// server/src/schema/patient_files.ts
import { pgTable, text, timestamp, pgEnum, integer, date, index, varchar } from 'drizzle-orm/pg-core';
import { appSchema } from './base';
import { clinics } from './clinics';
import { patients } from './patients';
import { users } from './users';

export const fileTypeEnum = pgEnum('file_type', ['x-ray', 'document', 'image', 'report', 'dicom']);
export const patientFileSourceEnum = pgEnum('patient_file_source', ['manual_upload', 'bridge_capture', 'lab_dicom']);

export const patientFiles = appSchema.table('patient_files', {
  id: text('id').primaryKey(),
  clinicId: text('clinic_id').notNull().references(() => clinics.id, { onDelete: 'cascade' }),
  patientId: text('patient_id').notNull().references(() => patients.id, { onDelete: 'cascade' }),
  fileName: text('file_name').notNull(),
  fileType: fileTypeEnum('file_type').notNull(),
  category: text('category').notNull(),
  filePath: text('file_path').notNull(),
  fileSizeKb: integer('file_size_kb'),
  toothNumber: text('tooth_number'),
  uploadDate: date('upload_date').defaultNow().notNull(),
  uploadedBy: text('uploaded_by').references(() => users.id, { onDelete: 'set null' }),
  notes: text('notes'),
  source: patientFileSourceEnum('source').notNull().default('manual_upload'),
  operatoryRoom: varchar('operatory_room', { length: 64 }),
  createdAt: timestamp('created_at').defaultNow().notNull(),
}, (table) => ({
  clinicIdIdx: index('patient_files_clinic_id_idx').on(table.clinicId),
  patientIdIdx: index('patient_files_patient_id_idx').on(table.patientId),
}));

export type PatientFile = typeof patientFiles.$inferSelect;
export type NewPatientFile = typeof patientFiles.$inferInsert;

// server/src/schema/clinical_notes.ts — add import and column
import { pgTable, text, timestamp, boolean, date, index, jsonb } from 'drizzle-orm/pg-core';
// (all existing imports remain)

export const clinicalNotes = appSchema.table('clinical_notes', {
  // ...existing columns unchanged...
  id: text('id').primaryKey(),
  clinicId: text('clinic_id').notNull().references(() => clinics.id, { onDelete: 'cascade' }),
  patientId: text('patient_id').notNull().references(() => patients.id, { onDelete: 'cascade' }),
  appointmentId: text('appointment_id').references(() => appointments.id, { onDelete: 'set null' }),
  admissionId: text('admission_id'),
  doctorId: text('doctor_id').references(() => users.id, { onDelete: 'set null' }),
  visitDate: date('visit_date').notNull(),
  chiefComplaint: text('chief_complaint'),
  diagnosis: text('diagnosis'),
  treatmentProvided: text('treatment_provided'),
  prescriptionsGiven: text('prescriptions_given'),
  followUpRequired: boolean('follow_up_required').default(false).notNull(),
  followUpDate: date('follow_up_date'),
  notes: text('notes'),
  attachedFileIds: jsonb('attached_file_ids').$type<string[]>().default([]),
  createdAt: timestamp('created_at').defaultNow().notNull(),
  updatedAt: timestamp('updated_at').defaultNow().notNull(),
}, (table) => ({
  clinicIdIdx: index('clinical_notes_clinic_id_idx').on(table.clinicId),
  patientIdIdx: index('clinical_notes_patient_id_idx').on(table.patientId),
}));

export type ClinicalNote = typeof clinicalNotes.$inferSelect;
export type NewClinicalNote = typeof clinicalNotes.$inferInsert;

cd server && pnpm db:push

git add server/src/schema/patient_files.ts server/src/schema/clinical_notes.ts
git commit -m "feat(schema): add source/operatoryRoom to patient_files, attachedFileIds to clinical_notes"

// server/src/schema/api_keys.ts
import { pgTable, text, timestamp, index } from 'drizzle-orm/pg-core';
import { appSchema } from './base';
import { clinics } from './clinics';

export const apiKeys = appSchema.table('api_keys', {
  id: text('id').primaryKey(),
  clinicId: text('clinic_id').notNull().references(() => clinics.id, { onDelete: 'cascade' }),
  label: text('label').notNull(),
  keyId: text('key_id').notNull().unique(),
  scope: text('scope').notNull().default('bridge_upload'),
  revokedAt: timestamp('revoked_at'),
  createdAt: timestamp('created_at').defaultNow().notNull(),
}, (table) => ({
  clinicIdIdx: index('api_keys_clinic_id_idx').on(table.clinicId),
  keyIdIdx: index('api_keys_key_id_idx').on(table.keyId),
}));

export type ApiKey = typeof apiKeys.$inferSelect;

export * from './api_keys';

export interface BridgeTokenPayload {
  sub: string;       // clinicId
  keyId: string;
  scope: 'bridge_upload';
  type: 'bridge';
}

export async function generateBridgeToken(clinicId: string, keyId: string): Promise<string> {
  const secret = new TextEncoder().encode(process.env.JWT_SECRET || '');
  const token = await new SignJWT({ sub: clinicId, keyId, scope: 'bridge_upload', type: 'bridge' })
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime('1y')
    .sign(secret);
  return token;
}

export async function verifyBridgeToken(token: string): Promise<BridgeTokenPayload | null> {
  try {
    const secret = new TextEncoder().encode(process.env.JWT_SECRET || '');
    const { payload } = await jwtVerify(token, secret, { clockTolerance: 60 });
    if (payload.type !== 'bridge' || payload.scope !== 'bridge_upload') return null;
    return payload as unknown as BridgeTokenPayload;
  } catch {
    return null;
  }
}

