            if ($canApprovePayment) {
                $manage .= '<button class="btn" type="submit" formaction="/admin/orders/action" name="action" value="approve_payment">Approve payment</button>';
            }
            $manage .= '</div></form>';
            if ($canDispatch) {
                $manage .= '<form method="post" action="/admin/orders/provision" style="margin-top:8px;">'
                    . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                    . '<input type="hidden" name="id" value="' . dsa_h((string) $o['id']) . '">'
                    . '<button class="btn" type="submit">' . dsa_h(dsa_ui_label('orders.dispatch_to_watu')) . '</button></form>';
            }
            if (dsa_admin_can_refresh_watu_order_status((array) $o)) {
                $manage .= '<form method="post" action="/admin/orders/refresh-watu-status" style="margin-top:8px;">'
                    . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                    . '<input type="hidden" name="id" value="' . dsa_h((string) $o['id']) . '">'
                    . '<button class="btn-secondary" type="submit" title="' . dsa_h(dsa_ui_label('orders.refresh_watu_status_title')) . '">'
                    . dsa_h(dsa_ui_label('orders.refresh_watu_status')) . '</button></form>';
            }
            if (dsa_admin_can_continue_order_on_watu((array) $o)) {
                $manage .= '<form method="post" action="/admin/orders/continue-on-watu" style="margin-top:8px;">'
                    . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                    . '<input type="hidden" name="id" value="' . dsa_h((string) $o['id']) . '">'
                    . '<button class="btn" type="submit" title="' . dsa_h(dsa_ui_label('orders.continue_on_watu_title')) . '">'
                    . dsa_h(dsa_ui_label('orders.continue_on_watu')) . '</button></form>';
            }
            if (
                $adminOrderStatus === 'fulfilled'
                && (
                    !dsa_order_needs_whmcs_provisioning((array) $o)
                    || dsa_order_whmcs_provisioning_complete((array) $o)
                )
            ) {
                $manage .= '<form method="post" action="/admin/orders/action" style="margin-top:8px;">'
                    . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                    . '<input type="hidden" name="id" value="' . dsa_h((string) $o['id']) . '">'
                    . '<input type="hidden" name="action" value="resend_email">'
                    . '<button class="btn-secondary" type="submit">Resend email</button></form>';
            }
            $rowCls = 'row-' . preg_replace('/[^a-z0-9_-]/', '', strtolower($adminOrderStatus));
            $html .= '<tr class="' . dsa_h($rowCls) . '"><td>' . dsa_h((string) $o['id']) . '</td><td>' . dsa_h((string) $o['product_name']) . '</td><td>' . dsa_h((string) $o['customer_name']) . '<br><span class="muted">' . dsa_h((string) $o['customer_email']) . '</span></td><td>' . dsa_h(dsa_money((int) $o['amount_cents'], (string) $o['currency'])) . '</td><td>' . $statusLabel . '</td><td>' . $dispatchCell . '</td><td>' . $billingCell . '</td><td>' . $provisioningCell . '</td><td>' . $proofCell . '</td><td>' . $manage . '</td></tr>';
        }
        if (count($orders) === 0) {
            $html .= '<tr><td colspan="10">' . dsa_empty_state('No orders found', 'Try a different filter or search term.') . '</td></tr>';
        }
        $html .= '</tbody></table></div>';
        if ($ordersPages > 1) {
            $prevUrl = dsa_build_admin_url(['section' => 'orders', 'filter' => $filter, 'orders_q' => $ordersQuery, 'orders_page' => max(1, $ordersPage - 1)]);
            $nextUrl = dsa_build_admin_url(['section' => 'orders', 'filter' => $filter, 'orders_q' => $ordersQuery, 'orders_page' => min($ordersPages, $ordersPage + 1)]);
            $html .= '<div class="pagination">'
                . ($ordersPage > 1 ? '<a class="btn-secondary" href="' . dsa_h($prevUrl) . '">Previous</a>' : '<span class="muted">Previous</span>')
                . '<span class="muted">Page ' . dsa_h((string) $ordersPage) . ' of ' . dsa_h((string) $ordersPages) . '</span>'
                . ($ordersPage < $ordersPages ? '<a class="btn-secondary" href="' . dsa_h($nextUrl) . '">Next</a>' : '<span class="muted">Next</span>')
                . '</div>';
        }
        $html .= '</div>';
    }

    if ($section === 'customers') {
        $html .= '<div class="card"><h2>Customers</h2><p class="muted">Search customers, inspect order history, and login as customer for support.</p>';
        $html .= '<form method="get" action="/admin"><input type="hidden" name="section" value="customers"><div class="row-4">'
            . '<div><label>Search</label><input name="customers_q" value="' . dsa_h($customersQuery) . '" placeholder="name, email, phone"></div>'
            . '<div><label>Status</label><select name="customers_status"><option value="all"' . ($customersStatus === 'all' ? ' selected' : '') . '>all customers</option><option value="with_orders"' . ($customersStatus === 'with_orders' ? ' selected' : '') . '>with orders</option><option value="without_orders"' . ($customersStatus === 'without_orders' ? ' selected' : '') . '>without orders</option></select></div>'
            . '<div><label>Sort</label><select name="customers_sort"><option value="recent"' . ($customersSort === 'recent' ? ' selected' : '') . '>recent activity</option><option value="orders"' . ($customersSort === 'orders' ? ' selected' : '') . '>most orders</option><option value="name"' . ($customersSort === 'name' ? ' selected' : '') . '>name</option><option value="email"' . ($customersSort === 'email' ? ' selected' : '') . '>email</option></select></div>'
            . '<div style="display:flex;align-items:flex-end;gap:8px"><button class="btn" type="submit">Apply</button><a class="btn-secondary" href="/admin?section=customers">Reset</a></div>'
            . '</div></form>';
        $html .= '<p class="muted" style="margin-top:10px">Showing ' . dsa_h((string) count($customers)) . ' customers.</p>';
        $html .= '<div class="table-wrap"><table><thead><tr><th>Customer</th><th>Orders</th><th>Lifetime</th><th>Last Order</th><th>Actions</th></tr></thead><tbody>';
        foreach ($customers as $customer) {
            $focusLink = dsa_build_admin_url([
                'section' => 'customers',
                'customers_q' => $customersQuery,
                'customers_status' => $customersStatus,
                'customers_sort' => $customersSort,
                'customer_id' => (int) ($customer['id'] ?? 0),
            ]);
            $html .= '<tr><td><strong>' . dsa_h((string) ($customer['name'] ?? '')) . '</strong><br><span class="muted">' . dsa_h((string) ($customer['email'] ?? '')) . '</span>';
            if (trim((string) ($customer['phone'] ?? '')) !== '') {
                $html .= '<br><span class="muted">' . dsa_h((string) $customer['phone']) . '</span>';
            }
            $html .= '</td><td>' . dsa_h((string) ((int) ($customer['order_count'] ?? 0))) . '</td>'
                . '<td>' . dsa_h(dsa_money((int) ($customer['total_spend_cents'] ?? 0), DSA_DEFAULT_CURRENCY)) . '</td>'
                . '<td>' . dsa_h((string) (($customer['last_order_at'] ?? '') !== '' ? $customer['last_order_at'] : 'n/a')) . '</td>'
                . '<td><a class="btn-secondary" href="' . dsa_h($focusLink) . '">View</a>'
                . '<form method="post" action="/admin/customers/login-as" style="margin-top:6px;">'
                . '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">'
                . '<input type="hidden" name="customer_id" value="' . dsa_h((string) ($customer['id'] ?? '')) . '">'
                . '<input type="hidden" name="customer_email" value="' . dsa_h((string) ($customer['email'] ?? '')) . '">'
                . '<input type="hidden" name="return_section" value="customers">'
                . '<button class="btn" type="submit">Login As Customer</button></form></td></tr>';
        }
        if (count($customers) === 0) {
            $html .= '<tr><td colspan="5"><span class="muted">No customers found for current filters.</span></td></tr>';
        }
        $html .= '</tbody></table></div></div>';

        if ($focusCustomer) {
            $html .= '<div class="card"><h2>Customer Detail</h2>';
            $html .= '<p><strong>' . dsa_h((string) ($focusCustomer['name'] ?? '')) . '</strong><br>'
                . '<span class="muted">' . dsa_h((string) ($focusCustomer['email'] ?? '')) . '</span>';
            if (trim((string) ($focusCustomer['phone'] ?? '')) !== '') {
                $html .= '<br><span class="muted">' . dsa_h((string) $focusCustomer['phone']) . '</span>';
            }
            $html .= '</p>';
            $html .= '<p class="muted">Joined: ' . dsa_h((string) ($focusCustomer['created_at'] ?? 'n/a'))
                . ' | Orders: ' . dsa_h((string) ((int) ($focusCustomer['order_count'] ?? 0)))
                . ' | Lifetime spend: ' . dsa_h(dsa_money((int) ($focusCustomer['total_spend_cents'] ?? 0), DSA_DEFAULT_CURRENCY)) . '</p>';
            $html .= '<h3 style="margin:12px 0 8px 0;">Recent Orders</h3>';
            $html .= '<table><thead><tr><th>Order</th><th>Product</th><th>Amount</th><th>Status</th><th>Payment</th><th>Created</th></tr></thead><tbody>';
            foreach ($focusCustomerOrders as $customerOrder) {
                $html .= '<tr><td>#' . dsa_h((string) $customerOrder['id']) . '</td>'
                    . '<td>' . dsa_h((string) $customerOrder['product_name']) . '</td>'
                    . '<td>' . dsa_h(dsa_money((int) $customerOrder['amount_cents'], (string) $customerOrder['currency'])) . '</td>'
                    . '<td>' . dsa_status_pill((string) $customerOrder['status']) . '</td>'
                    . '<td>' . dsa_h((string) (($customerOrder['payment_method'] ?? '') !== '' ? $customerOrder['payment_method'] : 'n/a')) . '</td>'
                    . '<td>' . dsa_h((string) $customerOrder['created_at']) . '</td></tr>';
            }
            if (count($focusCustomerOrders) === 0) {
                $html .= '<tr><td colspan="6"><span class="muted">No orders yet.</span></td></tr>';
            }
            $html .= '</tbody></table></div>';
        }
    }

    if ($section === 'support') {
        $html .= dsa_render_admin_support_section($pdo, $notice);
    }

    dsa_render_layout('Admin', $html);
}

function dsa_whmcs_portal_base_url(PDO $pdo): string
{
    $apiUrl = trim(dsa_setting($pdo, 'catalog_sync_whmcs_api_url', ''));
    if ($apiUrl === '') {
        return '';
    }
    $base = preg_replace('#/modules/.*$#', '', $apiUrl);
    return is_string($base) ? rtrim($base, '/') : '';
}

function dsa_client_area_nav(string $active): string
{
    $tabs = [
        'overview' => ['label' => 'Overview', 'path' => '/client-area'],
        'orders' => ['label' => 'Orders', 'path' => '/client-area/orders'],
        'products' => ['label' => 'My Products', 'path' => '/client-area/products'],
        'billing' => ['label' => 'Billing', 'path' => '/client-area/billing'],
        'support' => ['label' => 'Support', 'path' => '/client-area/support'],
        'profile' => ['label' => 'Profile', 'path' => '/client-area/profile'],
    ];
    $html = '<nav class="client-area-nav" aria-label="Client area">';
    foreach ($tabs as $key => $tab) {
        $isActive = $key === $active;
        if (($active === 'tickets' || $active === 'knowledgebase') && $key === 'support') {
            $isActive = true;
        }
        $class = $isActive ? 'active' : '';
        $html .= '<a class="' . $class . '" href="' . dsa_h($tab['path']) . '">' . dsa_h($tab['label']) . '</a>';
    }
    $html .= '</nav>';
    return $html;
}

function dsa_client_support_subnav(string $active): string
{
    $tabs = [
        'hub' => ['label' => 'Support Home', 'path' => '/client-area/support'],
        'tickets' => ['label' => 'Tickets', 'path' => '/client-area/support/tickets'],
        'knowledgebase' => ['label' => 'Knowledge Base', 'path' => '/client-area/support/knowledgebase'],
    ];
    $html = '<nav class="client-subnav" aria-label="Support">';
    foreach ($tabs as $key => $tab) {
        $class = $key === $active ? 'active' : '';
        $html .= '<a class="' . $class . '" href="' . dsa_h($tab['path']) . '">' . dsa_h($tab['label']) . '</a>';
    }
    $html .= '</nav>';
    return $html;
}

function dsa_render_client_overview(PDO $pdo, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    if ($clientId <= 0) {
        dsa_render_client_login('Please login.');
        return;
    }
    $orderStmt = $pdo->prepare('select count(*) from orders where customer_id = :id');
    $orderStmt->execute([':id' => $clientId]);
    $orderCount = (int) $orderStmt->fetchColumn();
    $productStmt = $pdo->prepare("select count(*) from orders where customer_id = :id and status in ('paid', 'fulfilled')");
    $productStmt->execute([':id' => $clientId]);
    $productCount = (int) $productStmt->fetchColumn();
    $ticketStmt = $pdo->prepare("select count(*) from support_tickets where customer_id = :id and status in ('open', 'in_progress', 'awaiting_customer')");
    $ticketStmt->execute([':id' => $clientId]);
    $openTickets = (int) $ticketStmt->fetchColumn();

    $email = (string) ($_SESSION['dsa_client_email'] ?? '');
    $html = '<div class="card"><h1>Client Area</h1><p class="muted">Signed in as ' . dsa_h($email) . '</p><div class="actions"><a class="btn-secondary" href="/client-area/logout">Logout</a></div>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= dsa_client_area_nav('overview') . '</div>';

    $html .= '<div class="kpi-grid" style="margin-bottom:14px;">';
    $html .= '<div class="kpi"><strong>' . $orderCount . '</strong><span class="muted">Orders</span><div style="margin-top:8px;"><a href="/client-area/orders">View orders</a></div></div>';
    $html .= '<div class="kpi"><strong>' . $productCount . '</strong><span class="muted">Products &amp; services</span><div style="margin-top:8px;"><a href="/client-area/products">Manage products</a></div></div>';
    $html .= '<div class="kpi"><strong>' . $openTickets . '</strong><span class="muted">Open tickets</span><div style="margin-top:8px;"><a href="/client-area/support/tickets">Get support</a></div></div>';
    $html .= '</div>';

    $html .= '<div class="card"><h2>Quick links</h2><div class="actions">';
    $html .= '<a class="btn-secondary" href="/client-area/orders">Orders &amp; payments</a>';
    $html .= '<a class="btn-secondary" href="/client-area/products">My products</a>';
    $html .= '<a class="btn-secondary" href="/client-area/support">Support center</a>';
    $html .= '<a class="btn-secondary" href="/client-area/support/knowledgebase">Knowledge base</a>';
    $html .= '<a class="btn-secondary" href="/client-area/profile">My profile</a>';
    $html .= '</div><p class="muted" style="margin-top:12px;">Orders show checkout and payment history. My Products is where you manage active services after provisioning.</p></div>';

    dsa_render_layout('Client area', $html);
}

function dsa_render_client_orders_list(PDO $pdo, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    if ($clientId <= 0) {
        dsa_render_client_login('Please login.');
        return;
    }
    $clientOrdersPerPage = 20;
    $clientOrdersPage = max(1, (int) ($_GET['page'] ?? 1));
    $clientOrdersTotalStmt = $pdo->prepare('select count(*) from orders where customer_id = :customer_id');
    $clientOrdersTotalStmt->execute([':customer_id' => $clientId]);
    $clientOrdersTotal = (int) $clientOrdersTotalStmt->fetchColumn();
    $clientOrdersPages = max(1, (int) ceil($clientOrdersTotal / $clientOrdersPerPage));
    if ($clientOrdersPage > $clientOrdersPages) {
        $clientOrdersPage = $clientOrdersPages;
    }
    $clientOrdersOffset = ($clientOrdersPage - 1) * $clientOrdersPerPage;
    $stmt = $pdo->prepare(
        "select o.id, o.status, o.amount_cents, o.currency, o.payment_ref, o.delivery_value, o.created_at,
                p.name as product_name
         from orders o
         join products p on p.id = o.product_id
         where o.customer_id = :customer_id
         order by o.id desc
         limit " . (int) $clientOrdersPerPage . ' offset ' . (int) $clientOrdersOffset
    );
    $stmt->execute([':customer_id' => $clientId]);
    $orders = $stmt->fetchAll();

