functions.php

<?php

declare(strict_types=1);

require_once __DIR__ . '/config.php';

// Polyfill for environments where mbstring is not available
if (!function_exists('mb_strtolower')) {
    function mb_strtolower(string $s, string $enc = 'UTF-8'): string
    {
        return strtolower($s);
    }
}

if (PHP_SAPI !== 'cli' && session_status() !== PHP_SESSION_ACTIVE) {
    session_name(SESSION_NAME);
    session_start([
        'cookie_httponly' => true,
        'cookie_samesite' => 'Lax',
        'use_strict_mode' => true,
    ]);
}

function ensure_runtime_paths(): void
{
    foreach ([CACHE_DIR, UPLOADS_DIR] as $directory) {
        if (!is_dir($directory)) {
            mkdir($directory, 0775, true);
        }
    }
}

function database(): PDO
{
    static $pdo = null;

    if ($pdo instanceof PDO) {
        return $pdo;
    }

    ensure_runtime_paths();
    $needsInit = !file_exists(DB_PATH);
    $pdo = new PDO('sqlite:' . DB_PATH);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
    $pdo->exec('PRAGMA foreign_keys = ON');

    if ($needsInit || !tables_exist($pdo)) {
        initialize_database($pdo);
    }

    return $pdo;
}

function tables_exist(PDO $pdo): bool
{
    $tables = ['subscriptions', 'plans', 'settings'];

    foreach ($tables as $table) {
        $stmt = $pdo->prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = :name");
        $stmt->execute(['name' => $table]);
        if (!$stmt->fetchColumn()) {
            return false;
        }
    }

    return true;
}

function initialize_database(?PDO $pdo = null): void
{
    $pdo ??= database();
    $schema = file_get_contents(SCHEMA_PATH);
    if ($schema === false) {
        throw new RuntimeException('Unable to read schema.sql');
    }

    $pdo->exec($schema);

    $defaults = [
        'json_source_url' => DEFAULT_JSON_SOURCE_URL,
        'vpn_name' => 'XAMBoost VPN',
        'vpn_description' => 'Fast self-updating VPN subscription panel.',
        'logo_url' => '',
        'accent_color' => '#22c55e',
        'server_renames' => '{}',
        'use_manual_servers' => '0',
        'manual_servers' => '',
        'response_format' => 'happ',
    ];

    foreach ($defaults as $key => $value) {
        if (get_setting($key) === null) {
            set_setting($key, $value);
        }
    }
}

function app_is_installed(): bool
{
    try {
        return get_setting('admin_username') !== null
            && get_setting('admin_password_hash') !== null
            && get_setting('api_token_hash') !== null;
    } catch (Throwable $exception) {
        return false;
    }
}

function app_base_path(): string
{
    $scriptName = $_SERVER['SCRIPT_NAME'] ?? '';
    $directory = str_replace('\\', '/', dirname($scriptName));

    if ($directory === '/' || $directory === '.' || $directory === '\\') {
        return '';
    }

    return rtrim($directory, '/');
}

function app_origin(): string
{
    $https = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
    $scheme = $https ? 'https' : 'http';
    $host = $_SERVER['HTTP_HOST'] ?? 'localhost';

    return $scheme . '://' . $host;
}

function app_url(string $path = ''): string
{
    $base = app_base_path();
    $cleanPath = ltrim($path, '/');

    return $base . ($cleanPath !== '' ? '/' . $cleanPath : '');
}

function absolute_app_url(string $path = ''): string
{
    return app_origin() . app_url($path);
}

function redirect(string $path): never
{
    header('Location: ' . (str_starts_with($path, 'http') ? $path : app_url($path)));
    exit;
}

function get_setting(string $key, ?string $default = null): ?string
{
    $stmt = database()->prepare('SELECT value FROM settings WHERE key = :key LIMIT 1');
    $stmt->execute(['key' => $key]);
    $value = $stmt->fetchColumn();

    return $value === false ? $default : (string) $value;
}

function set_setting(string $key, string $value): void
{
    $stmt = database()->prepare(
        'INSERT INTO settings (key, value) VALUES (:key, :value)
         ON CONFLICT(key) DO UPDATE SET value = excluded.value'
    );
    $stmt->execute([
        'key' => $key,
        'value' => $value,
    ]);
}

function set_settings(array $settings): void
{
    foreach ($settings as $key => $value) {
        set_setting((string) $key, (string) $value);
    }
}

function get_branding_settings(): array
{
    return [
        'vpn_name' => get_setting('vpn_name', 'XAMBoost VPN') ?? 'XAMBoost VPN',
        'vpn_description' => get_setting('vpn_description', 'Fast self-updating VPN subscription panel.') ?? '',
        'logo_url' => get_setting('logo_url', '') ?? '',
        'accent_color' => get_setting('accent_color', '#22c55e') ?? '#22c55e',
    ];
}

function json_setting_array(string $key, array $default = []): array
{
    $raw = get_setting($key);
    if ($raw === null || trim($raw) === '') {
        return $default;
    }

    $decoded = json_decode($raw, true);
    return is_array($decoded) ? $decoded : $default;
}

function flash(string $type, string $message): void
{
    $_SESSION['flash'][] = [
        'type' => $type,
        'message' => $message,
    ];
}

function consume_flash(): array
{
    $messages = $_SESSION['flash'] ?? [];
    unset($_SESSION['flash']);

    return is_array($messages) ? $messages : [];
}

function csrf_token(): string
{
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }

    return (string) $_SESSION['csrf_token'];
}

function verify_csrf(): void
{
    $token = $_POST['_csrf'] ?? '';
    if (!is_string($token) || !hash_equals(csrf_token(), $token)) {
        throw new RuntimeException('Invalid CSRF token.');
    }
}

function is_logged_in(): bool
{
    return !empty($_SESSION['admin_logged_in']);
}

function require_setup_complete(): void
{
    if (!app_is_installed() && basename($_SERVER['PHP_SELF'] ?? '') !== 'setup.php') {
        redirect('setup.php');
    }
}

function require_admin(): void
{
    require_setup_complete();
    if (!is_logged_in()) {
        redirect('login.php');
    }
}

function logout_admin(): void
{
    $_SESSION = [];
    if (ini_get('session.use_cookies')) {
        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 3600, $params['path'], $params['domain'] ?? '', (bool) ($params['secure'] ?? false), (bool) ($params['httponly'] ?? true));
    }
    session_destroy();
}

function now_utc(): string
{
    return gmdate('Y-m-d H:i:s');
}

function now_timestamp(): int
{
    return time();
}

function parse_datetime_to_utc(?string $value): ?string
{
    if ($value === null || trim($value) === '') {
        return null;
    }

    try {
        $date = new DateTimeImmutable($value, new DateTimeZone('UTC'));
    } catch (Throwable $exception) {
        try {
            $date = new DateTimeImmutable($value);
        } catch (Throwable $inner) {
            return null;
        }
    }

    return $date->setTimezone(new DateTimeZone('UTC'))->format('Y-m-d H:i:s');
}

function uuid_v4(): string
{
    $data = random_bytes(16);
    $data[6] = chr((ord($data[6]) & 0x0f) | 0x40);
    $data[8] = chr((ord($data[8]) & 0x3f) | 0x80);

    return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
}

function subscription_public_id(): string
{
    return str_replace('-', '', uuid_v4());
}

function rate_limit(string $scope, int $limit, int $windowSeconds = 60): bool
{
    ensure_runtime_paths();
    $ip = $_SERVER['REMOTE_ADDR'] ?? 'cli';
    $bucket = (int) floor(time() / $windowSeconds);
    $path = CACHE_DIR . '/ratelimit_' . sha1($scope . '|' . $ip . '|' . $bucket) . '.json';

