import { Hono } from 'hono'
import type { AppEnv } from '../types'
import { authRoutes } from './auth'
import { adminAuthRoutes } from './admin/auth'
import { userRoutes } from './users'
import { customerRoutes } from './customers/router'
import { userPreferencesRoute } from './user-preferences'
import { settingsModulesRoutes } from './settings-modules'
import { adminModulesRoutes } from './admin-modules'
import { adminAiRoutes } from './admin/ai'
import { aiRoutes } from './ai'
import { webhookRoutes } from './webhooks'
import { pushRouter } from './push'
import { notificationsRouter } from './notifications'
import { preferencesRoute } from './preferences'
import { tenantSettingsRoute } from './tenant-settings'
import { settingsKbRoute } from './settings-kb'
import { kbSpacesSettingsRoute } from './kb-spaces-settings'
import { kbReviewRoute } from './kb-review'
// wave-14: israeli-tax-reports
import { taxSettingsRoute } from './settings-tax'
// wave-14: lead-lost-re-engagement
import { leadReengagementCronRoute } from './cron/lead-reengagement'
import { sessionExpiredSweepCron } from './cron/session-expired-sweep'
import { sessionIdleCleanupCron } from './cron/session-idle-cleanup'
import { leadScoreRefreshCron } from './cron/lead-score-refresh'
import { crmSettingsRoute } from './settings/crm'
// wave-15: bituach-leumi
import { niiAdvancesRoutes } from './nii-advances'
// wave-15: scheduled-reports
import { scheduledReportsRouter } from './scheduled-reports'
// wave-15: accountant-export
import { coaRoutes } from './coa'

// wave-3 route imports
import { adminRouter } from './admin/index'
import { aiAssistantRoutes } from './ai-assistant'
import { kbRouter } from './kb'
import { projectRoutes } from './projects'
import { auditLogRoutes } from './audit-log'
import { auditLogRetentionCronRoute } from './cron/audit-log-retention'
import { zyncSubscriptionRoute } from './zync-subscription'
import { onboardingRoute } from './onboarding'
import { adminSubscriptionRoute } from './admin-subscription'
import { subscriptionTrialCheckRoute } from './cron/subscription-trial-check'

// wave-4 route imports
import { searchCompletenessRoute } from './search-completeness'
import { expenseRoutes } from './expenses/index'
import { filesRoutes } from './files/index'
import { expenseSettingsRoute } from './expenses/settings'
import { expenseReportsRoute } from './expenses/reports'
import { publicStatusRoutes } from './public/status'
import { realtimeRoutes } from './realtime'

// wave-5 route imports
import { taskTemplatesRoute } from './task-templates'
import { timeRoutes } from './time'
import { timeCleanupCronRoute } from './cron/time-cleanup'
import { timeTrackingSettingsRoute } from './settings/time-tracking'

// wave-6 route imports
import { supportRoutes } from './support/router'
import { ticketCloseStaleCronRoute } from './cron/ticket-close-stale'
import { invoiceRoutes } from './invoices/index'
import { projectTemplatesRoute } from './project-templates/index'
import { burndownRoute } from './burndown'
import { timeReportsRoutes } from './reports/time-reports'

// wave-8 route imports
import { billingRoutes } from './billing/index'
import { reportsRouter } from './reports/index'
import { analyticsDashboardRoutes } from './reports/dashboards'
import { analyticsRouter } from './analytics/index'
import { contractsRoute } from './contracts/index'
import { timeLockingRoutes } from './time/locking'
import { timeTeamRoutes } from './time/team'

