<?php
/**
 * Plugin Name: AdProtektor - Click Fraud Protection
 * Plugin URI: https://adprotektor.app/integrations/wordpress
 * Description: Protects your Google Ads and Meta campaigns from click fraud and, with the server-side conversions add-on, captures conversions from WooCommerce, WPForms, Gravity Forms, Contact Form 7 and Elementor Pro.
 * Version: 1.18.4
 * Author: AdProtektor
 * Author URI: https://adprotektor.app
 * License: GPL v2 or later
 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain: adprotektor
 * Requires at least: 5.7
 * Requires PHP: 7.4
 */

if (!defined('ABSPATH')) {
    exit;
}

define('ADPROTEKTOR_VERSION', '1.18.4');
define('ADPROTEKTOR_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('ADPROTEKTOR_API_BASE', 'https://api.adprotektor.app/v1');
// Cap for the rolling outbound-events debug log shown on the
// Activity admin page. Bumping this risks larger wp_options writes;
// 20 is plenty for diagnostic purposes.
define('ADPROTEKTOR_RECENT_EVENTS_CAP', 20);

class AdProtektor {

    private static $instance = null;

    /** Deliveries this request queued, sent once its response has gone out — see defer_delivery(). */
    private $deferred_deliveries = array();

    public static function get_instance() {
        if (null === self::$instance) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    private function __construct() {
        add_action('admin_menu', array($this, 'add_admin_menu'));
        add_action('admin_init', array($this, 'register_settings'));
        add_action('wp_footer', array($this, 'inject_tracking_script'));
        add_action('wp_footer', array($this, 'render_badge'), 99);
        add_filter('plugin_action_links_' . plugin_basename(__FILE__), array($this, 'add_settings_link'));
        add_action('admin_notices', array($this, 'setup_notice'));

        // First-party tracking proxy (adblock bypass). When enabled, it serves
        // track.js and relays /v1/tracking/* through this site's own origin under
        // the base path, so adblock domain-filter lists never match. It needs the
        // site key to forward the real visitor IP/JA4 (the backend ignores
        // forwarded signals from unauthenticated callers), and answers on init
        // priority 0. See adprotektor-firstparty.php.
        if (get_option('adprotektor_firstparty_enabled') && get_option('adprotektor_site_key', '') !== '') {
            require_once ADPROTEKTOR_PLUGIN_DIR . 'adprotektor-firstparty.php';
            AdProtektor_First_Party::from_settings()->register();
        }

        // ConversionOS — server-side conversion hooks. Each posts to
        // /v1/conversion-os/conversion with the site-key header. The
        // backend gates on subscription.conversion_os_enabled, so the
        // endpoint no-ops gracefully for non-add-on subscribers.
        //
        // Purchase fires from FOUR hooks sharing one per-order sentinel:
        //  - woocommerce_thankyou: shopper returned to order-received —
        //    fastest signal, but skipped while the order still needs
        //    payment (pending/failed) so an unpaid order never counts.
        //  - woocommerce_payment_complete: the gateway confirmed payment
        //    (IPN/webhook) — fires even when the shopper never returns
        //    from the gateway, so the sale isn't lost with the tab.
        //  - order_status_processing / _completed: manual gateways (COD,
        //    BACS) and admin-driven flows that never call
        //    payment_complete.
        // Whichever runs first sends; the rest no-op on the sentinel.
        add_action('woocommerce_thankyou', array($this, 'on_woo_thankyou'), 10, 1);
        add_action('woocommerce_payment_complete', array($this, 'on_woo_order_paid'), 10, 1);
        add_action('woocommerce_order_status_processing', array($this, 'on_woo_order_paid'), 10, 1);
        add_action('woocommerce_order_status_completed', array($this, 'on_woo_order_paid'), 10, 1);
        // Stash the shopper's visitor/session ids on the order at checkout,
        // while their cookies are still on the request — the paid-status
        // hooks above run in IPN/admin context where those cookies are the
        // gateway's (i.e. absent), and attribution would otherwise be lost.
        add_action('woocommerce_checkout_order_created', array($this, 'capture_order_visitor_context'), 10, 1);
        add_action('woocommerce_store_api_checkout_order_processed', array($this, 'capture_order_visitor_context'), 10, 1);
        add_action('adprotektor_deliver_event', array($this, 'deliver_pending_event'), 10, 1);
        add_action('woocommerce_order_status_cancelled', array($this, 'on_woo_order_cancelled'), 10, 1);
        add_action('woocommerce_order_status_refunded', array($this, 'on_woo_order_cancelled'), 10, 1);
        add_action('gform_after_submission', array($this, 'on_gform_submission'), 10, 2);
        add_action('wpcf7_mail_sent', array($this, 'on_cf7_submission'), 10, 1);
        add_action('wpforms_process_complete', array($this, 'on_wpforms_submission'), 10, 4);
        add_action('elementor_pro/forms/new_record', array($this, 'on_elementor_submission'), 10, 2);

        // WooCommerce funnel events (Meta Standard Events). Server-side
        // hooks are adblock-immune and run before the CDN browser detector
        // races. Plugin events tagged source=plugin / confidence=high will
        // supersede any concurrent low-confidence CDN event for the same
        // visitor + event_name in the backend dedup window.
        add_action('woocommerce_add_to_cart', array($this, 'on_woo_add_to_cart'), 10, 6);
        add_action('woocommerce_before_checkout_form', array($this, 'on_woo_initiate_checkout'), 10, 1);
        add_action('template_redirect', array($this, 'on_woo_view_content'), 20);

        // Checkout protection. Before WooCommerce creates an order, ask
        // AdProtektor whether this shopper is one it has flagged on hard
        // evidence (a bot, an operator's block, outside the allowed area). A
        // flagged shopper is refused with a reference they can quote; everyone
        // else, and every failure to get an answer, goes through. This is the
        // server-side half: the tracking script already stops the flagged
        // shopper's add to cart and checkout in the browser, and this catches
        // whatever skips the browser (a bot posting the checkout directly).
        // Classic checkout — and the express buttons built on it — refuse at
        // validation; the Checkout block and Store API refuse while the order
        // is still a checkout draft, so it never becomes an order.
        add_action('woocommerce_after_checkout_validation', array($this, 'guard_classic_checkout'), 1, 2);
        add_action('woocommerce_store_api_checkout_update_order_from_request', array($this, 'guard_block_checkout'), 1, 2);
    }

    public function add_admin_menu() {
        add_options_page(
            'AdProtektor Settings',
            'AdProtektor',
            'manage_options',
            'adprotektor',
            array($this, 'settings_page')
        );
        // Read-only diagnostics page. Configuration lives in the
        // AdProtektor dashboard, not here — this only displays status
        // + a rolling event log.
        add_submenu_page(
            'options-general.php',
            'AdProtektor Activity',
            'AdProtektor Activity',
            'manage_options',
            'adprotektor-activity',
            array($this, 'activity_page')
        );
    }

    public function register_settings() {
        register_setting('adprotektor_settings', 'adprotektor_tracking_code', array(
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ));
        // Site key — required for ConversionOS server-side hooks. The
        // backend's /v1/conversion-os/conversion endpoint authenticates
        // by hashing this against domains.settings.site_key_hash.
        register_setting('adprotektor_settings', 'adprotektor_site_key', array(
            'type' => 'string',
            // Write-only field: it is rendered blank (see the settings form), so a
            // blank submission means "leave it as it is", not "clear it". Without
            // this, saving the settings page for any other reason wiped the key
            // and silently killed every server-side conversion.
            //
            // Retain-on-blank needs an explicit way OUT, or a revoked key could
            // never be removed through the UI — hence the "remove the saved key"
            // checkbox beside the field, which is the only thing that clears it.
            'sanitize_callback' => function ($value) {
                // The checkbox counts only on this settings form's own submission.
                // options.php has checked its settings_fields() nonce already;
                // checking it here too means no other request that happens to
                // carry the field can clear the key.
                if (isset($_POST['_wpnonce'], $_POST['adprotektor_site_key_clear'])
                    && wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['_wpnonce'])), 'adprotektor_settings-options')
                    && sanitize_text_field(wp_unslash($_POST['adprotektor_site_key_clear'])) !== '') {
                    return '';
                }
                $value = sanitize_text_field((string) $value);

                return $value !== '' ? $value : (string) get_option('adprotektor_site_key', '');
            },
            'default' => '',
        ));
        // First-party tracking (adblock bypass) — relays script + events through
        // this site's own origin. Requires a site key (used to forward visitor
        // IP/JA4). See adprotektor-firstparty.php.
        register_setting('adprotektor_settings', 'adprotektor_firstparty_enabled', array(
            'type' => 'boolean',
            'sanitize_callback' => array($this, 'sanitize_checkbox'),
            'default' => false,
        ));
        // Whether a trusted edge (Cloudflare/nginx) fronts this site. Gates
        // trusting forwarded visitor IP/JA4 — off by default so a bare host
        // never trusts visitor-supplied headers.
        register_setting('adprotektor_settings', 'adprotektor_trusted_edge', array(
            'type' => 'boolean',
            'sanitize_callback' => array($this, 'sanitize_checkbox'),
            'default' => false,
        ));
        // Inbound headers carrying the visitor JA4 / JA4H, populated by the
        // customer's edge (Cloudflare Transform Rule / nginx ja4). Optional.
        register_setting('adprotektor_settings', 'adprotektor_ja4_header', array(
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => 'X-Adp-JA4',
        ));
        register_setting('adprotektor_settings', 'adprotektor_ja4h_header', array(
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => 'X-Adp-JA4H',
        ));
        // Optional "Protected by AdProtektor" footer badge. OFF unless the site
        // owner turns it on (wordpress.org: no credit links without opt-in). The
        // optional referral code (Account → Refer & earn) credits signups from
        // the badge to the site owner.
        register_setting('adprotektor_settings', 'adprotektor_badge_enabled', array(
            'type' => 'boolean',
            'sanitize_callback' => array($this, 'sanitize_checkbox'),
            'default' => false,
        ));
        register_setting('adprotektor_settings', 'adprotektor_badge_ref', array(
            'type' => 'string',
            'sanitize_callback' => array($this, 'sanitize_referral_code'),
            'default' => '',
        ));
    }

    public function sanitize_referral_code($value) {
        $code = strtolower(trim((string) $value));
        return preg_match('/^[a-z0-9]{4,16}$/', $code) ? $code : '';
    }

    /** The opt-in footer badge; prints nothing unless the owner enabled it. */
    public function render_badge() {
        if (!get_option('adprotektor_badge_enabled')) {
            return;
        }
        $args = array('utm_source' => 'wordpress-badge', 'utm_medium' => 'referral');
        $ref = (string) get_option('adprotektor_badge_ref', '');
        if ($ref !== '') {
            $args['via'] = $ref;
        }
        $url = add_query_arg($args, 'https://adprotektor.app/');
        printf(
            '<p class="adprotektor-badge" style="margin:12px auto;text-align:center;font-size:12px;opacity:.85;"><a href="%s" rel="noopener" target="_blank">%s</a></p>',
            esc_url($url),
            esc_html__('Protected by AdProtektor', 'adprotektor')
        );
    }

    public function sanitize_checkbox($value) {
        return !empty($value) ? 1 : 0;
    }

    public function add_settings_link($links) {
        $settings_link = '<a href="options-general.php?page=adprotektor">Settings</a>';
        array_unshift($links, $settings_link);
        return $links;
    }

