Upload server.js

server.js

@@ -0,0 +1,1418 @@
+/**
+ * ============================================================================
+ * PINOMAX MTProto Streaming, Auto-Indexer & Telegram Mini App Engine
+ * Powered by Express.js, GramJS (MTProto), MongoDB Atlas, Firebase & Artplayer
+ * ============================================================================
+ */
+
+import express from 'express';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import dotenv from 'dotenv';
+import axios from 'axios';
+import cors from 'cors';
+import helmet from 'helmet';
+import mongoose from 'mongoose';
+import { TelegramClient, Api } from 'telegram';
+import { StringSession } from 'telegram/sessions/index.js';
+import { NewMessage } from 'telegram/events/index.js';
+import bigInt from 'big-integer';
+import AdmZip from 'adm-zip';
+import crypto from 'crypto';
+if (!globalThis.crypto) globalThis.crypto = crypto;
+// Ilagay ito sa tabi ng iba pang imports sa itaas ng server.js mo
+import subtitleRoutes from './routes/subtitles.js';
+
+// Load Environment Variables
+dotenv.config();
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Initialize Express App
+const app = express();
+const PORT = process.env.PORT || 3000;
+
+// Core Configuration
+//const APP_URL = (process.env.APP_URL || 'https://streamixph05-pinomaxstreamv12026.hf.space').replace(/\/+$/, '');///
+const APP_URL = (process.env.APP_URL || 'https://movie-production-57b9.up.railway.app').replace(/\/+$/, '');
+const WORKER_URL = "https://pinomax-cache.roderickalmaras05.workers.dev";
+const API_ID = parseInt(process.env.API_ID || '0', 10);
+const API_HASH = (process.env.API_HASH || '').trim();
+const BOT_TOKEN = (process.env.BOT_TOKEN || '').trim();
+const ADMIN_ID = (process.env.ADMIN_ID || '').toString().trim();
+const MONGODB_URI = process.env.MONGODB_URI || '';
+const FIREBASE_DATABASE_URL = (process.env.FIREBASE_DATABASE_URL || 'https://jetmax-f3e8e-default-rtdb.firebaseio.com').replace(/\/+$/, '');
+const TMDB_API_KEY = process.env.TMDB_API_KEY || '86fd55697899e8444fa3da3ddd24518d';
+
+// Payment Configuration (GCash & PayPal)
+const PAYMENT_CONFIG = {
+  gcash_number: process.env.GCASH_NUMBER || '09638924040',
+  gcash_name: process.env.GCASH_NAME || 'PINOMAX ADMIN',
+  paypal_email: process.env.PAYPAL_EMAIL || 'payments@pinomax.com',
+  donate_amount: '5'
+};
+// 🟢 TELEGRAM MEDIA IN-MEMORY CACHE (Para instant play at walang Telegram API lag)
+const telegramMediaCache = new Map();
+
+// ---------------------------------------------------------------------------
+// 1. MONGODB DATABASE & SCHEMA (Collection: stream_files)
+// ---------------------------------------------------------------------------
+const streamFileSchema = new mongoose.Schema({
+  file_unique_id: { type: String, index: true },
+  file_id: { type: String, index: true },
+  unique_id: { type: String, index: true },
+  fileId: { type: String, index: true },
+  message_id: { type: Number },
+  messageId: { type: Number },
+  chat_id: { type: String },
+  chatId: { type: String },
+  channelId: { type: String, default: null },
+  file_name: { type: String, default: 'media.mp4' },
+  fileName: { type: String, default: 'media.mp4' },
+  file_size: { type: Number, default: 0 },
+  fileSize: { type: Number, default: 0 },
+  mime_type: { type: String, default: 'video/mp4' },
+  mimeType: { type: String, default: 'video/mp4' },
+  poster: { type: String, default: '' },
+  year: { type: String, default: '' },
+  rating: { type: String, default: '8.5' },
+  overview: { type: String, default: '' },
+  category: { type: String, default: 'Movie' },
+  episode: { type: String, default: '' },
+  uploadedBy: { type: String, default: 'Admin' },
+  createdAt: { type: Date, default: Date.now, index: true }
+}, {
+  collection: 'stream_files',
+  timestamps: true,
+  strict: false
+});
+
+const inMemoryFiles = new Map();
+let StreamFileModel = null;
+let StreamFile = null;
+let isMongoConnected = false;
+
+if (MONGODB_URI) {
+  mongoose.connect(MONGODB_URI, { serverSelectionTimeoutMS: 5000 }).then(() => {
+    isMongoConnected = true;
+    console.log('✅ Connected to MongoDB Atlas.');
+  }).catch((err) => {
+    console.warn('⚠️ MongoDB fallback to memory cache:', err.message);
+  });
+  StreamFileModel = mongoose.models.StreamFile || mongoose.model('StreamFile', streamFileSchema);
+  StreamFile = StreamFileModel;
+}
+
+async function saveStreamFileRecord(data) {
+  const primaryId = data.file_unique_id || data.file_id || data.unique_id || data.fileId;
+  const normalized = {
+    ...data,
+    file_unique_id: primaryId,
+    file_id: primaryId,
+    unique_id: primaryId,
+    fileId: primaryId,
+    chat_id: data.chat_id || data.chatId,
+    chatId: data.chatId || data.chat_id,
+    message_id: data.message_id || data.messageId,
+    messageId: data.messageId || data.message_id,
+    file_name: data.file_name || data.fileName || 'media.mp4',
+    fileName: data.fileName || data.file_name || 'media.mp4',
+    file_size: data.file_size !== undefined ? data.file_size : (data.fileSize || 0),
+    fileSize: data.fileSize !== undefined ? data.fileSize : (data.file_size || 0),
+    mime_type: data.mime_type || data.mimeType || 'video/mp4',
+    mimeType: data.mimeType || data.mime_type || 'video/mp4',
+    poster: data.poster || '',
+    year: data.year || '',
+    rating: data.rating || '8.5',
+    overview: data.overview || '',
+    category: data.category || 'Movie',
+    episode: data.episode || '',
+    updatedAt: new Date()
+  };
+
+  inMemoryFiles.set(primaryId, normalized);
+  const model = StreamFile || StreamFileModel;
+  if (isMongoConnected && model) {
+    try {
+      return await model.findOneAndUpdate(
+        { $or: [ { file_unique_id: primaryId }, { file_id: primaryId } ] },
+        { $set: normalized },
+        { upsert: true, new: true }
+      );
+    } catch (e) {
+      console.error('MongoDB save error:', e.message);
+    }
+  }
+  return normalized;
+}
+
+async function getStreamFileRecord(fileId) {
+  if (!fileId) return null;
+  const idStr = String(fileId).trim();
+  const model = StreamFile || StreamFileModel;
+  if (isMongoConnected && model) {
+    try {
+      const fileRecord = await model.findOne({
+        $or: [
+          { file_unique_id: idStr },
+          { file_id: idStr },
+          { unique_id: idStr },
+          { fileId: idStr }
+        ]
+      }).lean();
+      if (fileRecord) return fileRecord;
+    } catch (e) {
+      console.error('MongoDB find error:', e.message);
+    }
+  }
+  return inMemoryFiles.get(idStr) || null;
+}
+
+function formatBytes(bytes, decimals = 2) {
+  if (!bytes || bytes === 0) return '0 Bytes';
+  const k = 1024;
+  const dm = decimals < 0 ? 0 : decimals;
+  const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(dm)) + ' ' + sizes[i];