// server/src/routes/clinic-api-keys.ts
import { Hono } from 'hono';
import { getDatabase } from '../lib/db';
import { getDatabaseUrl } from '../lib/env';
import { handleError, AppError } from '../lib/errors';
import { apiKeys } from '../schema';
import { eq, and } from 'drizzle-orm';
import { generateBridgeToken } from '../lib/nextauth';

const clinicApiKeysRoute = new Hono();

// POST /api/v1/protected/clinic/api-keys — generate a bridge key
clinicApiKeysRoute.post('/', async (c) => {
  try {
    const user = c.get('user');
    const clinicContext = c.get('clinicContext');
    const clinicId = clinicContext?.currentClinicId || user.clinicId || '';

    if (!clinicId) throw new AppError('No clinic context', 403);
    if (user.role !== 'admin' && user.role !== 'superadmin') {
      throw new AppError('Only admins can generate bridge API keys', 403);
    }

    const { label } = await c.req.json<{ label: string }>();
    if (!label?.trim()) throw new AppError('Label is required', 400);

    const db = await getDatabase(getDatabaseUrl());
    const keyId = crypto.randomUUID();
    const token = await generateBridgeToken(clinicId, keyId);

    await db.insert(apiKeys).values({
      id: crypto.randomUUID(),
      clinicId,
      label: label.trim(),
      keyId,
      scope: 'bridge_upload',
    });

    return c.json({ apiKey: token, keyId, label: label.trim() }, 201);
  } catch (error) {
    return handleError(error, c);
  }
});

// GET /api/v1/protected/clinic/api-keys — list keys for clinic
clinicApiKeysRoute.get('/', async (c) => {
  try {
    const user = c.get('user');
    const clinicContext = c.get('clinicContext');
    const clinicId = clinicContext?.currentClinicId || user.clinicId || '';

    if (!clinicId) throw new AppError('No clinic context', 403);
    if (user.role !== 'admin' && user.role !== 'superadmin') {
      throw new AppError('Only admins can view bridge API keys', 403);
    }

    const db = await getDatabase(getDatabaseUrl());
    const keys = await db.select({
      id: apiKeys.id,
      keyId: apiKeys.keyId,
      label: apiKeys.label,
      scope: apiKeys.scope,
      revokedAt: apiKeys.revokedAt,
      createdAt: apiKeys.createdAt,
    })
      .from(apiKeys)
      .where(eq(apiKeys.clinicId, clinicId));

    return c.json(keys);
  } catch (error) {
    return handleError(error, c);
  }
});

// DELETE /api/v1/protected/clinic/api-keys/:keyId — revoke a key
clinicApiKeysRoute.delete('/:keyId', async (c) => {
  try {
    const user = c.get('user');
    const clinicContext = c.get('clinicContext');
    const clinicId = clinicContext?.currentClinicId || user.clinicId || '';
    const { keyId } = c.req.param();

    if (!clinicId) throw new AppError('No clinic context', 403);
    if (user.role !== 'admin' && user.role !== 'superadmin') {
      throw new AppError('Only admins can revoke bridge API keys', 403);
    }

    const db = await getDatabase(getDatabaseUrl());
    const [updated] = await db
      .update(apiKeys)
      .set({ revokedAt: new Date() })
      .where(and(eq(apiKeys.keyId, keyId), eq(apiKeys.clinicId, clinicId)))
      .returning();

    if (!updated) throw new AppError('Key not found', 404);

    return c.json({ revoked: true });
  } catch (error) {
    return handleError(error, c);
  }
});

export default clinicApiKeysRoute;

cd server && pnpm db:push

git add server/src/schema/api_keys.ts server/src/schema/index.ts \
        server/src/routes/clinic-api-keys.ts server/src/lib/nextauth.ts
git commit -m "feat(api-keys): bridge API key generation and revocation"

