Upload folder using huggingface_hub

.gitattributes

@@ -2,6 +2,29 @@
 *.pt filter=lfs diff=lfs merge=lfs -text
 *.bin filter=lfs diff=lfs merge=lfs -text
 *.pkl filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gz filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/pip/_vendor/distlib/t64-arm.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/pip/_vendor/distlib/t64.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/pip/_vendor/distlib/w64-arm.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/pip/_vendor/distlib/w64.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/setuptools/cli-arm64.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Lib/site-packages/setuptools/gui-arm64.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/dotenv.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/fastapi.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/httpx.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/idna.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/markdown-it.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/normalizer.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/pip.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/pip3.11.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/pip3.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/pygmentize.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/pyiceberg.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/python.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/pythonw.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/uvicorn.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/watchfiles.exe filter=lfs diff=lfs merge=lfs -text
+.tmp-ci-venv/Scripts/websockets.exe filter=lfs diff=lfs merge=lfs -text
 Frontend/public/favicon.jpeg filter=lfs diff=lfs merge=lfs -text
 Frontend/public/favicon.png filter=lfs diff=lfs merge=lfs -text
 Frontend/public/team/pragati_tiwari.jpg filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -34,3 +34,10 @@ docs/logs/
 scratch/
 .npm-cache/
 
+# GSSoC Score Tracking and Temporary Scripts
+scratch/
+.npm-cache/
+*.tmp
+../MOBILE_SETUP_TEMP.md
+../CI_YML_TEMP.yml
+../ENV_EXAMPLE_TEMP.example

Dockerfile

@@ -1,36 +1,40 @@
-# Use an official Python runtime as a parent image
-FROM python:3.10-slim
+# syntax=docker/dockerfile:1
 
-LABEL version="1.1.1" rebuild_trigger="2026-03-08-2032"
+FROM python:3.10-slim AS builder
 
-# Set the working directory to /app
-WORKDIR /app
-
-# Install system dependencies required for EasyOCR and OpenCV
-RUN apt-get update && apt-get install -y \
-    libgl1 \
-    libglib2.0-0 \
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy the requirements file into the container
 COPY requirements.txt .
+RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
+
+FROM python:3.10-slim AS runtime
 
-# Install dependencies (no-cache-dir keeps the docker image smaller)
-RUN pip install --no-cache-dir -r requirements.txt
+LABEL org.opencontainers.image.title="helpdesk-backend"
+LABEL org.opencontainers.image.description="HELPDESK.AI FastAPI backend (multi-stage)"
 
-# Copy all the remaining files into the container as a 'backend' directory
-# This allows absolute imports like 'from backend.services...' to work perfectly
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libgl1 \
+    libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --shell /usr/sbin/nologin appuser
+
+COPY --from=builder /install /usr/local
 COPY . /app/backend
 
-# Tell Python where to look for modules (so it can find the 'backend' folder)
-ENV PYTHONPATH=/app
+ENV PYTHONPATH=/app \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
 
-# Expose port 7860 (Hugging Face Spaces default)
 EXPOSE 7860
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 \
     CMD ["python", "backend/healthcheck.py"]
 
-# Run the FastAPI server via Uvicorn
+USER appuser
+
 CMD ["uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "7860"]

Frontend/eslint.config.js

@@ -35,4 +35,25 @@ export default defineConfig([
       'react-refresh/only-export-components': 'off',
         },
   },
+  {
+    files: [
+      '**/*.{test,spec}.{js,jsx}',
+      '**/__tests__/**/*.{js,jsx}',
+      'jest.setup.js',
+      'jest.fileMock.js',
+    ],
+    languageOptions: {
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+        ...globals.jest,
+      },
+    },
+  },
+  {
+    files: ['jest.fileMock.js'],
+    languageOptions: {
+      sourceType: 'commonjs',
+    },
+  },
 ])

Frontend/package.json

@@ -7,9 +7,11 @@
     "dev": "vite",
     "build": "vite build",
     "lint": "eslint . --ext js,jsx --report-unused-disable-directives --max-warnings 0",
+    "check:ai-secrets": "node ../scripts/check-frontend-secrets.mjs",
     "preview": "vite preview",
     "prepare": "husky install",
-    "format": "prettier --write ."
+    "format": "prettier --write .",
+    "test": "jest"
   },
   "dependencies": {
     "@google/generative-ai": "^0.24.1",
@@ -42,11 +44,18 @@
     "zustand": "^5.0.11"
   },
   "devDependencies": {
+    "@babel/core": "^7.24.0",
+    "@babel/preset-env": "^7.24.0",
+    "@babel/preset-react": "^7.24.0",
     "@eslint/js": "^9.39.1",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.2.0",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.1",
     "autoprefixer": "^10.4.24",
+    "babel-jest": "^29.7.0",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react": "^7.37.5",
@@ -54,11 +63,16 @@
     "eslint-plugin-react-refresh": "^0.4.24",
     "globals": "^16.5.0",
     "husky": "^9.1.7",
+    "identity-obj-proxy": "^3.0.0",
+    "jest": "^29.7.0",
+    "jest-environment-jsdom": "^29.7.0",
     "lint-staged": "^16.2.7",
     "postcss": "^8.5.6",
     "prettier": "^3.8.1",
     "tailwindcss": "^3.4.19",
     "vite": "^7.3.1"
   },
-  "lint-staged": "{'*.{js,jsx}': ['eslint --fix', 'prettier --write']}"
+  "lint-staged": {
+    "*.{js,jsx}": ["eslint --fix", "prettier --write"]
+  }
 }

Frontend/src/App.jsx

@@ -5,80 +5,81 @@ import {
   Navigate,
   useLocation
 } from "react-router-dom";
-import React, { useEffect } from "react";
-import { AnimatePresence } from "framer-motion";
-import { NotFound } from "./components/ui/not-found-2";
+import React, { Suspense, useEffect, lazy } from "react";
 import useTicketStore from "./store/ticketStore";
-import Toaster from "./components/shared/Toaster";
-import BugReportWidget from "./components/shared/BugReportWidget";
 import useRealtimeNotifications from "./hooks/useRealtimeNotifications";
-
-// Auth Components
-import Login from "./pages/Login";
-import ForgotPassword from "./pages/ForgotPassword";
-import ResetPassword from "./pages/ResetPassword";
-import Signup from "./pages/Signup";
-import AdminSignup from "./pages/AdminSignup";
-import AdminLobby from "./pages/AdminLobby";
-import UserLobby from "./pages/UserLobby";
-import LandingPage from "./pages/LandingPage";
-import ContactSales from "./pages/ContactSales";
-
-// Legacy components
-import DuplicateDetection from "./user/pages/DuplicateDetection";
-import AutoResolveChat from "./user/pages/AutoResolveChat";
-import Resolved from "./user/pages/Resolved";
-import TicketTracking from "./user/pages/TicketTracking";
-// Layouts
-import UserLayout from "./user/UserLayout";
-import AdminLayout from "./admin/layout/AdminLayout";
-
-// User Pages
-import Dashboard from "./user/pages/Dashboard";
-import CreateTicket from "./user/pages/CreateTicket";
-import MyTickets from "./user/pages/MyTickets";
-import TicketResult from "./user/pages/TicketResult";
-import Profile from "./user/pages/Profile";
-import TicketDetail from "./user/pages/TicketDetail";
-import TicketProcessing from "./user/pages/AIProcessing"; // Renamed generic import just in case, but keeping AIProcessing
-import AIProcessing from "./user/pages/AIProcessing";
-import AIUnderstanding from "./user/pages/AIUnderstanding";
-import Notifications from "./user/pages/Notifications";
-import Help from "./user/pages/Help";
-
-// NEW Admin Pages (Refactored)
-import AdminDashboard from "./admin/pages/AdminDashboard";
-import AdminTickets from "./admin/pages/AdminTickets";
-import AdminTicketDetail from "./admin/pages/AdminTicketDetail";
-import AdminUsers from "./admin/pages/AdminUsers";
-import AdminAnalytics from "./admin/pages/AdminAnalytics";
-import AdminProfile from "./admin/pages/AdminProfile";
-import AdminSettings from "./admin/pages/AdminSettings";
-import MasterBugReports from "./master-admin/pages/MasterBugReports";
-
-// Feature Pages
-import AutoCategorizationFeature from "./pages/features/AutoCategorizationFeature";
-import PriorityDetectionFeature from "./pages/features/PriorityDetectionFeature";
-import SmartResolutionFeature from "./pages/features/SmartResolutionFeature";
-
-// Legal Pages
-import TermsOfService from "./pages/legal/TermsOfService";
-import PrivacyPolicy from "./pages/legal/PrivacyPolicy";
-import Security from "./pages/legal/Security";
 import AdminProtectedRoute from "./components/shared/AdminProtectedRoute";
 import MasterAdminProtectedRoute from "./components/shared/MasterAdminProtectedRoute";
 import ProtectedRoute from "./components/shared/ProtectedRoute";
 import useAuthStore from "./store/authStore";
 import NotApproved from "./pages/NotApproved";
-
-// Master Admin Components
-import MasterAdminLogin from "./pages/MasterAdminLogin";
-import MasterAdminLayout from "./master-admin/layout/MasterAdminLayout";
-import MasterAdminDashboard from "./master-admin/pages/MasterAdminDashboard";
-import PendingAdminRequests from "./master-admin/pages/PendingAdminRequests";
-import AllCompanies from "./master-admin/pages/AllCompanies";
-import AllAdmins from "./master-admin/pages/AllAdmins";
-import Changelog from "./pages/Changelog";
+const Login = lazy(() => import("./pages/Login"));
+const ForgotPassword = lazy(() => import("./pages/ForgotPassword"));
+const ResetPassword = lazy(() => import("./pages/ResetPassword"));
+const Signup = lazy(() => import("./pages/Signup"));
+const AdminSignup = lazy(() => import("./pages/AdminSignup"));
+const AdminLobby = lazy(() => import("./pages/AdminLobby"));
+const UserLobby = lazy(() => import("./pages/UserLobby"));
+const LandingPage = lazy(() => import("./pages/LandingPage"));
+const ContactSales = lazy(() => import("./pages/ContactSales"));
+
+const DuplicateDetection = lazy(() => import("./user/pages/DuplicateDetection"));
+const AutoResolveChat = lazy(() => import("./user/pages/AutoResolveChat"));
+const Resolved = lazy(() => import("./user/pages/Resolved"));
+const TicketTracking = lazy(() => import("./user/pages/TicketTracking"));
+
+const UserLayout = lazy(() => import("./user/UserLayout"));
+const AdminLayout = lazy(() => import("./admin/layout/AdminLayout"));
+
+const Dashboard = lazy(() => import("./user/pages/Dashboard"));
+const CreateTicket = lazy(() => import("./user/pages/CreateTicket"));
+const MyTickets = lazy(() => import("./user/pages/MyTickets"));
+const TicketResult = lazy(() => import("./user/pages/TicketResult"));
+const Profile = lazy(() => import("./user/pages/Profile"));
+const TicketDetail = lazy(() => import("./user/pages/TicketDetail"));
+const AIProcessing = lazy(() => import("./user/pages/AIProcessing"));
+const AIUnderstanding = lazy(() => import("./user/pages/AIUnderstanding"));
+const Notifications = lazy(() => import("./user/pages/Notifications"));
+const Help = lazy(() => import("./user/pages/Help"));
+
+const AdminDashboard = lazy(() => import("./admin/pages/AdminDashboard"));
+const AdminTickets = lazy(() => import("./admin/pages/AdminTickets"));
+const AdminTicketDetail = lazy(() => import("./admin/pages/AdminTicketDetail"));
+const AdminUsers = lazy(() => import("./admin/pages/AdminUsers"));
+const AdminAnalytics = lazy(() => import("./admin/pages/AdminAnalytics"));
+const AdminProfile = lazy(() => import("./admin/pages/AdminProfile"));
+const AdminSettings = lazy(() => import("./admin/pages/AdminSettings"));
+const SLAPage = lazy(() => import("./admin/pages/SLAPage"));
+const MasterBugReports = lazy(() => import("./master-admin/pages/MasterBugReports"));
+
+const AutoCategorizationFeature = lazy(() => import("./pages/features/AutoCategorizationFeature"));
+const PriorityDetectionFeature = lazy(() => import("./pages/features/PriorityDetectionFeature"));
+const SmartResolutionFeature = lazy(() => import("./pages/features/SmartResolutionFeature"));
+
+const TermsOfService = lazy(() => import("./pages/legal/TermsOfService"));
+const PrivacyPolicy = lazy(() => import("./pages/legal/PrivacyPolicy"));
+const Security = lazy(() => import("./pages/legal/Security"));
+
+const MasterAdminLogin = lazy(() => import("./pages/MasterAdminLogin"));
+const MasterAdminLayout = lazy(() => import("./master-admin/layout/MasterAdminLayout"));
+const MasterAdminDashboard = lazy(() => import("./master-admin/pages/MasterAdminDashboard"));
+const PendingAdminRequests = lazy(() => import("./master-admin/pages/PendingAdminRequests"));
+const AllCompanies = lazy(() => import("./master-admin/pages/AllCompanies"));
+const AllAdmins = lazy(() => import("./master-admin/pages/AllAdmins"));
+const Changelog = lazy(() => import("./pages/Changelog"));
+const NotFoundPage = lazy(() => import("./components/ui/not-found-2").then((module) => ({ default: module.NotFound })));
+const Toaster = lazy(() => import("./components/shared/Toaster"));
+const BugReportWidget = lazy(() => import("./components/shared/BugReportWidget"));
+
+function RouteFallback() {
+  return (
+    <div className="flex min-h-[40vh] items-center justify-center px-6 py-16">
+      <div className="rounded-2xl border border-slate-200 bg-white px-6 py-4 text-sm font-semibold text-slate-500 shadow-sm">
+        Loading...
+      </div>
+    </div>
+  );
+}
 
 
 function TitleUpdater() {
@@ -96,6 +97,7 @@ function TitleUpdater() {
     else if (path.startsWith('/admin/analytics')) title = 'Analytics | Admin';
     else if (path.startsWith('/admin/profile')) title = 'Admin Profile';
     else if (path.startsWith('/admin/settings')) title = 'Settings | Admin';
+    else if (path.startsWith('/admin/sla')) title = 'SLA Monitor | Admin';
     // Master Admin Routes
     else if (path.startsWith('/master-admin/dashboard')) title = 'Master Dashboard';
     else if (path.startsWith('/master-admin/admin-requests')) title = 'Pending Requests | Master Admin';
@@ -191,10 +193,11 @@ function AppLayout() {
             <Route path="/admin/analytics" element={<AdminAnalytics />} />
             <Route path="/admin/profile" element={<AdminProfile />} />
             <Route path="/admin/settings" element={<AdminSettings />} />
+            <Route path="/admin/sla" element={<SLAPage />} />
           </Route>
         </Route>
 
-        <Route path="*" element={<NotFound />} />
+        <Route path="*" element={<NotFoundPage />} />
       </Routes>
     </>
   );
@@ -206,63 +209,60 @@ function App() {
 
   useEffect(() => {
     initialize();
-    // Dark mode initialize
-    const saved = localStorage.getItem('theme');
-    if (saved === 'dark') {
-      document.documentElement.classList.add('dark');
-    }
   }, [initialize]);
 
   return (
     <BrowserRouter>
       <TitleUpdater />
       <ScrollToTop />
-      <Toaster />
-      <BugReportWidget />
-      <Routes>
-        {/* Public */}
-        <Route path="/" element={<LandingPage />} />
-        <Route path="/login" element={<Login />} />
-        <Route path="/forgot-password" element={<ForgotPassword />} />
-        <Route path="/reset-password" element={<ResetPassword />} />
-        <Route path="/signup" element={<Signup />} />
-        <Route path="/admin-signup" element={<AdminSignup />} />
-        <Route path="/admin-lobby" element={<AdminLobby />} />
-        <Route path="/user-lobby" element={<UserLobby />} />
-        <Route path="/not-approved" element={<NotApproved />} />
-        <Route path="/contact-sales" element={<ContactSales />} />
-
-        {/* Feature Pages */}
-        <Route path="/features/categorization" element={<AutoCategorizationFeature />} />
-        <Route path="/features/priority" element={<PriorityDetectionFeature />} />
-        <Route path="/features/resolution" element={<SmartResolutionFeature />} />
-
-        {/* Resources Pages */}
-        <Route path="/changelog" element={<Changelog />} />
-        
-        {/* Legal Pages */}
-        <Route path="/terms" element={<TermsOfService />} />
-        <Route path="/privacy" element={<PrivacyPolicy />} />
-        <Route path="/security" element={<Security />} />
-
-        {/* Master Admin Portal */}
-        <Route path="/master-admin-login" element={<MasterAdminLogin />} />
-
-        <Route element={<MasterAdminProtectedRoute />}>
-          <Route element={<MasterAdminLayout />}>
-            <Route path="/master-admin/dashboard" element={<MasterAdminDashboard />} />
-            <Route path="/master-admin/admin-requests" element={<PendingAdminRequests />} />
-            <Route path="/master-admin/companies" element={<AllCompanies />} />
-            <Route path="/master-admin/all-admins" element={<AllAdmins />} />
-            <Route path="/master-admin/bug-reports" element={<MasterBugReports />} />
+      <Suspense fallback={<RouteFallback />}>
+        <Toaster />
+        <BugReportWidget />
+        <Routes>
+          {/* Public */}
+          <Route path="/" element={<LandingPage />} />
+          <Route path="/login" element={<Login />} />
+          <Route path="/forgot-password" element={<ForgotPassword />} />
+          <Route path="/reset-password" element={<ResetPassword />} />
+          <Route path="/signup" element={<Signup />} />
+          <Route path="/admin-signup" element={<AdminSignup />} />
+          <Route path="/admin-lobby" element={<AdminLobby />} />
+          <Route path="/user-lobby" element={<UserLobby />} />
+          <Route path="/not-approved" element={<NotApproved />} />
+          <Route path="/contact-sales" element={<ContactSales />} />
+
+          {/* Feature Pages */}
+          <Route path="/features/categorization" element={<AutoCategorizationFeature />} />
+          <Route path="/features/priority" element={<PriorityDetectionFeature />} />
+          <Route path="/features/resolution" element={<SmartResolutionFeature />} />
+
+            {/* Resources Pages */}
+            <Route path="/changelog" element={<Changelog />} />
+
+            {/* Legal Pages */}
+            <Route path="/terms" element={<TermsOfService />} />
+            <Route path="/privacy" element={<PrivacyPolicy />} />
+            <Route path="/security" element={<Security />} />
+
+          {/* Master Admin Portal */}
+          <Route path="/master-admin-login" element={<MasterAdminLogin />} />
+
+          <Route element={<MasterAdminProtectedRoute />}>
+            <Route element={<MasterAdminLayout />}>
+              <Route path="/master-admin/dashboard" element={<MasterAdminDashboard />} />
+              <Route path="/master-admin/admin-requests" element={<PendingAdminRequests />} />
+              <Route path="/master-admin/companies" element={<AllCompanies />} />
+              <Route path="/master-admin/all-admins" element={<AllAdmins />} />
+              <Route path="/master-admin/bug-reports" element={<MasterBugReports />} />
+            </Route>
           </Route>
-        </Route>
 
-        {/* Protected */}
-        <Route element={<ProtectedRoute />}>
-          <Route path="/*" element={<AppLayout />} />
-        </Route>
-      </Routes>
+          {/* Protected */}
+          <Route element={<ProtectedRoute />}>
+            <Route path="/*" element={<AppLayout />} />
+          </Route>
+        </Routes>
+      </Suspense>
     </BrowserRouter>
   );
 }

Frontend/src/admin/components/AdminSidebar.jsx

@@ -10,7 +10,8 @@ import {
     LogOut,
     Activity,
     ChevronLeft,
-    ChevronRight
+    ChevronRight,
+    Clock
 } from 'lucide-react';
 import useAuthStore from '../../store/authStore';
 
@@ -21,6 +22,7 @@ const AdminSidebar = ({ isMobile, onClose, isCollapsed, onToggleCollapse }) => {
         { label: 'Users', path: '/admin/users', icon: Users },
         { label: 'Analytics', path: '/admin/analytics', icon: BarChart3 },
         { label: 'Profile', path: '/admin/profile', icon: UserCircle },
+        { label: 'SLA Monitor', path: '/admin/sla', icon: Clock },
     ];
 
     const { logout } = useAuthStore();

Frontend/src/admin/components/SLABadge.jsx

@@ -1,12 +1,12 @@
 import React, { useState, useEffect } from 'react';
 import { Clock, AlertTriangle, ShieldCheck } from 'lucide-react';
 
-// SLA resolution limits in milliseconds based on priority.
+// SLA time limits in milliseconds based on priority
 const SLA_LIMITS = {
-    critical: 4 * 60 * 60 * 1000,
-    high: 12 * 60 * 60 * 1000,
-    medium: 24 * 60 * 60 * 1000,
-    low: 72 * 60 * 60 * 1000,
+    critical: 2 * 60 * 60 * 1000,   // 2 hours
+    high: 4 * 60 * 60 * 1000,   // 4 hours
+    medium: 8 * 60 * 60 * 1000,   // 8 hours
+    low: 24 * 60 * 60 * 1000,  // 24 hours
 };
 
 function formatDuration(ms) {
@@ -19,47 +19,36 @@ function formatDuration(ms) {
 }
 
 /**
- * SLABadge — shows SLA status for a ticket.
+ * SLABadge — shows SLA status for a ticket based on its priority and creation time.
  * 
  * Props:
  *  - priority: string ('critical' | 'high' | 'medium' | 'low')
  *  - createdAt: string (ISO date string)
- *  - slaBreachAt: string (ISO date string) — preferred persisted deadline
- *  - slaStatus: string ('ACTIVE' | 'WARNING' | 'BREACHED')
  *  - status: string — if ticket is resolved/closed, show "Met" without countdown
  *  - compact: bool — if true, shows just the badge with no label text
  */
-export default function SLABadge({ priority, createdAt, slaBreachAt, slaStatus, status, compact = false }) {
+export default function SLABadge({ priority, createdAt, status, compact = false }) {
     const [remaining, setRemaining] = useState(null);
 
-    const normalizedStatus = status?.toLowerCase();
-    const normalizedSlaStatus = slaStatus?.toUpperCase();
-    const isResolved = ['resolved', 'closed', 'auto-resolved', 'auto resolved'].includes(normalizedStatus);
+    const isResolved = ['resolved', 'closed', 'auto-resolved'].includes(status?.toLowerCase());
 
     useEffect(() => {
-        if (isResolved) return;
-        if (normalizedSlaStatus === 'BREACHED') {
-            setRemaining(-1);
-            return;
-        }
+        if (isResolved || !priority || !createdAt) return;
 
-        const priorityKey = priority?.toLowerCase?.() || 'medium';
+        const priorityKey = priority.toLowerCase();
         const limit = SLA_LIMITS[priorityKey] || SLA_LIMITS.medium;
-        const deadlineMs = slaBreachAt
-            ? new Date(slaBreachAt).getTime()
-            : new Date(createdAt).getTime() + limit;
-
-        if (!Number.isFinite(deadlineMs)) return;
+        const createdMs = new Date(createdAt).getTime();
 
         const calculate = () => {
-            const rem = deadlineMs - Date.now();
+            const elapsed = Date.now() - createdMs;
+            const rem = limit - elapsed;
             setRemaining(rem);
         };
 
         calculate();
         const timer = setInterval(calculate, 60 * 1000); // update every minute
         return () => clearInterval(timer);
-    }, [priority, createdAt, slaBreachAt, normalizedSlaStatus, isResolved]);
+    }, [priority, createdAt, isResolved]);
 
     if (isResolved) {
         return (

Frontend/src/admin/components/TicketTable.jsx

@@ -73,6 +73,9 @@ const TicketTable = ({ tickets = [], isLoading = false, limit = null }) => {
                             ? ticket.assigned_team
                             : (teamMap[effectiveCategory] || ticket.assigned_team || 'L1 Helpdesk');
                         const statusSt = getStatusStyle(ticket.status);
+                        const translationMeta = ticket?.metadata?.translation;
+                        const isTranslated = Boolean(translationMeta?.translated);
+                        const sourceLanguageName = translationMeta?.source_language_name || translationMeta?.source_language || 'Unknown';
 
                         // Truncated subject
                         const subject = ticket.subject || ticket.summary || 'Untitled ticket';
@@ -129,9 +132,16 @@ const TicketTable = ({ tickets = [], isLoading = false, limit = null }) => {
                                             <span style={{ fontSize: '13px', fontWeight: 500, color: '#111827', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
                                                 {truncSubject}
                                             </span>
-                                            <span style={{ fontSize: '11px', color: '#6b7280' }}>
-                                                {effectiveCategory || 'General'}
-                                            </span>
+                                            <div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
+                                                <span style={{ fontSize: '11px', color: '#6b7280' }}>
+                                                    {effectiveCategory || 'General'}
+                                                </span>
+                                                {isTranslated && (
+                                                    <span style={{ fontSize: '10px', color: '#0369a1' }}>
+                                                        Translated from {sourceLanguageName}
+                                                    </span>
+                                                )}
+                                            </div>
                                         </div>
                                     </div>
                                 </td>