    public function inject_tracking_script() {
        $tracking_code = get_option('adprotektor_tracking_code', '');
        if (empty($tracking_code)) {
            return;
        }
        // Skip attributes that tell JS optimizers / Cloudflare Rocket Loader to
        // leave the tracking tag exactly where it is. A minify/combine plugin that
        // rewrites this <script src> into its own /wp-content/cache/min/… dir breaks
        // the secondary bundles: track.js derives the base for rrweb.min.js and
        // conversions.min.js from its own src, so a relocated tag makes those 404
        // (the classic conversions.min.js cache 404). Keeping the tag untouched
        // means the base stays canonical and the secondary bundles resolve. Honored
        // by Autoptimize (data-noptimize), WP Rocket / SG Optimizer / LiteSpeed
        // (data-no-optimize, data-no-minify), WP Fastest Cache (data-wpfc-render),
        // ngx_pagespeed (data-pagespeed-no-defer), and Cloudflare Rocket Loader
        // (data-cfasync). Inert to the browser; the CDN loader's cache-dir fallback
        // still recovers if an optimizer ignores all of them.
        $attributes = array(
            'src' => 'https://cdn.adprotektor.app/track.js',
            'data-cfasync' => 'false',
            'data-no-optimize' => '1',
            'data-no-minify' => '1',
            'data-noptimize' => '1',
            'data-wpfc-render' => 'false',
            'data-pagespeed-no-defer' => true,
        );
        // First-party mode: point the script + its API at this site's own origin
        // so adblock domain filters can't match. Falls back to the CDN when the
        // toggle is off or no site key is configured (the proxy can't auth without it).
        if (get_option('adprotektor_firstparty_enabled') && get_option('adprotektor_site_key', '') !== '') {
            $base = defined('ADPROTEKTOR_BASE_PATH') ? ADPROTEKTOR_BASE_PATH : '/_adp';
            $attributes['src'] = $base . '/t.js';
            $attributes['data-api-url'] = $base;
        }
        // The tracking script is the service itself, loaded on every front-end
        // page, and must stay a plain tag with the attributes above, which
        // enqueueing cannot guarantee once optimizers rewrite queued assets.
        // wp_print_script_tag() escapes every attribute.
        echo "\n<!-- AdProtektor.app tracking -->\n";
        wp_print_script_tag($attributes);
        echo "<!-- /AdProtektor.app tracking -->\n";
    }

    public function settings_page() {
        if (!current_user_can('manage_options')) {
            return;
        }
        $tracking_code = get_option('adprotektor_tracking_code', '');
        // From the dashboard's "Open my WordPress plugin settings" button: put in
        // the field for the administrator to save, never saved here.
        $linked_code = $this->tracking_code_from_link();
        $field_code = $linked_code !== '' ? $linked_code : $tracking_code;
        ?>
        <div class="wrap">
            <h1><?php echo esc_html(get_admin_page_title()); ?></h1>

            <div style="background: #fff; border: 1px solid #ccd0d4; border-radius: 4px; padding: 20px; margin-top: 20px; max-width: 600px;">
                <div style="display: flex; align-items: center; margin-bottom: 20px;">
                    <div style="width: 40px; height: 40px; background: #004cf4; border-radius: 8px; display: flex; align-items: center; justify-content: center; margin-right: 12px;">
                        <span style="color: #fff; font-size: 20px; font-weight: bold;">A</span>
                    </div>
                    <div>
                        <h2 style="margin: 0; font-size: 18px;">AdProtektor</h2>
                        <p style="margin: 0; color: #666; font-size: 13px;">Click Fraud Protection for Google Ads &amp; Meta &middot; ConversionOS</p>
                    </div>
                </div>

                <?php if ($linked_code !== '' && $linked_code === $tracking_code) : ?>
                    <div class="notice notice-success inline">
                        <p>This site is already connected with the tracking code from your AdProtektor dashboard.</p>
                    </div>
                <?php elseif ($linked_code !== '' && $tracking_code !== '') : ?>
                    <div class="notice notice-warning inline">
                        <p><strong>A different tracking code from your AdProtektor dashboard is filled in below.</strong> Click Save Settings to switch this site to it.</p>
                    </div>
                <?php elseif ($linked_code !== '') : ?>
                    <div class="notice notice-info inline">
                        <p><strong>Your tracking code is filled in below.</strong> Click Save Settings to connect this site to AdProtektor.</p>
                    </div>
                <?php elseif ($tracking_code === '') : ?>
                    <div style="background: #f0fdfa; border: 1px solid #99f6e4; border-radius: 4px; padding: 16px; margin-bottom: 20px;">
                        <p style="margin: 0 0 4px; font-size: 14px;"><strong>New to AdProtektor?</strong></p>
                        <p style="margin: 0 0 12px; color: #444; font-size: 13px;">
                            Create an account for this site to get its tracking code. The free trial needs no credit card.
                            After signing up, click &ldquo;Open my WordPress plugin settings&rdquo; in the dashboard to come back here with the code filled in.
                        </p>
                        <p style="margin: 0;">
                            <a class="button button-primary" href="<?php echo esc_url($this->signup_url()); ?>" target="_blank" rel="noopener noreferrer">Create your free account</a>
                            <a class="button" style="margin-left: 6px;" href="https://app.adprotektor.app/login" target="_blank" rel="noopener noreferrer">Log in</a>
                        </p>
                    </div>
                <?php endif; ?>

                <form method="post" action="options.php">
                    <?php settings_fields('adprotektor_settings'); ?>

                    <table class="form-table" role="presentation">
                        <tr>
                            <th scope="row">
                                <label for="adprotektor_tracking_code">Tracking Code</label>
                            </th>
                            <td>
                                <input
                                    type="text"
                                    id="adprotektor_tracking_code"
                                    name="adprotektor_tracking_code"
                                    value="<?php echo esc_attr($field_code); ?>"
                                    class="regular-text"
                                    placeholder="Enter your tracking code"
                                />
                                <p class="description">
                                    Find it in your
                                    <a href="https://app.adprotektor.app" target="_blank" rel="noopener noreferrer">AdProtektor dashboard</a>
                                    under your site's settings &rarr; Install Code, where &ldquo;Open my WordPress plugin settings&rdquo; fills it in here for you.
                                </p>
                            </td>
                        </tr>
                        <tr>
                            <th scope="row">
                                <label for="adprotektor_site_key">Site Key (ConversionOS)</label>
                            </th>
                            <td>
                                <input
                                    type="password"
                                    id="adprotektor_site_key"
                                    name="adprotektor_site_key"
                                    value=""
                                    class="regular-text"
                                    placeholder="<?php echo get_option('adprotektor_site_key', '') !== '' ? 'Saved — paste a new key to replace it' : 'Required for server-side conversion tracking'; ?>"
                                    autocomplete="off"
                                />
                                <?php if (get_option('adprotektor_site_key', '') !== '') : ?>
                                    <label style="display:block;margin-top:6px;">
                                        <input type="checkbox" name="adprotektor_site_key_clear" value="1" />
                                        Remove the saved key (disables server-side conversion capture)
                                    </label>
                                <?php endif; ?>
                                <p class="description">
                                    Optional. Required only for the ConversionOS add-on — enables server-side WooCommerce, Gravity Forms, Contact Form 7, WPForms, and Elementor Pro conversion capture (more reliable than the browser script, which ad-blockers can disable). Find the site key in Domain Settings → ConversionOS.
                                    <br />Write-only: the saved key is never displayed. Leave blank to keep it, paste a new one to replace it, or tick the box above to remove it.
                                </p>
                            </td>
                        </tr>
                        <tr>
                            <th scope="row">
                                <label for="adprotektor_firstparty_enabled">First-party tracking</label>
                            </th>
                            <td>
                                <label>
                                    <?php /* Hidden 0 ensures unchecking posts an explicit value so the
                                             toggle can always be turned back OFF (an unchecked box sends
                                             no field, which would otherwise leave the saved value stuck). */ ?>
                                    <input type="hidden" name="adprotektor_firstparty_enabled" value="0" />
                                    <input
                                        type="checkbox"
                                        id="adprotektor_firstparty_enabled"
                                        name="adprotektor_firstparty_enabled"
                                        value="1"
                                        <?php checked(get_option('adprotektor_firstparty_enabled'), 1); ?>
                                    />
                                    Bypass adblockers (serve the script &amp; relay events through this site's own domain)
                                </label>
                                <p class="description">
                                    Requires a Site Key (above). When on, the tracking script is served from
                                    <code><?php echo esc_html((defined('ADPROTEKTOR_BASE_PATH') ? ADPROTEKTOR_BASE_PATH : '/_adp') . '/t.js'); ?></code>
                                    and events are relayed first-party, so adblock domain filters can't match.
                                    To also retain the visitor's JA4 bot-fingerprint, enable "Behind a trusted
                                    edge" below and have your edge forward it.
                                </p>
                            </td>
                        </tr>
                        <tr>
                            <th scope="row">
                                <label for="adprotektor_trusted_edge">Behind a trusted edge</label>
                            </th>
                            <td>
                                <label>
                                    <?php /* Hidden 0 so unchecking always posts a value — a stuck-ON
                                             trusted-edge flag would keep trusting spoofable IP/JA4 headers. */ ?>
                                    <input type="hidden" name="adprotektor_trusted_edge" value="0" />
                                    <input
                                        type="checkbox"
                                        id="adprotektor_trusted_edge"
                                        name="adprotektor_trusted_edge"
                                        value="1"
                                        <?php checked(get_option('adprotektor_trusted_edge'), 1); ?>
                                    />
                                    This site is fronted by Cloudflare or an nginx/proxy that sets the visitor's IP &amp; JA4 headers
                                </label>
                                <p class="description">
                                    Leave OFF for a normal/bare host. Only enable when a trusted edge rewrites
                                    the client headers — then the visitor IP (CF-Connecting-IP / X-Forwarded-For)
                                    and the JA4 headers below are forwarded. When OFF, those headers are treated
                                    as untrusted (visitor-spoofable) and ignored, and JA4 is not forwarded.
                                </p>
                            </td>
                        </tr>
                        <tr>
                            <th scope="row">
                                <label for="adprotektor_ja4_header">JA4 / JA4H edge headers</label>
                            </th>
                            <td>
                                <input
                                    type="text"
                                    id="adprotektor_ja4_header"
                                    name="adprotektor_ja4_header"
                                    value="<?php echo esc_attr(get_option('adprotektor_ja4_header', 'X-Adp-JA4')); ?>"
                                    class="regular-text"
                                    placeholder="X-Adp-JA4"
                                />
                                <input
                                    type="text"
                                    id="adprotektor_ja4h_header"
                                    name="adprotektor_ja4h_header"
                                    value="<?php echo esc_attr(get_option('adprotektor_ja4h_header', 'X-Adp-JA4H')); ?>"
                                    class="regular-text"
                                    placeholder="X-Adp-JA4H"
                                    style="margin-top:6px;"
                                />
                                <p class="description">
                                    Optional. The inbound request headers your edge sets to the visitor's JA4 and
                                    JA4H (e.g. a Cloudflare Transform Rule from <code>cf.bot_management.ja4</code>).
                                    Only used when "Behind a trusted edge" is on. Leave defaults if unsure.
                                </p>
                            </td>
                        </tr>
                        <tr>
                            <th scope="row">
                                <label for="adprotektor_badge_enabled">Footer badge</label>
                            </th>
                            <td>
                                <label>
                                    <input type="hidden" name="adprotektor_badge_enabled" value="0" />
                                    <input
                                        type="checkbox"
                                        id="adprotektor_badge_enabled"
                                        name="adprotektor_badge_enabled"
                                        value="1"
                                        <?php checked(get_option('adprotektor_badge_enabled'), 1); ?>
                                    />
                                    Show a small "Protected by AdProtektor" link in the site footer
                                </label>
                                <input
                                    type="text"
                                    id="adprotektor_badge_ref"
                                    name="adprotektor_badge_ref"
                                    value="<?php echo esc_attr(get_option('adprotektor_badge_ref', '')); ?>"
                                    class="regular-text"
                                    placeholder="Referral code (optional)"
                                    style="display:block;margin-top:6px;"
                                />
                                <p class="description">
                                    Off by default. If you join the AdProtektor referral program, paste the code from
                                    Account &rarr; Refer &amp; earn so signups through the badge are credited to you.
                                </p>
                            </td>
                        </tr>
                    </table>

                    <?php submit_button('Save Settings'); ?>
                </form>

                <?php if (!empty($tracking_code)) : ?>
                    <div style="background: #ecfdf5; border: 1px solid #a7f3d0; border-radius: 4px; padding: 12px; margin-top: 10px;">
                        <p style="margin: 0; color: #065f46; font-size: 13px;">
                            <strong>&#10003; Active</strong> &mdash; AdProtektor is protecting your site.
                        </p>
                    </div>
                <?php else : ?>
                    <div style="background: #fef3c7; border: 1px solid #fde68a; border-radius: 4px; padding: 12px; margin-top: 10px;">
                        <p style="margin: 0; color: #92400e; font-size: 13px;">
                            <?php if ($linked_code !== '') : ?>
                                <strong>Not configured</strong> &mdash; Click Save Settings above to activate protection.
                            <?php else : ?>
                                <strong>Not configured</strong> &mdash; Enter your tracking code above to activate protection.
                            <?php endif; ?>
                        </p>
                    </div>
                <?php endif; ?>
            </div>