+}
+
+// ---------------------------------------------------------------------------
+// 2. GRAMJS TELEGRAM MTPROTO ENGINE (AUTO-INDEXER WITH WORKER URLs)
+// ---------------------------------------------------------------------------
+let tgClient = null;
+let isGramJsConnected = false;
+
+if (API_ID && API_HASH && BOT_TOKEN) {
+  try {
+    const stringSession = new StringSession(process.env.SESSION_STRING || "");
+    tgClient = new TelegramClient(stringSession, API_ID, API_HASH, {
+      connectionRetries: 10,
+      retryDelay: 1000,
+      autoReconnect: true,
+      useIPv6: false,
+      timeout: 30,
+      floodSleepThreshold: 60
+    });
+  } catch (initErr) {
+    console.warn('⚠️ TelegramClient init notice:', initErr.message);
+  }
+}
+
+if (tgClient && API_ID && API_HASH && BOT_TOKEN) {
+  (async () => {
+    try {
+      console.log('Connecting Telegram GramJS MTProto client...');
+      await tgClient.start({ botAuthToken: process.env.BOT_TOKEN });
+      isGramJsConnected = true;
+      console.log('✅ Telegram GramJS MTProto Client successfully authenticated!');
+      
+      // 🟢 I-PRINT ANG SESSION STRING (Para makopya mo sa Railway)
+      try {
+        const savedSession = tgClient.session.save();
+        if (savedSession) {
+          console.log('🔑 SESSION_STRING MO (Kopyahin ito sa Railway):', savedSession);
+        }
+      } catch (_) {}
+
+      // 🟢 AUTO-CONNECT SA MGA STORAGE CHANNELS
+      const rawChannels = process.env.STORAGE_CHANNELS || '';
+      const STORAGE_CHANNELS = rawChannels
+        .split(',')
+        .map(id => id.trim())
+        .filter(Boolean);
+
+      if (STORAGE_CHANNELS.length > 0) {
+        console.log(`🔄 Kinokonekta ang ${STORAGE_CHANNELS.length} storage channels...`);
+        for (const chId of STORAGE_CHANNELS) {
+          try {
+            await tgClient.getInputEntity(chId);
+            console.log(`✅ Channel Connected & Cached: ${chId}`);
+          } catch (err) {
+            console.warn(`⚠️ Warning: Hindi ma-cache ang channel ${chId}:`, err.message);
+          }
+        }
+      }
+      // Keep Alive
+      setInterval(async () => {
+        if (tgClient && isGramJsConnected) {
+          try { await tgClient.getMe(); } catch (e) {}
+        }
+      }, 40000);
+
+    // Event Handler para sa Auto-Indexing ng Videos
+tgClient.addEventHandler(async (event) => {
+  try {
+    const message = event.message;
+    if (!message) return;
+
+    // 🟢 1. BASAHIN ANG ADMIN IDS SA TAAS (Mababasa ng lahat)
+    const ADMIN_IDS = (process.env.ADMIN_ID || '').split(',').map(id => id.trim()).filter(Boolean);
+
+    const senderId = message.senderId ? message.senderId.toString() : '';
+    const peerChannelId = message.peerId?.channelId ? message.peerId.channelId.toString() : '';
+    const chatId = peerChannelId ? `-100${peerChannelId}` : (message.chatId ? message.chatId.toString() : '');
+    const messageId = message.id;
+    const isChannelPost = Boolean(peerChannelId);
+    const isSenderAdmin = ADMIN_IDS.includes(senderId) || ADMIN_IDS.includes(chatId);
+    
+    // 🟢 1. COMMAND: /start (Private Chat Welcome)
+    if (!isChannelPost && message.message?.startsWith('/start')) {
+      if (ADMIN_IDS.length > 0 && !isSenderAdmin) {
+        await tgClient.sendMessage(chatId, {
+          message: `⛔ <b>Access Denied!</b>\n\nYour Telegram User ID: <code>${senderId}</code>\nAuthorized Admin ID: <code>${ADMIN_IDS.join(', ')}</code>`,
+          parseMode: 'html',
+        });
+        return;
+      }
+
+      await tgClient.sendMessage(chatId, {
+        message: 
+`🚀 <b>Welcome to PINOMAX MTProto Media Streaming & Downloader Engine!</b>
+
+⚡ <b>Bypasses the 20MB Bot API Limit</b> — Supports files up to <b>2GB</b>!
+
+*✨ Key Features:*
+• 📺 <b>HTTP 206 Partial Content Streaming</b>
+• 📥 <b>Direct Attachment Downloader</b>
+• 🎬 <b>Standalone Embed Video Player (with CC & Subtitles)</b>
+
+👉 <i>Mag-forward ng movie rito o mag-upload sa Channel para mag-auto index! Gamitin ang <b>/list</b> para makita ang mga uploaded movies.</i>`,
+        parseMode: 'html',
+      });
+      return;
+    }
+
+    // 🟢 2. COMMAND: /list (Ilista ang 10 pinakabagong uploaded movies)
+    if (!isChannelPost && message.message?.startsWith('/list')) {
+      try {
+        const model = StreamFile || StreamFileModel;
+        let files = [];
+        if (isMongoConnected && model) {
+          files = await model.find().sort({ createdAt: -1 }).limit(10).lean();
+        } else {
+          files = Array.from(inMemoryFiles.values()).slice(0, 10);
+        }
+
+        if (!files || files.length === 0) {
+          await tgClient.sendMessage(chatId, {
+            message: '📂 <b>Wala pang naka-save na movies sa database.</b>',
+            parseMode: 'html'
+          });
+          return;
+        }
+
+        let listText = '🎬 <b>Recent Uploaded Movies (PINOMAX):</b>\n\n';
+        files.forEach((f, idx) => {
+          const fId = f.file_unique_id || f.file_id || f.unique_id;
+          const embedUrl = `${WORKER_URL}/embed/${fId}`;
+          const title = f.file_name || f.fileName || 'Movie';
+          const size = formatBytes(f.file_size || f.fileSize || 0);
+          listText += `${idx + 1}. <b>${title}</b> (${size})\n`;
+          listText += `   👉 <code>${embedUrl}</code>\n\n`;
+        });
+
+        await tgClient.sendMessage(chatId, {
+          message: listText,
+          parseMode: 'html'
+        });
+      } catch (err) {
+        console.error('List error:', err);
+      }
+      return;
+    }
+
+    // 🟢 3. MEDIA HANDLER (Video Auto-Indexer)
+    if (message.media && (message.media.document || message.media.video || message.file)) {
+      // Harangin ang ibang tao kapag nag-upload sa PM
+      if (!isChannelPost && ADMIN_IDS.length > 0 && !isSenderAdmin) {
+        return;
+      }
+
+      const doc = message.media.document || message.media;
+      const file = message.file;
+
+            let fileName = file?.name || '';
+            if (!fileName && doc?.attributes) {
+              const fnAttr = doc.attributes.find(a => a.className === 'DocumentAttributeFilename' || a.fileName);
+              if (fnAttr && fnAttr.fileName) fileName = fnAttr.fileName;
+            }
+            if (!fileName) fileName = `media_${messageId}.${file?.ext || 'mp4'}`;
+
+            const fileSize = Number(file?.size || doc?.size || 0);
+            const mimeType = file?.mimeType || doc?.mimeType || 'video/mp4';
+            const fileUniqueId = `${chatId.replace(/^-/, '')}_${messageId}`;
+          // 🛡️ HARANGIN ANG MGA KALAT NA FILES / INTRO TEST (< 5MB)
+            if (fileSize < 5 * 1024 * 1024) {
+              console.log(`⏩ Skipped junk/small media (${formatBytes(fileSize)}): ${fileName}`);