Frontend/src/admin/pages/AdminDashboard.jsx

@@ -4,6 +4,7 @@ import { Activity, AlertTriangle, Clock, ShieldCheck } from 'lucide-react';
 
 import useAuthStore from "../../store/authStore";
 import { supabase } from "../../lib/supabaseClient";
+import useTicketsRealtime from "../../hooks/useTicketsRealtime";
 import StatCard from "../components/StatCard";
 import TicketTable from "../components/TicketTable";
 import { formatTimelineDate } from "../../utils/dateUtils";
@@ -107,6 +108,13 @@ const AdminDashboard = () => {
     const [isLoading, setIsLoading] = React.useState(true);
     const [nowMs, setNowMs] = React.useState(() => Date.now());
 
+    useTicketsRealtime({
+        company: profile?.company,
+        enabled: Boolean(profile),
+        onTicketsChange: setTickets,
+        channelName: 'admin_dashboard_tickets_realtime',
+    });
+
     React.useEffect(() => {
         if (profile) {
             const fetchStats = async () => {
@@ -135,8 +143,6 @@ const AdminDashboard = () => {
             };
 
             fetchStats();
-            const interval = setInterval(fetchStats, 30000);
-            return () => clearInterval(interval);
         }
     }, [profile]);
 

Frontend/src/admin/pages/AdminSettings.jsx

@@ -1,4 +1,4 @@
-import React from 'react';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import {
     Settings,
     Cpu,
@@ -8,6 +8,14 @@ import {
     ShieldCheck
 } from 'lucide-react';
 import useAdminStore from '../store/adminStore';
+import useAuthStore from '../../store/authStore';
+import { supabase } from '../../lib/supabaseClient';
+import {
+    DEFAULT_ADMIN_SETTINGS,
+    resolveCompanyId,
+    settingsFromSystemSettingsRow,
+    settingsToSystemSettingsRow
+} from '../../utils/adminSettingsPersistence';
 import { Card, CardContent } from "../../components/ui/card";
 import { Select } from "../../components/ui/select";
 
@@ -17,12 +25,97 @@ import { Select } from "../../components/ui/select";
  */
 const AdminSettings = () => {
     const { settings, updateSettings } = useAdminStore();
+    const { user, profile } = useAuthStore();
+    const [isLoadingSettings, setIsLoadingSettings] = useState(false);
+    const [isSavingSettings, setIsSavingSettings] = useState(false);
+    const [statusMessage, setStatusMessage] = useState('');
+    const [hasUnsavedChanges, setHasUnsavedChanges] = useState(false);
+
+    const companyId = useMemo(() => resolveCompanyId(profile, user), [profile, user]);
+
+    useEffect(() => {
+        let isMounted = true;
+
+        const loadCompanySettings = async () => {
+            if (!companyId) {
+                setStatusMessage('Company profile is required before settings can be synced.');
+                return;
+            }
+
+            setIsLoadingSettings(true);
+            setStatusMessage('');
+
+            const { data, error } = await supabase
+                .from('system_settings')
+                .select('ai_confidence_threshold, duplicate_sensitivity, enable_auto_resolve, auto_close_days, email_notifications, admin_alerts')
+                .eq('company_id', companyId)
+                .maybeSingle();
+
+            if (!isMounted) return;
+
+            if (error) {
+                setStatusMessage(`Unable to load saved settings: ${error.message}`);
+            } else if (data) {
+                updateSettings(settingsFromSystemSettingsRow(data, DEFAULT_ADMIN_SETTINGS));
+                setHasUnsavedChanges(false);
+                setStatusMessage('Saved company settings loaded.');
+            }
+
+            setIsLoadingSettings(false);
+        };
+
+        loadCompanySettings();
+
+        return () => {
+            isMounted = false;
+        };
+    }, [companyId, updateSettings]);
+
+    const saveCompanySettings = useCallback(async (nextSettings, { silent = false } = {}) => {
+        if (!companyId) {
+            setStatusMessage('Company profile is required before settings can be saved.');
+            return;
+        }
+
+        setIsSavingSettings(true);
+        if (!silent) {
+            setStatusMessage('');
+        }
+
+        const { error } = await supabase
+            .from('system_settings')
+            .upsert(settingsToSystemSettingsRow(nextSettings, companyId), { onConflict: 'company_id' });
+
+        if (error) {
+            setStatusMessage(`Unable to save settings: ${error.message}`);
+        } else {
+            setHasUnsavedChanges(false);
+            setStatusMessage('Settings saved for this company.');
+        }
+
+        setIsSavingSettings(false);
+    }, [companyId]);
 
-    // Handlers
     const handleChange = (key, value) => {
         updateSettings({ [key]: value });
+        setHasUnsavedChanges(true);
+        setStatusMessage('Saving changes...');
     };
 
+    const handleSaveSettings = useCallback(() => {
+        saveCompanySettings(settings);
+    }, [saveCompanySettings, settings]);
+
+    useEffect(() => {
+        if (!hasUnsavedChanges || isLoadingSettings || isSavingSettings) return undefined;
+
+        const saveTimer = window.setTimeout(() => {
+            saveCompanySettings(settings, { silent: true });
+        }, 800);
+
+        return () => window.clearTimeout(saveTimer);
+    }, [hasUnsavedChanges, isLoadingSettings, isSavingSettings, saveCompanySettings, settings]);
+
     return (
         <div className="max-w-4xl mx-auto py-6 space-y-10 pb-20 animate-in fade-in duration-700">
             {/* 1. Header Area */}
@@ -35,6 +128,22 @@ const AdminSettings = () => {
                         <ShieldCheck size={14} className="text-emerald-500" /> Administrator Account
                     </p>
                 </div>
+                <div className="flex flex-col items-start md:items-end gap-2">
+                    <button
+                        type="button"
+                        onClick={handleSaveSettings}
+                        disabled={!companyId || isLoadingSettings || isSavingSettings || !hasUnsavedChanges}
+                        className="inline-flex items-center gap-2 rounded-xl bg-slate-900 px-5 py-3 text-xs font-black uppercase tracking-widest text-white shadow-xl shadow-slate-200 transition-all hover:bg-indigo-600 disabled:cursor-not-allowed disabled:bg-slate-300 disabled:shadow-none"
+                    >
+                        <Save size={16} />
+                        {isSavingSettings ? 'Saving...' : 'Save Now'}
+                    </button>
+                    {statusMessage && (
+                        <p className="max-w-xs text-left md:text-right text-[10px] font-bold uppercase tracking-widest text-slate-400">
+                            {statusMessage}
+                        </p>
+                    )}
+                </div>
             </div>
 
             <div className="space-y-8">

Frontend/src/admin/pages/AdminTicketDetail.jsx

@@ -16,6 +16,7 @@ import { formatTicketId } from "../../utils/format";
 import SLABadge from "../components/SLABadge";
 import { formatFullTimestamp } from "../../utils/dateUtils";
 import TicketTimeline from "../../user/components/TicketTimeline";
+import TicketAuditTimeline from "../components/TicketAuditTimeline";
 
 const AdminTicketDetail = () => {
     const { ticket_id } = useParams();
@@ -34,6 +35,7 @@ const AdminTicketDetail = () => {
     const [imageUrl, setImageUrl] = useState(null);
     const [isUpdating, setIsUpdating] = useState(null);
     const [isLive, setIsLive] = useState(false);
+    const [showOriginalText, setShowOriginalText] = useState(false);
 
     const [correctionForm, setCorrectionForm] = useState({
         category: '',
@@ -197,6 +199,11 @@ const AdminTicketDetail = () => {
     const displayPriority = ticket.priority || 'Medium';
     const displaySummary = ticket.summary || ticket.subject || 'No Summary';
     const displayText = ticket.description || ticket.text || displaySummary;
+    const translationMeta = ticket.metadata?.translation;
+    const originalTextMeta = ticket.metadata?.original_text;
+    const isTranslated = Boolean(translationMeta?.translated && originalTextMeta?.description);
+    const sourceLanguageName = translationMeta?.source_language_name || translationMeta?.source_language || 'Unknown';
+    const renderedText = showOriginalText && isTranslated ? originalTextMeta.description : displayText;
 
     return (
         <div style={{ background: '#f8faf9', minHeight: '100vh', paddingBottom: '80px' }} className="-m-6 p-6 md:-m-10 md:p-10 space-y-6 animate-in fade-in duration-700">
@@ -312,8 +319,22 @@ const AdminTicketDetail = () => {
                             <span style={{ fontSize: '10px', color: '#9ca3af', fontWeight: 600, textTransform: 'uppercase' }}>{formatFullTimestamp(ticket.created_at)}</span>
                         </div>
                         <div style={{ padding: '28px' }}>
+                            {isTranslated && (
+                                <div style={{ marginBottom: '16px', border: '1px solid #bae6fd', background: '#f0f9ff', borderRadius: '12px', padding: '10px 12px', display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: '8px' }}>
+                                    <span style={{ fontSize: '12px', fontWeight: 600, color: '#0c4a6e' }}>
+                                        Translated from {sourceLanguageName}
+                                    </span>
+                                    <button
+                                        type="button"
+                                        onClick={() => setShowOriginalText(prev => !prev)}
+                                        style={{ fontSize: '11px', fontWeight: 700, color: '#0369a1', background: 'transparent', border: 'none', cursor: 'pointer' }}
+                                    >
+                                        {showOriginalText ? 'View English' : 'View Original'}
+                                    </button>
+                                </div>
+                            )}
                             <div style={{ background: 'linear-gradient(135deg, #0f1f12, #1a3320)', color: '#ffffff', borderRadius: '16px', padding: '24px 28px', fontSize: '15px', fontStyle: 'italic', lineHeight: 1.7 }}>
-                                "{displayText}"
+                                "{renderedText}"
                             </div>
 
                             {imageUrl && (
@@ -342,6 +363,8 @@ const AdminTicketDetail = () => {
                         </div>
                         <TicketTimeline ticket={ticket} />
                     </div>
+
+                    <TicketAuditTimeline ticketId={ticket.id} companyId={ticket.company_id} />
                 </div>
 
                 {/* AI Column */}

Frontend/src/admin/pages/AdminTickets.jsx

@@ -1,8 +1,9 @@
-import React, { useState, useMemo, useEffect } from 'react';
+import React, { useCallback, useState, useMemo, useEffect } from 'react';
 import { useNavigate, useLocation } from 'react-router-dom';
 import useAuthStore from "../../store/authStore";
 import useToastStore from "../../store/toastStore";
 import { supabase } from "../../lib/supabaseClient";
+import useTicketsRealtime from "../../hooks/useTicketsRealtime";
 import {
     Search,
     Filter,
@@ -29,7 +30,7 @@ import { formatTimelineDate } from "../../utils/dateUtils";
 const AdminTickets = () => {
     const navigate = useNavigate();
     const location = useLocation();
-    const { user } = useAuthStore();
+    const { user, profile } = useAuthStore();
     const { showToast } = useToastStore();
 
     // Data State
@@ -46,6 +47,27 @@ const AdminTickets = () => {
     const [teamFilter, setTeamFilter] = useState('All');
     const [agents, setAgents] = useState([]); // All staff/admins in the company
 
+    const ticketMatchesFilters = useCallback((ticket) => {
+        if (statusFilter !== 'All' && String(ticket.status || '').toLowerCase() !== statusFilter.toLowerCase()) return false;
+        if (categoryFilter !== 'All' && ticket.category !== categoryFilter) return false;
+        if (priorityFilter !== 'All' && String(ticket.priority || '').toLowerCase() !== priorityFilter.toLowerCase()) return false;
+        if (teamFilter !== 'All' && ticket.assigned_team !== teamFilter) return false;
+        return true;
+    }, [categoryFilter, priorityFilter, statusFilter, teamFilter]);
+
+    const handleRealtimeInsert = useCallback((ticket) => {
+        showToast(`New Incident Reported: #${formatTicketId(ticket.id)}`, "success");
+    }, [showToast]);
+
+    const { lastChangedTicketId } = useTicketsRealtime({
+        company: profile?.company,
+        enabled: Boolean(profile),
+        onTicketsChange: setTickets,
+        onInsert: handleRealtimeInsert,
+        shouldInclude: ticketMatchesFilters,
+        channelName: 'admin_tickets_realtime',
+    });
+
     const fetchInitialData = async () => {
         setLoading(true);
         try {
@@ -113,38 +135,6 @@ const AdminTickets = () => {
 
     useEffect(() => {
         fetchInitialData();
-
-        // 4. Real-time subscription to ticket changes
-        const { profile } = useAuthStore.getState();
-        const channel = supabase
-            .channel('admin_tickets_realtime')
-            .on(
-                'postgres_changes',
-                {
-                    event: '*',
-                    schema: 'public',
-                    table: 'tickets',
-                    filter: profile?.company ? `company=eq.${profile.company}` : undefined
-                },
-                (payload) => {
-                    console.log("Admin tickets sync event:", payload.eventType, payload.new);
-                    if (payload.eventType === 'INSERT') {
-                        setTickets(prev => [payload.new, ...prev]);
-                        showToast(`New Incident Reported: #${payload.new.id}`, "success");
-                        // Play a subtle sound or visual cue if needed
-                    } else if (payload.eventType === 'UPDATE') {
-                        setTickets(prev => prev.map(t => t.id === payload.new.id ? { ...t, ...payload.new } : t));
-                    } else if (payload.eventType === 'DELETE') {
-                        setTickets(prev => prev.filter(t => t.id === payload.old.id));
-                    }
-                }
-            )
-            .subscribe();
-
-        return () => {
-            supabase.removeChannel(channel);
-        };
-     
     }, [statusFilter, categoryFilter, priorityFilter, teamFilter]);
 
     // Seed search from URL
@@ -305,8 +295,11 @@ const AdminTickets = () => {
                             </tr>
                         </thead>
                         <tbody className="divide-y divide-slate-50">
-                            {filteredTickets.map((ticket) => (
-                                <tr key={ticket.id} className={`hover:bg-slate-50/50 transition-colors group ${isUpdating === ticket.id ? 'opacity-50 pointer-events-none' : ''}`}>
+                            {filteredTickets.map((ticket) => {
+                                const wasLiveChanged = String(lastChangedTicketId) === String(ticket.id);
+
+                                return (
+                                <tr key={ticket.id} className={`hover:bg-slate-50/50 transition-colors group ${wasLiveChanged ? 'bg-emerald-50/70 ring-1 ring-emerald-100' : ''} ${isUpdating === ticket.id ? 'opacity-50 pointer-events-none' : ''}`}>
                                     {/* Ticket ID */}
                                     <td className="px-6 py-6">
                                         <span className="font-mono text-xs font-black text-emerald-600">#{formatTicketId(ticket.id)}</span>
@@ -347,6 +340,11 @@ const AdminTickets = () => {
                                                 {ticket.category} 
                                                 <span className="text-[9px] font-medium text-slate-300">• {formatTimelineDate(ticket.created_at)}</span>
                                             </span>
+                                            {ticket?.metadata?.translation?.translated && (
+                                                <span className="text-[10px] text-sky-700 mt-1">
+                                                    Translated from {ticket.metadata.translation.source_language_name || ticket.metadata.translation.source_language || 'Unknown'}
+                                                </span>
+                                            )}
                                         </div>
                                     </td>
 
@@ -456,7 +454,8 @@ const AdminTickets = () => {
                                         </div>
                                     </td>
                                 </tr>
-                            ))}
+                                );
+                            })}
                         </tbody>
                     </table>
                 </div>

Frontend/src/components/shared/BugReportWidget.jsx

@@ -23,7 +23,6 @@ function useDiagnostics() {
         const browserInfo = navigator.userAgent;
         const screenInfo = `${window.innerWidth}x${window.innerHeight}`;
 
-         
         setDiagnostics(prev => ({
             ...prev,
             url: window.location.href,
@@ -31,16 +30,6 @@ function useDiagnostics() {
             screen: screenInfo
         }));
 
-        // Intercept console.error
-        const originalConsoleError = console.error;
-        console.error = function (...args) {
-            setDiagnostics(prev => ({
-                ...prev,
-                consoleErrors: [...prev.consoleErrors, args.join(' ')].slice(-10) // keep last 10
-            }));
-            originalConsoleError.apply(console, args);
-        };
-
         // Global Error Listener
         const handleError = (e) => {
             setDiagnostics(prev => ({
@@ -51,7 +40,6 @@ function useDiagnostics() {
         window.addEventListener('error', handleError);
 
         return () => {
-            console.error = originalConsoleError;
             window.removeEventListener('error', handleError);
         };
     }, []);

Frontend/src/config.js

@@ -13,5 +13,6 @@ const getBackendUrl = () => {
 export const API_CONFIG = {
     BACKEND_URL: getBackendUrl(),
     FRONTEND_URL: window.location.origin,
-    IS_PROD: import.meta.env.PROD
+    IS_PROD: import.meta.env.PROD,
+    USE_MOCK: import.meta.env.VITE_USE_MOCK !== 'false'  // default true
 };

Frontend/src/legacy_ui/Dashboard.jsx

@@ -63,7 +63,7 @@ const Dashboard = () => {
       }
     };
     fetchTickets();
-  // eslint-disable-next-line react-hooks/exhaustive-deps
+
   }, []);
 
   // Detect newly inserted or updated tickets for highlight animation
@@ -84,7 +84,7 @@ const Dashboard = () => {
     });
 
     prevTicketsRef.current = tickets;
-  // eslint-disable-next-line react-hooks/exhaustive-deps
+
   }, [tickets]);
 
   // Summary Counts

Frontend/src/pages/AdminSignup.jsx

@@ -10,6 +10,7 @@ import {
 } from "lucide-react";
 import useAuthStore from "../store/authStore";
 import { Select } from "../components/ui/select";
+import { getPasswordValidation, getPasswordValidationMessage } from "../utils/passwordValidation";
 
 /**
  * AdminSignup — Premium Multi-step Company Registration
@@ -44,6 +45,14 @@ function AdminSignup() {
 
     const navigate = useNavigate();
     const { signup, loading, user, profile } = useAuthStore();
+    const passwordRules = {
+        minLength: 8,
+        requireUppercase: true,
+        requireNumber: true,
+        requireSpecial: true,
+    };
+    const passwordChecks = getPasswordValidation(formData.password, passwordRules);
+    const passwordWarning = getPasswordValidationMessage(passwordChecks, passwordRules);
 
     // Redirect if already logged in and verified
     useEffect(() => {
@@ -80,8 +89,8 @@ function AdminSignup() {
                 setError("Please fill in all required personal information.");
                 return;
             }
-            if (formData.password.length < 8) {
-                setError("Password must be at least 8 characters long.");
+            if (passwordWarning) {
+                setError(passwordWarning);
                 return;
             }
             if (formData.password !== formData.confirmPassword) {
@@ -422,7 +431,7 @@ function AdminSignup() {
                                             </div>
                                             {/* Strength Meter */}
                                             {formData.password && (
-                                                <div className="mt-2 space-y-1">
+                                                <div className="mt-2 space-y-2">
                                                     <div className="flex justify-between items-center text-[10px] font-bold uppercase tracking-widest text-gray-400">
                                                         <span>Strength: {getStrengthText()}</span>
                                                         <span>{passwordStrength}%</span>
@@ -434,6 +443,12 @@ function AdminSignup() {
                                                             animate={{ width: `${passwordStrength}%` }}
                                                         />
                                                     </div>
+                                                    <div
+                                                        aria-live="polite"
+                                                        className={`text-[11px] font-semibold ${passwordWarning ? "text-red-600" : "text-emerald-700"}`}
+                                                    >
+                                                        {passwordWarning || "Password requirements met."}
+                                                    </div>
                                                 </div>
                                             )}
                                         </div>

Frontend/src/pages/LandingPage.jsx

@@ -1,4 +1,4 @@
-import React, { useRef, useEffect, useState } from 'react';
+import React, { useRef, useEffect, useState, useMemo } from 'react';
  
 import { motion, AnimatePresence } from 'framer-motion';
 import { useNavigate } from 'react-router-dom';
@@ -14,6 +14,12 @@ import {
 import useAuthStore from '../store/authStore';
 import TeamSection from '../components/landing/TeamSection';
 
+const CTA_TRANSITION = 'transition-all duration-200 ease-out transform-gpu will-change-transform';
+const CTA_SCALE = 'hover:scale-105 active:scale-[0.98]';
+const CTA_PRIMARY_GLOW = 'shadow-lg shadow-emerald-900/20 hover:shadow-emerald-900/35';
+const CTA_ICON_SHIFT = 'transition-transform duration-200 group-hover:translate-x-1';
+const CTA_PLAY_SHIFT = 'transition-transform duration-200 group-hover:translate-x-0.5';
+
 // ---- Count-up animation component ----
 function AnimatedStat({ target, suffix = '', prefix = '', label, isWord = false }) {
     const [display, setDisplay] = useState(isWord ? target : '0');
@@ -124,9 +130,9 @@ function DemoModal({ onClose }) {
                     <div className="flex gap-3 w-full md:w-auto">
                         <button
                             onClick={() => { onClose(); window.location.href = '/admin-signup'; }}
-                            className="flex-1 md:px-8 bg-emerald-600 hover:bg-emerald-500 text-white py-3 rounded-xl font-black italic uppercase tracking-wider transition-all flex items-center justify-center gap-2 shadow-lg shadow-emerald-500/20"
+                            className={`group flex-1 md:px-8 bg-emerald-600 hover:bg-emerald-500 text-white py-3 rounded-xl font-black italic uppercase tracking-wider ${CTA_TRANSITION} ${CTA_SCALE} ${CTA_PRIMARY_GLOW} flex items-center justify-center gap-2`}
                         >
-                            Start Free <ArrowRight className="w-4 h-4 ml-1" />
+                            Start Free <ArrowRight className={`w-4 h-4 ml-1 ${CTA_ICON_SHIFT}`} />
                         </button>
                     </div>
                 </div>
@@ -145,7 +151,7 @@ export default function LandingPage() {
     const [activeStep, setActiveStep] = useState(0);
     const [isRedirecting, setIsRedirecting] = useState(false);
 