// wave-7 route imports
import { invoiceApprovalRoutes } from './invoices/approvals'
import { invoiceDraftRoutes } from './invoices/drafts'
import { recurringInvoiceRoutes } from './invoices/recurring'
import { invoiceGenerateRoutes } from './invoices/generate'
import { timeInvoiceRoutes } from './time/invoice'
import { expenseInvoiceRoutes } from './expenses/invoice'
import { contractorRoutes } from './contractors/router'
import { contractorPortalRoutes } from './contractor-portal-api'
import { payoutRoutes } from './contractors/payouts'
import { withholdingCronRoute } from './contractors/withholding'
import { marketingRouter } from './marketing/router'
import { sequencesRoute } from './marketing/sequences'
import { authMiddleware } from '../middleware/auth'
import { slaPolicyRoutes } from './support/sla'
import { settingsProjectsRoute } from './settings/projects'
import { importRouter } from './imports/router'
import { invoiceAdapterRouter } from './invoice-adapters/router'
import { invoiceAdapterCron } from './invoice-adapters/cron'
import { dashboardRoutes } from './dashboard'
import { productsRoute } from './products'
import { inventoryRoute } from './inventory'
import { ticketSlaCheckCron } from './cron/ticket-sla-check'
import { recurringInvoiceGeneratorCron } from './cron/recurring-invoice-generator'
import { bulkRoutes } from './bulk/index'
import { savedFiltersRoutes } from './saved-filters'
import { telegramRoutes } from './telegram/index'

// wave-9 route imports
import { notificationPreferencesRoute } from './settings/notification-preferences'
import { accountSettingsRoute } from './settings/account'
import { profileRoute } from './profile'
import { portalRouter } from './portal/index'

// wave-10 route imports
import { currencyRoutes } from './currencies/index'
import { smtpSettingsRoute } from './settings/smtp'
import { calendarSettingsRoute } from './settings/calendar'
import { invoiceSettingsRoute } from './settings/invoices'
import { invoicingSettingsRoute } from './settings/invoicing'
import { dataExportRoutes, anonymizeRoutes } from './data/export'
import { recurringExpensesRoute } from './expenses/recurring'
import { mileageRoute } from './expenses/mileage'
import { timeApprovalRoutes } from './time/approvals'
import { sendSequenceEmailsCron } from './cron/send-sequence-emails'

// wave-10 leaf 5: ita-einvoice + payment-gateway-adapters
import { einvoiceSettingsRoute } from './settings/einvoice'
import { paymentGatewaySettingsRoute } from './settings/payment-gateway'
import { einvoiceInvoiceRoutes } from './invoices/einvoice'
import { paymentLinkInvoiceRoutes } from './invoices/payment-link'

// wave-11 route imports
import { proposalEditorRoute } from './proposals-editor'
import { proposalTemplatesRoute } from './proposal-templates'
import { portalFilesRoute } from './portal-files'
import { unifiedAttachmentsRouter } from './unified-attachments'
import { portalSettingsRoute } from './settings/portal'
import { customerSettingsRoute } from './settings/customers'
import { whiteLabelSettingsRoute } from './settings/white-label'
import { rolesRoute } from './roles'
import { invoicePaymentsRoutes } from './invoices/payments'
import { invoiceDunningRoutes } from './invoices/dunning'
import { dunningSettingsRoute } from './settings/dunning'
import { pdfTemplateSettingsRoute } from './settings/pdf-template'
import { proposalRoutes } from './proposals'
import { integrationsHubRoute } from './settings/integrations'
import { invoiceIntegrationsSettingsRoute } from './settings/integrations-invoicing'
import { webhookEndpointRoutes } from './webhooks/endpoints'
import { apiKeysRoutes } from './api-keys'
import { auditRoutes } from './audit'
import { webhookLogRetentionCron } from './cron/webhook-log-retention'
import { dataRetentionPurgeCron } from './cron/data-retention-purge'
import { auditPartitionCreateCron } from './cron/audit-partition-create'