    $email = (string) ($_SESSION['dsa_client_email'] ?? '');
    $html = '<div class="card"><h1>Client Area</h1><p class="muted">Signed in as ' . dsa_h($email) . '</p><div class="actions"><a class="btn-secondary" href="/client-area/logout">Logout</a></div>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= dsa_client_area_nav('orders') . '</div>';

    $html .= '<div class="card"><h2>Orders</h2><p class="muted">Purchase records, payment status, and checkout history.</p>';
    if ($clientOrdersTotal === 0) {
        $html .= dsa_empty_state('No orders yet', 'Products you purchase will appear here.', 'Browse Store', '/');
    } else {
        $html .= '<div class="table-wrap"><table><thead><tr><th>Order</th><th>Product</th><th>Amount</th><th>Status</th><th>Actions</th></tr></thead><tbody>';
        foreach ($orders as $o) {
            $status = (string) $o['status'];
            $statusLabel = dsa_customer_order_status_label((array) $o);
            $orderLabel = trim((string) ($o['product_name'] ?? ''));
            if ($orderLabel === '') {
                $orderLabel = 'Order';
            }
            $actions = '<div class="actions"><a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $o['id']) . '">Order details</a>';
            if (in_array($status, ['paid', 'fulfilled'], true)) {
                $actions .= '<a class="btn-secondary" href="/client-area/product/' . dsa_h((string) $o['id']) . '">Manage product</a>';
            }
            if ($status === 'pending_payment') {
                $payLabel = $statusLabel === 'payment_submitted' ? 'Continue payment' : 'Pay';
                $actions .= '<a class="btn" href="/order/' . dsa_h((string) $o['id']) . '/payment">' . dsa_h($payLabel) . '</a>';
            }
            $actions .= '</div>';
            $rowClass = 'row-' . $statusLabel;
            $html .= '<tr class="' . dsa_h($rowClass) . '"><td>#' . dsa_h((string) $o['id']) . '</td><td>' . dsa_h($orderLabel) . '</td><td>' . dsa_h(dsa_money((int) $o['amount_cents'], (string) $o['currency'])) . '</td><td>' . dsa_status_pill($statusLabel) . (($status === 'pending_payment' && $statusLabel === 'payment_submitted') ? '<br><span class="muted" style="font-size:12px;">Awaiting confirmation</span>' : '') . '</td><td>' . $actions . '</td></tr>';
        }
        $html .= '</tbody></table></div>';
        if ($clientOrdersPages > 1) {
            $html .= '<div class="pagination">'
                . ($clientOrdersPage > 1 ? '<a class="btn-secondary" href="/client-area/orders?page=' . ($clientOrdersPage - 1) . '">Previous</a>' : '<span class="muted">Previous</span>')
                . '<span class="muted">Page ' . dsa_h((string) $clientOrdersPage) . ' of ' . dsa_h((string) $clientOrdersPages) . '</span>'
                . ($clientOrdersPage < $clientOrdersPages ? '<a class="btn-secondary" href="/client-area/orders?page=' . ($clientOrdersPage + 1) . '">Next</a>' : '<span class="muted">Next</span>')
                . '</div>';
        }
    }
    $html .= '</div>';
    dsa_render_layout('Client orders', $html);
}

function dsa_render_client_products_list(PDO $pdo, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    if ($clientId <= 0) {
        dsa_render_client_login('Please login.');
        return;
    }
    $stmt = $pdo->prepare(
        "select o.id, o.status, o.amount_cents, o.currency, o.updated_at, o.delivery_value,
                p.name as product_name, p.description as product_description
         from orders o
         join products p on p.id = o.product_id
         where o.customer_id = :customer_id and o.status in ('paid', 'fulfilled')
         order by o.updated_at desc, o.id desc
         limit 100"
    );
    $stmt->execute([':customer_id' => $clientId]);
    $products = $stmt->fetchAll();

    $email = (string) ($_SESSION['dsa_client_email'] ?? '');
    $html = '<div class="card"><h1>Client Area</h1><p class="muted">Signed in as ' . dsa_h($email) . '</p><div class="actions"><a class="btn-secondary" href="/client-area/logout">Logout</a></div>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= dsa_client_area_nav('products') . '</div>';

    $html .= '<div class="card"><h2>My Products</h2><p class="muted">Active and provisioning services tied to your account. Manage delivery access, credentials, and service details here.</p>';
    if (count($products) === 0) {
        $html .= dsa_empty_state('No active products yet', 'Fulfilled or provisioning purchases will appear here.', 'View orders', '/client-area/orders');
    } else {
        $html .= '<div class="table-wrap"><table><thead><tr><th>Product</th><th>Order</th><th>Status</th><th>Last update</th><th>Actions</th></tr></thead><tbody>';
        foreach ($products as $row) {
            $name = trim((string) ($row['product_name'] ?? ''));
            if ($name === '') {
                $name = 'Product';
            }
            $html .= '<tr><td><strong>' . dsa_h($name) . '</strong><br><span class="muted">' . dsa_h(substr(trim((string) ($row['product_description'] ?? '')), 0, 80)) . '</span></td>'
                . '<td>#' . dsa_h((string) $row['id']) . '</td>'
                . '<td>' . dsa_status_pill(dsa_customer_order_status_label((array) $row)) . '</td>'
                . '<td>' . dsa_h((string) ($row['updated_at'] ?? '')) . '</td>'
                . '<td><div class="actions"><a class="btn" href="/client-area/product/' . dsa_h((string) $row['id']) . '">Manage</a>'
                . '<a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $row['id']) . '">Order</a></div></td></tr>';
        }
        $html .= '</tbody></table></div>';
    }
    $html .= '</div>';
    dsa_render_layout('My products', $html);
}

function dsa_render_client_support_hub(PDO $pdo, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    if ($clientId <= 0) {
        dsa_render_client_login('Please login.');
        return;
    }
    $email = (string) ($_SESSION['dsa_client_email'] ?? '');
    $html = '<div class="card"><h1>Client Area</h1><p class="muted">Signed in as ' . dsa_h($email) . '</p><div class="actions"><a class="btn-secondary" href="/client-area/logout">Logout</a></div>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= dsa_client_area_nav('support') . '</div>';

    $html .= dsa_client_support_subnav('hub');
    $html .= '<div class="card"><h2>Support Center</h2><p class="muted">Get help with orders, billing, and active services.</p>';
    $html .= '<div class="support-grid">';
    $html .= '<div class="support-card"><h3 style="margin:0;">Support tickets</h3><p class="muted" style="margin:0;">Open a ticket for billing, provisioning, or technical questions.</p><a class="btn" href="/client-area/support/tickets">Open tickets</a></div>';
    $html .= '<div class="support-card"><h3 style="margin:0;">Knowledge base</h3><p class="muted" style="margin:0;">Self-service guides for payments, products, and common questions.</p><a class="btn-secondary" href="/client-area/support/knowledgebase">Browse articles</a></div>';
    $html .= '</div></div>';
    dsa_render_layout('Support', $html);
}

function dsa_render_client_tickets(PDO $pdo, string $error, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    if ($clientId <= 0) {
        dsa_render_client_login('Please login.');
        return;
    }
    $tickets = $pdo->prepare('select id, order_id, subject, status, created_at, updated_at, last_reply_at, last_reply_by from support_tickets where customer_id = :id order by coalesce(last_reply_at, updated_at, created_at) desc limit 50');
    $tickets->execute([':id' => $clientId]);
    $ticketRows = $tickets->fetchAll();
    $orderOptions = $pdo->prepare('select id from orders where customer_id = :id order by id desc limit 50');
    $orderOptions->execute([':id' => $clientId]);
    $orders = $orderOptions->fetchAll();

    $email = (string) ($_SESSION['dsa_client_email'] ?? '');
    $html = '<div class="card"><h1>Client Area</h1><p class="muted">Signed in as ' . dsa_h($email) . '</p><div class="actions"><a class="btn-secondary" href="/client-area/logout">Logout</a></div>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= dsa_client_area_nav('tickets') . '</div>';
    $html .= dsa_client_support_subnav('tickets');

    $html .= '<div class="card"><h2>Support tickets</h2>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    if (count($ticketRows) === 0) {
        $html .= '<p class="muted">No tickets yet.</p>';
    } else {
        $html .= '<div class="table-wrap"><table><thead><tr><th>Ticket</th><th>Subject</th><th>Order</th><th>Status</th><th>Last update</th><th></th></tr></thead><tbody>';
        foreach ($ticketRows as $ticket) {
            $ticketId = (int) ($ticket['id'] ?? 0);
            $orderRef = (int) ($ticket['order_id'] ?? 0) > 0 ? '#' . (int) $ticket['order_id'] : '—';
            $html .= '<tr><td>#' . dsa_h((string) $ticketId) . '</td><td>' . dsa_h((string) $ticket['subject']) . '</td><td>' . dsa_h($orderRef) . '</td><td>' . dsa_ticket_status_pill((string) ($ticket['status'] ?? 'open')) . '</td><td>' . dsa_h((string) ($ticket['last_reply_at'] ?? $ticket['updated_at'] ?? $ticket['created_at'] ?? '')) . '</td><td><a class="btn-secondary" href="/client-area/support/tickets/' . dsa_h((string) $ticketId) . '">Open</a></td></tr>';
        }
        $html .= '</tbody></table></div>';
    }
    $html .= '</div>';

    $html .= '<div class="card"><h2>New ticket</h2><form method="post" action="/client-area/support/tickets">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<label>Subject</label><input name="subject" required maxlength="191">';
    $html .= '<label>Related order (optional)</label><select name="order_id"><option value="0">None</option>';
    foreach ($orders as $orderRow) {
        $html .= '<option value="' . (int) $orderRow['id'] . '">Order #' . (int) $orderRow['id'] . '</option>';
    }
    $html .= '</select>';
    $html .= '<label>Message</label><textarea name="message" rows="5" required></textarea>';
    $html .= '<p class="muted" style="margin-top:8px;">You will receive email updates and can reply by email or on this platform.</p>';
    $html .= '<div class="actions" style="margin-top:12px;"><button class="btn" type="submit">Submit ticket</button></div></form></div>';
    dsa_render_layout('Support tickets', $html);
}

function dsa_render_client_dashboard(PDO $pdo, string $notice): void
{
    dsa_render_client_overview($pdo, $notice);
}

function dsa_render_client_order(PDO $pdo, int $orderId, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    $stmt = $pdo->prepare(
        "select o.id, o.customer_email, o.status, o.amount_cents, o.currency, o.payment_ref, o.payment_method, o.payment_proof_path, o.payment_proof_note,
                o.delivery_value, o.service_details_json, o.whmcs_dispatch_status, o.whmcs_dispatch_message,
                o.created_at, o.updated_at, p.name as product_name, p.fulfillment_type
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id and o.customer_id = :customer_id
         limit 1"
    );
    $stmt->execute([':id' => $orderId, ':customer_id' => $clientId]);
    $order = $stmt->fetch();
    if (!$order) {
        dsa_render_client_dashboard($pdo, 'Order not found.');
        return;
    }
    dsa_sync_paid_signal_from_whmcs($pdo, $orderId);
    dsa_try_confirm_gateway_payment($pdo, $orderId, true);
    $stmt->execute([':id' => $orderId, ':customer_id' => $clientId]);
    $order = $stmt->fetch() ?: $order;
    if ((string) ($order['status'] ?? '') === 'paid') {
        dsa_on_order_became_paid($pdo, $orderId);
        $stmt->execute([':id' => $orderId, ':customer_id' => $clientId]);
        $order = $stmt->fetch() ?: $order;
    }

    $timeline = dsa_build_order_timeline($order);
    $orderLabel = trim((string) ($order['product_name'] ?? ''));
    if ($orderLabel === '') {
        $orderLabel = 'Order';
    }
    $clientStatusLabel = dsa_customer_order_status_label((array) $order);

    // Build "next step" card content to display at top
    $nextStepHtml = '';
    if ((string) $order['status'] === 'fulfilled') {
        if ((string) $order['delivery_value'] !== '' && (string) $order['fulfillment_type'] !== 'license_key') {
            $nextStepHtml = '<a class="btn" href="' . dsa_h((string) $order['delivery_value']) . '">Open Delivery</a>';
        } else {
            $nextStepHtml = '<a class="btn" href="/client-area/product/' . dsa_h((string) $order['id']) . '">Manage product</a>';
        }
    } elseif ((string) $order['status'] === 'paid') {
        if (dsa_demo_mode_active($pdo) || dsa_order_is_demo_paid_no_provision((array) $order)) {
            $nextStepHtml = '<p class="muted" style="margin:0;">' . dsa_h(dsa_demo_mode_paid_notice()) . '</p>';
        } else {
            $nextStepHtml = '<p class="muted" style="margin:0;">Payment confirmed. Provisioning is in progress — we\'ll notify you when ready. <a href="/client-area/product/' . dsa_h((string) $order['id']) . '">View product status</a></p>';
        }
    } elseif ($clientStatusLabel === 'payment_submitted') {
        $paymentMethod = (string) ($order['payment_method'] ?? '');
        if (dsa_is_gateway_payment_method($paymentMethod)) {
            $nextStepHtml = '<a class="btn" href="/order/' . dsa_h((string) $order['id']) . '/payment">Continue payment</a>'
                . '<p class="muted" style="margin:8px 0 0;">Didn\'t get the M-PESA prompt? Open payment to resend or update your phone number.</p>';
        } else {
            $nextStepHtml = '<p class="muted" style="margin:0;">We received your payment request and are waiting for confirmation.</p>';
        }
    } else {
        $nextStepHtml = '<a class="btn" href="/order/' . dsa_h((string) $order['id']) . '/payment">Pay Now</a>';
    }

    $html = '<div class="card">';
    $html .= '<p class="page-context">Purchase record · <a href="/client-area/orders">All orders</a></p>';
    $html .= '<h1>Order #' . dsa_h((string) $order['id']) . '</h1>';
    $html .= '<p class="muted">Payment, billing, and checkout details for this purchase.</p>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }

    // Prominent next-step card at top
    $html .= '<div class="card" style="background:var(--bg-surface);border-color:var(--accent);margin-bottom:14px;">'
        . '<h3 style="margin-top:0;">Next step</h3>'
        . '<div class="actions" style="margin-bottom:8px;">' . $nextStepHtml . '</div>'
        . '<p style="margin:0;"><strong>Status:</strong> ' . dsa_status_pill($clientStatusLabel) . '</p>';
    $statusContext = dsa_customer_order_status_context((array) $order);
    if ($statusContext !== '') {
        $html .= '<p class="muted" style="margin:8px 0 0;">' . dsa_h($statusContext) . '</p>';
    }
    $html .= '</div>';