-    const steps = [
+    const steps = useMemo(() => [
         {
             num: '01',
             title: 'Messy User Input',
@@ -208,7 +214,7 @@ export default function LandingPage() {
                 </div>
             )
         }
-    ];
+    ], []);
 
     useEffect(() => {
         if (!loading && user && profile) {
@@ -225,7 +231,7 @@ export default function LandingPage() {
             period: '/mo',
             desc: 'Perfect for small teams exploring AI helpdesk.',
             cta: 'Get Started Free',
-            ctaStyle: 'border border-gray-200 text-gray-700 hover:border-emerald-900 hover:text-emerald-800',
+            ctaStyle: `border border-gray-200 text-gray-700 hover:border-emerald-900 hover:text-emerald-800 group ${CTA_TRANSITION} ${CTA_SCALE}`,
             features: ['Up to 50 tickets/mo', 'Basic AI Categorization', 'Email Support', '1 Team Member', 'Public API Access'],
             popular: false,
         },
@@ -235,7 +241,7 @@ export default function LandingPage() {
             period: '/mo',
             desc: 'For growing IT teams needing full automation.',
             cta: 'Start Free Trial',
-            ctaStyle: 'bg-emerald-900 text-white hover:bg-emerald-800 shadow-lg shadow-emerald-900/20',
+            ctaStyle: `bg-emerald-900 text-white hover:bg-emerald-800 group ${CTA_TRANSITION} ${CTA_SCALE} ${CTA_PRIMARY_GLOW}`,
             features: ['Up to 500 tickets/mo', 'Advanced AI Parsing', 'Priority Detection Engine', 'Duplicate Detection', '5 Team Members', 'Priority Email Support'],
             popular: true,
         },
@@ -245,7 +251,7 @@ export default function LandingPage() {
             period: '',
             desc: 'For large organizations with complex IT landscapes.',
             cta: 'Contact Sales',
-            ctaStyle: 'border border-gray-200 text-gray-700 hover:border-emerald-900 hover:text-emerald-800',
+            ctaStyle: `border border-gray-200 text-gray-700 hover:border-emerald-900 hover:text-emerald-800 group ${CTA_TRANSITION} ${CTA_SCALE}`,
             features: ['Unlimited tickets', 'Custom AI Fine-Tuning', 'SSO & Audit Logs', 'Dedicated SLA Manager', 'Unlimited Members', 'VAPT & Compliance Reports'],
             popular: false,
         },
@@ -316,13 +322,13 @@ export default function LandingPage() {
                             </button>
                             <button
                                 onClick={() => setShowDemo(true)}
-                                className="text-sm font-semibold text-emerald-800 border border-emerald-200 px-4 py-2 rounded-lg hover:bg-emerald-50 transition-all flex items-center gap-1.5"
+                                className={`group text-sm font-semibold text-emerald-800 border border-emerald-200 px-4 py-2 rounded-lg hover:bg-emerald-50 ${CTA_TRANSITION} ${CTA_SCALE} flex items-center gap-1.5`}
                             >
-                                <Play className="w-3.5 h-3.5 fill-emerald-700" /> Watch Demo
+                                <Play className={`w-3.5 h-3.5 fill-emerald-700 ${CTA_PLAY_SHIFT}`} /> Watch Demo
                             </button>
                             <button
                                 onClick={() => navigate('/admin-signup')}
-                                className="bg-emerald-900 hover:bg-emerald-800 text-white px-5 py-2.5 rounded-lg text-sm font-semibold transition-all shadow-lg shadow-emerald-900/20"
+                                className={`group bg-emerald-900 hover:bg-emerald-800 text-white px-5 py-2.5 rounded-lg text-sm font-semibold ${CTA_TRANSITION} ${CTA_SCALE} ${CTA_PRIMARY_GLOW}`}
                             >
                                 Get Started Free
                             </button>
@@ -345,13 +351,13 @@ export default function LandingPage() {
                             <a href="#how-it-works" onClick={() => setIsMenuOpen(false)} className="block text-base font-semibold text-gray-700 hover:text-emerald-800 py-2">How It Works</a>
                             <a href="#pricing" onClick={() => setIsMenuOpen(false)} className="block text-base font-semibold text-gray-700 hover:text-emerald-800 py-2">Pricing</a>
                             <div className="pt-4 flex flex-col gap-3 border-t border-gray-100">
-                                <button onClick={() => { setIsMenuOpen(false); setShowDemo(true); }} className="w-full text-center py-2.5 text-emerald-800 font-semibold border border-emerald-200 rounded-lg flex items-center justify-center gap-2">
-                                    <Play className="w-4 h-4 fill-emerald-700" /> Watch Demo
+                                <button onClick={() => { setIsMenuOpen(false); setShowDemo(true); }} className={`group w-full text-center py-2.5 text-emerald-800 font-semibold border border-emerald-200 rounded-lg flex items-center justify-center gap-2 ${CTA_TRANSITION} ${CTA_SCALE}`}>
+                                    <Play className={`w-4 h-4 fill-emerald-700 ${CTA_PLAY_SHIFT}`} /> Watch Demo
                                 </button>
                                 <button onClick={() => navigate('/login')} className="w-full text-center py-2.5 text-gray-700 font-semibold border border-gray-100 rounded-lg">
                                     Sign In
                                 </button>
-                                <button onClick={() => navigate('/admin-signup')} className="w-full bg-emerald-900 text-white py-3 rounded-lg font-semibold shadow">
+                                <button onClick={() => navigate('/admin-signup')} className={`group w-full bg-emerald-900 text-white py-3 rounded-lg font-semibold ${CTA_TRANSITION} ${CTA_SCALE} ${CTA_PRIMARY_GLOW}`}>
                                     Get Started Free
                                 </button>
                             </div>
@@ -382,15 +388,15 @@ export default function LandingPage() {
                     <div className="flex flex-col sm:flex-row items-center justify-center gap-4 mb-6">
                         <button
                             onClick={() => navigate('/admin-signup')}
-                            className="w-full sm:w-auto px-8 py-4 bg-emerald-900 text-white rounded-xl font-bold shadow-xl shadow-emerald-900/25 hover:bg-emerald-800 hover:scale-[1.02] active:scale-[0.98] transition-all flex items-center justify-center gap-2 text-base"
+                            className={`group w-full sm:w-auto px-8 py-4 bg-emerald-900 text-white rounded-xl font-bold ${CTA_PRIMARY_GLOW} hover:bg-emerald-800 ${CTA_TRANSITION} ${CTA_SCALE} flex items-center justify-center gap-2 text-base`}
                         >
-                            Get Started Free <ArrowRight className="w-5 h-5" />
+                            Get Started Free <ArrowRight className={`w-5 h-5 ${CTA_ICON_SHIFT}`} />
                         </button>
                         <button
                             onClick={() => setShowDemo(true)}
-                            className="w-full sm:w-auto px-8 py-4 bg-white text-gray-700 border border-gray-200 rounded-xl font-semibold hover:border-emerald-500 hover:text-emerald-700 transition-all flex items-center justify-center gap-2 text-base"
+                            className={`group w-full sm:w-auto px-8 py-4 bg-white text-gray-700 border border-gray-200 rounded-xl font-semibold hover:border-emerald-500 hover:text-emerald-700 ${CTA_TRANSITION} ${CTA_SCALE} flex items-center justify-center gap-2 text-base`}
                         >
-                            <Play className="w-4 h-4 fill-gray-500" /> Watch a Demo
+                            <Play className={`w-4 h-4 fill-gray-500 ${CTA_PLAY_SHIFT}`} /> Watch a Demo
                         </button>
                     </div>
 
@@ -427,7 +433,7 @@ export default function LandingPage() {
                                         <div className="mb-4">
                                             <h3 className="text-sm font-bold text-gray-800 mb-1">Subject: Wifi down again in Lab 3??</h3>
                                             <p className="text-sm text-gray-600 leading-relaxed">
-                                                Hey support, the wifi in <span className="bg-yellow-100 px-1 rounded">downstairs lab 3</span> is acting up again.
+                                                Hey support, the wifi in <span className="bg-yellow-200 dark:bg-yellow-500/30 dark:text-yellow-200 text-yellow-900 px-1 rounded font-medium">downstairs lab 3</span> is acting up again.
                                                 Can't connect at all. Class starts in 20 mins, need this fixed ASAP!<br /><br />
                                                 Thanks,<br />Sarah
                                             </p>
@@ -658,7 +664,7 @@ export default function LandingPage() {
                             <div className="inline-flex items-center gap-2 px-3 py-1 bg-emerald-500/10 text-emerald-400 rounded-full text-[10px] md:text-xs font-bold uppercase tracking-widest border border-emerald-500/20 mb-4 md:mb-6">
                                 The Journey
                             </div>
-                            <h2 className="text-3xl sm:text-4xl md:text-6xl font-black text-white tracking-tight leading-[0.9] mb-8 md:mb-12 italic uppercase">
+                            <h2 className="text-3xl sm:text-4xl md:text-6xl font-extrabold text-white tracking-tight leading-[0.95] mb-8 md:mb-12">
                                 From Chaos <br />
                                 to <span className="text-emerald-500">Clarity.</span>
                             </h2>
@@ -669,28 +675,25 @@ export default function LandingPage() {
                                         key={idx}
                                         onMouseEnter={() => setActiveStep(idx)}
                                         onClick={() => setActiveStep(idx)}
-                                        className={`group cursor-pointer p-6 rounded-3xl transition-all duration-500 border ${activeStep === idx
+                                        className={`group cursor-pointer p-6 rounded-3xl transition-all duration-300 border ${activeStep === idx
                                             ? 'bg-white/10 border-white/20 shadow-2xl shadow-black/20'
                                             : 'bg-transparent border-transparent hover:bg-white/5 opacity-40 hover:opacity-100'
                                             }`}
                                     >
                                         <div className="flex items-start gap-4 md:gap-6">
-                                            <div className={`shrink-0 w-10 md:w-12 h-10 md:h-12 rounded-xl md:rounded-2xl flex items-center justify-center font-black text-lg md:text-xl italic transition-all duration-500 ${activeStep === idx ? 'bg-emerald-500 text-white shadow-lg shadow-emerald-500/20 rotate-12 scale-110' : 'bg-white/10 text-white/40'}`}>
+                                            <div className={`shrink-0 w-10 md:w-12 h-10 md:h-12 rounded-xl md:rounded-2xl flex items-center justify-center font-bold text-lg md:text-xl transition-all duration-300 ${activeStep === idx ? 'bg-emerald-500 text-white shadow-lg shadow-emerald-500/20 scale-105' : 'bg-white/10 text-white/40'}`}>
                                                 {step.num}
                                             </div>
                                             <div>
-                                                <h3 className={`text-xl font-black italic uppercase transition-colors duration-500 ${activeStep === idx ? 'text-white' : 'text-white/60'}`}>
+                                                <h3 className={`text-xl font-semibold tracking-tight transition-colors duration-300 ${activeStep === idx ? 'text-white' : 'text-white/60'}`}>
                                                     {step.title}
                                                 </h3>
-                                                {activeStep === idx && (
-                                                    <motion.p
-                                                        initial={{ opacity: 0, height: 0 }}
-                                                        animate={{ opacity: 1, height: 'auto' }}
-                                                        className="text-white/60 text-sm mt-3 leading-relaxed max-w-sm"
-                                                    >
-                                                        {step.desc}
-                                                    </motion.p>
-                                                )}
+                                                <p
+                                                    aria-hidden={activeStep !== idx}
+                                                    className={`text-white/60 text-sm mt-3 leading-relaxed max-w-sm overflow-hidden transition-all duration-300 ${activeStep === idx ? 'opacity-100 max-h-24' : 'opacity-0 max-h-0'}`}
+                                                >
+                                                    {step.desc}
+                                                </p>
                                             </div>
                                         </div>
                                     </div>
@@ -701,14 +704,14 @@ export default function LandingPage() {
                         {/* Right: Visual Display */}
                         <div className="w-full md:w-1/2 h-[350px] md:h-[500px] relative">
                             <div className="absolute inset-0 bg-gradient-to-br from-emerald-500/10 to-transparent rounded-[32px] md:rounded-[40px] border border-white/5 backdrop-blur-3xl overflow-hidden p-6 md:p-12 flex items-center justify-center">
-                                <AnimatePresence mode="wait">
+                                <AnimatePresence mode="sync">
                                     <motion.div
                                         key={activeStep}
-                                        initial={{ opacity: 0, scale: 0.9, y: 20 }}
+                                        initial={{ opacity: 0, scale: 0.98, y: 10 }}
                                         animate={{ opacity: 1, scale: 1, y: 0 }}
-                                        exit={{ opacity: 0, scale: 1.1, y: -20 }}
-                                        transition={{ type: 'spring', damping: 20, stiffness: 100 }}
-                                        className="w-full h-full flex flex-col items-center justify-center"
+                                        exit={{ opacity: 0, scale: 1.01, y: -8 }}
+                                        transition={{ duration: 0.28, ease: 'easeOut' }}
+                                        className="w-full h-full flex flex-col items-center justify-center will-change-transform"
                                     >
                                         <div className="mb-6 inline-flex items-center gap-2 px-4 py-1.5 bg-white/5 text-white/50 rounded-full text-[10px] font-black uppercase tracking-[0.2em]">
                                             <div className={`w-1.5 h-1.5 rounded-full bg-emerald-400 animate-pulse`} />
@@ -772,7 +775,7 @@ export default function LandingPage() {
                                 <button
                                     onClick={() => handlePricingClick(name)}
                                     disabled={isRedirecting && name === 'Growth'}
-                                    className={`w-full flex items-center justify-center gap-2 py-3 rounded-xl font-semibold transition-all mb-8 text-sm ${ctaStyle} ${isRedirecting && name === 'Growth' ? 'opacity-80 cursor-not-allowed' : ''}`}
+                                    className={`w-full flex items-center justify-center gap-2 py-3 rounded-xl font-semibold mb-8 text-sm ${ctaStyle} ${isRedirecting && name === 'Growth' ? 'opacity-80 cursor-not-allowed' : ''}`}
                                 >
                                     {isRedirecting && name === 'Growth' ? (
                                         <>
@@ -815,15 +818,15 @@ export default function LandingPage() {
                     <div className="flex flex-col sm:flex-row items-center justify-center gap-4">
                         <button
                             onClick={() => navigate('/admin-signup')}
-                            className="w-full sm:w-auto px-8 py-4 bg-white text-emerald-900 font-bold rounded-xl hover:bg-green-50 transition-all shadow-xl"
+                            className={`group w-full sm:w-auto px-8 py-4 bg-white text-emerald-900 font-bold rounded-xl hover:bg-green-50 ${CTA_TRANSITION} ${CTA_SCALE} shadow-xl`}
                         >
                             Get Started Free
                         </button>
                         <button
                             onClick={() => setShowDemo(true)}
-                            className="w-full sm:w-auto px-8 py-4 border border-white/30 text-white font-semibold rounded-xl hover:bg-white/10 transition-all flex items-center justify-center gap-2"
+                            className={`group w-full sm:w-auto px-8 py-4 border border-white/30 text-white font-semibold rounded-xl hover:bg-white/10 ${CTA_TRANSITION} ${CTA_SCALE} flex items-center justify-center gap-2`}
                         >
-                            <Play className="w-4 h-4 fill-white" /> Watch Demo
+                            <Play className={`w-4 h-4 fill-white ${CTA_PLAY_SHIFT}`} /> Watch Demo
                         </button>
                     </div>
                     <div className="mt-8">

Frontend/src/pages/Signup.jsx

@@ -3,6 +3,7 @@ import { useNavigate, Link } from "react-router-dom";
 import useAuthStore from "../store/authStore";
 import { supabase } from "../lib/supabaseClient";
 import { Eye, EyeOff, BrainCircuit, ArrowRight, Loader2, CheckCircle2, ChevronDown, Search, Building2, ArrowLeft } from "lucide-react";
+import { getPasswordValidation, getPasswordValidationMessage } from "../utils/passwordValidation";
 
 function Signup() {
   const [email, setEmail] = useState("");
@@ -27,6 +28,10 @@ function Signup() {
   const dropdownRef = useRef(null);
   const navigate = useNavigate();
   const { signup, user, profile } = useAuthStore();
+  const passwordRules = { minLength: 6 };
+  const passwordChecks = getPasswordValidation(password, passwordRules);
+  const passwordWarning = getPasswordValidationMessage(passwordChecks, passwordRules);
+  const confirmPasswordWarning = confirmPassword && password !== confirmPassword ? "Passwords do not match." : "";
 
   // Fetch and subscribe to companies
   useEffect(() => {
@@ -113,13 +118,13 @@ function Signup() {
       return;
     }
 
-    if (password.length < 6) {
-      setError("Password must be at least 6 characters long.");
+    if (passwordWarning) {
+      setError(passwordWarning);
       return;
     }
 
-    if (password !== confirmPassword) {
-      setError("Passwords do not match.");
+    if (confirmPasswordWarning) {
+      setError(confirmPasswordWarning);
       return;
     }
 
@@ -321,6 +326,11 @@ function Signup() {
                     {showPassword ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
                   </button>
                 </div>
+                {password && (
+                  <p aria-live="polite" className={`mt-2 text-[11px] font-semibold ${passwordWarning ? "text-red-600" : "text-emerald-700"}`}>
+                    {passwordWarning || "Password looks good."}
+                  </p>
+                )}
               </div>
               <div className="relative">
                 <label className="block mb-2" style={labelStyle}>Confirm</label>
@@ -331,6 +341,11 @@ function Signup() {
                     {showConfirmPassword ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
                   </button>
                 </div>
+                {confirmPasswordWarning && (
+                  <p aria-live="polite" className="mt-2 text-[11px] font-semibold text-red-600">
+                    {confirmPasswordWarning}
+                  </p>
+                )}
               </div>
             </div>
 

Frontend/src/services/aiAssistant.js

@@ -1,5 +1,4 @@
-import { GoogleGenerativeAI } from "@google/generative-ai";
-import { API_CONFIG } from "../config";
+import { supabase } from "../lib/supabaseClient";
 
 // ============================================================
 // MULTI-API FAILOVER CONFIGURATION
@@ -8,45 +7,30 @@ import { API_CONFIG } from "../config";
 // ============================================================
 
 const buildConfigList = () => {
-    const env = import.meta.env;
     const configs = [];
 
     // Priority 1: Native Gemini — try modern flash models
-    const geminiKeys = [
-        env.VITE_GEMINI_API_KEY_1, env.VITE_GEMINI_API_KEY_2,
-        env.VITE_GEMINI_API_KEY_3, env.VITE_GEMINI_API_KEY_4
-    ].filter(Boolean);
-    // Try each key with gemini-2.5-flash first (most robust, active free tier), then gemini-2.5-flash-lite
-    geminiKeys.forEach(key => {
-        configs.push({ provider: 'gemini', key, model: 'gemini-2.5-flash' });
-        configs.push({ provider: 'gemini', key, model: 'gemini-2.5-flash-lite' });
-        configs.push({ provider: 'gemini', key, model: 'gemini-2.0-flash' });
-    });
+    configs.push(
+        { provider: 'gemini', model: 'gemini-2.5-flash' },
+        { provider: 'gemini', model: 'gemini-2.5-flash-lite' },
+        { provider: 'gemini', model: 'gemini-2.0-flash' }
+    );
 
     // Priority 2: OpenRouter — updated model slugs (verified working as of 2025)
-    const openrouterKeys = [
-        env.VITE_OPENROUTER_API_KEY_1, env.VITE_OPENROUTER_API_KEY_2,
-        env.VITE_OPENROUTER_API_KEY_3, env.VITE_OPENROUTER_API_KEY_4,
-    ].filter(Boolean);
     const openrouterModels = [
         'meta-llama/llama-3.2-3b-instruct:free',
         'microsoft/phi-3-mini-128k-instruct:free',
         'mistralai/mistral-7b-instruct:free',
         'google/gemma-2-9b-it:free',
     ];
-    openrouterKeys.forEach((key, idx) => {
-        // Each key tries two models for extra redundancy
-        configs.push({ provider: 'openrouter', key, model: openrouterModels[idx % openrouterModels.length] });
-        configs.push({ provider: 'openrouter', key, model: openrouterModels[(idx + 1) % openrouterModels.length] });
+    openrouterModels.forEach((model) => {
+        configs.push({ provider: 'openrouter', model });
     });
 
     // Priority 3: Groq — use stable, currently-available models
-    const groqKeys = [
-        env.VITE_GROQ_API_KEY_1, env.VITE_GROQ_API_KEY_2, env.VITE_GROQ_API_KEY_3
-    ].filter(Boolean);
     const groqModels = ['llama-3.1-8b-instant', 'mixtral-8x7b-32768', 'gemma2-9b-it'];
-    groqKeys.forEach((key, idx) => {
-        configs.push({ provider: 'groq', key, model: groqModels[idx % groqModels.length] });
+    groqModels.forEach((model) => {
+        configs.push({ provider: 'groq', model });
     });
 
     return configs;
@@ -57,11 +41,8 @@ const buildConfigList = () => {
 // PROVIDER HANDLERS
 // ============================================================
 
-const callGemini = async (config, promptText, history, image) => {
-    const genAI = new GoogleGenerativeAI(config.key);
-    const model = genAI.getGenerativeModel({ model: config.model });
-
-    let formattedHistory = history.map(msg => {
+const buildGeminiMessages = (promptText, history, image) => {
+    const formattedHistory = history.map(msg => {
         const parts = [{ text: msg.text || "" }];
         if (msg.image) {
             const [mime, data] = msg.image.split(';base64,');
@@ -70,72 +51,110 @@ const callGemini = async (config, promptText, history, image) => {
         return { role: msg.role === 'bot' ? 'model' : 'user', parts };
     });
 
-    // Gemini requires history to start with 'user' role
-    const firstUserIdx = formattedHistory.findIndex(h => h.role === 'user');
-    if (firstUserIdx > 0) formattedHistory = formattedHistory.slice(firstUserIdx);
-    else if (firstUserIdx === -1) formattedHistory = [];
-
-    const chat = model.startChat({ history: formattedHistory, generationConfig: { maxOutputTokens: 2048 } });
-
     const messageParts = [{ text: promptText }];
     if (image) {
         const [mime, data] = image.split(';base64,');
         messageParts.push({ inlineData: { mimeType: mime.split(':')[1] || 'image/png', data } });
     }
 
-    const result = await chat.sendMessage(messageParts);
-    return result.response.text();
+    return formattedHistory.length > 0
+        ? [...formattedHistory, { role: 'user', parts: messageParts }]
+        : [{ role: 'user', parts: messageParts }];
 };
 
-const callOpenAICompat = async (config, promptText, history, image, baseUrl, extraHeaders = {}) => {
-    const messages = history.map(msg => ({
-        role: msg.role === 'bot' ? 'assistant' : 'user',
-        content: msg.text || ""
-    }));
+const buildOpenAICompatMessages = (promptText, history, image) => {
+    const messages = history.map(msg => {
+        const content = msg.image
+            ? [
+                { type: 'text', text: msg.text || '' },
+                { type: 'image_url', image_url: { url: msg.image } }
+            ]
+            : msg.text || '';
+
+        return {
+            role: msg.role === 'bot' ? 'assistant' : 'user',
+            content,
+        };
+    });
 
     const userContent = image
         ? [{ type: "text", text: promptText }, { type: "image_url", image_url: { url: image } }]
         : promptText;
 
     messages.push({ role: "user", content: userContent });
+    return messages;
+};
 
-    const response = await fetch(`${baseUrl}/chat/completions`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${config.key}`, ...extraHeaders },
-        body: JSON.stringify({ model: config.model, messages, max_tokens: 2048 })
-    });
+const extractResponseText = (data) => {
+    if (typeof data === 'string') return data;
+    if (!data || typeof data !== 'object') return '';
+
+    const openAiContent = data.choices?.[0]?.message?.content;
+    if (typeof openAiContent === 'string') return openAiContent;
+    if (Array.isArray(openAiContent)) {
+        return openAiContent
+            .map(part => part?.text || part?.content || '')
+            .filter(Boolean)
+            .join('');
+    }
+
+    const geminiParts = data.candidates?.[0]?.content?.parts;
+    if (Array.isArray(geminiParts)) {
+        return geminiParts
+            .map(part => part?.text || '')
+            .filter(Boolean)
+            .join('');
+    }
 
-    if (!response.ok) {
-        const err = new Error(`HTTP ${response.status}`);
-        err.status = response.status;
-        throw err;
+    if (typeof data.candidates?.[0]?.content === 'string') {
+        return data.candidates[0].content;
     }
-    const data = await response.json();
-    return data.choices?.[0]?.message?.content || "No response received.";
+
+    if (typeof data.text === 'string') return data.text;
+
+    return '';
+};
+
+const callProxy = async (config, promptText, history, image) => {
+    const body = config.provider === 'gemini'
+        ? {
+            provider: config.provider,
+            model: config.model,
+            messages: buildGeminiMessages(promptText, history, image),
+        }
+        : {
+            provider: config.provider,
+            model: config.model,
+            messages: buildOpenAICompatMessages(promptText, history, config.provider === 'groq' ? null : image),
+        };
+
+    const { data, error } = await supabase.functions.invoke('ai-proxy', { body });
+
+    if (error) {
+        const invokeError = new Error(error.message || 'AI proxy request failed');
+        invokeError.status = error.status || error?.context?.status;
+        throw invokeError;
+    }
+
+    const responseText = extractResponseText(data);
+    if (!responseText) {
+        throw new Error(`No response received from ${config.provider}`);
+    }
+
+    return responseText;
 };
 
 // Core failover runner — shared by both exported functions
 const runWithFailover = async (promptText, history, image) => {
     const configList = buildConfigList();
-    if (configList.length === 0) throw new Error("No AI API keys configured in .env");
+    if (configList.length === 0) throw new Error("No AI providers configured");
 
     for (let i = 0; i < configList.length; i++) {
         const config = configList[i];
         console.log(`[AI Failover] Trying ${i + 1}/${configList.length}: ${config.provider} (${config.model})`);
 
         try {
-            if (config.provider === 'gemini') {
-                return await callGemini(config, promptText, history, image);
-            } else if (config.provider === 'openrouter') {
-                return await callOpenAICompat(config, promptText, history, image,
-                    'https://openrouter.ai/api/v1',
-                    { 'HTTP-Referer': API_CONFIG.FRONTEND_URL, 'X-Title': 'AI Helpdesk' }
-                );
-            } else if (config.provider === 'groq') {
-                return await callOpenAICompat(config, promptText, history, null, // Groq = text only
-                    'https://api.groq.com/openai/v1'
-                );
-            }
+            return await callProxy(config, promptText, history, image);
         } catch (error) {
             const isRateLimit = error.status === 429
                 || error.message?.includes('429')

Frontend/src/services/api.js

@@ -2,7 +2,7 @@ import axios from 'axios';
 import { MOCK_TICKETS } from './mockData';
 import { API_CONFIG } from '../config';
 
-const USE_MOCK = true;
+const USE_MOCK = API_CONFIG.USE_MOCK;
 const API_BASE_URL = API_CONFIG.BACKEND_URL;
 
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -38,38 +38,69 @@ const setStorage = (key, data) => {
   }
 };
 
+// Shared mock logic for createTicket
+const createTicketMock = (ticketData) => {
+  const tickets = getStorage('tickets', MOCK_TICKETS);
+  const newTicket = {
+    ticket_id: "TCKT-" + Math.floor(Math.random() * 10000),
+    status: 'Open',
+    createdAt: new Date().toISOString(),
+    ...ticketData,
+    messages: [
+      {
+        sender: 'user',
+        message: ticketData.description || ticketData.summary || '',
+        timestamp: new Date().toISOString()
+      }
+    ]
+  };
+  tickets.unshift(newTicket); // Add to beginning
+  setStorage('tickets', tickets);
+  return { data: newTicket };
+};
+
 export const api = {
   // Login and Signup have been fully migrated to Supabase via authStore.js
   // Ensure that no component tries to use api.login or api.signup anymore.
 
