<?php
// ==========================================
// 1. HIGH-SECURITY DB-ENGINE & OPERATIONS
// ==========================================
date_default_timezone_set('Europe/Zurich');
session_start();

$folders = ['uploads', 'uploads/kyc', 'uploads/items', 'uploads/receipts', 'backups'];
foreach($folders as $f) { 
    if(!is_dir($f)) { mkdir($f, 0777, true); } 
    $ht = $f.'/.htaccess'; if(!file_exists($ht)) file_put_contents($ht, "Order Deny,Allow\nDeny from all"); 
}

try {
    $pdo = new PDO("mysql:host=localhost;dbname=vault_db;charset=utf8mb4", "vault_user", "VaultPasswort123", [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);
    $pdo->exec("CREATE TABLE IF NOT EXISTS store (k VARCHAR(50) PRIMARY KEY, v LONGTEXT)");
} catch (PDOException $e) { 
    die("System Operational Error: Database handshake rejected."); 
}

function safe_read($key) { global $pdo; $stmt = $pdo->prepare("SELECT v FROM store WHERE k=?"); $stmt->execute([$key]); $res = $stmt->fetchColumn(); return $res ? json_decode($res, true) : []; }
function safe_write($key, $data) { global $pdo; $stmt = $pdo->prepare("INSERT INTO store (k, v) VALUES (?, ?) ON DUPLICATE KEY UPDATE v=VALUES(v)"); $stmt->execute([$key, json_encode($data, JSON_UNESCAPED_UNICODE)]); }
function sanitize($text) { return htmlspecialchars(trim($text), ENT_QUOTES, 'UTF-8'); }

function redirect($msg='', $err='') { 
    if($msg) $_SESSION['flash_msg'] = $msg; 
    if($err) $_SESSION['flash_err'] = $err; 
    header("Location: index.php"); exit; 
}

$F_CONF = 'config'; $F_USER = 'users'; $F_AUCT = 'auctions'; $F_BIDS = 'bids'; $F_CHAT = 'chat'; $F_RADR = 'radar'; $F_IPBN = 'ip_bans'; $F_LOGS = 'audit_log';

function audit_log($user, $action, $details) {
    global $F_LOGS; $logs = safe_read($F_LOGS);
    $logs[] = ["zeit" => date("Y-m-d H:i:s"), "user" => $user, "ip" => $_SERVER['REMOTE_ADDR'], "action" => $action, "details" => $details];
    safe_write($F_LOGS, array_slice($logs, -1000));
}

$msg = $_SESSION['flash_msg'] ?? ''; $err = $_SESSION['flash_err'] ?? ''; unset($_SESSION['flash_msg'], $_SESSION['flash_err']);
if (empty($_SESSION['csrf_token'])) $_SESSION['csrf_token'] = bin2hex(random_bytes(32));

// IP Ban Firewall
$ip_bans = safe_read($F_IPBN);
if (in_array($_SERVER['REMOTE_ADDR'], $ip_bans)) {
    die("<div style='background:#000;color:red;font-family:monospace;padding:50px;text-align:center;height:100vh;'><h2>[ACCESS REVOKED]</h2>Your network IP has been permanently blacklisted by administration.</div>");
}

$config = safe_read($F_CONF);
if(empty($config)) { 
    $config = ["gate_code" => "GEHEIM123", "admin_user" => "Admin", "admin_pass" => password_hash("12-Ali123", PASSWORD_DEFAULT), "banners" => [], "crypto_wallet" => "TXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (USDT TRC-20)"]; 
    safe_write($F_CONF, $config); 
}

$users = safe_read($F_USER); $auctions = safe_read($F_AUCT); $bids = safe_read($F_BIDS); $chats = safe_read($F_CHAT); $radar = safe_read($F_RADR);

// Session Kick Protection
if(isset($_SESSION['logged_in']) && !isset($_SESSION['is_admin'])) {
    $u = $_SESSION['user'];
    if(!isset($users[$u]) || $users[$u]['status'] === 'banned' || ($_SESSION['session_id'] ?? '') !== ($users[$u]['active_session'] ?? '')) {
        session_destroy(); setcookie('vault_remember', '', time() - 3600, '/'); redirect('','Session terminated by Compliance or invalid.');
    }
}

// Persistent Login
if (!isset($_SESSION['logged_in']) && isset($_COOKIE['vault_remember'])) {
    $t = explode(':', $_COOKIE['vault_remember']);
    if (count($t) === 2 && isset($users[$t[0]]) && md5($users[$t[0]]['pass']) === $t[1] && $users[$t[0]]['status'] !== 'banned') {
        $_SESSION['user'] = $t[0]; $_SESSION['logged_in'] = true; if ($t[0] === "Admin") $_SESSION['is_admin'] = true;
        $sid = uniqid(); $_SESSION['session_id'] = $sid; $users[$t[0]]['active_session'] = $sid; safe_write($F_USER, $users);
        session_regenerate_id(true); audit_log($t[0], "Login", "Auto-Login Session Restored");
    }
}

// Auto Bidder Logic
function process_auto_bids($aid) {
    global $auctions, $bids, $F_BIDS; $a = $auctions[$aid]; if($a['status'] !== 'active') return;
    $changed = true;
    while($changed) {
        $changed = false; $a_bids = $bids[$aid] ?? []; $hb = !empty($a_bids) ? $a_bids[0]['betrag'] : 0; $hu = !empty($a_bids) ? $a_bids[0]['user'] : '';
        
        $step = $a['min_schritt'];
        if($hb >= 100000) { $step = 5000; } elseif($hb >= 50000) { $step = 2500; } elseif($hb >= 10000) { $step = 1000; }

        $nxt = $hb == 0 ? $a['min_gebot'] : $hb + $step;
        foreach($a['proxy_bids'] ?? [] as $pu => $pm) {
            if(in_array($pu, $a['blocked_users'] ?? [])) continue;
            if($pu !== $hu && $pm >= $nxt) {
                array_unshift($bids[$aid], ["user" => $pu, "betrag" => $nxt, "zeit" => date("H:i:s"), "ts" => time()]);
                audit_log("Auto Bidder", "Proxy Execute", "$pu bids $nxt on Lot_$aid"); $changed = true; break;
            }
        }
    }
    safe_write($F_BIDS, $bids);
}

// ==========================================
// 2. REALTIME API HUB (POLLING)
// ==========================================
if(isset($_GET['api'])) {
    header('Content-Type: application/json');
    if($_GET['api'] == 'toggle_watch' && isset($_SESSION['user'])) {
        $id = $_GET['id']; if(!isset($users[$_SESSION['user']]['watch'])) $users[$_SESSION['user']]['watch'] = [];
        if(in_array($id, $users[$_SESSION['user']]['watch'])) { $users[$_SESSION['user']]['watch'] = array_diff($users[$_SESSION['user']]['watch'], [$id]); } else { $users[$_SESSION['user']]['watch'][] = $id; }
        safe_write($F_USER, $users); echo json_encode(["ok"=>1]); exit;
    }

    $res = ["auctions" => [], "banners" => $config['banners']]; $u = $_SESSION['user'] ?? null;
    if($u) { 
        $radar[$u] = ["ts" => time(), "ip" => $_SERVER['REMOTE_ADDR'], "status" => $users[$u]['status']]; 
        foreach($radar as $k => $d) { if(time() - $d['ts'] > 6) unset($radar[$k]); } safe_write($F_RADR, $radar); 
        $res['my_status'] = $users[$u]['status'];
    }

    $vol_today = 0;
    foreach($auctions as $id => $a) {
        $a_bids = $bids[$id] ?? []; $hb = !empty($a_bids) ? $a_bids[0]['betrag'] : 0; $hu = !empty($a_bids) ? $a_bids[0]['user'] : '';
        if($hb > 0 && !in_array($a['status'], ['ended','sold'])) $vol_today += $hb;
        
        $step = $a['min_schritt']; if($hb >= 100000) $step = 5000; elseif($hb >= 50000) $step = 2500; elseif($hb >= 10000) $step = 1000;
        $next_allowed = $hb == 0 ? $a['min_gebot'] : $hb + $step;

        $current_buyout = $a['min_sofort'];
        if($a['buyout_type'] === 'dynamic' && $hb > 0) { $current_buyout = $hb + $a['buyout_addon']; }

        $hist_html = empty($a_bids) ? '<tr><td colspan="3" style="color:#666;text-align:center;">No bids yet.</td></tr>' : implode('', array_map(function($g, $i){ $c = $i===0 ? '#d4af37' : '#888'; return '<tr style="color:'.$c.';"><td>'.htmlspecialchars($g['user']).'</td><td>$ '.number_format($g['betrag'],2).'</td><td class="lt" data-epoch="'.$g['ts'].'"></td></tr>'; }, array_slice($a_bids, 0, 10), array_keys(array_slice($a_bids, 0, 10))));

        $is_blocked = in_array($u, $a['blocked_users'] ?? []);
        $escrow_buyer = $a['escrow_buyer'] ?? null;
        $is_escrow_watcher = in_array($u, $a['escrow_watchers'] ?? []);