    $html .= '<h3>Payment summary</h3>';
    $html .= '<p><strong>Product purchased:</strong> ' . dsa_h($orderLabel) . '</p>';
    $html .= '<p><strong>Order total:</strong> ' . dsa_h(dsa_money((int) $order['amount_cents'], (string) $order['currency'])) . '</p>';
    $html .= '<p class="muted"><strong>Ordered:</strong> ' . dsa_h((string) ($order['created_at'] ?? '')) . ' · <strong>Last update:</strong> ' . dsa_h((string) ($order['updated_at'] ?? '')) . '</p>';
    if ((string) $order['status'] === 'pending_payment' && $clientStatusLabel === 'payment_submitted') {
        $html .= '<p class="muted">Payment request submitted. Waiting for successful payment confirmation.</p>';
    }
    if (trim((string) $order['payment_ref']) !== '') {
        $html .= '<p class="muted">Payment Ref: ' . dsa_h((string) $order['payment_ref']) . '</p>';
    }
    if ((string) ($order['payment_method'] ?? '') !== '') {
        $methodLabel = dsa_payment_method_display_label($pdo, (string) $order['payment_method']);
        $html .= '<p class="muted">Payment Option: ' . dsa_h($methodLabel) . '</p>';
    }
    if ((string) $order['payment_proof_path'] !== '') {
        $html .= '<p><a href="' . dsa_h((string) $order['payment_proof_path']) . '" target="_blank">View uploaded proof</a></p>';
    }
    $itemsTable = dsa_render_order_items_table($pdo, (int) $order['id']);
    if ($itemsTable !== '') {
        $html .= '<h3>Line items</h3>' . $itemsTable;
    }
    $html .= '<h3>Order progress</h3>';
    foreach ($timeline as $item) {
        $html .= '<p>' . ($item['done'] ? '✅ ' : '⏳ ') . dsa_h($item['label']) . '</p>';
    }
    if (in_array((string) $order['status'], ['paid', 'fulfilled'], true)) {
        $html .= '<p class="muted" style="margin-top:12px;">Service credentials and delivery access are on the <a href="/client-area/product/' . dsa_h((string) $order['id']) . '">product management page</a>.</p>';
    }
    $html .= '<div class="actions" style="margin-top:12px;">';
    if ((string) $order['status'] === 'pending_payment') {
        $html .= '<a class="btn" href="/order/' . dsa_h((string) $order['id']) . '/payment">'
            . dsa_h($clientStatusLabel === 'payment_submitted' ? 'Continue payment' : 'Pay now')
            . '</a>';
    }
    $html .= '<a class="btn-secondary" href="/client-area/orders">Back to orders</a>'
        . '<a class="btn-secondary" href="/client-area">Client area</a>'
        . '</div>';
    if ($clientStatusLabel === 'payment_submitted' && dsa_is_gateway_payment_method((string) ($order['payment_method'] ?? ''))) {
        $html .= '<script>(function(){var orderId=' . json_encode((string) $order['id']) . ';if(!orderId){return;}'
            . 'var pollBusy=false;var poll=function(){if(pollBusy){return;}pollBusy=true;'
            . 'fetch("/order/"+encodeURIComponent(orderId)+"/payment/status",{credentials:"same-origin",headers:{"Accept":"application/json"},cache:"no-store"})'
            . '.then(function(r){return r.json();}).then(function(j){'
            . 'if(j&&j.ok&&j.paid){window.location.href=(j.redirect_url||("/client-area/order/"+encodeURIComponent(orderId)));return;}'
            . 'pollBusy=false;}).catch(function(){pollBusy=false;});};'
            . 'setInterval(poll,1000);poll();})();</script>';
    }
    $html .= '</div>';
    dsa_render_layout('Client order', $html);
}

function dsa_render_client_product_manage(PDO $pdo, int $orderId, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    $stmt = $pdo->prepare(
        "select o.id, o.status, o.amount_cents, o.currency, o.payment_ref, o.payment_proof_path, o.delivery_value, o.service_details_json, o.service_asset_json,
                o.whmcs_order_id, o.whmcs_invoice_id, o.whmcs_service_id, o.whmcs_domain_id, o.whmcs_dispatch_status, o.customer_email, o.customer_id, o.updated_at, o.notify_opt_in,
                p.name as product_name, p.description as product_description, p.fulfillment_type, p.slug as product_slug, p.catalog_product_id, p.provisioning_profile
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id and o.customer_id = :customer_id
         limit 1"
    );
    $stmt->execute([':id' => $orderId, ':customer_id' => $clientId]);
    $order = $stmt->fetch();
    if (!$order) {
        dsa_render_client_dashboard($pdo, 'Product not found for your account.');
        return;
    }

    $productLabel = trim((string) ($order['product_name'] ?? ''));
    if ($productLabel === '') {
        $productLabel = 'Product';
    }

    $html = '<div class="card">';
    $html .= '<p class="page-context">Active service · <a href="/client-area/products">All products</a> · Order <a href="/client-area/order/' . dsa_h((string) $order['id']) . '">#' . dsa_h((string) $order['id']) . '</a></p>';
    $html .= '<h1>' . dsa_h($productLabel) . '</h1>';
    $html .= '<p class="muted">Manage your provisioned service, delivery access, and technical details.</p>';
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $productStatusLabel = dsa_customer_order_status_label((array) $order);
    $html .= '<p><strong>Service status:</strong> ' . dsa_status_pill($productStatusLabel) . '</p>';
    $productStatusContext = dsa_customer_order_status_context((array) $order);
    if ($productStatusContext !== '') {
        $html .= '<p class="muted">' . dsa_h($productStatusContext) . '</p>';
    }
    $html .= '<p class="muted">' . dsa_h((string) $order['product_description']) . '</p>';
    $html .= '<p class="muted">Last update: ' . dsa_h((string) $order['updated_at']) . '</p>';
    $html .= '</div>';
    $html .= dsa_render_service_details_card((array) $order);
    if (in_array((string) ($order['status'] ?? ''), ['paid', 'fulfilled'], true)) {
        $html .= dsa_enhance_client_product_manage($pdo, (array) $order, '');
    }

    $sourceProductId = dsa_order_source_product_id((array) $order);
    if ($sourceProductId > 0) {
        $kbArticles = dsa_kb_client_articles($pdo, $clientId, $sourceProductId);
        if (count($kbArticles) > 0) {
            $html .= '<details class="card dsa-kb-compact" style="padding:12px 16px;margin-top:12px;">';
            $html .= '<summary style="cursor:pointer;font-weight:600;">Help articles (' . count($kbArticles) . ')</summary>';
            $html .= '<ul style="margin:10px 0 0;padding-left:18px;font-size:13px;line-height:1.5;">';
            foreach ($kbArticles as $kbArticle) {
                $kbId = (int) ($kbArticle['id'] ?? 0);
                $kbTitle = trim((string) ($kbArticle['title'] ?? ''));
                if ($kbId <= 0 || $kbTitle === '') {
                    continue;
                }
                $html .= '<li style="margin-bottom:4px;"><a href="/client-area/support/knowledgebase/' . $kbId . '">' . dsa_h($kbTitle) . '</a></li>';
            }
            $html .= '</ul>';
            $html .= '<p class="muted" style="margin:8px 0 0;font-size:12px;"><a href="/client-area/support/knowledgebase">All articles</a></p>';
            $html .= '</details>';
        }
    }

    $html .= '<div class="card"><h2>Delivery &amp; support</h2><div class="actions">';
    if ((string) $order['status'] === 'fulfilled' && (string) $order['delivery_value'] !== '') {
        if ((string) $order['fulfillment_type'] === 'license_key') {
            $html .= '<p><strong>License key:</strong> <code>' . dsa_h((string) $order['delivery_value']) . '</code></p>';
        } else {
            $html .= '<a class="btn" href="' . dsa_h((string) $order['delivery_value']) . '">Open delivery</a>';
        }
    }
    if ((string) $order['status'] !== 'fulfilled') {
        $html .= '<a class="btn" href="/order/' . dsa_h((string) $order['id']) . '/payment">Complete payment</a>';
    }
    $html .= '<a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $order['id']) . '">View order &amp; payment</a>';
    $html .= '<a class="btn-secondary" href="/client-area/support/tickets">Get support</a>';
    $html .= '</div>';
    if ((string) $order['payment_proof_path'] !== '') {
        $html .= '<p style="margin-top:12px;"><a href="' . dsa_h((string) $order['payment_proof_path']) . '" target="_blank">View submitted payment proof</a></p>';
    }
    $html .= '<p class="muted" style="margin-top:12px;">Billing details and invoices are on the <a href="/client-area/billing?order=' . dsa_h((string) $order['id']) . '">billing page</a>.</p>';
    $html .= '<div class="actions" style="margin-top:12px;">'
        . '<a class="btn-secondary" href="/client-area/products">Back to products</a>'
        . '<a class="btn-secondary" href="/client-area">Client area</a>'
        . '</div></div>';
    dsa_render_layout('Manage product', $html);
}

function dsa_render_payment_proof(PDO $pdo, int $orderId, string $notice): void
{
    dsa_release_session_lock_if_safe();
    $stmt = $pdo->prepare(
        "select o.id, o.customer_email, o.customer_phone, o.payment_ref, o.payment_method, o.payment_proof_note, o.payment_proof_path, o.status, o.amount_cents, o.currency, o.service_details_json,
                o.whmcs_dispatch_status, o.updated_at,
                p.name as product_name
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id
         limit 1"
    );
    $stmt->execute([':id' => $orderId]);
    $order = $stmt->fetch();
    if (!$order) {
        http_response_code(404);
        dsa_render_layout('Not found', '<div class="card"><h2>Order not found</h2></div>');
        return;
    }
    if ((string) ($order['status'] ?? '') === 'demo_simulated') {
        header('Location: /client-area/order/' . $orderId);
        return;
    }
    dsa_try_confirm_gateway_payment($pdo, $orderId, true);
    $stmt->execute([':id' => $orderId]);
    $order = $stmt->fetch() ?: $order;
    if ((string) ($order['status'] ?? '') === 'paid') {
        dsa_on_order_became_paid($pdo, $orderId);
        $stmt->execute([':id' => $orderId]);
        $order = $stmt->fetch() ?: $order;
    }
    $orderLabel = trim((string) ($order['product_name'] ?? ''));
    if ($orderLabel === '') {
        $orderLabel = 'Order';
    }
    if ($notice === '') {
        $notice = dsa_consume_payment_notice($orderId);
    }
    $methodKey = (string) ($order['payment_method'] ?? '');
    $resolvedMethodKey = dsa_resolve_payment_method_key($pdo, $methodKey);
    $payStatusLabel = dsa_customer_order_status_label((array) $order);
    $orderStatus = (string) ($order['status'] ?? 'pending_payment');
    if (in_array($orderStatus, ['paid', 'fulfilled'], true)) {
        dsa_payment_flow_state_clear($orderId);
        header('Location: /client-area/order/' . $orderId);
        exit;
    }
    $allowPaymentActions = ($orderStatus === 'pending_payment');
    $isAwaitingConfirmation = ($orderStatus === 'pending_payment' && $payStatusLabel === 'payment_submitted');
    $isGatewayMethod = dsa_is_gateway_payment_method((string) ($order['payment_method'] ?? ''));
    $stkInProgress = ($isAwaitingConfirmation && $isGatewayMethod);
    $paymentState = dsa_payment_request_state_get((int) $order['id']);
    $nowTs = time();
    $countdownLeft = 0;
    $resendLeft = 0;
    if ($isAwaitingConfirmation) {
        $updatedAtTs = strtotime((string) ($order['updated_at'] ?? ''));
        if ($updatedAtTs !== false) {
            $countdownLeft = max(0, 45 - max(0, $nowTs - (int) $updatedAtTs));
            $resendLeft = max(0, 10 - max(0, $nowTs - (int) $updatedAtTs));
        }
        if (isset($paymentState['expires_at'])) {
            $countdownLeft = max($countdownLeft, max(0, (int) $paymentState['expires_at'] - $nowTs));
        }
        if (isset($paymentState['resend_available_at'])) {
            $resendLeft = max($resendLeft, max(0, (int) $paymentState['resend_available_at'] - $nowTs));
        }
    }
    $storedPhone = dsa_resolve_gateway_payment_phone($pdo, (int) $order['id'], (array) $order, '');
    $displayPhone = dsa_format_msisdn_for_display($storedPhone);
    $inlineNotice = dsa_is_inline_payment_notice($notice) ? $notice : '';
    $topNotice = ($inlineNotice !== '' || dsa_is_stk_success_notice($notice)) ? '' : $notice;

    if ($stkInProgress) {
        $methodLabel = dsa_payment_method_display_label($pdo, $methodKey);
        if ($methodLabel === '') {
            $methodLabel = 'M-PESA';
        }
        $totalMoney = dsa_money((int) $order['amount_cents'], (string) $order['currency']);
        $statusMessage = $countdownLeft <= 0
            ? 'Waiting for M-PESA confirmation. This usually takes a few seconds.'
            : 'Check your phone and enter your M-PESA PIN within <strong id="dsaStkCountdown">' . dsa_h((string) $countdownLeft) . '</strong> seconds.';
        $resendDisabled = $resendLeft > 0;

        $html = '<div class="card">' . dsa_checkout_steps('payment') . '<h1>Payment</h1>';
        $html .= '<p class="muted">Order <span class="pill">#' . dsa_h((string) $order['id']) . '</span> · '
            . dsa_h($orderLabel) . ' · <strong>' . dsa_h($totalMoney) . '</strong></p>';
        $html .= '<div id="dsaStkPanel" style="margin-top:16px;padding-top:16px;border-top:1px solid var(--border);">';
        $html .= '<h3 style="margin:0 0 6px 0;">' . dsa_h($methodLabel) . '</h3>';
        $html .= '<p class="muted" id="dsaStkBadge" data-countdown="' . dsa_h((string) $countdownLeft) . '" data-resend="' . dsa_h((string) $resendLeft) . '" data-order-id="' . dsa_h((string) $order['id']) . '" style="margin:0;">'
            . $statusMessage . '</p>';
        $html .= '<form method="post" action="/order/' . dsa_h((string) $order['id']) . '/pay/start" id="dsaStkResendForm" style="margin-top:14px;">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<input type="hidden" name="resend" value="1">';
        if ($inlineNotice !== '') {
            $html .= '<p class="notice" style="margin:0 0 10px 0;">' . dsa_h($inlineNotice) . '</p>';
        }
        $html .= '<label>M-PESA phone number</label>';
        $html .= '<input name="payment_phone" value="' . dsa_h($displayPhone) . '" placeholder="07XXXXXXXX or 2547XXXXXXXX" style="max-width:280px;">';
        $html .= '<div class="actions" style="margin-top:10px;">';
        $html .= '<button class="btn" type="submit" id="dsaStkResendBtn"' . ($resendDisabled ? ' disabled' : '') . '>Resend M-PESA prompt</button>';
        $html .= '</div>';
        if ($resendDisabled) {
            $html .= '<p class="muted" id="dsaStkResendWait" style="margin:8px 0 0;">Resend available in <span id="dsaStkResendCountdown">' . dsa_h((string) $resendLeft) . '</span> seconds.</p>';
        }
        $html .= '</form>';
        $paymentMethods = dsa_payment_methods($pdo);
        if (count($paymentMethods) > 0) {
            $html .= '<details style="margin-top:14px;"><summary style="cursor:pointer;opacity:0.85;">Use a different payment method</summary>';
            $html .= '<form method="post" action="/order/' . dsa_h((string) $order['id']) . '/payment-method" style="margin-top:10px;">';
            $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
            $html .= '<input type="hidden" name="customer_email" value="' . dsa_h((string) $order['customer_email']) . '">';
            $html .= '<label>Payment option</label><select name="payment_method">';
            foreach ($paymentMethods as $optionKey => $option) {
                $html .= '<option value="' . dsa_h($optionKey) . '"' . ($optionKey === $resolvedMethodKey ? ' selected' : '') . '>' . dsa_h((string) ($option['label'] ?? $optionKey)) . '</option>';
            }
            $html .= '</select><div class="actions" style="margin-top:10px;"><button class="btn-secondary" type="submit">Update payment option</button></div></form></details>';
        }
        $html .= '</div>';
        $html .= '<div class="actions" style="margin-top:16px;"><a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $order['id']) . '">Back to order</a></div>';
        $html .= '<script>(function(){'
            . 'var badge=document.getElementById("dsaStkBadge");'
            . 'if(!badge){return;}'
            . 'var countdownEl=document.getElementById("dsaStkCountdown");'
            . 'var resendEl=document.getElementById("dsaStkResendCountdown");'
            . 'var resendBtn=document.getElementById("dsaStkResendBtn");'
            . 'var resendWait=document.getElementById("dsaStkResendWait");'
            . 'var orderId=badge.getAttribute("data-order-id")||"";'
            . 'var countdown=parseInt(badge.getAttribute("data-countdown")||"0",10);'
            . 'var resend=parseInt(badge.getAttribute("data-resend")||"0",10);'
            . 'var confirming="Checking for your M-PESA payment\u2026";'
            . 'var confirmed=false;'
            . 'var pollBusy=false;'
            . 'var goPaid=function(j){'
            . 'var target=(j&&j.redirect_url)?String(j.redirect_url):("/client-area/order/"+encodeURIComponent(orderId));'
            . 'window.location.href=target;'
            . '};'
            . 'var poll=function(){'
            . 'if(!orderId||pollBusy){return;}'
            . 'pollBusy=true;'
            . 'fetch("/order/"+encodeURIComponent(orderId)+"/payment/status",{credentials:"same-origin",headers:{"Accept":"application/json"},cache:"no-store"})'
            . '.then(function(r){return r.json();})'
            . '.then(function(j){if(j&&j.ok&&j.paid){goPaid(j);return;}pollBusy=false;})'
            . '.catch(function(){pollBusy=false;});'
            . '};'
            . 'var tick=function(){'
            . 'if(countdown>0){countdown--;if(countdownEl){countdownEl.textContent=String(countdown);}}'
            . 'else if(badge&&!confirmed){badge.textContent=confirming;confirmed=true;poll();}'
            . 'if(resend>0){resend--;if(resendEl){resendEl.textContent=String(resend);}'
            . 'if(resend<=0){if(resendBtn){resendBtn.disabled=false;}if(resendWait){resendWait.style.display="none";}}'
            . '}};'
            . 'setInterval(tick,1000);'
            . 'setInterval(poll,1000);'
            . 'poll();'
            . '})();</script>';
        $html .= '</div>';
        dsa_render_layout('Payment', $html);
        return;
    }