// server/src/durable-objects/clinic-hub.ts

export interface ClinicEvent {
  type: 'new_xray' | 'new_dicom' | 'ping';
  patientId?: string;
  patientName?: string;
  fileId?: string;
  toothNumber?: string | null;
  source?: string;
  labCaseId?: string | null;
  ts: number;
}

interface StoredEvent {
  ts: number;
  data: ClinicEvent;
}

export class ClinicHub {
  private events: StoredEvent[] = [];

  constructor(private state: DurableObjectState) {}

  async fetch(request: Request): Promise<Response> {
    const url = new URL(request.url);

    if (url.pathname.endsWith('/publish') && request.method === 'POST') {
      const event = await request.json<ClinicEvent>();
      const now = Date.now();
      this.events.push({ ts: now, data: { ...event, ts: now } });
      // Keep only last 2 minutes of events
      this.events = this.events.filter(e => now - e.ts < 120_000);
      return new Response('OK', { status: 200 });
    }

    if (url.pathname.endsWith('/poll') && request.method === 'GET') {
      const since = Number(url.searchParams.get('since') || 0);
      const fresh = this.events.filter(e => e.ts > since).map(e => e.data);
      return Response.json({ events: fresh, serverTs: Date.now() });
    }

    return new Response('Not found', { status: 404 });
  }
}

// server/src/lib/event-bus.ts

import type { ClinicEvent } from '../durable-objects/clinic-hub';

export type { ClinicEvent };

// In-memory fallback for Node.js dev
const memListeners = new Map<string, Set<(e: ClinicEvent) => void>>();

export const memBus = {
  subscribe(clinicId: string, fn: (e: ClinicEvent) => void) {
    if (!memListeners.has(clinicId)) memListeners.set(clinicId, new Set());
    memListeners.get(clinicId)!.add(fn);
    return () => memListeners.get(clinicId)?.delete(fn);
  },
  publish(clinicId: string, event: ClinicEvent) {
    memListeners.get(clinicId)?.forEach(fn => fn(event));
  },
};

export async function publishEvent(
  env: { CLINIC_HUB?: DurableObjectNamespace },
  clinicId: string,
  event: Omit<ClinicEvent, 'ts'>
) {
  const full: ClinicEvent = { ...event, ts: Date.now() };

  if (env.CLINIC_HUB) {
    const id = env.CLINIC_HUB.idFromName(clinicId);
    const hub = env.CLINIC_HUB.get(id);
    await hub.fetch(new Request('https://do/publish', {
      method: 'POST',
      body: JSON.stringify(full),
      headers: { 'Content-Type': 'application/json' },
    }));
  } else {
    memBus.publish(clinicId, full);
  }
}

// server/src/routes/sse.ts
import { Hono } from 'hono';
import { streamSSE } from 'hono/streaming';
import { handleError } from '../lib/errors';
import { memBus } from '../lib/event-bus';

const sseRoute = new Hono();

sseRoute.get('/clinic-events', async (c) => {
  try {
    const user = c.get('user');
    const clinicContext = c.get('clinicContext');
    const clinicId = clinicContext?.currentClinicId || user.clinicId || '';

    if (!clinicId) return c.json({ error: 'No clinic context' }, 403);

    const env = c.env as { CLINIC_HUB?: DurableObjectNamespace };

    return streamSSE(c, async (stream) => {
      if (env.CLINIC_HUB) {
        // CF Workers path: poll the Durable Object
        const doId = env.CLINIC_HUB.idFromName(clinicId);
        const hub = env.CLINIC_HUB.get(doId);
        let lastTs = Date.now();

        while (!stream.closed) {
          try {
            const res = await hub.fetch(
              new Request(`https://do/poll?since=${lastTs}`, { method: 'GET' })
            );
            const { events, serverTs } = await res.json<{ events: any[]; serverTs: number }>();
            for (const event of events) {
              await stream.writeSSE({ data: JSON.stringify(event) });
            }
            lastTs = serverTs;
          } catch {}
          await stream.sleep(1000);
        }
      } else {
        // Node.js dev path: subscribe to in-memory bus
        const pending: any[] = [];
        const unsub = memBus.subscribe(clinicId, (event) => pending.push(event));

        // Keepalive ping every 25s
        const timer = setInterval(async () => {
          if (!stream.closed) {
            await stream.writeSSE({ data: JSON.stringify({ type: 'ping', ts: Date.now() }) });
          }
        }, 25_000);

        while (!stream.closed) {
          while (pending.length > 0) {
            await stream.writeSSE({ data: JSON.stringify(pending.shift()) });
          }
          await stream.sleep(200);
        }

        unsub();
        clearInterval(timer);
      }
    });
  } catch (error) {
    return handleError(error, c);
  }
});

export default sseRoute;

# Durable Object for clinic real-time event bus (SSE)
[durable_objects]
bindings = [{ name = "CLINIC_HUB", class_name = "ClinicHub" }]

[[migrations]]
tag = "v1-clinic-hub"
new_classes = ["ClinicHub"]

[env.production.durable_objects]
bindings = [{ name = "CLINIC_HUB", class_name = "ClinicHub" }]

git add server/src/durable-objects/clinic-hub.ts server/src/lib/event-bus.ts \
        server/src/routes/sse.ts server/wrangler.toml
git commit -m "feat(sse): Durable Object event bus + SSE endpoint for real-time X-ray events"

import { verifyBridgeToken } from '../lib/nextauth';
import { publishEvent } from '../lib/event-bus';
import { apiKeys } from '../schema';

const user = c.get('user');