        $res["auctions"][$id] = [
            "title" => htmlspecialchars($a['title']), "highest" => $hb > 0 ? "$ ".number_format($hb, 2) : "$ ".number_format($a['min_gebot'],2),
            "next" => $next_allowed, "start_epoch" => $a['start_zeit'], "end_epoch" => ($a['status'] === 'frozen') ? time() + $a['pause_resttime'] : $a['end_zeit'],
            "status" => $a['status'], "hist_html" => $hist_html, "is_highest" => ($hu === $u), "buyout_price" => $current_buyout, "is_blocked" => $is_blocked,
            "escrow_expires" => $a['escrow_expires'] ?? 0, "escrow_buyer" => $escrow_buyer, "is_escrow_watcher" => $is_escrow_watcher
        ];
    }
    
    if($u && !isset($_SESSION['is_admin'])) { $res['chat'] = $chats[$u] ?? []; $res['notifs'] = $users[$u]['notifs'] ?? []; } 
    elseif (isset($_SESSION['is_admin']) && isset($_GET['chat_user'])) { $res['chat'] = $chats[$_GET['chat_user']] ?? []; }

    if(isset($_SESSION['is_admin'])) {
        $u_html = "";
        foreach($users as $username => $u_data) {
            if($username === "Admin") continue;
            $kyc_links = ""; foreach($u_data['kyc']??[] as $auc_id=>$p) { $kyc_links .= "<a href='$p' target='_blank' style='color:#00ffcc; margin-right:8px;'>Lot_".strtoupper(substr($auc_id,0,4))."</a>"; }
            $u_html .= "<tr class='u-row'><td class='u-name' style='padding:10px;'><b>".htmlspecialchars($username)."</b></td><td style='padding:10px; color:".($u_data['status']=='approved'?'#00ff00':($u_data['status']=='banned'?'red':'orange'))."'>".strtoupper($u_data['status'])."</td><td style='padding:10px;'>$kyc_links</td><td style='padding:10px; display:flex; gap:4px;'><button class='btn btn-out' style='padding:3px 6px; font-size:10px;' onclick='adminAction(\"$username\",\"appr\")'>VERIFY</button><button class='btn btn-out' style='padding:3px 6px; font-size:10px; color:orange; border-color:orange;' onclick='adminAction(\"$username\",\"susp\")'>KICK/SUSP</button><button class='btn' style='padding:3px 6px; font-size:10px; background:red; color:white;' onclick='adminAction(\"$username\",\"ban\")'>PERMA BAN</button><button class='btn btn-out' style='padding:3px 6px; font-size:10px; color:red; border-color:red;' onclick='adminAction(\"$username\",\"ipban\")'>IP BAN</button></td></tr>";
        }
        $res['admin_users_html'] = $u_html;
        $res['telemetry'] = ["vol" => "$ ".number_format($vol_today), "online" => count($radar), "kyc_pending" => count(array_filter($users, fn($x) => $x['status'] === 'pending')), "logs" => array_reverse(array_slice(safe_read($F_LOGS), -15))];
    }
    echo json_encode($res); exit;
}

// ==========================================
// 3. SECURE CORE POST CONTROLLER
// ==========================================
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (empty($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) redirect('','Security Token Validation Error.');
    $act = $_POST['action'] ?? '';

    if($act == 'gate') { if($_POST['code'] === $config['gate_code']) $_SESSION['gate'] = true; else redirect('','Invalid Portal Passkey.'); redirect(); }
    if($act == 'login') {
        $un = sanitize($_POST['user']); $pw = $_POST['pass'];
        if($un === $config['admin_user'] && password_verify($pw, $config['admin_pass'])) {
            $_SESSION['user'] = $un; $_SESSION['is_admin'] = true; $_SESSION['logged_in'] = true; redirect();
        } elseif(isset($users[$un]) && $users[$un]['status'] !== 'banned' && password_verify($pw, $users[$un]['pass'])) {
            $_SESSION['user'] = $un; $_SESSION['logged_in'] = true; $sid = uniqid(); $_SESSION['session_id'] = $sid; $users[$un]['active_session'] = $sid; safe_write($F_USER, $users);
            if(isset($_POST['remember'])) setcookie('vault_remember', base64_encode($un).':'.md5($users[$un]['pass']), time()+604800, '/'); redirect();
        } else { redirect('','Invalid credentials or account banned.'); }
    }
    if($act == 'register') {
        $un = sanitize($_POST['user']); $pw = $_POST['pass'];
        if(isset($users[$un]) || $un === $config['admin_user']) redirect('','Alias already taken.');
        $sid = uniqid(); $_SESSION['session_id'] = $sid;
        $users[$un] = ['pass' => password_hash($pw, PASSWORD_DEFAULT), 'status' => 'pending', 'kyc' => [], 'watch' => [], 'notifs' => [], 'active_session' => $sid];
        safe_write($F_USER, $users); $_SESSION['user'] = $un; $_SESSION['logged_in'] = true; redirect('Account creation successful! Awaiting verification.');
    }

    if(isset($_SESSION['is_admin']) && $act === 'admin_user_op') {
        $u = $_POST['u']; $mode = $_POST['mode'];
        if(isset($users[$u])) {
            if($mode === 'appr') { $users[$u]['status'] = 'approved'; $users[$u]['notifs'][] = ["msg"=>"✅ Welcome to The Vault. Your identity is verified and you are cleared to bid.", "ts"=>time()]; audit_log("Admin", "Verify", "User $u approved"); }
            if($mode === 'susp') { $users[$u]['status'] = 'pending'; $users[$u]['active_session'] = ''; audit_log("Admin", "Kick/Suspend", "User $u suspended"); }
            if($mode === 'ban') { $users[$u]['status'] = 'banned'; $users[$u]['active_session'] = ''; audit_log("Admin", "Permaban", "User $u permanently banned"); }
            if($mode === 'ipban') {
                $users[$u]['status'] = 'banned'; $users[$u]['active_session'] = '';
                $ip_bans = safe_read($F_IPBN); if(isset($radar[$u])) { $b_ip = $radar[$u]['ip']; if(!in_array($b_ip, $ip_bans)) $ip_bans[] = $b_ip; safe_write($F_IPBN, $ip_bans); }
                audit_log("Admin", "IP Ban", "Network block active for $u");
            }
            safe_write($F_USER, $users); echo json_encode(["success"=>1]); exit;
        }
    }

    if($act == 'send_chat' && isset($_SESSION['user'])) {
        $msg_t = sanitize($_POST['msg']);
        if($msg_t) {
            $t = isset($_SESSION['is_admin']) ? $_POST['target_user'] : $_SESSION['user']; $s = isset($_SESSION['is_admin']) ? 'Concierge' : $_SESSION['user'];
            if(!isset($chats[$t])) $chats[$t] = []; $chats[$t][] = ["sender" => $s, "msg" => $msg_t, "time" => date("H:i"), "ts" => time()]; safe_write($F_CHAT, $chats);
            if(isset($_SESSION['is_admin'])) { $users[$t]['notifs'][] = ["msg"=>"New secure message from Concierge Desk.", "ts"=>time()]; safe_write($F_USER, $users); } redirect();
        }
    }
    if($act == 'clear_notifs' && isset($_SESSION['user'])) { $users[$_SESSION['user']]['notifs'] = []; safe_write($F_USER, $users); redirect(); }
    if($act == 'rm_proxy' && isset($_SESSION['user'])) { $aid = $_POST['auction_id']; unset($auctions[$aid]['proxy_bids'][$_SESSION['user']]); safe_write($F_AUCT, $auctions); redirect('Auto Bidder deactivated.'); }

    // Client Actions
    if(isset($_SESSION['user']) && !isset($_SESSION['is_admin'])) {
        $aid = $_POST['auction_id'] ?? null;
        if($aid && in_array($act, ['bieten', 'agent', 'upload_kyc', 'sofortkauf', 'watch_escrow', 'upload_receipt'])) {
            if($users[$_SESSION['user']]['status'] !== 'approved') redirect('','Administrative clearance required.');
            $a = &$auctions[$aid];
            
            if($act == 'upload_kyc') {
                $tmp = $_FILES['kyc_file']['tmp_name']; $ext = strtolower(pathinfo($_FILES['kyc_file']['name'], PATHINFO_EXTENSION));
                if(in_array($ext, ['jpg','png','pdf'])) {
                    $path = "uploads/kyc/".bin2hex(random_bytes(8)).".$ext";
                    if(move_uploaded_file($tmp, $path)) { $users[$_SESSION['user']]['kyc'][$aid] = $path; safe_write($F_USER, $users); audit_log($_SESSION['user'], "KYC", "Proof of Funds Lot_$aid"); redirect('Proof of Funds transmitted securely.'); }
                } else redirect('','Invalid format.');
            }
            elseif($act == 'upload_receipt') {
                if($a['status'] !== 'escrow' || $a['escrow_buyer'] !== $_SESSION['user']) redirect('','Unauthorized.');
                $tmp = $_FILES['receipt_file']['tmp_name']; $ext = strtolower(pathinfo($_FILES['receipt_file']['name'], PATHINFO_EXTENSION));
                if(in_array($ext, ['jpg','png','pdf'])) {
                    $path = "uploads/receipts/".bin2hex(random_bytes(8)).".$ext";
                    if(move_uploaded_file($tmp, $path)) { $a['escrow_receipt'] = $path; safe_write($F_AUCT, $auctions); audit_log($_SESSION['user'], "Escrow", "Receipt uploaded for Lot_$aid"); redirect('Transaction receipt uploaded successfully.'); }
                }
            }
            elseif($act == 'watch_escrow') {
                if(!isset($a['escrow_watchers'])) $a['escrow_watchers'] = [];
                if(!in_array($_SESSION['user'], $a['escrow_watchers'])) { $a['escrow_watchers'][] = $_SESSION['user']; safe_write($F_AUCT, $auctions); }
                redirect('You will be notified if the settlement fails.');
            }
            else {
                if($a['req_kyc'] && empty($users[$_SESSION['user']]['kyc'][$aid])) redirect('','Proof of Funds mandatory for this asset.');
                if($a['status'] !== 'active' || time() > $a['end_zeit'] || time() < $a['start_zeit']) redirect('','Lot is currently inactive, frozen, or in escrow.');
                if(in_array($_SESSION['user'], $a['blocked_users'] ?? [])) redirect('','Your bidding privileges for this specific lot have been revoked.');
                