    $count = 0;
    if (file_exists($path)) {
        $decoded = json_decode((string) file_get_contents($path), true);
        $count = (int) ($decoded['count'] ?? 0);
    }

    $count++;
    file_put_contents($path, json_encode(['count' => $count, 'updated_at' => now_utc()], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES), LOCK_EX);

    return $count <= $limit;
}

function request_header(string $name): ?string
{
    $normalized = 'HTTP_' . strtoupper(str_replace('-', '_', $name));

    if (isset($_SERVER[$normalized])) {
        return trim((string) $_SERVER[$normalized]);
    }

    if (function_exists('getallheaders')) {
        foreach (getallheaders() as $headerName => $value) {
            if (strcasecmp($headerName, $name) === 0) {
                return trim((string) $value);
            }
        }
    }

    return null;
}

function json_response($data, int $status = 200): never
{
    http_response_code($status);
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    exit;
}

function error_response(string $message, int $status = 400, array $extra = []): never
{
    json_response(array_merge([
        'ok' => false,
        'error' => $message,
    ], $extra), $status);
}

function success_response(array $data = [], int $status = 200): never
{
    json_response(array_merge(['ok' => true], $data), $status);
}

function html_escape(?string $value): string
{
    return htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8');
}

function slugify(string $value): string
{
    $value = strtolower(trim($value));
    $value = preg_replace('/[^a-z0-9]+/i', '-', $value) ?? '';
    $value = trim($value, '-');

    return $value !== '' ? $value : 'item';
}

function normalize_accent_color(string $value): string
{
    $value = trim($value);
    return preg_match('/^#[0-9a-fA-F]{6}$/', $value) ? $value : '#22c55e';
}

function render_shell_start(string $title, string $subtitle = '', bool $showNav = true): void
{
    $brand = get_branding_settings();
    $flashMessages = consume_flash();
    $current = basename($_SERVER['PHP_SELF'] ?? '');
    $navItems = [
        'dashboard.php' => ['label' => 'Dashboard', 'url' => app_url('dashboard')],
        'subscriptions.php' => ['label' => 'Subscriptions', 'url' => app_url('subscriptions')],
        'plans.php' => ['label' => 'Plans', 'url' => app_url('plans')],
        'settings.php' => ['label' => 'Settings', 'url' => app_url('settings')],
    ];

    echo '<!doctype html><html lang="en"><head><meta charset="utf-8">';
    echo '<meta name="viewport" content="width=device-width, initial-scale=1">';
    echo '<title>' . html_escape($title . ' • ' . $brand['vpn_name']) . '</title>';
    echo '<script src="https://cdn.tailwindcss.com"></script>';
    echo '<script>tailwind.config={theme:{extend:{colors:{accent:"' . html_escape($brand['accent_color']) . '"}}}}</script>';
    echo '<link rel="preconnect" href="https://fonts.googleapis.com">';
    echo '<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>';
    echo '<link href="https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&display=swap" rel="stylesheet">';
    echo '<style>
        :root{--accent:' . html_escape($brand['accent_color']) . ';}
        body{font-family:Manrope,system-ui,sans-serif;background:
        radial-gradient(circle at top left, rgba(255,255,255,.35), transparent 32%),
        radial-gradient(circle at bottom right, rgba(34,197,94,.18), transparent 28%),
        linear-gradient(135deg, #f4f7fb 0%, #edf4f1 42%, #eef2ff 100%);}
        .glass{background:rgba(255,255,255,.62);backdrop-filter:blur(20px);-webkit-backdrop-filter:blur(20px);border:1px solid rgba(255,255,255,.55);box-shadow:0 20px 60px rgba(15,23,42,.08);}
        .glass-dark{background:rgba(15,23,42,.68);backdrop-filter:blur(18px);-webkit-backdrop-filter:blur(18px);}
        .text-accent{color:var(--accent);}
        .bg-accent{background-color:var(--accent);}
        .ring-accent{--tw-ring-color:var(--accent);}
        .border-accent{border-color:var(--accent);}
        .btn-primary{background:linear-gradient(135deg,var(--accent),#0f172a);color:#fff;}
        .btn-primary:hover{filter:brightness(1.04);}
        .nav-pill{transition:.2s ease;}
        .nav-pill:hover{transform:translateY(-1px);}
    </style>';
    echo '</head><body class="min-h-screen text-slate-900">';
    echo '<div class="mx-auto w-full max-w-7xl px-4 py-6 sm:px-6 lg:px-8">';
    echo '<div class="mb-6 glass rounded-[28px] p-5 sm:p-6">';
    echo '<div class="flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between">';
    echo '<div class="flex items-center gap-4">';
    if ($brand['logo_url'] !== '') {
        echo '<img src="' . html_escape($brand['logo_url']) . '" alt="Logo" class="h-14 w-14 rounded-2xl object-cover shadow-lg">';
    } else {
        echo '<div class="flex h-14 w-14 items-center justify-center rounded-2xl text-lg font-bold text-white shadow-lg" style="background:linear-gradient(135deg,' . html_escape($brand['accent_color']) . ',#0f172a)">VPN</div>';
    }
    echo '<div>';
    echo '<p class="text-xs font-semibold uppercase tracking-[0.28em] text-slate-500">VPN SaaS Panel</p>';
    echo '<h1 class="text-2xl font-extrabold tracking-tight text-slate-900">' . html_escape($title) . '</h1>';
    if ($subtitle !== '') {
        echo '<p class="mt-1 max-w-2xl text-sm text-slate-600">' . html_escape($subtitle) . '</p>';
    }
    echo '</div></div>';
    if ($showNav) {
        echo '<div class="flex flex-wrap items-center gap-2">';
        foreach ($navItems as $file => $item) {
            $active = $current === $file;
            $classes = $active
                ? 'nav-pill rounded-full px-4 py-2 text-sm font-semibold text-white shadow-md'
                : 'nav-pill rounded-full px-4 py-2 text-sm font-semibold text-slate-700';
            $style = $active ? ' style="background:linear-gradient(135deg,' . html_escape($brand['accent_color']) . ',#0f172a)"' : '';
            echo '<a class="' . $classes . '"' . $style . ' href="' . html_escape($item['url']) . '">' . html_escape($item['label']) . '</a>';
        }
        echo '<a class="nav-pill rounded-full px-4 py-2 text-sm font-semibold text-slate-700" href="' . html_escape(app_url('logout.php')) . '">Logout</a>';
        echo '</div>';
    }
    echo '</div></div>';