    $html = '<div class="card">' . dsa_checkout_steps('payment') . '<h1>Payment</h1>';
    if (dsa_demo_mode_active($pdo)) {
        $html .= '<p class="muted"><strong>Step 3:</strong> Demo checkout — skip payment to finish.</p>';
    } else {
        $html .= '<p class="muted"><strong>Step 3:</strong> Choose how to pay and complete your order.</p>';
    }
    if ($topNotice !== '') {
        $html .= '<p class="notice">' . dsa_h($topNotice) . '</p>';
    }
    $html .= '<p>Order <span class="pill">#' . dsa_h((string) $order['id']) . '</span> for <strong>' . dsa_h($orderLabel) . '</strong></p>';
    $itemsTable = dsa_render_order_items_table($pdo, (int) $order['id']);
    if ($itemsTable !== '') {
        $html .= '<h3>Items</h3>' . $itemsTable;
    }
    $html .= '<p>Total: <strong>' . dsa_h(dsa_money((int) $order['amount_cents'], (string) $order['currency'])) . '</strong></p>';
    $html .= '<p>Status: ' . dsa_status_pill($payStatusLabel) . '</p>';
    if ($isAwaitingConfirmation) {
        $html .= '<p class="muted">Payment request submitted. Complete the prompt to finish payment.</p>';
    } elseif ($orderStatus === 'fulfilled') {
        $html .= '<div class="notice">Your service is ready and active. '
            . '<a href="/client-area/product/' . dsa_h((string) $order['id']) . '">Manage your product</a> · '
            . '<a href="/client-area/order/' . dsa_h((string) $order['id']) . '">View order details</a>'
            . '</div>';
    } elseif ($orderStatus === 'paid' || dsa_order_is_demo_paid_no_provision((array) $order)) {
        if (dsa_demo_mode_active($pdo) || dsa_order_is_demo_paid_no_provision((array) $order)) {
            $html .= '<div class="notice">' . dsa_h(dsa_demo_mode_paid_notice()) . '</div>';
        } else {
            $html .= '<div class="notice">Payment confirmed successfully. Provisioning is in progress. '
                . '<a href="/client-area/product/' . dsa_h((string) $order['id']) . '">View product status</a></div>';
        }
    }
    $paymentMethods = dsa_payment_methods($pdo);
    if ($allowPaymentActions && dsa_demo_mode_active($pdo) && count($paymentMethods) === 0) {
        $html .= dsa_demo_mode_render_payment_only_card((int) $order['id']);
        $html .= '</div>';
        dsa_render_layout('Payment', $html);
        return;
    }
    if (count($paymentMethods) > 0 && $allowPaymentActions) {
        $gatewayReady = ($resolvedMethodKey !== '' && isset($paymentMethods[$resolvedMethodKey]) && dsa_is_gateway_payment_method($resolvedMethodKey) && !$isAwaitingConfirmation);
        if ($gatewayReady) {
            $method = $paymentMethods[$resolvedMethodKey];
            $html .= '<div style="margin-top:14px;padding-top:14px;border-top:1px solid var(--border);">';
            $html .= '<h3 style="margin:0 0 10px 0;">' . dsa_h((string) $method['label']) . '</h3>';
            if (trim((string) ($method['instructions'] ?? '')) !== '') {
                $html .= '<p class="muted" style="margin:0 0 12px 0;">' . nl2br(dsa_h(trim((string) $method['instructions']))) . '</p>';
            }
            if (($resolvedMethodKey === 'paypal' || $resolvedMethodKey === 'paypal_checkout') && ($method['paypal_type'] ?? '') === 'checkout') {
                $clientId = dsa_h((string) $method['client_id']);
                $usdAmount = number_format(((int) $order['amount_cents']) / 100, 2, '.', '');
                $orderId = (int) $order['id'];
                
                $html .= '<div id="paypal-button-container" style="margin-top:16px;max-width:320px;"></div>';
                $html .= '<script src="https://www.paypal.com/sdk/js?client-id=' . $clientId . '&currency=USD"></script>';
                $html .= '<script>
                (function(){
                    if(window.paypal){
                        paypal.Buttons({
                            createOrder: function(data, actions){
                                return actions.order.create({
                                    purchase_units: [{
                                        amount: {
                                            value: "' . $usdAmount . '"
                                        },
                                        description: "' . dsa_h($orderLabel) . ' Order #' . $orderId . '"
                                    }]
                                });
                            },
                            onApprove: function(data, actions){
                                return actions.order.capture().then(function(details){
                                    return fetch("/order/' . $orderId . '/paypal-capture", {
                                        method: "POST",
                                        headers: {
                                            "Content-Type": "application/json",
                                            "X-CSRF-Token": "' . dsa_csrf_token() . '"
                                        },
                                        body: JSON.stringify({
                                            orderID: data.orderID,
                                            paypalOrderID: data.orderID,
                                            paymentID: details.id,
                                            status: details.status
                                        })
                                    }).then(function(r){return r.json();})
                                    .then(function(j){
                                        if(j && j.success){
                                            window.location.href = "/client-area/order/' . $orderId . '";
                                        } else {
                                            alert("Payment capture failed: " + ((j && j.message) || "Unknown error"));
                                        }
                                    });
                                });
                            },
                            onError: function(err){
                                console.error(err);
                                alert("PayPal smart checkout error occurred.");
                            }
                        }).render("#paypal-button-container");
                    }
                })();
                </script>';
            } else {
                $html .= '<form method="post" action="/order/' . dsa_h((string) $order['id']) . '/pay/start">';
                $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
                if ($inlineNotice !== '') {
                    $html .= '<p class="notice" style="margin:0 0 10px 0;">' . dsa_h($inlineNotice) . '</p>';
                }
                if (in_array($resolvedMethodKey, ['mpesa_direct', 'watupay_mpesa'], true)) {
                    $html .= '<label>M-PESA phone number</label>';
                    $html .= '<input name="payment_phone" value="' . dsa_h($displayPhone) . '" placeholder="07XXXXXXXX or 2547XXXXXXXX" style="max-width:280px;">';
                }
                $startLabel = ($resolvedMethodKey === 'paypal' || $resolvedMethodKey === 'paypal_basic' || $resolvedMethodKey === 'paypal_checkout') ? 'Start PayPal payment' : 'Start M-PESA payment';
                $html .= '<div class="actions" style="margin-top:10px;"><button class="btn" type="submit">' . dsa_h($startLabel) . '</button>';
                if (dsa_demo_mode_active($pdo)) {
                    $html .= dsa_demo_mode_render_skip_payment_button((int) $order['id']);
                }
                $html .= '</div></form>';
            }
            if (count($paymentMethods) > 1) {
                $html .= '<details style="margin-top:12px;"><summary style="cursor:pointer;opacity:0.85;">Use a different payment method</summary>';
                $html .= '<form method="post" action="/order/' . dsa_h((string) $order['id']) . '/payment-method" style="margin-top:10px;">';
                $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
                $html .= '<input type="hidden" name="customer_email" value="' . dsa_h((string) $order['customer_email']) . '">';
                $html .= '<label>Payment option</label><select name="payment_method">';
                foreach ($paymentMethods as $optionKey => $option) {
                    $html .= '<option value="' . dsa_h($optionKey) . '"' . ($optionKey === $resolvedMethodKey ? ' selected' : '') . '>' . dsa_h((string) ($option['label'] ?? $optionKey)) . '</option>';
                }
                $html .= '</select><div class="actions" style="margin-top:10px;"><button class="btn-secondary" type="submit">Update payment option</button></div></form></details>';
            }
            $html .= '</div>';
        } else {
            $paymentStepTitle = $methodKey === '' ? 'Choose payment option' : 'Change payment option';
            $paymentStepButton = $methodKey === '' ? 'Continue' : 'Update payment option';
            $html .= '<div style="margin-top:14px;padding-top:14px;border-top:1px solid var(--border);">';
            $html .= '<h3 style="margin:0 0 10px 0;">' . dsa_h($paymentStepTitle) . '</h3>';
            $html .= '<form method="post" action="/order/' . dsa_h((string) $order['id']) . '/payment-method">';
            $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
            $html .= '<input type="hidden" name="customer_email" value="' . dsa_h((string) $order['customer_email']) . '">';
            $html .= '<label>Payment option</label><select name="payment_method">';
            foreach ($paymentMethods as $optionKey => $option) {
                $html .= '<option value="' . dsa_h($optionKey) . '"' . ($optionKey === $resolvedMethodKey ? ' selected' : '') . '>' . dsa_h((string) ($option['label'] ?? $optionKey)) . '</option>';
            }
            $html .= '</select><div class="actions" style="margin-top:10px;"><button class="btn" type="submit">' . dsa_h($paymentStepButton) . '</button>';
            if (dsa_demo_mode_active($pdo)) {
                $html .= dsa_demo_mode_render_skip_payment_button((int) $order['id']);
            }
            $html .= '</div></form></div>';
        }
    }
    if ($allowPaymentActions && $resolvedMethodKey !== '' && isset($paymentMethods[$resolvedMethodKey]) && !dsa_is_gateway_payment_method($resolvedMethodKey)) {
        $method = $paymentMethods[$resolvedMethodKey];
        $html .= '<p style="margin-top:12px;"><strong>Payment option:</strong> ' . dsa_h((string) $method['label']) . '</p>';
        if (trim((string) ($method['instructions'] ?? '')) !== '') {
            $html .= '<p class="muted">' . nl2br(dsa_h((string) $method['instructions'])) . '</p>';
        }
        if (trim((string) ($method['pay_url'] ?? '')) !== '') {
            $html .= '<p><a class="btn" href="' . dsa_h((string) $method['pay_url']) . '" target="_blank" rel="noopener">Pay now</a></p>';
        }
    } elseif ($allowPaymentActions && $methodKey !== '' && ($resolvedMethodKey === '' || !isset($paymentMethods[$resolvedMethodKey]))) {
        $html .= '<p class="muted" style="margin-top:12px;">Complete your payment using the agreed method, then submit payment reference and proof below.</p>';
    }
    if ((string) $order['payment_proof_path'] !== '') {
        $html .= '<p>Current proof: <a href="' . dsa_h((string) $order['payment_proof_path']) . '" target="_blank">View uploaded proof</a></p>';
    }
    $isCashOnlyMethod = ($methodKey === 'cash');
    $showManualProofStep = $allowPaymentActions && dsa_is_manual_payment_proof_method($resolvedMethodKey !== '' ? $resolvedMethodKey : $methodKey);
    if ($isCashOnlyMethod && $allowPaymentActions) {
        $html .= '<div class="card"><h3 style="margin-top:0;">Cash Payment Instructions</h3>'
            . '<p class="muted">Follow the payment instructions above to complete your cash payment. No online proof submission is required for this method.</p>'
            . '<div class="actions" style="margin-top:10px;"><a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $order['id']) . '">Back to Order</a>';
        if (dsa_demo_mode_active($pdo)) {
            $html .= dsa_demo_mode_render_skip_payment_button((int) $order['id']);
        }
        $html .= '</div></div>';
    } elseif ($showManualProofStep) {
        $html .= '<div class="card"><h3 style="margin-top:0;">Confirm Payment</h3><p class="muted">After paying, submit transaction reference and proof so we can activate your order.</p><form method="post" enctype="multipart/form-data" action="/order/' . dsa_h((string) $order['id']) . '/payment">';
        $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
        $html .= '<label>Order Email</label><input type="email" name="customer_email" value="' . dsa_h((string) $order['customer_email']) . '" required>';
        $html .= '<label>Payment Reference</label><input name="payment_ref" value="' . dsa_h((string) $order['payment_ref']) . '" required>';
        $html .= '<label>Proof Note (optional)</label><textarea name="proof_note" rows="2">' . dsa_h((string) $order['payment_proof_note']) . '</textarea>';
        $html .= '<label>Proof File (jpg/png/pdf, max 4MB)</label><input type="file" name="proof_file" accept=".jpg,.jpeg,.png,.pdf">';
        $html .= '<div style="margin-top:10px" class="actions"><button class="btn" type="submit">Submit Proof</button><a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $order['id']) . '">Back to Order</a>';
        if (dsa_demo_mode_active($pdo)) {
            $html .= dsa_demo_mode_render_skip_payment_button((int) $order['id']);
        }
        $html .= '</div></form></div>';
    } else {
        $html .= '<div class="actions" style="margin-top:10px;"><a class="btn-secondary" href="/client-area/order/' . dsa_h((string) $order['id']) . '">Back to Order</a>';
        if ($allowPaymentActions && dsa_demo_mode_active($pdo) && $methodKey === '') {
            $html .= dsa_demo_mode_render_skip_payment_button((int) $order['id']);
        }
        $html .= '</div>';
    }
    $html .= '</div>';
    dsa_render_layout('Payment', $html);
}

function dsa_normalize_license_pool(string $value): string
{
    $lines = preg_split('/\r\n|\r|\n/', $value) ?: [];
    $clean = [];
    foreach ($lines as $line) {
        $line = trim((string) $line);
        if ($line !== '') {
            $clean[] = $line;
        }
    }
    return implode("\n", array_values(array_unique($clean)));
}

function dsa_get_order_with_product(PDO $pdo, int $orderId): ?array
{
    $stmt = $pdo->prepare(
        "select o.id, o.product_id, o.customer_name, o.customer_email, o.customer_phone, o.status, o.payment_ref, o.payment_method, o.notify_opt_in,
                o.amount_cents, o.currency, o.delivery_value, o.service_details_json, o.whmcs_order_id, o.whmcs_invoice_id, o.whmcs_service_id,
                o.whmcs_dispatch_status, o.whmcs_dispatch_message,
                p.slug as product_slug, p.name as product_name, p.category, p.delivery_url, p.fulfillment_type,
                p.catalog_product_id, p.provisioning_profile
         from orders o
         join products p on p.id = o.product_id
         where o.id = :id
         limit 1"
    );
    $stmt->execute([':id' => $orderId]);
    $row = $stmt->fetch();
    return $row ?: null;
}

function dsa_assign_license_key(PDO $pdo, int $productId): string
{
    $poolKey = 'license_pool_' . $productId;
    $usedKey = 'license_used_' . $productId;
    $poolRaw = dsa_setting($pdo, $poolKey, '');
    $pool = preg_split('/\r\n|\r|\n/', $poolRaw) ?: [];
    $cleanPool = [];
    foreach ($pool as $item) {
        $item = trim((string) $item);
        if ($item !== '') {
            $cleanPool[] = $item;
        }
    }
    $usedRaw = dsa_setting($pdo, $usedKey, '[]');
    $used = json_decode($usedRaw, true);
    if (!is_array($used)) {
        $used = [];
    }
    foreach ($cleanPool as $candidate) {
        if (!in_array($candidate, $used, true)) {
            $used[] = $candidate;
            dsa_setting_set($pdo, $usedKey, json_encode(array_values(array_unique($used))));
            return $candidate;
        }
    }
    return '';
}

function dsa_order_provisioning_already_started(array $order): bool
{
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    if (in_array($dispatchStatus, ['dispatching', 'invoice_created', 'invoice_paid', 'provisioned', 'demo_paid_no_provision'], true)) {
        return true;
    }

    return (int) ($order['whmcs_invoice_id'] ?? 0) > 0 || (int) ($order['whmcs_order_id'] ?? 0) > 0;
}

function dsa_order_repair_premature_fulfillment(PDO $pdo, int $orderId): bool
{
    if ($orderId <= 0) {
        return false;
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || (string) ($order['status'] ?? '') !== 'fulfilled') {
        return false;
    }
    if (dsa_order_awaiting_watu_pay_reconciliation($order)) {
        $stmt = $pdo->prepare(
            "update orders set status = 'paid', updated_at = datetime('now') where id = :id and status = 'fulfilled'"
        );
        $stmt->execute([':id' => $orderId]);