            <div style="max-width: 600px; margin-top: 20px; color: #666; font-size: 13px;">
                <h3>How it works</h3>
                <ol>
                    <li>Create your account for this site at <a href="https://app.adprotektor.app" target="_blank" rel="noopener noreferrer">app.adprotektor.app</a></li>
                    <li>In the dashboard, click &ldquo;Open my WordPress plugin settings&rdquo; (or copy your tracking code)</li>
                    <li>Check the code in the field above and click Save Settings</li>
                    <li>AdProtektor will automatically detect and block fraudulent clicks on your Google Ads</li>
                </ol>
            </div>
        </div>
        <?php
    }

    /**
     * Sign-up link for a site with no tracking code yet. It carries this site's
     * host, so the account is created for it, and the plugin's UTM tags, so the
     * signup is credited to the plugin.
     */
    private function signup_url() {
        $args = array(
            'platform' => 'wordpress',
            'src' => 'wp-plugin',
            'utm_source' => 'wordpress',
            'utm_medium' => 'plugin',
            'utm_campaign' => 'plugin_settings',
        );
        $host = wp_parse_url(home_url(), PHP_URL_HOST);
        if (is_string($host) && $host !== '') {
            $args = array('domain' => $host) + $args;
        }
        return add_query_arg(array_map('rawurlencode', $args), 'https://app.adprotektor.app/register');
    }

    /**
     * The tracking code the dashboard's "Open my WordPress plugin settings" button
     * puts in this page's link (&adp_tracking_code=CODE). It only fills the field:
     * nothing is stored until an administrator submits the form, which options.php
     * checks against its nonce, so a crafted link cannot change the site's
     * configuration. Anything that is not shaped like a tracking code is ignored.
     */
    private function tracking_code_from_link() {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display-only prefill; saving goes through options.php and its nonce.
        if (!isset($_GET['adp_tracking_code'])) {
            return '';
        }
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- as above.
        $code = sanitize_text_field(wp_unslash($_GET['adp_tracking_code']));
        return preg_match('/^[A-Za-z0-9_-]{8,64}$/', $code) ? $code : '';
    }

    /**
     * On the Plugins screen only, and only until a tracking code is saved: the
     * plugin does nothing before then, and its settings page is easy to miss.
     * Saving a code removes the notice for good.
     */
    public function setup_notice() {
        if (get_option('adprotektor_tracking_code', '') !== '' || !current_user_can('manage_options')) {
            return;
        }
        $screen = function_exists('get_current_screen') ? get_current_screen() : null;
        if (!$screen || $screen->id !== 'plugins') {
            return;
        }
        ?>
        <div class="notice notice-warning">
            <p>
                <strong>AdProtektor is not protecting this site yet.</strong>
                Connect it with your tracking code to start detecting click fraud.
                <a href="<?php echo esc_url(admin_url('options-general.php?page=adprotektor')); ?>">Set up AdProtektor</a>
            </p>
        </div>
        <?php
    }

    // ---------------------------------------------------------------
    // ConversionOS — server-side conversion capture
    // ---------------------------------------------------------------

    /**
     * WooCommerce order-received page. Fastest purchase signal when the
     * shopper returns from the gateway — but only for orders that no
     * longer need payment. A pending/failed order also renders this
     * page (BACS instructions, a card still in 3DS limbo, a declined
     * retry); counting those as purchases over-reports revenue, and the
     * paid-status hooks below capture them the moment they're real.
     */
    public function on_woo_thankyou($order_id) {
        if (!$order_id || !function_exists('wc_get_order')) {
            return;
        }
        $order = wc_get_order($order_id);
        if (!$order) {
            return;
        }
        if (method_exists($order, 'needs_payment') && $order->needs_payment()) {
            return;
        }
        // needs_payment() only covers pending/failed. On-hold means an offline
        // gateway (BACS/cheque) is still awaiting manual payment confirmation —
        // not a sale yet; the status_processing/_completed backstops own it
        // the moment the merchant confirms.
        if (method_exists($order, 'has_status') && $order->has_status(array('failed', 'cancelled', 'on-hold'))) {
            return;
        }
        // Live shopper request — cookie fallback is safe if the checkout-time
        // meta stash is missing.
        $this->send_woo_purchase($order, true);
    }

    /**
     * Payment-confirmed backstop (woocommerce_payment_complete +
     * order_status_processing/completed). Runs server-to-server —
     * gateway IPN, admin status change — so a sale is captured even
     * when the shopper never loads the thank-you page. Shares the
     * per-order sentinel with on_woo_thankyou; whichever fires first
     * sends, the other no-ops.
     */
    public function on_woo_order_paid($order_id) {
        if (!$order_id || !function_exists('wc_get_order')) {
            return;
        }
        $order = wc_get_order($order_id);
        if (!$order) {
            return;
        }
        // No cookie fallback: this can run from an admin status change or a
        // gateway IPN, where any AdProtektor cookies on the request belong to
        // the store manager (or nobody) — stitching the sale to them would
        // credit the buyer's purchase to the wrong visitor.
        $this->send_woo_purchase($order, false);
    }

    /**
     * Persist the shopper's AdProtektor visitor id as order meta at checkout
     * time, while their browser cookies are on the request. The paid-status
     * hooks run in IPN/admin context (no shopper cookies), so without this
     * stash a gateway-confirmed purchase would fall back to an anonymous
     * visitor id and lose click attribution. Accepts a WC_Order (both classic
     * checkout_order_created and the Blocks store_api hook pass the order
     * object).
     *
     * No session id is stashed: the tracker keeps it in sessionStorage, which
     * never reaches the server. Up to 1.15.10 this stored the `adp_sid` cookie
     * under `_adp_sid` and sent it as the session — but that cookie is the
     * server's signed visitor id (see visitor_id_from_signed_cookie), and at 69
     * characters it failed ingest's 64-character session rule, so every
     * purchase on a first-party install was rejected.
     */
    public function capture_order_visitor_context($order) {
        if (!$order || !is_object($order) || !method_exists($order, 'update_meta_data')) {
            return;
        }
        $vid = $this->cookie_visitor_id();
        if ($vid === '') {
            return;
        }
        $order->update_meta_data('_adp_vid', $vid);
        $order->save();
    }

    /** Clamp a free-text field to the ingest validator's max length, or null. */
    private function cap_field($v, $n) {
        $s = is_string($v) ? trim($v) : '';
        // mbstring is optional on a WordPress host and the plugin only requires
        // PHP 7.4, so a bare mb_substr() would fatal the whole purchase.
        if ($s === '') return null;
        return function_exists('mb_substr') ? mb_substr($s, 0, $n) : substr($s, 0, $n);
    }

    /**
     * Build and send the Purchase for a paid order. Idempotent across all
     * calling hooks: the durable `_adp_fired` order meta is set ONLY after
     * the backend acknowledged the event — a failed POST (timeout, outage)
     * leaves the order unclaimed so a later hook (payment_complete after
     * thankyou, a status transition, a thank-you revisit) retries instead
     * of losing the sale forever. A short transient claim closes the
     * cross-worker race (IPN and thank-you render landing on different
     * PHP-FPM workers in the same second); it is released on failure.
     *
     * $allow_cookie_fallback: true only when the current request is the
     * shopper's own browser (thank-you page). Server/admin contexts must
     * not read live cookies — they'd be the store manager's.
     */
    private function send_woo_purchase($order, $allow_cookie_fallback = false) {
        $order_id = $order->get_id();
        // Durable idempotency — never fire twice for the same order.
        if ($order->get_meta('_adp_fired')) {
            return;
        }
        // Short-lived cross-request claim while the POST is in flight.
        $claim = 'adp_wc_purchase_' . $order_id;
        if (get_transient($claim)) {
            return;
        }
        set_transient($claim, 1, 5 * MINUTE_IN_SECONDS);

        $items = array();
        foreach ($order->get_items() as $item) {
            $product = $item->get_product();
            $qty = (int) $item->get_quantity();
            // Price the line as the customer was ACTUALLY charged, from the order
            // itself — not from the product's current catalogue price. The two
            // differ on every sale, coupon and post-purchase price change, and the
            // catalogue lookup reported 0.0 outright once a product was deleted,
            // so historical orders re-valued themselves over time. get_total() is
            // the line total net of discounts, hence the divide by quantity.
            $line_total = (float) $item->get_total();
            $unit_price = $qty > 0 ? $line_total / $qty : $line_total;
            // Round at the STORE's precision, not a hardcoded 2. WooCommerce's
            // decimal count is configurable and three-decimal currencies (KWD,
            // BHD, OMR) are real: forcing 2 turned a 1.234 KWD line into 1.23,
            // which the backend then stores as 1230 minor units instead of 1234.
            $decimals = function_exists('wc_get_price_decimals') ? (int) wc_get_price_decimals() : 2;
            $items[] = array(
                'sku'        => $product ? $product->get_sku() : null,
                'product_id' => $product ? (string) $product->get_id() : null,
                'name'       => $item->get_name(),
                'category'   => $this->product_category_name($product),
                'qty'        => $qty,
                'unit_price' => round($unit_price, $decimals),
            );
        }

        // Country for E.164 phone normalisation. Prefer shipping
        // address (typically where the customer lives) then billing.
        // ISO 3166-1 alpha-2 from WC, always 2-char uppercase.
        // Null when the order has no address — with_identity then
        // falls back to country_from_wp_locale() (the WP install's
        // configured locale). The backend's resolveCountryHint
        // mirrors the same chain: request payload → CF-IPCountry →
        // domains.business_country_code.
        $country = strtoupper((string) ($order->get_shipping_country() ?: $order->get_billing_country() ?: ''));
        if ($country === '' || strlen($country) !== 2) {
            $country = null;
        }

        // The phone we hash is the BILLING phone, so its E.164 prefix must come
        // from the billing country. Using the shipping-preferred one above gave
        // a UK buyer shipping a gift to Germany a +49 prefix on their +44
        // number — a hash that matches nobody at Meta or Google.
        $phone_country = strtoupper((string) ($order->get_billing_country() ?: $order->get_shipping_country() ?: ''));
        if (strlen($phone_country) !== 2) {
            $phone_country = null;
        }

        // Full address for Meta Advanced Matching (city/state/zip — hashed
        // server-side by FireCapiJob). Prefer shipping, fall back to billing;
        // null-ish empties are dropped by the backend. The state can be a code
        // (e.g. "CA") or full name depending on the store's locale — sent as-is,
        // normalised + hashed downstream.
        $city  = (string) ($order->get_shipping_city()  ?: $order->get_billing_city()  ?: '');
        $state = (string) ($order->get_shipping_state() ?: $order->get_billing_state() ?: '');
        $zip   = (string) ($order->get_shipping_postcode() ?: $order->get_billing_postcode() ?: '');

        // Visitor: the checkout-time stash on the order wins; the live
        // cookies are consulted only on the shopper's own request (thank-you
        // page — $allow_cookie_fallback); otherwise an anonymous id — the
        // backend bootstraps a row for it so the sale still counts, just
        // without attribution. An order stashed by 1.15.10 or earlier may carry
        // only `_adp_sid` (the signed visitor cookie): its visitor id is
        // recovered from it, and it is never sent as a session.
        $meta_vid = (string) $order->get_meta('_adp_vid');
        if ($meta_vid === '') {
            $meta_vid = $this->visitor_id_from_signed_cookie((string) $order->get_meta('_adp_sid'));
        }
        if ($meta_vid === '') {
            $meta_vid = $allow_cookie_fallback ? $this->resolve_visitor_id() : 'adp_anon_' . wp_generate_uuid4();
        }
        $payload = $this->with_identity(
            array(
                'visitor_id'   => $meta_vid,
                'event_name'   => 'purchase',
                'value'        => (float) $order->get_total(),
                'currency'     => strtoupper($order->get_currency()),
                'order_id'     => (string) $order_id,
                'line_items'   => $items,
                'country_code' => $country,
                // Clamped to the ingest validator's limits — WooCommerce lets a
                // shopper type anything into these, and one over-long value 422s
                // the whole order rather than just the field.
                'city'         => $this->cap_field($city, 100),
                'state'        => $this->cap_field($state, 100),
                'zip_code'     => $this->cap_field($zip, 20),
                'source'     => 'plugin',
                'confidence' => 'high',
            ),
            $order->get_billing_email() ?: null,
            $order->get_billing_phone() ?: null,
            $order->get_billing_first_name() ?: null,
            $order->get_billing_last_name() ?: null,
            $phone_country
        );

