session_start();
date_default_timezone_set('America/Lima');

define('BASE_PATH', __DIR__);
if (file_exists(BASE_PATH . '/config.php')) {
    require BASE_PATH . '/config.php';
}

if (!defined('APP_NAME')) define('APP_NAME', 'JAMA Store');
if (!defined('APP_URL')) define('APP_URL', '');
if (!defined('ADMIN_EMAIL')) define('ADMIN_EMAIL', 'admin@jama.pe');
if (!defined('ADMIN_PASSWORD')) define('ADMIN_PASSWORD', 'jhoan14');
if (!defined('RESET_ADMIN_PASSWORD')) define('RESET_ADMIN_PASSWORD', false);
if (!defined('YAPE_PHONE')) define('YAPE_PHONE', '+51 906264890');
if (!defined('YAPE_RECIPIENT')) define('YAPE_RECIPIENT', 'JULIO MIN*');
if (!defined('CONTACT_PHONE')) define('CONTACT_PHONE', 'REDES SOCIALES');
if (!defined('CONTACT_EMAIL')) define('CONTACT_EMAIL', 'ventas@jama.pe');
if (!defined('STORE_CITY')) define('STORE_CITY', 'Peru');
if (!defined('GOOGLE_CLIENT_ID')) define('GOOGLE_CLIENT_ID', '');
if (!defined('GOOGLE_CLIENT_SECRET')) define('GOOGLE_CLIENT_SECRET', '');
if (!defined('GOOGLE_REDIRECT_URI')) define('GOOGLE_REDIRECT_URI', '');

if (!defined('DATA_DIR')) define('DATA_DIR', BASE_PATH . '/data');
if (!defined('DB_PATH')) define('DB_PATH', DATA_DIR . '/jama_store.sqlite');
if (!defined('UPLOAD_PRODUCTS_DIR')) define('UPLOAD_PRODUCTS_DIR', BASE_PATH . '/uploads/products');
if (!defined('UPLOAD_SOCIAL_DIR')) define('UPLOAD_SOCIAL_DIR', BASE_PATH . '/uploads/social');
if (!defined('RECEIPTS_DIR')) define('RECEIPTS_DIR', BASE_PATH . '/private/receipts');

foreach (array(DATA_DIR, UPLOAD_PRODUCTS_DIR, UPLOAD_SOCIAL_DIR, RECEIPTS_DIR) as $dir) {
    if (!is_dir($dir)) {
        mkdir($dir, 0755, true);
    }
}

function e($value) {
    return htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8');
}

function money($value) {
    return 'S/ ' . number_format((float)$value, 2);
}

function now_text() {
    return date('Y-m-d H:i:s');
}

function url($route = 'inicio', $params = array()) {
    if ($route && $route !== 'inicio') {
        $params = array('r' => $route) + $params;
    }
    return 'index.php' . ($params ? '?' . http_build_query($params) : '');
}

function redirect_to($route = 'inicio', $params = array()) {
    header('Location: ' . url($route, $params));
    exit;
}

function csrf_token() {
    if (empty($_SESSION['csrf'])) {
        $_SESSION['csrf'] = bin2hex(random_bytes(24));
    }
    return $_SESSION['csrf'];
}

function csrf_field() {
    return '<input type="hidden" name="csrf" value="' . e(csrf_token()) . '">';
}

function check_csrf() {
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        return;
    }
    $token = isset($_POST['csrf']) ? $_POST['csrf'] : '';
    if (!$token || empty($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], $token)) {
        http_response_code(403);
        echo 'Solicitud no valida. Vuelve atras y recarga la pagina.';
        exit;
    }
}

function current_route() {
    if (!empty($_GET['r'])) {
        return trim($_GET['r'], '/');
    }
    $path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
    $base = str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME']));
    if ($base !== '/' && strpos($path, $base) === 0) {
        $path = substr($path, strlen($base));
    }
    $path = trim($path, '/');
    if ($path === '' || $path === 'index.php') {
        return 'inicio';
    }
    $map = array(
        'login/google' => 'google-login',
        'login/google/callback' => 'google-callback',
        'admin/pedidos' => 'admin-pedidos',
        'admin/productos' => 'admin-productos',
        'admin/clientes' => 'admin-clientes',
        'admin/promociones' => 'admin-promociones',
        'admin/redes' => 'admin-redes',
        'admin/backup' => 'admin-backup',
        'admin/boleta' => 'admin-boleta'
    );
    return isset($map[$path]) ? $map[$path] : $path;
}

function db() {
    static $pdo = null;
    if ($pdo) {
        return $pdo;
    }
    if (!extension_loaded('pdo_sqlite')) {
        http_response_code(500);
        echo '<h1>Falta activar SQLite en PHP</h1>';
        echo '<p>Activa la extension <strong>pdo_sqlite</strong> en XAMPP o en tu hosting cPanel.</p>';
        exit;
    }
    $pdo = new PDO('sqlite:' . DB_PATH);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
    init_db($pdo);
    return $pdo;
}

function run_sql($sql, $params = array()) {
    $stmt = db()->prepare($sql);
    $stmt->execute($params);
    return $stmt;
}

function one($sql, $params = array()) {
    $stmt = run_sql($sql, $params);
    $row = $stmt->fetch();
    return $row ? $row : null;
}

function all_rows($sql, $params = array()) {
    $stmt = run_sql($sql, $params);
    return $stmt->fetchAll();
}

function init_db($pdo) {
    static $done = false;
    if ($done) {
        return;
    }
    $done = true;
    $pdo->exec("CREATE TABLE IF NOT EXISTS users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        name TEXT NOT NULL,
        email TEXT NOT NULL UNIQUE,
        password_hash TEXT NOT NULL,
        role TEXT NOT NULL DEFAULT 'client',
        google_id TEXT,
        auth_provider TEXT NOT NULL DEFAULT 'email',
        promo_opt_in INTEGER NOT NULL DEFAULT 1,
        created_at TEXT NOT NULL
    )");
    $pdo->exec("CREATE TABLE IF NOT EXISTS products (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        name TEXT NOT NULL,
        category TEXT NOT NULL,
        price REAL NOT NULL,
        promo_price REAL,
        stock INTEGER NOT NULL DEFAULT 0,
        sizes TEXT,
        description TEXT,
        image TEXT,
        active INTEGER NOT NULL DEFAULT 1,
        created_at TEXT NOT NULL
    )");
    $pdo->exec("CREATE TABLE IF NOT EXISTS cart_items (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER NOT NULL,
        product_id INTEGER NOT NULL,
        size TEXT,
        qty INTEGER NOT NULL DEFAULT 1,
        updated_at TEXT NOT NULL
    )");
    $pdo->exec("CREATE TABLE IF NOT EXISTS orders (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id INTEGER NOT NULL,
        customer_name TEXT NOT NULL,
        email TEXT NOT NULL,
        phone TEXT NOT NULL,
        address TEXT NOT NULL,
        shipping_agency TEXT NOT NULL DEFAULT 'SHALOM',
        payment_method TEXT NOT NULL DEFAULT 'Yape',
        yape_phone TEXT NOT NULL,
        yape_recipient TEXT NOT NULL,
        yape_name TEXT,
        yape_operation TEXT,
        receipt_file TEXT,
        total REAL NOT NULL DEFAULT 0,
        status TEXT NOT NULL DEFAULT 'Pendiente',
        payment_status TEXT NOT NULL DEFAULT 'En revision',
        admin_hidden INTEGER NOT NULL DEFAULT 0,
        created_at TEXT NOT NULL
    )");
    $pdo->exec("CREATE TABLE IF NOT EXISTS order_items (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        order_id INTEGER NOT NULL,
        product_id INTEGER,
        product_name TEXT NOT NULL,
        price REAL NOT NULL,
        quantity INTEGER NOT NULL,
        size TEXT,
        image TEXT
    )");
    $pdo->exec("CREATE TABLE IF NOT EXISTS promotions (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        title TEXT NOT NULL,
        message TEXT NOT NULL,
        discount TEXT,
        recipients INTEGER NOT NULL DEFAULT 0,
        sent_at TEXT,
        created_at TEXT NOT NULL
    )");
    $pdo->exec("CREATE TABLE IF NOT EXISTS social_links (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        name TEXT NOT NULL,
        url TEXT NOT NULL,
        icon TEXT,
        active INTEGER NOT NULL DEFAULT 1,
        created_at TEXT NOT NULL
    )");

    $pdo->exec("CREATE TABLE IF NOT EXISTS admin_settings (
        setting_key TEXT PRIMARY KEY,
        setting_value TEXT
    )");

    $admin = $pdo->prepare("SELECT * FROM users WHERE email = ?");
    $admin->execute(array(strtolower(ADMIN_EMAIL)));
    $adminRow = $admin->fetch();
    if (!$adminRow) {
        $stmt = $pdo->prepare("INSERT INTO users (name, email, password_hash, role, promo_opt_in, created_at) VALUES (?, ?, ?, 'admin', 0, ?)");
        $stmt->execute(array('Administrador JAMA', strtolower(ADMIN_EMAIL), password_hash(ADMIN_PASSWORD, PASSWORD_DEFAULT), now_text()));
    } elseif (RESET_ADMIN_PASSWORD) {
        $stmt = $pdo->prepare("UPDATE users SET password_hash = ?, role = 'admin' WHERE email = ?");
        $stmt->execute(array(password_hash(ADMIN_PASSWORD, PASSWORD_DEFAULT), strtolower(ADMIN_EMAIL)));
    }

    $count = $pdo->query("SELECT COUNT(*) AS total FROM products")->fetch();
    if ((int)$count['total'] === 0) {
        $products = array(
            array('Polo JAMA Signature', 'Polos', 59, 49, 18, 'S,M,L,XL', 'Polo urbano de algodon, corte comodo y detalle JAMA al frente.'),
            array('Jogger JAMA Street', 'Pantalones', 89, 79, 10, 'S,M,L,XL', 'Jogger urbano para diario, suave y con estilo callejero.'),
            array('Gorra JAMA Urban', 'Accesorios', 39, null, 25, 'Unica', 'Gorra moderna para completar el outfit JAMA.'),
            array('Perfume JAMA Noir', 'Perfumes', 89, 79, 15, '50ml,100ml', 'Aroma elegante, intenso y urbano. Ideal para noche y salidas.'),
            array('Perfume JAMA Fresh', 'Perfumes', 75, null, 20, '50ml,100ml,Unisex', 'Fragancia fresca y limpia para uso diario.'),
            array('Perfume JAMA Gold', 'Perfumes', 99, 89, 10, '100ml,Unisex', 'Fragancia premium dulce con fondo amaderado.')
        );
        $stmt = $pdo->prepare("INSERT INTO products (name, category, price, promo_price, stock, sizes, description, image, active, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, '', 1, ?)");
        foreach ($products as $p) {
            $stmt->execute(array($p[0], $p[1], $p[2], $p[3], $p[4], $p[5], $p[6], now_text()));
        }
    }
}

function admin_setting($key, $default = '') {
    $row = one("SELECT setting_value FROM admin_settings WHERE setting_key = ?", array($key));
    return $row ? $row['setting_value'] : $default;
}

function set_admin_setting($key, $value) {
    run_sql("INSERT OR REPLACE INTO admin_settings (setting_key, setting_value) VALUES (?, ?)", array($key, $value));
}

function current_user() {
    if (empty($_SESSION['user_id'])) {
        return null;
    }
    return one("SELECT * FROM users WHERE id = ?", array((int)$_SESSION['user_id']));
}

function is_admin() {
    $user = current_user();
    return $user && $user['role'] === 'admin';
}

function require_user() {
    if (!current_user()) {
        redirect_to('login', array('err' => 'Inicia sesion para continuar.'));
    }
}

function require_admin() {
    if (!is_admin()) {
        redirect_to('admin-login', array('err' => 'Ingresa como administrador.'));
    }
}

function login_user($user) {
    $_SESSION['user_id'] = (int)$user['id'];
    merge_session_cart_to_user((int)$user['id']);
}

function cart_key($productId, $size) {
    return (int)$productId . '|' . trim((string)$size);
}

function parse_cart_key($key) {
    $parts = explode('|', $key, 2);
    return array((int)$parts[0], isset($parts[1]) ? $parts[1] : '');
}

function session_cart() {
    return isset($_SESSION['cart']) && is_array($_SESSION['cart']) ? $_SESSION['cart'] : array();
}

function save_session_cart($cart) {
    $_SESSION['cart'] = $cart;
}

function user_cart($userId) {
    $cart = array();
    $rows = all_rows("SELECT product_id, size, qty FROM cart_items WHERE user_id = ?", array($userId));
    foreach ($rows as $row) {
        $cart[cart_key($row['product_id'], $row['size'])] = (int)$row['qty'];
    }
    return $cart;
}

function save_user_cart($userId, $cart) {
    run_sql("DELETE FROM cart_items WHERE user_id = ?", array($userId));
    foreach ($cart as $key => $qty) {
        list($productId, $size) = parse_cart_key($key);
        if ($productId > 0 && $qty > 0) {
            run_sql("INSERT INTO cart_items (user_id, product_id, size, qty, updated_at) VALUES (?, ?, ?, ?, ?)", array($userId, $productId, $size, (int)$qty, now_text()));
        }
    }
}

function merge_session_cart_to_user($userId) {
    $session = session_cart();
    if (!$session) {
        return;
    }
    $cart = user_cart($userId);
    foreach ($session as $key => $qty) {
        $cart[$key] = isset($cart[$key]) ? $cart[$key] + (int)$qty : (int)$qty;
    }
    save_user_cart($userId, $cart);
    save_session_cart(array());
}

function get_cart() {
    $user = current_user();
    if ($user && $user['role'] === 'client') {
        return user_cart((int)$user['id']);
    }
    return session_cart();
}

function save_cart($cart) {
    $user = current_user();
    if ($user && $user['role'] === 'client') {
        save_user_cart((int)$user['id'], $cart);
    } else {
        save_session_cart($cart);
    }
}

function cart_count() {
    $total = 0;
    foreach (get_cart() as $qty) {
        $total += (int)$qty;
    }
    return $total;
}

function product_price($product) {
    if ($product['promo_price'] !== null && $product['promo_price'] !== '') {
        return (float)$product['promo_price'];
    }
    return (float)$product['price'];
}

function image_tag($path, $class = '', $alt = '') {
    if (!$path) {
        return '<div class="placeholder"><div><strong>JAMA</strong><span>Store</span></div></div>';
    }
    return '<img class="' . e($class) . '" src="' . e($path) . '" alt="' . e($alt) . '">';
}