    foreach ($flashMessages as $flash) {
        $tone = ($flash['type'] ?? 'info') === 'success'
            ? 'border-emerald-200 bg-emerald-50 text-emerald-800'
            : (($flash['type'] ?? 'info') === 'error' ? 'border-rose-200 bg-rose-50 text-rose-800' : 'border-sky-200 bg-sky-50 text-sky-800');
        echo '<div class="mb-4 rounded-2xl border px-4 py-3 text-sm font-medium ' . $tone . '">' . html_escape((string) ($flash['message'] ?? '')) . '</div>';
    }
}

function render_shell_end(): void
{
    echo '</div></body></html>';
}

function render_form_input(string $label, string $name, string $value = '', string $type = 'text', bool $required = false, string $placeholder = ''): void
{
    echo '<label class="block">';
    echo '<span class="mb-2 block text-sm font-semibold text-slate-700">' . html_escape($label) . '</span>';
    echo '<input type="' . html_escape($type) . '" name="' . html_escape($name) . '" value="' . html_escape($value) . '" placeholder="' . html_escape($placeholder) . '" class="w-full rounded-2xl border border-white/60 bg-white/70 px-4 py-3 text-sm text-slate-900 shadow-sm outline-none transition focus:border-slate-300 focus:ring-2 focus:ring-slate-200" ' . ($required ? 'required' : '') . '>';
    echo '</label>';
}

function render_form_textarea(string $label, string $name, string $value = '', int $rows = 4, string $placeholder = ''): void
{
    echo '<label class="block">';
    echo '<span class="mb-2 block text-sm font-semibold text-slate-700">' . html_escape($label) . '</span>';
    echo '<textarea name="' . html_escape($name) . '" rows="' . $rows . '" placeholder="' . html_escape($placeholder) . '" class="w-full rounded-2xl border border-white/60 bg-white/70 px-4 py-3 text-sm text-slate-900 shadow-sm outline-none transition focus:border-slate-300 focus:ring-2 focus:ring-slate-200">' . html_escape($value) . '</textarea>';
    echo '</label>';
}

function setup_guard_or_redirect(): void
{
    if (!app_is_installed()) {
        return;
    }

    redirect('dashboard');
}

function login_admin(string $username, string $password): bool
{
    $storedUsername = get_setting('admin_username');
    $storedHash = get_setting('admin_password_hash');
    if ($storedUsername === null || $storedHash === null) {
        return false;
    }

    if (!hash_equals($storedUsername, $username)) {
        return false;
    }

    if (!password_verify($password, $storedHash)) {
        return false;
    }

    session_regenerate_id(true);
    $_SESSION['admin_logged_in'] = true;
    $_SESSION['admin_username'] = $username;

    return true;
}

function get_api_token_from_request(): ?string
{
    $authorization = request_header('Authorization');
    if ($authorization !== null && preg_match('/Bearer\s+(.+)/i', $authorization, $matches)) {
        return trim($matches[1]);
    }

    $headerToken = request_header('X-API-Token');
    if ($headerToken !== null && $headerToken !== '') {
        return $headerToken;
    }

    $queryToken = $_GET['token'] ?? $_POST['token'] ?? null;
    return is_string($queryToken) && $queryToken !== '' ? $queryToken : null;
}

function require_api_token(): void
{
    if (!rate_limit('api', API_RATE_LIMIT)) {
        error_response('Rate limit exceeded. Try again in a minute.', 429);
    }

    $token = get_api_token_from_request();
    $hash = get_setting('api_token_hash');

    if ($token === null || $hash === null || !password_verify($token, $hash)) {
        error_response('Invalid API token.', 401);
    }
}

function fetch_remote_json_source(): array
{
    ensure_runtime_paths();
    $url = get_setting('json_source_url', DEFAULT_JSON_SOURCE_URL) ?? DEFAULT_JSON_SOURCE_URL;
    $cacheKey = sha1($url);
    $cachePath = CACHE_DIR . '/source_' . $cacheKey . '.json';
    $metaPath = CACHE_DIR . '/source_' . $cacheKey . '.meta.json';
    $now = time();

    $cachedRaw = file_exists($cachePath) ? (string) file_get_contents($cachePath) : null;
    $meta = file_exists($metaPath) ? json_decode((string) file_get_contents($metaPath), true) : [];
    $fetchedAt = (int) ($meta['fetched_at'] ?? 0);

    if ($cachedRaw !== null && ($now - $fetchedAt) < CACHE_TTL_SECONDS) {
        $decoded = json_decode($cachedRaw, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new RuntimeException('Cached source JSON is invalid.');
        }

        return [
            'url' => $url,
            'raw' => $cachedRaw,
            'decoded' => $decoded,
            'cached' => true,
            'stale' => false,
            'fetched_at' => $fetchedAt,
        ];
    }

    $raw = download_url($url);
    if ($raw !== null) {
        $decoded = json_decode($raw, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new RuntimeException('Source JSON could not be decoded: ' . json_last_error_msg());
        }

        file_put_contents($cachePath, $raw, LOCK_EX);
        file_put_contents($metaPath, json_encode(['fetched_at' => $now, 'url' => $url], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES), LOCK_EX);

        return [
            'url' => $url,
            'raw' => $raw,
            'decoded' => $decoded,
            'cached' => false,
            'stale' => false,
            'fetched_at' => $now,
        ];
    }

    if ($cachedRaw !== null) {
        $decoded = json_decode($cachedRaw, true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new RuntimeException('Stale cache JSON is invalid.');
        }

        return [
            'url' => $url,
            'raw' => $cachedRaw,
            'decoded' => $decoded,
            'cached' => true,
            'stale' => true,
            'fetched_at' => $fetchedAt,
        ];
    }

    throw new RuntimeException('Unable to fetch the remote source and no cache is available.');
}

function download_url(string $url): ?string
{
    if (function_exists('curl_init')) {
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_TIMEOUT => 15,
            CURLOPT_CONNECTTIMEOUT => 10,
            CURLOPT_USERAGENT => APP_NAME . '/' . APP_VERSION,
            CURLOPT_SSL_VERIFYPEER => true,
            CURLOPT_HTTPHEADER => ['Accept: application/json'],
        ]);
        $response = curl_exec($ch);
        $status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $error = curl_error($ch);
        curl_close($ch);

        if ($response !== false && $status >= 200 && $status < 300) {
            return (string) $response;
        }