        // Blocking: the response decides whether _adp_fired is claimed.
        $r = $this->post_conversion($payload, true);
        if (is_array($r) && !empty($r['success'])) {
            // Acknowledged (fired, deduped, or suppressed — all mean the
            // backend has the order): claim it durably so no hook refires.
            if (!empty($r['event_id'])) {
                $order->update_meta_data('_adp_event_id', $r['event_id']);
            }
            $order->update_meta_data('_adp_fired', 1);
            $order->save();
            return;
        }
        // Not acknowledged (network error, 5xx, unparseable body): release
        // the claim so a later hook retries. The backend's same-order
        // dedup absorbs the rare case where the event actually landed but
        // the response was lost.
        delete_transient($claim);
    }

    /**
     * Propagate a cancelled/refunded order to the backend. Pre-settlement
     * the /cancel endpoint drops the still-queued fire jobs; once already
     * delivered, the backend dispatches compensating refund events
     * (negative-value CAPI, Google ECW retraction) instead. Full-order
     * cancel/refund only — WooCommerce partial refunds keep the order in
     * its paid status and are not propagated.
     */
    public function on_woo_order_cancelled($order_id) {
        if (!$order_id || !function_exists('wc_get_order')) {
            return;
        }
        $order = wc_get_order($order_id);
        if (!$order) {
            return;
        }
        $eventId = $order->get_meta('_adp_event_id');
        if (!$eventId) {
            return;
        }
        $this->post_to('/conversion-os/conversion/cancel', array('event_id' => $eventId));
    }

    /**
     * Gravity Forms — fired after a successful submission. Walks fields by
     * GF field type (email/phone/name) so identity capture works regardless
     * of label or position. GF "name" fields store subparts as {id}.3 (first)
     * and {id}.6 (last) on the entry.
     */
    public function on_gform_submission($entry, $form) {
        $types = array();
        foreach ((array) ($form['fields'] ?? array()) as $field) {
            $types[] = is_object($field) ? ($field->type ?? '') : ($field['type'] ?? '');
        }
        if ($this->is_account_form($types)) {
            return;
        }
        $entry_id = isset($entry['id']) ? (string) $entry['id'] : '';
        if (!$this->claim_lead_sentinel('gform_' . $entry_id)) {
            return;
        }

        $email = null; $phone = null; $first = null; $last = null;
        if (!empty($form['fields']) && is_array($form['fields'])) {
            foreach ($form['fields'] as $field) {
                $type = is_object($field) ? $field->type : ($field['type'] ?? '');
                $field_id = is_object($field) ? $field->id : ($field['id'] ?? '');
                if (!$field_id) {
                    continue;
                }
                switch ($type) {
                    case 'email':
                        $email = $email ?: ($entry[(string) $field_id] ?? null);
                        break;
                    case 'phone':
                        $phone = $phone ?: ($entry[(string) $field_id] ?? null);
                        break;
                    case 'name':
                        $first = $first ?: ($entry[$field_id . '.3'] ?? null);
                        $last  = $last  ?: ($entry[$field_id . '.6'] ?? null);
                        break;
                    case 'text':
                        $label = is_object($field) ? strtolower((string) ($field->label ?? '')) : '';
                        $val = $entry[(string) $field_id] ?? null;
                        if (!$val) {
                            break;
                        }
                        if (!$first && preg_match('/(first|שם פרטי|first name)/i', $label)) {
                            $first = $val;
                        } elseif (!$last && preg_match('/(last|surname|שם משפחה)/i', $label)) {
                            $last = $val;
                        } elseif (!$first && !$last && preg_match('/(name|שם)/i', $label)) {
                            list($first, $last) = $this->split_full_name($val);
                        }
                        break;
                }
            }
        }

        $this->post_conversion($this->with_identity(
            array(
                'visitor_id' => $this->resolve_visitor_id(),
                'event_name' => 'lead',
                'value'      => 0,
                'currency'   => null,
                'order_id'   => 'gform_' . $entry_id,
                'source'     => 'plugin',
                'confidence' => 'high',
            ),
            $email, $phone, $first, $last
        ));
    }

    /**
     * Contact Form 7 — fired only when the email was successfully sent.
     * Field names are author-defined (no schema), so we match by common
     * conventions (your-email, your-tel, your-name) and a generic regex
     * fallback.
     */
    public function on_cf7_submission($contact_form) {
        if (method_exists($contact_form, 'scan_form_tags')
            && $contact_form->scan_form_tags(array('basetype' => array('password')))) {
            return;
        }
        $form_id = method_exists($contact_form, 'id') ? $contact_form->id() : '';

        // Read the submission BEFORE claiming, because the claim key has to
        // include it. Keyed on the form id alone, the 24h sentinel fired once and
        // then swallowed every other lead that form received for the rest of the
        // day — and the constant order_id below meant the backend's same-order
        // guard would have superseded them even if they had been sent. Discriminate
        // by submission content, exactly as the WPForms handler already does.
        $posted = array();
        if (class_exists('WPCF7_Submission')) {
            $sub = WPCF7_Submission::get_instance();
            if ($sub) {
                $data = $sub->get_posted_data();
                if (is_array($data)) {
                    $posted = $data;
                }
            }
        }

        $submission_key = $form_id . '_' . md5(wp_json_encode($posted));
        if (!$this->claim_lead_sentinel('cf7_' . $submission_key)) {
            return;
        }

        list($email, $phone, $first, $last) = $this->harvest_posted_data($posted);

        $this->post_conversion($this->with_identity(
            array(
                'visitor_id' => $this->resolve_visitor_id(),
                'event_name' => 'lead',
                'value'      => 0,
                'currency'   => null,
                'order_id'   => 'cf7_' . $submission_key,
                'source'     => 'plugin',
                'confidence' => 'high',
            ),
            $email, $phone, $first, $last
        ));
    }

    /**
     * WPForms — fires on successful submission. WPForms exposes clean field
     * metadata via $fields[$id]['type'], with 'name' fields carrying
     * first/last subkeys when configured as "First / Last" name format.
     *
     * @param array $fields    Submitted field values keyed by field id.
     * @param array $entry     Raw entry record.
     * @param array $form_data Form configuration.
     * @param int   $entry_id  Saved entry id (0 when entry storage disabled).
     */
    public function on_wpforms_submission($fields, $entry, $form_data, $entry_id) {
        if ($this->is_account_form(array_map(function ($field) {
            return is_array($field) ? ($field['type'] ?? '') : '';
        }, is_array($fields) ? $fields : array()))) {
            return;
        }
        // WPForms Lite (and any form with entry storage off) reports $entry_id 0
        // for EVERY submission, so this fallback is the norm there, not an edge
        // case — and the order_id below has to carry the same discriminator or the
        // backend's same-order guard supersedes every lead after the first as a
        // repeat of order "wpforms_0".
        $submission_key = 'wpforms_' . ($entry_id ?: md5(wp_json_encode($fields)));
        if (!$this->claim_lead_sentinel($submission_key)) {
            return;
        }

        $email = null; $phone = null; $first = null; $last = null;
        if (is_array($fields)) {
            foreach ($fields as $field) {
                $type = $field['type'] ?? '';
                switch ($type) {
                    case 'email':
                        $email = $email ?: ($field['value'] ?? null);
                        break;
                    case 'phone':
                        $phone = $phone ?: ($field['value'] ?? null);
                        break;
                    case 'name':
                        if (!empty($field['first']) || !empty($field['last'])) {
                            $first = $first ?: ($field['first'] ?? null);
                            $last  = $last  ?: ($field['last'] ?? null);
                        } elseif (!empty($field['value'])) {
                            list($f, $l) = $this->split_full_name($field['value']);
                            $first = $first ?: $f;
                            $last  = $last  ?: $l;
                        }
                        break;
                }
            }
        }

        $this->post_conversion($this->with_identity(
            array(
                'visitor_id' => $this->resolve_visitor_id(),
                'event_name' => 'lead',
                'value'      => 0,
                'currency'   => null,
                'order_id'   => $submission_key,
                'source'     => 'plugin',
                'confidence' => 'high',
            ),
            $email, $phone, $first, $last
        ));
    }

    /**
     * Elementor Forms (Pro) — fires on successful submission. Elementor's
     * field metadata distinguishes type='email' and type='tel' for built-in
     * fields; other fields fall through to id/label regex matching.
     *
     * Free Elementor does not have form submissions, so this hook simply
     * never fires there.
     */
    public function on_elementor_submission($record, $ajax_handler) {
        $fields = method_exists($record, 'get') ? $record->get('fields') : array();
        if ($this->is_account_form(array_map(function ($field) {
            return is_array($field) ? ($field['type'] ?? '') : '';
        }, is_array($fields) ? $fields : array()))) {
            return;
        }
        $form_settings = method_exists($record, 'get') ? $record->get('form_settings') : array();
        $form_id = is_array($form_settings) ? ($form_settings['id'] ?? '') : '';

        // Also the order_id below. Every other lead handler keys on a stable
        // per-submission identity (gform entry id, cf7/wpforms submission key);
        // this one used time(), so two submissions of one form in the same
        // second shared an order_id and the server superseded the second — a
        // lost lead, routine on a landing page taking paid traffic.
        $submission_key = 'elementor_' . $form_id . '_' . md5(wp_json_encode($fields));
        if (!$this->claim_lead_sentinel($submission_key)) {
            return;
        }

        $email = null; $phone = null; $first = null; $last = null;
        if (is_array($fields)) {
            foreach ($fields as $id => $field) {
                $type = strtolower((string) ($field['type'] ?? ''));
                $val  = $field['value'] ?? null;
                if (!$val) {
                    continue;
                }
                $id_str = strtolower((string) $id);
                if ($type === 'email') {
                    $email = $email ?: $val;
                } elseif ($type === 'tel' || preg_match('/phone|tel|mobile/i', $id_str)) {
                    $phone = $phone ?: $val;
                } elseif (preg_match('/first/i', $id_str)) {
                    $first = $first ?: $val;
                } elseif (preg_match('/last|surname/i', $id_str)) {
                    $last = $last ?: $val;
                } elseif (!$first && !$last && preg_match('/name/i', $id_str)) {
                    list($f, $l) = $this->split_full_name($val);
                    $first = $f;
                    $last  = $l;
                }
            }
        }

        $this->post_conversion($this->with_identity(
            array(
                'visitor_id' => $this->resolve_visitor_id(),
                'event_name' => 'lead',
                'value'      => 0,
                'currency'   => null,
                'order_id'   => $submission_key,
                'source'     => 'plugin',
                'confidence' => 'high',
            ),
            $email, $phone, $first, $last
        ));
    }

    /**
     * WooCommerce AddToCart — fires for classic cart adds (AJAX and form
     * submit). Blocks/Store-API adds arrive in REST context, which
     * is_browser_context() filters out — those are covered by the CDN
     * adapter's wc-blocks_added_to_cart listener instead.
     * Variation_id distinguishes product variants so a qty
     * bump on a different size/color fires its own event. Sentinel and
     * order_id share a 1-minute bucket so AJAX double-fires within the same
     * minute collapse server-side even if the local sentinel races across
     * PHP-FPM workers — both events ship with identical order_ids, the
     * backend dedups on (visitor, event, primary_product_hash) within
     * PER_EVENT_DEDUP_SECONDS=60, and only one fire reaches Meta/Google.
     * Contract: one AddToCart per (product, variation, visitor, minute).
     * 1-minute window matches Meta's documented CAPI guidance.
     */
    public function on_woo_add_to_cart($cart_item_key, $product_id, $quantity, $variation_id, $variation, $cart_item_data) {
        if (!$this->is_browser_context() || !function_exists('wc_get_product')) {
            return;
        }
        $operation = wp_generate_uuid4();
        $vid = $this->resolve_visitor_id();
        $product = wc_get_product($variation_id ?: $product_id);
        if (!$product) {
            return;
        }
        $unit_price = (float) $product->get_price();
        $this->post_conversion(array(
            'visitor_id' => $vid,
            'event_name' => 'add_to_cart',
            'value'      => $unit_price * (int) $quantity,
            'currency'   => function_exists('get_woocommerce_currency') ? strtoupper(get_woocommerce_currency()) : null,
            'order_id'   => 'wc_atc_' . $operation,
            'line_items' => array(array(
                'sku'        => $product->get_sku() ?: (string) $product->get_id(),
                'product_id' => (string) $product->get_id(),
                'name'       => $product->get_name(),
                'category'   => $this->product_category_name($product),
                'qty'        => (int) $quantity,
                'unit_price' => $unit_price,
            )),
            'source'     => 'plugin',
            'confidence' => 'high',
        ), false);
    }

