<?php
// Citami Connector — module. Loaded by citami-connector.php in a fixed
// order; never load this file on its own.
if (!defined('ABSPATH')) {
    exit;
}

/* ────────────────────────────────────────────────────────────────── */
/*  Settings page — admin configures the API key here                  */
/* ────────────────────────────────────────────────────────────────── */

add_action('admin_menu', function () {
    // 2.38 — a top-level menu: the product has its own place, not a row
    // under Settings. The submenu entry is renamed "Overview" so the
    // menu does not repeat the product name.
    add_menu_page(
        citami_brand_product(),
        citami_brand_name(),
        'manage_options',
        CITAMI_ADMIN_SLUG,
        'citami_settings_page',
        citami_admin_menu_icon(),
        58.7
    );
    add_submenu_page(CITAMI_ADMIN_SLUG, citami_brand_product(), citami_t('Panoramica', 'Overview'), 'manage_options', CITAMI_ADMIN_SLUG, 'citami_settings_page');
});

/**
 * Sanitize the API key. Citami issues 32+ char alphanum keys; reject
 * anything shorter (a typo or partial paste) and keep the previous
 * value. Surfaces an admin notice describing the rejection.
 */
function citami_sanitize_api_key($value) {
    $value = sanitize_text_field((string) $value);
    if ($value === '') {
        // Empty value clears a saved key (allowed — used to disconnect). With no saved key
        // and a key preloaded in the package, saving the form is the owner's consent: the
        // preloaded key becomes the saved one (2.70.2, never used before that).
        $saved = get_option('citami_api_key', '');
        if ((!is_string($saved) || trim($saved) === '') && function_exists('citami_preloaded_api_key')) {
            return citami_preloaded_api_key();
        }
        return '';
    }
    if (strlen($value) < 32) {
        add_settings_error(
            'citami_settings',
            'citami_short_api_key',
            citami_brand_text('API key Citami troppo corta (richiesti 32+ caratteri). Controlla di averla incollata per intero.')
        );
        // Keep the previous value rather than overwriting with a
        // half-pasted key.
        return get_option('citami_api_key', '');
    }
    return $value;
}

/**
 * Sanitize the endpoint URL. Must be a valid absolute URL with http(s).
 * Falls back to the previous value if filter_var rejects it.
 */
function citami_sanitize_endpoint($value) {
    $value = esc_url_raw((string) $value);
    if ($value === '') {
        return citami_default_endpoint();
    }
    if (filter_var($value, FILTER_VALIDATE_URL) === false) {
        add_settings_error(
            'citami_settings',
            'citami_bad_endpoint_url',
            citami_brand_text('Endpoint Citami non valido. Inserisci un URL completo, es. https://citami.ai')
        );
        return get_option('citami_endpoint', citami_default_endpoint());
    }
    $scheme = wp_parse_url($value, PHP_URL_SCHEME);
    if ($scheme !== 'http' && $scheme !== 'https') {
        add_settings_error(
            'citami_settings',
            'citami_bad_endpoint_scheme',
            citami_brand_text('Endpoint Citami deve usare http(s).')
        );
        return get_option('citami_endpoint', citami_default_endpoint());
    }
    return rtrim($value, '/');
}

function citami_sanitize_review_only($value) {
    return ($value === '1' || $value === 1 || $value === 'on' || $value === true) ? '1' : '0';
}

add_action('admin_init', function () {
    register_setting('citami_settings', 'citami_api_key', array(
        'type'              => 'string',
        'sanitize_callback' => 'citami_sanitize_api_key',
        'default'           => '',
    ));
    register_setting('citami_settings', 'citami_endpoint', array(
        'type'              => 'string',
        'sanitize_callback' => 'citami_sanitize_endpoint',
        'default'           => citami_default_endpoint(),
    ));
    register_setting('citami_settings', CITAMI_REVIEW_ONLY_OPT, array(
        'type'              => 'string',
        'sanitize_callback' => 'citami_sanitize_review_only',
        'default'           => '1',
    ));
    // v2.11.0 — CONFIGURABLE-SLUGS (gap M2): slug extra per il
    // rilevamento pagine about/faq, fusi con i default hardcoded.
    register_setting('citami_settings', CITAMI_ABOUT_SLUGS_OPT, array(
        'type'              => 'string',
        'sanitize_callback' => 'citami_sanitize_slug_list',
        'default'           => '',
    ));
    register_setting('citami_settings', CITAMI_FAQ_SLUGS_OPT, array(
        'type'              => 'string',
        'sanitize_callback' => 'citami_sanitize_slug_list',
        'default'           => '',
    ));
});

function citami_settings_page() {
    if (!current_user_can('manage_options')) return;

    // ?tab=… picks the screen; default = overview (2.38).
    $active_tab = isset($_GET['tab']) ? sanitize_key((string) $_GET['tab']) : 'overview'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only: which screen to show
    if (!in_array($active_tab, citami_ui_tab_ids(), true)) {
        $active_tab = 'overview';
    }