// wave-11 leaf-E route imports
import { contractorSettingsRoute } from './settings/contractors'
import { emailTemplateRoutes } from './email-templates'
import { fieldPermissionsSettingsRoute } from './field-permissions/settings'
import { fieldPermissionsEffectiveRoute } from './field-permissions/effective'
import { expenseApprovalRoutes } from './expenses/approvals'
import { vendorRoutes } from './vendors'
import { settingsLocaleRoute } from './settings/locale'
// wave-12: proposal-expiry-deadline
import { proposalSettingsRoute } from './settings/proposals'
import { proposalExpiryCron } from './cron/proposal-expiry'
import { proposalExpiryReminderCron } from './cron/proposal-expiry-reminder'
// wave-12: contract-renewal-amendment cron
import { contractExpiryReminderRoute } from './cron/contract-expiry-reminder'
// wave-12: activity-timeline
import { invoiceActivityRoutes } from './invoices/activity'
import { projectActivityRoutes } from './projects/activity'
import { customerActivityRoutes } from './customers/activity'
import { vendorActivityRoutes } from './vendor-activity'
// wave-12: admin-impersonation
import { impersonateRoute } from './impersonate'
import { impersonationEndRoute } from './impersonation-end'
// wave-12: bad-debt-writeoff
import { invoiceWriteOffRoute } from './invoices/write-off'
import { invoiceRecordRecoveryRoute } from './invoices/record-recovery'
import { badDebtReclaimsRoute } from './bad-debt-reclaims'
import { badDebtSettingsRoute } from './settings/bad-debt'
// wave-12: payment-reconciliation
import { outstandingInvoicesRoute, reconcileRoute } from './reconcile'
// wave-12: invoice-receipt-document
import { receiptRoutes } from './receipts/index'
import { invoiceReceiptIssueRoutes } from './invoices/receipt-issue'
// wave-12: api-usage-quota-ui
import { apiKeysUsageRoutes } from './api-keys-usage'
import { entityHistoryRoutes } from './entity-history'
// wave-12: oauth-authorization-code
import { oauthConnectionsRouter, oauthAdminRouter } from './oauth'
// wave-13: settings-contracts
import { contractSettingsRoute } from './settings/contracts'
// wave-13: session-security
import { sessionsRoute } from './sessions'
import { adminSessionsRoute } from './admin-sessions'
import { securitySettingsRoute } from './security-settings'
import { reauthRoute } from './reauth'
// wave-13: invoice-payment-reminders
import { invoiceRemindersRoutes } from './invoices/reminders'
import { invoicingRemindersSettingsRoute } from './settings/invoicing-reminders'
import { invoiceRemindersCronRoute } from './cron/invoice-reminders'
// dispatch-group: external cron services trigger named groups via HTTP
import { dispatchGroupRoute } from './cron/dispatch-group'
// wave-15: inventory settings
import { inventorySettingsRoute } from './settings/inventory'
import { shellLayoutRoute } from './shell-layout'
import { e2eRoleFixturesRoute } from './e2e-role-fixtures'

const routes = new Hono<AppEnv>()
const sequencesApiRoute = new Hono<AppEnv>()

sequencesApiRoute.use('*', authMiddleware)
sequencesApiRoute.route('/', sequencesRoute)

routes.get('/health', (c) => {
  return c.json({ status: 'ok', timestamp: Date.now() })
})

routes.route('/e2e/role-fixtures', e2eRoleFixturesRoute)

// foundation-auth-rbac
routes.route('/auth', authRoutes)
routes.route('/admin/auth', adminAuthRoutes)
routes.route('/users', userRoutes)

// customers-module
routes.route('/customers', customerRoutes)
routes.route('/products', productsRoute)
routes.route('/inventory', inventoryRoute)

// dark-light-theme: user preferences
routes.route('/user', userPreferencesRoute)

// module-management
routes.route('/settings/modules', settingsModulesRoutes)

// system-ai: specific /admin/ai BEFORE broad /admin
routes.route('/admin/ai', adminAiRoutes)
routes.route('/ai', aiRoutes)

// ai-assistant: second /ai mount (chat/rag routes; no conflict with aiRoutes which owns /settings /quota /usage /credits)
routes.route('/ai', aiAssistantRoutes)

// admin-dashboard: specific /admin/* routes BEFORE broad /admin
routes.route('/admin', adminRouter)

// admin-subscription: /admin/tenants routes BEFORE broad /admin
routes.route('/admin/tenants', adminSubscriptionRoute)

// module-management: admin module overrides (broad /admin — after /admin/ai and /admin/auth)
routes.route('/admin', adminModulesRoutes)