        return $stmt->rowCount() > 0;
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return false;
    }
    if (dsa_order_whmcs_provisioning_complete($order)) {
        return false;
    }
    $stmt = $pdo->prepare(
        "update orders set status = 'paid', updated_at = datetime('now') where id = :id and status = 'fulfilled'"
    );
    $stmt->execute([':id' => $orderId]);

    return $stmt->rowCount() > 0;
}

function dsa_admin_lifecycle_dispatch_label(array $order): string
{
    $status = (string) ($order['whmcs_dispatch_status'] ?? '');
    static $labels = [
        '' => 'Not started',
        'dispatching' => 'In progress',
        'invoice_created' => 'Invoice created',
        'invoice_paid' => 'Invoice created',
        'provisioned' => 'Invoice created',
        'failed' => 'Failed',
        'demo_paid_no_provision' => 'Demo — skipped',
    ];

    return $labels[$status] ?? ucwords(str_replace('_', ' ', $status));
}

function dsa_admin_lifecycle_billing_label(array $order): string
{
    $status = (string) ($order['whmcs_dispatch_status'] ?? '');
    if ($status === 'demo_paid_no_provision') {
        return 'N/A';
    }
    if (in_array($status, ['invoice_paid', 'provisioned'], true)) {
        return 'Paid';
    }
    if ($status === 'invoice_created' || (int) ($order['whmcs_invoice_id'] ?? 0) > 0) {
        return 'Awaiting payment';
    }

    return 'Not started';
}

function dsa_admin_lifecycle_provisioning_label(array $order): string
{
    $status = (string) ($order['whmcs_dispatch_status'] ?? '');
    if ($status === 'demo_paid_no_provision') {
        return 'N/A';
    }
    if ($status === 'provisioned') {
        return 'Service active';
    }
    if ($status === 'failed' && (int) ($order['whmcs_invoice_id'] ?? 0) > 0) {
        return 'Failed';
    }
    if ($status === 'invoice_paid') {
        return 'In progress';
    }

    return 'Not started';
}

/** @return array{dispatch:string,billing:string,provisioning:string} */
function dsa_admin_lifecycle_status_cells(array $order): array
{
    $na = '<span class="muted">N/A</span>';
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return ['dispatch' => $na, 'billing' => $na, 'provisioning' => $na];
    }
    $dispatchMessage = trim((string) ($order['whmcs_dispatch_message'] ?? ''));
    $messageSuffix = $dispatchMessage !== '' ? '<br><span class="muted">' . dsa_h($dispatchMessage) . '</span>' : '';
    $dispatchCell = dsa_h(dsa_admin_lifecycle_dispatch_label($order)) . $messageSuffix;
    $billingCell = dsa_h(dsa_admin_lifecycle_billing_label($order));
    $provisioningCell = dsa_h(dsa_admin_lifecycle_provisioning_label($order));

    return [
        'dispatch' => $dispatchCell,
        'billing' => $billingCell,
        'provisioning' => $provisioningCell,
    ];
}

function dsa_admin_can_dispatch_order(PDO $pdo, array $order): bool
{
    if ((string) ($order['status'] ?? '') !== 'paid') {
        return false;
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return false;
    }
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    $invoiceId = (int) ($order['whmcs_invoice_id'] ?? 0);
    if (
        !dsa_order_has_pending_stk_reference(trim((string) ($order['payment_ref'] ?? '')))
        && $invoiceId > 0
        && in_array($dispatchStatus, ['invoice_created', 'invoice_paid', 'provisioned'], true)
        && dsa_order_dispatch_already_completed_for_payment($pdo, $order)
    ) {
        return false;
    }
    if ($dispatchStatus === 'dispatching') {
        $dispatchedAtTs = strtotime((string) ($order['whmcs_dispatched_at'] ?? ''));
        $dispatchAgeSeconds = $dispatchedAtTs !== false ? (time() - (int) $dispatchedAtTs) : 9999;
        if ($dispatchAgeSeconds >= 0 && $dispatchAgeSeconds < 120) {
            return false;
        }

        return true;
    }
    if (in_array($dispatchStatus, ['invoice_created', 'invoice_paid', 'provisioned', 'demo_paid_no_provision'], true)) {
        return false;
    }

    return true;
}

/** @return array{success:bool,message:string} */
function dsa_admin_dispatch_order(PDO $pdo, int $orderId): array
{
    if ($orderId <= 0) {
        return ['success' => false, 'message' => 'Invalid order ID.'];
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order) {
        return ['success' => false, 'message' => 'Order not found.'];
    }
    // Invoice-payment orders (e.g. renewals) do not provision anything; they only
    // settle an existing WHMCS invoice. Route them straight to the invoice handler
    // instead of the generic provisioning/fulfillment path.
    if (count(dsa_order_invoice_payment_target((array) $order)) > 0) {
        dsa_apply_invoice_payment_to_whmcs($pdo, $orderId);
        $order = dsa_get_order_with_product($pdo, $orderId) ?: $order;
        $paidOk = (string) ($order['whmcs_dispatch_status'] ?? '') === 'provisioned';
        $detail = trim((string) ($order['whmcs_dispatch_message'] ?? ''));
        if ($paidOk) {
            return ['success' => true, 'message' => 'Renewal invoice paid. ' . $detail];
        }

        return [
            'success' => false,
            'message' => 'Invoice not settled yet. ' . ($detail !== '' ? $detail : 'Awaiting confirmed payment from a configured payment method.'),
        ];
    }
    dsa_order_repair_premature_fulfillment($pdo, $orderId);
    $order = dsa_get_order_with_product($pdo, $orderId) ?: $order;
    if ((string) ($order['status'] ?? '') !== 'paid') {
        return ['success' => false, 'message' => 'Only paid orders can be dispatched to Watu.'];
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return ['success' => false, 'message' => 'This product does not require Watu platform dispatch.'];
    }
    if (!dsa_admin_can_dispatch_order($pdo, $order)) {
        return ['success' => false, 'message' => dsa_ui_label('dispatch.already_dispatched')];
    }
    $dispatch = dsa_dispatch_paid_order_to_whmcs($pdo, $orderId);
    $order = dsa_get_order_with_product($pdo, $orderId) ?: $order;
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    if (in_array($dispatchStatus, ['invoice_created', 'invoice_paid', 'provisioned'], true)) {
        dsa_apply_auto_fulfillment($pdo, $orderId);

        return [
            'success' => true,
            'message' => 'Order #' . $orderId . ' dispatched to Watu — ' . dsa_admin_lifecycle_dispatch_label($order) . '.',
        ];
    }
    $detail = trim((string) ($order['whmcs_dispatch_message'] ?? ($dispatch['message'] ?? 'Dispatch did not complete.')));

    return ['success' => false, 'message' => 'Dispatch failed: ' . $detail];
}

function dsa_on_order_became_paid(PDO $pdo, int $orderId): void
{
    if (dsa_demo_mode_blocks_provisioning($pdo)) {
        return;
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if ($order && count(dsa_order_invoice_payment_target((array) $order)) > 0) {
        dsa_apply_invoice_payment_to_whmcs($pdo, $orderId);
        return;
    }
    dsa_apply_auto_dispatch_on_paid($pdo, $orderId);
    dsa_sync_order_dispatch_status_from_watu($pdo, $orderId, false);
    dsa_apply_auto_fulfillment($pdo, $orderId);
}

/**
 * Handles orders that exist only to pay an already-issued WHMCS invoice (renewals).
 * Instead of creating a new WHMCS order, it applies the collected payment to the
 * target invoice via the bridge; WHMCS then renews the underlying service/domain.
 */
function dsa_apply_invoice_payment_to_whmcs(PDO $pdo, int $orderId): void
{
    $payOrder = dsa_get_order_with_product($pdo, $orderId);
    if (!$payOrder) {
        return;
    }
    $target = dsa_order_invoice_payment_target((array) $payOrder);
    $invoiceId = (int) ($target['whmcs_invoice_id'] ?? 0);
    $sourceOrderId = (int) ($target['source_order_id'] ?? 0);
    if ($invoiceId <= 0 || $sourceOrderId <= 0) {
        return;
    }
    if (!in_array((string) ($payOrder['status'] ?? ''), ['paid', 'fulfilled'], true)) {
        return;
    }
    if ((string) ($payOrder['whmcs_dispatch_status'] ?? '') === 'provisioned') {
        return;
    }
    $stmt = $pdo->prepare("select * from orders where id = :id limit 1");
    $stmt->execute([':id' => $sourceOrderId]);
    $sourceOrder = $stmt->fetch();
    if (!$sourceOrder || strcasecmp((string) ($sourceOrder['customer_email'] ?? ''), (string) ($payOrder['customer_email'] ?? '')) !== 0) {
        return;
    }
    $accountRef = trim((string) ($payOrder['payment_ref'] ?? ''));
    $resp = dsa_service_manage_call($pdo, $sourceOrder, 'pay_invoice', [
        'invoice_id' => $invoiceId,
        'account_ref' => $accountRef,
        'tenant_payment_method' => (string) ($payOrder['payment_method'] ?? ''),
        'amount_cents' => (int) ($payOrder['amount_cents'] ?? 0),
    ]);
    $message = trim((string) ($resp['message'] ?? ''));
    if (!empty($resp['ok']) && (string) ($resp['status'] ?? '') === 'paid') {
        $upd = $pdo->prepare(
            "update orders
             set status = 'fulfilled',
                 whmcs_invoice_id = :inv,
                 whmcs_dispatch_status = 'provisioned',
                 whmcs_dispatch_message = :msg,
                 whmcs_dispatched_at = datetime('now'),
                 updated_at = datetime('now')
             where id = :id"
        );
        $upd->execute([':inv' => $invoiceId, ':msg' => $message !== '' ? $message : 'Invoice paid.', ':id' => $orderId]);
        return;
    }
    $failMsg = $message !== '' ? $message : 'Invoice payment could not be applied yet.';
    $upd = $pdo->prepare(
        "update orders
         set whmcs_invoice_id = :inv,
             whmcs_dispatch_status = 'invoice_created',
             whmcs_dispatch_message = :msg,
             whmcs_dispatched_at = datetime('now'),
             updated_at = datetime('now')
         where id = :id"
    );
    $upd->execute([':inv' => $invoiceId, ':msg' => $failMsg, ':id' => $orderId]);
}

function dsa_watu_dispatch_status_rank(string $status): int
{
    return match (strtolower(trim($status))) {
        'provisioned' => 4,
        'invoice_paid' => 3,
        'invoice_created' => 2,
        'dispatching', 'processing' => 1,
        default => 0,
    };
}

function dsa_order_dispatch_status_poll_allowed(PDO $pdo, int $orderId, bool $force = false): bool
{
    if ($force || $orderId <= 0) {
        return $force;
    }
    static $requestMemo = [];
    $memoKey = (string) spl_object_id($pdo) . '|dispatch|' . (string) $orderId;
    $now = time();
    if (isset($requestMemo[$memoKey]) && ($now - (int) $requestMemo[$memoKey]) < 30) {
        return false;
    }
    $requestMemo[$memoKey] = $now;

    return true;
}

function dsa_order_dispatch_status_should_poll(array $order): bool
{
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return false;
    }
    if (dsa_order_whmcs_provisioning_complete($order)) {
        return false;
    }
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    if ((int) ($order['whmcs_invoice_id'] ?? 0) > 0) {
        return true;
    }

    return in_array($dispatchStatus, ['dispatching', 'invoice_created', 'invoice_paid'], true);
}

function dsa_apply_watu_dispatch_status_payload(PDO $pdo, int $orderId, array $bodyJson): bool
{
    if (empty($bodyJson['ok']) || empty($bodyJson['found'])) {
        return false;
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order) {
        return false;
    }
    $newStatus = trim((string) ($bodyJson['status'] ?? ''));
    if ($newStatus === '') {
        return false;
    }
    $oldStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    if (dsa_watu_dispatch_status_rank($newStatus) < dsa_watu_dispatch_status_rank($oldStatus)) {
        return false;
    }

    $serviceDetails = is_array($bodyJson['service_details'] ?? null) ? (array) $bodyJson['service_details'] : [];
    $serviceAssets = is_array($bodyJson['service_assets'] ?? null) ? (array) $bodyJson['service_assets'] : [];
    $message = trim((string) ($bodyJson['message'] ?? ''));
    $stmt = $pdo->prepare(
        "update orders
         set whmcs_order_id = :whmcs_order_id,
             whmcs_invoice_id = :whmcs_invoice_id,
             whmcs_service_id = :whmcs_service_id,
             whmcs_dispatch_status = :whmcs_dispatch_status,
             whmcs_dispatch_message = :whmcs_dispatch_message,
             service_details_json = :service_details_json,
             whmcs_dispatched_at = case
                 when coalesce(whmcs_dispatched_at, '') = '' then datetime('now')
                 else whmcs_dispatched_at
             end,
             updated_at = datetime('now')
         where id = :id"
    );
    $stmt->execute([
        ':id' => $orderId,
        ':whmcs_order_id' => max((int) ($order['whmcs_order_id'] ?? 0), (int) ($bodyJson['whmcs_order_id'] ?? 0)),
        ':whmcs_invoice_id' => max((int) ($order['whmcs_invoice_id'] ?? 0), (int) ($bodyJson['whmcs_invoice_id'] ?? 0)),
        ':whmcs_service_id' => max((int) ($order['whmcs_service_id'] ?? 0), (int) ($bodyJson['whmcs_service_id'] ?? 0)),
        ':whmcs_dispatch_status' => $newStatus,
        ':whmcs_dispatch_message' => $message !== '' ? $message : (string) ($order['whmcs_dispatch_message'] ?? ''),
        ':service_details_json' => count($serviceDetails) > 0
            ? json_encode($serviceDetails, JSON_UNESCAPED_UNICODE)
            : (string) ($order['service_details_json'] ?? '{}'),
    ]);
    if ((int) $stmt->rowCount() <= 0) {
        return false;
    }
    if (count($serviceAssets) > 0 || count($serviceDetails) > 0) {
        dsa_order_store_dispatch_assets($pdo, $orderId, [
            'service_assets' => $serviceAssets,
            'service_details' => $serviceDetails,
            'whmcs_domain_id' => (int) ($bodyJson['whmcs_domain_id'] ?? ($serviceAssets['whmcs_domain_id'] ?? 0)),
        ]);
    }

    return true;
}

/** @return array{success:bool,message:string} */
function dsa_sync_order_dispatch_status_from_watu(PDO $pdo, int $orderId, bool $force = false): array
{
    if ($orderId <= 0) {
        return ['success' => false, 'message' => 'Invalid order ID.'];
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order) {
        return ['success' => false, 'message' => 'Order not found.'];
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return ['success' => true, 'message' => 'No Watu dispatch tracking required for this product.'];
    }
    if (!dsa_order_dispatch_status_should_poll($order)) {
        return ['success' => true, 'message' => 'Order has not been dispatched to Watu yet.'];
    }
    if (!$force && !dsa_order_dispatch_status_poll_allowed($pdo, $orderId, false)) {
        return ['success' => true, 'message' => 'Watu status was checked recently.'];
    }
    $statusUrl = dsa_order_dispatch_status_url($pdo);
    $watuKey = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($statusUrl === '' || $watuKey === '') {
        return ['success' => false, 'message' => 'Watu status endpoint is not configured.'];
    }
    $sep = strpos($statusUrl, '?') === false ? '?' : '&';
    $lookupUrl = $statusUrl . $sep . 'order_id=' . rawurlencode((string) $orderId);
    $http = dsa_http_get_with_watu_key($lookupUrl, $watuKey);
    if (empty($http['ok']) || trim((string) ($http['body'] ?? '')) === '') {
        return ['success' => false, 'message' => 'Could not reach Watu order status: ' . trim((string) ($http['error'] ?? 'unknown error'))];
    }
    $json = json_decode((string) $http['body'], true);
    if (!is_array($json) || empty($json['ok'])) {
        return ['success' => false, 'message' => 'Watu returned an invalid order status response.'];
    }
    if (empty($json['found'])) {
        return ['success' => true, 'message' => trim((string) ($json['message'] ?? 'No Watu dispatch record for this order yet.'))];
    }
    $updated = dsa_apply_watu_dispatch_status_payload($pdo, $orderId, $json);
    if ($updated) {
        dsa_apply_auto_fulfillment($pdo, $orderId);
    }
    dsa_maybe_continue_order_on_watu($pdo, $orderId, false);
    $order = dsa_get_order_with_product($pdo, $orderId) ?: $order;
    $statusLabel = dsa_admin_lifecycle_provisioning_label($order);
    if ($updated) {
        return [
            'success' => true,
            'message' => 'Watu status refreshed — provisioning: ' . $statusLabel . '.',
        ];
    }

    return [
        'success' => true,
        'message' => 'Watu status unchanged — provisioning: ' . $statusLabel . '.',
    ];
}

function dsa_admin_can_refresh_watu_order_status(array $order): bool
{
    if (!in_array((string) ($order['status'] ?? ''), ['paid', 'fulfilled'], true)) {
        return false;
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return false;
    }
    if (dsa_order_whmcs_provisioning_complete($order)) {
        return false;
    }

    return dsa_order_dispatch_status_should_poll($order);
}

/** @return array{success:bool,message:string} */
function dsa_admin_refresh_order_watu_status(PDO $pdo, int $orderId): array
{
    if ($orderId <= 0) {
        return ['success' => false, 'message' => 'Invalid order ID.'];
    }
    dsa_order_repair_premature_fulfillment($pdo, $orderId);

    return dsa_sync_order_dispatch_status_from_watu($pdo, $orderId, true);
}

function dsa_admin_can_continue_order_on_watu(array $order): bool
{
    if (!in_array((string) ($order['status'] ?? ''), ['paid', 'fulfilled'], true)) {
        return false;
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return false;
    }
    if (dsa_order_whmcs_provisioning_complete($order)) {
        return false;
    }
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');

    return in_array($dispatchStatus, ['invoice_created', 'invoice_paid'], true)
        || ((int) ($order['whmcs_invoice_id'] ?? 0) > 0 && $dispatchStatus !== 'provisioned');
}