-
   getTickets: async () => {
     if (USE_MOCK) {
       await delay(500);
       return getStorage('tickets', MOCK_TICKETS);
     }
+    try {
+      const response = await axios.get(`${API_BASE_URL}/tickets`);
+      const data = response?.data;
+
+      // Normalize to the mock shape: an array of tickets
+      if (Array.isArray(data)) return data;
+      if (data && Array.isArray(data.data)) return data.data;
+      if (data && Array.isArray(data.tickets)) return data.tickets;
+
+      return data;
+    } catch (error) {
+      console.error("Backend unavailable, falling back to mock:", error);
+      await delay(500);
+      return getStorage('tickets', MOCK_TICKETS);
+    }
   },
 
   createTicket: async (ticketData) => {
     if (USE_MOCK) {
       await delay(800);
-      const tickets = getStorage('tickets', MOCK_TICKETS);
-      const newTicket = {
-        ticket_id: "TCKT-" + Math.floor(Math.random() * 10000),
-        status: 'Open',
-        createdAt: new Date().toISOString(),
-        ...ticketData,
-        messages: [
-          {
-            sender: 'user',
-            message: ticketData.description || ticketData.summary || '',
-            timestamp: new Date().toISOString()
-          }
-        ]
-      };
-      tickets.unshift(newTicket); // Add to beginning
-      setStorage('tickets', tickets);
-      return { data: newTicket };
+      return createTicketMock(ticketData);
+    }
+    try {
+      const response = await axios.post(`${API_BASE_URL}/tickets/save`, ticketData);
+      const created = response?.data;
+
+      // Normalize to mock shape: { data: <createdTicket> }
+      if (created && created.data) return created;
+      return { data: created };
+    } catch (error) {
+      console.error("Backend unavailable, falling back to mock:", error);
+      await delay(800);
+      return createTicketMock(ticketData);
     }
   },
 

Frontend/src/store/authStore.js

@@ -1,8 +1,40 @@
 import { create } from 'zustand';
 import { persist } from 'zustand/middleware';
 import { supabase } from '../lib/supabaseClient';
+import { API_CONFIG } from '../config';
 import useTicketStore from './ticketStore';
 
+const BACKEND_URL = API_CONFIG.BACKEND_URL;
+
+const verifyServerCookieSession = async () => {
+    try {
+        const res = await fetch(`${BACKEND_URL}/auth/me`, {
+            method: 'GET',
+            credentials: 'include',
+            headers: { Accept: 'application/json' },
+        });
+        if (!res.ok) return null;
+        const body = await res.json();
+        return body?.user || null;
+    } catch (e) {
+        console.warn('Server cookie session check failed:', e?.message || e);
+        return null;
+    }
+};
+
+const mirrorBackendAuth = async (path, payload) => {
+    try {
+        await fetch(`${BACKEND_URL}${path}`, {
+            method: 'POST',
+            credentials: 'include',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+    } catch (e) {
+        console.warn(`Backend auth ${path} failed:`, e?.message || e);
+    }
+};
+
 let currentUserPromise = null;
 
 const useAuthStore = create(
@@ -89,6 +121,13 @@ const useAuthStore = create(
                 currentUserPromise = (async () => {
                     try {
                         set({ isCheckingSession: true });
+                        const cookieUser = await verifyServerCookieSession();
+                        if (cookieUser) {
+                            set({ user: cookieUser });
+                            get().getProfile(cookieUser);
+                            return cookieUser;
+                        }
+
                         const { data: { user }, error } = await supabase.auth.getUser();
                         if (error) throw error;
 
@@ -117,6 +156,8 @@ const useAuthStore = create(
                 set({ loading: true });
                 console.log("Attempting login for:", email);
                 try {
+                    await mirrorBackendAuth('/auth/login', { email, password });
+
                     const { data, error } = await supabase.auth.signInWithPassword({
                         email,
                         password,
@@ -205,6 +246,14 @@ const useAuthStore = create(
                 console.log("Starting signup for:", email);
 
                 try {
+                    await mirrorBackendAuth('/auth/signup', {
+                        email,
+                        password,
+                        full_name: fullName,
+                        role,
+                        company,
+                    });
+
                     // 1. Auth Signup with Metadata
                     console.log("Step 1: Auth.signUp...");
                     const { data, error } = await supabase.auth.signUp({
@@ -245,6 +294,15 @@ const useAuthStore = create(
             logout: async () => {
                 set({ loading: true });
                 try {
+                    try {
+                        await fetch(`${BACKEND_URL}/auth/logout`, {
+                            method: 'POST',
+                            credentials: 'include',
+                        });
+                    } catch (e) {
+                        console.warn('Backend cookie logout failed:', e?.message || e);
+                    }
+
                     const { error } = await supabase.auth.signOut();
                     if (error) throw error;
                     set({ user: null, profile: null });
@@ -305,8 +363,7 @@ const useAuthStore = create(
         {
             name: 'auth-storage',
             partialize: (state) => ({
-                // We keep profile persisted for quick UI transitions, 
-                // but session is handled by Supabase cookie/localStorage
+                // Profile only — JWT session lives in HttpOnly cookies (issue #130)
                 profile: state.profile
             }),
         }

Frontend/src/store/ticketStore.js

@@ -27,30 +27,41 @@ const useTicketStore = create(
             })),
             addTicket: (ticket) => set((state) => {
                 return {
-                    tickets: [...state.tickets, ticket]
+                    tickets: [ticket, ...state.tickets]
                 };
             }),
-            updateTicket: (ticketId, updates) => set((state) => {
-// eslint-disable-next-line no-unused-vars
-                const existingTicket = state.tickets.find(t => t.ticket_id === ticketId);
-                const updatedTickets = state.tickets.map(t => t.ticket_id === ticketId ? { ...t, ...updates } : t);
-                const shouldUpdateActive = state.activeTicket?.ticket_id === ticketId;
-
+            upsertTicket: (ticket) => set((state) => {
+                const ticketId = ticket?.id ?? ticket?.ticket_id;
+                if (!ticketId) return state;
 
+                const exists = state.tickets.some(t => (t.id ?? t.ticket_id) === ticketId);
+                const tickets = exists
+                    ? state.tickets.map(t => (t.id ?? t.ticket_id) === ticketId ? { ...t, ...ticket } : t)
+                    : [ticket, ...state.tickets];
+                const shouldUpdateActive = (state.activeTicket?.id ?? state.activeTicket?.ticket_id) === ticketId;
 
+                return {
+                    tickets,
+                    activeTicket: shouldUpdateActive ? { ...state.activeTicket, ...ticket } : state.activeTicket
+                };
+            }),
+            removeTicket: (ticketId) => set((state) => ({
+                tickets: state.tickets.filter(t => (t.id ?? t.ticket_id) !== ticketId),
+                activeTicket: (state.activeTicket?.id ?? state.activeTicket?.ticket_id) === ticketId
+                    ? null
+                    : state.activeTicket
+            })),
+            updateTicket: (ticketId, updates) => set((state) => {
+// eslint-disable-next-line no-unused-vars
+                const existingTicket = state.tickets.find(t => (t.id ?? t.ticket_id) === ticketId);
+                const updatedTickets = state.tickets.map(t => ((t.id ?? t.ticket_id) === ticketId) ? { ...t, ...updates } : t);
+                const shouldUpdateActive = ((state.activeTicket?.id ?? state.activeTicket?.ticket_id) === ticketId);
 
                 return {
                     tickets: updatedTickets,
                     activeTicket: shouldUpdateActive ? { ...state.activeTicket, ...updates } : state.activeTicket
                 };
             }),
-
-            removeTicket: (ticketId) => set((state) => ({
-    tickets: state.tickets.filter(t => t.ticket_id !== ticketId),
-    activeTicket: state.activeTicket?.ticket_id === ticketId
-        ? null
-        : state.activeTicket
-})),
             appendMessage: (ticketId, message) => set((state) => {
                 const updatedTickets = state.tickets.map(t =>
                     t.ticket_id === ticketId

Frontend/src/user/components/RecentTickets.jsx

@@ -150,6 +150,11 @@ const RecentTickets = () => {
                                             <p style={{ fontSize: '14px', fontWeight: 500, color: '#111827', margin: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', maxWidth: '320px' }}>
                                                 {ticket.summary || ticket.subject || ticket.description || "No description provided"}
                                             </p>
+                                            {ticket?.metadata?.translation?.translated && (
+                                                <p style={{ fontSize: '11px', color: '#0369a1', margin: '4px 0 0' }}>
+                                                    Translated from {ticket.metadata.translation.source_language_name || ticket.metadata.translation.source_language || 'Unknown'}
+                                                </p>
+                                            )}
                                         </td>
                                         <td style={{ padding: '16px 28px' }}>
                                             {getStatusBadge(ticket.status)}

Frontend/src/user/pages/AutoResolveChat.jsx

@@ -19,6 +19,7 @@ const AutoResolveChat = () => {
     const { aiTicket } = useTicketStore();
     const navigate = useNavigate();
     const [messages, setMessages] = useState([]);
+    const [steps, setSteps] = useState([]);
     const [isThinking, setIsThinking] = useState(false);
     const [isFinal, setIsFinal] = useState(false);
     const [inputText, setInputText] = useState('');
@@ -77,7 +78,7 @@ const AutoResolveChat = () => {
                 }
 
                 if (newSteps.length >= 2) {
-                    // Steps parsed successfully; welcome message sent below
+                    setSteps(newSteps);
                 } else {
                     const sentences = response
                         .replace(/\*\*/g, '')
@@ -87,7 +88,12 @@ const AutoResolveChat = () => {
                         .slice(0, 4);
 
                     if (sentences.length >= 2) {
-                        // Plan parsed but not rendered; welcome message sent below
+                        const sentenceSteps = sentences.map((s, i) => ({
+                            id: i + 1,
+                            task: s,
+                            completed: false
+                        }));
+                        setSteps(sentenceSteps);
                     } else {
                         throw new Error("Could not parse steps from AI response.");
                     }
@@ -197,6 +203,12 @@ const AutoResolveChat = () => {
         else recognition.start();
     };
 
+    const toggleStep = (stepId) => {
+        setSteps(prev => prev.map(step =>
+            step.id === stepId ? { ...step, completed: !step.completed } : step
+        ));
+    };
+
     if (!aiTicket) return null;
 
     return (
@@ -249,6 +261,48 @@ const AutoResolveChat = () => {
                         </div>
                     </div>
 
+                    {/* Troubleshooting Steps */}
+                    {steps.length > 0 && (
+                        <div className="px-10 py-6 border-b border-white/40 bg-emerald-50/30">
+                            <div className="flex items-center gap-2 mb-3">
+                                <ListChecks size={16} className="text-emerald-600" />
+                                <h3 className="text-[10px] font-black text-emerald-700 uppercase tracking-[0.2em]">
+                                    Troubleshooting Plan
+                                </h3>
+                            </div>
+                            <div className="space-y-2">
+                                {steps.map((step) => (
+                                    <button
+                                        key={step.id}
+                                        onClick={() => toggleStep(step.id)}
+                                        className={`w-full text-left flex items-center gap-3 p-3 rounded-xl border transition-all duration-300 ${
+                                            step.completed
+                                                ? 'bg-emerald-100 border-emerald-200 opacity-60'
+                                                : 'bg-white border-slate-100 hover:border-emerald-200 hover:bg-emerald-50/50'
+                                        }`}
+                                    >
+                                        <div className={`w-6 h-6 rounded-full flex items-center justify-center shrink-0 transition-all duration-300 ${
+                                            step.completed
+                                                ? 'bg-emerald-500 text-white'
+                                                : 'bg-slate-100 text-slate-400'
+                                        }`}>
+                                            {step.completed ? (
+                                                <CheckCircle2 size={14} />
+                                            ) : (
+                                                <span className="text-[10px] font-black">{step.id}</span>
+                                            )}
+                                        </div>
+                                        <span className={`text-[13px] font-bold leading-snug transition-all duration-300 ${
+                                            step.completed ? 'text-slate-400 line-through' : 'text-slate-700'
+                                        }`}>
+                                            {step.task}
+                                        </span>
+                                    </button>
+                                ))}
+                            </div>
+                        </div>
+                    )}
+
                     {/* Chat Messages */}
                     <div
                         ref={scrollRef}

Frontend/src/user/pages/CreateTicket.jsx

@@ -21,7 +21,6 @@ import { motion, AnimatePresence } from 'framer-motion';
 import { Button } from "../../components/ui/button";
 import { Card, CardHeader, CardTitle, CardDescription, CardContent } from "../../components/ui/card";
 import { Textarea } from "../../components/ui/textarea";
-import Tesseract from 'tesseract.js';
 import { translateText, SUPPORTED_LANGUAGES } from '../../services/translationService';
 import TemplateSelector from '../components/TemplateSelector';
 import TemplateForm from '../components/TemplateForm';
@@ -111,6 +110,7 @@ const CreateTicket = () => {
     const processOCR = async (imageFile) => {
         setIsOcrLoading(true);
         try {
+            const { default: Tesseract } = await import('tesseract.js');
             const { data: { text } } = await Tesseract.recognize(imageFile, 'eng');
             setExtractedOCR(text.trim());
         } catch (err) {

Frontend/src/user/pages/MyTickets.jsx

@@ -120,6 +120,14 @@ function MyTickets() {
         return 'text-gray-600';
     };
 
+    const getTranslationInfo = (ticket) => {
+        const t = ticket?.metadata?.translation;
+        if (!t?.translated) return null;
+        return {
+            sourceLanguageName: t.source_language_name || t.source_language || 'Unknown',
+        };
+    };
+
     return (
         <main className="flex-1 max-w-[1200px] w-full mx-auto px-6 py-10 flex flex-col gap-8">
             {/* Header section */}
@@ -317,6 +325,11 @@ function MyTickets() {
                                                  <p className="text-sm font-semibold text-gray-900 truncate group-hover:text-emerald-700 transition-colors">
                                                      {ticket.summary || ticket.subject || ticket.description || "No subject"}
                                                  </p>
+                                                 {getTranslationInfo(ticket) && (
+                                                     <p className="text-[10px] text-slate-500 mt-1">
+                                                         Translated from {getTranslationInfo(ticket).sourceLanguageName}
+                                                     </p>
+                                                 )}
                                             </td>
                                             <td className="px-6 py-4">
                                                 <span className="text-sm font-medium text-gray-600 bg-gray-100 px-2.5 py-1 rounded-md">

Frontend/src/user/pages/TicketDetail.jsx

@@ -22,6 +22,7 @@ const TicketDetail = () => {
     const [isReopening, setIsReopening] = useState(false);
     const [showCsat, setShowCsat] = useState(false);
     const [csatHasBeenDismissed, setCsatHasBeenDismissed] = useState(false);
+    const [showOriginalText, setShowOriginalText] = useState(false);
 
     useEffect(() => {
         window.scrollTo(0, 0);
@@ -122,6 +123,10 @@ const TicketDetail = () => {
     const solutionSteps = Array.isArray(ticket.solution_steps) ? ticket.solution_steps : [];
     const isAutoResolved = ticket.auto_resolve === true;
     const confidenceScore = ticket.metadata?.confidence ?? ticket.routing_confidence ?? 0.92;
+    const translationMeta = ticket.metadata?.translation;
+    const originalTextMeta = ticket.metadata?.original_text;
+    const isTranslated = Boolean(translationMeta?.translated && originalTextMeta?.description);
+    const sourceLanguageName = translationMeta?.source_language_name || translationMeta?.source_language || 'Unknown';
 
 
     const handleReopen = async () => {
@@ -184,6 +189,27 @@ const TicketDetail = () => {
 
                 {/* LEFT SIDE (Main Content) */}
                 <div className="lg:col-span-2 flex flex-col gap-6">
+                    {isTranslated && (
+                        <Card className="p-4 rounded-2xl border border-sky-100 bg-sky-50/70 shadow-sm">
+                            <div className="flex items-center justify-between gap-3">
+                                <p className="text-sm font-semibold text-sky-900">
+                                    Translated from {sourceLanguageName}
+                                </p>
+                                <button
+                                    type="button"
+                                    onClick={() => setShowOriginalText(prev => !prev)}
+                                    className="text-xs font-bold text-sky-700 hover:text-sky-900"
+                                >
+                                    {showOriginalText ? "View English" : "View Original"}
+                                </button>
+                            </div>
+                            {showOriginalText && (
+                                <p className="mt-3 text-sm text-slate-700 bg-white border border-sky-100 rounded-lg px-3 py-2">
+                                    {originalTextMeta?.description}
+                                </p>
+                            )}
+                        </Card>
+                    )}
 
                     {/* Card 1: Ticket Timeline */}
                     <Card className="p-6 sm:p-8 rounded-2xl border border-gray-100 shadow-sm bg-white">

Frontend/vite.config.js

@@ -15,6 +15,6 @@ export default defineConfig({
     },
   },
   build: {
-    sourcemap: true
+    sourcemap: 'hidden'
   }
 })

MobileApp/.env.example

@@ -0,0 +1,2 @@
+EXPO_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
+EXPO_PUBLIC_SUPABASE_ANON_KEY=your-supabase-anon-key

MobileApp/src/lib/supabase.js

@@ -2,8 +2,14 @@ import 'react-native-url-polyfill/auto';
 import { createClient } from '@supabase/supabase-js';
 import AsyncStorage from '@react-native-async-storage/async-storage';
 
-const supabaseUrl = 'https://aejuenhqciagpntcqoir.supabase.co';
-const supabaseKey = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImFlanVlbmhxY2lhZ3BudGNxb2lyIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzIzODQwNzgsImV4cCI6MjA4Nzk2MDA3OH0.-OxgEW5t4alPGlzV_JZDRZcLsQbbMap6jiWjfAVkMMY';
+const supabaseUrl = process.env.EXPO_PUBLIC_SUPABASE_URL;
+const supabaseKey = process.env.EXPO_PUBLIC_SUPABASE_ANON_KEY;
+
+if (!supabaseUrl || !supabaseKey) {
+  throw new Error(
+    'Missing Supabase mobile config. Set EXPO_PUBLIC_SUPABASE_URL and EXPO_PUBLIC_SUPABASE_ANON_KEY in MobileApp/.env or EAS secrets.'
+  );
+}
 
 export const supabase = createClient(supabaseUrl, supabaseKey, {
   auth: {

MobileApp/src/screens/auth/LoginScreen.js

@@ -5,6 +5,7 @@ import {
   ScrollView, StatusBar, Animated,
 } from 'react-native';
 import { supabase } from '../../lib/supabase';
+import { backendLogin, backendLogout } from '../../lib/authBackend';
 import { COLORS, SHADOWS } from '../../styles/theme';
 import { Lock, Mail, Eye, EyeOff, Zap, ArrowRight, ShieldCheck } from 'lucide-react-native';
 import { LinearGradient } from 'expo-linear-gradient';
@@ -52,6 +53,7 @@ const LoginScreen = () => {
     }
     setLoading(true);
     try {
+      await backendLogin(email, password);
       const { data, error } = await supabase.auth.signInWithPassword({ email, password });
       if (error) throw error;
 

MobileApp/src/screens/user/ProfileScreen.js

@@ -5,6 +5,7 @@ import {
 } from 'react-native';
 import { SafeAreaView } from 'react-native-safe-area-context';
 import { supabase } from '../../lib/supabase';
+import { backendLogout } from '../../lib/authBackend';
 import { COLORS, SHADOWS } from '../../styles/theme';
 import {
   User, Mail, Building2, ShieldCheck, Calendar, Ticket, Zap,
@@ -226,6 +227,7 @@ const ProfileScreen = () => {
   const handleLogout = async () => {
     try {
       Haptics.impactAsync(Haptics.ImpactFeedbackStyle.Medium);
+      await backendLogout();
       // Forcefully wipe all Supabase session keys from AsyncStorage first to trigger instant navigation resetting
       const keys = await AsyncStorage.getAllKeys();
       const supabaseKeys = keys.filter(k => k.startsWith('sb-') || k.includes('supabase'));
@@ -236,6 +238,7 @@ const ProfileScreen = () => {
     } catch (e) {
       console.warn("Logout error, forcing full wipe:", e);
       await AsyncStorage.clear();
+      await supabase.auth.signOut();
     }
   };
 

README.md

@@ -58,7 +58,9 @@ pinned: false
 
 ## 🌟 GSSoC '26 Contributor & Community Campaign
 
-We are extremely proud to be part of the **GirlScript Summer of Code (GSSoC) 2026**! To support the project and get real-time open-source project updates, please make sure you participate in our community campaign:
+We are extremely proud to be part of the **GirlScript Summer of Code (GSSoC) 2026**! To ensure high-quality contributions and maximum rewards for both developers and mentors, please review our official [GSSoC Mentorship Guide & Review Standard](MENTORSHIP.md).
+
+To support the project and get real-time open-source project updates, please make sure you participate in our community campaign:
 
 <div align="center">
 

backend/.env.example

@@ -1,18 +1,106 @@
-# Supabase Configuration
-SUPABASE_URL=https://your-project.supabase.co
-SUPABASE_SERVICE_KEY=your-service-key
+# =============================================================================
+# HELPDESK.AI Backend — Environment Variable Reference
+# =============================================================================
+# Copy this file to `backend/.env` and fill in the values appropriate for your
+# environment. NEVER commit a populated `.env` file to source control.
+#
+# All variables are read via `os.environ.get(...)` / `os.getenv(...)` in the
+# backend codebase. Defaults shown below match the values used in code.
+# =============================================================================
+
+
+# -----------------------------------------------------------------------------
+# Supabase (Database + Auth + Storage)
+# -----------------------------------------------------------------------------
+# Required for: ticket persistence, RAG knowledge base, SLA escalation,
+# auto-close cron job, notification routing, company settings seeding.
+#
+# Service-role key is required for backend (bypasses RLS). NEVER expose this
+# key to the frontend — use the anon key on the client side instead.
+SUPABASE_URL=https://YOUR-PROJECT-REF.supabase.co
+SUPABASE_SERVICE_KEY=
+# Anon key — required for /auth/login cookie bridge (issue #130). Safe for backend proxy only.
+SUPABASE_ANON_KEY=
+# Some newer services (auto_close, notification_routing, sla_service)
+# also accept SUPABASE_SERVICE_ROLE_KEY as an alias. Set both for safety.
+SUPABASE_SERVICE_ROLE_KEY=
+
+
+# -----------------------------------------------------------------------------
+# Google Gemini (LLM)
+# -----------------------------------------------------------------------------
+# Required for: auto-resolve chat, summary generation, advanced classification.
+# If unset, GeminiService will initialize in disabled mode and downstream
+# endpoints that depend on it will return graceful fallback responses.
+GEMINI_API_KEY=
 
-# Startup Mode
-# Set ALLOW_DEGRADED_STARTUP=1 to allow backend startup even if duplicate/RAG models fail to load
-# Useful for offline/dev environments where model downloads may not be available
-ALLOW_DEGRADED_STARTUP=0
 
-# Sentence Transformers Model Path
-# Provide a local path to the sentence-transformers model to avoid downloading from HuggingFace
-# If not set, model will be downloaded from HuggingFace (requires internet)
-# Example: ./models/all-MiniLM-L6-v2 or /opt/models/all-MiniLM-L6-v2
+# -----------------------------------------------------------------------------
+# AI Model Artifacts
+# -----------------------------------------------------------------------------
+# Path to a local sentence-transformer model directory used by RAG and
+# duplicate detection. If unset, the services will attempt to download the
+# default model on first run (requires internet access).
 SENTENCE_TRANSFORMER_MODEL_PATH=
 