// system-communications-notifications
routes.route('/push', pushRouter)
routes.route('/notifications', notificationsRouter)
routes.route('/webhooks', webhookRoutes)

// system-i18n
routes.route('/preferences', preferencesRoute)
routes.route('/tenant/settings', tenantSettingsRoute)
routes.route('/shell/layout', shellLayoutRoute)

// search-completeness: replaces old wave-3 search route
routes.route('/search', searchCompletenessRoute)

// kb-module
routes.route('/kb', kbRouter)

// projects-module
routes.route('/projects', projectRoutes)

// tenant-audit-log
routes.route('/audit-log', auditLogRoutes)
routes.route('/cron/audit-log-retention', auditLogRetentionCronRoute)

// zync-subscription
routes.route('/zync-subscription', zyncSubscriptionRoute)
routes.route('/onboarding', onboardingRoute)
routes.route('/cron/subscription-trial-check', subscriptionTrialCheckRoute)

// expenses-module
routes.route('/expenses', expenseInvoiceRoutes)
routes.route('/expenses', expenseRoutes)
routes.route('/settings/expenses', expenseSettingsRoute)
routes.route('/expenses/reports', expenseReportsRoute)
routes.route('/files', filesRoutes)

// real-time-infrastructure: WebSocket connect (same-origin cookie auth → DO)
routes.route('/realtime', realtimeRoutes)

// system-status-page: public status API
routes.route('/status', publicStatusRoutes)

// wave-5: recurring-tasks-templates
routes.route('/task-templates', taskTemplatesRoute)

// wave-5: time-management
routes.route('/time', timeRoutes)
routes.route('/cron/time-cleanup', timeCleanupCronRoute)
routes.route('/settings/time-tracking', timeTrackingSettingsRoute)

// wave-6: crm-support-center
routes.route('/tickets', supportRoutes)
routes.route('/cron/ticket-close-stale', ticketCloseStaleCronRoute)

// wave-6: project-template-gallery
routes.route('/project-templates', projectTemplatesRoute)

// wave-6: task-estimates-burndown (mounts at /projects resolving to /projects/:id/burndown)
routes.route('/projects', burndownRoute)

// wave-6: time-reports (after /time to avoid /time catching /time/reports as id="reports")
routes.route('/time/reports', timeReportsRoutes)

// ── wave-7 routes ─────────────────────────────────────────────────────────────


// leaf1: invoice approval workflow + draft library
routes.route('/invoices/approvals', invoiceApprovalRoutes)
routes.route('/invoices/drafts', invoiceDraftRoutes)

// leaf2: recurring invoices + bulk generate + generator cron
routes.route('/recurring-invoices', recurringInvoiceRoutes)
routes.route('/invoices/bulk-generate', invoiceGenerateRoutes)
routes.route('/cron/recurring-invoice-generator', recurringInvoiceGeneratorCron)

// leaf3: time-to-invoice + expense-to-invoice bridges
routes.route('/time/unbilled', timeInvoiceRoutes)

// leaf5: contractors + payouts + withholding cron
routes.route('/contractors', contractorRoutes)

// contractor-portal (wave 8): redeem + contractor-scoped API (also mounted at /contractor-portal in index.ts)
routes.route('/contractor-portal', contractorPortalRoutes)
routes.route('/payouts', payoutRoutes)
routes.route('/cron/withholding-expiry-check', withholdingCronRoute)

// leaf6: marketing leads pipeline (authed)
routes.route('/marketing', marketingRouter)
routes.route('/sequences', sequencesApiRoute)

// leaf7: SLA policies + cron + project settings
routes.route('/settings/sla', slaPolicyRoutes)
routes.route('/support/sla-policies', slaPolicyRoutes)
routes.route('/settings/projects', settingsProjectsRoute)
routes.route('/cron/ticket-sla-check', ticketSlaCheckCron)

// leaf8: data import
routes.route('/imports', importRouter)