function product_media($product, $small = false) {
    if ($small) {
        if (!$product['image']) {
            return '<span class="mini-img product-blank">JAMA</span>';
        }
        return '<img class="mini-img" src="' . e($product['image']) . '" alt="' . e($product['name']) . '">';
    }
    return image_tag($product['image'], '', $product['name']);
}

function product_card($product) {
    $price = product_price($product);
    $old = ($product['promo_price'] !== null && $product['promo_price'] !== '') ? '<span class="old-price">' . money($product['price']) . '</span>' : '';
    $sizes = '';
    foreach (array_filter(array_map('trim', explode(',', (string)$product['sizes']))) as $size) {
        $sizes .= '<span>' . e($size) . '</span>';
    }
    return '<article class="product-card">
        <a class="product-media" href="' . e(url('producto', array('id' => $product['id']))) . '">' . product_media($product) . '</a>
        <div class="product-body">
            <span class="tag">' . e($product['category']) . '</span>
            <div class="product-title">
                <h3>' . e($product['name']) . '</h3>
                <div class="price">' . $old . money($price) . '</div>
            </div>
            <p>' . e($product['description']) . '</p>
            <div class="stock-row"><span>Disponible: ' . (int)$product['stock'] . '</span><div class="size-list">' . $sizes . '</div></div>
            <a class="btn secondary" href="' . e(url('producto', array('id' => $product['id']))) . '">Ver prenda</a>
        </div>
    </article>';
}

function social_links_html() {
    $rows = all_rows("SELECT * FROM social_links WHERE active = 1 ORDER BY created_at DESC");
    if (!$rows) {
        return '<p class="muted social-empty">redes @.</p>';
    }
    $html = '<div class="social-list">';
    foreach ($rows as $row) {
        $icon = $row['icon'] ? '<img class="social-icon" src="' . e($row['icon']) . '" alt="' . e($row['name']) . '">' : '<span class="social-icon social-initial">' . e(substr($row['name'], 0, 1)) . '</span>';
        $html .= '<a class="social-link" target="_blank" rel="noopener" href="' . e($row['url']) . '">' . $icon . e($row['name']) . '</a>';
    }
    return $html . '</div>';
}

function notice_html() {
    if (!empty($_GET['ok'])) {
        return '<div class="notice">' . e($_GET['ok']) . '</div>';
    }
    if (!empty($_GET['err'])) {
        return '<div class="notice err">' . e($_GET['err']) . '</div>';
    }
    return '';
}

function shipping_badge() {
    return '<span class="shipping-badge"><img src="static/shalom-logo.png" alt="Shalom">SHALOM</span>';
}

function page($title, $content, $active = '') {
    $user = current_user();
    $userLinks = '';
    if ($user) {
        if ($user['role'] === 'admin') {
            $userLinks .= '<a href="' . e(url('admin')) . '">Panel admin</a>';
            $userLinks .= '<a href="' . e(url('logout')) . '">Salir (Administrador)</a>';
        } else {
            $userLinks .= '<a href="' . e(url('mis-pedidos')) . '">Mis pedidos</a>';
            $userLinks .= '<a href="' . e(url('logout')) . '">Salir</a>';
        }
    } else {
        $userLinks .= '<a href="' . e(url('login')) . '">Ingresar</a>';
        $userLinks .= '<a href="' . e(url('registro')) . '">Crear cuenta</a>';
    }
    $pageTitle = $title . ' - ' . APP_NAME;
    $seoHead = '';

    if ($active === 'inicio') {
        $pageTitle = 'JAMA Store Perú | Ropa Urbana y Perfumes';

        $seoHead = '
        <meta name="description" content="Compra ropa urbana, perfumes y promociones en JAMA Store Perú. Compra online, paga con Yape y recibe tus pedidos mediante Shalom.">
        <meta name="robots" content="index, follow">
        <link rel="canonical" href="https://jamastore.net.pe/">

        <meta property="og:title" content="JAMA Store Perú | Ropa Urbana y Perfumes">
        <meta property="og:description" content="Ropa urbana, perfumes y promociones en JAMA Store Perú. Compra online de forma rápida y segura.">
        <meta property="og:url" content="https://jamastore.net.pe/">
        <meta property="og:type" content="website">
        <meta property="og:site_name" content="JAMA Store Perú">
        ';
    }

    echo '<!doctype html><html lang="es"><head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <title>' . e($pageTitle) . '</title>
        ' . $seoHead . '
        <link rel="stylesheet" href="static/styles.css?v=php1">
        <style>
        .jama-delivery-card{position:relative;overflow:hidden;padding:20px!important;border:1px solid rgba(255,255,255,.12)!important;border-radius:22px!important;background:linear-gradient(145deg,rgba(255,255,255,.055),rgba(255,255,255,.018))!important;box-shadow:0 18px 45px rgba(0,0,0,.16)}
        .jama-delivery-card:before{content:"";position:absolute;width:150px;height:150px;border-radius:50%;background:rgba(220,35,45,.11);right:-55px;top:-65px;pointer-events:none}
        .jama-delivery-head{position:relative;display:flex;align-items:center;gap:13px;margin-bottom:17px}
        .jama-delivery-head-icon{width:42px;height:42px;display:grid;place-items:center;border-radius:14px;background:linear-gradient(135deg,#d91f2b,#8e0f18);color:#fff;font-size:19px;box-shadow:0 9px 22px rgba(217,31,43,.25);flex:0 0 auto}
        .jama-delivery-head div:last-child{display:flex;flex-direction:column;gap:2px}
        .jama-delivery-head span{font-size:10px;letter-spacing:1.7px;font-weight:800;color:#d6a54a}
        .jama-delivery-head strong{font-size:17px;line-height:1.2}
        .jama-delivery-head small{font-size:12px;opacity:.66;margin-top:3px}
        .jama-delivery-grid{position:relative;display:grid;grid-template-columns:1fr 1.35fr;gap:12px}
        .jama-delivery-field{display:flex;gap:11px;align-items:flex-start;padding:14px;border-radius:16px;border:1px solid rgba(255,255,255,.09);background:rgba(0,0,0,.16);transition:.2s ease}
        .jama-delivery-field:focus-within{border-color:rgba(217,31,43,.65);box-shadow:0 0 0 3px rgba(217,31,43,.09);transform:translateY(-1px)}
        .jama-delivery-icon{width:36px;height:36px;display:grid;place-items:center;border-radius:12px;background:rgba(217,31,43,.13);color:#ff646d;font-size:18px;flex:0 0 auto}
        .jama-delivery-copy{display:flex;flex-direction:column;gap:3px;min-width:0;width:100%}
        .jama-delivery-copy small{font-size:9px;letter-spacing:1.3px;font-weight:800;color:#d6a54a}
        .jama-delivery-copy strong{font-size:13px}
        .jama-delivery-copy input{width:100%;margin-top:6px;border:0!important;border-bottom:1px solid rgba(255,255,255,.15)!important;border-radius:0!important;background:transparent!important;padding:9px 2px!important;outline:none;color:inherit;font-size:14px}
        .jama-delivery-copy input::placeholder{opacity:.45}
        .jama-delivery-note{position:relative;display:flex;align-items:center;gap:7px;margin-top:12px;padding:9px 11px;border-radius:12px;background:rgba(214,165,74,.075);font-size:11px;opacity:.76}
        .jama-delivery-note span{color:#d6a54a;font-weight:900}
        @media(max-width:720px){.jama-delivery-card{padding:16px!important;border-radius:18px!important}.jama-delivery-grid{grid-template-columns:1fr}.jama-delivery-head strong{font-size:15px}.jama-delivery-head small{font-size:11px}.jama-delivery-field{padding:13px}}

        /* Confirmacion Yape: compacta y elegante */
        .jama-yape-confirm{grid-column:1/-1;display:grid;grid-template-columns:1fr 1fr;gap:12px;padding:14px;border-radius:18px;border:1px solid rgba(115,66,180,.18);background:linear-gradient(145deg,rgba(115,66,180,.075),rgba(255,255,255,.018))}
        .jama-yape-confirm-field{display:flex;align-items:center;gap:10px;padding:12px 13px;border-radius:14px;background:rgba(0,0,0,.14);border:1px solid rgba(255,255,255,.08);transition:.2s ease}
        .jama-yape-confirm-field:focus-within{border-color:rgba(151,92,220,.55);box-shadow:0 0 0 3px rgba(151,92,220,.08)}
        .jama-yape-confirm-icon{width:34px;height:34px;display:grid;place-items:center;border-radius:11px;background:rgba(151,92,220,.16);color:#c9a8ff;font-size:16px;flex:0 0 auto}
        .jama-yape-confirm-copy{display:flex;flex-direction:column;gap:2px;min-width:0;width:100%}
        .jama-yape-confirm-copy small{font-size:9px;letter-spacing:1.2px;font-weight:800;color:#c9a8ff}
        .jama-yape-confirm-copy strong{font-size:12px}
        .jama-yape-confirm-copy input{width:100%;margin-top:5px;border:0!important;border-bottom:1px solid rgba(255,255,255,.14)!important;border-radius:0!important;background:transparent!important;padding:8px 1px!important;color:inherit;font-size:13px;outline:none}

        /* Detalle del pedido del cliente */
        .jama-order-detail-head{margin-bottom:18px}
        .jama-order-layout{display:grid;grid-template-columns:minmax(0,1.55fr) minmax(290px,.75fr);gap:18px;align-items:start}
        .jama-order-card{overflow:hidden;padding:0!important;border-radius:22px!important;border:1px solid rgba(255,255,255,.10)!important;background:linear-gradient(145deg,rgba(255,255,255,.045),rgba(255,255,255,.018))!important;box-shadow:0 16px 42px rgba(0,0,0,.15)}
        .jama-order-card-head{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:17px 18px;border-bottom:1px solid rgba(255,255,255,.08)}
        .jama-order-card-head div{display:flex;flex-direction:column;gap:2px}
        .jama-order-card-head span{font-size:9px;letter-spacing:1.5px;font-weight:800;color:#d6a54a}
        .jama-order-card-head strong{font-size:15px}
        .jama-order-table-wrap{overflow-x:auto}
        .jama-order-table{width:100%;border-collapse:collapse}
        .jama-order-table th{padding:12px 16px;font-size:9px;letter-spacing:1.1px;text-transform:uppercase;opacity:.58;text-align:left;border-bottom:1px solid rgba(255,255,255,.08)}
        .jama-order-table td{padding:15px 16px;vertical-align:middle;border-bottom:1px solid rgba(255,255,255,.065)}
        .jama-order-table tbody tr:last-child td{border-bottom:0}
        .jama-order-table .right{text-align:right}
        .jama-order-product{display:flex;align-items:center;gap:11px;min-width:210px}
        .jama-order-product .mini-img{width:52px;height:52px;border-radius:13px;object-fit:cover;flex:0 0 auto}
        .jama-order-product strong{font-size:13px;display:block}
        .jama-order-product small{font-size:10px;opacity:.58}
        .jama-order-qty{display:inline-grid;place-items:center;min-width:31px;height:29px;padding:0 8px;border-radius:10px;background:rgba(255,255,255,.06);font-size:12px;font-weight:800}
        .jama-order-summary{padding:17px!important;border-radius:22px!important;border:1px solid rgba(255,255,255,.10)!important;background:linear-gradient(145deg,rgba(255,255,255,.045),rgba(255,255,255,.018))!important;box-shadow:0 16px 42px rgba(0,0,0,.15)}
        .jama-order-summary-title{display:flex;align-items:center;gap:11px;margin-bottom:14px;padding-bottom:13px;border-bottom:1px solid rgba(255,255,255,.08)}
        .jama-order-summary-title-icon{width:38px;height:38px;display:grid;place-items:center;border-radius:12px;background:rgba(217,31,43,.13);color:#ff646d;font-size:17px}
        .jama-order-summary-title div{display:flex;flex-direction:column;gap:1px}
        .jama-order-summary-title span{font-size:9px;letter-spacing:1.4px;font-weight:800;color:#d6a54a}
        .jama-order-summary-title strong{font-size:15px}
        .jama-order-info{display:flex;gap:10px;align-items:flex-start;padding:12px 0;border-bottom:1px solid rgba(255,255,255,.07)}
        .jama-order-info:last-of-type{border-bottom:0}
        .jama-order-info-icon{width:33px;height:33px;display:grid;place-items:center;border-radius:10px;background:rgba(255,255,255,.055);font-size:15px;flex:0 0 auto}
        .jama-order-info-copy{display:flex;flex-direction:column;gap:3px;min-width:0}
        .jama-order-info-copy small{font-size:9px;letter-spacing:1.1px;font-weight:800;opacity:.52}
        .jama-order-info-copy strong{font-size:12.5px;line-height:1.4;word-break:break-word}
        .jama-order-info-copy .shipping-badge{margin-top:3px}
        .jama-order-yape-data{display:grid;grid-template-columns:1fr 1fr;gap:8px;margin-top:5px}
        .jama-order-yape-data div{padding:8px 9px;border-radius:10px;background:rgba(115,66,180,.08)}
        .jama-order-yape-data span{display:block;font-size:8px;letter-spacing:.9px;opacity:.52;margin-bottom:2px}
        .jama-order-yape-data b{font-size:11px;font-weight:800}
        .jama-order-total{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:14px;padding:15px;border-radius:15px;background:linear-gradient(135deg,rgba(217,31,43,.16),rgba(214,165,74,.08));border:1px solid rgba(217,31,43,.18)}
        .jama-order-total span{font-size:10px;letter-spacing:1.2px;font-weight:800;opacity:.62}
        .jama-order-total strong{font-size:20px;color:#fff}
        @media(max-width:900px){.jama-order-layout{grid-template-columns:1fr}.jama-order-summary{order:-1}}
        @media(max-width:720px){.jama-yape-confirm{grid-template-columns:1fr;padding:12px}.jama-order-card,.jama-order-summary{border-radius:18px!important}.jama-order-table th,.jama-order-table td{padding:11px 12px}.jama-order-product .mini-img{width:45px;height:45px}.jama-order-yape-data{grid-template-columns:1fr}}