                $b = &$bids[$aid]; if(!isset($b)) $b = []; $val = (float)$_POST['val']; $hb = !empty($b) ? $b[0]['betrag'] : 0;
                $old_highest = !empty($b) ? $b[0]['user'] : null;
                $is_shadowed = ($users[$_SESSION['user']]['status'] === 'shadow_banned');

                if($act == 'bieten') {
                    $step = $a['min_schritt']; if($hb >= 100000) $step = 5000; elseif($hb >= 50000) $step = 2500; elseif($hb >= 10000) $step = 1000;
                    $nxt = $hb == 0 ? $a['min_gebot'] : $hb + $step;
                    
                    if($val >= $nxt && (empty($b) || $b[0]['user'] !== $_SESSION['user'])) {
                        if(!$is_shadowed) {
                            array_unshift($b, ["user" => $_SESSION['user'], "betrag" => $val, "zeit" => date("H:i:s"), "ts" => time()]);
                            if($a['end_zeit'] - time() < ($a['sniper']*60)) $a['end_zeit'] += ($a['sniper']*60);
                            safe_write($F_BIDS, $bids); safe_write($F_AUCT, $auctions); process_auto_bids($aid);
                            if($old_highest && $old_highest !== $_SESSION['user']) { $users[$old_highest]['notifs'][] = ["msg"=>"🚨 You have been OUTBID on LOT_".strtoupper(substr($aid,0,6))."!", "ts"=>time()]; safe_write($F_USER, $users); }
                        }
                        audit_log($_SESSION['user'], "Bid", "$val on Lot_$aid ".($is_shadowed?'[SHADOW]':'')); redirect('Bid placed successfully!');
                    } else redirect('','Bid does not meet minimum increment or you are already highest bidder.');
                }
                if($act == 'agent') {
                    if($val >= ($hb == 0 ? $a['min_gebot'] : $hb + $a['min_schritt'])) {
                        if(!$is_shadowed) { $a['proxy_bids'][$_SESSION['user']] = $val; safe_write($F_AUCT, $auctions); process_auto_bids($aid); }
                        redirect('Auto Bidder engaged.');
                    } else redirect('','Limit too low.');
                }
                if($act == 'sofortkauf') {
                    $target_price = $a['min_sofort']; if($a['buyout_type'] === 'dynamic' && $hb > 0) { $target_price = $hb + $a['buyout_addon']; }
                    if(!$is_shadowed) {
                        $a['status'] = 'escrow'; $a['escrow_buyer'] = $_SESSION['user']; $a['escrow_price'] = $target_price; 
                        $a['escrow_expires'] = time() + (90 * 60); $a['escrow_watchers'] = []; $a['escrow_receipt'] = '';
                        safe_write($F_AUCT, $auctions);
                        
                        // Escrow Chat Integration (Auto Message)
                        $buyer = $_SESSION['user'];
                        if(!isset($chats[$buyer])) $chats[$buyer] = [];
                        $welcome_msg = "🚨 <b>SETTLEMENT INITIATED (LOT_".strtoupper(substr($aid,0,6)).")</b><br><br>Amount due: $ " . number_format($target_price) . "<br><br><b>PAYMENT INSTRUCTIONS:</b><br>" . nl2br(sanitize($a['checkout_info']));
                        $chats[$buyer][] = ["sender" => "Concierge", "msg" => $welcome_msg, "time" => date("H:i"), "ts" => time()];
                        safe_write($F_CHAT, $chats);
                        
                        $_SESSION['auto_open_chat'] = true;
                    }
                    audit_log($_SESSION['user'], "Buyout Triggered", "Settlement started for $target_price on Lot_$aid ".($is_shadowed?'[SHADOW]':'')); 
                    redirect('Buyout initiated. Complete crypto settlement within 90 minutes.');
                }
            }
        }
    }

    // Admin Actions
    if(isset($_SESSION['is_admin'])) {
        if($act == 'update_gate') { $config['gate_code'] = sanitize($_POST['new_code']); $config['crypto_wallet'] = sanitize($_POST['crypto_wallet']); safe_write($F_CONF, $config); redirect('System Preferences updated.'); }
        if($act == 'create_auction') {
            $id = uniqid(); $path = ""; if(!empty($_FILES['img']['tmp_name'])) { $path = "uploads/items/$id.".strtolower(pathinfo($_FILES['img']['name'], PATHINFO_EXTENSION)); move_uploaded_file($_FILES['img']['tmp_name'], $path); }
            $auctions[$id] = [
                "title" => sanitize($_POST['title']), "desc" => sanitize($_POST['desc']), "start_zeit" => strtotime($_POST['start']), "end_zeit" => strtotime($_POST['end']),
                "min_gebot" => (float)$_POST['min_b'], "min_schritt" => (float)$_POST['step'], "sniper" => (int)$_POST['sniper'], "req_kyc" => isset($_POST['req_kyc']), "checkout_info" => sanitize($_POST['chkout']), "img" => $path, "status" => "active", "winner" => "", "win_price" => 0, "proxy_bids" => [],
                "buyout_type" => $_POST['b_type'], "min_sofort" => (float)$_POST['b_static'], "buyout_addon" => (float)$_POST['b_dynamic'], "blocked_users" => []
            ];
            safe_write($F_AUCT, $auctions); redirect('Asset successfully deployed.');
        }
        if($act == 'del_auction') { $aid = $_POST['id']; unset($auctions[$aid]); unset($bids[$aid]); safe_write($F_AUCT, $auctions); safe_write($F_BIDS, $bids); redirect('Lot completely deleted.'); }
        if($act == 'add_banner') { $config['banners'][] = ["text" => sanitize($_POST['b_text']), "space" => (int)$_POST['b_space'], "active" => true]; safe_write($F_CONF, $config); redirect(); }
        if($act == 'del_banner') { unset($config['banners'][$_POST['b_idx']]); $config['banners'] = array_values($config['banners']); safe_write($F_CONF, $config); redirect(); }
        if($act == 'toggle_pause') { $aid = $_POST['id']; $a = &$auctions[$aid]; if($a['status'] === 'active') { $a['status'] = 'frozen'; $a['pause_resttime'] = $a['end_zeit'] - time(); } elseif($a['status'] === 'frozen') { $a['status'] = 'active'; $a['end_zeit'] = time() + $a['pause_resttime']; } safe_write($F_AUCT, $auctions); redirect(); }
        if($act == 'mod_time') { $auctions[$_POST['id']]['end_zeit'] += (int)$_POST['secs']; safe_write($F_AUCT, $auctions); redirect(); }
        if($act == 'storno_bid') { $aid = $_POST['id']; $idx = (int)$_POST['bid_idx']; unset($bids[$aid][$idx]); $bids[$aid] = array_values($bids[$aid]); safe_write($F_BIDS, $bids); process_auto_bids($aid); redirect('Bid cancelled.'); }
        if($act == 'block_user_lot') {
            $aid = $_POST['id']; $bu = $_POST['block_u']; 
            if(!isset($auctions[$aid]['blocked_users'])) $auctions[$aid]['blocked_users'] = [];
            if(!in_array($bu, $auctions[$aid]['blocked_users'])) { $auctions[$aid]['blocked_users'][] = $bu; }
            if(isset($auctions[$aid]['proxy_bids'][$bu])) unset($auctions[$aid]['proxy_bids'][$bu]);
            safe_write($F_AUCT, $auctions); redirect("User $bu blocked from this lot.");
        }
        if($act == 'unblock_user_lot') { $aid = $_POST['id']; $bu = $_POST['block_u']; if(isset($auctions[$aid]['blocked_users'])) { $auctions[$aid]['blocked_users'] = array_diff($auctions[$aid]['blocked_users'], [$bu]); safe_write($F_AUCT, $auctions); } redirect("User $bu restored to lot."); }
        