        if ($error !== '') {
            return null;
        }
    }

    $context = stream_context_create([
        'http' => [
            'method' => 'GET',
            'timeout' => 15,
            'ignore_errors' => true,
            'header' => "Accept: application/json\r\nUser-Agent: " . APP_NAME . '/' . APP_VERSION . "\r\n",
        ],
    ]);
    $response = @file_get_contents($url, false, $context);

    return $response === false ? null : $response;
}

function extract_server_uris($value, array &$collector = []): array
{
    $schemes = ['vless://', 'vmess://', 'trojan://', 'ss://'];

    if (is_string($value)) {
        $trimmed = trim($value);
        foreach ($schemes as $scheme) {
            if (stripos($trimmed, $scheme) === 0) {
                $collector[$trimmed] = $trimmed;
                break;
            }
        }
        return array_values($collector);
    }

    if (is_array($value)) {
        foreach ($value as $item) {
            extract_server_uris($item, $collector);
        }
    }

    return array_values($collector);
}

function parse_proxy_uri(string $uri): ?array
{
    $parts = parse_url($uri);
    if ($parts === false || empty($parts['scheme'])) {
        return null;
    }

    $scheme = strtolower((string) $parts['scheme']);
    if ($scheme === 'vless' || $scheme === 'trojan') {
        parse_str((string) ($parts['query'] ?? ''), $query);
        $fragment = isset($parts['fragment']) ? urldecode((string) $parts['fragment']) : '';
        return [
            'scheme' => $scheme,
            'raw' => $uri,
            'user' => (string) ($parts['user'] ?? ''),
            'password' => (string) ($parts['pass'] ?? ''),
            'host' => (string) ($parts['host'] ?? ''),
            'port' => isset($parts['port']) ? (int) $parts['port'] : null,
            'query' => $query,
            'name' => trim($fragment),
        ];
    }

    if ($scheme === 'ss') {
        $fragment = '';
        if (str_contains($uri, '#')) {
            [, $fragment] = explode('#', $uri, 2);
            $fragment = urldecode($fragment);
        }
        $withoutFragment = explode('#', $uri, 2)[0];
        $body = substr($withoutFragment, strlen('ss://'));
        $decoded = base64_decode(strtr($body, '-_', '+/'), true);
        if ($decoded === false) {
            $bodyParts = explode('@', $body, 2);
            if (count($bodyParts) !== 2) {
                return null;
            }
            $left = $bodyParts[0];
            $right = $bodyParts[1];
        } else {
            $bodyParts = explode('@', $decoded, 2);
            if (count($bodyParts) !== 2) {
                return null;
            }
            $left = $bodyParts[0];
            $right = $bodyParts[1];
        }
        [$method, $password] = array_pad(explode(':', $left, 2), 2, '');
        [$host, $port] = array_pad(explode(':', $right, 2), 2, '');
        return [
            'scheme' => 'ss',
            'raw' => $uri,
            'method' => $method,
            'password' => $password,
            'host' => $host,
            'port' => (int) $port,
            'name' => trim($fragment),
            'query' => [],
        ];
    }

    return null;
}

function clean_server_label(string $label): string
{
    $label = preg_replace('/\s+/', ' ', trim($label)) ?? '';
    return $label !== '' ? $label : 'VPN Server';
}

function server_rename_for(array $candidates, array $mapping): ?string
{
    foreach ($candidates as $candidate) {
        $candidate = trim((string) $candidate);
        if ($candidate === '') {
            continue;
        }

        if (isset($mapping[$candidate]) && trim((string) $mapping[$candidate]) !== '') {
            return trim((string) $mapping[$candidate]);
        }
    }

    return null;
}

function singbox_transport_from_query(array $query): ?array
{
    $type = strtolower((string) ($query['type'] ?? 'tcp'));

    if ($type === '' || $type === 'tcp') {
        return null;
    }

    if ($type === 'ws') {
        $transport = ['type' => 'ws'];
        if (!empty($query['path'])) {
            $transport['path'] = (string) $query['path'];
        }
        // Prefer explicit `host` param, fallback to `sni` when present.
        $host = (string) ($query['host'] ?? '');
        if ($host === '' && !empty($query['sni'])) {
            $host = (string) $query['sni'];
        }
        if ($host !== '') {
            $transport['headers'] = ['Host' => $host];
        }
        return $transport;
    }

    if ($type === 'grpc') {
        $transport = ['type' => 'grpc'];
        if (!empty($query['serviceName'])) {
            $transport['service_name'] = (string) $query['serviceName'];
        }
        if (!empty($query['mode'])) {
            $transport['mode'] = (string) $query['mode'];
        }
        return $transport;
    }

    if ($type === 'httpupgrade') {
        return [
            'type' => 'httpupgrade',
            'host' => (string) ($query['host'] ?? ''),
            'path' => (string) ($query['path'] ?? '/'),
        ];
    }

    if ($type === 'xhttp') {
        $transport = [
            'type' => 'http',
            'path' => (string) ($query['path'] ?? '/'),
        ];
        $host = (string) ($query['host'] ?? '');
        if ($host !== '') {
            $transport['host'] = [$host];
        }
        return $transport;
    }

    return ['type' => $type];
}

function singbox_tls_from_query(array $query, string $host): ?array
{
    $security = strtolower((string) ($query['security'] ?? 'none'));
    if (!in_array($security, ['tls', 'reality'], true)) {
        return null;
    }

    $tls = [
        'enabled' => true,
        'server_name' => (string) ($query['sni'] ?? $host),
    ];

    if (!empty($query['insecure']) && (string) $query['insecure'] !== '0') {
        $tls['insecure'] = true;
    }

    if (!empty($query['alpn'])) {
        $tls['alpn'] = array_values(array_filter(array_map('trim', explode(',', (string) $query['alpn']))));
    }

    if (!empty($query['fp'])) {
        $tls['utls'] = [
            'enabled' => true,
            'fingerprint' => (string) $query['fp'],
        ];
    }

    if ($security === 'reality' && !empty($query['pbk'])) {
        $tls['reality'] = [
            'enabled' => true,
            'public_key' => (string) $query['pbk'],
        ];
        if (!empty($query['sid'])) {
            $tls['reality']['short_id'] = (string) $query['sid'];
        }
    }

    return $tls;
}

function singbox_outbound_from_server(array $parsed, int $index, array $renameMap): ?array
{
    $name = clean_server_label($parsed['name'] ?: (($parsed['host'] ?? 'server') . ':' . ($parsed['port'] ?? '')));
    $renamed = server_rename_for([
        $parsed['name'] ?? '',
        $parsed['host'] ?? '',
        $parsed['raw'] ?? '',
    ], $renameMap);
    $displayName = $renamed ?? $name;
    $tag = slugify($displayName) . '-' . $index;