        /* Footer JAMA */
        .jama-footer{margin-top:42px;padding:0 0 20px;background:linear-gradient(180deg,rgba(255,255,255,.015),rgba(0,0,0,.14));border-top:1px solid rgba(255,255,255,.07)}
        .jama-footer-main{display:grid;grid-template-columns:1.25fr 1fr 1fr;gap:30px;padding-top:34px;padding-bottom:30px}
        .jama-footer-brand,.jama-footer-block{min-width:0}
        .jama-footer-logo{display:inline-flex;align-items:center;gap:11px;color:inherit;text-decoration:none;margin-bottom:14px}.jama-footer-logo img{width:42px;height:42px;object-fit:cover;border-radius:12px;border:1px solid rgba(255,255,255,.12)}.jama-footer-logo span{display:flex;align-items:baseline;gap:5px;font-size:20px;font-weight:900;letter-spacing:.4px}.jama-footer-logo small{font-size:9px;letter-spacing:1.8px;opacity:.55}
        .jama-footer-brand p,.jama-footer-social p{margin:0 0 14px;max-width:430px;color:rgba(255,255,255,.58);font-size:12.5px;line-height:1.65}.jama-footer-origin{display:inline-flex;padding:6px 10px;border-radius:999px;background:rgba(255,255,255,.045);border:1px solid rgba(255,255,255,.07);font-size:10px;font-weight:800;letter-spacing:.7px;color:rgba(255,255,255,.72)}
        .jama-footer-label{display:block;margin:2px 0 14px;color:#fff;font-size:11px;font-weight:900;letter-spacing:1.3px;text-transform:uppercase}
        .jama-footer-service{display:flex;align-items:center;gap:10px;padding:10px 0;border-bottom:1px solid rgba(255,255,255,.06)}.jama-footer-service:last-child{border-bottom:0}.jama-footer-service-icon{width:31px;height:31px;display:grid;place-items:center;border-radius:10px;background:rgba(113,66,181,.16);color:#d5baff;font-weight:900}.jama-footer-service>div{display:flex;flex-direction:column;gap:2px}.jama-footer-service strong{font-size:12px}.jama-footer-service small{font-size:10.5px;color:rgba(255,255,255,.48)}.jama-footer-service .shipping-badge{margin:0;flex:0 0 auto}
        .jama-footer-social .social-list{display:flex;flex-wrap:wrap;gap:8px}.jama-footer-social .social-link{display:inline-flex;align-items:center;gap:7px;padding:8px 10px;border:1px solid rgba(255,255,255,.08);border-radius:11px;background:rgba(255,255,255,.03);font-size:11px;text-decoration:none}.jama-footer-social .social-icon{width:22px;height:22px;border-radius:7px;object-fit:cover}
        .jama-footer-bottom{display:flex;align-items:center;justify-content:space-between;gap:18px;padding-top:17px;border-top:1px solid rgba(255,255,255,.07)}.jama-footer-links{display:flex;flex-wrap:wrap;gap:8px 15px}.jama-footer-links a{color:rgba(255,255,255,.52);font-size:10.5px;text-decoration:none}.jama-footer-links a:hover{color:#fff}.jama-footer-copy{color:rgba(255,255,255,.38);font-size:10px;white-space:nowrap}
        @media(max-width:900px){.jama-footer-main{grid-template-columns:1fr 1fr}.jama-footer-brand{grid-column:1/-1}.jama-footer-bottom{align-items:flex-start;flex-direction:column}.jama-footer-copy{white-space:normal}}
        @media(max-width:620px){.jama-footer-main{grid-template-columns:1fr;gap:24px;padding-top:28px}.jama-footer-brand{grid-column:auto}.jama-footer-bottom{padding-bottom:4px}}
        </style>
    </head><body>
    <header class="topbar"><div class="wrap nav">
        <a class="brand" href="' . e(url('inicio')) . '"><img class="brand-mark" src="static/jama-brand.jpeg" alt="JAMA Store"><span>JAMA<small>Store</small></span></a>
        <nav class="nav-links">
            <a class="' . ($active === 'inicio' ? 'active' : '') . '" href="' . e(url('inicio')) . '">Inicio</a>
            <a class="' . ($active === 'catalogo' ? 'active' : '') . '" href="' . e(url('catalogo')) . '">Catalogo</a>
            <a class="' . ($active === 'perfumes' ? 'active' : '') . '" href="' . e(url('perfumes')) . '">Perfumes</a>
            <a class="' . ($active === 'promos' ? 'active' : '') . '" href="' . e(url('promos')) . '">Promos</a>
            ' . $userLinks . '
            <a class="cart-pill" href="' . e(url('carrito')) . '">Carrito (' . cart_count() . ')</a>
        </nav>
    </div></header>
    ' . notice_html() . $content . '
    <footer class="jama-footer">
        <div class="wrap jama-footer-main">
            <div class="jama-footer-brand">
                <a class="jama-footer-logo" href="' . e(url('inicio')) . '"><img src="static/jama-brand.jpeg" alt="JAMA Store"><span>JAMA<small>STORE</small></span></a>
                <p>Moda urbana, perfumes y promociones con estilo propio. Compra online de forma simple y recibe tu pedido por agencia.</p>
                <span class="jama-footer-origin">JAMA Store Perú</span>
            </div>
            <div class="jama-footer-block">
                <span class="jama-footer-label">Compra y envío</span>
                <div class="jama-footer-service"><span class="jama-footer-service-icon">Y</span><div><strong>Pago por Yape</strong><small>Disponible al finalizar tu compra</small></div></div>
                <div class="jama-footer-service">' . shipping_badge() . '<div><strong>Envíos por Shalom</strong><small>Coordina tu agencia al realizar el pedido</small></div></div>
            </div>
            <div class="jama-footer-block jama-footer-social">
                <span class="jama-footer-label">Síguenos</span>
                <p>Entérate de nuevas prendas, perfumes y promociones.</p>
                ' . social_links_html() . '
            </div>
        </div>
        <div class="wrap jama-footer-bottom">
            <div class="jama-footer-links">
                <a href="' . e(url('terminos-y-condiciones')) . '">Términos</a>
                <a href="' . e(url('politica-privacidad')) . '">Privacidad</a>
                <a href="' . e(url('terminos-promociones')) . '">Promociones</a>
                <a href="' . e(url('configuracion-cookies')) . '">Cookies</a>
                <a href="' . e(url('uso-del-sitio')) . '">Uso del sitio</a>
            </div>
            <span class="jama-footer-copy">&copy; 2026 JAMA Store. Todos los derechos reservados.</span>
        </div>
    </footer>
    <script src="static/app.js"></script>
    </body></html>';
}

function admin_page($title, $content, $active = 'dashboard') {
    require_admin();
    $links = array(
        'dashboard' => array('Panel', 'admin'),
        'pedidos' => array('Pedidos', 'admin-pedidos'),
        'productos' => array('Productos', 'admin-productos'),
        'clientes' => array('Clientes', 'admin-clientes'),
        'redes' => array('Redes', 'admin-redes'),
        'promos' => array('Promociones', 'admin-promociones'),
        'backup' => array('Backup', 'admin-backup')
    );
    $nav = '';
    foreach ($links as $key => $item) {
        $nav .= '<a class="' . ($active === $key ? 'active' : '') . '" href="' . e(url($item[1])) . '">' . e($item[0]) . '</a>';
    }
    echo '<!doctype html><html lang="es"><head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <title>' . e($title) . ' - Admin JAMA</title>
        <link rel="stylesheet" href="static/styles.css?v=php1">
    </head><body><div class="admin-shell">
        <aside class="sidebar">
            <a class="brand" href="' . e(url('inicio')) . '"><img class="brand-mark" src="static/jama-brand.jpeg" alt="JAMA"><span>JAMA<small>Admin</small></span></a>
            <nav class="side-nav">' . $nav . '<a href="' . e(url('inicio')) . '">Ver tienda</a><a href="' . e(url('logout')) . '">Salir</a></nav>
        </aside>
        <main class="admin-main">' . notice_html() . $content . '</main>
    </div></body></html>';
}

function page_home() {
    $products = all_rows("SELECT * FROM products WHERE active = 1 ORDER BY created_at DESC LIMIT 6");
    $cards = '';
    foreach ($products as $p) {
        $cards .= product_card($p);
    }
    $promo = one("SELECT * FROM promotions ORDER BY created_at DESC LIMIT 1");
    $promoHtml = $promo ? '<section class="section"><div class="wrap">
        <style>
            .jama-promo-active{position:relative;overflow:hidden;display:flex;align-items:center;justify-content:space-between;gap:24px;padding:28px 30px;border:1px solid rgba(255,255,255,.10);border-radius:22px;background:linear-gradient(135deg,#171717,#232323);box-shadow:0 18px 45px rgba(0,0,0,.16)}
            .jama-promo-active:after{content:"";position:absolute;right:-70px;top:-90px;width:220px;height:220px;border-radius:50%;background:rgba(255,255,255,.035)}
            .jama-promo-copy{position:relative;z-index:1;display:flex;align-items:center;gap:22px;min-width:0}
            .jama-promo-off{flex:0 0 auto;min-width:118px;padding:16px 18px;border-radius:18px;background:#fff;color:#111;text-align:center;font-size:27px;font-weight:900;line-height:1;letter-spacing:-.8px}
            .jama-promo-text{min-width:0;color:#fff!important}.jama-promo-kicker{display:inline-flex;align-items:center;gap:7px;margin-bottom:9px;padding:6px 10px;border-radius:999px;background:rgba(255,255,255,.08);color:#f2c66d!important;font-size:11px;font-weight:900;letter-spacing:1.3px;text-transform:uppercase;opacity:1!important}.jama-promo-kicker:before{content:"";width:6px;height:6px;border-radius:50%;background:#e7b653;box-shadow:0 0 0 4px rgba(231,182,83,.12)}.jama-promo-text h2{margin:0 0 8px;color:#fff!important;font-size:clamp(22px,3vw,32px);font-weight:900;line-height:1.08;letter-spacing:-.4px}.jama-promo-text p{margin:0;color:rgba(255,255,255,.78)!important;opacity:1!important;max-width:680px;line-height:1.55}.jama-promo-action{position:relative;z-index:1;white-space:nowrap}
            @media(max-width:720px){.jama-promo-active{align-items:flex-start;flex-direction:column;padding:22px}.jama-promo-copy{align-items:flex-start;flex-direction:column;gap:14px}.jama-promo-off{min-width:104px;font-size:23px}.jama-promo-action{width:100%;text-align:center}}
        </style>
        <div class="jama-promo-active">
            <div class="jama-promo-copy">
                <div class="jama-promo-off">' . e($promo['discount'] ?: 'PROMO') . '</div>
                <div class="jama-promo-text"><span class="jama-promo-kicker">Promo activa</span><h2>' . e($promo['title']) . '</h2><p>' . e($promo['message']) . '</p></div>
            </div>
            <a class="btn gold jama-promo-action" href="' . e(url('promos')) . '">Ver promoción</a>
        </div>
    </div></section>' : '';
    $content = '<main>
        <section class="wrap hero">
            <div class="hero-copy">
                <span class="eyebrow"><span class="dot"></span>JAMA Store 24/7</span>
                <h1>JAMA Store Perú - Ropa urbana y perfumes</h1>
                <p class="lead">Compra prendas y perfumes JAMA, paga con Yape y envia por SHALOM. Cada cliente tiene su cuenta, carrito y pedidos guardados.</p>
                <div class="hero-actions"><a class="btn red" href="' . e(url('catalogo')) . '">Ver catalogo</a><a class="btn secondary" href="' . e(url('perfumes')) . '">Perfumes</a></div>
            </div>
            <div class="hero-card"><img src="static/jama-brand.jpeg" alt="JAMA Store"><div class="hero-badge"><strong>JAMA Store</strong><span>Moda, perfumes y promociones</span></div></div>
        </section>
        <section class="section"><div class="wrap"><div class="section-head"><div><h2>Novedades</h2><p>Moda urbana, perfumes y promociones para encontrar tu propio estilo.</p></div></div><div class="grid">' . $cards . '</div></div></section>
        ' . $promoHtml . '
    </main>';
    page('Inicio', $content, 'inicio');
}

function page_catalog($onlyPerfumes = false) {
    if ($onlyPerfumes) {
        $rows = all_rows("SELECT * FROM products WHERE active = 1 AND category = 'Perfumes' ORDER BY created_at DESC");
        $title = 'Perfumes JAMA';
        $active = 'perfumes';
        $desc = 'Fragancias para sumar a tu tienda con el mismo carrito.';
    } else {
        $rows = all_rows("SELECT * FROM products WHERE active = 1 AND category != 'Perfumes' ORDER BY created_at DESC");
        $title = 'Catalogo JAMA';
        $active = 'catalogo';
        $desc = 'Ropa, accesorios y prendas urbanas.';
    }
    $cards = '';
    foreach ($rows as $p) {
        $cards .= product_card($p);
    }
    if (!$cards) {
        $cards = '<div class="panel empty">Aun no hay productos activos.</div>';
    }
    $content = '<main class="section"><div class="wrap"><div class="section-head"><div><span class="eyebrow"><span class="dot"></span>' . e($active) . '</span><h1>' . e($title) . '</h1><p>' . e($desc) . '</p></div></div><div class="grid">' . $cards . '</div></div></main>';
    page($title, $content, $active);
}

function page_product() {
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $product = one("SELECT * FROM products WHERE id = ? AND active = 1", array($id));
    if (!$product) {
        page('No encontrado', '<main class="section"><div class="wrap panel empty">Producto no encontrado.</div></main>');
        return;
    }
    $sizes = '';
    foreach (array_filter(array_map('trim', explode(',', (string)$product['sizes']))) as $size) {
        $sizes .= '<option value="' . e($size) . '">' . e($size) . '</option>';
    }
    if (!$sizes) {
        $sizes = '<option value="">Unica</option>';
    }
    $old = ($product['promo_price'] !== null && $product['promo_price'] !== '') ? '<span class="old-price">' . money($product['price']) . '</span>' : '';
    $content = '<main class="section"><div class="wrap hero">
        <div class="product-media hero-card">' . product_media($product) . '</div>
        <div class="hero-copy">
            <span class="tag">' . e($product['category']) . '</span>
            <h1>' . e($product['name']) . '</h1>
            <div class="price">' . $old . money(product_price($product)) . '</div>
            <p class="lead">' . e($product['description']) . '</p>
            <form method="post" action="' . e(url('agregar')) . '" class="panel form-grid">' . csrf_field() . '
                <input type="hidden" name="product_id" value="' . (int)$product['id'] . '">
                <label class="field"><span>Talla / variante</span><select name="size">' . $sizes . '</select></label>
                <label class="field"><span>Cantidad</span><input type="number" name="qty" min="1" max="' . (int)$product['stock'] . '" value="1"></label>
                <div class="field full"><button class="btn red" type="submit">Agregar al carrito</button></div>
            </form>
        </div>
    </div></main>';
    page($product['name'], $content, $product['category'] === 'Perfumes' ? 'perfumes' : 'catalogo');
}