/** @return array{success:bool,message:string} */
function dsa_continue_order_on_watu(PDO $pdo, int $orderId, bool $force = false): array
{
    if ($orderId <= 0) {
        return ['success' => false, 'message' => 'Invalid order ID.'];
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order) {
        return ['success' => false, 'message' => 'Order not found.'];
    }
    if (!dsa_order_needs_whmcs_provisioning($order)) {
        return ['success' => true, 'message' => 'No Watu provisioning required for this product.'];
    }
    if (dsa_order_whmcs_provisioning_complete($order)) {
        return ['success' => true, 'message' => 'Service is already active on Watu.'];
    }
    if (!$force && !dsa_admin_can_continue_order_on_watu($order)) {
        return ['success' => false, 'message' => 'Order is not ready to continue on Watu yet.'];
    }
    if (!$force && !dsa_order_dispatch_status_poll_allowed($pdo, $orderId, false)) {
        return ['success' => true, 'message' => 'Watu continue was attempted recently.'];
    }
    $provisionUrl = dsa_order_provision_url($pdo);
    $watuKey = trim(dsa_setting($pdo, 'catalog_sync_whmcs_secret', dsa_setting($pdo, 'catalog_sync_whmcs_identifier', '')));
    if ($provisionUrl === '' || $watuKey === '') {
        return ['success' => false, 'message' => 'Watu provision endpoint is not configured.'];
    }
    $http = dsa_http_post_json_with_watu_key($provisionUrl, $watuKey, [
        'order_id' => $orderId,
        'payment_ref' => trim((string) ($order['payment_ref'] ?? '')),
    ]);
    if (empty($http['ok']) || trim((string) ($http['body'] ?? '')) === '') {
        return ['success' => false, 'message' => 'Could not reach Watu provision service: ' . trim((string) ($http['error'] ?? 'unknown error'))];
    }
    $json = json_decode((string) $http['body'], true);
    if (!is_array($json) || empty($json['ok'])) {
        return ['success' => false, 'message' => trim((string) ($json['message'] ?? 'Watu provision request failed.'))];
    }
    $json['found'] = true;
    dsa_apply_watu_dispatch_status_payload($pdo, $orderId, $json);
    dsa_apply_auto_fulfillment($pdo, $orderId);
    $order = dsa_get_order_with_product($pdo, $orderId) ?: $order;
    $status = (string) ($order['whmcs_dispatch_status'] ?? '');
    if ($status === 'provisioned') {
        return ['success' => true, 'message' => 'Order #' . $orderId . ' is now active on Watu.'];
    }

    return [
        'success' => true,
        'message' => 'Watu updated — dispatch: ' . dsa_admin_lifecycle_dispatch_label($order)
            . ', billing: ' . dsa_admin_lifecycle_billing_label($order)
            . ', provisioning: ' . dsa_admin_lifecycle_provisioning_label($order)
            . '. ' . trim((string) ($json['message'] ?? '')),
    ];
}

function dsa_maybe_continue_order_on_watu(PDO $pdo, int $orderId, bool $force = false): void
{
    if ($orderId <= 0) {
        return;
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || !dsa_admin_can_continue_order_on_watu($order)) {
        return;
    }
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    if (!$force && $dispatchStatus !== 'invoice_paid') {
        return;
    }
    static $requestMemo = [];
    $memoKey = (string) spl_object_id($pdo) . '|continue|' . (string) $orderId;
    $now = time();
    if (!$force && isset($requestMemo[$memoKey]) && ($now - (int) $requestMemo[$memoKey]) < 60) {
        return;
    }
    $requestMemo[$memoKey] = $now;
    dsa_continue_order_on_watu($pdo, $orderId, true);
}

/** @return array{success:bool,message:string} */
function dsa_admin_continue_order_on_watu(PDO $pdo, int $orderId): array
{
    if ($orderId <= 0) {
        return ['success' => false, 'message' => 'Invalid order ID.'];
    }
    dsa_order_repair_premature_fulfillment($pdo, $orderId);

    return dsa_continue_order_on_watu($pdo, $orderId, true);
}

function dsa_apply_auto_dispatch_on_paid(PDO $pdo, int $orderId): void
{
    if (dsa_setting($pdo, 'order_dispatch_enabled', '1') !== '1') {
        return;
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || !dsa_admin_can_dispatch_order($pdo, $order)) {
        return;
    }
    dsa_dispatch_paid_order_to_whmcs($pdo, $orderId);
}

function dsa_order_needs_whmcs_provisioning(array $order): bool
{
    $fulfillmentType = (string) ($order['fulfillment_type'] ?? 'manual');
    if (in_array($fulfillmentType, ['instant_link', 'license_key'], true)) {
        return false;
    }
    $profile = dsa_normalize_provisioning_profile((string) ($order['provisioning_profile'] ?? 'none'));
    if ($profile !== 'none') {
        return true;
    }
    $slug = (string) ($order['product_slug'] ?? '');
    if (preg_match('/^(?:watu-sku-)?(?:catalog|whmcs-product)-\d+$/', $slug) === 1) {
        return true;
    }
    if ((int) ($order['catalog_product_id'] ?? 0) > 0) {
        return true;
    }
    return dsa_order_source_product_id($order) > 0;
}

function dsa_order_whmcs_provisioning_complete(array $order): bool
{
    return (string) ($order['whmcs_dispatch_status'] ?? '') === 'provisioned';
}

function dsa_apply_auto_fulfillment(PDO $pdo, int $orderId): void
{
    if (dsa_demo_mode_blocks_provisioning($pdo)) {
        return;
    }
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || (string) $order['status'] !== 'paid') {
        return;
    }
    $needsWhmcs = dsa_order_needs_whmcs_provisioning($order);
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    $whmcsInvoiceId = (int) ($order['whmcs_invoice_id'] ?? 0);
    if ($whmcsInvoiceId > 0 && in_array($dispatchStatus, ['invoice_created', 'invoice_paid', 'provisioned'], true)) {
        if ($needsWhmcs && dsa_order_whmcs_provisioning_complete($order)) {
            dsa_mark_order_fulfilled($pdo, $orderId, false);
        }
        return;
    }
    if ($needsWhmcs) {
        if (dsa_order_whmcs_provisioning_complete($order)) {
            dsa_mark_order_fulfilled($pdo, $orderId, false);
        }

        return;
    }
    if (dsa_order_has_multiple_items($pdo, $orderId)) {
        return;
    }
    $fulfillmentType = (string) ($order['fulfillment_type'] ?? 'manual');
    if (in_array($fulfillmentType, ['instant_link', 'license_key'], true)) {
        dsa_mark_order_fulfilled($pdo, $orderId, true);
    }
}

function dsa_mark_order_fulfilled(PDO $pdo, int $orderId, bool $sendEmail): array
{
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order) {
        return ['ok' => false, 'message' => 'Order not found.'];
    }
    if (in_array((string) $order['status'], ['pending_payment', 'cancelled'], true)) {
        return ['ok' => false, 'message' => 'Order must be paid before fulfillment.'];
    }
    if (dsa_order_needs_whmcs_provisioning($order) && !dsa_order_whmcs_provisioning_complete($order)) {
        return ['ok' => false, 'message' => 'Service is not active on Watu yet. Fulfillment happens after provisioning completes.'];
    }

    $deliveryValue = trim((string) ($order['delivery_value'] ?? ''));
    $fulfillmentType = (string) ($order['fulfillment_type'] ?? 'manual');
    if ($deliveryValue === '' && $fulfillmentType === 'instant_link') {
        $deliveryValue = trim((string) ($order['delivery_url'] ?? ''));
    } elseif ($deliveryValue === '' && $fulfillmentType === 'license_key') {
        $deliveryValue = dsa_assign_license_key($pdo, (int) $order['product_id']);
        if ($deliveryValue === '') {
            return ['ok' => false, 'message' => 'No available license key in pool for this product.'];
        }
    }

    $stmt = $pdo->prepare(
        "update orders
         set status = 'fulfilled',
             delivery_value = :delivery_value,
             updated_at = datetime('now')
         where id = :id"
    );
    $stmt->execute([
        ':id' => $orderId,
        ':delivery_value' => $deliveryValue,
    ]);

    $notified = dsa_send_order_notification_email($pdo, $orderId, 'order_fulfilled');
    if ($sendEmail && !$notified) {
        dsa_send_fulfillment_email($pdo, $orderId);
    }
    return ['ok' => true, 'message' => 'Order fulfilled.'];
}

function dsa_send_fulfillment_email(PDO $pdo, int $orderId): bool
{
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || (string) $order['status'] !== 'fulfilled') {
        return false;
    }
    $brandTitle = dsa_setting($pdo, 'brand_title', DSA_APP_NAME);
    $emailLogoUrl = dsa_brand_logo_url($pdo);
    $emailPrimaryColor = trim(dsa_setting($pdo, 'email_primary_color', '#2563eb'));
    $emailFooterText = trim(dsa_setting($pdo, 'email_footer_text', 'Need help? Reply to this email and our team will assist.'));
    if (!preg_match('/^#[0-9a-fA-F]{6}$/', $emailPrimaryColor)) {
        $emailPrimaryColor = '#2563eb';
    }

    $deliveryValue = trim((string) ($order['delivery_value'] ?? ''));
    $fulfillmentType = (string) ($order['fulfillment_type'] ?? 'manual');
    $subject = 'Your digital order is fulfilled';
    $bodyText = "Hi " . (string) $order['customer_name'] . ",\n\n"
        . "Your order #" . $orderId . " for " . (string) $order['product_name'] . " is fulfilled.\n";
    if ($deliveryValue !== '') {
        if ($fulfillmentType === 'license_key') {
            $bodyText .= "Your license key: " . $deliveryValue . "\n";
        } else {
            $bodyText .= "Delivery link: " . $deliveryValue . "\n";
        }
    } else {
        $bodyText .= "Our team will share delivery details shortly.\n";
    }
    $bodyText .= "\nRegards,\n" . $brandTitle;

    $bodyHtml = '<!doctype html><html><body style="font-family:Arial,sans-serif;background:#f8fafc;color:#0f172a;padding:16px;">';
    $bodyHtml .= '<div style="max-width:620px;margin:0 auto;background:#ffffff;border:1px solid #e2e8f0;border-radius:10px;padding:20px;">';
    if ($emailLogoUrl !== '') {
        $bodyHtml .= '<p style="margin:0 0 14px 0;"><img src="' . dsa_h($emailLogoUrl) . '" alt="' . dsa_h($brandTitle) . '" style="max-height:48px;max-width:220px;"></p>';
    }
    $bodyHtml .= '<h2 style="margin:0 0 12px 0;">Your digital order is fulfilled</h2>';
    $bodyHtml .= '<p>Hi ' . dsa_h((string) $order['customer_name']) . ',</p>';
    $bodyHtml .= '<p>Your order <strong>#' . dsa_h((string) $orderId) . '</strong> for <strong>' . dsa_h((string) $order['product_name']) . '</strong> is fulfilled.</p>';
    if ($deliveryValue !== '') {
        if ($fulfillmentType === 'license_key') {
            $bodyHtml .= '<p><strong>Your license key:</strong> <code>' . dsa_h($deliveryValue) . '</code></p>';
        } else {
            $bodyHtml .= '<p><a href="' . dsa_h($deliveryValue) . '" style="display:inline-block;background:' . dsa_h($emailPrimaryColor) . ';color:#ffffff;padding:10px 14px;border-radius:8px;text-decoration:none;">Access your delivery</a></p>';
            $bodyHtml .= '<p style="font-size:13px;color:#475569;">If the button does not work, open this link: ' . dsa_h($deliveryValue) . '</p>';
        }
    } else {
        $bodyHtml .= '<p>Our team will share delivery details shortly.</p>';
    }
    if ($emailFooterText !== '') {
        $bodyHtml .= '<hr style="border:none;border-top:1px solid #e2e8f0;margin:16px 0;">';
        $bodyHtml .= '<p style="font-size:13px;color:#475569;">' . nl2br(dsa_h($emailFooterText)) . '</p>';
    }
    $bodyHtml .= '<p style="margin-top:16px;">Regards,<br>' . dsa_h($brandTitle) . '</p>';
    $bodyHtml .= '</div></body></html>';

    return dsa_send_mail((string) $order['customer_email'], $subject, $bodyText, $bodyHtml);
}

function dsa_notification_template_defaults(): array
{
    return [
        'general.order_received' => [
            'category_key' => 'general',
            'category_label' => 'General Messages',
            'template_label' => 'Order Confirmation',
            'trigger_key' => 'order_received',
            'subject_template' => 'Order #{{order_id}} received - {{product_name}}',
            'body_template' => "Hi {{customer_name}},\n\nWe've received your order #{{order_id}} for {{product_name}}.\nCurrent status: {{status}}.\n\nWe will notify you when payment and provisioning are completed.\n\nRegards,\n{{store_name}}",
        ],
        'invoice.payment_received' => [
            'category_key' => 'invoice',
            'category_label' => 'Invoice Messages',
            'template_label' => 'Invoice Payment Confirmation',
            'trigger_key' => 'payment_received',
            'subject_template' => 'Payment received for order #{{order_id}}',
            'body_template' => "Hi {{customer_name}},\n\nPayment has been received for order #{{order_id}} ({{product_name}}).\nPayment reference: {{payment_ref}}\nCurrent status: {{status}}.\n\nProvisioning is now in progress.\n\nRegards,\n{{store_name}}",
        ],
        'invoice.renewal_due' => [
            'category_key' => 'invoice',
            'category_label' => 'Invoice Messages',
            'template_label' => 'Service Renewal Due',
            'trigger_key' => 'renewal_due',
            'subject_template' => 'Renewal due for {{product_name}} — {{renewal_amount}}',
            'body_template' => "Hi {{customer_name}},\n\nYour {{product_name}} service is due for renewal on {{renewal_due_date}}.\n\nAmount due: {{renewal_amount}}\n\nPay now in your client area:\n{{renewal_pay_url}}\n\nRegards,\n{{store_name}}",
        ],
        'product_service.fulfilled' => [
            'category_key' => 'product_service',
            'category_label' => 'Product/Service Messages',
            'template_label' => 'Hosting/Product Fulfilled',
            'trigger_key' => 'order_fulfilled',
            'subject_template' => 'Order #{{order_id}} fulfilled - {{product_name}}',
            'body_template' => "Hi {{customer_name}},\n\nYour order #{{order_id}} for {{product_name}} is fulfilled.\nDetails: {{delivery_value}}\n\nRegards,\n{{store_name}}",
        ],
        'domain.fulfilled' => [
            'category_key' => 'domain',
            'category_label' => 'Domain Messages',
            'template_label' => 'Domain Order Fulfilled',
            'trigger_key' => 'order_fulfilled',
            'subject_template' => 'Domain order #{{order_id}} fulfilled - {{product_name}}',
            'body_template' => "Hi {{customer_name}},\n\nYour domain order #{{order_id}} for {{product_name}} is fulfilled.\nDetails: {{delivery_value}}\n\nRegards,\n{{store_name}}",
        ],
    ];
}