    /**
     * WooCommerce InitiateCheckout — fires when the checkout form renders,
     * which is the canonical "user intends to buy" signal. Logged-in
     * customers' billing email lifts EMQ on this high-value event.
     */
    public function on_woo_initiate_checkout($checkout) {
        if (!$this->is_browser_context() || !function_exists('WC')) {
            return;
        }
        $cart = WC()->cart;
        if (!$cart || $cart->is_empty()) {
            return;
        }
        $vid = $this->resolve_visitor_id();
        $cart_hash = method_exists($cart, 'get_cart_hash') ? $cart->get_cart_hash() : md5(wp_json_encode($cart->get_cart()));
        if (!$this->claim_lead_sentinel("wc_ic_{$cart_hash}_{$vid}", 5 * MINUTE_IN_SECONDS)) {
            return;
        }

        $items = array();
        foreach ($cart->get_cart() as $ci) {
            $product = isset($ci['data']) ? $ci['data'] : null;
            $items[] = array(
                'sku'        => ($product && method_exists($product, 'get_sku')) ? ($product->get_sku() ?: (string) $product->get_id()) : null,
                'product_id' => ($product && method_exists($product, 'get_id')) ? (string) $product->get_id() : null,
                'name'       => ($product && method_exists($product, 'get_name')) ? $product->get_name() : null,
                'category'   => $this->product_category_name($product),
                'qty'        => (int) ($ci['quantity'] ?? 1),
                'unit_price' => ($product && method_exists($product, 'get_price')) ? (float) $product->get_price() : 0.0,
            );
        }

        // Logged-in email lifts EMQ on InitiateCheckout. WC's billing
        // address fields aren't reliable here (checkout form just rendered,
        // user hasn't filled them) but the WP user account email is.
        $email = null;
        $first = null;
        $last = null;
        $user = function_exists('wp_get_current_user') ? wp_get_current_user() : null;
        if ($user && !empty($user->ID)) {
            $email = $user->user_email ?: null;
            $first = $user->first_name ?: null;
            $last  = $user->last_name ?: null;
        }

        $this->post_conversion($this->with_identity(
            array(
                'visitor_id' => $vid,
                'event_name' => 'initiate_checkout',
                'value'      => (float) $cart->get_total('edit'),
                'currency'   => strtoupper(get_woocommerce_currency()),
                'order_id'   => 'wc_ic_' . $cart_hash,
                'line_items' => $items,
                'source'     => 'plugin',
                'confidence' => 'high',
            ),
            $email, null, $first, $last
        ), false);
    }

    /**
     * WooCommerce ViewContent — single-product page renders. No native WC
     * hook exists, so we use template_redirect (fires after WP query
     * resolution but before output) and check is_product(). 5-minute
     * sentinel + order_id bucket aligns with Meta Pixel's documented
     * per-content_id dedup window — F5 reload, back-button, accelerator
     * prefetch, and casual return-to-product browsing within a session
     * all collapse to a single fire. Must stay in sync with backend's
     * `PER_EVENT_DEDUP_SECONDS['view_content']` so cross-source
     * ViewContent bursts collapse cleanly server-side too.
     */
    public function on_woo_view_content() {
        if (!$this->is_browser_context() || !function_exists('is_product') || !is_product()) {
            return;
        }
        $product = null;
        if (function_exists('wc_get_product')) {
            $product = wc_get_product(get_the_ID());
        }
        if (!$product) {
            return;
        }
        $product_id = $product->get_id();
        $vid = $this->resolve_visitor_id();
        $bucket = (int) (time() / 300);
        if (!$this->claim_lead_sentinel("wc_vc_{$product_id}_{$vid}_{$bucket}", 15 * MINUTE_IN_SECONDS)) {
            return;
        }
        $unit_price = (float) $product->get_price();
        $this->post_conversion(array(
            'visitor_id' => $vid,
            'event_name' => 'view_content',
            'value'      => $unit_price,
            'currency'   => function_exists('get_woocommerce_currency') ? strtoupper(get_woocommerce_currency()) : null,
            'order_id'   => 'wc_vc_' . $product_id . '_' . $bucket,
            'line_items' => array(array(
                'sku'        => $product->get_sku() ?: (string) $product_id,
                'product_id' => (string) $product_id,
                'name'       => $product->get_name(),
                'category'   => $this->product_category_name($product),
                'qty'        => 1,
                'unit_price' => $unit_price,
            )),
            'source'     => 'plugin',
            'confidence' => 'high',
        ), false);
    }

    // ---------------------------------------------------------------
    // Checkout protection
    // ---------------------------------------------------------------

    /**
     * Classic checkout: refuse a flagged shopper at validation, before
     * WooCommerce creates the order. Express-pay buttons that place their
     * order through WC_Checkout::process_checkout() pass this hook too.
     */
    public function guard_classic_checkout($data, $errors) {
        if (!is_object($errors) || !method_exists($errors, 'add')) {
            return;
        }
        $cart = function_exists('WC') ? WC()->cart : null;
        $refusal = $this->checkout_refusal(
            $cart ? (float) $cart->get_total('edit') : null,
            function_exists('get_woocommerce_currency') ? get_woocommerce_currency() : null
        );
        if ($refusal !== null) {
            $errors->add('adprotektor_checkout_guard', esc_html($refusal));
        }
    }

    /**
     * Checkout block and Store API: refuse while the order is still a
     * checkout draft. It is never set to pending or paid, and WooCommerce
     * deletes abandoned drafts on its own. The Store API answers the
     * RouteException with its message, which the Checkout block shows after
     * decoding its entities, so the escaped message reads as written.
     */
    public function guard_block_checkout($order, $request = null) {
        $refusal = $this->checkout_refusal(
            (is_object($order) && method_exists($order, 'get_total')) ? (float) $order->get_total() : null,
            (is_object($order) && method_exists($order, 'get_currency')) ? $order->get_currency() : null
        );
        if ($refusal === null) {
            return;
        }
        if (class_exists('\Automattic\WooCommerce\StoreApi\Exceptions\RouteException')) {
            throw new \Automattic\WooCommerce\StoreApi\Exceptions\RouteException('adprotektor_checkout_guard', esc_html($refusal), 403);
        }
        throw new \Exception(esc_html($refusal));
    }

    /**
     * Ask AdProtektor whether this shopper may place an order. Returns the
     * plain-text message to refuse them with, or null to let the order
     * through. Fails open: no site key, a store manager placing an order, no
     * answer within three seconds, or any answer but an explicit block, and
     * the order goes ahead. The server records every refusal (and, in shadow
     * mode, every order it would have refused) under this site.
     */
    private function checkout_refusal($value = null, $currency = null) {
        $site_key = get_option('adprotektor_site_key', '');
        if ($site_key === '' || (function_exists('current_user_can') && current_user_can('manage_woocommerce'))) {
            return null;
        }

        $query = array('stage' => 'checkout', 'locale' => function_exists('determine_locale') ? determine_locale() : get_locale());
        if ($value !== null) {
            $query['value'] = round((float) $value, 2);
        }
        if (is_string($currency) && $currency !== '') {
            $query['currency'] = strtoupper($currency);
        }
        $checkout_url = function_exists('wc_get_checkout_url') ? wc_get_checkout_url() : '';
        $headers = array_filter(array(
            'X-Adp-Site-Key'   => $site_key,
            'X-Adp-Host'       => wp_parse_url(home_url(), PHP_URL_HOST),
            'X-Adp-Path'       => $checkout_url ? wp_parse_url($checkout_url, PHP_URL_PATH) : null,
            'X-Adp-Visitor-Id' => $this->cookie_visitor_id(),
            'X-Adp-Client-IP'  => $this->shopper_ip(),
            'X-Adp-Channel'    => 'server',
        ), function ($v) { return is_string($v) && $v !== ''; });

        $response = wp_remote_get(ADPROTEKTOR_API_BASE . '/enforcement/checkout?' . http_build_query($query), array(
            'timeout' => 3,
            'headers' => $headers,
        ));
        if (is_wp_error($response) || (int) wp_remote_retrieve_response_code($response) !== 200) {
            return null;
        }
        $body = json_decode(wp_remote_retrieve_body($response), true);
        if (!is_array($body) || ($body['decision'] ?? '') !== 'block') {
            return null;
        }

        $message = is_string($body['message'] ?? null) ? sanitize_text_field($body['message']) : '';
        if ($message !== '') {
            return $message;
        }
        // An explicit block without its message still refuses, in English.
        $reference = is_string($body['reference'] ?? null) ? $body['reference'] : '';
        return "We can't complete this order. This store's fraud protection flagged this session. If you think this is a mistake, contact us"
            . (preg_match('/^ADP-[0-9A-Z]{4}-[0-9A-Z]{4}$/', $reference) ? " and quote reference {$reference}." : '.');
    }

    /**
     * The shopper's IP as this server sees it. Behind an edge the admin has
     * vouched for ("Behind a trusted edge"), the edge's CF-Connecting-IP or
     * first X-Forwarded-For; otherwise REMOTE_ADDR, because a forwarded
     * header the shopper wrote themselves is not evidence of anything.
     */
    private function shopper_ip() {
        if (get_option('adprotektor_trusted_edge', false)) {
            foreach (array('HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR') as $header) {
                $candidate = isset($_SERVER[$header]) ? trim(explode(',', sanitize_text_field(wp_unslash($_SERVER[$header])))[0]) : '';
                if ($candidate !== '' && filter_var($candidate, FILTER_VALIDATE_IP)) {
                    return $candidate;
                }
            }
        }
        $remote = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '';
        return filter_var($remote, FILTER_VALIDATE_IP) ? $remote : '';
    }

    // ---------------------------------------------------------------
    // Helpers
    // ---------------------------------------------------------------

    /**
     * Comma-joined product category names for a WC product, matching the
     * `category_name` PixelYourSite emits (e.g. "NEW, Lip Boosters"). For a
     * variation the categories live on the parent product, so resolve the
     * parent id first. Returns null when no categories / outside WC.
     */
    private function product_category_name($product) {
        if (!$product || !is_object($product) || !function_exists('get_the_terms')) {
            return null;
        }
        $pid = (method_exists($product, 'get_parent_id') && $product->get_parent_id())
            ? $product->get_parent_id()
            : (method_exists($product, 'get_id') ? $product->get_id() : 0);
        if (!$pid) {
            return null;
        }
        $terms = get_the_terms($pid, 'product_cat');
        if (!$terms || is_wp_error($terms)) {
            return null;
        }
        $names = array();
        foreach ($terms as $t) {
            if (is_object($t) && !empty($t->name)) {
                $names[] = $t->name;
            }
        }
        return $names ? implode(', ', $names) : null;
    }

    /**
     * True only for genuine browser-originated requests. Filters out
     * cron, WP-CLI, and REST API contexts where the visitor cookies
     * wouldn't make sense. AJAX add-to-cart IS browser context.
     */
    private function is_browser_context() {
        if (is_admin() && !(defined('DOING_AJAX') && DOING_AJAX)) {
            return false;
        }
        if (defined('DOING_CRON') && DOING_CRON) {
            return false;
        }
        if (defined('WP_CLI') && WP_CLI) {
            return false;
        }
        if (defined('REST_REQUEST') && REST_REQUEST) {
            return false;
        }
        return !empty($_SERVER['HTTP_USER_AGENT']);
    }

    private function resolve_visitor_id() {
        // Attach the conversion to the visitor the tracker saw (see
        // cookie_visitor_id). Falls back to a random ID if neither cookie is
        // there (ad-blocked track.js) — the backend bootstraps a row for
        // plugin-sourced events, so the conversion still counts, just
        // unattributed.
        $vid = $this->cookie_visitor_id();
        return $vid !== '' ? $vid : 'adp_anon_' . wp_generate_uuid4();
    }