-# Readiness Check
-# Set REQUIRE_SUPABASE=true to include Supabase configuration in the strict readiness gate
+
+# -----------------------------------------------------------------------------
+# Startup / Health-Check Behaviour
+# -----------------------------------------------------------------------------
+# Controls strict startup validation. When `0` (default), the backend will
+# REFUSE to start if core classifier assets are missing — this prevents the
+# silent "Unknown" classification fallback documented in ISSUE_DEBUG_FINDINGS.
+# Set to `1` only for local development without the full model bundle.
+ALLOW_DEGRADED_STARTUP=0
+
+# When `true`, startup will hard-fail if Supabase credentials are missing.
+# Default `false` allows the backend to run in "no-persistence" mode for tests.
 REQUIRE_SUPABASE=false
+
+# Slack Alerts
+SLACK_WEBHOOK_URL=https://hooks.slack.com/services/xxx/yyy/zzz
+
+# -----------------------------------------------------------------------------
+# Health-Check Probe (Docker / Kubernetes)
+# -----------------------------------------------------------------------------
+HEALTHCHECK_URL=http://127.0.0.1:7860/ready
+HEALTHCHECK_TIMEOUT_SECONDS=3
+
+
+# -----------------------------------------------------------------------------
+# SLA Escalation Background Worker
+# -----------------------------------------------------------------------------
+SLA_ESCALATION_ENABLED=true
+SLA_ESCALATION_INTERVAL_SECONDS=300
+
+
+# -----------------------------------------------------------------------------
+# Auto-Close Cron Job (Issue #41)
+# -----------------------------------------------------------------------------
+AUTO_CLOSE_ENABLED=true
+AUTO_CLOSE_DAYS=7
+# Standard 5-field cron expression. Default: 02:00 UTC every day.
+AUTO_CLOSE_CRON_SCHEDULE=0 2 * * *
+
+
+# -----------------------------------------------------------------------------
+# Notification Routing Middleware (Issue #41)
+# -----------------------------------------------------------------------------
+# Accepted values: debug, info, warning
+NOTIFICATION_ROUTING_LOG_LEVEL=info
+
+
+# -----------------------------------------------------------------------------
+# Generic Environment Flag
+# -----------------------------------------------------------------------------
+# Set to `development` to enable extra debug logging in some services.
+ENV=production
+
+
+# -----------------------------------------------------------------------------
+# Redis Inference Cache (Issue #131)
+# -----------------------------------------------------------------------------
+# When true, cache DistilBERT classifications and sentence-transformer embeddings.
+USE_REDIS_CACHE=false
+REDIS_URL=redis://127.0.0.1:6379/0
+REDIS_CACHE_TTL_SECONDS=3600

backend/Dockerfile

@@ -1,36 +1,40 @@
-# Use an official Python runtime as a parent image
-FROM python:3.10-slim
+# syntax=docker/dockerfile:1
 
-LABEL version="1.1.1" rebuild_trigger="2026-03-08-2032"
+FROM python:3.10-slim AS builder
 
-# Set the working directory to /app
-WORKDIR /app
-
-# Install system dependencies required for EasyOCR and OpenCV
-RUN apt-get update && apt-get install -y \
-    libgl1 \
-    libglib2.0-0 \
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy the requirements file into the container
 COPY requirements.txt .
+RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
+
+FROM python:3.10-slim AS runtime
 
-# Install dependencies (no-cache-dir keeps the docker image smaller)
-RUN pip install --no-cache-dir -r requirements.txt
+LABEL org.opencontainers.image.title="helpdesk-backend"
+LABEL org.opencontainers.image.description="HELPDESK.AI FastAPI backend (multi-stage)"
 
-# Copy all the remaining files into the container as a 'backend' directory
-# This allows absolute imports like 'from backend.services...' to work perfectly
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libgl1 \
+    libglib2.0-0 \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --shell /usr/sbin/nologin appuser
+
+COPY --from=builder /install /usr/local
 COPY . /app/backend
 
-# Tell Python where to look for modules (so it can find the 'backend' folder)
-ENV PYTHONPATH=/app
+ENV PYTHONPATH=/app \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
 
-# Expose port 7860 (Hugging Face Spaces default)
 EXPOSE 7860
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 \
     CMD ["python", "backend/healthcheck.py"]
 
-# Run the FastAPI server via Uvicorn
+USER appuser
+
 CMD ["uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "7860"]

backend/auth/crypto.py

@@ -1,98 +1,218 @@
 import os
-import hashlib
 import base64
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-
-# Initialize AESGCM with 32-byte key derived from secret key
-SECRET_KEY = os.environ.get("DB_ENCRYPTION_SECRET_KEY")
-
-_cipher = None
-if SECRET_KEY:
-    # Hash secret key to ensure it is exactly 32 bytes (256 bits)
-    key_bytes = hashlib.sha256(SECRET_KEY.encode()).digest()
-    _cipher = AESGCM(key_bytes)
-else:
-    print("[WARNING] DB_ENCRYPTION_SECRET_KEY not set. Data encryption is disabled (degraded mode).")
-
-def encrypt(plain_text: str) -> str:
-    """Encrypt plain text using AES-256 GCM and return base64 encoded string."""
-    if not _cipher or not plain_text:
-        return plain_text
+import logging
+import hashlib
+from typing import Any
+
+# Configure logger
+logger = logging.getLogger(__name__)
+logger.setLevel(logging.WARNING)
+
+if not logger.handlers:
+    handler = logging.StreamHandler()
+    formatter = logging.Formatter("[Crypto] %(asctime)s - %(levelname)s - %(message)s")
+    handler.setFormatter(formatter)
+    logger.addHandler(handler)
+
+CRYPTOGRAPHY_AVAILABLE = False
+_aesgcm = None
+ENCRYPTION_ENABLED = False
+
+try:
+    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+    CRYPTOGRAPHY_AVAILABLE = True
+except ImportError:
+    logger.warning("The 'cryptography' library is not available. Running with database encryption disabled.")
+
+# Key Parsing logic: supporting urlsafe-b64, hex, and SHA-256 stretching
+def derive_cryptographic_key(raw_key: str | None) -> bytes | None:
+    if not raw_key:
+        return None
+    
+    # 1. Try URL-safe Base64 decode
     try:
-        # Generate 12-byte random nonce for GCM
-        nonce = os.urandom(12)
-        encrypted_bytes = _cipher.encrypt(nonce, plain_text.encode(), None)
-        # Combine nonce and ciphertext and encode as base64
-        combined = nonce + encrypted_bytes
-        return base64.b64encode(combined).decode('utf-8')
-    except Exception as e:
-        print(f"[Crypto Error] Encryption failed: {e}")
-        return plain_text
+        # Pad string appropriately if needed
+        padded = raw_key + "=" * ((4 - len(raw_key) % 4) % 4)
+        decoded = base64.urlsafe_b64decode(padded.encode('utf-8'))
+        if len(decoded) == 32:
+            return decoded
+    except Exception:
+        pass
 
-def decrypt(cipher_text: str) -> str:
-    """Decrypt base64 encoded ciphertext using AES-256 GCM and return plain text."""
-    if not _cipher or not cipher_text:
-        return cipher_text
+    # 2. Try hex decode
     try:
-        # Check if cipher_text looks like base64
+        decoded = bytes.fromhex(raw_key)
+        if len(decoded) == 32:
+            return decoded
+    except Exception:
+        pass
+
+    # 3. Fall back to SHA-256 stretch
+    return hashlib.sha256(raw_key.encode('utf-8')).digest()
+
+
+# Initialize Key and AESGCM instance
+if CRYPTOGRAPHY_AVAILABLE:
+    SECRET_KEY_ENV_VAR = "DB_ENCRYPTION_SECRET_KEY"
+    raw_secret_key = os.environ.get(SECRET_KEY_ENV_VAR)
+    
+    if raw_secret_key:
         try:
-            combined = base64.b64decode(cipher_text.encode('utf-8'))
-        except Exception:
-            return cipher_text  # Return as-is if not valid base64
-            
-        if len(combined) < 12:
-            return cipher_text  # Not enough bytes for nonce
-            
-        nonce = combined[:12]
-        ciphertext = combined[12:]
-        decrypted_bytes = _cipher.decrypt(nonce, ciphertext, None)
-        return decrypted_bytes.decode('utf-8')
-    except Exception as e:
-        # If decryption fails, it might be unencrypted plaintext (graceful degrade for old records)
-        return cipher_text
+            key_bytes = derive_cryptographic_key(raw_secret_key)
+            if key_bytes:
+                _aesgcm = AESGCM(key_bytes)
+                ENCRYPTION_ENABLED = True
+                logger.info("Database encryption key loaded and active.")
+            else:
+                logger.warning("Could not derive key from DB_ENCRYPTION_SECRET_KEY. Database encryption disabled.")
+        except Exception as e:
+            logger.warning(f"Failed to initialize AESGCM: {e}. Database encryption disabled.")
+    else:
+        logger.warning("DB_ENCRYPTION_SECRET_KEY is not set in environment. Running with database encryption disabled.")
+
+# Tag prefix for identifying encrypted data
+PREFIX = "enc:v1:"
 
-def apply_db_encryption_patch():
-    """Apply transparent monkeypatch to Postgrest/Supabase client execute method for 'tickets' table."""
+def encrypt_value(value: str) -> str:
+    """Encrypt a string value using AES-256-GCM. Returns 'enc:v1:<base64>'."""
+    if not ENCRYPTION_ENABLED or _aesgcm is None:
+        return value
+    if not isinstance(value, str):
+        return value
+    # Double-encryption protection: if already encrypted, return as-is
+    if value.startswith(PREFIX):
+        return value
+        
     try:
-        from postgrest._sync.request_builder import SyncQueryRequestBuilder
+        # Generate 12-byte secure random nonce
+        nonce = os.urandom(12)
+        plaintext_bytes = value.encode('utf-8')
+        # Encrypt (combines ciphertext and tag automatically in cryptography's AESGCM)
+        ciphertext = _aesgcm.encrypt(nonce, plaintext_bytes, None)
+        # Store nonce + ciphertext together
+        payload = nonce + ciphertext
+        encoded = base64.b64encode(payload).decode('utf-8')
+        return f"{PREFIX}{encoded}"
+    except Exception as e:
+        logger.error(f"Encryption failed: {e}")
+        return value
+
+def decrypt_value(value: str) -> str:
+    """Decrypt a string value that starts with 'enc:v1:'."""
+    if not ENCRYPTION_ENABLED or _aesgcm is None:
+        return value
+    if not isinstance(value, str):
+        return value
+    # Graceful pass-through for legacy/plaintext rows
+    if not value.startswith(PREFIX):
+        return value
         
-        _original_execute = SyncQueryRequestBuilder.execute
-
-        def custom_execute(self):
-            path_str = getattr(self.request.path, "path", "")
-            table_name = path_str.split('/')[-1]
-            
-            if table_name == "tickets":
-                payload = self.request.json
-                if isinstance(payload, dict):
-                    for field in ["contact_email", "description", "raw_text"]:
-                        if field in payload and payload[field] is not None:
-                            payload[field] = encrypt(str(payload[field]))
-                elif isinstance(payload, list):
-                    for item in payload:
-                        if isinstance(item, dict):
-                            for field in ["contact_email", "description", "raw_text"]:
-                                if field in item and item[field] is not None:
-                                    item[field] = encrypt(str(item[field]))
-                                    
-            res = _original_execute(self)
-            
-            if table_name == "tickets" and res and hasattr(res, "data"):
-                data = res.data
-                if isinstance(data, dict):
-                    for field in ["contact_email", "description", "raw_text"]:
-                        if field in data and data[field] is not None:
-                            data[field] = decrypt(str(data[field]))
-                elif isinstance(data, list):
-                    for item in data:
-                        if isinstance(item, dict):
-                            for field in ["contact_email", "description", "raw_text"]:
-                                if field in item and item[field] is not None:
-                                    item[field] = decrypt(str(item[field]))
-                                    
-            return res
-
-        SyncQueryRequestBuilder.execute = custom_execute
-        print("[Crypto] Supabase database encryption patch applied successfully.")
+    try:
+        encoded_str = value[len(PREFIX):]
+        payload = base64.b64decode(encoded_str)
+        if len(payload) < 12:
+            return value
+        nonce = payload[:12]
+        ciphertext = payload[12:]
+        decrypted_bytes = _aesgcm.decrypt(nonce, ciphertext, None)
+        return decrypted_bytes.decode('utf-8')
     except Exception as e:
-        print(f"[Crypto WARNING] Failed to apply database encryption patch: {e}")
+        logger.error(f"Decryption failed: {e}")
+        return value
+
+# ORM Payload Processing Helpers
+TARGET_FIELDS = {"contact_email", "description", "raw_text"}
+
+def encrypt_row(row: dict) -> dict:
+    if not isinstance(row, dict):
+        return row
+    new_row = dict(row)
+    for field in TARGET_FIELDS:
+        if field in new_row and new_row[field] is not None:
+            new_row[field] = encrypt_value(str(new_row[field]))
+    return new_row
+
+def decrypt_row(row: dict) -> dict:
+    if not isinstance(row, dict):
+        return row
+    new_row = dict(row)
+    for field in TARGET_FIELDS:
+        if field in new_row and new_row[field] is not None:
+            new_row[field] = decrypt_value(str(new_row[field]))
+    return new_row
+
+def encrypt_payload(payload: Any) -> Any:
+    if isinstance(payload, list):
+        return [encrypt_row(row) for row in payload]
+    elif isinstance(payload, dict):
+        return encrypt_row(payload)
+    return payload
+
+def decrypt_payload(payload: Any) -> Any:
+    if isinstance(payload, list):
+        return [decrypt_row(row) for row in payload]
+    elif isinstance(payload, dict):
+        return decrypt_row(payload)
+    return payload
+
+# Transparent client query wrapper proxy
+class WrappedRequestBuilder:
+    def __init__(self, builder: Any, table_name: str):
+        object.__setattr__(self, "_builder", builder)
+        object.__setattr__(self, "_table_name", table_name)
+
+    def insert(self, json: Any, *args, **kwargs) -> "WrappedRequestBuilder":
+        if self._table_name == "tickets":
+            json = encrypt_payload(json)
+        res = self._builder.insert(json, *args, **kwargs)
+        return WrappedRequestBuilder(res, self._table_name)
+
+    def update(self, json: Any, *args, **kwargs) -> "WrappedRequestBuilder":
+        if self._table_name == "tickets":
+            json = encrypt_payload(json)
+        res = self._builder.update(json, *args, **kwargs)
+        return WrappedRequestBuilder(res, self._table_name)
+
+    def execute(self, *args, **kwargs) -> Any:
+        res = self._builder.execute(*args, **kwargs)
+        if self._table_name == "tickets" and res and hasattr(res, "data"):
+            res.data = decrypt_payload(res.data)
+        return res
+
+    def __getattr__(self, name: str) -> Any:
+        attr = getattr(self._builder, name)
+        if callable(attr):
+            def wrapper(*args, **kwargs):
+                res = attr(*args, **kwargs)
+                if res is self._builder:
+                    return self
+                if hasattr(res, "execute") or hasattr(res, "table") or hasattr(res, "insert"):
+                    return WrappedRequestBuilder(res, self._table_name)
+                return res
+            return wrapper
+        return attr
+
+    def __setattr__(self, name: str, value: Any) -> None:
+        setattr(self._builder, name, value)
+
+
+def wrap_client(client: Any) -> Any:
+    """Wraps a Supabase client's table method for transparent tickets encryption."""
+    if client is None:
+        return None
+
+    # Avoid double wrapping
+    if hasattr(client, "_wrapped_by_crypto"):
+        return client
+
+    original_table = client.table
+
+    def wrapped_table(table_name: str, *args, **kwargs) -> Any:
+        builder = original_table(table_name, *args, **kwargs)
+        if table_name == "tickets":
+            return WrappedRequestBuilder(builder, table_name)
+        return builder
+
+    client.table = wrapped_table
+    client._wrapped_by_crypto = True
+    return client

backend/main.py

@@ -8,6 +8,7 @@ import os
 import sys
 import uuid
 import json
+import re
 import datetime
 import traceback
 import warnings
@@ -19,9 +20,8 @@ from contextlib import asynccontextmanager
 warnings.filterwarnings("ignore", message="'pin_memory'")
 
 # HF Rebuild Trigger: 2026-03-08-2030
-from fastapi import FastAPI, Depends, Header, HTTPException, Request, Response
+from fastapi import FastAPI, Depends, HTTPException, Request
 from slowapi import Limiter, _rate_limit_exceeded_handler
-from prometheus_client import generate_latest, CONTENT_TYPE_LATEST
 from slowapi.util import get_remote_address
 from slowapi.errors import RateLimitExceeded
 from fastapi.middleware.cors import CORSMiddleware
@@ -36,13 +36,12 @@ from dotenv import load_dotenv
 env_path = Path(__file__).parent / '.env'
 load_dotenv(dotenv_path=env_path)
 
-# Apply database encryption for PII fields
-try:
-    from backend.auth.crypto import apply_db_encryption_patch
-    apply_db_encryption_patch()
-except Exception as e:
-    print(f"[WARNING] Database encryption patch initialization failed: {e}")
+# CI smoke tests allow degraded startup so the app can import without heavy ML assets.
+ALLOW_DEGRADED_STARTUP = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
+
 
+def _startup_fatal(message: str) -> None:
+    print(f"[Startup-FATAL] {message}")
 
 # Initialize Supabase Client (Service Role for backend bypass)
 try:
@@ -53,7 +52,8 @@ try:
         print("[ERROR] SUPABASE_URL or SUPABASE_SERVICE_KEY not set in backend/.env")
         supabase = None
     else:
-        supabase = create_client(url, key)
+        from backend.auth.crypto import wrap_client
+        supabase = wrap_client(create_client(url, key))
 except (ImportError, Exception) as e:
     print(f"[WARNING] Supabase initialization failed: {e}")
     supabase = None
@@ -65,16 +65,14 @@ sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..")
 from backend.services.classifier_service import ClassifierService
 from backend.services.classifier_v2 import classifier_v2
 from backend.services.classifier_v3 import classifier_v3 # V3 Power Model
+from backend.services.audit_service import AuditLogService, AuditLogAccessError
+from backend.services.onnx_service import onnx_classifier
 from backend.services.ner_service import NERService
 from backend.services.duplicate_service import DuplicateService
 from backend.services.rag_service import RagService
-from backend.services.sla_service import (
-    calculate_sla_breach_at,
-    calculate_sla_response_at,
-    classify_sla_status,
-    load as load_sla_service,
-    run_sla_escalation_loop,
-)
+from backend.services.sla_engine import SLAEngine, compute_sla_breach_at, get_sla_policy
+from backend.services.redis_cache import redis_cache
+from backend.auth_cookie import router as auth_cookie_router, get_current_user  # noqa: F401
 
 
 # ---------------------------------------------------------------------------
@@ -123,13 +121,62 @@ def detect_semantic_duplicate(text: str, *, company_id: str | None, threshold: f
         duplicate_result["parent_ticket_id"] = duplicate_result.get("duplicate_ticket_id")
         duplicate_result["is_potential_duplicate"] = duplicate_result.get("is_duplicate", False)
         return duplicate_result
+
+
+def classify_ticket_text(text: str) -> dict:
+    """Run the local classifier cascade with ONNX as the offline fallback path."""
+    cached = redis_cache.get_classification(text)
+    if cached:
+        return cached
+
+    result = _classify_ticket_text_uncached(text)
+    redis_cache.set_classification(text, result)
+    return result
+
+
+def _classify_ticket_text_uncached(text: str) -> dict:
+    try:
+        classification_v3_res = classifier_v3.predict(text)
+        if "error" not in classification_v3_res:
+            cat = classification_v3_res.get("Category", {}).get("prediction", "Unknown")
+            sub = classification_v3_res.get("Subcategory", {}).get("prediction", "Unknown")
+            pri = classification_v3_res.get("priority", {}).get("prediction", "Medium")
+            conf = classification_v3_res.get("Category", {}).get("confidence", 0.0)
+
+            from backend.services.classifier_service import TEAM_MAP, AUTO_RESOLVE_SUBS
+            return {
+                "category": cat,
+                "subcategory": sub,
+                "priority": pri,
+                "auto_resolve": sub in AUTO_RESOLVE_SUBS,
+                "assigned_team": TEAM_MAP.get(cat, "General Support"),
+                "confidence": float(conf),
+            }
+    except Exception:
+        traceback.print_exc()
+
+    try:
+        onnx_result = onnx_classifier.predict(text)
+        if onnx_result:
+            return onnx_result
+    except Exception as error:
+        print(f"[ONNX] Fallback classification skipped: {error}")
+
+    try:
+        return classifier_service.predict(text)
+    except Exception:
+        traceback.print_exc()
+        return {
+            "category": "Unknown", "subcategory": "Unknown", "priority": "Medium",
+            "auto_resolve": False, "assigned_team": "General Support", "confidence": 0.0,
+        }
+
 class TicketRequest(BaseModel):
     text: str
     image_base64: str = ""
     image_text: str = "" # Keep for backward compatibility
     user_id: str | None = None
     company: str | None = None
-    company_id: str | None = None
     image_url: str | None = None
     confidence_threshold: float = 0.20
     duplicate_sensitivity: float = 0.85
@@ -149,10 +196,6 @@ class TicketSaveRequest(BaseModel):
     image_url: str | None = None
     company: str | None = None
     company_id: str | None = None
-    description_vector: list[float] | None = None
-    is_potential_duplicate: bool = False
-    parent_ticket_id: str | None = None
-    sla_response_due_at: str | None = None
     sla_breach_at: str
     sla_status: str | None = None
     escalation_level: int = 0
@@ -168,8 +211,6 @@ class TicketSaveRequest(BaseModel):
 class DuplicateInfo(BaseModel):
     is_duplicate: bool
     duplicate_ticket_id: str | None = None
-    parent_ticket_id: str | None = None
-    is_potential_duplicate: bool = False
     similarity: float = 0.0
 
 
@@ -191,8 +232,6 @@ class TicketResponse(BaseModel):
     entities: list[EntityInfo]
     duplicate_ticket: DuplicateInfo
     confidence: float
-    is_potential_duplicate: bool = False
-    parent_ticket_id: str | None = None
     needs_review: bool = False
     reasoning: str = ""
     decision_factors: list[str] = []
@@ -202,6 +241,10 @@ class TicketResponse(BaseModel):
     timeline: dict = {} # Map of step_name: timestamp
     env_metadata: dict = {} # IP, Hostname, Browser/OS
     sla_breach_at: str | None = None
+    original_text: str | None = None
+    source_language: str = "en"
+    source_language_name: str = "English"
+    was_translated: bool = False
     version: str = "2.1.0-Neural-Diagnostic"
 
 
@@ -229,6 +272,24 @@ class TicketRecord(BaseModel):
     timeline: dict = {} # Milestones: created, analyzed, triaged, routed, in_progress, resolved
 
 
+class AuditLogProfile(BaseModel):
+    full_name: str | None = None
+    email: str | None = None
+    profile_picture: str | None = None
+
+
+class AuditLogRecord(BaseModel):
+    id: str
+    ticket_id: str
+    company_id: str
+    performed_by: str | None = None
+    action: str
+    old_value: dict | list | str | None = None
+    new_value: dict | list | str | None = None
+    created_at: str
+    performed_by_profile: AuditLogProfile | None = None
+
+
 # --- In-Memory Database (to be replaced with SQL later) ---
 TICKETS_DB: list[TicketRecord] = []
 
@@ -247,10 +308,14 @@ class ReadinessResponse(BaseModel):
 # ---------------------------------------------------------------------------
 # Service singletons
 # ---------------------------------------------------------------------------
+from backend.services.semantic_duplicate_service import SemanticDuplicateService
+
 classifier_service = ClassifierService()
 ner_service = NERService()
 duplicate_service = DuplicateService()
 rag_service = RagService()
+sla_engine = SLAEngine(supabase_client=None)  # Will be reassigned after supabase init
+semantic_dupe_service = SemanticDuplicateService(supabase_client=None)  # wired in lifespan
 
 try:
     from backend.services.gemini_service import GeminiService
@@ -264,6 +329,82 @@ try:
 except ImportError:
     ocr_service = None
 
+LANGUAGE_NAMES = {
+    "en": "English",
+    "es": "Spanish",
+    "de": "German",
+    "hi": "Hindi",
+    "fr": "French",
+    "it": "Italian",
+    "pt": "Portuguese",
+    "ja": "Japanese",
+    "ko": "Korean",
+    "zh": "Chinese",
+    "ar": "Arabic",
+    "ru": "Russian",
+}
+
+def _heuristic_language_detection(text: str) -> dict:
+    sample = (text or "").strip()
+    if not sample:
+        return {"code": "en", "name": "English"}
+    ascii_chars = sum(1 for c in sample if ord(c) < 128)
+    ratio = ascii_chars / max(len(sample), 1)
+    if ratio > 0.97:
+        return {"code": "en", "name": "English"}
+    return {"code": "unknown", "name": "Unknown"}
+
+def detect_and_translate_ticket_text(text: str) -> dict:
+    original_text = (text or "").strip()
+    if not original_text:
+        return {
+            "text_for_analysis": text or "",
+            "source_language": "en",
+            "source_language_name": "English",
+            "was_translated": False,
+            "original_text": "",
+            "metadata":{},
+        }
+
+    detected = _heuristic_language_detection(original_text)
+    if gemini_service and getattr(gemini_service, "_initialized", False):
+        detected = gemini_service.detect_language(original_text)
+
+    source_code = str(detected.get("code", "en")).lower()
+    source_name = detected.get("name") or LANGUAGE_NAMES.get(source_code, source_code.upper())
+    if source_code in ("en", "eng"):
+        return {
+            "text_for_analysis": original_text,
+            "source_language": "en",
+            "source_language_name": "English",
+            "was_translated": False,
+            "original_text": original_text,
+            "metadata":{},
+        }
+
+    translated_text = original_text
+    if gemini_service and getattr(gemini_service, "_initialized", False):
+        translated_text = gemini_service.translate_to_english(original_text, source_name)
+
+    if not translated_text or translated_text.strip() == original_text:
+        return {
+            "text_for_analysis": original_text,
+            "source_language": source_code,
+            "source_language_name": source_name,
+            "was_translated": False,
+            "original_text": original_text,
+            "metadata":{},
+        }
+
+    return {
+        "text_for_analysis": translated_text.strip(),
+        "source_language": source_code,
+        "source_language_name": source_name,
+        "was_translated": True,
+        "original_text": original_text,
+        "metadata":{},
+    }
+
 