function cart_lines() {
    $lines = array();
    $total = 0;
    foreach (get_cart() as $key => $qty) {
        list($productId, $size) = parse_cart_key($key);
        $product = one("SELECT * FROM products WHERE id = ?", array($productId));
        if (!$product) {
            continue;
        }
        $price = product_price($product);
        $subtotal = $price * (int)$qty;
        $total += $subtotal;
        $lines[] = array('key' => $key, 'product' => $product, 'size' => $size, 'qty' => (int)$qty, 'price' => $price, 'subtotal' => $subtotal);
    }
    return array($lines, $total);
}

function page_cart() {
    list($lines, $total) = cart_lines();
    $rows = '';
    foreach ($lines as $line) {
        $p = $line['product'];
        $rows .= '<tr>
            <td><div class="order-product">' . product_media($p, true) . '<div><strong>' . e($p['name']) . '</strong><br><span class="muted">Variante: ' . e($line['size']) . '</span></div></div></td>
            <td>' . money($line['price']) . '</td>
            <td><form method="post" action="' . e(url('carrito-actualizar')) . '" class="inline-form">' . csrf_field() . '<input type="hidden" name="key" value="' . e($line['key']) . '"><input type="number" name="qty" min="1" value="' . (int)$line['qty'] . '" style="width:90px"><button class="btn small secondary">Actualizar</button></form></td>
            <td class="right">' . money($line['subtotal']) . '</td>
            <td class="right"><form method="post" action="' . e(url('carrito-eliminar')) . '" class="inline-form" onsubmit="return confirm(\'¿Quitar esta prenda del carrito?\')">' . csrf_field() . '<input type="hidden" name="key" value="' . e($line['key']) . '"><button class="btn small danger" type="submit" title="Eliminar del carrito" aria-label="Eliminar del carrito">&#128465;</button></form></td>
        </tr>';
    }
    if (!$rows) {
        $rows = '<tr><td colspan="5" class="empty">Tu carrito esta vacio.</td></tr>';
    }
    $user = current_user();
    if ($user && $user['role'] === 'client' && $lines) {
        $checkout = '<form method="post" enctype="multipart/form-data" action="' . e(url('pedido-crear')) . '" class="panel checkout-panel form-grid">' . csrf_field() . '
            <div class="checkout-top field full"><div><span class="eyebrow"><span class="dot"></span>Finaliza</span><strong>Pago por Yape y envio SHALOM</strong></div><div class="checkout-total">' . money($total) . '</div></div>
            <div class="field full jama-delivery-card">
                <div class="jama-delivery-head">
                    <div class="jama-delivery-head-icon">✦</div>
                    <div><span>DATOS DE ENTREGA</span><strong>¿Dónde coordinamos tu pedido?</strong><small>Completa estos datos para preparar y enviar tu compra correctamente.</small></div>
                </div>
                <div class="jama-delivery-grid">
                    <label class="jama-delivery-field">
                        <span class="jama-delivery-icon">☎</span>
                        <span class="jama-delivery-copy"><small>CONTACTO</small><strong>Teléfono / WhatsApp</strong><input name="phone" inputmode="tel" autocomplete="tel" required placeholder="Ej. 999 999 999"></span>
                    </label>
                    <label class="jama-delivery-field">
                        <span class="jama-delivery-icon">⌖</span>
                        <span class="jama-delivery-copy"><small>DESTINO</small><strong>Dirección de envío</strong><input name="address" autocomplete="street-address" required placeholder="Distrito, calle y referencia"></span>
                    </label>
                </div>
                <div class="jama-delivery-note"><span>✓</span> Verifica tus datos antes de confirmar el pedido.</div>
            </div>
            <div class="field full shipping-field"><div class="shipping-icon"><img src="static/shalom-logo.png" alt="Shalom"></div><label><span>Agencia de envio</span><input name="shipping_agency" value="SHALOM" readonly></label></div>
            <div class="field full yape-card">
                <span class="yape-shine"></span>
                <div class="yape-head"><div class="yape-logo-box"><img class="yape-logo" src="static/yape-logo.png" alt="Yape"></div><div><span class="tag yape-tag">Yape</span><strong>Yapea aqui mismo al numero ' . e(YAPE_PHONE) . '</strong><small>Destinatario: ' . e(YAPE_RECIPIENT) . '. Sube tu comprobante para validar el pedido.</small></div></div>
                <div class="yape-data"><div><span>Numero</span><strong>' . e(YAPE_PHONE) . '</strong></div><div><span>Nombre</span><strong>' . e(YAPE_RECIPIENT) . '</strong></div><div><span>Total</span><strong>' . money($total) . '</strong></div></div>
            </div>
            <div class="jama-yape-confirm">
                <label class="jama-yape-confirm-field">
                    <span class="jama-yape-confirm-icon">Y</span>
                    <span class="jama-yape-confirm-copy"><small>CONFIRMACION</small><strong>Nombre que aparece en tu Yape</strong><input name="yape_name" required autocomplete="name" placeholder="Ej. Juan Pérez"></span>
                </label>
                <label class="jama-yape-confirm-field">
                    <span class="jama-yape-confirm-icon">#</span>
                    <span class="jama-yape-confirm-copy"><small>OPERACION</small><strong>Nro. de operación Yape</strong><input name="yape_operation" inputmode="numeric" placeholder="Opcional"></span>
                </label>
            </div>
            <label class="field full"><span>Sube comprobante Yape</span><input type="file" name="receipt" accept=".jpg,.jpeg,.png,.webp,.pdf" required></label>
            <div class="field full"><button class="btn red yape-submit" type="submit">Confirmar pedido</button></div>
        </form>';
    } elseif ($lines) {
        $checkout = '<div class="panel"><h2>Inicia sesion para comprar</h2><p class="muted">Asi tu pedido queda guardado con tu correo y lo puedes ver en Mis pedidos.</p><a class="btn red" href="' . e(url('login')) . '">Ingresar</a> <a class="btn secondary" href="' . e(url('registro')) . '">Crear cuenta</a></div>';
    } else {
        $checkout = '<div class="panel"><h2>Total</h2><div class="total-line"><span>Carrito</span><strong>' . money(0) . '</strong></div></div>';
    }
    $content = '<main class="section"><div class="wrap"><span class="eyebrow"><span class="dot"></span>Carrito</span><h1>Finaliza tu compra</h1><div class="admin-grid"><div class="panel"><table class="cart-table"><thead><tr><th>Prenda</th><th>Precio</th><th>Cantidad</th><th class="right">Subtotal</th><th></th></tr></thead><tbody>' . $rows . '</tbody></table></div>' . $checkout . '</div></div></main>';
    page('Carrito', $content);
}

function handle_add_to_cart() {
    check_csrf();
    $productId = isset($_POST['product_id']) ? (int)$_POST['product_id'] : 0;
    $qty = max(1, isset($_POST['qty']) ? (int)$_POST['qty'] : 1);
    $size = trim(isset($_POST['size']) ? $_POST['size'] : '');
    $product = one("SELECT * FROM products WHERE id = ? AND active = 1", array($productId));
    if (!$product) {
        redirect_to('catalogo', array('err' => 'Producto no encontrado.'));
    }
    $key = cart_key($productId, $size);
    $cart = get_cart();
    $cart[$key] = isset($cart[$key]) ? $cart[$key] + $qty : $qty;
    save_cart($cart);
    redirect_to('carrito', array('ok' => 'Prenda agregada al carrito.'));
}

function handle_cart_update() {
    check_csrf();
    $key = isset($_POST['key']) ? $_POST['key'] : '';
    $qty = isset($_POST['qty']) ? (int)$_POST['qty'] : 0;
    $cart = get_cart();
    if (isset($cart[$key])) {
        if ($qty <= 0) {
            unset($cart[$key]);
        } else {
            $cart[$key] = $qty;
        }
    }
    save_cart($cart);
    redirect_to('carrito', array('ok' => 'Carrito actualizado.'));
}

function handle_cart_remove() {
    check_csrf();
    $key = isset($_POST['key']) ? $_POST['key'] : '';
    $cart = get_cart();
    if (isset($cart[$key])) {
        unset($cart[$key]);
        save_cart($cart);
    }
    redirect_to('carrito', array('ok' => 'Prenda eliminada del carrito.'));
}

function relative_path($absolute) {
    return str_replace('\\', '/', ltrim(str_replace(BASE_PATH, '', $absolute), '/'));
}

function upload_file($field, $dir, $prefix, $allowed) {
    if (empty($_FILES[$field]) || $_FILES[$field]['error'] === UPLOAD_ERR_NO_FILE) {
        return '';
    }
    if ($_FILES[$field]['error'] !== UPLOAD_ERR_OK) {
        return '';
    }
    $ext = strtolower(pathinfo($_FILES[$field]['name'], PATHINFO_EXTENSION));
    if (!in_array($ext, $allowed, true)) {
        return '';
    }
    $name = $prefix . '-' . bin2hex(random_bytes(8)) . '.' . $ext;
    $target = rtrim($dir, '/\\') . '/' . $name;
    if (!move_uploaded_file($_FILES[$field]['tmp_name'], $target)) {
        return '';
    }
    return relative_path($target);
}

function handle_create_order() {
    check_csrf();
    require_user();
    $user = current_user();
    if ($user['role'] !== 'client') {
        redirect_to('carrito', array('err' => 'Usa una cuenta de cliente para comprar.'));
    }
    list($lines, $total) = cart_lines();
    if (!$lines) {
        redirect_to('carrito', array('err' => 'Tu carrito esta vacio.'));
    }
    $phone = trim(isset($_POST['phone']) ? $_POST['phone'] : '');
    $address = trim(isset($_POST['address']) ? $_POST['address'] : '');
    $agency = trim(isset($_POST['shipping_agency']) ? $_POST['shipping_agency'] : 'SHALOM');
    $yapeName = trim(isset($_POST['yape_name']) ? $_POST['yape_name'] : '');
    $operation = trim(isset($_POST['yape_operation']) ? $_POST['yape_operation'] : '');
    $receipt = upload_file('receipt', RECEIPTS_DIR, 'comprobante', array('jpg', 'jpeg', 'png', 'webp', 'pdf'));
    if (!$phone || !$address || !$yapeName || !$receipt) {
        redirect_to('carrito', array('err' => 'Completa direccion, telefono, nombre Yape y comprobante.'));
    }
    run_sql("INSERT INTO orders (user_id, customer_name, email, phone, address, shipping_agency, yape_phone, yape_recipient, yape_name, yape_operation, receipt_file, total, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", array($user['id'], $user['name'], $user['email'], $phone, $address, $agency ?: 'SHALOM', YAPE_PHONE, YAPE_RECIPIENT, $yapeName, $operation, $receipt, $total, now_text()));
    $orderId = (int)db()->lastInsertId();
    foreach ($lines as $line) {
        $p = $line['product'];
        run_sql("INSERT INTO order_items (order_id, product_id, product_name, price, quantity, size, image) VALUES (?, ?, ?, ?, ?, ?, ?)", array($orderId, $p['id'], $p['name'], $line['price'], $line['qty'], $line['size'], $p['image']));
        run_sql("UPDATE products SET stock = MAX(stock - ?, 0) WHERE id = ?", array($line['qty'], $p['id']));
    }
    save_cart(array());
    redirect_to('pedido-exito', array('id' => $orderId));
}

function page_order_success() {
    require_user();
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $order = one("SELECT * FROM orders WHERE id = ? AND user_id = ?", array($id, current_user()['id']));
    if (!$order) {
        redirect_to('mis-pedidos');
    }
    $content = '<main class="section"><div class="wrap payment-summary"><div><span class="eyebrow"><span class="dot"></span>Pedido recibido</span><h1>Gracias por tu compra</h1><p class="lead">Tu pedido #' . (int)$order['id'] . ' ya aparece en tu cuenta y en el panel admin. El pago queda en revision hasta validar el Yape.</p><a class="btn red" href="' . e(url('mis-pedidos')) . '">Ver mis pedidos</a></div><div class="panel"><strong>Total</strong><h2>' . money($order['total']) . '</h2><span class="pay-status">' . e($order['payment_status']) . '</span></div></div></main>';
    page('Pedido recibido', $content);
}

function page_my_orders() {
    require_user();
    $user = current_user();
    $orders = all_rows("SELECT * FROM orders WHERE user_id = ? ORDER BY created_at DESC", array($user['id']));
    $rows = '';
    foreach ($orders as $o) {
        $rows .= '<tr><td>#' . (int)$o['id'] . '</td><td>' . e($o['created_at']) . '</td><td>' . money($o['total']) . '</td><td><span class="order-status">' . e($o['status']) . '</span></td><td><span class="pay-status">' . e($o['payment_status']) . '</span></td><td><a class="btn small secondary" href="' . e(url('pedido', array('id' => $o['id']))) . '">Ver</a></td></tr>';
    }
    if (!$rows) {
        $rows = '<tr><td colspan="6" class="empty">Aun no hiciste pedidos.</td></tr>';
    }
    $content = '<main class="section"><div class="wrap"><span class="eyebrow"><span class="dot"></span>Mi cuenta</span><h1>Pedidos realizados</h1><div class="panel"><table class="admin-table"><thead><tr><th>Pedido</th><th>Fecha</th><th>Total</th><th>Envio</th><th>Pago</th><th></th></tr></thead><tbody>' . $rows . '</tbody></table></div></div></main>';
    page('Mis pedidos', $content);
}

function page_customer_order() {
    require_user();
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $user = current_user();
    $order = one("SELECT * FROM orders WHERE id = ? AND user_id = ?", array($id, $user['id']));
    if (!$order) {
        redirect_to('mis-pedidos');
    }
    $items = all_rows("SELECT * FROM order_items WHERE order_id = ?", array($id));
    $rows = '';
    foreach ($items as $it) {
        $variant = trim((string)$it['size']) !== '' ? e($it['size']) : 'Única';
        $rows .= '<tr>
            <td><div class="jama-order-product">' . image_tag($it['image'], 'mini-img', $it['product_name']) . '<div><strong>' . e($it['product_name']) . '</strong><small>Variante: ' . $variant . '</small></div></div></td>
            <td><span class="jama-order-qty">' . (int)$it['quantity'] . '</span></td>
            <td>' . money($it['price']) . '</td>
            <td class="right"><strong>' . money($it['price'] * $it['quantity']) . '</strong></td>
        </tr>';
    }
    if (!$rows) {
        $rows = '<tr><td colspan="4" class="empty">Este pedido no tiene productos.</td></tr>';
    }