    if (($parsed['scheme'] ?? '') === 'vless') {
        $outbound = [
            'type' => 'vless',
            'tag' => $tag,
            'server' => (string) $parsed['host'],
            'server_port' => (int) ($parsed['port'] ?? 443),
            'uuid' => (string) $parsed['user'],
        ];
        if (!empty($parsed['query']['flow'])) {
            $outbound['flow'] = (string) $parsed['query']['flow'];
        }
        $tls = singbox_tls_from_query($parsed['query'], (string) $parsed['host']);
        if ($tls !== null) {
            $outbound['tls'] = $tls;
        }
        $transport = singbox_transport_from_query($parsed['query']);
        if ($transport !== null) {
            $outbound['transport'] = $transport;
        }
        if (!empty($parsed['query']['packetEncoding'])) {
            $outbound['packet_encoding'] = (string) $parsed['query']['packetEncoding'];
        }

        return [
            'tag' => $tag,
            'display_name' => $displayName,
            'country' => infer_country_from_label($displayName),
            'outbound' => $outbound,
        ];
    }

    if (($parsed['scheme'] ?? '') === 'trojan') {
        $outbound = [
            'type' => 'trojan',
            'tag' => $tag,
            'server' => (string) $parsed['host'],
            'server_port' => (int) ($parsed['port'] ?? 443),
            'password' => (string) $parsed['user'],
        ];
        $tls = singbox_tls_from_query($parsed['query'], (string) $parsed['host']);
        if ($tls !== null) {
            $outbound['tls'] = $tls;
        }
        $transport = singbox_transport_from_query($parsed['query']);
        if ($transport !== null) {
            $outbound['transport'] = $transport;
        }

        return [
            'tag' => $tag,
            'display_name' => $displayName,
            'country' => infer_country_from_label($displayName),
            'outbound' => $outbound,
        ];
    }

    if (($parsed['scheme'] ?? '') === 'ss') {
        $outbound = [
            'type' => 'shadowsocks',
            'tag' => $tag,
            'server' => (string) $parsed['host'],
            'server_port' => (int) ($parsed['port'] ?? 443),
            'method' => (string) ($parsed['method'] ?? ''),
            'password' => (string) ($parsed['password'] ?? ''),
        ];

        return [
            'tag' => $tag,
            'display_name' => $displayName,
            'country' => infer_country_from_label($displayName),
            'outbound' => $outbound,
        ];
    }

    return null;
}

function infer_country_from_label(string $label): string
{
    $normalized = trim(preg_replace('/[^\p{L}\p{N},\s-]+/u', '', $label) ?? '');
    if ($normalized === '') {
        return 'Unknown';
    }

    $parts = explode(',', $normalized);
    $first = trim($parts[0]);
    if ($first !== '') {
        return $first;
    }

    $words = preg_split('/\s+/', $normalized) ?: [];
    return trim(implode(' ', array_slice($words, 0, min(2, count($words))))) ?: 'Unknown';
}

function collect_countries_from_source(array $source): array
{
    $countries = [];

    foreach ($source as $key => $value) {
        if ($key === 'updated_at') {
            continue;
        }

        if ($key === 'other_countries' && is_array($value)) {
            foreach ($value as $country => $countryPayload) {
                if (is_array($countryPayload)) {
                    $countries[$country] = $country;
                }
            }
            continue;
        }

        if ($key === 'w_other') {
            continue;
        }

        if (is_array($value) && (array_key_exists('best', $value) || array_key_exists('top10', $value))) {
            $countries[humanize_source_key((string) $key)] = humanize_source_key((string) $key);
        }
    }

    foreach (extract_server_uris($source) as $uri) {
        $parsed = parse_proxy_uri($uri);
        if ($parsed !== null && !empty($parsed['name'])) {
            $countries[infer_country_from_label((string) $parsed['name'])] = infer_country_from_label((string) $parsed['name']);
        }
    }

    ksort($countries);
    return array_values($countries);
}

function humanize_source_key(string $key): string
{
    $key = preg_replace('/^w_/', '', $key) ?? $key;
    $key = str_replace('_', ' ', $key);

    return ucwords($key);
}

function strip_server_badges(string $label): string
{
    $label = urldecode($label);
    $label = preg_replace('/^\p{So}+\s*/u', '', $label) ?? $label;
    $label = preg_replace('/\|\s*\[[^\]]+\]/u', '', $label) ?? $label;
    $label = preg_replace('/\[[^\]]*CIDR[^\]]*\]/iu', 'Whitelist', $label) ?? $label;
    $label = preg_replace('/\b(BL|YA|VK)\b/u', '', $label) ?? $label;
    $label = preg_replace('/\s*\|\s*/u', ' | ', $label) ?? $label;
    $label = preg_replace('/\s+/', ' ', $label) ?? $label;
    $label = trim($label, " \t\n\r\0\x0B|-");

    return $label !== '' ? $label : 'VPN Server';
}

function normalize_country_name(string $country): string
{
    $country = trim($country);
    $country = preg_replace('/\s*Whitelist\s*$/iu', '', $country) ?? $country;
    if (strcasecmp($country, 'The Netherlands') === 0) {
        return 'Netherlands';
    }

    return $country;
}

function country_to_flag_emoji(string $country): string
{
    $map = [
        'Russia' => 'RU', 'Finland' => 'FI', 'Netherlands' => 'NL', 'Germany' => 'DE',
        'United States' => 'US', 'United Kingdom' => 'GB', 'Sweden' => 'SE', 'France' => 'FR',
        'Poland' => 'PL', 'Spain' => 'ES', 'Italy' => 'IT', 'Canada' => 'CA',
    ];

    $countryNorm = normalize_country_name($country);
    $iso = $map[$countryNorm] ?? null;
    if ($iso === null) {
        return '';
    }

    // Convert ISO letters to regional indicator symbols without requiring mbstring
    $s = strtoupper($iso);
    $emoji = '';
    for ($i = 0, $len = strlen($s); $i < $len; $i++) {
        $ch = $s[$i];
        $code = ord($ch);
        if ($code < 65 || $code > 90) {
            continue;
        }
        $cp = 0x1F1E6 + ($code - 65);
        // encode codepoint to UTF-8
        if ($cp <= 0x7F) {
            $emoji .= chr($cp);
        } elseif ($cp <= 0x7FF) {
            $emoji .= chr(0xC0 | ($cp >> 6)) . chr(0x80 | ($cp & 0x3F));
        } elseif ($cp <= 0xFFFF) {
            $emoji .= chr(0xE0 | ($cp >> 12)) . chr(0x80 | (($cp >> 6) & 0x3F)) . chr(0x80 | ($cp & 0x3F));
        } else {
            $emoji .= chr(0xF0 | ($cp >> 18)) . chr(0x80 | (($cp >> 12) & 0x3F)) . chr(0x80 | (($cp >> 6) & 0x3F)) . chr(0x80 | ($cp & 0x3F));
        }
    }

    return $emoji;
}

function country_to_russian_name(string $country): string
{
    $map = [
        'Russia' => 'Россия', 'Finland' => 'Финляндия', 'Netherlands' => 'Нидерланды',
        'Germany' => 'Германия', 'United States' => 'США', 'United Kingdom' => 'Великобритания',
        'Sweden' => 'Швеция', 'France' => 'Франция', 'Poland' => 'Польша',
        'Spain' => 'Испания', 'Italy' => 'Италия', 'Canada' => 'Канада',
    ];