function dsa_notification_templates(PDO $pdo): array
{
    $defaults = dsa_notification_template_defaults();
    $result = [];
    foreach ($defaults as $templateKey => $template) {
        $result[$templateKey] = array_merge($template, [
            'template_key' => $templateKey,
            'enabled' => true,
        ]);
    }
    $syncedJson = trim((string) dsa_setting($pdo, 'notifications_synced_templates_json', ''));
    if ($syncedJson !== '') {
        $synced = json_decode($syncedJson, true);
        if (is_array($synced)) {
            foreach ($synced as $templateKey => $tpl) {
                if (!is_array($tpl) || !isset($result[$templateKey])) {
                    continue;
                }
                if (trim((string) ($tpl['subject'] ?? '')) !== '') {
                    $result[$templateKey]['subject_template'] = (string) $tpl['subject'];
                }
                if (trim((string) ($tpl['body'] ?? '')) !== '') {
                    $result[$templateKey]['body_template'] = (string) $tpl['body'];
                }
                if (trim((string) ($tpl['template_label'] ?? '')) !== '') {
                    $result[$templateKey]['template_label'] = (string) $tpl['template_label'];
                }
                if (trim((string) ($tpl['category_key'] ?? '')) !== '') {
                    $result[$templateKey]['category_key'] = (string) $tpl['category_key'];
                }
                if (trim((string) ($tpl['category_label'] ?? '')) !== '') {
                    $result[$templateKey]['category_label'] = (string) $tpl['category_label'];
                }
                $safeKey = preg_replace('/[^a-z0-9_\.]+/i', '_', (string) $templateKey) ?? '';
                if ($safeKey === '') {
                    continue;
                }
                $defaultEnabled = !empty($tpl['enabled']) ? '1' : '0';
                $savedEnabled = trim((string) dsa_setting($pdo, 'notify_enabled_' . $safeKey, ''));
                if ($savedEnabled === '') {
                    $savedEnabled = $defaultEnabled;
                    dsa_setting_set($pdo, 'notify_enabled_' . $safeKey, $savedEnabled);
                }
                $result[$templateKey]['enabled'] = $savedEnabled === '1';
            }
        }
    }
    return $result;
}

function dsa_save_notification_templates(PDO $pdo, array $post): void
{
    $input = is_array($post['notifications'] ?? null) ? (array) $post['notifications'] : [];
    foreach (dsa_notification_template_defaults() as $templateKey => $_default) {
        $row = is_array($input[$templateKey] ?? null) ? (array) $input[$templateKey] : [];
        $safeKey = preg_replace('/[^a-z0-9_\.]+/i', '_', (string) $templateKey) ?? '';
        if ($safeKey === '') {
            continue;
        }
        dsa_setting_set($pdo, 'notify_enabled_' . $safeKey, isset($row['enabled']) ? '1' : '0');
    }
}

function dsa_notification_template_key_for_order(array $order, string $triggerKey): string
{
    if ($triggerKey === 'order_received') {
        return 'general.order_received';
    }
    if ($triggerKey === 'payment_received') {
        return 'invoice.payment_received';
    }
    if ($triggerKey === 'renewal_due') {
        return 'invoice.renewal_due';
    }
    if ($triggerKey === 'order_fulfilled') {
        $category = strtolower(trim((string) ($order['category'] ?? '')));
        $name = strtolower(trim((string) ($order['product_name'] ?? '')));
        if (strpos($category, 'domain') !== false || strpos($name, 'domain') !== false || preg_match('/\.[a-z]{2,20}/', $name)) {
            return 'domain.fulfilled';
        }
        return 'product_service.fulfilled';
    }
    return '';
}

function dsa_notification_order_password_fallback(): string
{
    return 'Use the password you set at checkout or reset via control panel';
}

function dsa_notification_body_contains_html(string $body): bool
{
    return preg_match('/<[a-z][\s\S]*>/i', $body) === 1;
}

function dsa_notification_plain_text_from_html(string $html): string
{
    $text = preg_replace('/<(br|\/p|\/div|\/li|\/tr|\/h[1-6])\s*\/?>/i', "\n", $html) ?? $html;
    $text = strip_tags($text);
    $text = html_entity_decode($text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
    $text = preg_replace("/[ \t]+\n/", "\n", $text) ?? $text;
    $text = preg_replace("/\n{3,}/", "\n\n", $text) ?? $text;
    return trim($text);
}

function dsa_notification_order_merge_replacements(PDO $pdo, array $order, array $service): array
{
    $orderId = (int) ($order['id'] ?? 0);
    $storeName = trim((string) dsa_setting($pdo, 'brand_title', DSA_APP_NAME));
    if ($storeName === '') {
        $storeName = DSA_APP_NAME;
    }
    $storeUrl = dsa_base_url($pdo);
    $signature = trim((string) dsa_setting($pdo, 'email_footer_text', ''));
    if ($signature === '') {
        $signature = "Regards,\n" . $storeName;
    }

    $customerName = (string) ($order['customer_name'] ?? 'Customer');
    $customerEmail = (string) ($order['customer_email'] ?? '');
    $productName = trim((string) ($order['product_name'] ?? ''));
    if ($productName === '') {
        $productName = trim((string) ($service['product_name'] ?? ''));
    }

    $password = trim((string) ($service['password'] ?? ''));
    if ($password === '') {
        $password = dsa_notification_order_password_fallback();
    }

    $serverName = trim((string) ($service['server_name'] ?? ''));
    $serverHostname = trim((string) ($service['server_hostname'] ?? ''));
    $serverIp = trim((string) ($service['server_ip'] ?? ''));
    $serverDisplay = $serverName !== '' ? $serverName : $serverHostname;

    $whmcsOrderId = (int) ($order['whmcs_order_id'] ?? 0);
    $whmcsInvoiceId = (int) ($order['whmcs_invoice_id'] ?? 0);
    $whmcsServiceId = (int) ($order['whmcs_service_id'] ?? ($service['service_id'] ?? 0));

    $deliveryValue = trim((string) ($order['delivery_value'] ?? ''));
    if ($deliveryValue === '' && count($service) > 0) {
        $parts = [];
        foreach ([
            'Domain' => (string) ($service['domain'] ?? ''),
            'Username' => (string) ($service['username'] ?? ''),
            'Server' => $serverDisplay,
            'Server IP' => $serverIp !== '' ? $serverIp : (string) ($service['dedicated_ip'] ?? ''),
            'Status' => (string) ($service['status'] ?? ''),
            'Next Due Date' => (string) ($service['next_due_date'] ?? ''),
        ] as $label => $value) {
            $value = trim((string) $value);
            if ($value !== '') {
                $parts[] = $label . ': ' . $value;
            }
        }
        for ($i = 1; $i <= 4; $i++) {
            $ns = trim((string) ($service['ns' . $i] ?? ($service['nameserver' . $i] ?? '')));
            if ($ns !== '') {
                $parts[] = 'NS' . $i . ': ' . $ns;
            }
        }
        if (count($parts) > 0) {
            $deliveryValue = implode("\n", $parts);
        }
    }

    $values = [
        'customer_name' => $customerName,
        'client_name' => $customerName,
        'clientname' => $customerName,
        'customer_email' => $customerEmail,
        'client_email' => $customerEmail,
        'clientemail' => $customerEmail,
        'product_name' => $productName,
        'service_product_name' => trim((string) ($service['product_name'] ?? $productName)),
        'order_id' => (string) $orderId,
        'order_number' => (string) $orderId,
        'whmcs_order_id' => $whmcsOrderId > 0 ? (string) $whmcsOrderId : '',
        'invoice_id' => $whmcsInvoiceId > 0 ? (string) $whmcsInvoiceId : '',
        'payment_ref' => (string) ($order['payment_ref'] ?? ''),
        'status' => (string) ($order['status'] ?? ''),
        'delivery_value' => $deliveryValue,
        'service_domain' => (string) ($service['domain'] ?? ''),
        'service_username' => (string) ($service['username'] ?? ''),
        'service_password' => $password,
        'service_server' => $serverDisplay,
        'service_server_name' => $serverName,
        'service_server_hostname' => $serverHostname,
        'service_server_ip' => $serverIp !== '' ? $serverIp : trim((string) ($service['dedicated_ip'] ?? '')),
        'service_dedicated_ip' => trim((string) ($service['dedicated_ip'] ?? '')),
        'service_status' => (string) ($service['status'] ?? ''),
        'service_next_due_date' => (string) ($service['next_due_date'] ?? ''),
        'service_billing_cycle' => (string) ($service['billing_cycle'] ?? ''),
        'service_recurring_amount' => (string) ($service['recurring_amount'] ?? ''),
        'service_first_payment_amount' => (string) ($service['first_payment_amount'] ?? ''),
        'service_payment_method' => (string) ($service['payment_method'] ?? ''),
        'service_reg_date' => (string) ($service['registration_date'] ?? ''),
        'service_registration_date' => (string) ($service['registration_date'] ?? ''),
        'service_id' => $whmcsServiceId > 0 ? (string) $whmcsServiceId : trim((string) ($service['service_id'] ?? '')),
        'store_name' => $storeName,
        'company_name' => $storeName,
        'companyname' => $storeName,
        'company_link' => $storeUrl,
        'companylink' => $storeUrl,
        'signature' => $signature,
    ];
    for ($i = 1; $i <= 4; $i++) {
        $ns = trim((string) ($service['ns' . $i] ?? ($service['nameserver' . $i] ?? '')));
        $values['service_ns' . $i] = $ns;
        $values['nameserver' . $i] = $ns;
    }

    $replacements = [];
    foreach ($values as $key => $value) {
        $replacements['{{' . $key . '}}'] = $value;
        $replacements['{$' . $key . '}'] = $value;
    }
    return $replacements;
}

function dsa_send_order_notification_email(PDO $pdo, int $orderId, string $triggerKey): bool
{
    $order = dsa_get_order_with_product($pdo, $orderId);
    if (!$order || !dsa_has_table($pdo, 'order_notification_events')) {
        return false;
    }
    if ((int) ($order['notify_opt_in'] ?? 1) !== 1) {
        return false;
    }
    $alreadyStmt = $pdo->prepare("select id from order_notification_events where order_id = :order_id and trigger_key = :trigger_key limit 1");
    $alreadyStmt->execute([':order_id' => $orderId, ':trigger_key' => $triggerKey]);
    if ($alreadyStmt->fetch()) {
        return false;
    }
    $templateKey = dsa_notification_template_key_for_order($order, $triggerKey);
    if ($templateKey === '') {
        return false;
    }
    $templates = dsa_notification_templates($pdo);
    $tpl = $templates[$templateKey] ?? null;
    if (!is_array($tpl) || empty($tpl['enabled'])) {
        return false;
    }
    $service = dsa_order_service_details($order);
    $replacements = dsa_notification_order_merge_replacements($pdo, $order, $service);
    $storeName = (string) ($replacements['{{store_name}}'] ?? DSA_APP_NAME);
    $brandedSubject = dsa_notification_apply_branding($pdo, (string) ($tpl['subject_template'] ?? ''));
    $brandedBody = dsa_notification_apply_branding($pdo, (string) ($tpl['body_template'] ?? ''));
    $subject = strtr($brandedSubject, $replacements);
    $bodyText = strtr($brandedBody, $replacements);
    if (trim($subject) === '' || trim($bodyText) === '') {
        return false;
    }
    $logoUrl = dsa_brand_logo_url($pdo);
    $storeUrl = dsa_base_url($pdo);
    $headerLogo = $logoUrl !== ''
        ? '<div style="margin-bottom:12px;"><img src="' . dsa_h($logoUrl) . '" alt="' . dsa_h($storeName) . '" style="max-height:48px;max-width:220px;"></div>'
        : '<h2 style="margin:0 0 12px 0;">' . dsa_h($storeName) . '</h2>';
    if (dsa_notification_body_contains_html($bodyText)) {
        $htmlReplacements = [];
        foreach ($replacements as $token => $value) {
            $htmlReplacements[$token] = htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
        }
        $bodyInner = strtr($brandedBody, $htmlReplacements);
        $plainBody = dsa_notification_plain_text_from_html($bodyText);
    } else {
        $bodyInner = nl2br(dsa_h($bodyText));
        $plainBody = $bodyText;
    }
    $bodyHtml = '<!doctype html><html><body style="font-family:Arial,sans-serif;background:#f8fafc;color:#0f172a;padding:16px;">'
        . '<div style="max-width:620px;margin:0 auto;background:#ffffff;border:1px solid #e2e8f0;border-radius:10px;padding:20px;">'
        . $headerLogo
        . $bodyInner
        . '<p style="margin-top:16px;font-size:12px;color:#64748b;"><a href="' . dsa_h($storeUrl) . '">' . dsa_h($storeUrl) . '</a></p>'
        . '</div></body></html>';
    $sent = dsa_send_mail((string) ($order['customer_email'] ?? ''), $subject, $plainBody, $bodyHtml);
    if ($sent) {
        $mark = $pdo->prepare(
            "insert into order_notification_events (order_id, trigger_key, sent_at)
             values (:order_id, :trigger_key, datetime('now'))
             on conflict(order_id, trigger_key) do nothing"
        );
        $mark->execute([':order_id' => $orderId, ':trigger_key' => $triggerKey]);
    }
    return $sent;
}

function dsa_send_renewal_invoice_notification(PDO $pdo, int $sourceOrderId, int $whmcsInvoiceId, string $dueDate, int $retailCents, string $currency): bool
{
    if ($sourceOrderId <= 0 || $whmcsInvoiceId <= 0 || !dsa_has_table($pdo, 'order_notification_events')) {
        return false;
    }
    $triggerKey = 'renewal_invoice_' . $whmcsInvoiceId;
    $alreadyStmt = $pdo->prepare("select id from order_notification_events where order_id = :order_id and trigger_key = :trigger_key limit 1");
    $alreadyStmt->execute([':order_id' => $sourceOrderId, ':trigger_key' => $triggerKey]);
    if ($alreadyStmt->fetch()) {
        return false;
    }
    $order = dsa_get_order_with_product($pdo, $sourceOrderId);
    if (!$order || (int) ($order['notify_opt_in'] ?? 1) !== 1) {
        return false;
    }
    $templates = dsa_notification_templates($pdo);
    $tpl = $templates['invoice.renewal_due'] ?? null;
    if (!is_array($tpl) || empty($tpl['enabled'])) {
        return false;
    }
    $service = dsa_order_service_details($order);
    $replacements = dsa_notification_order_merge_replacements($pdo, $order, $service);
    $storeUrl = rtrim((string) ($replacements['{{company_link}}'] ?? dsa_base_url($pdo)), '/');
    $renewalAmount = dsa_money(max(0, $retailCents), $currency);
    $payUrl = $storeUrl . '/client-area/billing/invoice/' . $whmcsInvoiceId . '?order=' . $sourceOrderId;
    $replacements['{{renewal_amount}}'] = $renewalAmount;
    $replacements['{{renewal_due_date}}'] = $dueDate !== '' ? $dueDate : '-';
    $replacements['{{renewal_pay_url}}'] = $payUrl;
    $replacements['{{whmcs_invoice_id}}'] = (string) $whmcsInvoiceId;
    $storeName = (string) ($replacements['{{store_name}}'] ?? DSA_APP_NAME);
    $brandedSubject = dsa_notification_apply_branding($pdo, (string) ($tpl['subject_template'] ?? ''));
    $brandedBody = dsa_notification_apply_branding($pdo, (string) ($tpl['body_template'] ?? ''));
    $subject = strtr($brandedSubject, $replacements);
    $bodyText = strtr($brandedBody, $replacements);
    if (trim($subject) === '' || trim($bodyText) === '') {
        return false;
    }
    $logoUrl = dsa_brand_logo_url($pdo);
    $headerLogo = $logoUrl !== ''
        ? '<div style="margin-bottom:12px;"><img src="' . dsa_h($logoUrl) . '" alt="' . dsa_h($storeName) . '" style="max-height:48px;max-width:220px;"></div>'
        : '<h2 style="margin:0 0 12px 0;">' . dsa_h($storeName) . '</h2>';
    $bodyHtml = '<!doctype html><html><body style="font-family:Arial,sans-serif;background:#f8fafc;color:#0f172a;padding:16px;">'
        . '<div style="max-width:620px;margin:0 auto;background:#ffffff;border:1px solid #e2e8f0;border-radius:10px;padding:20px;">'
        . $headerLogo
        . nl2br(dsa_h($bodyText))
        . '<p style="margin-top:16px;font-size:12px;color:#64748b;"><a href="' . dsa_h($storeUrl) . '">' . dsa_h($storeUrl) . '</a></p>'
        . '</div></body></html>';
    $sent = dsa_send_mail((string) ($order['customer_email'] ?? ''), $subject, $bodyText, $bodyHtml);
    if ($sent) {
        $mark = $pdo->prepare(
            "insert into order_notification_events (order_id, trigger_key, sent_at)
             values (:order_id, :trigger_key, datetime('now'))
             on conflict(order_id, trigger_key) do nothing"
        );
        $mark->execute([':order_id' => $sourceOrderId, ':trigger_key' => $triggerKey]);
    }
    return $sent;
}