    $operationText = trim((string)$order['yape_operation']) !== '' ? e($order['yape_operation']) : 'No registrado';
    $yapeNameText = trim((string)$order['yape_name']) !== '' ? e($order['yape_name']) : 'No registrado';

    $content = '<main class="section jama-order-detail-page"><div class="wrap">
        <div class="detail-head jama-order-detail-head">
            <div><span class="eyebrow"><span class="dot"></span>Pedido #' . (int)$order['id'] . '</span><h1>Detalle del pedido</h1></div>
            <div><span class="order-status">' . e($order['status']) . '</span> <span class="pay-status">' . e($order['payment_status']) . '</span></div>
        </div>

        <div class="jama-order-layout">
            <section class="panel jama-order-card">
                <div class="jama-order-card-head"><div><span>TU COMPRA</span><strong>Productos del pedido</strong></div><strong>' . count($items) . ' producto(s)</strong></div>
                <div class="jama-order-table-wrap"><table class="jama-order-table"><thead><tr><th>Producto</th><th>Cant.</th><th>Precio</th><th class="right">Subtotal</th></tr></thead><tbody>' . $rows . '</tbody></table></div>
            </section>

            <aside class="panel jama-order-summary">
                <div class="jama-order-summary-title"><span class="jama-order-summary-title-icon">✓</span><div><span>RESUMEN</span><strong>Envío y pago</strong></div></div>

                <div class="jama-order-info">
                    <span class="jama-order-info-icon">⌖</span>
                    <div class="jama-order-info-copy"><small>DIRECCIÓN DE ENTREGA</small><strong>' . e($order['address']) . '</strong></div>
                </div>

                <div class="jama-order-info">
                    <span class="jama-order-info-icon">↗</span>
                    <div class="jama-order-info-copy"><small>AGENCIA DE ENVÍO</small><strong>' . shipping_badge() . '</strong></div>
                </div>

                <div class="jama-order-info">
                    <span class="jama-order-info-icon">Y</span>
                    <div class="jama-order-info-copy"><small>DATOS DEL YAPE</small><strong>Pago registrado</strong><div class="jama-order-yape-data"><div><span>NOMBRE</span><b>' . $yapeNameText . '</b></div><div><span>OPERACIÓN</span><b>' . $operationText . '</b></div></div></div>
                </div>

                <div class="jama-order-total"><span>TOTAL DEL PEDIDO</span><strong>' . money($order['total']) . '</strong></div>
            </aside>
        </div>
    </div></main>';
    page('Pedido #' . $id, $content);
}

function google_configured() {
    return GOOGLE_CLIENT_ID !== '' && GOOGLE_CLIENT_SECRET !== '';
}

function app_url() {
    if (APP_URL !== '') {
        return rtrim(APP_URL, '/');
    }
    $https = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443);
    $scheme = $https ? 'https' : 'http';
    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : 'localhost';
    $base = str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME']));
    return rtrim($scheme . '://' . $host . ($base === '/' ? '' : $base), '/');
}

function google_redirect_uri() {
    return GOOGLE_REDIRECT_URI !== '' ? GOOGLE_REDIRECT_URI : app_url() . '/index.php?r=google-callback';
}

function google_button() {
    if (!google_configured()) {
        return '<div class="google-note">Google Login esta listo, pero falta poner GOOGLE_CLIENT_ID y GOOGLE_CLIENT_SECRET en config.php.</div>';
    }
    return '<a class="btn google-btn" href="' . e(url('google-login')) . '"><span class="google-mark">G</span> Continuar con Google</a>';
}

function page_login($admin = false) {
    $action = $admin ? 'admin-login' : 'login';
    $extra = $admin ? '' : '<div class="auth-separator"><span>o</span></div>' . google_button() . '<p class="muted">No tienes cuenta? <a href="' . e(url('registro')) . '">Crea una aqui</a></p>';
    $content = '<main class="auth-shell"><form class="auth-card" method="post" action="' . e(url($action)) . '">' . csrf_field() . '<h1>' . ($admin ? 'Panel admin' : 'Ingresar') . '</h1><p class="muted">Accede con tu correo.</p><label class="field"><span>Correo</span><input type="email" name="email" required></label><label class="field"><span>Contrasena</span><input type="password" name="password" required></label><button class="btn red" style="width:100%;margin-top:14px">Entrar</button>' . $extra . '</form></main>';
    page($admin ? 'Admin' : 'Ingresar', $content);
}

function page_register() {
    $content = '<main class="auth-shell"><form class="auth-card" method="post" action="' . e(url('registro')) . '">' . csrf_field() . '<h1>Crear cuenta</h1><p class="muted">Tu carrito y pedidos quedaran guardados con tu correo.</p><label class="field"><span>Nombre</span><input name="name" required></label><label class="field"><span>Correo</span><input type="email" name="email" required></label><label class="field"><span>Contrasena</span><input type="password" name="password" minlength="4" required></label><label class="checkbox"><input type="checkbox" name="promo_opt_in" checked> Quiero recibir promociones</label><button class="btn red" style="width:100%;margin-top:14px">Crear cuenta</button><div class="auth-separator"><span>o</span></div>' . google_button() . '<p class="muted">Ya tienes cuenta? <a href="' . e(url('login')) . '">Ingresa aqui</a></p></form></main>';
    page('Registro', $content);
}

function handle_login($admin = false) {
    check_csrf();
    $email = strtolower(trim(isset($_POST['email']) ? $_POST['email'] : ''));
    $password = isset($_POST['password']) ? $_POST['password'] : '';
    $user = one("SELECT * FROM users WHERE email = ?", array($email));
    if (!$user || !password_verify($password, $user['password_hash'])) {
        redirect_to($admin ? 'admin-login' : 'login', array('err' => 'Correo o contrasena incorrectos.'));
    }
    if ($admin && $user['role'] !== 'admin') {
        redirect_to('admin-login', array('err' => 'Esta cuenta no es admin.'));
    }
    login_user($user);
    redirect_to($user['role'] === 'admin' ? 'admin' : 'inicio', array('ok' => 'Sesion iniciada.'));
}

function handle_register() {
    check_csrf();
    $name = trim(isset($_POST['name']) ? $_POST['name'] : '');
    $email = strtolower(trim(isset($_POST['email']) ? $_POST['email'] : ''));
    $password = isset($_POST['password']) ? $_POST['password'] : '';
    if (!$name || !$email || strlen($password) < 4) {
        redirect_to('registro', array('err' => 'Completa tus datos.'));
    }
    try {
        run_sql("INSERT INTO users (name, email, password_hash, role, promo_opt_in, created_at) VALUES (?, ?, ?, 'client', ?, ?)", array($name, $email, password_hash($password, PASSWORD_DEFAULT), isset($_POST['promo_opt_in']) ? 1 : 0, now_text()));
    } catch (Exception $e) {
        redirect_to('registro', array('err' => 'Ese correo ya esta registrado.'));
    }
    $user = one("SELECT * FROM users WHERE email = ?", array($email));
    login_user($user);
    redirect_to('inicio', array('ok' => 'Cuenta creada.'));
}

function handle_logout() {
    session_destroy();
    redirect_to('inicio', array('ok' => 'Sesion cerrada.'));
}

function handle_google_login() {
    if (!google_configured()) {
        redirect_to('login', array('err' => 'Falta configurar Google Login en config.php.'));
    }
    $_SESSION['google_state'] = bin2hex(random_bytes(16));
    $params = array(
        'client_id' => GOOGLE_CLIENT_ID,
        'redirect_uri' => google_redirect_uri(),
        'response_type' => 'code',
        'scope' => 'openid email profile',
        'state' => $_SESSION['google_state'],
        'access_type' => 'online',
        'prompt' => 'select_account'
    );
    header('Location: https://accounts.google.com/o/oauth2/v2/auth?' . http_build_query($params));
    exit;
}

function curl_json($url, $postFields = null, $bearer = '') {
    if (!function_exists('curl_init')) {
        return null;
    }
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    if ($postFields !== null) {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postFields));
        curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
    } elseif ($bearer) {
        curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: Bearer ' . $bearer));
    }
    $body = curl_exec($ch);
    curl_close($ch);
    return $body ? json_decode($body, true) : null;
}

function handle_google_callback() {
    if (!google_configured()) {
        redirect_to('login', array('err' => 'Google Login no esta configurado.'));
    }
    if (!empty($_GET['error'])) {
        redirect_to('login', array('err' => 'Google cancelo el acceso.'));
    }
    $state = isset($_GET['state']) ? $_GET['state'] : '';
    if (!$state || empty($_SESSION['google_state']) || !hash_equals($_SESSION['google_state'], $state)) {
        redirect_to('login', array('err' => 'Estado de Google no valido.'));
    }
    $code = isset($_GET['code']) ? $_GET['code'] : '';
    $token = curl_json('https://oauth2.googleapis.com/token', array(
        'code' => $code,
        'client_id' => GOOGLE_CLIENT_ID,
        'client_secret' => GOOGLE_CLIENT_SECRET,
        'redirect_uri' => google_redirect_uri(),
        'grant_type' => 'authorization_code'
    ));
    if (!$token || empty($token['access_token'])) {
        redirect_to('login', array('err' => 'No se pudo conectar con Google.'));
    }
    $info = curl_json('https://www.googleapis.com/oauth2/v3/userinfo', null, $token['access_token']);
    if (!$info || empty($info['email'])) {
        redirect_to('login', array('err' => 'Google no devolvio el correo.'));
    }
    $email = strtolower($info['email']);
    $googleId = isset($info['sub']) ? $info['sub'] : '';
    $name = isset($info['name']) ? $info['name'] : $email;
    $user = one("SELECT * FROM users WHERE google_id = ? AND google_id != ''", array($googleId));
    if (!$user) {
        $user = one("SELECT * FROM users WHERE email = ?", array($email));
        if ($user) {
            run_sql("UPDATE users SET google_id = ?, auth_provider = 'google' WHERE id = ?", array($googleId, $user['id']));
        } else {
            run_sql("INSERT INTO users (name, email, password_hash, role, google_id, auth_provider, promo_opt_in, created_at) VALUES (?, ?, ?, 'client', ?, 'google', 1, ?)", array($name, $email, password_hash(bin2hex(random_bytes(18)), PASSWORD_DEFAULT), $googleId, now_text()));
        }
        $user = one("SELECT * FROM users WHERE email = ?", array($email));
    }
    login_user($user);
    redirect_to('inicio', array('ok' => 'Entraste con Google.'));
}

function admin_dashboard() {
    $orders = one("SELECT COUNT(*) AS total FROM orders");
    $clients = one("SELECT COUNT(*) AS total FROM users WHERE role = 'client'");
    $products = one("SELECT COUNT(*) AS total FROM products WHERE active = 1");
    $pending = one("SELECT COUNT(*) AS total FROM orders WHERE payment_status != 'Aprobado' AND status != 'Cancelado'");

    $resetAt = admin_setting('earnings_reset_at', '');
    $sql = "SELECT COALESCE(SUM(total),0) AS total FROM orders WHERE payment_status = 'Aprobado' AND status != 'Cancelado'";
    $params = array();
    if ($resetAt !== '') {
        $sql .= " AND created_at >= ?";
        $params[] = $resetAt;
    }
    $earnings = one($sql, $params);
    $resetLabel = $resetAt !== '' ? 'Desde: ' . $resetAt : 'Desde el inicio';

    $content = '<div class="admin-head"><div><span class="eyebrow"><span class="dot"></span>Admin</span><h1>Panel JAMA</h1></div><a class="btn secondary" href="' . e(url('inicio')) . '">Ver tienda</a></div>
    <div class="stats"><div class="stat"><span>Pedidos</span><strong>' . (int)$orders['total'] . '</strong></div><div class="stat"><span>Ganancia</span><strong>' . money($earnings['total']) . '</strong><small class="muted">' . e($resetLabel) . '</small></div><div class="stat"><span>Clientes</span><strong>' . (int)$clients['total'] . '</strong></div><div class="stat"><span>Pagos pendientes</span><strong>' . (int)$pending['total'] . '</strong></div></div>
    <div class="admin-grid"><div class="panel"><h2>Acciones rapidas</h2><p class="muted">Revisa pagos, pedidos, stock, promociones y redes.</p><a class="btn red" href="' . e(url('admin-pedidos')) . '">Ver pedidos</a> <a class="btn secondary" href="' . e(url('admin-productos')) . '">Productos</a></div><div class="panel"><h2>Ganancia del panel</h2><p class="muted">Este contador suma pedidos con pago aprobado. Reiniciarlo no borra pedidos ni ventas guardadas.</p><div class="total-line"><span>Acumulado</span><strong>' . money($earnings['total']) . '</strong></div><form method="post" action="' . e(url('admin-ganancia-reiniciar')) . '" onsubmit="return confirm(\'¿Reiniciar el contador de ganancia a S/ 0.00? Los pedidos NO se borraran.\')">' . csrf_field() . '<button class="btn small danger" type="submit">Reiniciar ganancia</button></form></div></div>';
    admin_page('Panel', $content, 'dashboard');
}

function handle_admin_earnings_reset() {
    check_csrf();
    require_admin();
    set_admin_setting('earnings_reset_at', now_text());
    redirect_to('admin', array('ok' => 'Ganancia reiniciada a S/ 0.00. Tus pedidos siguen guardados.'));
}

function admin_order_items_summary($orderId) {
    $items = all_rows("SELECT * FROM order_items WHERE order_id = ?", array($orderId));
    $html = '';
    foreach ($items as $it) {
        $html .= '<div class="order-product mini-line">' . image_tag($it['image'], 'mini-img tiny', $it['product_name']) . '<div><strong>' . e($it['product_name']) . '</strong><br><span class="muted">' . e($it['size']) . ' x ' . (int)$it['quantity'] . '</span></div></div>';
    }
    return $html;
}