+              return; // Hindi ito ise-save sa database
+            }
+
+            let poster = '';
+            let year = '2024';
+            let rating = '8.5';
+            let overview = '';
+            let category = fileName.toLowerCase().includes('series') ? 'Series' : 'Movie';
+            let episode = '';
+
+            // ✅ SMART TMDB TITLE CLEANER & DUAL SEARCH
+            try {
+              // 1. Linisin ang mga kalat na tags, channel names, resolution, at underscores
+              let cleanTitle = fileName
+                .replace(/\.mp4|\.mkv|\.webm|\.avi/gi, '')
+                .replace(/@\w+/g, '') // Tanggalin ang @channel_name
+                .replace(/tagalog dubbed|tagdub|dubbed|pinoy|tagalog|full movie/gi, '')
+                .replace(/1080p|720p|480p|hdrip|bluray|web-dl|webrip|x264|x265|hevc/gi, '')
+                .replace(/[\(\)\[\]_\-\.]+/g, ' ') // Palitan ang _, -, at brackets ng space
+                .trim();
+
+              // 2. Hanapin kung may Taon (e.g. 2024, 2000, 1999)
+              const yearMatch = cleanTitle.match(/\b(19\d{2}|20\d{2})\b/);
+              let detectedYear = yearMatch ? yearMatch[1] : '';
+              if (detectedYear) {
+                cleanTitle = cleanTitle.replace(detectedYear, '').trim();
+              }
+
+              // 3. Unang Search sa TMDB (May Title + Year para eksakto)
+              let searchUrl = `https://api.themoviedb.org/3/search/multi?api_key=${TMDB_API_KEY}&query=${encodeURIComponent(cleanTitle)}${detectedYear ? '&year=' + detectedYear : ''}`;
+              let searchRes = await axios.get(searchUrl, { timeout: 4000 });
+
+              // 4. Fallback Search: Kung walang nahanap, mag-search uli gamit ang Title lang
+              if (!searchRes.data?.results?.length && detectedYear) {
+                searchUrl = `https://api.themoviedb.org/3/search/multi?api_key=${TMDB_API_KEY}&query=${encodeURIComponent(cleanTitle)}`;
+                searchRes = await axios.get(searchUrl, { timeout: 4000 });
+              }
+
+              if (searchRes.data?.results?.length > 0) {
+                const resItem = searchRes.data.results[0];
+                if (resItem.poster_path) {
+                  poster = `https://image.tmdb.org/t/p/w500${resItem.poster_path}`;
+                }
+                year = (resItem.release_date || resItem.first_air_date || detectedYear || '').split('-')[0] || '2024';
+                rating = resItem.vote_average ? resItem.vote_average.toFixed(1) : '8.5';
+                overview = resItem.overview ? (resItem.overview.length > 120 ? resItem.overview.substring(0, 120) + '...' : resItem.overview) : '';
+                category = resItem.media_type === 'tv' ? 'Series' : 'Movie';
+              } else {
+                year = detectedYear || '2024';
+              }
+            } catch (_) {}
+
+              
+
+            await saveStreamFileRecord({
+              chat_id: chatId.toString(),
+              message_id: Number(messageId),
+              file_name: fileName,
+              file_size: fileSize,
+              mime_type: mimeType,
+              poster,
+              year,
+              rating,
+              overview,
+              category,
+              episode,
+              unique_id: fileUniqueId,
+              uploadedBy: isChannelPost ? 'Channel Storage' : (senderId ? `@${senderId}` : 'Admin')
+            });
+            
+            // I-cache agad ang media para ready sa streaming
+            telegramMediaCache.set(`${chatId}_${messageId}`, {
+              media: message.media,
+              size: fileSize,
+              mimeType,
+              timestamp: Date.now()
+            });
+
+            const streamUrl = `${WORKER_URL}/stream/${fileUniqueId}`;
+            const downloadUrl = `${WORKER_URL}/download/${fileUniqueId}?file=${encodeURIComponent(fileName)}`;
+            const embedUrl = `${WORKER_URL}/embed/${fileUniqueId}`;
+            const sizeFormatted = formatBytes(fileSize);
+
+            // 👉 FORMAT NA TUGMANG-TUGMA SA SCREENSHOT 1:
+            const replyHtml = 
+`🎬 <b>Media Successfully Indexed (2GB MTProto Engine)!</b>\n\n` +
+`📁 <b>File Name:</b> ${fileName}\n` +
+`📦 <b>File Size:</b> ${sizeFormatted}\n` +
+`🏷️ <b>Source:</b> ${isChannelPost ? 'Channel Auto-Index' : 'Direct Upload'}\n` +
+`🆔 <b>File ID:</b> ${fileUniqueId}\n\n` +
+`━━━━━━━━━━━━━━━━━━━━\n` +
+`📺 <b>Stream URL (HTTP 206):</b>\n` +
+`${streamUrl}\n\n` +
+`📥 <b>Direct Download URL:</b>\n` +
+`${downloadUrl}\n\n` +
+`🎬 <b>Cloudflare Cached Embed URL:</b>\n` +
+`${embedUrl}\n` +
+`━━━━━━━━━━━━━━━━━━━━`;
+
+         // 1. KUNG SA STORAGE CHANNEL KA NAG-UPLOAD O NAG-FORWARD:
+            if (isChannelPost) {
+              await tgClient.sendMessage(chatId, { 
+                message: replyHtml, 
+                replyTo: Number(messageId), 
+                parseMode: 'html' 
+              }).catch((e) => console.error('Channel send error:', e.message));
+
+              if (ADMIN_ID && chatId !== ADMIN_ID) {
+                await tgClient.sendMessage(ADMIN_ID, { 
+                  message: replyHtml, 
+                  parseMode: 'html' 
+                }).catch((e) => console.error('Admin PM send error:', e.message));
+              }
+            } 
+            // 2. KUNG DIRECT FORWARD MO SA PM NG BOT:
+            else {
+              await tgClient.sendMessage(chatId, { 
+                message: replyHtml, 
+                parseMode: 'html' 
+              }).catch((e) => console.error('PM send error:', e.message));
+            }
+          }
+        } catch (err) {
+          console.error('Error in event handler:', err);
+        }
+      }, new NewMessage({}));
+
+    } catch (err) {
+      console.warn('⚠️ GramJS Error:', err.message);
+    }
+  })();
+}
+
+// ---------------------------------------------------------------------------
+// 3. EXPRESS MIDDLEWARE CONFIGURATION
+// ---------------------------------------------------------------------------
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+app.use(cors());
+app.use(helmet({ contentSecurityPolicy: false, crossOriginEmbedderPolicy: false }));
+app.set('view engine', 'ejs');
+app.set('views', path.join(__dirname, 'views'));
+app.use(express.static(path.join(__dirname, 'public')));
+
+app.use('/', subtitleRoutes);
+// ---------------------------------------------------------------------------
+// 4. FIREBASE VIP & PAYMENT APIS (TUGMA SA AdminDashboardActivity.java)
+// ---------------------------------------------------------------------------
+app.get('/api/vip/status/:uid', async (req, res) => {
+  const { uid } = req.params;
+  try {
+    const fb = await axios.get(`${FIREBASE_DATABASE_URL}/users/${uid}.json`);
+    const user = fb.data || {};
+    let isVip = user.isVip || false;