 # ---------------------------------------------------------------------------
 # Lifespan (startup / shutdown)
@@ -273,12 +414,16 @@ async def lifespan(app: FastAPI):
     """Load all models at startup."""
     print("[Startup] Loading AI models ...")
     try:
-        classifier_service.load()
+        redis_cache.connect()
     except Exception as e:
+        print(f"[WARNING] Redis cache not available: {e}")
+    try:
+        classifier_service.load()
+    except FileNotFoundError as e:
         print(f"[WARNING] Classifier not loaded: {e}")
     try:
         ner_service.load()
-    except Exception as e:
+    except FileNotFoundError as e:
         print(f"[WARNING] NER not loaded: {e}")
     try:
         duplicate_service.load()
@@ -288,50 +433,39 @@ async def lifespan(app: FastAPI):
         rag_service.load()
     except Exception as e:
         print(f"[WARNING] RAG service not loaded: {e}")
+    try:
+        onnx_classifier.load()
+    except Exception as e:
+        print(f"[WARNING] ONNX classifier fallback not loaded: {e}")
     
     if gemini_service:
         print(f"[Startup] Gemini Service: {'Initialized' if gemini_service._initialized else 'FAILED (Key missing or SDK error)'}")
     else:
         print("[Startup] Gemini Service: NOT LOADED (Import failed)")
 
-    print("[Startup] Classifier V2 Shadow: Ready.")
-    print("[Startup] Ready.")
-    # Strict health checks: fail loudly when core model assets are unavailable.
-    # Set ALLOW_DEGRADED_STARTUP=1 to permit degraded startup for local/dev convenience.
-    try:
-        strict_mode = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") != "1"
-    except Exception:
-        strict_mode = True
+    # Wire services with supabase client
+    sla_engine.supabase = supabase
+    semantic_dupe_service.supabase = supabase
 
-    classifier_loaded_flag = getattr(classifier_service, "_loaded", False)
-    ner_loaded_flag = getattr(ner_service, "_loaded", False)
+    # Pre-load embedding model so first ticket save is fast
+    try:
+        semantic_dupe_service.load()
+        print(f"[Startup] Semantic Duplicate Detection: {'Loaded' if semantic_dupe_service._loaded else 'Failed (model missing)'}")
+    except Exception as e:
+        print(f"[Startup] Semantic Duplicate Detection load error: {e}")
+    print(f"[Startup] SLA Engine: {'Initialized' if supabase else 'Offline (no DB)'}")
 
-    if strict_mode and not classifier_loaded_flag:
-        raise RuntimeError("[Startup-FATAL] Classifier assets not loaded. Set ALLOW_DEGRADED_STARTUP=1 to bypass.")
+    # Start background SLA checker as an async task (every 5 minutes)
+    if supabase:
+        from backend.sla_checker import sla_checker_loop_async
+        asyncio.create_task(sla_checker_loop_async(supabase, interval_seconds=300))
+        print("[Startup] SLA background checker started (interval=300s)")
 
-    sla_task = None
-    try:
-        if supabase and os.environ.get("SLA_ESCALATION_ENABLED", "true").lower() == "true":
-            notification_router = None
-            try:
-                from backend.services.notification_routing import load as load_notification_router
-                notification_router = load_notification_router()
-            except Exception as e:
-                print(f"[WARNING] Notification router not loaded for SLA service: {e}")
-            sla_service = load_sla_service(supabase, notification_router)
-            interval = int(os.environ.get("SLA_ESCALATION_INTERVAL_SECONDS", "300"))
-            sla_task = asyncio.create_task(run_sla_escalation_loop(sla_service, interval_seconds=interval))
-            print(f"[Startup] SLA escalation loop enabled ({interval}s interval).")
-
-        yield
-    finally:
-        if sla_task:
-            sla_task.cancel()
-            try:
-                await sla_task
-            except asyncio.CancelledError:
-                pass
-        print("[Shutdown] Cleaning up ...")
+    print("[Startup] Classifier V2 Shadow: Ready.")
+    print(f"[Startup] ONNX MiniLM Fallback: {'READY' if getattr(onnx_classifier, '_loaded', False) else 'DEGRADED (artifacts missing)'}")
+    print("[Startup] Ready.")
+    yield
+    print("[Shutdown] Cleaning up ...")
 
 
 # ---------------------------------------------------------------------------
@@ -362,6 +496,8 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+app.include_router(auth_cookie_router)
+
 
 # ---------------------------------------------------------------------------
 # Root & Health check
@@ -448,17 +584,6 @@ async def root():
     """
 
 
-async def verify_metrics_token(x_metrics_token: str | None = Header(default=None)):
-    expected_token = os.environ.get("METRICS_TOKEN")
-    if expected_token and x_metrics_token != expected_token:
-        raise HTTPException(status_code=403, detail="Forbidden")
-
-
-@app.get("/metrics", dependencies=[Depends(verify_metrics_token)])
-def metrics():
-    return Response(content=generate_latest(), media_type=CONTENT_TYPE_LATEST)
-
-
 @app.get("/health", response_model=HealthResponse)
 async def health_check():
     return HealthResponse(
@@ -471,29 +596,18 @@ async def health_check():
 @app.get("/ready", response_model=ReadinessResponse)
 async def readiness_check():
     require_supabase = os.environ.get("REQUIRE_SUPABASE", "false").lower() == "true"
-    allow_degraded = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
-    
     checks = {
         "api": True,
         "classifier_loaded": classifier_service._loaded,
         "ner_loaded": ner_service._loaded,
-        "duplicate_index_loaded": duplicate_service.is_available(),
-        "rag_loaded": rag_service.is_available(),
+        "duplicate_index_loaded": duplicate_service._loaded,
+        "rag_loaded": rag_service._loaded,
     }
     if require_supabase:
         checks["supabase_configured"] = supabase is not None
 
-    # In degraded mode, duplicate and RAG services are optional
-    if allow_degraded:
-        required_checks = {k: v for k, v in checks.items() if k not in ["duplicate_index_loaded", "rag_loaded"]}
-        all_required_pass = all(required_checks.values())
-        
-        if all_required_pass:
-            return ReadinessResponse(status="ready", checks=checks)
-    else:
-        # Strict mode: all checks must pass
-        if all(checks.values()):
-            return ReadinessResponse(status="ready", checks=checks)
+    if all(checks.values()):
+        return ReadinessResponse(status="ready", checks=checks)
 
     return JSONResponse(
         status_code=503,
@@ -634,31 +748,6 @@ async def get_tickets(company_id: str | None = None):
     res = query.execute()
     return res.data
 
-@app.get("/tickets/search")
-async def search_tickets(q: str | None = None, company_id: str | None = None, limit: int = 50, offset: int = 0):
-    """Search tickets using tenant-safe full-text search."""
-    if not supabase:
-        raise HTTPException(status_code=500, detail="Database connection not initialized")
-
-    if not q:
-        raise HTTPException(status_code=400, detail="Search query is required")
-    if not company_id:
-        raise HTTPException(status_code=400, detail="company_id is required for tenant-safe search")
-
-    try:
-        result = supabase.rpc(
-            "search_tickets",
-            {
-                "query_text": q,
-                "company_id": company_id,
-                "limit_rows": limit,
-                "offset_rows": offset,
-            },
-        ).execute()
-        return result.data or []
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Search failed: {e}")
-
 @app.post("/tickets/save")
 async def save_ticket(request_body: TicketSaveRequest):
     """
@@ -669,64 +758,80 @@ async def save_ticket(request_body: TicketSaveRequest):
         raise HTTPException(status_code=500, detail="Supabase connection not initialized.")
 
     logger = logging.getLogger(__name__)
-    try:
-        final_data = request_body.dict()
-
-        # Resolve tenant linkage from user profile with authorization validation.
-        profile = {}
-        if request_body.user_id:
-            try:
-                profile_res = (
-                    supabase.table("profiles")
-                    .select("company_id, company")
-                    .eq("id", request_body.user_id)
-                    .single()
-                    .execute()
-                )
-                profile = profile_res.data or {}
-                if not profile:
-                    raise HTTPException(status_code=404, detail="User profile not found")
-                
-                # SELF-HEALING: If company_id is null in database but company name exists, resolve it!
-                if not profile.get("company_id") and profile.get("company"):
-                    try:
-                        comp_name = profile.get("company").strip()
-                        comp_res = (
-                            supabase.table("companies")
-                            .select("id")
-                            .ilike("name", comp_name)
-                            .execute()
-                        )
-                        if comp_res.data:
-                            resolved_company_id = comp_res.data[0]["id"]
-                            # Backfill the profile table in real-time
-                            supabase.table("profiles").update({"company_id": resolved_company_id}).eq("id", request_body.user_id).execute()
-                            profile["company_id"] = resolved_company_id
-                            logger.info(f"[SELF-HEALING] Backfilled company_id={resolved_company_id} for user={request_body.user_id}")
-                    except Exception as healing_err:
-                        logger.warning(f"[SELF-HEALING WARNING] Failed to backfill company_id: {healing_err}")
-            except HTTPException:
-                raise
-            except Exception as profile_error:
-                user_hash = hashlib.sha256(str(request_body.user_id).encode()).hexdigest()[:8]
-                logger.error(f"Tenant resolution error for user {user_hash}: {profile_error}")
-                raise HTTPException(status_code=503, detail="Failed to resolve tenant linkage") from profile_error
-
-        # Validate tenant consistency and authorization.
-        profile_company_id = profile.get("company_id")
-        if final_data.get("company_id"):
-            # User provided company_id: verify it matches their profile.
-            if profile_company_id and final_data["company_id"] != profile_company_id:
-                user_hash = hashlib.sha256(str(request_body.user_id).encode()).hexdigest()[:8]
-                logger.warning(f"Tenant mismatch: user {user_hash} attempted {final_data['company_id']}, assigned to {profile_company_id}")
-                raise HTTPException(status_code=403, detail="User not authorized for this tenant")
-        elif profile_company_id:
-            # Backfill company_id from profile.
-            final_data["company_id"] = profile_company_id
-        elif request_body.user_id:
-            # User has no tenant assignment.
-            raise HTTPException(status_code=400, detail="User has no tenant assignment")
+    final_data = request_body.model_dump()
+    original_subject = final_data.get("subject", "") or ""
+    original_description = final_data.get("description", "") or ""
+
+    # Detect language and translate subject/description into English before downstream routing/indexing.
+    translation_probe_text = (original_description.strip() or original_subject.strip())
+    translation_ctx = detect_and_translate_ticket_text(translation_probe_text)
+    metadata = final_data.get("metadata") or {}
+    if translation_ctx["was_translated"]:
+        translated_subject = gemini_service.translate_to_english(original_subject, translation_ctx["source_language_name"]) if original_subject else original_subject
+        translated_description = gemini_service.translate_to_english(original_description, translation_ctx["source_language_name"]) if original_description else original_description
+        final_data["subject"] = translated_subject or original_subject
+        final_data["description"] = translated_description or original_description
+        metadata["original_text"] = {
+            "subject": original_subject,
+            "description": original_description,
+        }
+    metadata["translation"] = {
+        "translated": bool(translation_ctx["was_translated"]),
+        "source_language": translation_ctx["source_language"],
+        "source_language_name": translation_ctx["source_language_name"],
+    }
+    final_data["metadata"] = metadata
+
+    # Backfill SLA deadlines/status when the client omits or sends empty values.
+    priority_key = str(final_data.get("priority") or "medium").lower().strip()
+    now_utc = datetime.datetime.now(datetime.timezone.utc)
+
+    if not str(final_data.get("sla_breach_at") or "").strip():
+        final_data["sla_breach_at"] = compute_sla_breach_at(priority_key, now_utc)
+
+    if not str(final_data.get("sla_response_due_at") or "").strip():
+        policy = get_sla_policy(priority_key)
+        response_hours = max(1, int(round(float(policy["max_hours"]) * 0.25)))
+        response_due_at = now_utc + datetime.timedelta(hours=response_hours)
+        final_data["sla_response_due_at"] = response_due_at.isoformat()
+
+    if not str(final_data.get("sla_status") or "").strip():
+        final_data["sla_status"] = "ACTIVE"
+    # Resolve tenant linkage from user profile with authorization validation.
+    profile = {}
+    if request_body.user_id:
+        try:
+            profile_res = (
+                supabase.table("profiles")
+                .select("company_id, company")
+                .eq("id", request_body.user_id)
+                .single()
+                .execute()
+            )
+            profile = profile_res.data or {}
+            if not profile:
+                raise HTTPException(status_code=404, detail="User profile not found")
+        except HTTPException:
+            raise
+        except Exception as profile_error:
+            logger.error(f"Tenant resolution error for user {request_body.user_id}: {profile_error}")
+            raise HTTPException(status_code=503, detail="Failed to resolve tenant linkage") from profile_error
+
+    # Validate tenant consistency and authorization.
+    profile_company_id = profile.get("company_id")
+    if final_data.get("company_id"):
+        # User provided company_id: verify it matches their profile.
+        if profile_company_id and final_data["company_id"] != profile_company_id:
+            logger.warning(f"Tenant mismatch: user {request_body.user_id} attempted {final_data['company_id']}, assigned to {profile_company_id}")
+            raise HTTPException(status_code=403, detail="User not authorized for this tenant")
+    elif profile_company_id:
+        # Backfill company_id from profile.
+        final_data["company_id"] = profile_company_id
+    elif request_body.user_id:
+        # User has no tenant assignment.
+        raise HTTPException(status_code=400, detail="User has no tenant assignment")
 
+    try:
         # Backfill company name if missing.
         if not final_data.get("company") and profile.get("company"):
             final_data["company"] = profile["company"]
@@ -752,19 +857,28 @@ async def save_ticket(request_body: TicketSaveRequest):
             "is_potential_duplicate": False,
             "similarity": 0.0,
         }
+        user_hash = hashlib.sha256(str(request_body.user_id).encode()).hexdigest()[:8]
+        logger.info(f"Tenant linkage: user_hash={user_hash}, company_id={final_data.get('company_id')}")
 
-        if duplicate_text:
-            duplicate_result = detect_semantic_duplicate(
-                duplicate_text,
-                company_id=final_data.get("company_id"),
-                threshold=duplicate_threshold,
-            )
-            final_data["description_vector"] = duplicate_service.generate_embedding(duplicate_text)
-        else:
-            final_data["description_vector"] = None
 
-        final_data["is_potential_duplicate"] = duplicate_result.get("is_potential_duplicate", False)
-        final_data["parent_ticket_id"] = duplicate_result.get("parent_ticket_id")
+        # Semantic duplicate check BEFORE inserting the ticket
+        # This allows us to warn the user before confirming
+        duplicate_check_result = None
+        try:
+            dupe_text = (request_body.description or request_body.subject or "").strip()
+            if dupe_text:
+                duplicate_check_result = await semantic_dupe_service.check_duplicate(
+                    text=dupe_text,
+                    company_id=final_data.get("company_id"),
+                )
+                if duplicate_check_result["is_duplicate"]:
+                    logger.info(
+                        f"[DUPLICATE] Ticket flagged as potential duplicate of "
+                        f"{duplicate_check_result['duplicate_ticket_id']} "
+                        f"(similarity: {duplicate_check_result['similarity']})"
+                    )
+        except Exception as e:
+            logger.warning(f"[DUPLICATE] Semantic check error (non-fatal): {e}")
 
         # --- Sanitize payload to only include valid Supabase DB columns ---
         # Extra AI telemetry and non-existent schema fields are merged into the metadata JSONB column
@@ -772,13 +886,14 @@ async def save_ticket(request_body: TicketSaveRequest):
         VALID_TICKET_COLUMNS = {
             "user_id", "subject", "description", "category", "subcategory",
             "priority", "assigned_team", "status", "auto_resolve", "is_duplicate",
-            "confidence", "image_url", "company", "company_id", "sla_breach_at", "metadata",
+            "confidence", "image_url", "company", "company_id",
+            "sla_breach_at", "sla_response_due_at", "sla_status", "escalation_level", "metadata",
         }
         # Merge any extra telemetry and SLA/duplicate fields into metadata before filtering
         existing_metadata = final_data.get("metadata") or {}
         extra_keys = (
             "entities", "solution_steps", "ocr_text", "needs_review", "routing_confidence",
-            "is_potential_duplicate", "parent_ticket_id", "sla_response_due_at", "sla_status", "escalation_level"
+            "is_potential_duplicate", "parent_ticket_id"
         )
         for extra_key in extra_keys:
             if extra_key in final_data and final_data[extra_key] not in (None, "", [], {}):
@@ -795,19 +910,29 @@ async def save_ticket(request_body: TicketSaveRequest):
             
         ticket_id = res.data[0]["id"]
 
-        duplicate_indexed = True
-        duplicate_index_warning = None
+        # If duplicate detected, link parent ticket
+        if duplicate_check_result and duplicate_check_result["is_duplicate"]:
+            try:
+                supabase.table("tickets").update({
+                    "is_potential_duplicate": True,
+                    "parent_ticket_id": duplicate_check_result["duplicate_ticket_id"],
+                }).eq("id", ticket_id).execute()
+            except Exception as e:
+                logger.warning(f"[DUPLICATE] Failed to link parent ticket: {e}")
+
+        # Index the new ticket's embedding for future duplicate checks
+        embedding_indexed = False
+        description_text = (request_body.description or "").strip()
+        subject_text = (request_body.subject or "").strip()
+        duplicate_text = description_text or subject_text
         if duplicate_text:
             try:
+                # Both: old in-memory index (for backward compat) and new pgvector index
                 duplicate_service.add_ticket(str(ticket_id), duplicate_text)
+                asyncio.create_task(semantic_dupe_service.index_ticket(ticket_id, duplicate_text))
+                embedding_indexed = True
             except Exception as index_error:
-                duplicate_indexed = False
-                duplicate_index_warning = "Duplicate index update failed."
-                print(f"[WARNING] {duplicate_index_warning} ticket_id={ticket_id} error={index_error}")
-        else:
-            duplicate_indexed = False
-            duplicate_index_warning = "Duplicate index update skipped: no description or subject text was provided."
-            print(f"[WARNING] {duplicate_index_warning}")
+                logger.warning(f"[INDEX] Failed to index ticket {ticket_id}: {index_error}")
         
         # Add initial system diagnostic message
         msg = "Our Neural Engine has successfully triaged your issue and routed it to the designated team."
@@ -825,12 +950,14 @@ async def save_ticket(request_body: TicketSaveRequest):
         response = {
             "status": "success",
             "ticket_id": ticket_id,
-            "duplicate_indexed": duplicate_indexed,
-            "is_potential_duplicate": final_data["is_potential_duplicate"],
-            "parent_ticket_id": final_data["parent_ticket_id"],
+            "duplicate_indexed": embedding_indexed,
         }
-        if duplicate_index_warning:
-            response["duplicate_index_warning"] = duplicate_index_warning
+        if duplicate_check_result and duplicate_check_result["is_duplicate"]:
+            response["duplicate_warning"] = True
+            response["parent_ticket_id"] = duplicate_check_result["duplicate_ticket_id"]
+            response["parent_subject"] = duplicate_check_result.get("parent_subject")
+            response["similarity"] = duplicate_check_result["similarity"]
+            response["candidates"] = duplicate_check_result.get("candidates", [])
         return response
 
     except Exception as e:
@@ -838,17 +965,70 @@ async def save_ticket(request_body: TicketSaveRequest):
         raise HTTPException(status_code=500, detail=str(e))
 
 @app.get("/tickets/{ticket_id}")
-async def get_ticket_by_id(ticket_id: str):
+async def get_ticket_by_id(
+    request: Request,
+    ticket_id: str,
+):
     """Fetch single persistent ticket."""
     if not supabase:
         raise HTTPException(status_code=500, detail="Database connection not initialized")
-    
+
+    # Guard route overlap where '/tickets/search' may be matched here first.
+    if ticket_id == "search":
+        return await search_tickets(
+            q=request.query_params.get("q", ""),
+            company_id=request.query_params.get("company_id"),
+        )
+
     res = supabase.table("tickets").select("*").eq("id", ticket_id).single().execute()
     if not res.data:
         raise HTTPException(status_code=404, detail="Ticket not found")
     return res.data
 
 
+@app.get("/tickets/{ticket_id}/audit_logs", response_model=list[AuditLogRecord])
+async def get_ticket_audit_logs(ticket_id: str, company_id: str):
+    """Return a company-scoped chronological audit trail for a ticket."""
+    if not supabase:
+        raise HTTPException(status_code=500, detail="Database connection not initialized")
+
+    try:
+        service = AuditLogService(supabase)
+        return service.get_ticket_audit_logs(ticket_id, company_id)
+    except AuditLogAccessError as err:
+        raise HTTPException(status_code=err.status_code, detail=err.detail)
+
+
+@app.get("/tickets/search")
+async def search_tickets(q: str, company_id: str | None = None):
+    """Search tickets by query text, optionally scoped by company_id."""
+    if not supabase:
+        raise HTTPException(status_code=500, detail="Database connection not initialized")
+    query_text = (q or "").strip()
+    if not query_text:
+        raise HTTPException(status_code=400, detail="Query text is required")
+
+    try:
+        rpc_res = supabase.rpc(
+            "search_tickets",
+            {"query_text": query_text, "company_id": company_id},
+        ).execute()
+        return rpc_res.data or []
+    except Exception:
+        # Fallback for environments without RPC function support.
+        fallback = supabase.table("tickets").select("*").order("created_at", desc=True).execute()
+        rows = fallback.data or []
+        lowered = query_text.lower()
+        filtered = [
+            row for row in rows
+            if lowered in str(row.get("subject", "")).lower()
+            or lowered in str(row.get("description", "")).lower()
+        ]
+        if company_id:
+            filtered = [row for row in filtered if row.get("company_id") == company_id]
+        return filtered
+
+
 @app.post("/tickets", response_model=TicketRecord)
 async def create_ticket(ticket: TicketRecord):
     """Save a new ticket into the system."""
@@ -887,11 +1067,6 @@ async def analyze_ticket(request_body: TicketRequest, request: Request):
     Main endpoint for analyzing a new ticket using the cascade of local AI models.
     """
     text = request_body.text
-
-    settings = get_system_settings(request_body.company_id)
-    confidence_threshold = settings["ai_confidence_threshold"]
-    duplicate_sensitivity = settings["duplicate_sensitivity"]
-    enable_auto_resolve = settings["enable_auto_resolve"]
     
     # Grab client metadata
     client_ip = request.client.host if request.client else "unknown"
@@ -924,6 +1099,8 @@ async def analyze_only(request_body: TicketRequest):
     and duplicate check before committing to a ticket creation.
     """
     text = request_body.text
+    translation_ctx = detect_and_translate_ticket_text(text)
+    text = translation_ctx["text_for_analysis"]
     print(f"[AI] Starting Analysis (READ-ONLY) for: {text[:50]}...") 
     settings = get_system_settings(request_body.company)
     confidence_threshold = settings["ai_confidence_threshold"]
@@ -968,6 +1145,10 @@ async def analyze_only(request_body: TicketRequest):
             is_potential_duplicate=False,
             parent_ticket_id=None,
             sla_breach_at=_sla_breach.isoformat().replace("+00:00", "Z"),
+            original_text=request_body.text,
+            source_language=translation_ctx["source_language"],
+            source_language_name=translation_ctx["source_language_name"],
+            was_translated=translation_ctx["was_translated"],
         )
     
     # --- Context & Environment ---
@@ -1000,36 +1181,7 @@ async def analyze_only(request_body: TicketRequest):
     summary = text[:100] + ("…" if len(text) > 100 else "") 
 
     # --- Classification ---
-    try:
-        classification_v3_res = classifier_v3.predict(text)
-        if "error" in classification_v3_res:
-            # Fallback to V1
-            classification = classifier_service.predict(text)
-        else:
-            # Parse V3 output
-            cat = classification_v3_res.get("Category", {}).get("prediction", "Unknown")
-            sub = classification_v3_res.get("Subcategory", {}).get("prediction", "Unknown")
-            pri = classification_v3_res.get("priority", {}).get("prediction", "Medium")
-            conf = classification_v3_res.get("Category", {}).get("confidence", 0.0)
-            
-            from backend.services.classifier_service import TEAM_MAP, AUTO_RESOLVE_SUBS
-            assigned_team = TEAM_MAP.get(cat, "General Support")
-            auto_resolve = sub in AUTO_RESOLVE_SUBS
-            
-            classification = {
-                "category": cat,
-                "subcategory": sub,
-                "priority": pri,
-                "auto_resolve": auto_resolve,
-                "assigned_team": assigned_team,
-                "confidence": float(conf)
-            }
-    except Exception as e:
-        traceback.print_exc()
-        classification = {
-            "category": "Unknown", "subcategory": "Unknown", "priority": "Medium",
-            "auto_resolve": False, "assigned_team": "General Support", "confidence": 0.0,
-        }
+    classification = classify_ticket_text(text)
 
     timeline["ai_analyzed"] = get_now_ist()
     timeline["triaged"] = get_now_ist()
@@ -1043,21 +1195,10 @@ async def analyze_only(request_body: TicketRequest):
     timeline["metadata_harvested"] = get_now_ist()
 
     # --- Duplicate detection ---
-    duplicate_threshold = get_duplicate_threshold(request_body.company_id, duplicate_sensitivity)
     try:
-        dup_result = detect_semantic_duplicate(
-            text,
-            company_id=request_body.company_id,
-            threshold=duplicate_threshold,
-        )
+        dup_result = duplicate_service.check_duplicate(text, threshold=request_body.duplicate_sensitivity)
     except Exception:
-        dup_result = {
-            "is_duplicate": False,
-            "duplicate_ticket_id": None,
-            "parent_ticket_id": None,
-            "is_potential_duplicate": False,
-            "similarity": 0.0,
-        }
+        dup_result = {"is_duplicate": False, "duplicate_ticket_id": None, "similarity": 0.0}
 
     # --- RAG Knowledge Base Check ---
     rag_match = None
@@ -1073,7 +1214,7 @@ async def analyze_only(request_body: TicketRequest):
 
     # --- Reasoning ---
     decision_factors = []
-    if classification["confidence"] > confidence_threshold:
+    if classification["confidence"] > request_body.confidence_threshold:
         decision_factors.append(f"High confidence match for '{classification['subcategory']}'")
     if entities:
         decision_factors.append(f"Detected entities: {', '.join([e['text'] for e in entities[:2]])}")
@@ -1083,14 +1224,6 @@ async def analyze_only(request_body: TicketRequest):
         decision_factors.append(f"Found solution article: '{rag_match['title']}'")
 
     reasoning = f"Categorized as '{classification['category']}' - {classification['subcategory']}."
-    if (
-        enable_auto_resolve
-        and classification["confidence"] >= confidence_threshold
-        and classification["auto_resolve"]
-    ):
-        classification["auto_resolve"] = True
-    else:
-        classification["auto_resolve"] = False
     if classification["auto_resolve"]:
         reasoning += " Flagged for AI auto-resolution via Knowledge Base." if rag_match else " Flagged for auto-resolution."
     