    $queue = get_option(CITAMI_FIX_QUEUE_OPT, array());
    $queue_array = is_array($queue) ? $queue : array();
    $pending_count = 0;
    foreach ($queue_array as $fix) {
        $status = is_array($fix) && isset($fix['status']) ? (string) $fix['status'] : 'pending';
        if ($status === 'pending') $pending_count++;
    }

    // Connection state at a glance (2.46 — one state, with the reason as tooltip and a link to fix it).
    $conn = citami_connection_state();
    $pill_class = 'citami-pill--' . $conn['class'];
    $pill_text = $conn['label'];
    $nav = citami_ui_nav_items($pending_count);
    $labels = array();
    foreach ($nav as $it) {
        $labels[$it['id']] = $it['label'];
    }
    $labels['setup'] = citami_t('Primo avvio guidato', 'Guided first run');
    $dashboard_url = citami_lang_url(citami_brand_site() . '/dashboard');
    ?>
    <div class="wrap citami-wrap citami-app" data-citami-tab="<?php echo esc_attr($active_tab); ?>" data-citami-filter-label="<?php echo esc_attr(citami_t('Filtra…', 'Filter…')); ?>">
        <header class="citami-topbar">
            <a class="citami-brand" href="<?php echo esc_url(citami_admin_url()); ?>">
                <span class="citami-mark" aria-hidden="true">C</span>
                <span class="citami-brand-text">
                    <span class="citami-brand-name"><?php echo esc_html(citami_brand_product()); ?></span>
                    <span class="citami-version">v<?php echo esc_html(CITAMI_PLUGIN_VERSION); ?></span>
                </span>
            </a>
            <a class="citami-pill <?php echo esc_attr($pill_class); ?>" href="<?php echo esc_url($conn['href']); ?>" title="<?php echo esc_attr($conn['hint']); ?>" data-citami="connection-pill" data-state="<?php echo esc_attr($conn['state']); ?>"><?php echo esc_html($pill_text); ?></a>
            <?php if (citami_is_free_account()): ?><span class="citami-pill citami-pill--plan" data-citami="plan-free" title="<?php echo esc_attr(citami_t('Account gratuito: tutte le funzioni, con quote mensili ridotte.', 'Free account: every feature, with smaller monthly quotas.')); ?>"><?php echo esc_html(citami_t('Account gratuito', 'Free account')); ?></span><?php endif; ?>
            <div class="citami-topbar-actions">
                <?php if (function_exists('citami_setup_url')): ?><a class="citami-btn citami-btn--ghost" href="<?php echo esc_url(citami_setup_url(1)); ?>"><?php echo wp_kses(citami_ui_icon('setup'), citami_kses_allowed()); ?> <?php echo esc_html(citami_t('Primo avvio guidato', 'Guided first run')); ?></a><?php endif; ?>
                <?php if (citami_get_api_key() === ''): ?>
                <a class="citami-btn citami-btn--primary" href="<?php echo esc_url(function_exists('citami_connect_start_url') ? citami_connect_start_url() : citami_signup_url('header')); ?>" data-citami="signup"><?php echo esc_html(citami_t('Collega con un clic', 'Connect with one click')); ?></a>
                <?php elseif (citami_is_free_account()): ?>
                <a class="citami-btn citami-btn--ghost" href="<?php echo esc_url($dashboard_url); ?>" target="_blank" rel="noopener"><?php echo esc_html(citami_t('Apri la dashboard', 'Open the dashboard')); ?> <?php echo wp_kses(citami_ui_icon('external'), citami_kses_allowed()); ?></a>
                <a class="citami-btn citami-btn--primary" href="<?php echo esc_url(citami_upgrade_url('header')); ?>" target="_blank" rel="noopener" data-citami="upgrade-header"><?php echo esc_html(citami_t('Passa a un piano', 'See the plans')); ?></a>
                <?php else: ?>
                <a class="citami-btn citami-btn--primary" href="<?php echo esc_url($dashboard_url); ?>" target="_blank" rel="noopener"><?php echo esc_html(citami_t('Apri la dashboard', 'Open the dashboard')); ?> <?php echo wp_kses(citami_ui_icon('external'), citami_kses_allowed()); ?></a>
                <?php endif; ?>
            </div>
        </header>

        <div class="citami-layout">
            <nav class="citami-nav" aria-label="<?php echo esc_attr(citami_brand_product()); ?>">
                <?php $nav_group = ''; foreach ($nav as $it): ?>
                    <?php if (!empty($it['group']) && $it['group'] !== $nav_group): $nav_group = $it['group']; ?><span class="citami-nav-group"><?php echo esc_html($nav_group); ?></span><?php endif; ?>
                    <a class="citami-nav-item <?php echo $active_tab === $it['id'] ? 'is-active' : ''; ?>" href="<?php echo esc_url(citami_admin_url($it['id'])); ?>" <?php echo $active_tab === $it['id'] ? 'aria-current="page"' : ''; ?>>
                        <?php echo wp_kses(citami_ui_icon($it['icon']), citami_kses_allowed()); ?>
                        <span><?php echo esc_html($it['label']); ?></span>
                        <?php if (!empty($it['badge'])): ?><b class="citami-badge"><?php echo (int) $it['badge']; ?></b><?php endif; ?>
                    </a>
                <?php endforeach; ?>
            </nav>