// Support bridge_upload scope tokens in addition to session users
let user = c.get('user');
let bridgeClinicId: string | null = null;

const authHeader = c.req.header('Authorization');
if (authHeader?.startsWith('Bearer ')) {
  const token = authHeader.slice(7);
  const bridgePayload = await verifyBridgeToken(token);
  if (bridgePayload) {
    // Verify keyId not revoked
    const db2 = await getDatabase(getDatabaseUrl());
    const [key] = await db2.select()
      .from(apiKeys)
      .where(eq(apiKeys.keyId, bridgePayload.keyId))
      .limit(1);
    if (!key || key.revokedAt) {
      return c.json({ error: 'Bridge API key revoked or invalid' }, 401);
    }
    bridgeClinicId = bridgePayload.sub;
    // Synthesise a minimal user context for the rest of the handler
    if (!user) {
      user = { id: 'bridge', role: 'bridge', clinicId: bridgeClinicId } as any;
      c.set('user', user);
    }
  }
}

const clinicId = clinicContext?.currentClinicId || user.clinicId || '';

const clinicId = bridgeClinicId || clinicContext?.currentClinicId || user.clinicId || '';

const source = (formData.get('source') as string | null) || 'manual_upload';
const operatoryRoom = (formData.get('operatoryRoom') as string | null) || null;

const [newFile] = await db.insert(patientFiles)
  .values({
    id: fileId,
    clinicId,
    patientId,
    fileName: file.name,
    fileType: fileType.toLowerCase() as 'x-ray' | 'document' | 'image' | 'report' | 'dicom',
    category,
    filePath: r2Key,
    fileSizeKb,
    toothNumber: toothNumber || null,
    uploadedBy: user.id !== 'bridge' ? user.id : null,
    notes: notes || null,
    source: source as 'manual_upload' | 'bridge_capture' | 'lab_dicom',
    operatoryRoom: operatoryRoom || null,
    uploadDate: new Date().toISOString().split('T')[0],
  })
  .returning();

// Fire SSE event — non-blocking
if (fileType.toLowerCase() === 'x-ray' || fileType.toLowerCase() === 'dicom') {
  const [patientRow] = await db.select({ firstName: patients.firstName, lastName: patients.lastName })
    .from(patients)
    .where(eq(patients.id, patientId))
    .limit(1);
  const eventType = isDicom ? 'new_dicom' : 'new_xray';
  c.executionCtx?.waitUntil(
    publishEvent(c.env as any, clinicId, {
      type: eventType,
      patientId,
      patientName: patientRow ? `${patientRow.firstName} ${patientRow.lastName}` : '',
      fileId: newFile.id,
      toothNumber: toothNumber || null,
      source,
    })
  );
}

import clinicApiKeysRoute from './routes/clinic-api-keys';
import sseRoute from './routes/sse';

protectedRoutes.route('/clinic/api-keys', clinicApiKeysRoute);
protectedRoutes.route('/sse', sseRoute);

export { ClinicHub } from './durable-objects/clinic-hub';

git add server/src/routes/files.ts server/src/api.ts server/src/worker.ts
git commit -m "feat(upload): accept bridge tokens, fire SSE event after x-ray upload"

packages:
  - 'server'
  - 'database-server'
  - 'ui'
  - 'mobile'
  - 'shared'
  - 'bridge'

{
  "name": "@odontox/bridge",
  "version": "1.0.0",
  "description": "OdontoX Bridge — operatory X-ray uploader",
  "main": "dist/main/index.js",
  "scripts": {
    "dev": "tsc -p tsconfig.json --watch",
    "build": "tsc -p tsconfig.json",
    "start": "electron dist/main/index.js",
    "pack": "npm run build && electron-builder --dir",
    "dist:win": "npm run build && electron-builder --win",
    "dist:mac": "npm run build && electron-builder --mac"
  },
  "dependencies": {
    "axios": "^1.7.9",
    "better-sqlite3": "^9.6.0",
    "chokidar": "^4.0.3",
    "electron-store": "^10.0.0",
    "electron-updater": "^6.3.9"
  },
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.13",
    "@types/node": "^22.0.0",
    "electron": "^33.0.0",
    "electron-builder": "^25.1.8",
    "typescript": "^5.7.0"
  }
}