    $countryNorm = normalize_country_name($country);
    return $map[$countryNorm] ?? $countryNorm;
}

function enhance_label_for_happ(string $country, string $label): string
{
    $flag = country_to_flag_emoji($country);
    $rus = country_to_russian_name($country);

    $parts = [];
    if ($flag !== '') {
        $parts[] = $flag;
    }
    if ($rus !== '') {
        $parts[] = $rus;
    }

    if (!empty($parts)) {
        return implode(' ', $parts) . ' — ' . $label;
    }

    return $label;
}

function build_happ_profile_header(array $subscription, array $payload = []): string
{
    // Use panel VPN name as profile title per request
    $title = get_setting('vpn_name', $subscription['name'] ?? 'Subscription') ?: ($subscription['name'] ?? 'Subscription');
    $updateInterval = (int) get_setting('happ_update_interval', '5');
    $support = (string) ($subscription['telegram_id'] ?? '');
    if ($support !== '' && !str_starts_with($support, 'http')) {
        // assume telegram id provided like @name or t.me/name
        if (str_starts_with($support, '@')) {
            $support = 'https://t.me/' . ltrim($support, '@');
        } elseif (!str_starts_with($support, 'http')) {
            $support = 'https://t.me/' . $support;
        }
    }

    $instructionLink = absolute_app_url('subscription/' . ($subscription['id'] ?? ''));
    $announce = (string) ($subscription['description'] ?? '');
    $announceBase64 = $announce === '' ? '' : base64_encode($announce);
    $expiresUnix = 0;
    if (!empty($subscription['expires_at'])) {
        $t = strtotime((string) $subscription['expires_at']);
        $expiresUnix = $t === false ? 0 : $t;
    }
    $created = $subscription['created_at'] ?? gmdate('c');
    $count = is_array($payload['servers'] ?? null) ? count($payload['servers']) : 0;

    $lines = [];
    $lines[] = '# profile-title: ' . $title;
    $lines[] = '# profile-update-interval: ' . $updateInterval;
    $lines[] = '# support-url: ' . $support;
    $lines[] = '# profile-web-page-url: ' . $instructionLink;
    $lines[] = '# announce: base64:' . $announceBase64;
    $lines[] = '# subscription-userinfo: upload=0; download=0; total=0; expire=' . $expiresUnix;
    $lines[] = '# traffic-limit: 0';
    $lines[] = '# Date/Time: ' . $created;
    $lines[] = '# Количество: ' . $count;

    return implode("\n", $lines) . "\n";
}

function is_whitelist_label(string $label): bool
{
    return (bool) preg_match('/CIDR|Whitelist/iu', $label);
}

function is_pseudo_country(string $country): bool
{
    return in_array(strtolower(trim($country)), ['baltics', 'other'], true);
}

function rebuild_uri_with_label(string $uri, string $label): string
{
    $base = explode('#', $uri, 2)[0];
    return $base . '#' . rawurlencode($label);
}

function extract_candidates_from_bucket(array $bucket, string $country, bool $isWhitelist, string $bucketKey): array
{
    $candidates = [];

    if (isset($bucket['top10']) && is_array($bucket['top10'])) {
        foreach ($bucket['top10'] as $entry) {
            if (!is_array($entry) || empty($entry['key']) || !is_string($entry['key'])) {
                continue;
            }

            $parsed = parse_proxy_uri($entry['key']);
            if ($parsed === null) {
                continue;
            }

            $rawLabel = (string) ($parsed['name'] ?? '');
            $cleanLabel = strip_server_badges($rawLabel);
            $resolvedCountry = normalize_country_name($country);
            if (is_pseudo_country($resolvedCountry)) {
                $resolvedCountry = normalize_country_name(infer_country_from_label($cleanLabel));
            }
            $isCidr = (bool) preg_match('/CIDR/iu', $rawLabel);
            $isWhite = $isWhitelist || is_whitelist_label($rawLabel) || str_starts_with($bucketKey, 'w_');
            $finalLabel = $isWhite
                ? $resolvedCountry . ' Whitelist'
                : $resolvedCountry;

            $candidates[] = [
                'uri' => rebuild_uri_with_label($entry['key'], $finalLabel),
                'raw_uri' => $entry['key'],
                'latency_ms' => isset($entry['latency_ms']) ? (float) $entry['latency_ms'] : 999999.0,
                'host' => (string) ($entry['host'] ?? ($parsed['host'] ?? '')),
                'port' => isset($entry['port']) ? (int) $entry['port'] : (int) ($parsed['port'] ?? 0),
                'country' => $resolvedCountry,
                'label' => $finalLabel,
                'is_whitelist' => $isWhite,
                'is_cidr' => $isCidr,
                'bucket' => $bucketKey,
            ];
        }
    }

    if ($candidates === [] && !empty($bucket['best']) && is_string($bucket['best'])) {
        $parsed = parse_proxy_uri($bucket['best']);
        if ($parsed !== null) {
            $rawLabel = (string) ($parsed['name'] ?? '');
            $cleanLabel = strip_server_badges($rawLabel);
            $resolvedCountry = normalize_country_name($country);
            if (is_pseudo_country($resolvedCountry)) {
                $resolvedCountry = normalize_country_name(infer_country_from_label($cleanLabel));
            }
            $isCidr = (bool) preg_match('/CIDR/iu', $rawLabel);
            $isWhite = $isWhitelist || is_whitelist_label($rawLabel) || str_starts_with($bucketKey, 'w_');
            $finalLabel = $isWhite
                ? $resolvedCountry . ' Whitelist'
                : $resolvedCountry;

            $candidates[] = [
                'uri' => rebuild_uri_with_label($bucket['best'], $finalLabel),
                'raw_uri' => $bucket['best'],
                'latency_ms' => 999999.0,
                'host' => (string) ($parsed['host'] ?? ''),
                'port' => (int) ($parsed['port'] ?? 0),
                'country' => $resolvedCountry,
                'label' => $finalLabel,
                'is_whitelist' => $isWhite,
                'is_cidr' => $isCidr,
                'bucket' => $bucketKey,
            ];
        }
    }

    return $candidates;
}

function curated_subscription_servers(array $source): array
{
    $ordinaryByCountry = [];
    $whitelistCandidates = [];

    foreach ($source as $key => $value) {
        if (!is_array($value) || $key === 'updated_at') {
            continue;
        }

        if ($key === 'other_countries') {
            foreach ($value as $country => $countryBucket) {
                if (!is_array($countryBucket)) {
                    continue;
                }
                if (is_pseudo_country((string) $country)) {
                    continue;
                }

                foreach (extract_candidates_from_bucket($countryBucket, (string) $country, false, (string) $country) as $candidate) {
                    $existing = $ordinaryByCountry[$candidate['country']] ?? null;
                    if ($existing === null || $candidate['latency_ms'] < $existing['latency_ms']) {
                        $ordinaryByCountry[$candidate['country']] = $candidate;
                    }
                }
            }
            continue;
        }