@@ -1100,8 +1233,10 @@ async def analyze_only(request_body: TicketRequest):
     if gemini_service and gemini_service._initialized:
         summary = gemini_service.get_summary(text)
     
-    # Convert priority to the SLA resolution target timestamp for preview.
-    sla_breach_dt = calculate_sla_breach_at(classification["priority"])
+    # Convert priority to SLA breached timestamp (for preview)
+    hours_map = {"Critical": 2, "High": 8, "Medium": 24, "Low": 72}
+    sla_hours = hours_map.get(classification["priority"], 72)
+    sla_breach_dt = datetime.datetime.utcnow() + datetime.timedelta(hours=sla_hours)
 
     return TicketResponse(
         ticket_id=str(uuid.uuid4()), # Temporary ID
@@ -1114,17 +1249,21 @@ async def analyze_only(request_body: TicketRequest):
         entities=[EntityInfo(**e) for e in entities],
         duplicate_ticket=DuplicateInfo(**dup_result),
         confidence=classification["confidence"],
-        needs_review=classification["confidence"] < confidence_threshold,
+        needs_review=classification["confidence"] < 0.20,
         reasoning=reasoning,
         decision_factors=decision_factors,
         image_description=gemini_analysis["image_description"],
         ocr_text=gemini_analysis["ocr_text"],
-        highlights=entities, # Use entities as highlights for now
+        highlights=[e.get("text", "") for e in entities], # Use entity texts as highlights for now
         timeline=timeline,
         env_metadata=env_metadata,
         is_potential_duplicate=dup_result.get("is_potential_duplicate", False),
         parent_ticket_id=dup_result.get("parent_ticket_id"),
-        sla_breach_at=sla_breach_dt.isoformat().replace("+00:00", "Z")
+        sla_breach_at=sla_breach_dt.isoformat().replace("+00:00", "Z"),
+        original_text=translation_ctx["original_text"],
+        source_language=translation_ctx["source_language"],
+        source_language_name=translation_ctx["source_language_name"],
+        was_translated=translation_ctx["was_translated"],
     )
 
 @app.post("/ai/analyze_stream")
@@ -1143,11 +1282,7 @@ async def analyze_stream(request_body: TicketRequest):
             "model_version": "3.0.0-PRO",
             "api_endpoint": "/ai/analyze_stream"
         }
-        timeline = {"received": get_now_ist()} 
-        settings = get_system_settings(request_body.company_id)
-        confidence_threshold = settings["ai_confidence_threshold"]
-        duplicate_sensitivity = settings["duplicate_sensitivity"]
-        enable_auto_resolve = settings["enable_auto_resolve"]
+        timeline = {"received": get_now_ist()}
 
         # 1. Reading
         yield f"data: {json.dumps({'step': 'Reading your message', 'status': 'in_progress'})}\n\n"
@@ -1175,33 +1310,7 @@ async def analyze_stream(request_body: TicketRequest):
         # 3. Classification
         yield f"data: {json.dumps({'step': 'Detecting category and priority', 'status': 'in_progress'})}\n\n"
         await asyncio.sleep(0.2)
-        try:
-            classification_v3_res = classifier_v3.predict(text)
-            if "error" in classification_v3_res:
-                classification = classifier_service.predict(text)
-            else:
-                cat = classification_v3_res.get("Category", {}).get("prediction", "Unknown")
-                sub = classification_v3_res.get("Subcategory", {}).get("prediction", "Unknown")
-                pri = classification_v3_res.get("priority", {}).get("prediction", "Medium")
-                conf = classification_v3_res.get("Category", {}).get("confidence", 0.0)
-                
-                from backend.services.classifier_service import TEAM_MAP, AUTO_RESOLVE_SUBS
-                assigned_team = TEAM_MAP.get(cat, "General Support")
-                auto_resolve = sub in AUTO_RESOLVE_SUBS
-                
-                classification = {
-                    "category": cat,
-                    "subcategory": sub,
-                    "priority": pri,
-                    "auto_resolve": auto_resolve,
-                    "assigned_team": assigned_team,
-                    "confidence": float(conf)
-                }
-        except Exception as e:
-            classification = {
-                "category": "Unknown", "subcategory": "Unknown", "priority": "Medium",
-                "auto_resolve": False, "assigned_team": "General Support", "confidence": 0.0,
-            }
+        classification = classify_ticket_text(text)
         timeline["ai_analyzed"] = get_now_ist()
         timeline["triaged"] = get_now_ist()
 
@@ -1209,20 +1318,9 @@ async def analyze_stream(request_body: TicketRequest):
         yield f"data: {json.dumps({'step': 'Checking duplicate issues', 'status': 'in_progress'})}\n\n"
         await asyncio.sleep(0.2)
         try:
-            duplicate_threshold = get_duplicate_threshold(request_body.company_id, duplicate_sensitivity)
-            dup_result = detect_semantic_duplicate(
-                text,
-                company_id=request_body.company_id,
-                threshold=duplicate_threshold,
-            )
+            dup_result = duplicate_service.check_duplicate(text, threshold=request_body.duplicate_sensitivity)
         except Exception:
-            dup_result = {
-                "is_duplicate": False,
-                "duplicate_ticket_id": None,
-                "parent_ticket_id": None,
-                "is_potential_duplicate": False,
-                "similarity": 0.0,
-            }
+            dup_result = {"is_duplicate": False, "duplicate_ticket_id": None, "similarity": 0.0}
 
         # 5. RAG / Solutions
         yield f"data: {json.dumps({'step': 'Finding possible solutions', 'status': 'in_progress'})}\n\n"
@@ -1238,7 +1336,7 @@ async def analyze_stream(request_body: TicketRequest):
             pass
 
         decision_factors = []
-        if classification["confidence"] > confidence_threshold:
+        if classification["confidence"] > request_body.confidence_threshold:
             decision_factors.append(f"High confidence match for '{classification['subcategory']}'")
         if entities:
             decision_factors.append(f"Detected entities: {', '.join([e['text'] for e in entities[:2]])}")
@@ -1247,8 +1345,6 @@ async def analyze_stream(request_body: TicketRequest):
         if rag_match:
             decision_factors.append(f"Found solution article: '{rag_match['title']}'")
 
-        if not enable_auto_resolve:
-            classification["auto_resolve"] = False
         reasoning = f"Categorized as '{classification['category']}' - {classification['subcategory']}."
         if classification["auto_resolve"]:
             reasoning += " Flagged for AI auto-resolution via Knowledge Base." if rag_match else " Flagged for auto-resolution."
@@ -1258,7 +1354,9 @@ async def analyze_stream(request_body: TicketRequest):
         if gemini_service and gemini_service._initialized:
             summary = gemini_service.get_summary(text)
         
-        sla_breach_dt = calculate_sla_breach_at(classification["priority"])
+        hours_map = {"Critical": 2, "High": 8, "Medium": 24, "Low": 72}
+        sla_hours = hours_map.get(classification["priority"], 72)
+        sla_breach_dt = datetime.datetime.utcnow() + datetime.timedelta(hours=sla_hours)
 
         ticket_response_dict = {
             "ticket_id": str(uuid.uuid4()),
@@ -1271,17 +1369,15 @@ async def analyze_stream(request_body: TicketRequest):
             "entities": [e for e in entities],
             "duplicate_ticket": dup_result,
             "confidence": classification["confidence"],
-            "needs_review": classification["confidence"] < confidence_threshold,
+            "needs_review": classification["confidence"] < 0.20,
             "reasoning": reasoning,
             "decision_factors": decision_factors,
             "image_description": gemini_analysis["image_description"],
             "ocr_text": gemini_analysis["ocr_text"],
-            "highlights": entities,
+            "highlights": [e.get("text", "") for e in entities],
             "timeline": timeline,
             "env_metadata": env_metadata,
-            "is_potential_duplicate": dup_result.get("is_potential_duplicate", False),
-            "parent_ticket_id": dup_result.get("parent_ticket_id"),
-            "sla_breach_at": sla_breach_dt.isoformat().replace("+00:00", "Z")
+            "sla_breach_at": sla_breach_dt.isoformat() + "Z"
         }
 
         # 6. Final Result
@@ -1313,3 +1409,258 @@ async def analyze_ticket_v2(request: TicketRequest):
         }
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
+
+
+# ---------------------------------------------------------------------------
+# SLA Engine Endpoints
+# ---------------------------------------------------------------------------
+
+class SLAStatsResponse(BaseModel):
+    total: int = 0
+    active: int = 0
+    breached: int = 0
+    warning: int = 0
+    met: int = 0
+    breach_rate: float = 0.0
+    by_priority: dict = {}
+
+
+@app.get("/sla/stats", response_model=SLAStatsResponse)
+async def sla_stats():
+    """Get aggregated SLA dashboard statistics across all tickets."""
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+    stats = await sla_engine.get_dashboard_stats()
+    if "error" in stats:
+        raise HTTPException(status_code=500, detail=stats["error"])
+    return stats
+
+
+class SLATicketInfo(BaseModel):
+    id: str
+    ticket_id: str | None = None
+    subject: str | None = None
+    summary: str | None = None
+    priority: str = "medium"
+    status: str | None = None
+    assigned_team: str | None = None
+    sla_status: str = "active"
+    escalation_level: int = 0
+    remaining_seconds: int = 0
+    created_at: str | None = None
+    sla_breach_at: str | None = None
+    sla_warning_at: str | None = None
+    last_escalated_at: str | None = None
+
+
+@app.get("/sla/tickets")
+async def sla_tickets(
+    status: str | None = None,
+    priority: str | None = None,
+    limit: int = 100,
+    offset: int = 0,
+):
+    """
+    List tickets with SLA status. Filter by sla_status and/or priority.
+    """
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+
+    query = (
+        supabase.table("tickets")
+        .select("id, ticket_id, subject, summary, priority, status, assigned_team, sla_status, escalation_level, remaining_seconds, created_at, sla_breach_at, sla_warning_at, last_escalated_at")
+        .order("created_at", desc=True)
+    )
+
+    if status and status != "all":
+        query = query.eq("sla_status", status)
+    if priority and priority != "all":
+        query = query.eq("priority", priority.capitalize())
+
+    query = query.range(offset, offset + limit - 1)
+    res = query.execute()
+    return {"tickets": res.data or [], "total": len(res.data or [])}
+
+
+class EscalationLogEntry(BaseModel):
+    id: str
+    ticket_id: str | None = None
+    ticket_subject: str = ""
+    priority: str = "medium"
+    sla_status: str = ""
+    escalation_level: int = 0
+    remaining_seconds: int = 0
+    assigned_team: str = ""
+    notification_channels: list = []
+    triggered_at: str | None = None
+    resolved_at: str | None = None
+    notes: str = ""
+
+
+@app.get("/sla/escalations")
+async def sla_escalations(limit: int = 50, offset: int = 0):
+    """Fetch escalation log history."""
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+
+    try:
+        res = (
+            supabase.table("escalation_logs")
+            .select("*")
+            .order("triggered_at", desc=True)
+            .range(offset, offset + limit - 1)
+            .execute()
+        )
+        return {"escalations": res.data or [], "total": len(res.data or [])}
+    except Exception as e:
+        # Table might not exist yet
+        print(f"[SLA] Escalation logs query failed: {e}")
+        return {"escalations": [], "total": 0}
+
+
+class SLAPolicyInfo(BaseModel):
+    id: str
+    priority: str
+    max_hours: int
+    warning_pct: float
+    auto_escalate: bool
+    l2_after_minutes: int
+    l3_after_minutes: int
+
+
+@app.get("/sla/policies")
+async def sla_policies():
+    """Get configured SLA policies."""
+    if not supabase:
+        # Return defaults from code
+        policies = []
+        for pri, cfg in sla_engine.SLA_POLICIES.items() if hasattr(sla_engine, 'SLA_POLICIES') else SLA_POLICIES.items():
+            policies.append({
+                "priority": pri,
+                "max_hours": cfg["max_hours"],
+                "warning_pct": cfg["warning_pct"],
+                "auto_escalate": cfg["auto_escalate_on_breach"],
+                "l2_after_minutes": cfg["l2_escalation_mins"],
+                "l3_after_minutes": cfg["l3_escalation_mins"],
+            })
+        return {"policies": policies}
+
+    try:
+        res = supabase.table("sla_policies").select("*").execute()
+        return {"policies": res.data or []}
+    except Exception as e:
+        print(f"[SLA] Policies query failed: {e}")
+        return {"policies": []}
+
+
+@app.post("/sla/check")
+async def trigger_sla_check():
+    """Manually trigger an SLA evaluation cycle (admin)."""
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+    
+    asyncio.create_task(sla_engine.check_all_active_tickets())
+    return {"status": "triggered", "message": "SLA check cycle started in background"}
+
+
+# ---------------------------------------------------------------------------
+# Semantic Duplicate Detection Endpoints
+# ---------------------------------------------------------------------------
+
+@app.post("/ai/check_duplicate")
+async def check_duplicate_endpoint(
+    body: TicketRequest,
+    company_id: str | None = None,
+):
+    """
+    Check a ticket text for potential duplicates using semantic vector search.
+    Returns top candidates with similarity scores.
+    """
+    text = (body.text or "").strip()
+    if not text:
+        raise HTTPException(status_code=400, detail="No text provided")
+
+    threshold = body.duplicate_sensitivity if hasattr(body, 'duplicate_sensitivity') else None
+    result = await semantic_dupe_service.check_duplicate(
+        text=text,
+        company_id=company_id or body.company,
+        threshold=threshold,
+    )
+    return result
+
+
+@app.post("/ai/reindex_embeddings")
+async def reindex_embeddings():
+    """Re-generate vector embeddings for all tickets."""
+    result = await semantic_dupe_service.reindex_all()
+    return result
+
+
+@app.get("/system/settings")
+async def get_system_settings_endpoint():
+    """Fetch all system settings."""
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+    try:
+        res = supabase.table("system_settings").select("*").execute()
+        settings = {}
+        for row in res.data or []:
+            settings[row["key"]] = row["value"]
+        return settings
+    except Exception as e:
+        logger.warning(f"[SETTINGS] Query failed: {e}")
+        return {}
+
+
+@app.patch("/system/settings")
+async def update_system_settings(body: dict):
+    """Update a specific system setting."""
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+    key = body.get("key")
+    value = body.get("value")
+    if not key or value is None:
+        raise HTTPException(status_code=400, detail="key and value required")
+    try:
+        supabase.table("system_settings").upsert({
+            "key": key,
+            "value": value,
+            "updated_at": datetime.datetime.utcnow().isoformat() + "Z",
+        }).execute()
+        return {"status": "updated", "key": key}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@app.get("/sla/tickets/{ticket_id}")
+async def sla_ticket_detail(ticket_id: str):
+    """Get detailed SLA info for a specific ticket."""
+    if not supabase:
+        raise HTTPException(status_code=503, detail="Database not connected")
+
+    # Fetch ticket
+    res = supabase.table("tickets").select("*").eq("id", ticket_id).single().execute()
+    if not res.data:
+        raise HTTPException(status_code=404, detail="Ticket not found")
+
+    ticket = res.data
+    result = sla_engine.evaluate_ticket(ticket)
+
+    # Fetch escalation history for this ticket
+    try:
+        esc_res = (
+            supabase.table("escalation_logs")
+            .select("*")
+            .eq("ticket_id", ticket_id)
+            .order("triggered_at", desc=True)
+            .execute()
+        )
+        escalations = esc_res.data or []
+    except Exception:
+        escalations = []
+
+    return {
+        "ticket": ticket,
+        "sla_evaluation": result,
+        "escalations": escalations,
+    }

backend/requirements.txt

@@ -4,6 +4,8 @@ datasets>=2.14.0
 pandas>=2.0.0
 scikit-learn>=1.3.0
 sentence-transformers>=2.2.0
+onnxruntime>=1.17.0
+tokenizers>=0.15.0
 fastapi>=0.104.0
 uvicorn>=0.24.0
 openpyxl>=3.1.0
@@ -15,4 +17,9 @@ easyocr
 slowapi>=0.1.9
 supabase==2.22.4
 storage3==2.22.4
-prometheus-client>=0.17.0
+redis>=5.0.0
+pytest
+pytest-asyncio
+httpx
+cryptography>=42.0.0
+

backend/services/classifier_service.py

@@ -6,27 +6,20 @@ Priority and other fields are derived from the category mapping.
 
 import os
 import json
-import torch
-import torch.nn.functional as F
-from transformers import DistilBertTokenizerFast, DistilBertForSequenceClassification
-import time
-from prometheus_client import Counter, Histogram
-
-# Prometheus metrics for tracking model performance
-MODEL_PREDICTIONS_TOTAL = Counter(
-    "model_predictions_total",
-    "Total count of DistilBERT predictions",
-    ["status"]
-)
-
-MODEL_PREDICTION_LATENCY = Histogram(
-    "model_prediction_latency_seconds",
-    "Latency of DistilBERT prediction in seconds",
-    buckets=(0.05, 0.1, 0.25, 0.5, 0.75, 1.0, 2.5, 5.0, 10.0)
-)
+try:
+    import torch
+    import torch.nn.functional as F
+    from transformers import DistilBertTokenizerFast, DistilBertForSequenceClassification
+    _HAS_TORCH = True
+except Exception:  # pragma: no cover - optional CI/runtime dependency
+    torch = None
+    F = None
+    DistilBertTokenizerFast = None
+    DistilBertForSequenceClassification = None
+    _HAS_TORCH = False
 
 SAVE_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "models", "classifier")
-DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+DEVICE = torch.device("cuda" if torch and torch.cuda.is_available() else "cpu") if _HAS_TORCH else None
 MAX_LEN = 128
 
 # Priority mapping based on sub-category severity
@@ -72,26 +65,19 @@ class ClassifierService:
         if self._loaded:
             return
 
+        if not _HAS_TORCH:
+            # Degraded environment: ML runtime not available. Delay failure until predict is called.
+            print("[INFO] ML runtime not available; classifier will remain unloaded until dependencies are installed.")
+            return
+
         abs_dir = os.path.abspath(SAVE_DIR)
-        safetensors_path = os.path.join(abs_dir, "model.safetensors")
 
-        if not os.path.exists(safetensors_path):
+        if not os.path.exists(os.path.join(abs_dir, "model.safetensors")):
             raise FileNotFoundError(
                 f"Classifier model not found at {abs_dir}. "
                 "Please ensure model files are present."
             )
 
-        with open(safetensors_path, "rb") as f:
-            header = f.read(512)
-        if (
-            b"version https://git-lfs.github.com/spec" in header
-            or b"oid sha256:" in header
-        ):
-            raise FileNotFoundError(
-                f"Classifier model at {abs_dir} is a Git LFS placeholder, not the actual model. "
-                "Please pull the LFS assets."
-            )
-
         # Load label mappings
         with open(os.path.join(abs_dir, "id2label.json"), "r") as f:
             self.id2label = json.load(f)
@@ -113,74 +99,65 @@ class ClassifierService:
         """
         Predict category, subcategory, priority, auto_resolve, assigned_team, and confidence.
         """
-        start_time = time.time()
-        try:
-            self.load()
-
-            encoding = self.tokenizer(
-                text,
-                truncation=True,
-                padding="max_length",
-                max_length=MAX_LEN,
-                return_tensors="pt",
-            )
-            input_ids = encoding["input_ids"].to(DEVICE)
-            attention_mask = encoding["attention_mask"].to(DEVICE)
-
-            with torch.no_grad():
-                outputs = self.model(input_ids=input_ids, attention_mask=attention_mask)
-                logits = outputs.logits
-                probs = F.softmax(logits, dim=1)
-                confidence, pred_idx = torch.max(probs, dim=1)
-
-            pred_idx = pred_idx.item()
-            confidence = round(confidence.item(), 4)
-
-            # Decode the combined label "Category | SubCategory"
-            combined_label = self.id2label.get(str(pred_idx), "Unknown | Unknown")
-            parts = combined_label.split(" | ", 1)
-            category = parts[0].strip() if len(parts) > 0 else "Unknown"
-            subcategory = parts[1].strip() if len(parts) > 1 else "Unknown"
-
-            # Derive priority
-            priority = PRIORITY_MAP.get(subcategory, "Medium")
-
-            # Derive assigned team
-            assigned_team = TEAM_MAP.get(category, "General Support")
-
-            # Derive auto_resolve
-            auto_resolve = subcategory in AUTO_RESOLVE_SUBS
-
-            # --- Regex Override Layer (Boost for Technical Keywords) ---
-            tech_keywords = {
-                "Network": ["IP address", "hostname", "connection", "network", "bandwidth", "DNS", "firewall", "VPN", "Connectivity", "Latency", "Routing", "Spikes"],
-                "Software": ["crash", "load", "website", "application", "error", "bug", "failing", "software", "SQL", "Cluster", "Database", "Production", "Latency"],
-                "Access": ["login", "password", "access", "authentication", "account", "permission", "MFA", "OAuth"]
-            }
-            
-            lower_text = text.lower()
-            for cat, keywords in tech_keywords.items():
-                if any(k.lower() in lower_text for k in keywords):
-                    # If current prediction is generic, or we have a high-value technical keyword
-                    if category == "General" or confidence < 0.9:
-                        category = cat
-                        assigned_team = TEAM_MAP.get(cat, "General Support")
-                        # Boost confidence significantly for verified technical signals
-                        confidence = max(confidence, 0.92) 
-                        break
-
-            MODEL_PREDICTIONS_TOTAL.labels(status="success").inc()
-            return {
-                "category": category,
-                "subcategory": subcategory,
-                "priority": priority,
-                "auto_resolve": auto_resolve,
-                "assigned_team": assigned_team,
-                "confidence": confidence,
-            }
-        except Exception as e:
-            MODEL_PREDICTIONS_TOTAL.labels(status="failure").inc()
-            raise e
-        finally:
-            duration = time.time() - start_time
-            MODEL_PREDICTION_LATENCY.observe(duration)
+        self.load()
+
+        encoding = self.tokenizer(
+            text,
+            truncation=True,
+            padding="max_length",
+            max_length=MAX_LEN,
+            return_tensors="pt",
+        )
+        input_ids = encoding["input_ids"].to(DEVICE)
+        attention_mask = encoding["attention_mask"].to(DEVICE)
+
+        with torch.no_grad():
+            outputs = self.model(input_ids=input_ids, attention_mask=attention_mask)
+            logits = outputs.logits
+            probs = F.softmax(logits, dim=1)
+            confidence, pred_idx = torch.max(probs, dim=1)
+
+        pred_idx = pred_idx.item()
+        confidence = round(confidence.item(), 4)
+
+        # Decode the combined label "Category | SubCategory"
+        combined_label = self.id2label.get(str(pred_idx), "Unknown | Unknown")
+        parts = combined_label.split(" | ", 1)
+        category = parts[0].strip() if len(parts) > 0 else "Unknown"
+        subcategory = parts[1].strip() if len(parts) > 1 else "Unknown"
+
+        # Derive priority
+        priority = PRIORITY_MAP.get(subcategory, "Medium")
+
+        # Derive assigned team
+        assigned_team = TEAM_MAP.get(category, "General Support")
+
+        # Derive auto_resolve
+        auto_resolve = subcategory in AUTO_RESOLVE_SUBS
+
+        # --- Regex Override Layer (Boost for Technical Keywords) ---
+        tech_keywords = {
+            "Network": ["IP address", "hostname", "connection", "network", "bandwidth", "DNS", "firewall", "VPN", "Connectivity", "Latency", "Routing", "Spikes"],
+            "Software": ["crash", "load", "website", "application", "error", "bug", "failing", "software", "SQL", "Cluster", "Database", "Production", "Latency"],
+            "Access": ["login", "password", "access", "authentication", "account", "permission", "MFA", "OAuth"]
+        }
+        
+        lower_text = text.lower()
+        for cat, keywords in tech_keywords.items():
+            if any(k.lower() in lower_text for k in keywords):
+                # If current prediction is generic, or we have a high-value technical keyword
+                if category == "General" or confidence < 0.9:
+                    category = cat
+                    assigned_team = TEAM_MAP.get(cat, "General Support")
+                    # Boost confidence significantly for verified technical signals
+                    confidence = max(confidence, 0.92) 
+                    break
+
+        return {
+            "category": category,
+            "subcategory": subcategory,
+            "priority": priority,
+            "auto_resolve": auto_resolve,
+            "assigned_team": assigned_team,
+            "confidence": confidence,
+        }

backend/services/classifier_v2.py

@@ -1,89 +1,109 @@
 import os
-import torch
-import torch.nn as nn
 import pickle
 import json
-from transformers import DistilBertTokenizerFast, DistilBertModel
+try:
+    import torch
+    import torch.nn as nn
+    from transformers import DistilBertTokenizerFast, DistilBertModel
+    _HAS_TORCH = True
+except Exception:  # pragma: no cover - optional runtime dependency
+    torch = None
+    nn = None
+    DistilBertTokenizerFast = None
+    DistilBertModel = None
+    _HAS_TORCH = False
 