// leaf9: customer dedup + invoice adapters + cron + dashboard
routes.route('/invoice-adapters', invoiceAdapterRouter)
routes.route('/cron/invoice-adapter-reconcile', invoiceAdapterCron)
routes.route('/cron/invoice-reconcile', invoiceAdapterCron)
routes.route('/dashboard', dashboardRoutes)

// ── wave-8 routes ─────────────────────────────────────────────────────────────

// leaf1: billing module (tenant self-service billing)
routes.route('/billing', billingRoutes)

// leaf2: bulk operations across invoices, customers, expenses, projects
routes.route('/bulk', bulkRoutes)

// leaf7: profitability reports + revenue forecasting
routes.route('/reports', reportsRouter)

// wave C: reports-analytics custom dashboards + widget query
routes.route('/dashboards', analyticsDashboardRoutes)
routes.route('/analytics', analyticsRouter)

// leaf9: saved-list-filters + telegram-bot
routes.route('/saved-filters', savedFiltersRoutes)
routes.route('/telegram', telegramRoutes)

// leaf4: contracts-esignature
routes.route('/contracts', contractsRoute)

// leaf8: time-entry-locking + team-time-overview
// /time/team BEFORE /time to avoid /:id capture
routes.route('/time/team', timeTeamRoutes)
routes.route('/time-entries', timeLockingRoutes)

// ── wave-9 routes ─────────────────────────────────────────────────────────────

// leaf4: notification-preferences + settings-module
routes.route('/notifications', notificationPreferencesRoute)
routes.route('/settings/account', accountSettingsRoute)
routes.route('/profile', profileRoute)

// leaf5: tenant-portals — customer self-service (no staff auth, portal JWT)
routes.route('/portal', portalRouter)

// ── wave-10 routes ─────────────────────────────────────────────────────────────

// leaf4: multi-currency — exchange rates + conversion
routes.route('/currencies', currencyRoutes)

// leaf2: custom-smtp-email-whitelabel + team-users-settings
routes.route('/settings/smtp', smtpSettingsRoute)
routes.route('/settings/email', smtpSettingsRoute)

// leaf1: calendar-integration-settings-ui + invoice-settings-page
routes.route('/settings/calendar', calendarSettingsRoute)
routes.route('/settings/invoices', invoiceSettingsRoute)
routes.route('/settings/invoicing', invoicingSettingsRoute)

// leaf8: data-export-gdpr
routes.route('/data', dataExportRoutes)
routes.route('/customers', anonymizeRoutes)

// leaf3: finance — recurring expenses + mileage logbook
// /expenses/recurring BEFORE /expenses to avoid /:id capture
routes.route('/expenses/recurring', recurringExpensesRoute)
routes.route('/mileage', mileageRoute)

// leaf10: time-approval-workflow
// /time approval routes BEFORE /time CRUD routes to avoid /:id capture
routes.route('/time', timeApprovalRoutes)

// leaf6: marketing-flows — email sequences cron
routes.route('/cron/send-sequence-emails', sendSequenceEmailsCron)

// leaf5: ita-einvoice + payment-gateway-adapters
routes.route('/settings/einvoice', einvoiceSettingsRoute)
routes.route('/settings/payment-gateway', paymentGatewaySettingsRoute)
// Invoice sub-routes — BEFORE broad /invoices/:id to ensure POST /:id/... resolves
routes.route('/invoices', einvoiceInvoiceRoutes)
routes.route('/invoices', paymentLinkInvoiceRoutes)

// ── wave-11 routes ─────────────────────────────────────────────────────────────

// customer-portal-settings-ui (spec 136)
// /settings/portal/preview-token and /settings/portal/users BEFORE broad /settings/portal to avoid /:id capture
routes.route('/settings/portal', portalSettingsRoute)

// settings-customers (spec, wave 11)
routes.route('/settings/customers', customerSettingsRoute)

// custom-domain-settings-ui (spec 137)
routes.route('/settings/white-label', whiteLabelSettingsRoute)
routes.route('/settings/domains', whiteLabelSettingsRoute)

// settings-roles (wave 11)
routes.route('/roles', rolesRoute)