+    const expiry = user.vip_expiry || 0;
+
+    if (isVip && expiry > 0 && Date.now() > expiry) {
+      isVip = false;
+      await axios.patch(`${FIREBASE_DATABASE_URL}/users/${uid}.json`, { isVip: false });
+    }
+
+    return res.json({
+      isVip,
+      vip_expiry: expiry,
+      userName: user.name || user.user_name || 'User',
+      active_request: user.active_request || null
+    });
+  } catch (e) {
+    return res.json({ isVip: false });
+  }
+});
+
+app.post('/api/vip/submit-request', async (req, res) => {
+  const { uid, userName, planName, amount, method, refNumber } = req.body;
+  if (!uid || !refNumber) return res.status(400).json({ error: 'Kulang ang data' });
+
+  const timestamp = Date.now();
+  const dateStr = new Date(timestamp).toLocaleString('en-PH', { 
+    timeZone: 'Asia/Manila',
+    month: 'short',
+    day: '2-digit',
+    year: 'numeric',
+    hour: '2-digit',
+    minute: '2-digit',
+    hour12: true
+  });
+
+  const payload = {
+    uid: String(uid).trim(),
+    name: String(userName || 'Telegram User').trim(),
+    userName: String(userName || 'Telegram User').trim(),
+    plan: String(planName || 'VIP Access').trim(),
+    amount: String(amount || '5').trim(),
+    ref_number: String(refNumber).trim(),
+    ref: String(refNumber).trim(),
+    method: String(method || 'GCASH').toUpperCase().trim(),
+    status: 'pending',
+    date: dateStr,
+    createdAt: timestamp
+  };
+
+  try {
+    // 1. I-save sa user profile (active_request)
+    await axios.put(`${FIREBASE_DATABASE_URL}/users/${uid}/active_request.json`, payload);
+
+    // 2. I-save sa "requests" node (Para sa AdminDashboardActivity.java)
+    const reqKey = `REQ_${uid}_${timestamp}`;
+    await axios.put(`${FIREBASE_DATABASE_URL}/requests/${reqKey}.json`, payload);
+
+    // 3. TELEGRAM ALERT SA ADMIN PM KAPAG MAY NAG-SUBMIT
+    if (tgClient && ADMIN_ID && isGramJsConnected) {
+      try {
+        await tgClient.sendMessage(ADMIN_ID, {
+          message: 
+`💰 <b>BAGONG BAYAD / DONATE SUBMISSION!</b>\n\n` +
+`👤 <b>User:</b> <code>${userName}</code> (ID: <code>${uid}</code>)\n` +
+`👑 <b>Plan:</b> <code>${planName}</code>\n` +
+`💵 <b>Amount:</b> ₱${amount}\n` +
+`💳 <b>Method:</b> <code>${method}</code>\n` +
+`🔢 <b>Ref No.:</b> <code>${refNumber}</code>\n\n` +
+`👉 <i>Buksan ang Admin Dashboard App para i-Approve!</i>`,
+          parseMode: 'html'
+        });
+      } catch (_) {}
+    }
+
+    return res.json({ success: true, message: 'Naisumite sa Admin!' });
+  } catch (e) {
+    return res.status(500).json({ error: 'Error sa database' });
+  }
+});
+
+app.get('/api/payment-config', (req, res) => {
+  res.json(PAYMENT_CONFIG);
+});
+
+app.get('/stream/:fileId', async (req, res) => {
+  const fileId = req.params.fileId;
+  const rec = await getStreamFileRecord(fileId);
+  
+  if (!rec) {
+    console.error(`❌ Stream Failed: File record not found in MongoDB for ID: ${fileId}`);
+    return res.redirect('https://vjs.zencdn.net/v/oceans.mp4');
+  }
+
+  if (!tgClient || !isGramJsConnected) {
+    console.error('❌ Stream Failed: Telegram MTProto Client not connected');
+    return res.redirect('https://vjs.zencdn.net/v/oceans.mp4');
+  }
+
+  try {
+    let peer = rec.chat_id || rec.chatId;
+    
+    // 🟢 RESOLVE TELEGRAM PEER PARA SA LAHAT NG STORAGE CHANNELS
+    let targetEntity;
+    try {
+      targetEntity = await tgClient.getInputEntity(peer);
+    } catch (resolveErr) {
+      if (typeof peer === 'string' && peer.startsWith('-100')) {
+        peer = bigInt(peer.replace('-100', ''));
+      }
+      targetEntity = await tgClient.getInputEntity(peer);
+    }
+
+    const msgIdNum = Number(rec.message_id || rec.messageId);
+    const cacheKey = `${rec.chat_id}_${msgIdNum}`;
+    let mediaObj = null;
+    let totalSize = Number(rec.file_size || rec.fileSize || 0);
+
+    // 🟢 1. FAST MEMORY CACHE
+    if (telegramMediaCache.has(cacheKey)) {
+      const cached = telegramMediaCache.get(cacheKey);
+      mediaObj = cached.media;
+      if (cached.size) totalSize = cached.size;
+    } else {
+      const msgs = await tgClient.getMessages(targetEntity, { ids: [msgIdNum] });
+      const msg = msgs && msgs[0];
+      
+      if (!msg || !msg.media) {
+        console.error(`❌ Stream Failed: Message not found in Telegram (Channel: ${peer}, Msg ID: ${msgIdNum})`);
+        return res.redirect('https://vjs.zencdn.net/v/oceans.mp4');
+      }
+      
+      mediaObj = msg.media;
+      totalSize = Number(msg.file?.size || totalSize);
+
+      telegramMediaCache.set(cacheKey, {
+        media: mediaObj,
+        size: totalSize,
+        mimeType: rec.mime_type || 'video/mp4',
+        timestamp: Date.now()
+      });
+    }
+
+    const range = req.headers.range;
+    let start = 0;
+    let end = totalSize - 1;
+
+    const cacheHeaders = {
+      'Cache-Control': 'public, max-age=2592000, s-maxage=2592000, immutable',
+      'CDN-Cache-Control': 'max-age=2592000',
+      'Cloudflare-CDN-Cache-Control': 'max-age=2592000',
+      'Access-Control-Allow-Origin': '*',
+      'Accept-Ranges': 'bytes'
+    };
+
+    // 🟢 2. STANDARD HTTP 206
+    if (range) {
+      const parts = range.replace(/bytes=/, '').split('-');
+      start = parseInt(parts[0], 10);
+      if (parts[1]) {
+        end = parseInt(parts[1], 10);
+      }
+      res.writeHead(206, {
+        ...cacheHeaders,
+        'Content-Range': `bytes ${start}-${end}/${totalSize}`,
+        'Content-Length': (end - start) + 1,
+        'Content-Type': rec.mime_type || 'video/mp4'
+      });
+    } else {
+      res.writeHead(200, {
+        ...cacheHeaders,
+        'Content-Length': totalSize,
+        'Content-Type': rec.mime_type || 'video/mp4'
+      });
+    }
+
+    // 🟢 3. STREAMING CHUNKS (1MB CHUNK)
+    const stream = tgClient.iterDownload({
+      file: mediaObj,
+      offset: bigInt(start),
+      limit: (end - start) + 1,
+      requestSize: 1024 * 1024
+    });
+
+    let closed = false;
+    req.on('close', () => { 
+      closed = true;
+    });
+
+    for await (const chunk of stream) {
+      if (closed) break;
+      res.write(chunk);
+    }
+    if (!closed) res.end();
+
+  } catch (e) {
+    console.error('❌ Stream Route Critical Error:', e.message);
+    if (!res.headersSent) res.redirect('https://vjs.zencdn.net/v/oceans.mp4');
+  }
+});
+
+// DIRECT ATTACHMENT DOWNLOADER (VIP ONLY)
+app.get('/download/:fileId', async (req, res) => {
+  const fileId = req.params.fileId;
+  
+  // ⛔ HARANGIN ANG DIRECT LINK KUNG HINDI VIP:
+  const isVip = req.query.vip === '1';
+  if (!isVip) {
+    return res.status(403).send('<h1 style="color:red;text-align:center;margin-top:50px;font-family:sans-serif;">⛔ 403 Forbidden: VIP Only Download Feature</h1>');
+  }
+
+  const rec = await getStreamFileRecord(fileId);
+  if (!rec || !tgClient || !isGramJsConnected) {