        // Admin Escrow Actions
        if($act == 'escrow_add_time') { $auctions[$_POST['id']]['escrow_expires'] += (15 * 60); safe_write($F_AUCT, $auctions); redirect('Added 15 minutes to escrow clock.'); }
        if($act == 'escrow_verify') {
            $aid = $_POST['id']; $a = &$auctions[$aid];
            $a['status'] = 'sold'; $a['winner'] = $a['escrow_buyer']; $a['win_price'] = $a['escrow_price'];
            audit_log("Admin", "Escrow Complete", "Lot_$aid closed for ".$a['escrow_buyer']);
            safe_write($F_AUCT, $auctions); redirect('Payment verified. Lot sold.');
        }
        if($act == 'escrow_void') {
            $aid = $_POST['id']; $a = &$auctions[$aid]; $bad_buyer = $a['escrow_buyer'];
            if(isset($users[$bad_buyer])) { $users[$bad_buyer]['status'] = 'banned'; $users[$bad_buyer]['active_session'] = ''; audit_log("Admin", "Escrow Voided", "Banned $bad_buyer for non-payment on Lot_$aid"); }
            foreach($a['escrow_watchers'] ?? [] as $w) { if(isset($users[$w])) { $users[$w]['notifs'][] = ["msg"=>"🚨 LOT_".strtoupper(substr($aid,0,6))." IS BACK ON THE MARKET! Settlement failed.", "ts"=>time()]; } }
            $a['status'] = 'active'; $a['escrow_buyer'] = null; $a['escrow_watchers'] = []; $a['end_zeit'] = max($a['end_zeit'], time() + 300);
            safe_write($F_USER, $users); safe_write($F_AUCT, $auctions); redirect('Escrow voided. Buyer banned. Lot resumed.');
        }
    }
}
if(isset($_GET['logout'])) { session_destroy(); setcookie('vault_remember', '', time() - 3600, '/'); header("Location: index.php"); exit; }
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>THE VAULT | Premium Enterprise</title>
    <style>
        @import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;600&family=Space+Mono&display=swap');
        :root { --bg: #030303; --gold: #d4af37; --panel: rgba(18,18,18,0.75); --bord: rgba(255,255,255,0.08); --neon: #00ffcc; }
        body { background: var(--bg); color: #e0e0e0; font-family: 'Inter', sans-serif; margin:0; padding:0; min-height:100vh; }
        
        .glass { background: var(--panel); backdrop-filter: blur(20px); -webkit-backdrop-filter: blur(20px); border: 1px solid var(--bord); border-radius: 6px; }
        
        .marquee-wrapper { width:100%; overflow:hidden; background:#ff1a1a; color:#fff; display:flex; font-weight:600; font-size:11px; letter-spacing:2px; text-transform:uppercase; }
        .marquee-track { display:flex; white-space:nowrap; animation: scrollX 25s linear infinite; }
        @keyframes scrollX { 0% { transform: translateX(0); } 100% { transform: translateX(-50%); } }
        
        .nav { padding: 20px 40px; display:flex; justify-content:space-between; align-items:center; border-bottom:1px solid var(--bord); background:#000; }
        .logo { font-size:22px; font-weight:300; letter-spacing:8px; color:var(--gold); display:flex; align-items:center; gap:15px; }
        .crypto-badge { font-size:10px; font-family:'Space Mono'; border:1px solid var(--neon); color:var(--neon); padding:4px 8px; border-radius:3px; letter-spacing:1px; }
        
        .btn { background:var(--gold); color:#000; border:none; padding:12px 22px; font-weight:600; cursor:pointer; text-transform:uppercase; font-size:11px; letter-spacing:1px; transition:0.3s; border-radius:3px; }
        .btn:hover { background:#fff; } .btn-out { background:transparent; border:1px solid var(--gold); color:var(--gold); }
        input, textarea, select { width:100%; padding:13px; margin:8px 0; background:rgba(0,0,0,0.6); border:1px solid var(--bord); color:#fff; border-radius:4px; font-family:'Inter'; box-sizing:border-box; }
        
        /* High-End Gallery Framework */
        .vault-container { max-width: 1300px; margin: 0 auto; padding: 20px; width: 100%; box-sizing: border-box; }
        .grid-gal { display:grid; grid-template-columns:repeat(auto-fill, minmax(360px, 1fr)); gap:30px; margin-top:30px; }
        
        .img-container { width:100%; height:280px; overflow:hidden; position:relative; border-radius:4px 4px 0 0; background:#000; }
        .img-fixed { width:100%; height:100%; object-fit: cover; transition: 0.5s; display:block; }
        .auc-card:hover .img-fixed { transform: scale(1.03); }
        
        .timer { font-family:'Space Mono', monospace; font-size:22px; color:#fff; } .blink { color:#ff3333; animation: bl 1s infinite; }
        @keyframes bl { 50%{opacity:0.2;} }
        .watch-btn { position:absolute; top:15px; right:15px; background:rgba(0,0,0,0.6); border-radius:50%; width:36px; height:36px; display:flex; align-items:center; justify-content:center; cursor:pointer; transition:0.3s; font-size:16px; z-index:5; }
        .watch-btn.active { color:var(--gold); }
        
        .admin-layout { display:flex; min-height:calc(100vh - 70px); }
        .sidebar { width:260px; border-right:1px solid var(--bord); padding:20px; display:flex; flex-direction:column; gap:8px; background:#000; }
        .sb-item { padding:14px; cursor:pointer; font-size:11px; letter-spacing:2px; text-transform:uppercase; color:#777; transition:0.3s; border-radius:4px; }
        .sb-item.active, .sb-item:hover { background:var(--bord); color:var(--gold); }
        .admin-main { flex:1; padding:40px; overflow-y:auto; }
        .t-val { font-size:26px; font-family:'Space Mono'; color:#fff; margin-top:8px; }
        
        .modal-overlay { position:fixed; top:0; left:0; width:100%; height:100%; background:rgba(0,0,0,0.92); z-index:9999; display:none; justify-content:center; align-items:center; }
        .modal-box { width:550px; padding:40px; position:relative; }
        .notif-bell { position:relative; cursor:pointer; font-size:20px; }
        .notif-dot { position:absolute; top:-4px; right:-4px; width:9px; height:9px; background:red; border-radius:50%; display:none; }
        .msg-toast { position:fixed; top:20px; left:50%; transform:translateX(-50%); z-index:9999; padding:15px 30px; border-radius:4px; text-align:center; animation: fadeOut 4s forwards; }
        @keyframes fadeOut { 0%{opacity:1;top:20px;} 80%{opacity:1;top:20px;} 100%{opacity:0;top:-50px;display:none;} }
    </style>
</head>
<body>

<?php if($msg): ?><div class="msg-toast glass" style="border-color:var(--gold); color:var(--gold);"><?= $msg ?></div><?php endif; ?>
<?php if($err): ?><div class="msg-toast glass" style="border-color:#ff4444; color:#ff4444;"><?= $err ?></div><?php endif; ?>

<?php $active_banners = array_filter($config['banners'] ?? [], fn($b)=>$b['active']); if(!empty($active_banners)): ?>
    <div class="marquee-wrapper"><div class="marquee-track">
        <?php $m_text = ""; foreach($active_banners as $b) { $m_text .= $b['text'] . str_repeat("&nbsp;", $b['space'] ?: 12); } echo "<div>$m_text</div><div>$m_text</div>"; ?>
    </div></div>
<?php endif; ?>

<div class="nav">
    <div class="logo">THE VAULT <span class="crypto-badge">CRYPTO SETTLEMENT ONLY</span></div>
    <?php if(isset($_SESSION['logged_in'])): ?>
        <div style="display:flex; align-items:center; gap:25px;">
            <?php if(!isset($_SESSION['is_admin'])): ?>
                <div class="notif-bell" onclick="document.getElementById('notif_panel').style.display='block'">🔔<div class="notif-dot" id="n_dot" <?= !empty($users[$_SESSION['user']]['notifs']) ? 'style="display:block;"' : '' ?>></div></div>
            <?php endif; ?>
            <div style="font-size:11px; letter-spacing:2px; text-transform:uppercase;"><span style="color:#666;">CLIENT_ID:</span> <span id="my_status_badge" style="color:var(--gold); font-weight:600;"><?= htmlspecialchars($_SESSION['user']) ?></span></div>
            <a href="?logout=1" class="btn btn-out" style="padding:8px 16px; text-decoration:none;">LOGOUT</a>
        </div>
    <?php endif; ?>
</div>