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "CommonJS",
    "moduleResolution": "node",
    "outDir": "dist",
    "rootDir": "src",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "sourceMap": true
  },
  "include": ["src/**/*"],
  "exclude": ["node_modules", "dist"]
}

module.exports = {
  appId: 'io.odontox.bridge',
  productName: 'OdontoX Bridge',
  directories: { buildResources: 'assets', output: 'release' },
  files: ['dist/**/*', 'assets/**/*', 'src/renderer/**/*'],
  win: {
    target: 'nsis',
    icon: 'assets/icon.png',
    requestedExecutionLevel: 'asInvoker',
  },
  mac: {
    target: 'dmg',
    icon: 'assets/icon.png',
    category: 'public.app-category.medical',
  },
  nsis: {
    oneClick: true,
    runAfterFinish: true,
    createDesktopShortcut: false,
  },
  publish: [{ provider: 'generic', url: 'https://updates.odontox.io/bridge' }],
};

cd bridge && pnpm install

mkdir -p bridge/assets bridge/src/main bridge/src/renderer/patient-selector
# Create 1x1 px placeholder PNGs — replace with real icons before distribution
node -e "
const { createCanvas } = require('canvas');
// If canvas not available, just touch the files
" 2>/dev/null || touch bridge/assets/tray-green.png bridge/assets/tray-yellow.png bridge/assets/tray-red.png bridge/assets/icon.png

git add bridge/ pnpm-workspace.yaml
git commit -m "feat(bridge): scaffold Electron bridge app project"

// bridge/src/main/store.ts
import Store from 'electron-store';

export interface BridgeConfig {
  apiKey: string;
  serverUrl: string;
  watchFolder: string;
  roomId: string;
  selectedPatientId: string | null;
  selectedPatientName: string | null;
  selectedPatientAt: number | null; // unix ms — auto-clear after 4h
  autoStart: boolean;
  patientTimeoutMs: number; // default 4 * 60 * 60 * 1000
}

const defaults: BridgeConfig = {
  apiKey: '',
  serverUrl: 'https://api.odontox.io',
  watchFolder: '',
  roomId: '',
  selectedPatientId: null,
  selectedPatientName: null,
  selectedPatientAt: null,
  autoStart: true,
  patientTimeoutMs: 4 * 60 * 60 * 1000,
};

export const store = new Store<BridgeConfig>({ defaults });

export function getConfig(): BridgeConfig {
  return store.store;
}

export function setConfig<K extends keyof BridgeConfig>(key: K, value: BridgeConfig[K]) {
  store.set(key, value);
}

export function selectPatient(id: string, name: string) {
  store.set('selectedPatientId', id);
  store.set('selectedPatientName', name);
  store.set('selectedPatientAt', Date.now());
}

export function clearPatient() {
  store.set('selectedPatientId', null);
  store.set('selectedPatientName', null);
  store.set('selectedPatientAt', null);
}

export function isPatientExpired(): boolean {
  const { selectedPatientAt, patientTimeoutMs } = store.store;
  if (!selectedPatientAt) return true;
  return Date.now() - selectedPatientAt > patientTimeoutMs;
}

git add bridge/src/main/store.ts
git commit -m "feat(bridge): electron-store config module"

// bridge/src/main/queue.ts
import Database from 'better-sqlite3';
import path from 'path';
import { app } from 'electron';

export type QueueStatus = 'pending' | 'done' | 'failed';

export interface QueueItem {
  id: number;
  filePath: string;
  fileHash: string;
  patientId: string;
  patientName: string;
  roomId: string | null;
  status: QueueStatus;
  attempts: number;
  lastError: string | null;
  createdAt: number;
}

let db: Database.Database;

export function initQueue() {
  const dbPath = path.join(app.getPath('userData'), 'queue.sqlite');
  db = new Database(dbPath);
  db.exec(`
    CREATE TABLE IF NOT EXISTS queue (
      id          INTEGER PRIMARY KEY AUTOINCREMENT,
      filePath    TEXT    NOT NULL,
      fileHash    TEXT    NOT NULL,
      patientId   TEXT    NOT NULL,
      patientName TEXT    NOT NULL DEFAULT '',
      roomId      TEXT,
      status      TEXT    NOT NULL DEFAULT 'pending',
      attempts    INTEGER NOT NULL DEFAULT 0,
      lastError   TEXT,
      createdAt   INTEGER NOT NULL DEFAULT (unixepoch())
    );
    CREATE UNIQUE INDEX IF NOT EXISTS queue_hash_patient
      ON queue (fileHash, patientId)
      WHERE status != 'done';
  `);
}

export function enqueue(filePath: string, fileHash: string, patientId: string, patientName: string, roomId: string | null) {
  // Ignore if already queued/done for this hash+patient combo
  const existing = db.prepare(
    `SELECT id FROM queue WHERE fileHash = ? AND patientId = ? AND status != 'done'`
  ).get(fileHash, patientId);
  if (existing) return;

  db.prepare(`
    INSERT INTO queue (filePath, fileHash, patientId, patientName, roomId)
    VALUES (?, ?, ?, ?, ?)
  `).run(filePath, fileHash, patientId, patientName, roomId ?? null);
}

export function getPending(limit = 10): QueueItem[] {
  return db.prepare(
    `SELECT * FROM queue WHERE status = 'pending' AND attempts < 5 ORDER BY id LIMIT ?`
  ).all(limit) as QueueItem[];
}

export function markDone(id: number) {
  db.prepare(`UPDATE queue SET status = 'done' WHERE id = ?`).run(id);
}