        $isWhitelistBucket = str_starts_with((string) $key, 'w_');
        $country = humanize_source_key((string) $key);
        if (!$isWhitelistBucket && is_pseudo_country($country)) {
            continue;
        }

        foreach (extract_candidates_from_bucket($value, $country, $isWhitelistBucket, (string) $key) as $candidate) {
            if ($candidate['is_whitelist']) {
                $whitelistCandidates[] = $candidate;
                continue;
            }

            $existing = $ordinaryByCountry[$candidate['country']] ?? null;
            if ($existing === null || $candidate['latency_ms'] < $existing['latency_ms']) {
                $ordinaryByCountry[$candidate['country']] = $candidate;
            }
        }
    }

    uasort($ordinaryByCountry, static fn(array $a, array $b): int => $a['latency_ms'] <=> $b['latency_ms']);
    usort($whitelistCandidates, static function (array $a, array $b): int {
        if (($a['is_cidr'] ?? false) !== ($b['is_cidr'] ?? false)) {
            return ($a['is_cidr'] ?? false) ? -1 : 1;
        }
        return $a['latency_ms'] <=> $b['latency_ms'];
    });

    $pickedWhitelist = [];
    $usedHosts = [];
    foreach ($whitelistCandidates as $candidate) {
        $hostKey = strtolower($candidate['host'] . ':' . $candidate['port']);
        if (isset($usedHosts[$hostKey])) {
            continue;
        }

        $usedHosts[$hostKey] = true;
        $pickedWhitelist[] = $candidate;
        if (count($pickedWhitelist) >= 2) {
            break;
        }
    }

    foreach ($pickedWhitelist as $index => &$candidate) {
        $candidate['label'] = normalize_country_name($candidate['country']) . ' Whitelist ' . ($index + 1);
        $candidate['uri'] = rebuild_uri_with_label($candidate['raw_uri'], $candidate['label']);
    }
    unset($candidate);

    $ordinary = array_values($ordinaryByCountry);
    $all = array_merge($ordinary, $pickedWhitelist);
    $countries = array_values(array_unique(array_map(static fn(array $item): string => $item['country'], $ordinary)));
    sort($countries);

    return [
        'ordinary' => $ordinary,
        'whitelist' => $pickedWhitelist,
        'all' => $all,
        'uris' => array_values(array_map(static fn(array $item): string => $item['uri'], $all)),
        'countries' => $countries,
    ];
}

function build_happ_config(array $source): array
{
    $renameMap = json_setting_array('server_renames', []);
    $curated = curated_subscription_servers($source);
    $renameMap = json_setting_array('server_renames', []);
    $converted = [];
    $tags = [];
    $countries = [];

    foreach (array_values($curated['uris']) as $index => $uri) {
        $parsed = parse_proxy_uri($uri);
        if ($parsed === null) {
            continue;
        }

        $convertedServer = singbox_outbound_from_server($parsed, $index + 1, $renameMap);
        if ($convertedServer === null) {
            continue;
        }

        $converted[] = $convertedServer['outbound'];
        $tags[] = $convertedServer['tag'];
        $countries[$convertedServer['country']] = $convertedServer['country'];
    }

    if ($tags === []) {
        throw new RuntimeException('No compatible proxy servers were found in the source JSON.');
    }

    $converted[] = [
        'type' => 'selector',
        'tag' => 'proxy',
        'outbounds' => $tags,
        'default' => $tags[0],
    ];
    $converted[] = [
        'type' => 'direct',
        'tag' => 'direct',
    ];

    ksort($countries);

    return [
        'config' => [
            'log' => ['level' => 'info'],
            'outbounds' => $converted,
            'route' => [
                'rules' => [
                    [
                        'geoip' => ['ru'],
                        'outbound' => 'direct',
                    ],
                    [
                        'outbound' => 'proxy',
                    ],
                ],
            ],
        ],
        'countries' => array_values($countries),
        'server_count' => count($tags),
        'ordinary_count' => count($curated['ordinary']),
        'whitelist_count' => count($curated['whitelist']),
    ];
}

function fetch_plan(?string $planId): ?array
{
    if ($planId === null || trim($planId) === '') {
        return null;
    }

    $stmt = database()->prepare('SELECT * FROM plans WHERE id = :id LIMIT 1');
    $stmt->execute(['id' => $planId]);
    $plan = $stmt->fetch();

    return $plan ?: null;
}

function fetch_subscription(string $id): ?array
{
    $stmt = database()->prepare(
        'SELECT s.*, p.name AS plan_name, p.duration_days AS plan_duration_days, p.price AS plan_price
         FROM subscriptions s
         LEFT JOIN plans p ON p.id = s.plan_id
         WHERE s.id = :id
         LIMIT 1'
    );
    $stmt->execute(['id' => $id]);
    $subscription = $stmt->fetch();

    return $subscription ?: null;
}

function subscription_status_detail(array $subscription): array
{
    if (($subscription['status'] ?? 'active') !== 'active') {
        return ['ok' => false, 'code' => 403, 'reason' => 'Subscription is disabled.'];
    }

    $expiresAt = strtotime((string) ($subscription['expires_at'] ?? ''));
    if ($expiresAt === false || $expiresAt < time()) {
        return ['ok' => false, 'code' => 410, 'reason' => 'Subscription has expired.'];
    }

    return ['ok' => true, 'code' => 200, 'reason' => 'active'];
}

function build_subscription_meta(array $subscription): array
{
    return [
        'name' => $subscription['name'],
        'description' => $subscription['description'],
        'badge' => $subscription['badge'],
        'expires_at' => $subscription['expires_at'],
        'telegram_id' => $subscription['telegram_id'],
        'plan' => $subscription['plan_name'] ?? null,
        'subscription_id' => $subscription['id'],
        'vpn_name' => get_setting('vpn_name', 'XAMBoost VPN'),
        'logo_url' => get_setting('logo_url', ''),
        'accent_color' => get_setting('accent_color', '#22c55e'),
    ];
}

function build_default_subscription_payload(array $subscription, array $source): array
{
    $useManual = (get_setting('use_manual_servers', '0') === '1');
    $curated = curated_subscription_servers($source);