+    return res.redirect('https://vjs.zencdn.net/v/oceans.mp4');
+  }
+
+  try {
+    let peer = rec.chat_id;
+    if (typeof peer === 'string' && peer.startsWith('-100')) {
+      peer = bigInt(peer.replace('-100', ''));
+    }
+    const msgs = await tgClient.getMessages(peer, { ids: [Number(rec.message_id)] });
+    const msg = msgs && msgs[0];
+    if (!msg || !msg.media) return res.redirect('https://vjs.zencdn.net/v/oceans.mp4');
+
+    const totalSize = Number(msg.file?.size || rec.file_size || 0);
+    const fileName = rec.file_name || rec.fileName || `media_${fileId}.mp4`;
+    const cleanFileName = encodeURIComponent(fileName);
+
+    res.writeHead(200, {
+      'Content-Length': totalSize,
+      'Content-Type': 'application/octet-stream',
+      'Content-Disposition': `attachment; filename="${cleanFileName}"; filename*=UTF-8''${cleanFileName}`,
+      'Access-Control-Allow-Origin': '*'
+    });
+
+    const stream = tgClient.iterDownload({
+      file: msg.media,
+      offset: bigInt(0),
+      limit: totalSize,
+      requestSize: 1024 * 1024
+    });
+
+    let closed = false;
+    req.on('close', () => { closed = true; });
+    for await (const chunk of stream) {
+      if (closed) break;
+      res.write(chunk);
+    }
+    if (!closed) res.end();
+  } catch (e) {
+    if (!res.headersSent) res.status(500).send('Download Error: ' + e.message);
+  }
+});
+
+app.get('/embed/:fileId', async (req, res) => {
+  const { fileId } = req.params;
+  const rec = await getStreamFileRecord(fileId) || { file_name: 'Pinomax Video' };
+  const streamUrl = `${WORKER_URL}/stream/${fileId}`;
+  const downloadUrl = `${WORKER_URL}/download/${fileId}`;
+  const movieTitle = rec.file_name || rec.fileName || 'Movie';
+
+  res.render('embed_player', {
+    streamUrl: streamUrl,
+    downloadUrl: downloadUrl,
+    title: movieTitle,
+    poster: rec.poster || ''
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 7. CATALOG ROUTE (PARA SA MINI APP & WEB)
+// ---------------------------------------------------------------------------
+app.get(['/', '/newapp', '/pinomax'], async (req, res) => {
+  res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0');
+  res.setHeader('Pragma', 'no-cache');
+  res.setHeader('Expires', '0');
+
+  try {
+    let movies = [];
+    const model = StreamFile || StreamFileModel;
+    if (isMongoConnected && model) {
+      movies = await model.find().sort({ createdAt: -1 }).limit(100).lean();
+    } else {
+      movies = Array.from(inMemoryFiles.values());
+    }
+
+    const q = (req.query.q || '').trim().toLowerCase();
+    let filtered = movies;
+    if (q) {
+      filtered = movies.filter(m => (m.file_name || m.fileName || '').toLowerCase().includes(q));
+    }
+
+    res.render('index', {
+      movies: filtered.map(m => ({
+        id: m.file_unique_id || m.file_id || m.unique_id,
+        title: m.file_name || m.fileName || 'Movie',
+        image: m.poster || '',
+        rating: m.rating || '8.5',
+        year: m.year || '2024',
+        genre: m.category || 'Movie',
+        size: formatBytes(m.file_size || m.fileSize || 0)
+      })),
+      totalCount: movies.length,
+      searchQuery: req.query.q || '',
+      paymentConfig: PAYMENT_CONFIG
+    });
+  } catch (err) {
+    res.render('index', { movies: [], totalCount: 0, searchQuery: '', paymentConfig: PAYMENT_CONFIG });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 8. SUBTITLE SCRAPER & IN-MEMORY UNZIPPER (SUBDL)
+// ---------------------------------------------------------------------------
+app.get('/api/subtitles/:query', async (req, res) => {
+  let { query } = req.params;
+  if (!query || query === 'undefined') {
+    return res.json({ success: false, subtitles: [] });
+  }
+
+  try {
+    let tmdbId = query;
+
+    if (isNaN(Number(query))) {
+      const cleanTitle = query
+        .replace(/\.mp4|\.mkv|\.webm/gi, '')
+        .replace(/tagalog dubbed|tagdub|dubbed|1080p|720p|hd/gi, '')
+        .replace(/[\(\)\[\]]/g, '')
+        .trim();
+
+      const searchUrl = `https://api.themoviedb.org/3/search/movie?api_key=${TMDB_API_KEY}&query=${encodeURIComponent(cleanTitle)}`;
+      const searchRes = await axios.get(searchUrl, { timeout: 6000 });
+      if (searchRes.data?.results?.length > 0) {
+        tmdbId = searchRes.data.results[0].id;
+      } else {
+        return res.json({ success: false, subtitles: [] });
+      }
+    }
+
+    const subdlKey = "subdl_NMbBKczp6Un1tAIRELW0fR0F2lLPbCFbsDxn0MwUK8Q";
+    const subdlUrl = `https://api.subdl.com/api/v1/subtitles?api_key=${subdlKey}&tmdb_id=${tmdbId}&languages=tl,en`;
+
+    const subRes = await axios.get(subdlUrl, {
+      headers: { 'User-Agent': 'Mozilla/5.0 (Linux; Android 10; K)' },
+      timeout: 8000
+    });
+
+    const subtitlesData = subRes.data?.subtitles || [];
+    const formatted = subtitlesData.map(sub => {
+      const isTag = (sub.lang || sub.language || '').toLowerCase().includes('tag') || (sub.lang || '').toLowerCase().includes('tl') || (sub.lang || '').toLowerCase().includes('fil');
+      const rawUrl = sub.url.startsWith('/') ? `https://dl.subdl.com${sub.url}` : sub.url;
+      const release = sub.release_name ? sub.release_name.substring(0, 16) : 'HD';
+
+      return {
+        name: isTag ? `🇵🇭 Tagalog (${release})` : `🇬🇧 English (${release})`,
+        url: `/api/sub-content?url=${encodeURIComponent(rawUrl)}`,
+        type: 'vtt'
+      };
+    });
+
+    res.json({ success: formatted.length > 0, subtitles: formatted, tmdbId });
+  } catch (err) {
+    res.json({ success: false, subtitles: [] });
+  }
+});
+
+app.get('/api/sub-content', async (req, res) => {
+  const targetUrl = req.query.url;
+  if (!targetUrl) return res.status(400).send('URL required');
+
+  try {
+    const response = await axios.get(targetUrl, {
+      responseType: 'arraybuffer',
+      headers: { 
+        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
+        'Accept': '*/*'
+      },
+      maxRedirects: 5,
+      timeout: 12000
+    });
+
+    let srtText = '';
+    const buffer = Buffer.from(response.data);
+
+    // 1. KUNG ZIP FILE ANG SUBTITLE:
+    if (targetUrl.toLowerCase().includes('.zip') || (buffer[0] === 0x50 && buffer[1] === 0x4B)) {
+      const zip = new AdmZip(buffer);
+      const zipEntries = zip.getEntries();
+      
+      // 🛡️ Alisin ang macOS hidden files at kunin ang totoong .srt o .vtt:
+      const validEntries = zipEntries.filter(e => !e.isDirectory && !e.entryName.includes('__MACOSX'));
+      const srtEntry = validEntries.find(e => e.entryName.toLowerCase().endsWith('.srt') || e.entryName.toLowerCase().endsWith('.vtt')) || validEntries[0];
+
+      if (srtEntry) {
+        srtText = srtEntry.getData().toString('utf8');
+      } else {
+        return res.status(404).send('No valid subtitle found inside zip');