<?php if(!isset($_SESSION['gate'])): ?>
    <div style="display:flex; justify-content:center; align-items:center; height:75vh;"><div class="glass" style="padding:40px; text-align:center; width:360px;"><h3 style="margin-top:0; font-weight:300; letter-spacing:4px;">DECRYPTION BRIDGE</h3><form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="gate"><input type="password" name="code" placeholder="Enter System Passkey" required><button class="btn" style="width:100%; margin-top:12px;">DECRYPT NODE</button></form></div></div>
<?php elseif(!isset($_SESSION['logged_in'])): ?>
    <div id="auth" style="display:flex; justify-content:center; padding:120px 20px; gap:40px; flex-wrap:wrap;">
        <div class="glass" style="padding:40px; width:350px;"><h3 style="margin-top:0; font-weight:300; color:var(--gold); letter-spacing:1px;">SECURE LOGIN</h3><form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="login"><input type="text" name="user" placeholder="Alias Name" required><input type="password" name="pass" placeholder="Password" required><label style="font-size:11px; color:#666; display:block; margin:10px 0;"><input type="checkbox" name="remember" value="1" checked> Enable Persistent 7-Day Lock</label><button class="btn" style="width:100%;">ACCESS PORTAL</button></form></div>
        <div class="glass" style="padding:40px; width:350px;"><h3 style="margin-top:0; font-weight:300; letter-spacing:1px;">REGISTRATION</h3><form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="register"><input type="text" name="user" placeholder="Choose Alias Identity" required><input type="password" name="pass" placeholder="Establish Password" required><button class="btn btn-out" style="width:100%; margin-top:33px;">TRANSMIT APPLICATION</button></form></div>
    </div>
<?php elseif(isset($_SESSION['is_admin'])): ?>
    <!-- ADMIN CEO DASHBOARD -->
    <div class="admin-layout">
        <div class="sidebar glass" style="border-radius:0;">
            <div class="sb-item active" onclick="sT('s_dash')">📡 Command Center</div>
            <div class="sb-item" onclick="sT('s_auct')">🏗️ Asset Portfolio</div>
            <div class="sb-item" onclick="sT('s_user')">🛡️ Client Compliance (IAM)</div>
            <div class="sb-item" onclick="sT('s_brdc')">📻 Global Comms</div>
            <div class="sb-item" onclick="sT('s_pref')">⚙️ System Preferences</div>
            <div class="sb-item" onclick="sT('s_chat')">💬 Private Client Desk</div>
        </div>
        <div class="admin-main">
            <div id="s_dash" class="adm-tab">
                <div class="telemetry-grid">
                    <div class="glass t-box"><div>LIVE VOLUME</div><div class="t-val" id="tl_vol">$...</div></div>
                    <div class="glass t-box" style="border-color:#00ffcc;"><div>ONLINE NODES</div><div class="t-val" id="tl_onl">...</div></div>
                    <div class="glass t-box" style="border-color:orange;"><div>PENDING KYC</div><div class="t-val" id="tl_kyc">...</div></div>
                    <div class="glass t-box" style="border-color:#00ff00;"><div>COMPLIANCE REPORT</div><a href="index.php?export=ledger"><button class="btn" style="margin-top:10px; width:100%;">EXPORT CSV</button></a></div>
                </div>
                <div class="glass" style="padding:20px;"><h4 style="margin-top:0; color:var(--neon); font-family:'Space Mono';">> WAF_AUDIT_LOG.TRC</h4><div class="terminal" id="term_log" style="height:250px; overflow-y:auto; background:#000; padding:15px; font-family:'Space Mono'; font-size:11px; color:var(--neon);">Loading log vectors...</div></div>
            </div>
            
            <div id="s_pref" class="adm-tab" style="display:none;"><div class="glass" style="padding:30px; max-width:550px;"><h3>SYSTEM PREFERENCES</h3><form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="update_gate"><label style="font-size:11px; color:#888;">Portal Decryption Key:</label><input type="text" name="new_code" value="<?= htmlspecialchars($config['gate_code']) ?>" required><label style="font-size:11px; color:#888; display:block; margin-top:15px;">Admin Crypto Receiving Address (Displayed to buyers in Escrow):</label><input type="text" name="crypto_wallet" value="<?= htmlspecialchars($config['crypto_wallet']) ?>" required><button class="btn" style="width:100%; margin-top:15px;">SAVE PREFERENCES</button></form></div></div>

            <div id="s_user" class="adm-tab" style="display:none;">
                <input type="text" id="userSearch" placeholder="🔍 Live CRM Filter (Enter Alias Name)..." onkeyup="filterUsers()">
                <div class="glass" style="padding:20px;">
                    <table style="width:100%; text-align:left; font-size:12px;">
                        <thead><tr style="color:var(--gold);"><th>Client Identity</th><th>Compliance Status</th><th>Operational Controls</th></tr></thead>
                        <tbody id="admin_users_tbody"><tr><td colspan="3" style="text-align:center;color:#666;">Synchronizing client database matrix...</td></tr></tbody>
                    </table>
                </div>
            </div>

            <!-- ASSET PORTFOLIO -->
            <div id="s_auct" class="adm-tab" style="display:none;">
                <div style="display:flex; gap:30px; align-items:flex-start;">
                    <div class="glass" style="padding:30px; width:400px; flex-shrink:0;">
                        <h3>DEPLOY NEW ASSET VECTOR</h3>
                        <form method="POST" enctype="multipart/form-data"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="create_auction"><input type="text" name="title" placeholder="Asset Nomenclature" required><textarea name="desc" placeholder="Asset Dossier History (Specifications, provenance, state...)" rows="3" required></textarea><div style="display:flex; gap:8px;"><input type="datetime-local" name="start" required><input type="datetime-local" name="end" required></div><div style="display:flex; gap:8px;"><input type="number" name="min_b" placeholder="Opening Bid ($)" required><input type="number" name="step" placeholder="Base Step ($)" required></div><input type="number" name="sniper" placeholder="Anti-Sniper Extension Buffer (Mins)" value="2" required><textarea name="chkout" placeholder="Discreet Escrow Delivery/Payment details" rows="2" required></textarea><label style="font-size:11px;"><input type="checkbox" name="req_kyc" value="1"> Enable selective Proof of Funds validation</label>
                        <div style="margin:10px 0;"><span style="font-size:11px;color:#666;">Select Buyout Mode:</span><select name="b_type" onchange="document.getElementById('b_st').style.display=this.value==='static'?'block':'none'; document.getElementById('b_dy').style.display=this.value==='dynamic'?'block':'none';"><option value="none">No Buyout</option><option value="static">Static Fixed Price</option><option value="dynamic">Dynamic (Premium over highest bid)</option></select></div><div id="b_st" style="display:none;"><input type="number" name="b_static" placeholder="Fixed Buyout Price ($)"></div><div id="b_dy" style="display:none;"><input type="number" name="b_dynamic" placeholder="Premium added to highest bid ($)"></div><div style="margin:10px 0; font-size:11px; color:#555;">Asset Catalog Illustration:<br><input type="file" name="img"></div><button class="btn" style="width:100%;">DEPLOY TO PLATFORM</button></form>
                    </div>
                    <div style="flex-grow:1;">
                        <?php foreach($auctions as $id => $a): ?>
                            <div class="glass" style="padding:20px; margin-bottom:15px; border-left:3px solid <?= $a['status']==='active'?'var(--neon)':($a['status']==='escrow'?'orange':'#555') ?>;">
                                <div style="display:flex; justify-content:space-between;">
                                    <div><h4 style="margin:0; color:var(--gold);"><?= htmlspecialchars($a['title']) ?></h4><div style="font-size:11px; color:#888;">Lot_<?= strtoupper(substr($id,0,6)) ?> | Status: <?= strtoupper($a['status']) ?></div></div>
                                    <div style="display:flex; gap:5px;">
                                        <form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="toggle_pause"><input type="hidden" name="id" value="<?= $id ?>"><button class="btn <?= $a['status']==='frozen'?'':'btn-out' ?>" style="padding:5px 10px;"><?= $a['status']==='frozen'?'RESUME LOT':'FREEZE LOT' ?></button></form>
                                        <form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="mod_time"><input type="hidden" name="id" value="<?= $id ?>"><input type="hidden" name="secs" value="3600"><button class="btn btn-out" style="padding:5px 10px;">+1H</button></form>
                                        <form method="POST" onsubmit="return confirm('WARNING: Are you sure you want to completely eradicate this lot and all its history?');"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="del_auction"><input type="hidden" name="id" value="<?= $id ?>"><button class="btn" style="padding:5px 10px; background:red; color:white;">DELETE LOT</button></form>
                                    </div>
                                </div>

                                <!-- ADMIN ESCROW DESK -->
                                <?php if($a['status'] === 'escrow'): ?>
                                    <div style="margin-top:15px; padding:15px; border:1px solid orange; background:rgba(255,165,0,0.1); border-radius:4px;">
                                        <h4 style="margin:0 0 10px 0; color:orange;">🚨 ESCROW SETTLEMENT DESK</h4>
                                        <div style="font-size:12px; margin-bottom:10px;">
                                            <strong>Buyer:</strong> <?= $a['escrow_buyer'] ?> | <strong>Amount:</strong> $<?= number_format($a['escrow_price']) ?><br>
                                            <strong>Time Remaining:</strong> <span class="admin-escrow-timer" data-expires="<?= $a['escrow_expires'] ?>" style="color:red; font-family:'Space Mono'; font-weight:bold;"></span><br>
                                            <?php if(!empty($a['escrow_receipt'])): ?>
                                                <a href="<?= $a['escrow_receipt'] ?>" target="_blank" style="color:var(--neon); text-decoration:underline;">[ VIEW UPLOADED RECEIPT ]</a>
                                            <?php else: ?>
                                                <span style="color:#888;">No receipt uploaded yet.</span>
                                            <?php endif; ?>
                                        </div>
                                        <div style="display:flex; gap:10px;">
                                            <form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="escrow_verify"><input type="hidden" name="id" value="<?= $id ?>"><button class="btn" style="background:#00ff00; color:#000;">VERIFY PAYMENT & CLOSE</button></form>
                                            <form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="escrow_add_time"><input type="hidden" name="id" value="<?= $id ?>"><button class="btn btn-out" style="color:orange; border-color:orange;">+15 MINS</button></form>
                                            <form method="POST" onsubmit="return confirm('Void escrow? Buyer will be banned and lot will resume.');"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="escrow_void"><input type="hidden" name="id" value="<?= $id ?>"><button class="btn" style="background:red; color:#fff;">VOID & RESUME LOT</button></form>
                                        </div>
                                    </div>
                                <?php endif; ?>