    $allItems = $curated['all'];

    if ($useManual) {
        $manual = (string) get_setting('manual_servers', '');
        $lines = array_values(array_filter(array_map('trim', preg_split('/\r?\n/', $manual) ?: [])));
        $manualItems = [];
        foreach ($lines as $line) {
            $parsed = parse_proxy_uri($line);
            $label = $parsed['name'] ?? '';
            $country = $parsed['name'] ? infer_country_from_label($parsed['name']) : 'Unknown';
            $manualItems[] = [
                'uri' => rebuild_uri_with_label($line, enhance_label_for_happ($country, $label ?: $line)),
                'raw_uri' => $line,
                'latency_ms' => 999999.0,
                'host' => (string) ($parsed['host'] ?? ''),
                'port' => (int) ($parsed['port'] ?? 0),
                'country' => $country,
                'label' => enhance_label_for_happ($country, $label ?: $line),
                'is_whitelist' => false,
                'is_cidr' => false,
                'bucket' => 'manual',
            ];
        }

        $allItems = $manualItems;
        $ordinary = $manualItems;
        $whitelist = [];
    } else {
        // Choose top 3 ordinary servers (one per country) and up to 1 whitelist server
        $ordinary = array_slice($curated['ordinary'], 0, 3);
        $whitelist = array_slice($curated['whitelist'], 0, 1);

        // Enhance labels and ensure URI remarks updated
        foreach ($ordinary as &$it) {
            $it['label'] = enhance_label_for_happ($it['country'] ?? 'Unknown', $it['label'] ?? ($it['country'] ?? 'Server'));
            $it['uri'] = rebuild_uri_with_label($it['raw_uri'] ?? ($it['uri'] ?? ''), $it['label']);
        }
        unset($it);

        foreach ($whitelist as &$it) {
            $it['label'] = enhance_label_for_happ($it['country'] ?? 'Unknown', $it['label'] ?? ($it['country'] ?? 'Whitelist'));
            $it['uri'] = rebuild_uri_with_label($it['raw_uri'] ?? ($it['uri'] ?? ''), $it['label']);
        }
        unset($it);

        $allItems = array_merge($ordinary, $whitelist);
    }

    return [
        'meta' => array_merge(build_subscription_meta($subscription), [
            'server_count' => count($allItems),
            'stable_country_count' => count($ordinary),
            'whitelist_server_count' => count($whitelist),
        ]),
        'servers' => array_values(array_map(static fn(array $i): string => $i['uri'], $allItems)),
        'server_groups' => [
            'standard' => array_map(static fn(array $item): array => [
                'country' => $item['country'],
                'name' => $item['label'],
                'latency_ms' => $item['latency_ms'],
                'uri' => $item['uri'],
            ], $ordinary),
            'whitelist' => array_map(static fn(array $item): array => [
                'country' => $item['country'],
                'name' => $item['label'],
                'latency_ms' => $item['latency_ms'],
                'uri' => $item['uri'],
            ], $whitelist),
        ],
        'routing' => [
            'rules' => [
                [
                    'type' => 'field',
                    'geoip' => ['ru'],
                    'outbound' => 'direct',
                ],
                [
                    'type' => 'field',
                    'outbound' => 'proxy',
                ],
            ],
        ],
    ];
}

function wants_json_response(): bool
{
    $queryFlags = [
        $_GET['response'] ?? null,
        $_GET['view'] ?? null,
        $_GET['output'] ?? null,
    ];

    foreach ($queryFlags as $flag) {
        if (is_string($flag) && strtolower($flag) === 'json') {
            return true;
        }
    }

    $accept = strtolower(request_header('Accept') ?? '');
    if ($accept !== '' && str_contains($accept, 'application/json') && !str_contains($accept, 'text/html')) {
        return true;
    }

    $xhr = strtolower(request_header('X-Requested-With') ?? '');
    return $xhr === 'xmlhttprequest';
}

function save_uploaded_logo(string $fieldName = 'logo_file'): ?string
{
    if (empty($_FILES[$fieldName]) || !is_array($_FILES[$fieldName])) {
        return null;
    }

    $file = $_FILES[$fieldName];
    if (($file['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_NO_FILE) {
        return null;
    }

    if (($file['error'] ?? UPLOAD_ERR_OK) !== UPLOAD_ERR_OK) {
        throw new RuntimeException('Logo upload failed.');
    }

    $finfo = new finfo(FILEINFO_MIME_TYPE);
    $mime = $finfo->file((string) $file['tmp_name']) ?: '';
    $extensions = [
        'image/png' => 'png',
        'image/jpeg' => 'jpg',
        'image/webp' => 'webp',
        'image/gif' => 'gif',
    ];

    if (!isset($extensions[$mime])) {
        throw new RuntimeException('Unsupported logo format. Use PNG, JPG, WEBP, or GIF.');
    }

    $filename = 'logo_' . date('Ymd_His') . '_' . bin2hex(random_bytes(4)) . '.' . $extensions[$mime];
    $target = UPLOADS_DIR . '/' . $filename;

    if (!move_uploaded_file((string) $file['tmp_name'], $target)) {
        throw new RuntimeException('Unable to store uploaded logo.');
    }

    return absolute_app_url('uploads/' . $filename);
}

function next_expiry_from_days(?string $currentExpiresAt, int $days): string
{
    $base = strtotime((string) $currentExpiresAt);
    $start = ($base !== false && $base > time()) ? $base : time();
    return gmdate('Y-m-d H:i:s', strtotime('+' . $days . ' days', $start));
}

function ensure_subscription_exists_or_fail(string $id): array
{
    $subscription = fetch_subscription($id);
    if ($subscription === null) {
        error_response('Subscription not found.', 404);
    }

    return $subscription;
}

function collect_dashboard_stats(): array
{
    $pdo = database();
    $totals = [
        'subscriptions' => (int) $pdo->query('SELECT COUNT(*) FROM subscriptions')->fetchColumn(),
        'active' => (int) $pdo->query("SELECT COUNT(*) FROM subscriptions WHERE status = 'active'")->fetchColumn(),
        'expired' => (int) $pdo->query("SELECT COUNT(*) FROM subscriptions WHERE expires_at < datetime('now')")->fetchColumn(),
        'plans' => (int) $pdo->query('SELECT COUNT(*) FROM plans')->fetchColumn(),
    ];

    return $totals;
}

function all_plans(): array
{
    return database()->query('SELECT * FROM plans ORDER BY duration_days ASC, name ASC')->fetchAll();
}

function all_subscriptions(): array
{
    return database()->query(
        'SELECT s.*, p.name AS plan_name
         FROM subscriptions s
         LEFT JOIN plans p ON p.id = s.plan_id
         ORDER BY datetime(s.created_at) DESC'
    )->fetchAll();
}

function current_page_url(): string
{
    $uri = $_SERVER['REQUEST_URI'] ?? '/';
    return strtok($uri, '?') ?: '/';
}