function dsa_notification_apply_branding(PDO $pdo, string $template): string
{
    $storeName = trim((string) dsa_setting($pdo, 'brand_title', DSA_APP_NAME));
    if ($storeName === '') {
        $storeName = DSA_APP_NAME;
    }
    $storeUrl = dsa_base_url($pdo);
    $logoUrl = dsa_brand_logo_url($pdo);
    $replacements = [
        '{$company_name}' => $storeName,
        '{$companyname}' => $storeName,
        '{{company_name}}' => $storeName,
        '{$company_link}' => $storeUrl,
        '{$companylink}' => $storeUrl,
        '{{company_link}}' => $storeUrl,
        '{$logo}' => $logoUrl,
        '{{logo}}' => $logoUrl,
    ];
    $text = strtr($template, $replacements);
    $text = preg_replace('#https?://(www\.)?watutechnology\.com[^\s"\']*#i', $storeUrl, $text) ?? $text;
    $text = preg_replace('#https?://[^/\s]+/(support|web-portal|clientarea)[^\s"\']*#i', $storeUrl, $text) ?? $text;
    return $text;
}

function dsa_render_client_profile(PDO $pdo, string $error, string $notice): void
{
    $clientId = (int) ($_SESSION['dsa_client_id'] ?? 0);
    dsa_release_session_lock_if_safe();
    if ($clientId <= 0) {
        dsa_render_client_login('Please login to view your profile.');
        return;
    }
    $stmt = $pdo->prepare("select id, name, email, phone from customers where id = :id limit 1");
    $stmt->execute([':id' => $clientId]);
    $customer = $stmt->fetch();
    if (!$customer) {
        dsa_render_client_login('Session expired. Please login again.');
        return;
    }
    $html = '<div class="card"><h1>My Profile</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= '<form method="post" action="/client-area/profile">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<label>Name</label><input name="name" value="' . dsa_h((string) ($customer['name'] ?? '')) . '" required>';
    $html .= '<label>Email</label><input type="email" value="' . dsa_h((string) ($customer['email'] ?? '')) . '" disabled style="opacity:.6;">';
    $html .= '<label>Phone (optional)</label><input name="phone" value="' . dsa_h((string) ($customer['phone'] ?? '')) . '" placeholder="+254700000000">';
    $html .= '<hr style="border:none;border-top:1px solid #334155;margin:16px 0;">';
    $html .= '<h3>Change Password</h3><p class="muted">Leave blank to keep your current password.</p>';
    $html .= '<label>New Password</label><input type="password" name="new_password" minlength="8" placeholder="Leave blank to keep current">';
    $html .= '<label>Confirm New Password</label><input type="password" name="confirm_password" minlength="8" placeholder="Repeat new password">';
    $html .= '<div class="actions" style="margin-top:14px;"><button class="btn" type="submit">Save Changes</button><a class="btn-secondary" href="/client-area">Back to Client Area</a></div>';
    $html .= '</form></div>';
    dsa_render_layout('My Profile', $html);
}

function dsa_render_client_forgot_password(string $error, string $notice): void
{
    $html = '<div class="card"><h1>Forgot Password</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    $html .= '<p class="muted">Enter your client area email to receive a password reset link.</p>';
    $html .= '<form method="post" action="/client-area/forgot-password">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<label>Email</label><input type="email" name="email" required>';
    $html .= '<div style="margin-top:10px"><button class="btn" type="submit">Send Reset Link</button></div></form>';
    $html .= '<p style="margin-top:10px"><a href="/client-area/login">Back to login</a></p>';
    $html .= '</div>';
    dsa_render_layout('Forgot password', $html);
}

function dsa_render_client_reset_password(string $token, string $error, string $notice): void
{
    $html = '<div class="card"><h1>Reset Password</h1>';
    if ($error !== '') {
        $html .= '<p style="color:#ef4444">' . dsa_h($error) . '</p>';
    }
    if ($notice !== '') {
        $html .= '<p class="notice">' . dsa_h($notice) . '</p>';
    }
    if ($token === '') {
        $html .= '<p class="muted">Request a new reset link from the forgot password page.</p>';
        $html .= '<p><a href="/client-area/forgot-password">Go to forgot password</a></p>';
        $html .= '</div>';
        dsa_render_layout('Reset password', $html);
        return;
    }
    $html .= '<form method="post" action="/client-area/reset-password">';
    $html .= '<input type="hidden" name="csrf" value="' . dsa_h(dsa_csrf_token()) . '">';
    $html .= '<input type="hidden" name="token" value="' . dsa_h($token) . '">';
    $html .= '<label>New Password</label><input type="password" name="new_password" minlength="8" required>';
    $html .= '<label>Confirm Password</label><input type="password" name="confirm_password" minlength="8" required>';
    $html .= '<div style="margin-top:10px"><button class="btn" type="submit">Update Password</button></div></form>';
    $html .= '</div>';
    dsa_render_layout('Reset password', $html);
}

function dsa_base_url(?PDO $pdo = null): string
{
    $configuredDomain = '';
    if ($pdo instanceof PDO) {
        $configuredDomain = dsa_normalize_domain((string) dsa_setting($pdo, 'whitelabel_domain', ''));
    }
    if ($configuredDomain !== '') {
        return 'https://' . $configuredDomain;
    }
    $scheme = dsa_request_scheme();
    $host = dsa_normalize_domain((string) ($_SERVER['HTTP_HOST'] ?? ''));
    if ($host === '') {
        return 'https://dsa-demo.launch-pad.biz';
    }
    return $scheme . '://' . $host;
}

function dsa_issue_client_password_reset(PDO $pdo, string $email): void
{
    if ($email === '') {
        return;
    }
    $stmt = $pdo->prepare("select id, email from customers where email = :email limit 1");
    $stmt->execute([':email' => $email]);
    $customer = $stmt->fetch();
    if (!$customer) {
        return;
    }

    $token = bin2hex(random_bytes(24));
    $tokenHash = hash('sha256', $token);
    $ins = $pdo->prepare(
        "insert into customer_password_resets (customer_id, token_hash, expires_at, used_at, created_at)
         values (:customer_id, :token_hash, datetime('now', '+30 minutes'), null, datetime('now'))"
    );
    $ins->execute([
        ':customer_id' => (int) $customer['id'],
        ':token_hash' => $tokenHash,
    ]);
    $resetUrl = dsa_base_url($pdo) . '/client-area/reset-password?token=' . urlencode($token);
    $subject = 'Reset your client area password';
    $text = "We received a request to reset your client area password.\n\n"
        . "Reset link (valid for 30 minutes): " . $resetUrl . "\n\n"
        . "If you did not request this, you can ignore this email.";
    $html = '<!doctype html><html><body style="font-family:Arial,sans-serif;background:#f8fafc;padding:16px;">'
        . '<div style="max-width:620px;margin:0 auto;background:#fff;border:1px solid #e2e8f0;border-radius:10px;padding:20px;">'
        . '<h2>Reset your client area password</h2>'
        . '<p>Use the button below to reset your password. This link expires in 30 minutes.</p>'
        . '<p><a href="' . dsa_h($resetUrl) . '" style="display:inline-block;background:#2563eb;color:#fff;padding:10px 14px;border-radius:8px;text-decoration:none;">Reset Password</a></p>'
        . '<p style="font-size:13px;color:#475569;">If you did not request this, you can ignore this email.</p>'
        . '</div></body></html>';
    dsa_send_mail((string) $customer['email'], $subject, $text, $html);
}

function dsa_is_valid_client_reset_token(PDO $pdo, string $token): bool
{
    if ($token === '') {
        return false;
    }
    $tokenHash = hash('sha256', $token);
    $stmt = $pdo->prepare(
        "select id
         from customer_password_resets
         where token_hash = :token_hash
           and used_at is null
           and expires_at >= datetime('now')
         limit 1"
    );
    $stmt->execute([':token_hash' => $tokenHash]);
    return (bool) $stmt->fetch();
}

function dsa_apply_client_password_reset(PDO $pdo, string $token, string $newPassword): bool
{
    if ($token === '') {
        return false;
    }
    $tokenHash = hash('sha256', $token);
    $stmt = $pdo->prepare(
        "select id, customer_id
         from customer_password_resets
         where token_hash = :token_hash
           and used_at is null
           and expires_at >= datetime('now')
         limit 1"
    );
    $stmt->execute([':token_hash' => $tokenHash]);
    $row = $stmt->fetch();
    if (!$row) {
        return false;
    }
    $updateCustomer = $pdo->prepare("update customers set password_hash = :hash, updated_at = datetime('now') where id = :id");
    $updateCustomer->execute([
        ':id' => (int) $row['customer_id'],
        ':hash' => password_hash($newPassword, PASSWORD_DEFAULT),
    ]);
    $markUsed = $pdo->prepare("update customer_password_resets set used_at = datetime('now') where id = :id");
    $markUsed->execute([':id' => (int) $row['id']]);
    return true;
}

function dsa_issue_admin_password_reset(PDO $pdo, string $username): void
{
    if ($username === '') {
        return;
    }
    $stmt = $pdo->prepare("select id, username, email from admin_users where username = :username limit 1");
    $stmt->execute([':username' => $username]);
    $admin = $stmt->fetch();
    if (!$admin) {
        return;
    }

    $token = bin2hex(random_bytes(24));
    $tokenHash = hash('sha256', $token);
    $ins = $pdo->prepare(
        "insert into admin_password_resets (admin_user_id, token_hash, expires_at, used_at, created_at)
         values (:admin_user_id, :token_hash, datetime('now', '+30 minutes'), null, datetime('now'))"
    );
    $ins->execute([
        ':admin_user_id' => (int) $admin['id'],
        ':token_hash' => $tokenHash,
    ]);

    $resetUrl = dsa_base_url($pdo) . '/admin/reset-password?token=' . urlencode($token);
    $recipient = trim((string) ($admin['email'] ?? ''));
    if (!filter_var($recipient, FILTER_VALIDATE_EMAIL)) {
        $configuredRecipient = trim((string) dsa_setting($pdo, 'admin_password_reset_email', ''));
        $recipient = filter_var($configuredRecipient, FILTER_VALIDATE_EMAIL) ? $configuredRecipient : '';
    }

    $sentByEmail = false;
    if ($recipient !== '') {
        $subject = 'Reset your admin password';
        $text = "We received a request to reset an admin password.\n\n"
            . "Reset link (valid for 30 minutes): " . $resetUrl . "\n\n"
            . "If you did not request this, you can ignore this email.";
        $html = '<!doctype html><html><body style="font-family:Arial,sans-serif;background:#f8fafc;padding:16px;">'
            . '<div style="max-width:620px;margin:0 auto;background:#fff;border:1px solid #e2e8f0;border-radius:10px;padding:20px;">'
            . '<h2>Reset your admin password</h2>'
            . '<p>Use the button below to reset your password. This link expires in 30 minutes.</p>'
            . '<p><a href="' . dsa_h($resetUrl) . '" style="display:inline-block;background:#2563eb;color:#fff;padding:10px 14px;border-radius:8px;text-decoration:none;">Reset Password</a></p>'
            . '<p style="font-size:13px;color:#475569;">If you did not request this, you can ignore this email.</p>'
            . '</div></body></html>';
        $sentByEmail = dsa_send_mail($recipient, $subject, $text, $html);
    }

    if (!$sentByEmail) {
        $opsLogPath = __DIR__ . '/storage/admin_password_reset_requests.log';
        $entry = [
            'time' => date('c'),
            'username' => (string) ($admin['username'] ?? ''),
            'expires_at' => date('c', time() + 1800),
            'reset_url' => $resetUrl,
        ];
        @file_put_contents($opsLogPath, json_encode($entry, JSON_UNESCAPED_SLASHES) . PHP_EOL, FILE_APPEND);
    }

    dsa_audit_log('admin_password_reset_requested', [
        'username' => (string) ($admin['username'] ?? ''),
        'delivery' => $sentByEmail ? 'email' : 'ops_log',
    ]);
}

function dsa_is_valid_admin_reset_token(PDO $pdo, string $token): bool
{
    if ($token === '') {
        return false;
    }
    $tokenHash = hash('sha256', $token);
    $stmt = $pdo->prepare(
        "select id
         from admin_password_resets
         where token_hash = :token_hash
           and used_at is null
           and expires_at >= datetime('now')
         limit 1"
    );
    $stmt->execute([':token_hash' => $tokenHash]);
    return (bool) $stmt->fetch();
}

function dsa_apply_admin_password_reset(PDO $pdo, string $token, string $newPassword): bool
{
    if ($token === '') {
        return false;
    }
    $tokenHash = hash('sha256', $token);
    $stmt = $pdo->prepare(
        "select id, admin_user_id
         from admin_password_resets
         where token_hash = :token_hash
           and used_at is null
           and expires_at >= datetime('now')
         limit 1"
    );
    $stmt->execute([':token_hash' => $tokenHash]);
    $row = $stmt->fetch();
    if (!$row) {
        return false;
    }

    $pdo->beginTransaction();
    try {
        $updateAdmin = $pdo->prepare("update admin_users set password_hash = :hash, updated_at = datetime('now') where id = :id");
        $updateAdmin->execute([
            ':id' => (int) $row['admin_user_id'],
            ':hash' => password_hash($newPassword, PASSWORD_DEFAULT),
        ]);
        $markUsed = $pdo->prepare("update admin_password_resets set used_at = datetime('now') where id = :id and used_at is null");
        $markUsed->execute([':id' => (int) $row['id']]);
        if ($markUsed->rowCount() !== 1) {
            $pdo->rollBack();
            return false;
        }
        $pdo->commit();
    } catch (Throwable $e) {
        if ($pdo->inTransaction()) {
            $pdo->rollBack();
        }
        return false;
    }

    dsa_audit_log('admin_password_reset_completed', [
        'admin_user_id' => (int) $row['admin_user_id'],
    ]);
    return true;
}

function dsa_build_order_timeline(array $order): array
{
    $status = (string) ($order['status'] ?? 'pending_payment');
    $dispatchStatus = (string) ($order['whmcs_dispatch_status'] ?? '');
    $clientStatusLabel = dsa_customer_order_status_label($order);
    $paymentConfirmed = in_array($status, ['paid', 'fulfilled'], true)
        && $clientStatusLabel !== 'payment_submitted';
    $serviceReady = $status === 'fulfilled' && dsa_order_whmcs_provisioning_complete($order);
    if (!$serviceReady && $status === 'fulfilled' && !dsa_order_needs_whmcs_provisioning($order)) {
        $serviceReady = true;
    }
    if ($status === 'demo_simulated') {
        return [
            ['label' => 'Order received', 'done' => true],
            ['label' => 'Legacy demo order (no payment)', 'done' => true],
        ];
    }
    if ($dispatchStatus === 'demo_paid_no_provision') {
        return [
            ['label' => 'Order received', 'done' => true],
            ['label' => 'Watu Technology M-PESA payment received', 'done' => true],
            ['label' => 'Demo store — no service provisioned (refund within 72 business hours if paid in error)', 'done' => true],
        ];
    }
    return [
        ['label' => 'Order received', 'done' => true],
        ['label' => 'Payment received', 'done' => $paymentConfirmed],
        ['label' => 'Setting up your service', 'done' => $serviceReady],
        ['label' => 'Service ready', 'done' => $serviceReady],
    ];
}