                                <div style="margin-top:10px; font-size:11px; max-height:100px; overflow-y:auto; border-top:1px solid var(--bord); padding-top:10px;">
                                    <?php foreach($bids[$id] ?? [] as $idx => $b): ?>
                                        <div style="display:flex; justify-content:space-between; margin-bottom:3px; background:#000; padding:4px;">
                                            <span><?= $b['user'] ?>: $<?= number_format($b['betrag']) ?></span>
                                            <div style="display:flex; gap:5px;">
                                                <form method="POST" style="margin:0;"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="block_user_lot"><input type="hidden" name="id" value="<?= $id ?>"><input type="hidden" name="block_u" value="<?= $b['user'] ?>"><button style="background:orange; color:#000; border:none; padding:2px 5px; font-size:9px; cursor:pointer;">BLOCK USER</button></form>
                                                <form method="POST" style="margin:0;"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="storno_bid"><input type="hidden" name="id" value="<?= $id ?>"><input type="hidden" name="bid_idx" value="<?= $idx ?>"><button style="background:red; color:#fff; border:none; padding:2px 5px; font-size:9px; cursor:pointer;">CANCEL (X)</button></form>
                                            </div>
                                        </div>
                                    <?php endforeach; ?>
                                </div>
                                <?php if(!empty($a['blocked_users'])): ?>
                                    <div style="margin-top:10px; font-size:10px; color:orange;">Blocked from this lot: <?php foreach($a['blocked_users'] as $bu): ?><form method="POST" style="display:inline;"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="unblock_user_lot"><input type="hidden" name="id" value="<?= $id ?>"><input type="hidden" name="block_u" value="<?= $bu ?>"><button style="background:none; border:1px solid orange; color:orange; cursor:pointer; font-size:9px; margin-right:5px;"><?= $bu ?> [UNBLOCK]</button></form><?php endforeach; ?></div>
                                <?php endif; ?>
                            </div>
                        <?php endforeach; ?>
                    </div>
                </div>
            </div>
            
            <div id="s_brdc" class="adm-tab" style="display:none;"><div class="glass" style="padding:30px; max-width:600px;"><h3>RADIO TRANSMISSION BROADCASTS</h3><form method="POST" style="display:flex; gap:10px;"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="add_banner"><input type="text" name="b_text" placeholder="Broadcast String" required><input type="number" name="b_space" placeholder="Spacer Margin (Spaces)" value="15" required><button class="btn">INJECT</button></form><table style="width:100%; margin-top:20px; font-size:12px; text-align:left;"><?php foreach($config['banners'] ?? [] as $i => $b): ?><tr style="border-bottom:1px solid var(--bord);"><td style="padding:10px;"><?= htmlspecialchars($b['text']) ?></td><td style="padding:10px;"><form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="del_banner"><input type="hidden" name="b_idx" value="<?= $i ?>"><button class="btn" style="background:red; color:#fff; padding:4px 8px;">TERMINATE</button></form></td></tr><?php endforeach; ?></table></div></div>
            <div id="s_chat" class="adm-tab" style="display:none;"><div style="display:flex; gap:20px;"><div class="glass" style="width:250px; padding:15px; height:450px; overflow-y:auto;"><h4 style="margin-top:0;">SECURE CHANNELS</h4><?php foreach($users as $u => $d): if($u!=="Admin"): ?><div style="padding:10px; border-bottom:1px solid var(--bord); cursor:pointer;" onclick="setAChat('<?= htmlspecialchars($u) ?>')">👤 Channel: <?= htmlspecialchars($u) ?></div><?php endif; endforeach; ?></div><div class="glass" style="flex:1; padding:20px; display:flex; flex-direction:column; height:450px;"><h3 id="c_head" style="margin-top:0;">CHOOSE TRANSMISSION ID</h3><div id="c_box" style="flex:1; overflow-y:auto; background:#000; padding:15px; margin-bottom:10px; display:flex; flex-direction:column; gap:8px;"></div><form method="POST" onsubmit="event.preventDefault(); sendAC();" style="display:flex; gap:5px;"><input type="text" id="c_in" placeholder="Transmit secure protocol message..." style="margin:0;"><button class="btn" style="padding:0 25px;">SEND</button></form></div></div></div>
        </div>
    </div>
    <script>
        function sT(id) { document.querySelectorAll('.adm-tab').forEach(e=>e.style.display='none'); document.querySelectorAll('.sb-item').forEach(e=>e.classList.remove('active')); document.getElementById(id).style.display='block'; event.target.classList.add('active'); }
        function filterUsers() { let f=document.getElementById('userSearch').value.toLowerCase(); document.querySelectorAll('.u-row').forEach(r=>{ r.style.display = r.querySelector('.u-name').innerText.toLowerCase().includes(f)?'':'none'; }); }
        function adminAction(u, mode) { fetch('index.php', { method:'POST', headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:`action=admin_user_op&csrf_token=<?= $_SESSION['csrf_token'] ?>&u=${u}&mode=${mode}` }); }
        let cUser = ''; function openChat(u) { sT('s_chat'); setAChat(u); } function setAChat(u) { cUser = u; document.getElementById('c_head').innerText = "CHANNEL: " + u; syncAC(); }
        function sendAC() { let m = document.getElementById('c_in').value; if(!m) return; fetch('index.php', { method:'POST', headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'action=send_chat&csrf_token=<?= $_SESSION['csrf_token'] ?>&target_user='+cUser+'&msg='+encodeURIComponent(m) }).then(()=>{ document.getElementById('c_in').value=''; syncAC(); }); }
        function syncAC() { if(!cUser) return; fetch('index.php?api=live&chat_user='+cUser).then(r=>r.json()).then(d=>{ let bx=document.getElementById('c_box'); bx.innerHTML=''; if(d.chat) d.chat.forEach(m=>{ let me=m.sender==='Concierge'; bx.innerHTML+=`<div style="max-width:80%; padding:8px; border-radius:4px; align-self:${me?'flex-end':'flex-start'}; background:${me?'rgba(212,175,55,0.15)':'#222'}; border-left:2px solid ${me?'var(--gold)':'#555'};"><strong>${m.sender}</strong> <span style="font-size:9px;opacity:0.5">${m.time}</span><br>${m.msg}</div>`; }); bx.scrollTop=bx.scrollHeight; }); }
        
        setInterval(()=>{ fetch('index.php?api=live').then(r=>r.json()).then(d=>{ if(d.telemetry) { document.getElementById('tl_vol').innerText = d.telemetry.vol; document.getElementById('tl_onl').innerText = d.telemetry.online; document.getElementById('tl_kyc').innerText = d.telemetry.kyc_pending; let term = document.getElementById('term_log'); term.innerHTML = ''; d.telemetry.logs.forEach(l => { term.innerHTML += `<div style="border-bottom:1px solid #111; padding:3px 0;">[${l.zeit}] ${l.user}: ${l.action} -> ${l.details}</div>`; }); term.scrollTop = term.scrollHeight; } if(d.admin_users_html) { document.getElementById('admin_users_tbody').innerHTML = d.admin_users_html; } if(document.getElementById('s_chat').style.display=='block') syncAC(); }); }, 2000);

        setInterval(()=>{ let now = Math.floor(Date.now() / 1000); document.querySelectorAll('.admin-escrow-timer').forEach(el => { let exp = parseInt(el.getAttribute('data-expires')); let diff = exp - now; if(diff <= 0) { el.innerHTML = "EXPIRED"; } else { let m=Math.floor(diff/60), s=diff%60; el.innerHTML = (m<10?"0":"")+m+":"+(s<10?"0":"")+s; } }); }, 1000);
    </script>
<?php else: ?>
    <!-- VIP CLIENT FRONTEND PLATFORM -->
    <audio id="outbidSound" src="data:audio/wav;base64,UklGRigAAABXQVZFZm10IBAAAAABAAEARKwAAIhYAQACABAAZGF0YQQAAAAAAA=="></audio>
    <audio id="resumeSound" src="data:audio/wav;base64,UklGRigAAABXQVZFZm10IBAAAAABAAEARKwAAIhYAQACABAAZGF0YQQAAAAAAA=="></audio>

    <!-- Onboarding Modal -->
    <div class="modal-overlay" id="rulesModal" style="display:flex;"><div class="glass modal-box" style="text-align:center;"><h2>RULES OF THE VAULT</h2><p style="color:#aaa; font-size:13px; text-align:left; line-height:1.6;">1. <strong>CRYPTO ONLY:</strong> All transactions are settled exclusively in digital assets (USDT, USDC, BTC, ETH). Traditional fiat or bank wires are strictly rejected.<br>2. All submissions are final and legally binding.<br>3. Active extensions protect lots via anti-sniper logic buffers.</p><button class="btn" style="width:100%;" onclick="accRules()">I COMPLY & ENTER</button></div></div>