export function markFailed(id: number, error: string) {
  db.prepare(`
    UPDATE queue SET attempts = attempts + 1, lastError = ? WHERE id = ?
  `).run(error, id);
  // After 5 attempts → terminal failed
  db.prepare(`
    UPDATE queue SET status = 'failed' WHERE id = ? AND attempts >= 5
  `).run(id);
}

export function getFailedCount(): number {
  return (db.prepare(`SELECT COUNT(*) as n FROM queue WHERE status = 'failed'`).get() as { n: number }).n;
}

export function getPendingCount(): number {
  return (db.prepare(`SELECT COUNT(*) as n FROM queue WHERE status = 'pending'`).get() as { n: number }).n;
}

export function retryFailed() {
  db.prepare(`UPDATE queue SET status = 'pending', attempts = 0, lastError = NULL WHERE status = 'failed'`).run();
}

export function getRecentUploads(limit = 20): QueueItem[] {
  return db.prepare(
    `SELECT * FROM queue ORDER BY id DESC LIMIT ?`
  ).all(limit) as QueueItem[];
}

git add bridge/src/main/queue.ts
git commit -m "feat(bridge): SQLite queue with pending/done/failed states and hash dedup"

// bridge/src/main/watcher.ts
import chokidar, { FSWatcher } from 'chokidar';
import path from 'path';
import fs from 'fs';
import crypto from 'crypto';
import { enqueue } from './queue';
import { getConfig, isPatientExpired } from './store';

const ALLOWED_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.bmp', '.tiff', '.tif']);
const MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024; // 50MB guard

let watcher: FSWatcher | null = null;
let onNewFile: (() => void) | null = null;
let onNoPatient: (() => void) | null = null;

function sha256(filePath: string): string {
  const buf = fs.readFileSync(filePath);
  return crypto.createHash('sha256').update(buf).digest('hex');
}

export function startWatcher(callbacks: {
  onNewFile: () => void;
  onNoPatient: () => void;
}) {
  onNewFile = callbacks.onNewFile;
  onNoPatient = callbacks.onNoPatient;

  const { watchFolder } = getConfig();
  if (!watchFolder) return;

  watcher = chokidar.watch(watchFolder, {
    awaitWriteFinish: { stabilityThreshold: 800, pollInterval: 100 },
    ignored: /(^|[/\\])\../,
    persistent: true,
    ignoreInitial: true,
  });

  watcher.on('add', (filePath: string) => {
    const ext = path.extname(filePath).toLowerCase();
    if (!ALLOWED_EXTENSIONS.has(ext)) return;

    const stat = fs.statSync(filePath);
    if (stat.size > MAX_FILE_SIZE_BYTES) return;

    const config = getConfig();

    if (!config.selectedPatientId || isPatientExpired()) {
      onNoPatient?.();
      return;
    }

    const hash = sha256(filePath);
    enqueue(filePath, hash, config.selectedPatientId, config.selectedPatientName || '', config.roomId || null);
    onNewFile?.();
  });
}

export function stopWatcher() {
  watcher?.close();
  watcher = null;
}

export function restartWatcher(callbacks: { onNewFile: () => void; onNoPatient: () => void }) {
  stopWatcher();
  startWatcher(callbacks);
}

git add bridge/src/main/watcher.ts
git commit -m "feat(bridge): chokidar file watcher with size guard and hash dedup"

// bridge/src/main/uploader.ts
import axios from 'axios';
import fs from 'fs';
import FormData from 'form-data';
import { getPending, markDone, markFailed, getPendingCount, getFailedCount } from './queue';
import { getConfig } from './store';

export type TrayState = 'green' | 'yellow' | 'red';
let onTrayUpdate: ((state: TrayState, tooltip: string) => void) | null = null;
let flushing = false;

export function setTrayCallback(cb: (state: TrayState, tooltip: string) => void) {
  onTrayUpdate = cb;
}

export function updateTray() {
  const pending = getPendingCount();
  const failed = getFailedCount();
  const { apiKey, watchFolder } = getConfig();

  if (!apiKey || !watchFolder) {
    onTrayUpdate?.('red', 'OdontoX Bridge — not configured');
    return;
  }
  if (failed > 0) {
    onTrayUpdate?.('red', `OdontoX Bridge — ${failed} upload(s) failed`);
  } else if (pending > 0) {
    onTrayUpdate?.('yellow', `OdontoX Bridge — ${pending} queued`);
  } else {
    onTrayUpdate?.('green', 'OdontoX Bridge — connected');
  }
}

export async function flushQueue() {
  if (flushing) return;
  flushing = true;

  try {
    const items = getPending(10);

    for (const item of items) {
      try {
        if (!fs.existsSync(item.filePath)) {
          markFailed(item.id, 'File no longer exists');
          continue;
        }

        const { apiKey, serverUrl, roomId } = getConfig();
        const form = new FormData();
        form.append('file', fs.createReadStream(item.filePath));
        form.append('patientId', item.patientId);
        form.append('fileType', 'x-ray');
        form.append('category', 'operatory_capture');
        form.append('source', 'bridge_capture');
        if (item.roomId) form.append('operatoryRoom', item.roomId);

        await axios.post(`${serverUrl}/api/v1/protected/files/upload`, form, {
          headers: {
            Authorization: `Bearer ${apiKey}`,
            ...form.getHeaders(),
          },
          timeout: 60_000,
        });

        markDone(item.id);
      } catch (err: any) {
        const msg = err?.response?.data?.error || err?.message || 'Unknown error';
        markFailed(item.id, msg);
      }
    }
  } finally {
    flushing = false;
    updateTray();
  }
}