    /**
     * The visitor id from this request's cookies, or ''. `adp_vid` is the
     * tracker's own first-party cookie. `adp_sid` is the server's signed copy of
     * the same id, set on the store's domain by the first-party proxy: it is
     * HttpOnly and server-set, so it outlives a script-set cookie under Safari's
     * 7-day cap, and it is the fallback when adp_vid is gone.
     */
    private function cookie_visitor_id() {
        if (!empty($_COOKIE['adp_vid'])) {
            return sanitize_text_field(wp_unslash($_COOKIE['adp_vid']));
        }
        if (!empty($_COOKIE['adp_sid'])) {
            return $this->visitor_id_from_signed_cookie(sanitize_text_field(wp_unslash($_COOKIE['adp_sid'])));
        }
        return '';
    }

    /**
     * The visitor id inside the server's signed `adp_sid` cookie
     * (`<visitor id>.<32-hex HMAC>`), or '' when the value has another shape.
     * The plugin cannot check the HMAC (the key is the server's), so the id
     * carries exactly the trust adp_vid does — both are client-held. It is
     * never a session id: the tracker's session lives in sessionStorage.
     */
    private function visitor_id_from_signed_cookie($raw) {
        $raw = is_string($raw) ? $raw : '';
        $dot = strrpos($raw, '.');
        if ($dot === false || !preg_match('/^[0-9a-f]{32}$/', substr($raw, $dot + 1))) {
            return '';
        }
        $vid = substr($raw, 0, $dot);
        return ($vid !== '' && strlen($vid) <= 191) ? $vid : '';
    }

    /**
     * $blocking defaults to FALSE: only the purchase path reads the response
     * (for the durable _adp_fired claim) and asks for it explicitly. The lead
     * handlers discarded it while still waiting out the full 8s timeout, so an
     * API that blackholes packets rather than refusing them stalled every
     * Contact Form 7 / Gravity Forms / WPForms / Elementor submission on the
     * customer's site for eight seconds before their thank-you page rendered.
     */
    private function post_conversion(array $payload, $blocking = false) {
        // When it happened, for the backend to pair a form conversion with the
        // browser's copy of the same submission however late this one is
        // delivered. Pairing only — the conversion time stays the arrival.
        if (!isset($payload['submitted_at'])) {
            $payload['submitted_at'] = time();
        }
        // A form lead goes from this request once it is answered; the funnel
        // events a storefront sends on every page keep to WP-Cron, so a slow API
        // never holds a PHP worker per product view.
        $after_response = isset($payload['event_name']) && $payload['event_name'] === 'lead';
        return $this->post_to('/conversion-os/conversion', $payload, $blocking, $after_response);
    }

    /**
     * Merge identity fields into the payload as SHA-256 hashes. Normalisation
     * mirrors ConversionOsController::normalize*ForHash exactly — any drift
     * here breaks the dedupe between Pixel and CAPI.
     *
     * $country_hint defaults to whatever get_locale() reveals about
     * the WP install (e.g. 'he_IL' → 'IL', 'en_US' → 'US',
     * 'pt_BR' → 'BR'). NO hardcoded country fallback — if the
     * locale doesn't carry a recognisable ISO suffix, $country_hint
     * stays null and hash_phone produces digits-only. Customers
     * who need a specific override can pass it explicitly (the
     * order-processing path passes the actual order country).
     *
     * Caller order: callers that have explicit country (order
     * processing) pass it; lead-gen callers (CF7, Gravity, WPForms,
     * Elementor) omit and get the locale-derived default.
     */
    private function with_identity(array $payload, $email, $phone, $first, $last, $country_hint = null) {
        if ($country_hint === null) {
            $country_hint = $this->country_from_wp_locale();
        }
        if ($email) {
            $payload['email_hash'] = $this->hash_email($email);
            // Gmail-normalised variant for the Google paths (GA4 / Ads).
            $payload['email_hash_google'] = $this->hash_email_google($email);
        }
        if ($phone) {
            $payload['phone_hash'] = $this->hash_phone($phone, $country_hint);
        }
        if ($first) {
            $payload['first_name_hash'] = $this->hash_name($first);
        }
        if ($last) {
            $payload['last_name_hash'] = $this->hash_name($last);
        }
        return $payload;
    }

    private function hash_email($email) {
        $email = trim((string) $email);
        if ($email === '') {
            return null;
        }
        return hash('sha256', strtolower($email));
    }

    /**
     * Gmail-normalised email hash for the Google paths (GA4 / Google Ads).
     * Google's Enhanced Conversions spec canonicalises gmail.com & googlemail.com
     * addresses before hashing: dots removed and any "+tag" stripped from the
     * local part (john.doe+promo@gmail.com -> johndoe@gmail.com). Non-gmail
     * addresses get plain lowercase+trim, identical to hash_email().
     *
     * Mirrors normalizeEmailForHashGoogle() in the backend and
     * normalizeEmailGoogle() in cdn/src/conversions.js — keep all three in sync.
     */
    private function hash_email_google($email) {
        $email = strtolower(trim((string) $email));
        if ($email === '') {
            return null;
        }
        $at = strrpos($email, '@');
        if ($at === false || $at === 0) {
            return hash('sha256', $email);
        }
        $local = substr($email, 0, $at);
        $domain = substr($email, $at + 1);
        if ($domain === 'gmail.com' || $domain === 'googlemail.com') {
            $plus = strpos($local, '+');
            if ($plus !== false) {
                $local = substr($local, 0, $plus);
            }
            $local = str_replace('.', '', $local);
        }
        return hash('sha256', $local . '@' . $domain);
    }

    /**
     * Country-driven E.164 phone normalisation, then SHA-256.
     *
     * Plugin-side hashing must produce the EXACT same digits as
     * backend/app/Services/CountryCallingCodes.php and
     * cdn/src/countryCodes.js, or Meta CAPI dedup between Pixel
     * (browser) and CAPI (server) breaks. The map below is a copy
     * of those two — kept inline rather than as a separate file so
     * the plugin ZIP stays self-contained.
     *
     * Priority for the country hint:
     *   1. $country_hint param (typically the order's
     *      shipping/billing country).
     *   2. Null → digits-only output. Meta CAPI does its own
     *      server-side normalisation for known patterns and won't
     *      reject the event.
     */
    /**
     * Derive ISO 3166-1 alpha-2 from WordPress's get_locale(). WP
     * locale format is BCP-47-ish: 'language_REGION' (he_IL, en_US,
     * pt_BR, fr_FR). When the region segment is a valid 2-letter
     * code in our calling-code map, return it. Otherwise null —
     * no guessing.
     *
     * Locales without a region ('en', 'fr') return null and the
     * caller falls through to digits-only hashing.
     */
    private function country_from_wp_locale() {
        if (!function_exists('get_locale')) return null;
        $locale = (string) get_locale();
        if (strpos($locale, '_') === false) return null;
        $parts = explode('_', $locale);
        if (count($parts) < 2) return null;
        $region = strtoupper(substr($parts[1], 0, 2));
        if (!preg_match('/^[A-Z]{2}$/', $region)) return null;
        return $this->calling_code_for($region) !== null ? $region : null;
    }

    private function hash_phone($phone, $country_hint = null) {
        $phone = (string) $phone;
        if (trim($phone) === '') {
            return null;
        }
        $has_plus = strncmp(ltrim($phone), '+', 1) === 0;
        $digits = preg_replace('/\D/', '', $phone);
        if ($has_plus) {
            return hash('sha256', '+' . $digits);
        }
        if (is_string($country_hint) && $country_hint !== '') {
            $cc = $this->calling_code_for(strtoupper($country_hint));
            if ($cc !== null) {
                if (strlen($digits) > 0 && $digits[0] === '0') {
                    $digits = substr($digits, 1);
                }
                return hash('sha256', '+' . $cc . $digits);
            }
        }
        return hash('sha256', $digits);
    }

    /**
     * ISO 3166-1 alpha-2 → E.164 calling code. Static map; must
     * stay in sync with backend/app/Services/CountryCallingCodes.php
     * and cdn/src/countryCodes.js.
     */
    private function calling_code_for($iso2) {
        static $map = array(
            'AC'=>'247','AD'=>'376','AE'=>'971','AF'=>'93','AG'=>'1268','AI'=>'1264','AL'=>'355','AM'=>'374',
            'AO'=>'244','AR'=>'54','AS'=>'1684','AT'=>'43','AU'=>'61','AW'=>'297','AX'=>'358','AZ'=>'994',
            'BA'=>'387','BB'=>'1246','BD'=>'880','BE'=>'32','BF'=>'226','BG'=>'359','BH'=>'973','BI'=>'257',
            'BJ'=>'229','BL'=>'590','BM'=>'1441','BN'=>'673','BO'=>'591','BQ'=>'599','BR'=>'55','BS'=>'1242',
            'BT'=>'975','BW'=>'267','BY'=>'375','BZ'=>'501',
            'CA'=>'1','CC'=>'61','CD'=>'243','CF'=>'236','CG'=>'242','CH'=>'41','CI'=>'225','CK'=>'682',
            'CL'=>'56','CM'=>'237','CN'=>'86','CO'=>'57','CR'=>'506','CU'=>'53','CV'=>'238','CW'=>'599',
            'CX'=>'61','CY'=>'357','CZ'=>'420',
            'DE'=>'49','DJ'=>'253','DK'=>'45','DM'=>'1767','DO'=>'1809','DZ'=>'213',
            'EC'=>'593','EE'=>'372','EG'=>'20','EH'=>'212','ER'=>'291','ES'=>'34','ET'=>'251',
            'FI'=>'358','FJ'=>'679','FK'=>'500','FM'=>'691','FO'=>'298','FR'=>'33',
            'GA'=>'241','GB'=>'44','GD'=>'1473','GE'=>'995','GF'=>'594','GG'=>'44','GH'=>'233','GI'=>'350',
            'GL'=>'299','GM'=>'220','GN'=>'224','GP'=>'590','GQ'=>'240','GR'=>'30','GT'=>'502','GU'=>'1671',
            'GW'=>'245','GY'=>'592',
            'HK'=>'852','HN'=>'504','HR'=>'385','HT'=>'509','HU'=>'36',
            'ID'=>'62','IE'=>'353','IL'=>'972','IM'=>'44','IN'=>'91','IO'=>'246','IQ'=>'964','IR'=>'98',
            'IS'=>'354','IT'=>'39',
            'JE'=>'44','JM'=>'1876','JO'=>'962','JP'=>'81',
            'KE'=>'254','KG'=>'996','KH'=>'855','KI'=>'686','KM'=>'269','KN'=>'1869','KP'=>'850','KR'=>'82',
            'KW'=>'965','KY'=>'1345','KZ'=>'7',
            'LA'=>'856','LB'=>'961','LC'=>'1758','LI'=>'423','LK'=>'94','LR'=>'231','LS'=>'266','LT'=>'370',
            'LU'=>'352','LV'=>'371','LY'=>'218',
            'MA'=>'212','MC'=>'377','MD'=>'373','ME'=>'382','MF'=>'590','MG'=>'261','MH'=>'692','MK'=>'389',
            'ML'=>'223','MM'=>'95','MN'=>'976','MO'=>'853','MP'=>'1670','MQ'=>'596','MR'=>'222','MS'=>'1664',
            'MT'=>'356','MU'=>'230','MV'=>'960','MW'=>'265','MX'=>'52','MY'=>'60','MZ'=>'258',
            'NA'=>'264','NC'=>'687','NE'=>'227','NF'=>'672','NG'=>'234','NI'=>'505','NL'=>'31','NO'=>'47',
            'NP'=>'977','NR'=>'674','NU'=>'683','NZ'=>'64',
            'OM'=>'968',
            'PA'=>'507','PE'=>'51','PF'=>'689','PG'=>'675','PH'=>'63','PK'=>'92','PL'=>'48','PM'=>'508',
            'PR'=>'1787','PS'=>'970','PT'=>'351','PW'=>'680','PY'=>'595',
            'QA'=>'974',
            'RE'=>'262','RO'=>'40','RS'=>'381','RU'=>'7','RW'=>'250',
            'SA'=>'966','SB'=>'677','SC'=>'248','SD'=>'249','SE'=>'46','SG'=>'65','SH'=>'290','SI'=>'386',
            'SJ'=>'47','SK'=>'421','SL'=>'232','SM'=>'378','SN'=>'221','SO'=>'252','SR'=>'597','SS'=>'211',
            'ST'=>'239','SV'=>'503','SX'=>'1721','SY'=>'963','SZ'=>'268',
            'TA'=>'290','TC'=>'1649','TD'=>'235','TG'=>'228','TH'=>'66','TJ'=>'992','TK'=>'690','TL'=>'670',
            'TM'=>'993','TN'=>'216','TO'=>'676','TR'=>'90','TT'=>'1868','TV'=>'688','TW'=>'886','TZ'=>'255',
            'UA'=>'380','UG'=>'256','US'=>'1','UY'=>'598','UZ'=>'998',
            'VA'=>'39','VC'=>'1784','VE'=>'58','VG'=>'1284','VI'=>'1340','VN'=>'84','VU'=>'678',
            'WF'=>'681','WS'=>'685',
            'YE'=>'967','YT'=>'262',
            'ZA'=>'27','ZM'=>'260','ZW'=>'263',
        );
        return isset($map[$iso2]) ? $map[$iso2] : null;
    }

    private function hash_name($name) {
        $name = $this->normalize_name_for_hash($name);
        if ($name === '') {
            return null;
        }
        return hash('sha256', $name);
    }