    <!-- Dossier Modal -->
    <div class="modal-overlay" id="dosModal" onclick="if(event.target===this) this.style.display='none';"><div class="glass modal-box"><span style="position:absolute; top:15px; right:20px; font-size:24px; cursor:pointer; color:#666;" onclick="document.getElementById('dosModal').style.display='none'">×</span><h2 id="d_title" style="color:var(--gold); margin-top:0;">Asset Title</h2><div id="d_img" style="width:100%; height:250px; background-size:cover; background-position:center; border-radius:4px; margin-bottom:15px;"></div><h4 style="border-bottom:1px solid var(--bord); padding-bottom:4px; margin-bottom:8px;">OFFICIAL DOSSIER PROTOCOL</h4><p id="d_desc" style="font-size:13px; line-height:1.6; color:#bbb; white-space:pre-wrap;"></p></div></div>

    <div class="vault-container">
        <div style="padding:20px 0; display:flex; gap:20px; border-bottom:1px solid rgba(255,255,255,0.05); font-size:12px; letter-spacing:1px;">
            <div class="c-tab active" style="cursor:pointer; color:var(--gold); font-weight:600;" onclick="f_tab('all')">EXHIBITION GALLERY</div>
            <div class="c-tab" style="cursor:pointer; color:#555; font-weight:600;" onclick="f_tab('watch')">MY PRIVATE VAULT (WATCHLIST)</div>
        </div>

        <div class="grid-gal">
            <?php foreach($auctions as $id => $a): 
                $is_w = in_array($id, $users[$_SESSION['user']]['watch'] ?? []);
            ?>
                <div class="auc-card glass act-card" data-id="<?= $id ?>" data-watch="<?= $is_w?'1':'0' ?>">
                    <div class="watch-btn <?= $is_w?'active':'' ?>" onclick="tglW(this, '<?= $id ?>')">♥</div>
                    <?php if($a['img']): ?><div class="img-container"><img src="<?= $a['img'] ?>" class="img-fixed"></div><?php endif; ?>
                    <div class="auc-content" style="margin-top:0; background:none;">
                        <div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:6px;"><span style="font-size:10px; color:var(--gold); letter-spacing:1px;">LOT_<?= strtoupper(substr($id,0,5)) ?></span><button class="btn btn-out" style="padding:4px 8px; font-size:9px;" onclick="openDos(`<?= htmlspecialchars($a['title']) ?>`, `<?= htmlspecialchars($a['desc']) ?>`, `<?= $a['img'] ?>`)">VIEW DOSSIER</button></div>
                        <h2 style="margin:0 0 15px 0; font-weight:300; font-size:20px; color:#fff;"><?= htmlspecialchars($a['title']) ?></h2>
                        
                        <div style="display:flex; justify-content:space-between; align-items:flex-end; border-bottom:1px solid var(--bord); padding-bottom:12px; margin-bottom:12px;">
                            <div><div style="font-size:9px; color:#666;">CURRENT STANDING</div><div id="price_<?= $id ?>" style="font-size:22px; font-weight:600; color:var(--gold);">$...</div></div>
                            <div style="text-align:right;"><div style="font-size:9px; color:#666;">CLOCK</div><div id="tmr_<?= $id ?>" class="timer c-clock" data-id="<?= $id ?>">...</div></div>
                        </div>
                        <div style="height:90px; overflow-y:auto; margin-bottom:15px;"><table style="width:100%; font-size:11px; font-family:'Space Mono';"><tbody id="hist_<?= $id ?>"></tbody></table></div>
                        
                        <!-- DYNAMIC FLICKER-FREE INJECTION ZONE -->
                        <div id="dyn_form_<?= $id ?>"></div>
                    </div>
                </div>
            <?php endforeach; ?>
        </div>
    </div>

    <!-- Floating Private Client Assistant -->
    <div id="conc_widget" class="glass" style="position:fixed; bottom:20px; right:20px; width:320px; display:none; flex-direction:column; z-index:9999;"><div style="padding:15px; display:flex; justify-content:space-between; align-items:center; background:#111; font-size:12px; border-bottom:1px solid var(--bord);"><span style="color:var(--gold); font-weight:bold;">PRIVATE CONCIERGE LINE</span><span style="cursor:pointer;" onclick="document.getElementById('conc_widget').style.display='none'">×</span></div><div id="my_chat_box" style="height:220px; overflow-y:auto; padding:15px; display:flex; flex-direction:column; gap:8px; font-size:11px; background:#000;"></div><form method="POST" onsubmit="event.preventDefault(); sendMyC();" style="display:flex; padding:10px; gap:4px;"><input type="text" id="my_c_in" placeholder="Transmit query vector..." style="margin:0;"><button class="btn">></button></form></div>
    <button class="btn" style="position:fixed; bottom:20px; right:20px; z-index:9998; border-radius:30px; padding:14px 24px;" onclick="document.getElementById('conc_widget').style.display='flex'">✉️ PRIVATE CONCIERGE</button>

    <div id="notif_panel" class="glass" style="display:none; position:fixed; top:70px; right:40px; width:300px; z-index:9999; padding:20px;"><h4 style="margin-top:0; border-bottom:1px solid var(--bord); padding-bottom:10px;">SYSTEM ALERTS</h4><div style="max-height:200px; overflow-y:auto; font-size:11px; margin-bottom:10px;" id="notif_list"></div><form method="POST"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="clear_notifs"><button class="btn btn-out" style="width:100%;">CLEAR HISTORY</button></form></div>

    <?php if(isset($_SESSION['auto_open_chat'])): unset($_SESSION['auto_open_chat']); ?>
    <script>
        document.addEventListener("DOMContentLoaded", function() {
            document.getElementById('conc_widget').style.display = 'flex';
        });
    </script>
    <?php endif; ?>

    <script>
        let GLOBAL_WALLET = <?= json_encode($config['crypto_wallet']) ?>;
        if(localStorage.getItem('v_rules') === '1') document.getElementById('rulesModal').style.display='none';
        function accRules() { localStorage.setItem('v_rules', '1'); document.getElementById('rulesModal').style.display='none'; }
        function openDos(t, d, img) { document.getElementById('d_title').innerText=t; document.getElementById('d_desc').innerText=d; document.getElementById('d_img').style.backgroundImage=`url('${img}')`; document.getElementById('dosModal').style.display='flex'; }
        function f_tab(m) { document.querySelectorAll('.c-tab').forEach(e=>e.style.color='#555'); event.target.style.color='var(--gold)'; document.querySelectorAll('.act-card').forEach(c => { if(m==='all') c.style.display='flex'; else c.style.display=c.getAttribute('data-watch')==='1'?'flex':'none'; }); }
        function tglW(b, id) { fetch(`index.php?api=toggle_watch&id=${id}`).then(r=>r.json()).then(d=>{ if(d.ok) { b.classList.toggle('active'); let p=b.closest('.act-card'); p.setAttribute('data-watch', p.getAttribute('data-watch')==='1'?'0':'1'); } }); }
        
        let aData = {}; let wasH = {}; let wasEscrow = {};
        function pollLive() {
            fetch('index.php?api=live').then(r=>r.json()).then(d => {
                if(d.my_status) { let badge = document.getElementById('my_status_badge'); badge.style.color = d.my_status === 'approved' ? '#00ff00' : 'var(--gold)'; }
                
                let nList = document.getElementById('notif_list');
                if(nList && d.notifs) {
                    nList.innerHTML = d.notifs.length === 0 ? '<span style="color:#444;">No new alerts.</span>' : '';
                    d.notifs.forEach(n => { nList.innerHTML += `<div style="padding:6px 0; border-bottom:1px solid var(--bord);"><span style="color:var(--gold); font-size:10px;">Alert</span><br>${n.msg}</div>`; });
                    if(d.notifs.length > 0) document.getElementById('n_dot').style.display='block'; else document.getElementById('n_dot').style.display='none';
                }

                for(let id in d.auctions) {
                    let a = d.auctions[id]; aData[id] = a;
                    let pE = document.getElementById('price_'+id); if(pE) pE.innerText = a.highest;
                    let hE = document.getElementById('hist_'+id); if(hE) hE.innerHTML = a.hist_html;
                    
                    let iE = document.getElementById('inp_'+id); 
                    if(iE) { iE.min = a.next; iE.placeholder = "Min. $ " + parseInt(a.next).toLocaleString(); }
                    
                    if(wasH[id] === true && a.is_highest === false && a.status === 'active') { document.getElementById('outbidSound').play().catch(()=>{}); }
                    wasH[id] = a.is_highest;

                    if(wasEscrow[id] === true && a.status === 'active') { document.getElementById('resumeSound').play().catch(()=>{}); }
                    wasEscrow[id] = (a.status === 'escrow');