// Retry every 30 seconds
export function startFlushInterval() {
  flushQueue();
  setInterval(flushQueue, 30_000);
}

export async function searchPatients(query: string): Promise<Array<{ id: string; firstName: string; lastName: string; patientNumber: string; lastVisit?: string }>> {
  const { apiKey, serverUrl } = getConfig();
  if (!apiKey) return [];
  try {
    const res = await axios.get(`${serverUrl}/api/v1/protected/patients`, {
      params: { search: query, limit: 10 },
      headers: { Authorization: `Bearer ${apiKey}` },
      timeout: 10_000,
    });
    return res.data?.patients || res.data || [];
  } catch {
    return [];
  }
}

git add bridge/src/main/uploader.ts
git commit -m "feat(bridge): upload flush with retry, tray state callback, patient search"

// bridge/src/main/tray.ts
import { Tray, Menu, nativeImage, BrowserWindow, shell, app, Notification } from 'electron';
import path from 'path';
import { getConfig, selectPatient, clearPatient } from './store';
import { flushQueue, updateTray } from './uploader';
import { getRecentUploads, retryFailed } from './queue';

let tray: Tray | null = null;
let patientWindow: BrowserWindow | null = null;

function icon(name: string) {
  return nativeImage.createFromPath(path.join(__dirname, '../../assets', name));
}

export function createTray() {
  tray = new Tray(icon('tray-green.png'));
  tray.setToolTip('OdontoX Bridge');
  rebuildMenu();
  return tray;
}

export function setTrayState(state: 'green' | 'yellow' | 'red', tooltip: string) {
  if (!tray) return;
  const iconName = `tray-${state}.png`;
  tray.setImage(icon(iconName));
  tray.setToolTip(tooltip);
  rebuildMenu();
}

export function rebuildMenu() {
  if (!tray) return;
  const cfg = getConfig();
  const patientLabel = cfg.selectedPatientId
    ? `Patient: ${cfg.selectedPatientName} ✓`
    : 'Select Patient…';

  const menu = Menu.buildFromTemplate([
    {
      label: patientLabel,
      click: () => openPatientSelector(),
    },
    { label: 'Clear Patient', click: () => { clearPatient(); rebuildMenu(); }, enabled: !!cfg.selectedPatientId },
    { type: 'separator' },
    { label: 'Retry Failed Uploads', click: () => { retryFailed(); flushQueue(); } },
    {
      label: 'View Upload Log',
      click: () => {
        const items = getRecentUploads(20);
        const lines = items.map(i => `[${i.status}] ${path.basename(i.filePath)} — ${i.patientName}`).join('\n');
        new Notification({ title: 'Recent Uploads', body: lines.slice(0, 200) || 'No uploads yet' }).show();
      },
    },
    { type: 'separator' },
    { label: 'Open OdontoX', click: () => shell.openExternal(cfg.serverUrl.replace('api.', 'portal.')) },
    { type: 'separator' },
    { label: 'Quit', click: () => app.quit() },
  ]);

  tray.setContextMenu(menu);
}

export function openPatientSelector() {
  if (patientWindow && !patientWindow.isDestroyed()) {
    patientWindow.focus();
    return;
  }

  patientWindow = new BrowserWindow({
    width: 420,
    height: 340,
    resizable: false,
    alwaysOnTop: true,
    title: 'Select Patient',
    webPreferences: {
      nodeIntegration: false,
      contextIsolation: true,
      preload: path.join(__dirname, 'preload.js'),
    },
  });

  patientWindow.loadFile(path.join(__dirname, '../../src/renderer/patient-selector/index.html'));
  patientWindow.on('closed', () => { patientWindow = null; });
}

export function showNoPatientNotification() {
  new Notification({
    title: 'OdontoX Bridge',
    body: 'No patient selected — image was not queued. Select a patient first.',
  }).show();
}

// bridge/src/main/index.ts
import { app, ipcMain } from 'electron';
import { createTray, setTrayState, rebuildMenu, showNoPatientNotification } from './tray';
import { initQueue } from './queue';
import { startWatcher } from './watcher';
import { startFlushInterval, setTrayCallback, flushQueue } from './uploader';
import { selectPatient, isPatientExpired, getConfig } from './store';
import { searchPatients } from './uploader';
import { autoUpdater } from 'electron-updater';

app.setName('OdontoX Bridge');