+      }
+    } else {
+      srtText = buffer.toString('utf8');
+    }
+
+    // 2. LINISIN ANG BOM AT I-CONVERT SA WEBVTT:
+    srtText = srtText.replace(/^\uFEFF/, '').trim(); // Tanggalin ang invisible BOM error
+
+    if (!srtText.startsWith('WEBVTT')) {
+      // Palitan ang comma (,) ng tuldok (.) para sa tamang VTT timestamp
+      srtText = 'WEBVTT\n\n' + srtText.replace(/(\d{2}:\d{2}:\d{2}),(\d{3})/g, '$1.$2');
+    }
+
+    res.writeHead(200, {
+      'Content-Type': 'text/vtt; charset=utf-8',
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Headers': '*',
+      'Cache-Control': 'public, max-age=86400'
+    });
+    res.end(srtText);
+  } catch (err) {
+    console.error('Subtitle parse error:', err.message);
+    res.status(500).send('Failed to process subtitle');
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 9. RENDER KEEP-ALIVE PINGER
+// ---------------------------------------------------------------------------
+app.get('/ping', (req, res) => {
+  res.status(200).json({ status: 'OK', uptime: process.uptime() });
+});
+
+setInterval(async () => {
+  try {
+    await axios.get(`${APP_URL}/ping`, { timeout: 8000 });
+  } catch (_) {}
+}, 10 * 60 * 1000);
+
+// ---------------------------------------------------------------------------
+// 🛠️ 1-CLICK POSTER & RESOLUTION AUTO-FIXER PARA SA LAHAT NG LUMANG MOVIES
+// ---------------------------------------------------------------------------
+app.get('/api/admin/fix-posters', async (req, res) => {
+  try {
+    const model = StreamFile || StreamFileModel;
+    if (!isMongoConnected || !model) {
+      return res.status(500).send('Database not connected.');
+    }
+
+    const allFiles = await model.find();
+    let updatedCount = 0;
+
+    for (const file of allFiles) {
+      const fileName = file.file_name || file.fileName || '';
+      if (!fileName) continue;
+
+      // 1. I-detect ang Resolution (4K, 1080p, 720p, 480p)
+      let quality = '1080P FHD';
+      if (/4k|2160p|uhd/i.test(fileName)) quality = '4K UHD';
+      else if (/1080p|fhd/i.test(fileName)) quality = '1080P FHD';
+      else if (/720p|hd/i.test(fileName)) quality = '720P HD';
+      else if (/480p|sd/i.test(fileName)) quality = '480P SD';
+
+      // 2. Linisin ang Title mula sa kalat at resolution
+      let cleanTitle = fileName
+        .replace(/\.mp4|\.mkv|\.webm|\.avi/gi, '')
+        .replace(/@\w+/g, '')
+        .replace(/4k|2160p|1080p|720p|480p|uhd|fhd|hdrip|bluray|web-dl|webrip|x264|x265|hevc/gi, '')
+        .replace(/tagalog dubbed|tagdub|dubbed|pinoy|tagalog|full movie/gi, '')
+        .replace(/[\(\)\[\]_\-\.]+/g, ' ')
+        .trim();
+
+      const yearMatch = cleanTitle.match(/\b(19\d{2}|20\d{2})\b/);
+      let detectedYear = yearMatch ? yearMatch[1] : '';
+      if (detectedYear) {
+        cleanTitle = cleanTitle.replace(detectedYear, '').trim();
+      }
+
+      // 3. Search sa TMDB
+      let poster = file.poster || '';
+      let rating = file.rating || '8.5';
+      let year = file.year || detectedYear || '2024';
+      let overview = file.overview || '';
+
+      try {
+        let searchUrl = `https://api.themoviedb.org/3/search/multi?api_key=${TMDB_API_KEY}&query=${encodeURIComponent(cleanTitle)}${detectedYear ? '&year=' + detectedYear : ''}`;
+        let searchRes = await axios.get(searchUrl, { timeout: 4000 });
+
+        if (!searchRes.data?.results?.length && detectedYear) {
+          searchUrl = `https://api.themoviedb.org/3/search/multi?api_key=${TMDB_API_KEY}&query=${encodeURIComponent(cleanTitle)}`;
+          searchRes = await axios.get(searchUrl, { timeout: 4000 });
+        }
+
+        if (searchRes.data?.results?.length > 0) {
+          const resItem = searchRes.data.results[0];
+          if (resItem.poster_path) {
+            poster = `https://image.tmdb.org/t/p/w500${resItem.poster_path}`;
+          }
+          year = (resItem.release_date || resItem.first_air_date || detectedYear || '').split('-')[0] || year;
+          rating = resItem.vote_average ? resItem.vote_average.toFixed(1) : rating;
+          overview = resItem.overview ? (resItem.overview.length > 120 ? resItem.overview.substring(0, 120) + '...' : resItem.overview) : overview;
+        }
+      } catch (_) {}
+
+      // 4. I-save pabalik sa MongoDB Atlas
+      await model.updateOne(
+        { _id: file._id },
+        { 
+          $set: { 
+            poster, 
+            rating, 
+            year, 
+            overview,
+            episode: quality // I-save ang resolution badge
+          } 
+        }
+      );
+      updatedCount++;
+    }
+
+    res.send(`<h1>✅ Tagumpay! Na-update ang ${updatedCount} na pelikula!</h1><p>Bumalik sa <a href="/">Homepage</a> para makita ang mga bagong HD posters.</p>`);
+  } catch (err) {
+    res.status(500).send('Auto-Fix Error: ' + err.message);
+  }
+});
+
+// ===========================================================================
+// 🛡️ SECRET ADMIN PANEL & CRUD API
+// ===========================================================================
+
+// 🟢 1. API: Kunin ang listahan ng lahat ng movies
+app.get('/api/admin/all-movies', async (req, res) => {
+  try {
+    const model = StreamFile || StreamFileModel;
+    let movies = [];
+    if (mongoose.connection.readyState === 1 && model) {
+      movies = await model.find().sort({ createdAt: -1 }).maxTimeMS(5000).lean();
+    } else {
+      movies = Array.from(inMemoryFiles.values());
+    }
+    return res.json({ success: true, movies: movies || [] });
+  } catch (err) {
+    console.error('Admin API error:', err);
+    return res.json({ success: true, movies: Array.from(inMemoryFiles.values()) });
+  }
+});
+
+// 🟢 2. API: I-save ang edited movie details
+app.post('/api/admin/update-movie', async (req, res) => {
+  try {
+    const { id, file_name, poster, year, rating, category, overview, episode } = req.body;
+    if (!id) return res.status(400).json({ error: 'Kulang ang ID' });
+
+    const model = StreamFile || StreamFileModel;
+    const updateData = {
+      file_name,
+      fileName: file_name,
+      poster,
+      year,
+      rating,
+      category,
+      overview,
+      episode
+    };
+
+    if (mongoose.connection.readyState === 1 && model) {
+      await model.findOneAndUpdate(
+        { $or: [{ file_unique_id: id }, { file_id: id }, { unique_id: id }] },
+        { $set: updateData }
+      );
+    }
+
+    if (inMemoryFiles.has(id)) {
+      const existing = inMemoryFiles.get(id);
+      inMemoryFiles.set(id, { ...existing, ...updateData });
+    }
+
+    return res.json({ success: true, message: 'Na-update nang matagumpay!' });
+  } catch (err) {
+    return res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// 🟢 3. API: Mag-delete ng Movie