// partial-payment-recording (wave-11) — BEFORE broad /invoices/:id
routes.route('/invoices', invoicePaymentsRoutes)

// payment-retry-dunning (wave-11) — invoice dunning BEFORE broad /invoices/:id
routes.route('/invoices', invoiceDunningRoutes)
routes.route('/settings/dunning', dunningSettingsRoute)

// invoice-pdf-customization (wave-11)
// /preview BEFORE base path to avoid /:id capture
routes.route('/settings/invoicing/pdf-template', pdfTemplateSettingsRoute)

// proposal-editor CRUD (wave-11): /proposals/templates BEFORE /:id (Hono ordering)
// And proposalEditorRoute owns GET/POST / and GET/PATCH/DELETE/POST-send /:id
routes.route('/proposals', proposalEditorRoute)
routes.route('/proposal-templates', proposalTemplatesRoute)

// proposal-to-invoice-direct (wave-11) — AFTER editor routes so /:id doesn't swallow /invoice sub-routes first
routes.route('/proposals', proposalRoutes)

// ALL cron routes MUST be registered before portalFilesRoute (which mounts at '' and
// has use('*', authMiddleware) — a catch-all that blocks any routes registered after it).
routes.route('/cron/webhook-log-retention', webhookLogRetentionCron)
routes.route('/cron/data-retention-purge', dataRetentionPurgeCron)
routes.route('/cron/audit-partition-create', auditPartitionCreateCron)
routes.route('/cron/proposal-expiry', proposalExpiryCron)
routes.route('/cron/proposal-expiry-reminder', proposalExpiryReminderCron)
routes.route('/cron/contract-expiry-reminder', contractExpiryReminderRoute)
routes.route('/cron/invoice-reminders', invoiceRemindersCronRoute)
routes.route('/cron/lead-reengagement', leadReengagementCronRoute)
routes.route('/cron/lead-score-refresh', leadScoreRefreshCron)
routes.route('/cron/session-expired-sweep', sessionExpiredSweepCron)
routes.route('/cron/session-idle-cleanup', sessionIdleCleanupCron)
// dispatch-group: external cron services (cron-job.org) trigger named groups via HTTP
routes.route('/cron/dispatch-group', dispatchGroupRoute)

// unified-attachments (spec 41)
routes.route('/attachments', unifiedAttachmentsRouter)
routes.route('/attachments/unified', unifiedAttachmentsRouter)

// portal-file-sharing (wave-11): staff-side file management
// Route handles /customers/:customerId/portal-files and /portal-files/* — mount at root
// WARNING: mounts at '' (all paths) with use('*', authMiddleware) — MUST be last catch-all
routes.route('', portalFilesRoute)

// wave-11 leaf-D: integration-hub
routes.route('/settings/integrations', integrationsHubRoute)
routes.route('/settings/integrations/invoicing', invoiceIntegrationsSettingsRoute)

// wave-11 leaf-D: webhook-endpoint-detail
// /webhooks/events BEFORE /webhooks/:id to avoid id capture
routes.route('/webhooks', webhookEndpointRoutes)
routes.route('/webhooks/endpoints', webhookEndpointRoutes)

// wave-11 leaf-D: audit-compliance
routes.route('/audit', auditRoutes)

// wave-11 leaf-E routes
// expense-approval-workflow: /expenses/approvals BEFORE /expenses to avoid /:id capture
routes.route('/expenses/approvals', expenseApprovalRoutes)

// contractor-settings
routes.route('/settings/contractors', contractorSettingsRoute)

// email-template-editor
routes.route('/email-templates', emailTemplateRoutes)

// field-level-permissions
routes.route('/settings/field-permissions', fieldPermissionsSettingsRoute)
routes.route('/field-permissions/effective', fieldPermissionsEffectiveRoute)

// vendors-suppliers
routes.route('/vendors', vendorRoutes)

// timezone-handling: locale settings (tenant operations timezone)
routes.route('/settings/locale', settingsLocaleRoute)

// wave-12: proposal-expiry-deadline settings
routes.route('/settings/proposals', proposalSettingsRoute)