    /**
     * Name normalisation for SHA-256. MUST byte-match
     * ConversionOsController::normalizeNameForHash and the CDN's
     * normalizeName (cdn/src/conversions.js) — all three lowercase the UTF-8
     * value, NFKC-normalise it, then strip everything that is not a letter or
     * combining mark. "Mary-Jo O'Brien" → "maryjoobrien"; a Hebrew name like
     * "יוסי" stays "יוסי" instead of being deleted to "". The old /[^a-z]/
     * strip blanked every non-Latin name, silently zeroing fn/ln advanced
     * matching and CDN/plugin dedup on non-Latin stores. mbstring/intl fall
     * back gracefully — Hebrew has no case so strtolower() leaves it intact.
     */
    private function normalize_name_for_hash($name) {
        $name = (string) $name;
        if (class_exists('Normalizer')) {
            $name = \Normalizer::normalize($name, \Normalizer::FORM_KC) ?: $name;
        }
        $name = function_exists('mb_strtolower') ? mb_strtolower($name, 'UTF-8') : strtolower($name);
        // /u returns null on malformed UTF-8; coalesce to '' so hash_name's
        // empty-check drops it instead of hashing null.
        return preg_replace('/[^\p{L}\p{M}]/u', '', trim($name)) ?? '';
    }

    private function split_full_name($full) {
        $full = trim((string) $full);
        if ($full === '') {
            return array(null, null);
        }
        $parts = preg_split('/\s+/', $full, 2);
        $first = $parts[0] ?? null;
        $last  = $parts[1] ?? null;
        return array($first, $last);
    }

    /**
     * Scan an arbitrary posted-data array (CF7 / custom forms) for email,
     * phone, and name fields. Returns [email, phone, first, last].
     */
    private function harvest_posted_data(array $posted) {
        $email = null; $phone = null; $first = null; $last = null; $full = null;
        // Common explicit keys first
        $email_keys = array('your-email', 'email', 'e-mail');
        $phone_keys = array('your-tel', 'tel', 'phone', 'mobile');
        $first_keys = array('first-name', 'firstname', 'first_name', 'fname');
        $last_keys  = array('last-name', 'lastname', 'last_name', 'lname', 'surname');
        $full_keys  = array('your-name', 'name', 'fullname', 'full-name');

        foreach ($email_keys as $k) { if (isset($posted[$k]) && $posted[$k] !== '') { $email = is_array($posted[$k]) ? reset($posted[$k]) : $posted[$k]; break; } }
        foreach ($phone_keys as $k) { if (isset($posted[$k]) && $posted[$k] !== '') { $phone = is_array($posted[$k]) ? reset($posted[$k]) : $posted[$k]; break; } }
        foreach ($first_keys as $k) { if (isset($posted[$k]) && $posted[$k] !== '') { $first = is_array($posted[$k]) ? reset($posted[$k]) : $posted[$k]; break; } }
        foreach ($last_keys as $k)  { if (isset($posted[$k]) && $posted[$k] !== '') { $last  = is_array($posted[$k]) ? reset($posted[$k]) : $posted[$k]; break; } }
        foreach ($full_keys as $k)  { if (isset($posted[$k]) && $posted[$k] !== '') { $full  = is_array($posted[$k]) ? reset($posted[$k]) : $posted[$k]; break; } }

        // Regex fallback for arbitrary keys
        foreach ($posted as $k => $v) {
            if (is_array($v)) { $v = reset($v); }
            if (!is_string($v) || $v === '') { continue; }
            $kl = strtolower($k);
            if (!$email && preg_match('/e?mail/', $kl)) { $email = $v; }
            elseif (!$phone && preg_match('/phone|tel|mobile/', $kl)) { $phone = $v; }
            elseif (!$first && preg_match('/first/', $kl)) { $first = $v; }
            elseif (!$last && preg_match('/last|surname/', $kl)) { $last = $v; }
            elseif (!$full && preg_match('/name|שם/u', $kl)) { $full = $v; }
        }

        if ($full && !$first && !$last) {
            list($first, $last) = $this->split_full_name($full);
        }
        return array($email, $phone, $first, $last);
    }

    /**
     * A form that signs a person in or up — it asks for a password. Gravity's
     * User Registration, WPForms' and Elementor's password fields: a person
     * creating an account or logging in is not a lead, and their submission
     * was reaching Google and Meta as one. The tracker draws the same line
     * (cdn/src/tracker.js isNonLeadFormEl).
     *
     * @param array $types the submitted form's field types
     */
    private function is_account_form(array $types) {
        foreach ($types as $type) {
            if (strtolower((string) $type) === 'password') {
                return true;
            }
        }
        return false;
    }

    /**
     * Lead-form idempotency. WooCommerce has order meta sentinels; forms
     * don't. Use a 24h WP transient so the same submission doesn't fire
     * twice on rare hook double-registrations.
     *
     * Returns true on first claim, false when the sentinel is already set.
     */
    private function claim_lead_sentinel($key, $ttl = null) {
        $sentinel = 'adp_fired_' . md5($key);
        if (get_transient($sentinel)) {
            return false;
        }
        // TTL must outlive the key, not the day. The funnel callers mint keys
        // bucketed by minute or by five minutes, and a fixed 24h expiry left every
        // one of those buckets sitting in wp_options long after it could ever be
        // claimed again — tens of thousands of dead rows on a busy store, since
        // expired transients are only reaped lazily on read.
        set_transient($sentinel, 1, $ttl ?: 24 * HOUR_IN_SECONDS);
        return true;
    }

    /**
     * Append a single entry to the rolling recent-events log used by
     * the Activity admin page. Bounded to ADPROTEKTOR_RECENT_EVENTS_CAP
     * entries (FIFO trim). Wrapped in try/catch — a wp_options write
     * failure must never block the actual event submission.
     *
     * autoload is NO so wp_options doesn't load this on every WP
     * request; only the Activity admin page reads it. The option key
     * survives across plugin updates.
     */
    private function append_recent_event_log($path, $payload, $http_status, $response_excerpt, $ms_elapsed) {
        try {
            $existing = get_option('adprotektor_recent_events', array());
            if (!is_array($existing)) $existing = array();
            $entry = array(
                'ts' => current_time('mysql', true), // UTC
                'event_name' => isset($payload['event_name']) ? (string) $payload['event_name'] : '(unknown)',
                'order_id' => isset($payload['order_id']) ? (string) $payload['order_id'] : null,
                'path' => (string) $path,
                'http_status' => $http_status === null ? null : (int) $http_status,
                'response_excerpt' => $response_excerpt === null ? null : substr((string) $response_excerpt, 0, 200),
                'ms' => (int) $ms_elapsed,
            );
            // FIFO trim — push then slice. Newest first for easier
            // rendering in the admin table.
            array_unshift($existing, $entry);
            if (count($existing) > ADPROTEKTOR_RECENT_EVENTS_CAP) {
                $existing = array_slice($existing, 0, ADPROTEKTOR_RECENT_EVENTS_CAP);
            }
            update_option('adprotektor_recent_events', $existing, false /* autoload=NO */);
        } catch (\Throwable $e) {
            // Silent: a debug-log write must never break event sending.
        }
    }

    private function post_to($path, array $payload, $blocking = true, $after_response = false) {
        $site_key = get_option('adprotektor_site_key', '');
        if (!$site_key) return null;
        if ($path === '/conversion-os/conversion' && empty($payload['event_id'])) $payload['event_id'] = wp_generate_uuid4();
        $id = 'adp_delivery_' . hash('sha256', $path . ':' . ($payload['event_id'] ?? wp_generate_uuid4()));
        if (!get_option($id)) {
            $nonce = random_bytes(12);
            $tag = '';
            $cipher = openssl_encrypt(wp_json_encode($payload), 'aes-256-gcm', hash('sha256', wp_salt('auth'), true), OPENSSL_RAW_DATA, $nonce, $tag);
            if ($cipher === false) return null;
            // base64 only makes the encrypted binary payload safe to store in wp_options.
            // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
            $entry = array('path' => $path, 'payload' => base64_encode($nonce . $tag . $cipher),
                'credential' => hash('sha256', $site_key), 'created' => time(), 'attempts' => 0);
            if (!add_option($id, $entry, '', false) && !get_option($id)) return null;
        }
        // Schedule before attempting transport: a PHP timeout still leaves recovery.
        if (!wp_next_scheduled('adprotektor_deliver_event', array($id))) {
            wp_schedule_single_event(time() + 60, 'adprotektor_deliver_event', array($id));
        }
        if ($blocking) return $this->deliver_pending_event($id);
        if ($after_response) $this->defer_delivery($id);
        return array('success' => true, 'queued' => true);
    }

    /**
     * Send a queued delivery from this request, once its response has gone out.
     *
     * A lead used to wait for WP-Cron: a minute at best, five to fifteen on a
     * host that runs it from system cron. Sent after the response, so the
     * visitor's page is never held up by our API; the queued entry and its
     * cron job stay the recovery path for a send that fails.
     *
     * Form leads only (post_conversion), and only where PHP can hand the
     * response over first — PHP-FPM, LiteSpeed. Under mod_php or CGI a
     * `shutdown` callback runs while the visitor's connection is still open, so
     * a send there (up to eight seconds against a slow API) would hold their
     * page: those deliveries wait for WP-Cron as they always did. The backend
     * pairs a late lead with the browser's copy by `submitted_at`, not by
     * arrival.
     */
    private function defer_delivery($id) {
        if (!function_exists('fastcgi_finish_request') && !function_exists('litespeed_finish_request')) {
            return;
        }
        if (!$this->deferred_deliveries) {
            add_action('shutdown', array($this, 'deliver_deferred'), PHP_INT_MAX);
        }
        $this->deferred_deliveries[$id] = true;
    }