function admin_orders() {
    $orders = all_rows("SELECT * FROM orders WHERE admin_hidden = 0 ORDER BY created_at DESC");
    $rows = '';
    foreach ($orders as $o) {
        $remove = '';
        if (in_array($o['status'], array('Entregado','Cancelado'), true)) {
            $remove = '<form method="post" action="' . e(url('admin-pedido-eliminar')) . '" class="inline-form" onsubmit="return confirm(\'¿Eliminar este pedido del panel?\')">' . csrf_field() . '<input type="hidden" name="id" value="' . (int)$o['id'] . '"><button class="btn small danger" type="submit" title="Eliminar del panel">&#128465;</button></form>';
        }
        $rows .= '<tr><td>#' . (int)$o['id'] . '<br><span class="muted">' . e($o['created_at']) . '</span></td><td>' . e($o['customer_name']) . '<br><span class="muted">' . e($o['email']) . '</span></td><td>' . admin_order_items_summary($o['id']) . '</td><td>' . e($o['address']) . '<br>' . shipping_badge() . '</td><td>' . money($o['total']) . '<br><span class="pay-status">' . e($o['payment_status']) . '</span></td><td><span class="order-status">' . e($o['status']) . '</span></td><td><a class="btn small red" href="' . e(url('admin-pedido', array('id' => $o['id']))) . '">Ver</a> ' . $remove . '</td></tr>';
    }
    if (!$rows) {
        $rows = '<tr><td colspan="7" class="empty">No hay pedidos visibles.</td></tr>';
    }
    $content = '<div class="admin-head"><h1>Pedidos</h1></div><div class="panel"><table class="admin-table"><thead><tr><th>Pedido</th><th>Cliente</th><th>Prendas</th><th>Envio</th><th>Total/Pago</th><th>Estado</th><th></th></tr></thead><tbody>' . $rows . '</tbody></table></div>';
    admin_page('Pedidos', $content, 'pedidos');
}

function admin_order_detail() {
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $order = one("SELECT * FROM orders WHERE id = ?", array($id));
    if (!$order) {
        redirect_to('admin-pedidos', array('err' => 'Pedido no encontrado.'));
    }
    $items = all_rows("SELECT * FROM order_items WHERE order_id = ?", array($id));
    $rows = '';
    foreach ($items as $it) {
        $rows .= '<tr><td><div class="order-product">' . image_tag($it['image'], 'mini-img', $it['product_name']) . '<div><strong>' . e($it['product_name']) . '</strong><br><span class="muted">Talla/variante: ' . e($it['size']) . '</span></div></div></td><td>' . (int)$it['quantity'] . '</td><td>' . money($it['price']) . '</td><td class="right">' . money($it['price'] * $it['quantity']) . '</td></tr>';
    }
    $receipt = $order['receipt_file'] ? '<a class="btn secondary" target="_blank" href="' . e(url('comprobante', array('id' => $order['id']))) . '">Ver comprobante Yape</a>' : '<span class="muted">Sin comprobante</span>';
    $invoice = $order['payment_status'] === 'Aprobado' ? '<a class="btn red invoice-btn" target="_blank" href="' . e(url('admin-boleta', array('id' => $order['id']))) . '">Generar boleta PDF</a>' : '<span class="muted">Aprueba el pago para generar boleta.</span>';
    $delete = in_array($order['status'], array('Entregado', 'Cancelado'), true) ? '<form method="post" action="' . e(url('admin-pedido-eliminar')) . '" class="inline-form" onsubmit="return confirm(\'Quitar este pedido del panel?\')">' . csrf_field() . '<input type="hidden" name="id" value="' . (int)$order['id'] . '"><button class="btn small danger">Eliminar del panel</button></form>' : '';
    $content = '<div class="detail-head"><div><span class="eyebrow"><span class="dot"></span>Pedido #' . (int)$order['id'] . '</span><h1>Detalle del pedido</h1></div><a class="btn secondary" href="' . e(url('admin-pedidos')) . '">Volver</a></div>
    <div class="admin-grid"><div class="panel"><table class="admin-table"><thead><tr><th>Prenda</th><th>Cant.</th><th>Precio</th><th class="right">Subtotal</th></tr></thead><tbody>' . $rows . '</tbody></table></div>
    <div class="panel"><h2>Cliente y envio</h2><p><strong>' . e($order['customer_name']) . '</strong><br>' . e($order['email']) . '<br>' . e($order['phone']) . '</p><p><strong>Direccion:</strong><br>' . e($order['address']) . '</p><p><strong>Agencia:</strong><br>' . shipping_badge() . '</p><h2>Yape</h2><p>Numero: ' . e($order['yape_phone']) . '<br>Destinatario: ' . e($order['yape_recipient']) . '<br>Nombre Yape: ' . e($order['yape_name']) . '<br>Operacion: ' . e($order['yape_operation']) . '</p>' . $receipt . '<div class="invoice-box"><h3>Boleta</h3>' . $invoice . '</div>
    <form method="post" action="' . e(url('admin-pedido-estado')) . '" class="form-grid mt">' . csrf_field() . '<input type="hidden" name="id" value="' . (int)$order['id'] . '"><label class="field"><span>Estado envio</span><select name="status">' . options(array('Pendiente','Confirmado','Preparando','Enviado','Entregado','Cancelado'), $order['status']) . '</select></label><label class="field"><span>Estado pago</span><select name="payment_status">' . options(array('En revision','Aprobado','Rechazado'), $order['payment_status']) . '</select></label><div class="field full"><button class="btn red">Guardar estado</button>' . $delete . '</div></form>
    <div class="total-line mt"><span>Total</span><strong>' . money($order['total']) . '</strong></div></div></div>';
    admin_page('Pedido #' . $id, $content, 'pedidos');
}

function options($values, $selected) {
    $html = '';
    foreach ($values as $value) {
        $html .= '<option value="' . e($value) . '"' . ($value === $selected ? ' selected' : '') . '>' . e($value) . '</option>';
    }
    return $html;
}

function handle_admin_order_status() {
    check_csrf();
    require_admin();
    $id = (int)$_POST['id'];
    $status = trim($_POST['status']);
    $payment = trim($_POST['payment_status']);
    run_sql("UPDATE orders SET status = ?, payment_status = ? WHERE id = ?", array($status, $payment, $id));
    redirect_to('admin-pedido', array('id' => $id, 'ok' => 'Pedido actualizado.'));
}

function handle_admin_order_delete() {
    check_csrf();
    require_admin();
    $id = (int)$_POST['id'];
    $order = one("SELECT * FROM orders WHERE id = ?", array($id));
    if (!$order || !in_array($order['status'], array('Entregado', 'Cancelado'), true)) {
        redirect_to('admin-pedidos', array('err' => 'Solo puedes quitar pedidos entregados o cancelados.'));
    }
    run_sql("UPDATE orders SET admin_hidden = 1 WHERE id = ?", array($id));
    redirect_to('admin-pedidos', array('ok' => 'Pedido quitado del panel. El cliente aun lo conserva en su cuenta.'));
}

function admin_products() {
    $rows = all_rows("SELECT * FROM products ORDER BY active DESC, created_at DESC");
    $html = '';
    foreach ($rows as $p) {
        $action = $p['active'] ? '<form method="post" action="' . e(url('admin-producto-eliminar')) . '" class="inline-form">' . csrf_field() . '<input type="hidden" name="id" value="' . (int)$p['id'] . '"><button class="btn small danger">Ocultar</button></form>' : '<form method="post" action="' . e(url('admin-producto-restaurar')) . '" class="inline-form">' . csrf_field() . '<input type="hidden" name="id" value="' . (int)$p['id'] . '"><button class="btn small secondary">Restaurar</button></form>';
        $html .= '<tr><td>' . product_media($p, true) . '</td><td><strong>' . e($p['name']) . '</strong><br><span class="muted">' . e($p['category']) . '</span></td><td>' . money($p['price']) . '</td><td>' . ($p['promo_price'] ? money($p['promo_price']) : '-') . '</td><td>' . (int)$p['stock'] . '</td><td>' . e($p['sizes']) . '</td><td><a class="btn small secondary" href="' . e(url('admin-producto-form', array('id' => $p['id']))) . '">Editar</a>' . $action . '</td></tr>';
    }
    if (!$html) {
        $html = '<tr><td colspan="7" class="empty">No hay productos.</td></tr>';
    }
    $content = '<div class="admin-head"><h1>Productos y stock</h1><div><a class="btn red" href="' . e(url('admin-producto-form')) . '">Agregar prenda</a> <a class="btn secondary" href="' . e(url('admin-productos-masivo')) . '">Agregar hasta 20</a></div></div><div class="panel"><table class="admin-table"><thead><tr><th>Foto</th><th>Producto</th><th>Precio</th><th>Promo</th><th>Stock</th><th>Tallas</th><th></th></tr></thead><tbody>' . $html . '</tbody></table></div>';
    admin_page('Productos', $content, 'productos');
}

function admin_product_form() {
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $p = $id ? one("SELECT * FROM products WHERE id = ?", array($id)) : null;
    $action = $p ? 'admin-producto-guardar' : 'admin-producto-crear';
    $image = $p && $p['image'] ? '<div class="field full"><span>Foto actual</span><img class="mini-img" src="' . e($p['image']) . '" alt=""></div>' : '';
    $content = '<div class="admin-head"><h1>' . ($p ? 'Editar producto' : 'Agregar producto') . '</h1><a class="btn secondary" href="' . e(url('admin-productos')) . '">Volver</a></div>
    <form class="panel form-grid" method="post" enctype="multipart/form-data" action="' . e(url($action)) . '">' . csrf_field() . '<input type="hidden" name="id" value="' . ($p ? (int)$p['id'] : 0) . '">
        <label class="field"><span>Nombre</span><input name="name" required value="' . e($p ? $p['name'] : '') . '"></label>
        <label class="field"><span>Categoria</span><input name="category" required value="' . e($p ? $p['category'] : 'Polos') . '"></label>
        <label class="field"><span>Precio</span><input type="number" step="0.01" name="price" required value="' . e($p ? $p['price'] : '') . '"></label>
        <label class="field"><span>Precio promo</span><input type="number" step="0.01" name="promo_price" value="' . e($p ? $p['promo_price'] : '') . '"></label>
        <label class="field"><span>Stock</span><input type="number" name="stock" required value="' . e($p ? $p['stock'] : 0) . '"></label>
        <label class="field"><span>Tallas / variantes</span><input name="sizes" value="' . e($p ? $p['sizes'] : 'S,M,L,XL') . '"></label>
        <label class="field full"><span>Descripcion</span><textarea name="description">' . e($p ? $p['description'] : '') . '</textarea></label>
        ' . $image . '
        <label class="field full"><span>Foto</span><input type="file" name="image" accept=".jpg,.jpeg,.png,.webp"></label>
        <div class="field full"><button class="btn red">Guardar producto</button></div>
    </form>';
    admin_page('Producto', $content, 'productos');
}

function admin_products_bulk_form() {
    require_admin();
    $categories = array('Polos', 'Camisas', 'Poleras', 'Pantalones', 'Shorts', 'Accesorios', 'Zapatillas', 'Perfumes', 'Otros');
    $rows = '';

    for ($i = 0; $i < 20; $i++) {
        $number = $i + 1;
        $options = '';
        foreach ($categories as $category) {
            $options .= '<option value="' . e($category) . '">' . e($category) . '</option>';
        }

        $rows .= '<div class="panel" style="margin-bottom:18px">
            <h2>Producto ' . $number . '</h2>
            <div class="form-grid">
                <label class="field"><span>Nombre</span><input name="name[]" placeholder="Ej. Polo Oversize Negro"></label>
                <label class="field"><span>Categoria</span><select name="category[]">' . $options . '</select></label>
                <label class="field"><span>Precio</span><input type="number" min="0" step="0.01" name="price[]" placeholder="0.00"></label>
                <label class="field"><span>Precio promo</span><input type="number" min="0" step="0.01" name="promo_price[]" placeholder="Opcional"></label>
                <label class="field"><span>Stock</span><input type="number" min="0" name="stock[]" value="0"></label>
                <label class="field"><span>Tallas / variantes</span><input name="sizes[]" value="S,M,L,XL" placeholder="S,M,L,XL"></label>
                <label class="field full"><span>Descripcion</span><textarea name="description[]" placeholder="Descripcion del producto"></textarea></label>
                <label class="field full"><span>Foto</span><input type="file" name="images[]" accept=".jpg,.jpeg,.png,.webp"></label>
            </div>
        </div>';
    }

    $content = '<div class="admin-head"><div><h1>Agregar hasta 20 productos</h1><p class="muted">Completa solo los productos que quieras agregar. Los espacios vacios se ignoran. Usa la categoria Perfumes para que aparezcan en la seccion Perfumes; las demas categorias aparecen en Catalogo JAMA.</p></div><a class="btn secondary" href="' . e(url('admin-productos')) . '">Volver</a></div>
    <form method="post" enctype="multipart/form-data" action="' . e(url('admin-productos-masivo-guardar')) . '">' . csrf_field() . '
        ' . $rows . '
        <div class="panel"><button class="btn red" type="submit">Guardar productos</button></div>
    </form>';

    admin_page('Agregar productos', $content, 'productos');
}

function upload_file_array($field, $index, $dir, $prefix, $allowed) {
    if (empty($_FILES[$field]) || !isset($_FILES[$field]['error'][$index]) || $_FILES[$field]['error'][$index] === UPLOAD_ERR_NO_FILE) {
        return '';
    }
    if ($_FILES[$field]['error'][$index] !== UPLOAD_ERR_OK) {
        return '';
    }

    $originalName = isset($_FILES[$field]['name'][$index]) ? $_FILES[$field]['name'][$index] : '';
    $tmpName = isset($_FILES[$field]['tmp_name'][$index]) ? $_FILES[$field]['tmp_name'][$index] : '';
    $ext = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));

    if (!$tmpName || !in_array($ext, $allowed, true)) {
        return '';
    }

    $name = $prefix . '-' . bin2hex(random_bytes(8)) . '.' . $ext;
    $target = rtrim($dir, '/\\') . '/' . $name;
    if (!move_uploaded_file($tmpName, $target)) {
        return '';
    }

    return relative_path($target);
}

function handle_products_bulk_save() {
    check_csrf();
    require_admin();

    $names = isset($_POST['name']) && is_array($_POST['name']) ? $_POST['name'] : array();
    $categories = isset($_POST['category']) && is_array($_POST['category']) ? $_POST['category'] : array();
    $prices = isset($_POST['price']) && is_array($_POST['price']) ? $_POST['price'] : array();
    $promoPrices = isset($_POST['promo_price']) && is_array($_POST['promo_price']) ? $_POST['promo_price'] : array();
    $stocks = isset($_POST['stock']) && is_array($_POST['stock']) ? $_POST['stock'] : array();
    $sizes = isset($_POST['sizes']) && is_array($_POST['sizes']) ? $_POST['sizes'] : array();
    $descriptions = isset($_POST['description']) && is_array($_POST['description']) ? $_POST['description'] : array();