                    let formBox = document.getElementById('dyn_form_'+id);
                    if(formBox) {
                        if(a.is_blocked) {
                            if(!document.getElementById('blk_'+id)) formBox.innerHTML = '<div id="blk_'+id+'" style="background:rgba(255,0,0,0.2); border:1px solid red; color:white; text-align:center; padding:15px; font-size:12px; font-weight:600;">BIDDING PRIVILEGES REVOKED FOR THIS LOT</div>';
                        }
                        else if(a.status === 'escrow') {
                            if(a.escrow_buyer === "<?= $_SESSION['user'] ?? '' ?>") {
                                if(!document.getElementById('escrow_panel_'+id)) {
                                    formBox.innerHTML = `
                                        <div id="escrow_panel_${id}" style="background:rgba(212,175,55,0.1); border:1px solid var(--gold); border-radius:4px; padding:15px; text-align:center;">
                                            <div style="color:var(--gold); font-weight:bold; font-size:12px; margin-bottom:10px;">SECURE CRYPTO SETTLEMENT</div>
                                            <div id="escrow_timer_${id}" style="font-size:24px; font-family:'Space Mono'; color:red; margin-bottom:10px;" class="escrow-timer-client" data-expires="${a.escrow_expires}">--:--</div>
                                            <div style="font-size:10px; color:#aaa; margin-bottom:5px;">Transfer exact amount to:</div>
                                            <input type="text" value="${GLOBAL_WALLET}" readonly style="font-size:10px; text-align:center; padding:8px; margin-bottom:10px; cursor:text;" onclick="this.select();">
                                            <form method="POST" enctype="multipart/form-data">
                                                <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="upload_receipt"><input type="hidden" name="auction_id" value="${id}">
                                                <input type="file" name="receipt_file" required style="font-size:10px; border:none; background:transparent;">
                                                <button class="btn" style="width:100%; margin-top:5px;">UPLOAD RECEIPT</button>
                                            </form>
                                            <div style="font-size:10px; color:#666; margin-top:10px;">The Concierge chat has been opened for assistance.</div>
                                        </div>
                                    `;
                                } else {
                                    let et = document.getElementById('escrow_timer_'+id); if(et) et.setAttribute('data-expires', a.escrow_expires);
                                }
                            } else {
                                let wId = 'escrow_watch_'+id+'_'+a.is_escrow_watcher;
                                if(!document.getElementById(wId)) {
                                    let watcher_html = a.is_escrow_watcher 
                                        ? `<div style="margin-top:10px; font-size:10px; color:#00ff00;">✓ You will be notified if settlement fails.</div>`
                                        : `<form method="POST" style="margin-top:10px;"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="watch_escrow"><input type="hidden" name="auction_id" value="${id}"><button class="btn btn-out" style="width:100%;">🔔 NOTIFY ME IF BUYOUT FAILS</button></form>`;

                                    formBox.innerHTML = `
                                        <div id="${wId}" style="background:#111; border:1px solid #333; text-align:center; padding:15px; border-radius:4px;">
                                            <div style="color:orange; font-size:12px; font-weight:bold; margin-bottom:5px;">🔒 AWAITING SETTLEMENT</div>
                                            <div style="font-size:11px; color:#888;">Buyout triggered. Lot paused pending crypto verification.</div>
                                            ${watcher_html}
                                        </div>
                                    `;
                                }
                            }
                        }
                        else if(a.status === 'sold' || a.status === 'ended') { 
                            if(!document.getElementById('cls_'+id)) formBox.innerHTML = '<div id="cls_'+id+'" style="background:#111; text-align:center; padding:10px; color:var(--gold); font-size:11px; font-weight:600;">🔒 LOT CONCLUDED / CLOSED</div>'; 
                        }
                        else if(a.status === 'frozen') { 
                            if(!document.getElementById('frz_'+id)) formBox.innerHTML = '<div id="frz_'+id+'" style="background:orange; color:#000; text-align:center; padding:10px; font-size:11px; font-weight:600;">⏸️ TRANSMISSION FROZEN BY COMPLIANCE</div>'; 
                        }
                        else if(d.my_status !== 'approved') { 
                            if(!document.getElementById('pnd_'+id)) formBox.innerHTML = '<div id="pnd_'+id+'" style="background:#222; text-align:center; padding:10px; font-size:11px;">⏳ AWAITING ADMINISTRATIVE CLEARANCE...</div>'; 
                        }
                        else {
                            let requires_kyc = <?= json_encode(array_combine(array_keys($auctions), array_column($auctions, 'req_kyc'))) ?>;
                            let user_has_kyc = <?= json_encode(!empty($users[$_SESSION['user']]['kyc']) ? $users[$_SESSION['user']]['kyc'] : []) ?>;
                            
                            if(requires_kyc[id] && !user_has_kyc[id]) {
                                if(!document.getElementById('kyc_'+id)) {
                                    formBox.innerHTML = `<form id="kyc_${id}" method="POST" enctype="multipart/form-data" style="background:rgba(212,175,55,0.05); padding:12px; border:1px solid var(--gold); border-radius:4px;"><div style="font-size:11px; color:var(--gold); margin-bottom:6px; font-weight:600;">⚠️ Proof of Funds Layer Activated</div><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="upload_kyc"><input type="hidden" name="auction_id" value="${id}"><input type="file" name="kyc_file" required style="font-size:10px; border:none; background:transparent;"><button class="btn" style="width:100%; margin-top:8px; padding:8px;">UPLOAD POF DOSSIER</button></form>`;
                                }
                            } else {
                                let buyout_btn_html = "";
                                if(a.buyout_price > 0) { buyout_btn_html = `<form method="POST" style="margin-top:6px;"><input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="sofortkauf"><input type="hidden" name="auction_id" value="${id}"><button class="btn" style="width:100%; background:#fff; color:#000;">⚡ INSTANT ACQUIRE $ ${parseInt(a.buyout_price).toLocaleString()}</button></form>`; }

                                if(!document.getElementById('inp_'+id)) {
                                    formBox.innerHTML = `
                                        <form method="POST" style="display:flex; gap:8px;">
                                            <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="bieten"><input type="hidden" name="auction_id" value="${id}">
                                            <input type="number" name="val" id="inp_${id}" step="1" required style="margin:0;">
                                            <button class="btn" style="margin:0;">BID</button>
                                        </form>
                                        <div style="background:rgba(255,255,255,0.02); border:1px solid var(--bord); border-radius:4px; padding:12px; margin-top:8px;">
                                            <div style="font-size:11px; font-weight:600; color:var(--gold);">🤖 AUTO BIDDER TOOL</div>
                                            <div style="font-size:10px; color:#666; margin:4px 0 8px 0; line-height:1.3;">Set your maximum limit. The system will automatically bid the minimum required increment on your behalf if you are outbid.</div>
                                            <form method="POST" style="display:flex; gap:6px; margin:0;">
                                                <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>"><input type="hidden" name="action" value="agent"><input type="hidden" name="auction_id" value="${id}">
                                                <input type="number" name="val" step="1" placeholder="Max Limit ($)" required style="margin:0; padding:8px;">
                                                <button class="btn btn-out" style="margin:0; padding:8px 12px; font-size:10px;">ACTIVATE</button>
                                            </form>
                                        </div>
                                        ${buyout_btn_html}
                                    `;
                                }
                            }
                        }
                    }
                }
                let ch=document.getElementById('my_chat_box'); if(ch && d.chat) { let old=ch.innerHTML; ch.innerHTML=''; d.chat.forEach(m=>{ let me=m.sender!=='Concierge'; ch.innerHTML+=`<div style="max-width:85%; padding:8px; border-radius:4px; align-self:${me?'flex-end':'flex-start'}; background:${me?'rgba(212,175,55,0.12)':'#222'}; border-left:2px solid ${me?'var(--gold)':'#555'};"><strong>${m.sender}</strong> <span style="font-size:9px;opacity:0.4">${m.time}</span><br>${m.msg}</div>`; }); if(old!==ch.innerHTML) ch.scrollTop=ch.scrollHeight; }
            });
        }
        function sendMyC() { let m = document.getElementById('my_c_in').value; if(!m) return; fetch('index.php', { method:'POST', headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'action=send_chat&csrf_token=<?= $_SESSION['csrf_token'] ?>&msg='+encodeURIComponent(m) }).then(()=>{ document.getElementById('my_c_in').value=''; pollLive(); }); }
        
        setInterval(pollLive, 2000); pollLive();
        
        setInterval(()=>{
            let now = Math.floor(Date.now() / 1000);
            document.querySelectorAll('.c-clock').forEach(el => {
                let id = el.getAttribute('data-id'); let a = aData[id]; if(!a) return;
                if(a.status === 'escrow') { el.innerHTML = "SETTLING"; return; }
                if(a.status === 'frozen') { el.innerHTML = "FROZEN"; return; }
                if(a.status === 'sold' || a.status === 'ended') { el.innerHTML = "CLOSED"; return; }
                if(now < a.start_epoch) { el.innerHTML = "UPCOMING"; return; }
                let diff = a.end_epoch - now; if(diff <= 0) { el.innerHTML = "ENDED"; return; }
                let d=Math.floor(diff/86400), h=Math.floor((diff%86400)/3600), m=Math.floor((diff%3600)/60), s=diff%60;
                el.innerHTML = (d>0?d+"d ":"")+(h<10?"0":"")+h+":"+(m<10?"0":"")+m+":"+(s<10?"0":"")+s;
                if(diff < 60) el.className = "timer c-clock blink"; else el.className = "timer c-clock";
            });
            
            // Client Escrow Timers Updates without Flicker
            document.querySelectorAll('.escrow-timer-client').forEach(el => {
                let exp = parseInt(el.getAttribute('data-expires')); let diff = exp - now;
                if(diff <= 0) { el.innerHTML = "00:00 - EXPIRED"; } else { let m=Math.floor(diff/60), s=diff%60; el.innerHTML = (m<10?"0":"")+m+":"+(s<10?"0":"")+s; }
            });
        }, 1000);
    </script>
<?php endif; ?>
</body>
</html>