+app.delete('/api/admin/delete-movie/:id', async (req, res) => {
+  try {
+    const { id } = req.params;
+    const model = StreamFile || StreamFileModel;
+
+    if (mongoose.connection.readyState === 1 && model) {
+      await model.deleteOne({ 
+        $or: [{ file_unique_id: id }, { file_id: id }, { unique_id: id }] 
+      });
+    }
+    inMemoryFiles.delete(id);
+
+    return res.json({ success: true, message: 'Movie deleted!' });
+  } catch (err) {
+    return res.status(500).json({ success: false, error: err.message });
+  }
+});
+
+// 🟢 4. SECRET ADMIN DASHBOARD WEB UI
+app.get('/secret-admin-portal', (req, res) => {
+  res.send(`<!DOCTYPE html>
+<html lang="tl">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+  <title>PINOMAX Admin Manager</title>
+  <style>
+    :root {
+      --bg: #0c0d14;
+      --card-bg: #161824;
+      --accent: #e50914;
+      --text: #f0f2f5;
+      --text-muted: #8c93a8;
+      --border: #23273a;
+      --input-bg: #090a0f;
+    }
+    * { margin:0; padding:0; box-sizing:border-box; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
+    body { background: var(--bg); color: var(--text); padding: 16px; }
+
+    .header {
+      display: flex; justify-content: space-between; align-items: center;
+      flex-wrap: wrap; gap: 12px; margin-bottom: 20px;
+      padding-bottom: 12px; border-bottom: 1px solid var(--border);
+    }
+    .search-box {
+      padding: 10px 14px; background: var(--card-bg); border: 1px solid var(--border);
+      border-radius: 8px; color: #fff; width: 260px; max-width: 100%; outline: none; font-size: 13px;
+    }
+
+    .grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+      gap: 14px;
+    }
+    .movie-card {
+      background: var(--card-bg); border-radius: 10px; border: 1px solid var(--border);
+      overflow: hidden; display: flex; flex-direction: column;
+    }
+    .card-top { display: flex; gap: 12px; padding: 12px; }
+    .card-poster {
+      width: 70px; height: 100px; border-radius: 6px; object-fit: cover;
+      background: #222; flex-shrink: 0;
+    }
+    .card-info { flex: 1; overflow: hidden; }
+    .card-title { font-size: 13px; font-weight: bold; margin-bottom: 4px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; color:#fff; }
+    .card-id { font-size: 10px; font-family: monospace; color: #ff7b7b; margin-bottom: 4px; }
+    .badge {
+      display: inline-block; font-size: 9px; padding: 2px 6px; border-radius: 4px;
+      background: #2a2e45; color: #8cb4ff; margin-right: 4px; font-weight: 600;
+    }
+    .badge-star { background: #3d3000; color: #ffd700; }
+    .card-overview {
+      font-size: 11px; color: var(--text-muted); margin-top: 6px;
+      display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden;
+    }
+    .card-actions {
+      display: flex; border-top: 1px solid var(--border); background: rgba(0,0,0,0.25);
+    }
+    .card-actions button {
+      flex: 1; padding: 10px; background: transparent; border: none;
+      color: #fff; font-size: 12px; font-weight: bold; cursor: pointer;
+    }
+    .btn-edit { color: #58a6ff !important; border-right: 1px solid var(--border); }
+    .btn-delete { color: #f85149 !important; }
+
+    #editModal {
+      position: fixed; inset: 0; background: rgba(0,0,0,0.85);
+      display: none; align-items: center; justify-content: center; z-index: 1000; padding: 15px;
+    }
+    .modal-content {
+      background: var(--card-bg); border-radius: 12px; width: 100%; max-width: 480px;
+      max-height: 90vh; overflow-y: auto; padding: 20px; border: 1px solid var(--border);
+    }
+    .form-group { margin-bottom: 10px; }
+    .form-group label { display: block; font-size: 11px; color: var(--text-muted); margin-bottom: 3px; }
+    .form-group input, .form-group textarea, .form-group select {
+      width: 100%; padding: 8px 10px; background: var(--input-bg); border: 1px solid var(--border);
+      border-radius: 6px; color: #fff; font-size: 12px; outline: none;
+    }
+    .modal-buttons { display: flex; gap: 10px; margin-top: 15px; }
+    .modal-buttons button { flex: 1; padding: 10px; border-radius: 6px; border: none; font-weight: bold; cursor: pointer; }
+    .btn-save { background: var(--accent); color: #fff; }
+    .btn-cancel { background: #30363d; color: #fff; }
+  </style>
+</head>
+<body>
+
+  <div class="header">
+    <div>
+      <h1 style="font-size:20px; font-weight:900; color:var(--accent);">🎬 PINOMAX Media Manager</h1>
+      <span id="totalBadge" style="font-size:12px; color:var(--text-muted);">Kinukuha ang database...</span>
+    </div>
+    <div style="display:flex; gap:8px;">
+      <input type="text" class="search-box" id="searchInput" placeholder="🔍 Maghanap..." oninput="renderMovies()" />
+      <button onclick="loadMovies()" style="padding:0 12px; background:#21262d; border:1px solid var(--border); color:#fff; border-radius:8px; cursor:pointer; font-size:12px;">🔄 Refresh</button>
+    </div>
+  </div>
+
+  <div class="grid" id="moviesContainer"></div>
+
+  <!-- EDIT MODAL -->
+  <div id="editModal">
+    <div class="modal-content">
+      <h3 style="margin-bottom:12px; color:var(--accent); font-size:16px;">✏️ Edit Movie</h3>
+      
+      <div class="form-group">
+        <label>File ID:</label>
+        <input type="text" id="editId" disabled style="opacity:0.5;" />
+      </div>
+
+      <div class="form-group">
+        <label>Title / File Name:</label>
+        <div style="display:flex; gap:6px;">
+          <input type="text" id="editTitle" />
+          <button type="button" onclick="fetchTMDB()" style="padding:0 10px; background:#238636; border:none; border-radius:6px; color:#fff; font-size:11px; cursor:pointer;">TMDB</button>
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label>Poster URL:</label>
+        <input type="text" id="editPoster" />
+      </div>
+
+      <div style="display:flex; gap:8px;">
+        <div class="form-group" style="flex:1;">
+          <label>Year:</label>
+          <input type="text" id="editYear" />
+        </div>
+        <div class="form-group" style="flex:1;">
+          <label>Rating:</label>
+          <input type="text" id="editRating" />
+        </div>
+      </div>
+
+      <div class="form-group">
+        <label>Category:</label>
+        <select id="editCategory">
+          <option value="Movie">Movie</option>
+          <option value="Series">Series</option>
+        </select>
+      </div>
+
+      <div class="form-group">
+        <label>Overview:</label>
+        <textarea id="editOverview" rows="3"></textarea>
+      </div>
+
+      <div class="modal-buttons">
+        <button class="btn-cancel" onclick="closeModal()">Kansela</button>
+        <button class="btn-save" onclick="saveMovie()">I-save</button>
+      </div>
+    </div>
+  </div>
+
+  <script>
+    var allMovies = [];
+