    $created = 0;
    $skipped = 0;
    $max = min(20, count($names));

    for ($i = 0; $i < $max; $i++) {
        $name = trim(isset($names[$i]) ? $names[$i] : '');
        $priceText = trim(isset($prices[$i]) ? (string)$prices[$i] : '');

        if ($name === '') {
            continue;
        }
        if ($priceText === '' || !is_numeric($priceText)) {
            $skipped++;
            continue;
        }

        $category = trim(isset($categories[$i]) ? $categories[$i] : 'Polos');
        if ($category === '') {
            $category = 'Polos';
        }
        $price = max(0, (float)$priceText);
        $promoText = trim(isset($promoPrices[$i]) ? (string)$promoPrices[$i] : '');
        $promoPrice = ($promoText === '' || !is_numeric($promoText)) ? null : max(0, (float)$promoText);
        $stock = max(0, (int)(isset($stocks[$i]) ? $stocks[$i] : 0));
        $sizeText = trim(isset($sizes[$i]) ? $sizes[$i] : '');
        $description = trim(isset($descriptions[$i]) ? $descriptions[$i] : '');
        $image = upload_file_array('images', $i, UPLOAD_PRODUCTS_DIR, 'producto', array('jpg','jpeg','png','webp'));

        run_sql(
            "INSERT INTO products (name, category, price, promo_price, stock, sizes, description, image, active, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?)",
            array($name, $category, $price, $promoPrice, $stock, $sizeText, $description, $image, now_text())
        );
        $created++;
    }

    if ($created === 0) {
        redirect_to('admin-productos-masivo', array('err' => 'No se agregaron productos. Completa al menos nombre y precio.'));
    }

    $message = $created . ' producto(s) agregado(s) correctamente.';
    if ($skipped > 0) {
        $message .= ' ' . $skipped . ' fila(s) se omitieron por no tener precio valido.';
    }
    redirect_to('admin-productos', array('ok' => $message));
}

function handle_product_save($create = false) {
    check_csrf();
    require_admin();
    $id = isset($_POST['id']) ? (int)$_POST['id'] : 0;
    $current = $id ? one("SELECT * FROM products WHERE id = ?", array($id)) : null;
    $image = upload_file('image', UPLOAD_PRODUCTS_DIR, 'producto', array('jpg','jpeg','png','webp'));
    if (!$image && $current) {
        $image = $current['image'];
    }
    $data = array(
        trim($_POST['name']),
        trim($_POST['category']),
        (float)$_POST['price'],
        $_POST['promo_price'] === '' ? null : (float)$_POST['promo_price'],
        (int)$_POST['stock'],
        trim($_POST['sizes']),
        trim($_POST['description']),
        $image
    );
    if ($create) {
        run_sql("INSERT INTO products (name, category, price, promo_price, stock, sizes, description, image, active, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?)", array_merge($data, array(now_text())));
    } else {
        $data[] = $id;
        run_sql("UPDATE products SET name = ?, category = ?, price = ?, promo_price = ?, stock = ?, sizes = ?, description = ?, image = ? WHERE id = ?", $data);
    }
    redirect_to('admin-productos', array('ok' => 'Producto guardado.'));
}

function handle_product_active($active) {
    check_csrf();
    require_admin();
    $id = (int)$_POST['id'];
    run_sql("UPDATE products SET active = ? WHERE id = ?", array($active ? 1 : 0, $id));
    redirect_to('admin-productos', array('ok' => $active ? 'Producto restaurado.' : 'Producto ocultado.'));
}

function admin_clients() {
    $rows = all_rows("SELECT u.*, COUNT(o.id) AS orders_count, COALESCE(SUM(o.total),0) AS spent FROM users u LEFT JOIN orders o ON o.user_id = u.id WHERE u.role = 'client' GROUP BY u.id ORDER BY u.created_at DESC");
    $html = '';
    foreach ($rows as $u) {
        $html .= '<tr><td><strong>' . e($u['name']) . '</strong><br><span class="muted">' . e($u['email']) . '</span></td><td>' . e($u['auth_provider']) . '</td><td>' . (int)$u['orders_count'] . '</td><td>' . money($u['spent']) . '</td><td>' . ($u['promo_opt_in'] ? 'Si' : 'No') . '</td></tr>';
    }
    if (!$html) {
        $html = '<tr><td colspan="5" class="empty">Aun no hay clientes.</td></tr>';
    }
    $content = '<div class="admin-head"><h1>Clientes</h1></div><div class="panel"><table class="admin-table"><thead><tr><th>Cliente</th><th>Registro</th><th>Pedidos</th><th>Total</th><th>Promos</th></tr></thead><tbody>' . $html . '</tbody></table></div>';
    admin_page('Clientes', $content, 'clientes');
}

function admin_promotions() {
    $recipientCount = one("SELECT COUNT(*) AS total FROM users WHERE role = 'client' AND promo_opt_in = 1");
    $promos = all_rows("SELECT * FROM promotions ORDER BY created_at DESC");
    $history = '';
    foreach ($promos as $p) {
        $discount = trim((string)$p['discount']) !== '' ? $p['discount'] : 'PROMO';
        $history .= '<article class="jama-admin-promo-item">
            <div class="jama-admin-promo-discount">' . e($discount) . '</div>
            <div class="jama-admin-promo-main"><strong>' . e($p['title']) . '</strong><p>' . e($p['message']) . '</p></div>
            <div class="jama-admin-promo-meta"><span><b>' . (int)$p['recipients'] . '</b> clientes</span><small>' . e($p['created_at']) . '</small></div>
        </article>';
    }
    if (!$history) {
        $history = '<div class="empty">Aun no hay promociones.</div>';
    }
    $content = '<style>
        .jama-promo-admin-layout{display:grid;grid-template-columns:minmax(300px,.9fr) minmax(420px,1.35fr);gap:22px;align-items:start}
        .jama-promo-admin-card{border-radius:20px;overflow:hidden}.jama-promo-admin-head{margin:-2px 0 18px}.jama-promo-admin-head span{display:block;font-size:12px;font-weight:800;letter-spacing:1.2px;text-transform:uppercase;opacity:.55;margin-bottom:5px}.jama-promo-admin-head h2{margin:0 0 5px}.jama-promo-admin-head p{margin:0;opacity:.7}
        .jama-promo-tip{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:12px 14px;border:1px solid rgba(255,255,255,.09);border-radius:14px;margin-top:2px}.jama-promo-tip strong{font-size:20px}.jama-promo-tip span{font-size:12px;opacity:.68}
        .jama-promo-history{display:grid;gap:10px}.jama-admin-promo-item{display:grid;grid-template-columns:96px minmax(0,1fr) auto;gap:15px;align-items:center;padding:15px;border:1px solid rgba(255,255,255,.08);border-radius:16px;background:rgba(255,255,255,.025)}
        .jama-admin-promo-discount{padding:13px 10px;border-radius:13px;background:#fff;color:#111;font-weight:900;text-align:center;line-height:1.05}.jama-admin-promo-main strong{display:block;font-size:15px;margin-bottom:4px}.jama-admin-promo-main p{margin:0;opacity:.66;font-size:13px;line-height:1.4}.jama-admin-promo-meta{text-align:right;white-space:nowrap}.jama-admin-promo-meta span{display:block;font-size:12px;margin-bottom:4px}.jama-admin-promo-meta small{opacity:.55;font-size:11px}
        @media(max-width:900px){.jama-promo-admin-layout{grid-template-columns:1fr}.jama-admin-promo-item{grid-template-columns:85px minmax(0,1fr)}.jama-admin-promo-meta{grid-column:2;text-align:left}}
        @media(max-width:520px){.jama-admin-promo-item{grid-template-columns:1fr}.jama-admin-promo-discount{width:max-content;min-width:100px}.jama-admin-promo-meta{grid-column:auto}}
    </style>
    <div class="admin-head"><div><span class="eyebrow"><span class="dot"></span>Marketing</span><h1>Promociones</h1></div></div>
    <div class="jama-promo-admin-layout">
        <form method="post" action="' . e(url('admin-promo-crear')) . '" class="panel form-grid jama-promo-admin-card">' . csrf_field() . '
            <div class="field full jama-promo-admin-head"><span>Nueva promoción</span><h2>Crea una promo clara y llamativa</h2><p>El descuento se mostrará como el elemento principal para tus clientes.</p></div>
            <label class="field"><span>Titulo</span><input name="title" required placeholder="Ej. Descuento en todas las prendas"></label>
            <label class="field"><span>Descuento</span><input name="discount" placeholder="30% OFF"></label>
            <label class="field full"><span>Mensaje</span><textarea name="message" required placeholder="Ej. Aprovecha el descuento por tiempo limitado en prendas seleccionadas."></textarea></label>
            <div class="field full jama-promo-tip"><div><span>Clientes que aceptan promociones</span><strong>' . (int)$recipientCount['total'] . '</strong></div><span>Si tu hosting tiene correo activo, también se intentará enviar por email.</span></div>
            <div class="field full"><button class="btn red">Crear y avisar</button></div>
        </form>
        <div class="panel jama-promo-admin-card"><div class="jama-promo-admin-head"><span>Historial</span><h2>Promociones publicadas</h2><p>Vista rápida del descuento, alcance y fecha.</p></div><div class="jama-promo-history">' . $history . '</div></div>
    </div>';
    admin_page('Promociones', $content, 'promos');
}

function handle_promotion_create() {
    check_csrf();
    require_admin();
    $title = trim($_POST['title']);
    $message = trim($_POST['message']);
    $discount = trim(isset($_POST['discount']) ? $_POST['discount'] : '');
    $clients = all_rows("SELECT email FROM users WHERE role = 'client' AND promo_opt_in = 1");
    foreach ($clients as $client) {
        @mail($client['email'], $title, $message, 'From: ' . CONTACT_EMAIL);
    }
    run_sql("INSERT INTO promotions (title, message, discount, recipients, sent_at, created_at) VALUES (?, ?, ?, ?, ?, ?)", array($title, $message, $discount, count($clients), now_text(), now_text()));
    redirect_to('admin-promociones', array('ok' => 'Promocion guardada.'));
}

function page_promos() {
    $rows = all_rows("SELECT * FROM promotions ORDER BY created_at DESC LIMIT 12");
    $html = '';
    foreach ($rows as $p) {
        $discount = trim((string)$p['discount']) !== '' ? $p['discount'] : 'PROMO';
        $html .= '<article class="jama-promo-card">
            <div class="jama-promo-card-top"><span class="jama-promo-card-label">Oferta JAMA</span><div class="jama-promo-card-off">' . e($discount) . '</div></div>
            <div class="jama-promo-card-body"><h2>' . e($p['title']) . '</h2><p>' . e($p['message']) . '</p></div>
            <div class="jama-promo-card-foot"><span>Disponible en JAMA Store</span><a class="btn small secondary" href="' . e(url('catalogo')) . '">Ver catálogo</a></div>
        </article>';
    }
    if (!$html) {
        $html = '<div class="panel empty">Aun no hay promociones publicadas.</div>';
    }
    $content = '<style>
        .jama-promos-head{margin-bottom:24px}.jama-promos-head h1{margin-bottom:7px}.jama-promos-head p{margin:0;opacity:.68;max-width:660px}
        .jama-promos-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:18px}
        .jama-promo-card{position:relative;overflow:hidden;padding:23px;border:1px solid rgba(255,255,255,.09);border-radius:21px;background:linear-gradient(145deg,rgba(255,255,255,.045),rgba(255,255,255,.018));box-shadow:0 14px 35px rgba(0,0,0,.10)}
        .jama-promo-card:after{content:"";position:absolute;width:170px;height:170px;border-radius:50%;right:-78px;top:-90px;background:rgba(255,255,255,.025)}
        .jama-promo-card-top{position:relative;z-index:1;display:flex;align-items:center;justify-content:space-between;gap:15px;margin-bottom:18px}.jama-promo-card-label{font-size:11px;font-weight:800;letter-spacing:1.3px;text-transform:uppercase;opacity:.55}.jama-promo-card-off{min-width:106px;padding:12px 14px;border-radius:14px;background:#fff;color:#111;font-size:22px;font-weight:900;text-align:center;line-height:1;letter-spacing:-.5px}
        .jama-promo-card-body{position:relative;z-index:1}.jama-promo-card-body h2{margin:0 0 8px;font-size:23px;line-height:1.12}.jama-promo-card-body p{margin:0;opacity:.7;line-height:1.55}.jama-promo-card-foot{position:relative;z-index:1;display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:21px;padding-top:15px;border-top:1px solid rgba(255,255,255,.07)}.jama-promo-card-foot span{font-size:12px;opacity:.52}
        @media(max-width:760px){.jama-promos-grid{grid-template-columns:1fr}.jama-promo-card{padding:20px}}
    </style>
    <main class="section"><div class="wrap"><div class="jama-promos-head"><span class="eyebrow"><span class="dot"></span>Promos</span><h1>Promociones JAMA</h1><p>Descuentos y oportunidades activas para comprar tus prendas y productos favoritos.</p></div><div class="jama-promos-grid">' . $html . '</div></div></main>';
    page('Promos', $content, 'promos');
}

function admin_socials() {
    $rows = all_rows("SELECT * FROM social_links ORDER BY active DESC, created_at DESC");
    $html = '';
    foreach ($rows as $s) {
        $icon = $s['icon'] ? '<img class="mini-img tiny" src="' . e($s['icon']) . '" alt="">' : '<span class="social-icon social-initial">' . e(substr($s['name'], 0, 1)) . '</span>';
        $html .= '<tr><td>' . $icon . '</td><td><strong>' . e($s['name']) . '</strong><br><span class="muted">' . e($s['url']) . '</span></td><td><form method="post" action="' . e(url('admin-redes-eliminar')) . '" class="inline-form">' . csrf_field() . '<input type="hidden" name="id" value="' . (int)$s['id'] . '"><button class="btn small danger">Eliminar</button></form></td></tr>';
    }
    if (!$html) {
        $html = '<tr><td colspan="3" class="empty">Aun no agregaste redes.</td></tr>';
    }
    $content = '<div class="admin-head"><h1>Redes sociales</h1></div><div class="admin-grid"><form class="panel form-grid" method="post" enctype="multipart/form-data" action="' . e(url('admin-redes-crear')) . '">' . csrf_field() . '<label class="field"><span>Red social</span><input name="name" placeholder="Instagram" required></label><label class="field"><span>Enlace</span><input name="url" placeholder="https://instagram.com/..." required></label><label class="field full"><span>Icono / foto</span><input type="file" name="icon" accept=".jpg,.jpeg,.png,.webp"></label><div class="field full"><button class="btn red">Agregar red</button></div></form><div class="panel"><table class="admin-table"><thead><tr><th>Icono</th><th>Red</th><th></th></tr></thead><tbody>' . $html . '</tbody></table></div></div>';
    admin_page('Redes', $content, 'redes');
}