 # Paths
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 MODEL_DIR = os.path.join(BASE_DIR, "models", "classifier-v2")
 
 # We must use the exact same class definition as trainer_v2
-class MultiOutputClassifierV2(nn.Module):
-    def __init__(self, num_labels_per_output: dict):
-        super().__init__()
-        self.bert = DistilBertModel.from_pretrained("distilbert-base-uncased")
-        hidden = self.bert.config.hidden_size 
-        self.dropout = nn.Dropout(0.2)
-        self.heads = nn.ModuleDict()
-        for name, n_labels in num_labels_per_output.items():
-            self.heads[name] = nn.Linear(hidden, n_labels)
+if _HAS_TORCH:
+    class MultiOutputClassifierV2(nn.Module):
+        def __init__(self, num_labels_per_output: dict):
+            super().__init__()
+            self.bert = DistilBertModel.from_pretrained("distilbert-base-uncased")
+            hidden = self.bert.config.hidden_size 
+            self.dropout = nn.Dropout(0.2)
+            self.heads = nn.ModuleDict()
+            for name, n_labels in num_labels_per_output.items():
+                self.heads[name] = nn.Linear(hidden, n_labels)
 
-    def forward(self, input_ids, attention_mask):
-        outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
-        cls_output = outputs.last_hidden_state[:, 0] 
-        cls_output = self.dropout(cls_output)
-        logits = {name: head(cls_output) for name, head in self.heads.items()}
-        return logits
+        def forward(self, input_ids, attention_mask):
+            outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
+            cls_output = outputs.last_hidden_state[:, 0] 
+            cls_output = self.dropout(cls_output)
+            logits = {name: head(cls_output) for name, head in self.heads.items()}
+            return logits
 
-class ClassifierServiceV2:
-    def __init__(self):
-        self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
-        
-        # 1. Load Config
-        config_path = os.path.join(MODEL_DIR, "model_config.json")
-        if not os.path.exists(config_path):
-            self.model = None
-            print(f"[WARN] V2 Model config not found at {config_path}")
-            return
+    class ClassifierServiceV2:
+        def __init__(self):
+            self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+            
+            # 1. Load Config
+            config_path = os.path.join(MODEL_DIR, "model_config.json")
+            if not os.path.exists(config_path):
+                self.model = None
+                print(f"[WARN] V2 Model config not found at {config_path}")
+                return
 
-        with open(config_path, "r") as f:
-            self.num_labels = json.load(f)
+            with open(config_path, "r") as f:
+                self.num_labels = json.load(f)
 
-        # 2. Load Encoders
-        with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
-            self.label_encoders = pickle.load(f)
+            # 2. Load Encoders
+            with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
+                self.label_encoders = pickle.load(f)
 
-        # 3. Load Model
-        self.model = MultiOutputClassifierV2(self.num_labels).to(self.device)
-        model_path = os.path.join(MODEL_DIR, "model.pt")
-        self.model.load_state_dict(torch.load(model_path, map_location=self.device))
-        self.model.eval()
+            # 3. Load Model
+            self.model = MultiOutputClassifierV2(self.num_labels).to(self.device)
+            model_path = os.path.join(MODEL_DIR, "model.pt")
+            self.model.load_state_dict(torch.load(model_path, map_location=self.device))
+            self.model.eval()
 
-        # 4. Load Tokenizer
-        self.tokenizer = DistilBertTokenizerFast.from_pretrained(MODEL_DIR)
-        print("[SUCCESS] Classifier Service V2 (Shadow) Loaded Successfully.")
+            # 4. Load Tokenizer
+            self.tokenizer = DistilBertTokenizerFast.from_pretrained(MODEL_DIR)
+            print("[SUCCESS] Classifier Service V2 (Shadow) Loaded Successfully.")
 
-    def predict(self, text: str):
-        if self.model is None:
-            return {"error": "V2 Model not initialized"}
+        def predict(self, text: str):
+            if self.model is None:
+                return {"error": "V2 Model not initialized"}
 
-        inputs = self.tokenizer(
-            text, 
-            return_tensors="pt", 
-            truncation=True, 
-            padding=True, 
-            max_length=256 # V2 uses 256
-        ).to(self.device)
+            inputs = self.tokenizer(
+                text, 
+                return_tensors="pt", 
+                truncation=True, 
+                padding=True, 
+                max_length=256 # V2 uses 256
+            ).to(self.device)
 
-        with torch.no_grad():
-            logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+            with torch.no_grad():
+                logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+                
+            results = {}
+            for col, le in self.label_encoders.items():
+                probs = torch.softmax(logits[col], dim=1)
+                conf, pred_idx = torch.max(probs, dim=1)
+                results[col] = {
+                    "prediction": le.inverse_transform([pred_idx.item()])[0],
+                    "confidence": float(conf.item())
+                }
             
-        results = {}
-        for col, le in self.label_encoders.items():
-            probs = torch.softmax(logits[col], dim=1)
-            conf, pred_idx = torch.max(probs, dim=1)
-            results[col] = {
-                "prediction": le.inverse_transform([pred_idx.item()])[0],
-                "confidence": float(conf.item())
-            }
-        
-        # Map V2 'Priority' (capitalized) to generic response
-        if "Priority" in results:
-            results["priority"] = results.pop("Priority")
+            # Map V2 'Priority' (capitalized) to generic response
+            if "Priority" in results:
+                results["priority"] = results.pop("Priority")
+
+            return results
+
+    # Singleton instance
+    classifier_v2 = ClassifierServiceV2()
+else:
+    class ClassifierServiceV2:
+        def __init__(self):
+            self.model = None
+            self.tokenizer = None
+            self.label_encoders = {}
 
-        return results
+        def predict(self, text: str):
+            return {"error": "V2 model not available in this environment"}
 
-# Singleton instance
-classifier_v2 = ClassifierServiceV2()
+    classifier_v2 = ClassifierServiceV2()

backend/services/classifier_v3.py

@@ -1,75 +1,95 @@
 import os
-import torch
-import torch.nn as nn
 import pickle
 import json
-from transformers import BertTokenizerFast, BertModel
+try:
+    import torch
+    import torch.nn as nn
+    from transformers import BertTokenizerFast, BertModel
+    _HAS_TORCH = True
+except Exception:  # pragma: no cover - optional runtime dependency
+    torch = None
+    nn = None
+    BertTokenizerFast = None
+    BertModel = None
+    _HAS_TORCH = False
 
 # Paths
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 MODEL_DIR = os.path.join(BASE_DIR, "models", "classifier-v3")
 
-class MultiOutputClassifierV3(nn.Module):
-    def __init__(self, num_labels_per_output: dict):
-        super().__init__()
-        self.bert = BertModel.from_pretrained("bert-base-uncased")
-        hidden = self.bert.config.hidden_size 
-        self.dropout = nn.Dropout(0.3)
-        self.heads = nn.ModuleDict()
-        for name, n_labels in num_labels_per_output.items():
-            self.heads[name] = nn.Sequential(
-                nn.Linear(hidden, 256),
-                nn.ReLU(),
-                nn.Dropout(0.1),
-                nn.Linear(256, n_labels)
-            )
+if _HAS_TORCH:
+    class MultiOutputClassifierV3(nn.Module):
+        def __init__(self, num_labels_per_output: dict):
+            super().__init__()
+            self.bert = BertModel.from_pretrained("bert-base-uncased")
+            hidden = self.bert.config.hidden_size 
+            self.dropout = nn.Dropout(0.3)
+            self.heads = nn.ModuleDict()
+            for name, n_labels in num_labels_per_output.items():
+                self.heads[name] = nn.Sequential(
+                    nn.Linear(hidden, 256),
+                    nn.ReLU(),
+                    nn.Dropout(0.1),
+                    nn.Linear(256, n_labels)
+                )
 
-    def forward(self, input_ids, attention_mask):
-        outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
-        pooled_output = outputs.pooler_output 
-        pooled_output = self.dropout(pooled_output)
-        logits = {name: head(pooled_output) for name, head in self.heads.items()}
-        return logits
+        def forward(self, input_ids, attention_mask):
+            outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
+            pooled_output = outputs.pooler_output 
+            pooled_output = self.dropout(pooled_output)
+            logits = {name: head(pooled_output) for name, head in self.heads.items()}
+            return logits
 
-class ClassifierServiceV3:
-    def __init__(self):
-        self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
-        self.model = None
-        
-        config_path = os.path.join(MODEL_DIR, "model_config.json")
-        if not os.path.exists(config_path):
-            print(f"[V3 Service] Model not found yet at {MODEL_DIR}")
-            return
+    class ClassifierServiceV3:
+        def __init__(self):
+            self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+            self.model = None
+            
+            config_path = os.path.join(MODEL_DIR, "model_config.json")
+            if not os.path.exists(config_path):
+                print(f"[V3 Service] Model not found yet at {MODEL_DIR}")
+                return
 
-        with open(config_path, "r") as f:
-            self.num_labels = json.load(f)
+            with open(config_path, "r") as f:
+                self.num_labels = json.load(f)
 
-        with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
-            self.label_encoders = pickle.load(f)
+            with open(os.path.join(MODEL_DIR, "label_encoders.pkl"), "rb") as f:
+                self.label_encoders = pickle.load(f)
 
-        self.model = MultiOutputClassifierV3(self.num_labels).to(self.device)
-        self.model.load_state_dict(torch.load(os.path.join(MODEL_DIR, "model.pt"), map_location=self.device))
-        self.model.eval()
+            self.model = MultiOutputClassifierV3(self.num_labels).to(self.device)
+            self.model.load_state_dict(torch.load(os.path.join(MODEL_DIR, "model.pt"), map_location=self.device))
+            self.model.eval()
 
-        self.tokenizer = BertTokenizerFast.from_pretrained(MODEL_DIR)
-        print("[INFO] Classifier Service V3 (Power Model) Loaded.")
+            self.tokenizer = BertTokenizerFast.from_pretrained(MODEL_DIR)
+            print("[INFO] Classifier Service V3 (Power Model) Loaded.")
 
-    def predict(self, text: str):
-        if self.model is None: return {"error": "V3 Model not loaded"}
-        inputs = self.tokenizer(text, return_tensors="pt", truncation=True, padding=True, max_length=256).to(self.device)
-        with torch.no_grad():
-            logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+        def predict(self, text: str):
+            if self.model is None: return {"error": "V3 Model not loaded"}
+            inputs = self.tokenizer(text, return_tensors="pt", truncation=True, padding=True, max_length=256).to(self.device)
+            with torch.no_grad():
+                logits = self.model(inputs["input_ids"], inputs["attention_mask"])
+                
+            results = {}
+            for col, le in self.label_encoders.items():
+                probs = torch.softmax(logits[col], dim=1)
+                conf, pred_idx = torch.max(probs, dim=1)
+                results[col] = {
+                    "prediction": le.inverse_transform([pred_idx.item()])[0],
+                    "confidence": float(conf.item())
+                }
             
-        results = {}
-        for col, le in self.label_encoders.items():
-            probs = torch.softmax(logits[col], dim=1)
-            conf, pred_idx = torch.max(probs, dim=1)
-            results[col] = {
-                "prediction": le.inverse_transform([pred_idx.item()])[0],
-                "confidence": float(conf.item())
-            }
-        
-        if "Priority" in results: results["priority"] = results.pop("Priority")
-        return results
+            if "Priority" in results: results["priority"] = results.pop("Priority")
+            return results
+
+    classifier_v3 = ClassifierServiceV3()
+else:
+    class ClassifierServiceV3:
+        def __init__(self):
+            self.model = None
+            self.tokenizer = None
+            self.label_encoders = {}
+
+        def predict(self, text: str):
+            return {"error": "V3 model not available in this environment"}
 
-classifier_v3 = ClassifierServiceV3()
+    classifier_v3 = ClassifierServiceV3()

backend/services/duplicate_service.py

@@ -7,7 +7,13 @@ import uuid
 import os
 from typing import Any
 
-from sentence_transformers import SentenceTransformer, util
+try:
+    from sentence_transformers import SentenceTransformer, util
+    _HAS_SENTENCE = True
+except Exception:  # pragma: no cover - optional runtime dependency
+    SentenceTransformer = None
+    util = None
+    _HAS_SENTENCE = False
 
 SIMILARITY_THRESHOLD = 0.70
 
@@ -32,6 +38,17 @@ class DuplicateService:
             return
         
         print("[DuplicateService] Loading model...")
+        if not _HAS_SENTENCE:
+            allow_degraded = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
+            self._load_failed = True
+            print("[DuplicateService] sentence-transformers not installed")
+            if allow_degraded:
+                print("[DuplicateService] DEGRADED: Continuing without model (ALLOW_DEGRADED_STARTUP=1)")
+                self.model = None
+                self._loaded = False
+                return
+            else:
+                raise ImportError("sentence-transformers is required for DuplicateService")
         try:
             # Check if a local model path is provided
             model_path = os.environ.get("SENTENCE_TRANSFORMER_MODEL_PATH")
@@ -101,12 +118,20 @@ class DuplicateService:
 
     def generate_embedding(self, text: str) -> list[float] | None:
         """Generate a 384-d embedding for the provided ticket text."""
+        from backend.services.redis_cache import redis_cache
+
+        cached = redis_cache.get_embedding(text)
+        if cached is not None:
+            return cached
+
         self.load()
         if not self.is_available():
             return None
 
         embedding = self.model.encode(text, convert_to_tensor=False, normalize_embeddings=True)
-        return [float(value) for value in embedding.tolist()]
+        values = [float(value) for value in embedding.tolist()]
+        redis_cache.set_embedding(text, values)
+        return values
 
     def _build_result(
         self,

backend/services/gemini_service.py

@@ -2,6 +2,7 @@ import os
 import base64
 import io
 import re
+import json
 from PIL import Image
 from google import genai
 from dotenv import load_dotenv
@@ -222,3 +223,65 @@ class GeminiService:
         except Exception as e:
             print(f"[GeminiService] Bug Analysis Error: {e}")
             return f"Diagnostic analysis failed: {str(e)}"
+
+    def detect_language(self, text: str) -> dict:
+        """
+        Detect language for the given text. Returns ISO-ish language code and English language name.
+        """
+        if not text or not text.strip():
+            return {"code": "en", "name": "English"}
+        if not self._initialized:
+            return {"code": "en", "name": "English"}
+
+        try:
+            prompt = (
+                "Detect the natural language of the following user message. "
+                "Return strict JSON only with keys: code, name. "
+                "Example: {\"code\":\"es\",\"name\":\"Spanish\"}.\n\n"
+                f"Text:\n{text}"
+            )
+            response = self.client.models.generate_content(
+                model=self.model_name,
+                contents=prompt
+            )
+            raw = (response.text or "").strip()
+            match = re.search(r"\{.*\}", raw, re.DOTALL)
+            parsed = json.loads(match.group(0) if match else raw)
+            code = str(parsed.get("code", "en")).lower()
+            name = str(parsed.get("name", "English"))
+            if not code:
+                code = "en"
+            if not name:
+                name = "English"
+            return {"code": code, "name": name}
+        except Exception as e:
+            print(f"[GeminiService] Language detection error: {e}")
+            return {"code": "en", "name": "English"}
+
+    def translate_to_english(self, text: str, source_language: str | None = None) -> str:
+        """
+        Translate user text to English while preserving technical terms.
+        """
+        if not text or not text.strip():
+            return text
+        if not self._initialized:
+            return text
+
+        try:
+            lang_hint = f"Source language: {source_language}. " if source_language else ""
+            prompt = (
+                "Translate the following support ticket text to natural, concise English. "
+                "Preserve technical terms, error codes, product names, and formatting. "
+                "Return only translated text with no prefix or explanation. "
+                f"{lang_hint}\n\n"
+                f"Text:\n{text}"
+            )
+            response = self.client.models.generate_content(
+                model=self.model_name,
+                contents=prompt
+            )
+            translated = (response.text or "").strip()
+            return translated or text
+        except Exception as e:
+            print(f"[GeminiService] Translation error: {e}")
+            return text

backend/services/ner_service.py

@@ -5,12 +5,20 @@ Labels follow pattern: B-B-ENTITY_TYPE, I-B-ENTITY_TYPE, O
 
 import os
 import json
-import torch
-import torch.nn.functional as F
-from transformers import DistilBertTokenizerFast, DistilBertForTokenClassification
+try:
+    import torch
+    import torch.nn.functional as F
+    from transformers import DistilBertTokenizerFast, DistilBertForTokenClassification
+    _HAS_TORCH = True
+except Exception:  # pragma: no cover - optional runtime dependency
+    torch = None
+    F = None
+    DistilBertTokenizerFast = None
+    DistilBertForTokenClassification = None
+    _HAS_TORCH = False
 
 SAVE_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "models", "ner")
-DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+DEVICE = torch.device("cuda" if torch and torch.cuda.is_available() else "cpu") if _HAS_TORCH else None
 MAX_LEN = 128
 
 import re
@@ -41,6 +49,10 @@ class NERService:
         if self._loaded:
             return
 
+        if not _HAS_TORCH:
+            print("[INFO] NER runtime not available; NER model will remain unloaded until dependencies are installed.")
+            return
+
         abs_dir = os.path.abspath(SAVE_DIR)
 
         if not os.path.exists(os.path.join(abs_dir, "model.safetensors")):

backend/services/rag_service.py

@@ -1,5 +1,10 @@
 import os
-from sentence_transformers import SentenceTransformer
+try:
+    from sentence_transformers import SentenceTransformer
+    _HAS_SENTENCE = True
+except Exception:  # pragma: no cover - optional runtime dependency
+    SentenceTransformer = None
+    _HAS_SENTENCE = False
 from supabase import create_client, Client
 from dotenv import load_dotenv
 
@@ -27,6 +32,17 @@ class RagService:
             return
         
         print("[RAG] Loading SentenceTransformer for Knowledge Base...")
+        if not _HAS_SENTENCE:
+            allow_degraded = os.environ.get("ALLOW_DEGRADED_STARTUP", "0") == "1"
+            self._load_failed = True
+            print("[RAG] sentence-transformers not installed")
+            if allow_degraded:
+                print("[RAG] DEGRADED: Continuing without model (ALLOW_DEGRADED_STARTUP=1)")
+                self.model = None
+                self._loaded = False
+                return
+            else:
+                raise ImportError("sentence-transformers is required for RagService")
         try:
             # Check if a local model path is provided
             model_path = os.environ.get("SENTENCE_TRANSFORMER_MODEL_PATH")

backend/services/sla_service.py

@@ -14,6 +14,10 @@ import os
 from datetime import datetime, timedelta, timezone
 from typing import Any, Callable, Optional
 
+from fastapi import BackgroundTasks
+
+from backend.sla_checker import dispatch_slack_alert
+
 try:
     from dotenv import load_dotenv
 except ImportError:
@@ -110,11 +114,12 @@ class SlaEscalationService:
         now_fn: Callable[[], datetime] = _utc_now,
         notification_router: Any = None,
     ):
-        self.supabase = supabase_client
+        from backend.auth.crypto import wrap_client
+        self.supabase = wrap_client(supabase_client)
         self.now_fn = now_fn
         self.notification_router = notification_router
 
-    def run_once(self) -> dict[str, int | str]:
+    def run_once(self, background_tasks: BackgroundTasks | None = None) -> dict[str, int | str]:
         stats: dict[str, int | str] = {
             "processed_count": 0,
             "breached_count": 0,
@@ -136,7 +141,7 @@ class SlaEscalationService:
                 if not self._should_breach(ticket, now):
                     stats["skipped_count"] = int(stats["skipped_count"]) + 1
                     continue
-                self._breach_ticket(ticket, now)
+                self._breach_ticket(ticket, now, background_tasks=background_tasks)
                 stats["breached_count"] = int(stats["breached_count"]) + 1
             except Exception as exc:
                 stats["error_count"] = int(stats["error_count"]) + 1
@@ -169,7 +174,13 @@ class SlaEscalationService:
             return False
         return classify_sla_status(ticket.get("sla_breach_at"), now) == "BREACHED"
 
-    def _breach_ticket(self, ticket: dict[str, Any], now: datetime) -> None:
+    def _breach_ticket(
+        self,
+        ticket: dict[str, Any],
+        now: datetime,
+        *,
+        background_tasks: BackgroundTasks | None = None,
+    ) -> None:
         ticket_id = str(ticket.get("id"))
         company_id = ticket.get("company_id")
         escalation_level = int(ticket.get("escalation_level") or 0) + 1
@@ -185,6 +196,7 @@ class SlaEscalationService:
 
         self._insert_audit_log(ticket, escalation_level, timestamp)
         self._emit_system_message(ticket, escalation_level, timestamp)
+        self._dispatch_breach_alert(ticket, now, background_tasks=background_tasks)
 
         logger.warning(
             "SLA breached | ticket_id=%s | company_id=%s | priority=%s | level=%s",
@@ -194,6 +206,31 @@ class SlaEscalationService:
             escalation_level,
         )
 
+    def _dispatch_breach_alert(
+        self,
+        ticket: dict[str, Any],
+        breach_time: datetime,
+        *,
+        background_tasks: BackgroundTasks | None = None,
+    ) -> None:
+        ticket_id = str(ticket.get("id") or "")
+        subject = str(ticket.get("subject") or "Untitled ticket")
+        category = str(ticket.get("priority") or "Uncategorized")
+        assignee = str(ticket.get("assigned_team") or "Unassigned")
+
+        if background_tasks is not None:
+            background_tasks.add_task(
+                dispatch_slack_alert,
+                ticket_id,
+                subject,
+                category,
+                assignee,
+                breach_time,
+            )
+            return
+
+        dispatch_slack_alert(ticket_id, subject, category, assignee, breach_time)
+
     def _insert_audit_log(self, ticket: dict[str, Any], escalation_level: int, timestamp: str) -> None:
         ticket_id = str(ticket.get("id"))
         self.supabase.table("audit_logs").insert(

backend/services/slack_notifier.py

@@ -48,9 +48,9 @@ def build_slack_payload(ticket: dict[str, Any]) -> dict:
     ticket_id = str(ticket.get("id", "???"))
     ticket_ref = f"#T-{ticket_id[-4:]}" if len(ticket_id) >= 4 else f"#T-{ticket_id}"
     subject = ticket.get("subject") or "Untitled ticket"
-    priority = str(ticket.get("priority", "unknown")).upper()
+    priority = str(ticket.get("priority") or "unknown").upper()
     assigned_team = ticket.get("assigned_team") or "Unassigned"
-    company = ticket.get("company") or ticket.get("company_id") or "Unknown"
+    company = ticket.get("company") or ticket.get("company_id") or "UNKNOWN"
     breach_at = ticket.get("sla_breach_at") or "N/A"
 
     # Color based on priority

backend/tests/conftest.py

@@ -272,6 +272,7 @@ def mock_ai_services(request):
         "test_redis_cache.py",
         "test_semantic_duplicates.py",
         "test_auth_cookie.py",
+        "test_mobile_supabase_env.py",
     }:
         yield
         return