// Hide from macOS Dock — tray-only app
if (process.platform === 'darwin') app.dock?.hide();

app.whenReady().then(() => {
  initQueue();

  const tray = createTray();

  setTrayCallback((state, tooltip) => {
    setTrayState(state, tooltip);
  });

  startWatcher({
    onNewFile: () => flushQueue(),
    onNoPatient: () => showNoPatientNotification(),
  });

  startFlushInterval();

  // Auto-clear patient after configured timeout
  setInterval(() => {
    if (isPatientExpired()) {
      const { selectedPatientId } = getConfig();
      if (selectedPatientId) {
        const { clearPatient } = require('./store');
        clearPatient();
        rebuildMenu();
      }
    }
  }, 60_000);

  // Auto-updater
  autoUpdater.checkForUpdatesAndNotify().catch(() => {});
});

app.on('window-all-closed', (e: Event) => {
  e.preventDefault(); // Keep tray alive
});

// IPC: Patient selector renderer calls
ipcMain.handle('search-patients', async (_event, query: string) => {
  return searchPatients(query);
});

ipcMain.handle('select-patient', (_event, id: string, name: string) => {
  selectPatient(id, name);
  rebuildMenu();
  return true;
});

ipcMain.handle('get-selected-patient', () => {
  const cfg = getConfig();
  return { id: cfg.selectedPatientId, name: cfg.selectedPatientName };
});

// bridge/src/main/preload.ts
import { contextBridge, ipcRenderer } from 'electron';

contextBridge.exposeInMainWorld('bridge', {
  searchPatients: (q: string) => ipcRenderer.invoke('search-patients', q),
  selectPatient: (id: string, name: string) => ipcRenderer.invoke('select-patient', id, name),
  getSelectedPatient: () => ipcRenderer.invoke('get-selected-patient'),
});

git add bridge/src/main/tray.ts bridge/src/main/index.ts bridge/src/main/preload.ts
git commit -m "feat(bridge): tray icon, IPC preload, and main process entry"

<!-- bridge/src/renderer/patient-selector/index.html -->
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'unsafe-inline'" />
  <title>Select Patient</title>
  <style>
    * { box-sizing: border-box; margin: 0; padding: 0; }
    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #fff; padding: 16px; }
    h2 { font-size: 14px; font-weight: 600; color: #1a1a2e; margin-bottom: 12px; }
    input {
      width: 100%; padding: 8px 12px; font-size: 14px; border: 1px solid #d1d5db;
      border-radius: 8px; outline: none;
    }
    input:focus { border-color: #3b82f6; box-shadow: 0 0 0 3px rgba(59,130,246,.15); }
    #results { margin-top: 8px; max-height: 220px; overflow-y: auto; }
    .result {
      padding: 10px 12px; border-radius: 6px; cursor: pointer;
      display: flex; justify-content: space-between; align-items: center;
    }
    .result:hover { background: #f3f4f6; }
    .result .name { font-size: 13px; font-weight: 500; color: #111827; }
    .result .meta { font-size: 11px; color: #6b7280; }
    .empty { padding: 16px; text-align: center; color: #9ca3af; font-size: 13px; }
    .selected { background: #eff6ff; border: 1px solid #bfdbfe; padding: 8px 12px;
      border-radius: 8px; margin-top: 8px; font-size: 12px; color: #1d4ed8; }
  </style>
</head>
<body>
  <h2>Select Patient</h2>
  <input id="search" type="text" placeholder="Search by name or patient number…" autofocus />
  <div id="results"></div>
  <div id="selected-info"></div>

  <script>
    const bridge = window.bridge;
    const searchEl = document.getElementById('search');
    const resultsEl = document.getElementById('results');
    const selectedInfoEl = document.getElementById('selected-info');
    let debounce = null;

    bridge.getSelectedPatient().then(p => {
      if (p?.name) {
        selectedInfoEl.innerHTML = `<div class="selected">Currently selected: <strong>${p.name}</strong></div>`;
      }
    });

    searchEl.addEventListener('input', () => {
      clearTimeout(debounce);
      const q = searchEl.value.trim();
      if (q.length < 2) { resultsEl.innerHTML = ''; return; }
      debounce = setTimeout(async () => {
        const patients = await bridge.searchPatients(q);
        if (!patients.length) {
          resultsEl.innerHTML = '<div class="empty">No patients found</div>';
          return;
        }
        resultsEl.innerHTML = patients.map(p => `
          <div class="result" data-id="${p.id}" data-name="${p.firstName} ${p.lastName}">
            <div>
              <div class="name">${p.firstName} ${p.lastName}</div>
              <div class="meta">${p.patientNumber || ''}${p.lastVisit ? ' · Last: ' + p.lastVisit : ''}</div>
            </div>
            <span style="font-size:18px">→</span>
          </div>
        `).join('');
      }, 300);
    });

    resultsEl.addEventListener('click', async (e) => {
      const row = e.target.closest('.result');
      if (!row) return;
      const { id, name } = row.dataset;
      await bridge.selectPatient(id, name);
      window.close();
    });
  </script>
</body>
</html>