// wave-12: bad-debt-writeoff settings
routes.route('/settings/bad-debt', badDebtSettingsRoute)

// wave-12: activity-timeline — /:id/activity sub-routes BEFORE broad /:id handlers
routes.route('/invoices', invoiceActivityRoutes)
routes.route('/projects', projectActivityRoutes)
routes.route('/customers', customerActivityRoutes)
routes.route('/vendors', vendorActivityRoutes)

// wave-12: bad-debt-writeoff — BEFORE broad /invoices/:id to ensure POST /:id/... resolves
routes.route('/invoices', invoiceWriteOffRoute)
routes.route('/invoices', invoiceRecordRecoveryRoute)
routes.route('/bad-debt-reclaims', badDebtReclaimsRoute)

// wave-12: admin-impersonation — unauthenticated token exchange + end session
routes.route('/impersonate', impersonateRoute)
routes.route('/admin/impersonation/end', impersonationEndRoute)

// wave-12: payment-reconciliation
// /invoices/outstanding BEFORE broad /invoices/:id to prevent id-capture
routes.route('/invoices', outstandingInvoicesRoute)
routes.route('/reconcile', reconcileRoute)

// wave-12: invoice-receipt-document
// /receipts standalone routes + /invoices/:id/receipts and /invoices/:id/invoice-receipt
routes.route('/receipts', receiptRoutes)
// invoice-scoped issue routes BEFORE broad /invoices/:id to prevent id-capture
routes.route('/invoices', invoiceReceiptIssueRoutes)

// wave-12: api-usage-quota-ui — /api-keys/:id/usage + /api-keys/:id/quota
// NOTE: sub-routes /:id/usage and /:id/quota BEFORE any broad /:id handler
routes.route('/api-keys', apiKeysUsageRoutes)
routes.route('/api-keys', apiKeysRoutes)

// wave-12: operational-audit-trail — entity change history
// /:entity/:id/history BEFORE broad entity routes to prevent id-capture
routes.route('/', entityHistoryRoutes)

// wave-12: oauth-authorization-code — user connections + admin client registration
routes.route('/oauth', oauthConnectionsRouter)
routes.route('/admin/oauth', oauthAdminRouter)

// wave-13: settings-contracts
routes.route('/settings/contracts', contractSettingsRoute)
routes.route('/settings/inventory', inventorySettingsRoute)

// wave-13: session-security
routes.route('/user/sessions', sessionsRoute)
routes.route('/admin/sessions', adminSessionsRoute)
routes.route('/settings/security', securitySettingsRoute)
routes.route('/reauth', reauthRoute)

// wave-13: invoice-payment-reminders
// /:id/reminders/* BEFORE broad /invoices/:id to prevent id-capture
routes.route('/invoices', invoiceRemindersRoutes)

// wave-6: invoices-core
// catch-all /:id MUST stay last among /invoices mounts, else it shadows static sub-paths (/invoices/approvals, /drafts, /outstanding)
routes.route('/invoices', invoiceRoutes)
routes.route('/settings/invoicing/reminders', invoicingRemindersSettingsRoute)

// wave-14: settings-kb
routes.route('/settings/kb', settingsKbRoute)
// /kb/spaces/:id/settings and /kb/spaces/:id/reorder BEFORE generic /kb router
routes.route('/kb/spaces', kbSpacesSettingsRoute)
// /kb/review + /kb/articles/:id/submit-review|approve|reject
routes.route('/kb', kbReviewRoute)

// wave-14: israeli-tax-reports — tax settings PATCH
routes.route('/settings/tax', taxSettingsRoute)

// wave-14: lead-lost-re-engagement
routes.route('/settings/crm', crmSettingsRoute)

// wave-15: bituach-leumi — NII advance payments CRUD
routes.route('/nii-advances', niiAdvancesRoutes)

// wave-15: scheduled-reports
routes.route('/report-schedules', scheduledReportsRouter)

// wave-15: accountant-export — chart of accounts management
routes.route('/coa', coaRoutes)

export { routes }