function normalize_social_url($url) {
    $url = trim($url);
    if ($url && !preg_match('/^https?:\/\//i', $url)) {
        $url = 'https://' . $url;
    }
    return $url;
}

function handle_social_create() {
    check_csrf();
    require_admin();
    $icon = upload_file('icon', UPLOAD_SOCIAL_DIR, 'red', array('jpg','jpeg','png','webp'));
    run_sql("INSERT INTO social_links (name, url, icon, active, created_at) VALUES (?, ?, ?, 1, ?)", array(trim($_POST['name']), normalize_social_url($_POST['url']), $icon, now_text()));
    redirect_to('admin-redes', array('ok' => 'Red social agregada.'));
}

function handle_social_delete() {
    check_csrf();
    require_admin();
    run_sql("DELETE FROM social_links WHERE id = ?", array((int)$_POST['id']));
    redirect_to('admin-redes', array('ok' => 'Red social eliminada.'));
}

function serve_receipt() {
    require_user();
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $order = one("SELECT * FROM orders WHERE id = ?", array($id));
    $user = current_user();
    if (!$order || (!$user || ($user['role'] !== 'admin' && (int)$order['user_id'] !== (int)$user['id']))) {
        http_response_code(403);
        echo 'No autorizado.';
        exit;
    }
    $file = BASE_PATH . '/' . $order['receipt_file'];
    if (!is_file($file)) {
        http_response_code(404);
        echo 'Comprobante no encontrado.';
        exit;
    }
    $ext = strtolower(pathinfo($file, PATHINFO_EXTENSION));
    $types = array('jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'pdf' => 'application/pdf');
    header('Content-Type: ' . (isset($types[$ext]) ? $types[$ext] : 'application/octet-stream'));
    header('Content-Length: ' . filesize($file));
    readfile($file);
    exit;
}

function pdf_escape($text) {
    $text = (string)$text;
    if (function_exists('iconv')) {
        $converted = @iconv('UTF-8', 'ASCII//TRANSLIT//IGNORE', $text);
        if ($converted !== false) {
            $text = $converted;
        }
    }
    return str_replace(array('\\', '(', ')', "\r", "\n"), array('\\\\', '\\(', '\\)', ' ', ' '), $text);
}

function pdf_short($text, $max = 36) {
    $text = trim((string)$text);
    if (strlen($text) <= $max) {
        return $text;
    }
    return substr($text, 0, max(0, $max - 3)) . '...';
}

function pdf_text_cmd($x, $y, $size, $text, $font = 'F1', $rgb = array(0.12,0.12,0.14)) {
    return sprintf("BT /%s %.2f Tf %.3f %.3f %.3f rg %.2f %.2f Td (%s) Tj ET\n", $font, $size, $rgb[0], $rgb[1], $rgb[2], $x, $y, pdf_escape($text));
}

function jama_invoice_pdf($order, $items) {
    $c = '';

    // Fondo y cabecera premium.
    $c .= "0.075 0.075 0.090 rg 0 760 595 82 re f\n";
    $c .= "0.780 0.050 0.080 rg 0 754 595 6 re f\n";
    $c .= pdf_text_cmd(38, 805, 24, 'JAMA STORE', 'F2', array(1,1,1));
    $c .= pdf_text_cmd(39, 784, 10, 'Ropa urbana y perfumes | Peru', 'F1', array(0.82,0.82,0.84));
    $c .= pdf_text_cmd(420, 806, 12, 'COMPROBANTE', 'F2', array(1,1,1));
    $c .= pdf_text_cmd(420, 787, 10, 'Pedido #' . str_pad($order['id'], 6, '0', STR_PAD_LEFT), 'F1', array(0.88,0.88,0.90));

    // Datos generales.
    $c .= "0.965 0.965 0.972 rg 32 650 531 82 re f\n";
    $c .= pdf_text_cmd(46, 710, 9, 'CLIENTE', 'F2', array(0.45,0.45,0.48));
    $c .= pdf_text_cmd(46, 692, 12, pdf_short($order['customer_name'], 42), 'F2');
    $c .= pdf_text_cmd(46, 675, 9, pdf_short($order['email'], 52), 'F1', array(0.32,0.32,0.35));
    $c .= pdf_text_cmd(310, 710, 9, 'FECHA / PAGO', 'F2', array(0.45,0.45,0.48));
    $c .= pdf_text_cmd(310, 692, 10, $order['created_at'], 'F1');
    $c .= pdf_text_cmd(310, 675, 9, 'Yape: ' . pdf_short($order['yape_name'], 28), 'F1', array(0.32,0.32,0.35));

    $c .= pdf_text_cmd(46, 635, 9, 'ENVIO', 'F2', array(0.45,0.45,0.48));
    $c .= pdf_text_cmd(46, 619, 9, pdf_short($order['address'], 74), 'F1');
    $c .= pdf_text_cmd(46, 603, 9, 'Agencia: ' . $order['shipping_agency'] . '   |   Telefono: ' . $order['phone'], 'F1', array(0.32,0.32,0.35));

    // Tabla.
    $tableTop = 565;
    $c .= "0.075 0.075 0.090 rg 32 " . ($tableTop - 4) . " 531 28 re f\n";
    $c .= pdf_text_cmd(42, $tableTop + 5, 9, 'PRODUCTO', 'F2', array(1,1,1));
    $c .= pdf_text_cmd(305, $tableTop + 5, 9, 'VARIANTE', 'F2', array(1,1,1));
    $c .= pdf_text_cmd(400, $tableTop + 5, 9, 'CANT.', 'F2', array(1,1,1));
    $c .= pdf_text_cmd(450, $tableTop + 5, 9, 'PRECIO', 'F2', array(1,1,1));
    $c .= pdf_text_cmd(510, $tableTop + 5, 9, 'TOTAL', 'F2', array(1,1,1));

    $y = $tableTop - 27;
    $maxRows = 16;
    $shown = 0;
    foreach ($items as $it) {
        if ($shown >= $maxRows) break;
        if ($shown % 2 === 1) {
            $c .= sprintf("0.975 0.975 0.980 rg 32 %.2f 531 24 re f\n", $y - 7);
        }
        $c .= pdf_text_cmd(42, $y, 9, pdf_short($it['product_name'], 36), 'F1');
        $c .= pdf_text_cmd(305, $y, 8.5, pdf_short($it['size'], 14), 'F1');
        $c .= pdf_text_cmd(408, $y, 9, (string)(int)$it['quantity'], 'F1');
        $c .= pdf_text_cmd(450, $y, 8.5, money($it['price']), 'F1');
        $c .= pdf_text_cmd(510, $y, 8.5, money($it['price'] * $it['quantity']), 'F2');
        $c .= sprintf("0.88 0.88 0.90 RG 32 %.2f m 563 %.2f l S\n", $y - 10, $y - 10);
        $y -= 27;
        $shown++;
    }
    if (count($items) > $maxRows) {
        $c .= pdf_text_cmd(42, $y, 8.5, '... y ' . (count($items) - $maxRows) . ' producto(s) mas', 'F1', array(0.40,0.40,0.43));
        $y -= 24;
    }

    // Total y pie.
    $totalBoxY = max(82, $y - 52);
    $c .= sprintf("0.965 0.965 0.972 rg 335 %.2f 228 56 re f\n", $totalBoxY);
    $c .= pdf_text_cmd(350, $totalBoxY + 34, 9, 'TOTAL PAGADO', 'F2', array(0.45,0.45,0.48));
    $c .= pdf_text_cmd(444, $totalBoxY + 20, 19, money($order['total']), 'F2', array(0.72,0.04,0.07));
    $c .= pdf_text_cmd(38, 50, 9, 'Gracias por comprar en JAMA Store.', 'F2');
    $c .= pdf_text_cmd(38, 34, 7.5, 'Comprobante interno de pedido. No reemplaza un comprobante electronico emitido ante SUNAT.', 'F1', array(0.46,0.46,0.48));

    $objects = array();
    $objects[] = "1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n";
    $objects[] = "2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n";
    $objects[] = "3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] /Resources << /Font << /F1 5 0 R /F2 6 0 R >> >> /Contents 4 0 R >> endobj\n";
    $objects[] = "4 0 obj << /Length " . strlen($c) . " >> stream\n" . $c . "\nendstream\nendobj\n";
    $objects[] = "5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj\n";
    $objects[] = "6 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica-Bold >> endobj\n";

    $pdf = "%PDF-1.4\n";
    $offsets = array(0);
    foreach ($objects as $obj) {
        $offsets[] = strlen($pdf);
        $pdf .= $obj;
    }
    $xref = strlen($pdf);
    $pdf .= "xref\n0 " . (count($objects) + 1) . "\n0000000000 65535 f \n";
    for ($i = 1; $i <= count($objects); $i++) {
        $pdf .= sprintf("%010d 00000 n \n", $offsets[$i]);
    }
    $pdf .= "trailer << /Size " . (count($objects) + 1) . " /Root 1 0 R >>\nstartxref\n" . $xref . "\n%%EOF";
    return $pdf;
}

function admin_invoice_pdf() {
    require_admin();
    $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
    $order = one("SELECT * FROM orders WHERE id = ?", array($id));
    if (!$order || $order['payment_status'] !== 'Aprobado') {
        redirect_to('admin-pedidos', array('err' => 'Primero aprueba el pago.'));
    }
    $items = all_rows("SELECT * FROM order_items WHERE order_id = ?", array($id));
    $pdf = jama_invoice_pdf($order, $items);
    header('Content-Type: application/pdf');
    header('Content-Disposition: inline; filename="comprobante-jama-' . (int)$order['id'] . '.pdf"');
    header('Content-Length: ' . strlen($pdf));
    echo $pdf;
    exit;
}

function admin_backup() {
    require_admin();
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="jama-store-backup-' . date('Ymd-His') . '.sqlite"');
    header('Content-Length: ' . filesize(DB_PATH));
    readfile(DB_PATH);
    exit;
}

function legal_page($title) {
    $content = '<main class="section legal-page"><div class="wrap"><span class="eyebrow"><span class="dot"></span>JAMA Store</span><h1>' . e($title) . '</h1><div class="panel legal-card"><p>Acceso y Navegación: El uso de nuestra plataforma es libre y gratuito. Al navegar en el sitio, el usuario se compromete a proporcionar información verídica y mantener un uso adecuado de las funcionalidades disponibles.

Disponibilidad de Stock: Las prendas y perfumes mostrados están sujetos a disponibilidad de stock. En caso de agotarse un producto finalizado el pedido, nos comunicaremos de inmediato para coordinar el cambio o la devolución del monto abonado.</p><p>Contacto: ' . e(CONTACT_EMAIL) . ' - ' . e(CONTACT_PHONE) . '</p></div></div></main>';
    page($title, $content);
}

$route = current_route();

try {
    switch ($route) {
        case 'inicio': page_home(); break;
        case 'catalogo': page_catalog(false); break;
        case 'perfumes': page_catalog(true); break;
        case 'producto': page_product(); break;
        case 'promos': page_promos(); break;
        case 'carrito': page_cart(); break;
        case 'agregar': handle_add_to_cart(); break;
        case 'carrito-actualizar': handle_cart_update(); break;
        case 'carrito-eliminar': handle_cart_remove(); break;
        case 'pedido-crear': handle_create_order(); break;
        case 'pedido-exito': page_order_success(); break;
        case 'mis-pedidos': page_my_orders(); break;
        case 'pedido': page_customer_order(); break;
        case 'login': $_SERVER['REQUEST_METHOD'] === 'POST' ? handle_login(false) : page_login(false); break;
        case 'registro': $_SERVER['REQUEST_METHOD'] === 'POST' ? handle_register() : page_register(); break;
        case 'logout': handle_logout(); break;
        case 'google-login': handle_google_login(); break;
        case 'google-callback': handle_google_callback(); break;
        case 'admin-login': $_SERVER['REQUEST_METHOD'] === 'POST' ? handle_login(true) : page_login(true); break;
        case 'admin': admin_dashboard(); break;
        case 'admin-pedidos': admin_orders(); break;
        case 'admin-pedido': admin_order_detail(); break;
        case 'admin-pedido-estado': handle_admin_order_status(); break;
        case 'admin-pedido-eliminar': handle_admin_order_delete(); break;
        case 'admin-ganancia-reiniciar': handle_admin_earnings_reset(); break;
        case 'admin-productos': admin_products(); break;
        case 'admin-productos-masivo': admin_products_bulk_form(); break;
        case 'admin-productos-masivo-guardar': handle_products_bulk_save(); break;
        case 'admin-producto-form': admin_product_form(); break;
        case 'admin-producto-crear': handle_product_save(true); break;
        case 'admin-producto-guardar': handle_product_save(false); break;
        case 'admin-producto-eliminar': handle_product_active(false); break;
        case 'admin-producto-restaurar': handle_product_active(true); break;
        case 'admin-clientes': admin_clients(); break;
        case 'admin-promociones': admin_promotions(); break;
        case 'admin-promo-crear': handle_promotion_create(); break;
        case 'admin-redes': admin_socials(); break;
        case 'admin-redes-crear': handle_social_create(); break;
        case 'admin-redes-eliminar': handle_social_delete(); break;
        case 'admin-boleta': admin_invoice_pdf(); break;
        case 'admin-backup': admin_backup(); break;
        case 'comprobante': serve_receipt(); break;
        case 'configuracion-cookies': legal_page('Configuracion de las cookies'); break;
        case 'terminos-y-condiciones': legal_page('Terminos y Condiciones'); break;
        case 'terminos-promociones': legal_page('Terminos y Condiciones Promociones'); break;
        case 'politica-privacidad': legal_page('Politica de Privacidad'); break;
        case 'seleccionar-pais': legal_page('Seleccionar Pais'); break;
        case 'uso-del-sitio': legal_page('Uso del Sitio'); break;
        default:
            http_response_code(404);
            page('No encontrado', '<main class="section"><div class="wrap panel empty">Pagina no encontrada.</div></main>');
    }
} catch (Exception $e) {
    http_response_code(500);
    page('Error', '<main class="section"><div class="wrap panel"><h1>Error interno</h1><p class="muted">Revisa que PHP tenga SQLite activo y que las carpetas data, uploads y private tengan permiso de escritura.</p><pre>' . e($e->getMessage()) . '</pre></div></main>');
}
?>