    /** WordPress `shutdown`, last: hand the visitor their response, then deliver. */
    public function deliver_deferred() {
        $ids = array_keys($this->deferred_deliveries);
        $this->deferred_deliveries = array();
        if (!$ids) {
            return;
        }
        if (function_exists('fastcgi_finish_request')) {
            fastcgi_finish_request();
        } elseif (function_exists('litespeed_finish_request')) {
            litespeed_finish_request();
        } else {
            return;
        }
        foreach ($ids as $id) {
            $this->deliver_pending_event($id);
        }
    }

    public function deliver_pending_event($id) {
        if (!is_string($id) || !preg_match('/^adp_delivery_[a-f0-9]{64}$/', $id)) return null;
        $entry = get_option($id);
        if (!is_array($entry)) return null;
        if (time() - $entry['created'] >= DAY_IN_SECONDS
            || !hash_equals($entry['credential'], hash('sha256', get_option('adprotektor_site_key', '')))) {
            $this->append_recent_event_log($entry['path'], array(), null, 'delivery expired or destination changed', 0);
            delete_option($id);
            return null;
        }
        // Reverses the storage encoding in post_to(); the result is decrypted, never executed.
        // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
        $raw = base64_decode($entry['payload'], true);
        $plain = $raw === false ? false : openssl_decrypt(substr($raw, 28), 'aes-256-gcm', hash('sha256', wp_salt('auth'), true), OPENSSL_RAW_DATA, substr($raw, 0, 12), substr($raw, 12, 16));
        $payload = $plain === false ? null : json_decode($plain, true);
        if (!is_array($payload)) { delete_option($id); return null; }
        $entry['attempts']++;
        update_option($id, $entry, false);
        // Recovery is independent of another shopper action or order transition.
        if (!wp_next_scheduled('adprotektor_deliver_event', array($id))) {
            wp_schedule_single_event(time() + min(3600, 60 * (2 ** min(6, $entry['attempts']))), 'adprotektor_deliver_event', array($id));
        }
        $reply = $this->send_to($entry['path'], $payload, true);
        $status = is_array($reply) ? ($reply['_http_status'] ?? 0) : 0;
        $accepted = $status >= 200 && $status < 300 && (!empty($reply['success']) || !empty($reply['ok']));
        if ($accepted || ($status >= 400 && $status < 500 && !in_array($status, array(408, 409, 425, 429), true))) {
            delete_option($id);
            wp_clear_scheduled_hook('adprotektor_deliver_event', array($id));
        }
        return $accepted ? $reply : null;
    }

    private function send_to($path, array $payload, $blocking = true) {
        $site_key = get_option('adprotektor_site_key', '');
        if (empty($site_key)) {
            return null;
        }

        $url = ADPROTEKTOR_API_BASE . $path;
        $started_at = microtime(true);
        $response = wp_remote_post($url, array(
            // Non-blocking still performs DNS + TCP + TLS + the request send
            // inline; it only skips waiting for the RESPONSE. So the timeout has
            // to leave room for a slow handshake, or it aborts the request before
            // the API ever receives it. It costs nothing in the normal case,
            // where the call returns as soon as the body is out.
            'timeout'  => $blocking ? 8 : 5,
            'blocking' => (bool) $blocking,
            'headers'  => array(
                'Content-Type'    => 'application/json',
                'X-Adp-Site-Key'  => $site_key,
                'X-Adp-Host'      => wp_parse_url(home_url(), PHP_URL_HOST),
            ),
            'body'     => wp_json_encode($payload),
        ));
        $ms = (int) round((microtime(true) - $started_at) * 1000);

        if (is_wp_error($response)) {
            if (defined('WP_DEBUG') && WP_DEBUG) {
                // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
                error_log('AdProtektor: ' . $response->get_error_message());
            }
            // Log the failed attempt so the Activity page surfaces it.
            $this->append_recent_event_log($path, $payload, null, $response->get_error_message(), $ms);
            return null;
        }
        if (!$blocking) {
            // Fire-and-forget: WP returns before the response exists, so there is
            // no status or body to read. Logged as dispatched so the Activity page
            // still shows the event was sent.
            $this->append_recent_event_log($path, $payload, null, 'sent (non-blocking)', $ms);
            return null;
        }
        $body_raw = wp_remote_retrieve_body($response);
        $body = json_decode($body_raw, true);
        $http_status = (int) wp_remote_retrieve_response_code($response);
        $this->append_recent_event_log($path, $payload, $http_status, $body_raw, $ms);
        return (is_array($body) ? $body : array()) + array('_http_status' => $http_status);
    }

    /**
     * Lazily-fetched plugin status (subscription enabled, last
     * received event, latest version). Cached for 5 minutes via a
     * WP transient so the Activity page loads instantly without
     * hammering the backend.
     */
    private function fetch_plugin_status($force_refresh = false) {
        $cache_key = 'adprotektor_plugin_status_v1';
        if (!$force_refresh) {
            $cached = get_transient($cache_key);
            if (is_array($cached)) return $cached;
        }
        $site_key = get_option('adprotektor_site_key', '');
        if (empty($site_key)) {
            return array('error' => 'no_site_key');
        }
        $url = ADPROTEKTOR_API_BASE . '/plugin/status';
        $response = wp_remote_get($url, array(
            'timeout' => 5,
            'headers' => array(
                'X-Adp-Site-Key' => $site_key,
                'X-Adp-Host' => wp_parse_url(home_url(), PHP_URL_HOST),
            ),
        ));
        if (is_wp_error($response)) {
            return array('error' => 'request_failed', 'message' => $response->get_error_message());
        }
        $body = json_decode(wp_remote_retrieve_body($response), true);
        if (!is_array($body)) {
            return array('error' => 'invalid_response', 'http_status' => (int) wp_remote_retrieve_response_code($response));
        }
        set_transient($cache_key, $body, 5 * MINUTE_IN_SECONDS);
        return $body;
    }

    /**
     * Read-only diagnostics page. Three sections:
     *   1. Connection status (subscription enabled, last ping, version)
     *   2. Recent activity log (last 20 outbound POSTs)
     *   3. Debug / environment (PHP/WP/relevant plugin versions + the
     *      country we derived from get_locale)
     *
     * NO inputs. Only the "Clear log" button which is purely local.
     * All settings stay in the AdProtektor dashboard.
     */
    public function activity_page() {
        // Handle the local "Clear log" form submission first.
        if (isset($_POST['adp_clear_log']) && check_admin_referer('adp_clear_log')) {
            delete_option('adprotektor_recent_events');
            // Re-load with autoload=no so subsequent appends keep the
            // setting non-autoloaded.
            update_option('adprotektor_recent_events', array(), false);
            echo '<div class="notice notice-success is-dismissible"><p>Recent events log cleared.</p></div>';
        }

        $status = $this->fetch_plugin_status();
        $events = get_option('adprotektor_recent_events', array());
        if (!is_array($events)) $events = array();

        $locale = function_exists('get_locale') ? (string) get_locale() : '(unknown)';
        $derived_country = $this->country_from_wp_locale();

        ?>
        <div class="wrap">
            <h1>AdProtektor Activity</h1>
            <p style="color:#666;max-width:720px;">Read-only diagnostics. All settings and configuration live in your <a href="https://app.adprotektor.app" target="_blank" rel="noopener">AdProtektor dashboard</a> — this page only shows what the plugin is doing.</p>

            <h2>Connection</h2>
            <table class="widefat striped" style="max-width:720px;">
                <tbody>
                    <tr><th style="width:240px;">Plugin version</th><td><code><?php echo esc_html(ADPROTEKTOR_VERSION); ?></code><?php
                        // Only surface an update notice when the backend
                        // reports a *newer* version. A plain string !==
                        // comparison flagged a downgrade as an "update"
                        // whenever the backend fell back to a stale default
                        // (e.g. 1.3.0 while this plugin is already 1.4.0).
                        if (isset($status['plugin_version_latest']) && version_compare((string) $status['plugin_version_latest'], ADPROTEKTOR_VERSION, '>')):
                    ?> &nbsp;<span style="color:#d63638;">Update available: <?php echo esc_html((string) $status['plugin_version_latest']); ?></span><?php endif; ?></td></tr>
                    <tr><th>ConversionOS</th><td><?php
                        if (isset($status['error'])) {
                            echo '<span style="color:#d63638;">Unknown — ' . esc_html((string) $status['error']) . '</span>';
                        } elseif (!empty($status['conversion_os_enabled'])) {
                            echo '<span style="color:#00a32a;">Enabled</span>';
                        } else {
                            echo '<span style="color:#d63638;">Disabled</span>';
                        }
                    ?></td></tr>
                    <tr><th>Last event received by backend</th><td><?php echo isset($status['last_event_received_at']) ? esc_html((string) $status['last_event_received_at']) : '<em>never</em>'; ?></td></tr>
                    <tr><th>First-party tracking (adblock bypass)</th><td><?php
                        $fp_on = get_option('adprotektor_firstparty_enabled') && get_option('adprotektor_site_key', '') !== '';
                        if ($fp_on) {
                            $fp_base = (defined('ADPROTEKTOR_BASE_PATH') ? ADPROTEKTOR_BASE_PATH : '/_adp');
                            echo '<span style="color:#00a32a;">Enabled</span> &nbsp;<span style="color:#888;">serving <code>' . esc_html($fp_base . '/t.js') . '</code></span>';
                        } elseif (get_option('adprotektor_firstparty_enabled')) {
                            echo '<span style="color:#d63638;">Off — needs a Site Key</span>';
                        } else {
                            echo '<span style="color:#888;">Disabled</span>';
                        }
                    ?></td></tr>
                    <tr><th>Detected country (from <code>get_locale()</code>)</th><td><?php echo $derived_country ? '<code>' . esc_html($derived_country) . '</code>' : '<em>none</em>'; ?> &nbsp;<span style="color:#888;">(locale: <code><?php echo esc_html($locale); ?></code>)</span></td></tr>
                </tbody>
            </table>

            <h2 style="margin-top:24px;">Recent activity (last <?php echo (int) ADPROTEKTOR_RECENT_EVENTS_CAP; ?>)</h2>
            <?php if (empty($events)): ?>
                <p><em>No events sent yet.</em></p>
            <?php else: ?>
                <table class="widefat striped">
                    <thead><tr>
                        <th style="width:160px;">When (UTC)</th>
                        <th>Event</th>
                        <th>Order</th>
                        <th style="width:80px;">HTTP</th>
                        <th style="width:80px;">Latency</th>
                        <th>Response excerpt</th>
                    </tr></thead>
                    <tbody>
                        <?php foreach ($events as $ev): ?>
                            <tr>
                                <td><code><?php echo esc_html($ev['ts'] ?? ''); ?></code></td>
                                <td><?php echo esc_html($ev['event_name'] ?? ''); ?></td>
                                <td><?php echo $ev['order_id'] !== null ? '<code>' . esc_html((string) $ev['order_id']) . '</code>' : '—'; ?></td>
                                <td><?php
                                    $http = $ev['http_status'] ?? null;
                                    if ($http === null) echo '<span style="color:#d63638;">err</span>';
                                    elseif ($http >= 200 && $http < 300) echo '<span style="color:#00a32a;">' . esc_html((string) $http) . '</span>';
                                    else echo '<span style="color:#d63638;">' . esc_html((string) $http) . '</span>';
                                ?></td>
                                <td><?php echo isset($ev['ms']) ? esc_html((string) $ev['ms']) . ' ms' : ''; ?></td>
                                <td style="font-family:monospace;font-size:11px;color:#666;"><?php echo esc_html((string) ($ev['response_excerpt'] ?? '')); ?></td>
                            </tr>
                        <?php endforeach; ?>
                    </tbody>
                </table>
                <form method="post" style="margin-top:12px;">
                    <?php wp_nonce_field('adp_clear_log'); ?>
                    <button type="submit" name="adp_clear_log" value="1" class="button">Clear log</button>
                </form>
            <?php endif; ?>

            <h2 style="margin-top:24px;">Environment</h2>
            <table class="widefat" style="max-width:720px;">
                <tbody>
                    <tr><th style="width:240px;">PHP version</th><td><code><?php echo esc_html(PHP_VERSION); ?></code></td></tr>
                    <tr><th>WordPress version</th><td><code><?php echo esc_html(function_exists('get_bloginfo') ? get_bloginfo('version') : '(unknown)'); ?></code></td></tr>
                    <?php
                    $relevant = array(
                        'WooCommerce' => 'woocommerce/woocommerce.php',
                        'Gravity Forms' => 'gravityforms/gravityforms.php',
                        'WPForms Lite' => 'wpforms-lite/wpforms.php',
                        'WPForms' => 'wpforms/wpforms.php',
                        'Contact Form 7' => 'contact-form-7/wp-contact-form-7.php',
                        'Elementor Pro' => 'elementor-pro/elementor-pro.php',
                    );
                    foreach ($relevant as $label => $slug):
                        $active = function_exists('is_plugin_active') ? is_plugin_active($slug) : false;
                    ?>
                        <tr><th><?php echo esc_html($label); ?></th><td><?php echo $active ? '<span style="color:#00a32a;">active</span>' : '<span style="color:#888;">inactive</span>'; ?></td></tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php
    }
}

AdProtektor::get_instance();