+    window.addEventListener('DOMContentLoaded', loadMovies);
+
+    function loadMovies() {
+      document.getElementById('totalBadge').innerText = 'Kinukuha ang mga pelikula...';
+      fetch('/api/admin/all-movies')
+        .then(function(res) { return res.json(); })
+        .then(function(data) {
+          allMovies = data.movies || [];
+          document.getElementById('totalBadge').innerText = 'Kabuuang Pelikula: ' + allMovies.length;
+          renderMovies();
+        })
+        .catch(function(err) {
+          document.getElementById('totalBadge').innerText = 'Error: Hindi ma-load ang database';
+        });
+    }
+
+    function renderMovies() {
+      var q = (document.getElementById('searchInput').value || '').toLowerCase().trim();
+      var container = document.getElementById('moviesContainer');
+      container.innerHTML = '';
+
+      var filtered = allMovies.filter(function(m) {
+        var name = (m.file_name || m.fileName || '').toLowerCase();
+        var id = (m.file_unique_id || m.file_id || m.unique_id || '').toLowerCase();
+        return name.indexOf(q) !== -1 || id.indexOf(q) !== -1;
+      });
+
+      if (filtered.length === 0) {
+        container.innerHTML = '<div style="color:var(--text-muted); grid-column: 1/-1; text-align:center; padding:30px;">Walang pelikula.</div>';
+        return;
+      }
+
+      filtered.forEach(function(m) {
+        var id = m.file_unique_id || m.file_id || m.unique_id || m._id;
+        var title = m.file_name || m.fileName || 'Untitled';
+        var poster = m.poster || 'https://via.placeholder.com/150x225/111/fff?text=NO+POSTER';
+        var year = m.year || '2024';
+        var rating = m.rating || '8.5';
+        var overview = m.overview || 'Walang synopsis.';
+
+        var card = document.createElement('div');
+        card.className = 'movie-card';
+        card.innerHTML = 
+          '<div class="card-top">' +
+            '<img class="card-poster" src="' + poster + '" onerror="this.src=\\'https://via.placeholder.com/150x225/111/fff?text=NO+POSTER\\'" />' +
+            '<div class="card-info">' +
+              '<div class="card-title">' + title + '</div>' +
+              '<div class="card-id">ID: ' + id + '</div>' +
+              '<div>' +
+                '<span class="badge badge-star">⭐ ' + rating + '</span>' +
+                '<span class="badge">' + year + '</span>' +
+              '</div>' +
+              '<div class="card-overview">' + overview + '</div>' +
+            '</div>' +
+          '</div>' +
+          '<div class="card-actions">' +
+            '<button class="btn-edit" onclick="openEdit(\\'' + encodeURIComponent(id) + '\\')">✏️ Edit</button>' +
+            '<button class="btn-delete" onclick="deleteItem(\\'' + encodeURIComponent(id) + '\\')">🗑️ Delete</button>' +
+          '</div>';
+        container.appendChild(card);
+      });
+    }
+
+    function openEdit(encId) {
+      var id = decodeURIComponent(encId);
+      var m = allMovies.find(function(item) {
+        return (item.file_unique_id || item.file_id || item.unique_id || item._id) === id;
+      });
+      if (!m) return;
+
+      document.getElementById('editId').value = id;
+      document.getElementById('editTitle').value = m.file_name || m.fileName || '';
+      document.getElementById('editPoster').value = m.poster || '';
+      document.getElementById('editYear').value = m.year || '2024';
+      document.getElementById('editRating').value = m.rating || '8.5';
+      document.getElementById('editCategory').value = m.category || 'Movie';
+      document.getElementById('editOverview').value = m.overview || '';
+
+      document.getElementById('editModal').style.display = 'flex';
+    }
+
+    function closeModal() {
+      document.getElementById('editModal').style.display = 'none';
+    }
+
+    function fetchTMDB() {
+      var title = document.getElementById('editTitle').value;
+      if (!title) return alert('Lagyan ng Title!');
+      
+      var clean = title.replace(/\\.[a-zA-Z0-9]+$/g, '').replace(/@\\w+/g, '').replace(/[\\(\\)\\[\\]_\\-\\.]+/g, ' ').trim();
+      var yearMatch = clean.match(/\\b(19\\d{2}|20\\d{2})\\b/);
+      var yr = yearMatch ? yearMatch[1] : '';
+      if (yr) clean = clean.replace(yr, '').trim();
+
+      fetch('https://api.themoviedb.org/3/search/multi?api_key=86fd55697899e8444fa3da3ddd24518d&query=' + encodeURIComponent(clean) + (yr ? '&year=' + yr : ''))
+        .then(function(r) { return r.json(); })
+        .then(function(d) {
+          if (d.results && d.results.length > 0) {
+            var item = d.results[0];
+            if (item.poster_path) document.getElementById('editPoster').value = 'https://image.tmdb.org/t/p/w500' + item.poster_path;
+            document.getElementById('editYear').value = (item.release_date || item.first_air_date || yr || '2024').split('-')[0];
+            document.getElementById('editRating').value = item.vote_average ? item.vote_average.toFixed(1) : '8.5';
+            document.getElementById('editOverview').value = item.overview || '';
+            alert('✅ TMDB Match: ' + (item.title || item.name));
+          } else {
+            alert('Walang nahanap sa TMDB.');
+          }
+        }).catch(function() { alert('TMDB Fetch Error'); });
+    }
+
+    function saveMovie() {
+      var payload = {
+        id: document.getElementById('editId').value,
+        file_name: document.getElementById('editTitle').value,
+        poster: document.getElementById('editPoster').value,
+        year: document.getElementById('editYear').value,
+        rating: document.getElementById('editRating').value,
+        category: document.getElementById('editCategory').value,
+        overview: document.getElementById('editOverview').value
+      };
+
+      fetch('/api/admin/update-movie', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload)
+      })
+      .then(function(r) { return r.json(); })
+      .then(function(d) {
+        if (d.success) {
+          closeModal();
+          loadMovies();
+        } else {
+          alert('Error: ' + d.error);
+        }
+      });
+    }
+
+    function deleteItem(encId) {
+      var id = decodeURIComponent(encId);
+      if (!confirm('Burahin ang pelikulang ito?')) return;
+
+      fetch('/api/admin/delete-movie/' + encodeURIComponent(id), { method: 'DELETE' })
+        .then(function(r) { return r.json(); })
+        .then(function(d) {
+          if (d.success) {
+            loadMovies();
+          } else {
+            alert('Failed to delete');
+          }
+        });
+    }
+  </script>
+</body>
+</html>`);
+});
+// 10. SERVER START
+// ---------------------------------------------------------------------------
+app.listen(PORT, '0.0.0.0', () => {
+  console.log(`🚀 PINOMAX Server live on port ${PORT}`);
+});