            <main class="citami-main">
                <?php if ($active_tab !== 'overview'): ?>
                <div class="citami-page-head">
                    <h1 class="citami-page-title"><?php echo esc_html(isset($labels[$active_tab]) ? $labels[$active_tab] : $active_tab); ?></h1>
                </div>
                <?php endif; ?>
                <div class="citami-notices">
                <?php
                // Surface admin notices from any handler (settings save OR
                // approve/reject action). The transient pattern is used by the
                // approve/reject redirect since admin_post handlers can't emit
                // settings_errors directly.
                settings_errors('citami_settings');
                // 2.59 — options.php comes back with settings-updated: say so (the WordPress
                // "Settings saved." message belongs to the general screen and never showed here).
                // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only
                if (!empty($_GET['settings-updated']) && !get_settings_errors('citami_settings')) {
                    echo '<div class="notice notice-success is-dismissible" data-citami="saved-notice"><p>' . esc_html(citami_t('Impostazioni salvate.', 'Settings saved.')) . '</p></div>';
                }
                $action_notice = get_transient('citami_action_notice');
                if (is_array($action_notice) && !empty($action_notice['message'])) {
                    $type = !empty($action_notice['type']) ? $action_notice['type'] : 'info';
                    printf(
                        '<div class="notice notice-%s is-dismissible"><p>%s</p></div>',
                        esc_attr($type),
                        wp_kses(citami_notice_text_html($action_notice), citami_kses_allowed())
                    );
                    delete_transient('citami_action_notice');
                }
                ?>
                </div>

                <div class="citami-tab-body citami-tab-body--<?php echo esc_attr($active_tab); ?>">
                <?php if ($active_tab === 'overview'): ?>
                    <?php citami_render_overview_tab(); ?>
                <?php elseif ($active_tab === 'pending'): ?>
                    <?php citami_render_pending_fixes_tab($queue_array); ?>
                <?php elseif ($active_tab === 'seo'): ?>
                    <?php citami_render_seo_settings_tab(); ?>
                <?php elseif ($active_tab === 'import'): ?>
                    <?php citami_render_import_tab(); ?>
                <?php elseif ($active_tab === 'bots'): ?>
                    <?php citami_render_bots_tab(); ?>
                <?php elseif ($active_tab === 'redirects'): ?>
                    <?php citami_render_redirects_tab(); ?>
                <?php elseif ($active_tab === 'local'): ?>
                    <?php citami_render_local_tab(); ?>
                <?php elseif ($active_tab === 'pages'): ?>
                    <?php citami_render_pages_tab(); ?>
                <?php elseif ($active_tab === 'gsc'): ?>
                    <?php citami_render_gsc_tab(); ?>
                <?php elseif ($active_tab === 'articles'): ?>
                    <?php citami_render_articles_tab(); ?>
                <?php elseif ($active_tab === 'links'): ?>
                    <?php citami_render_links_tab(); ?>
                <?php elseif ($active_tab === 'brand'): ?>
                    <?php citami_render_brand_tab(); ?>
                <?php elseif ($active_tab === 'setup'): ?>
                    <?php citami_render_setup_tab(); ?>
                <?php else: ?>
                    <?php citami_render_general_settings_tab($queue_array); ?>
                <?php endif; ?>
                </div><!-- .citami-tab-body -->
            </main>
        </div>
        <div class="citami-savebar" hidden>
            <span><?php echo esc_html(citami_t('Modifiche non salvate', 'Unsaved changes')); ?></span>
            <button type="button" class="citami-btn citami-btn--primary" data-citami-save><?php echo esc_html(citami_t('Salva', 'Save')); ?></button>
        </div>
    </div>
    <?php
}

/**
 * Renders the General Settings tab (the original v2.0 settings UI).
 * Extracted as a function so the tab switcher in citami_settings_page
 * stays readable.
 */
function citami_render_general_settings_tab(array $queue) {
    $buffer = get_option(CITAMI_BUFFER_OPT, array());
    $buffer_count = is_array($buffer) ? count($buffer) : 0;
    $queue_count = count($queue);
    $review_only = citami_is_review_only();
    ?>
    <div class="citami-page-head">
        <p class="citami-muted"><?php echo wp_kses_post(citami_t(
            "Collega questo sito alla dashboard Citami. Se hai scaricato lo ZIP dalla dashboard, la chiave è già precaricata e non serve incollarla. Altrimenti: <a href=\"https://citami.ai/dashboard/settings/plugin\" target=\"_blank\">Impostazioni → Plugin</a> → bottone <strong>«Mostra API key»</strong> → Copia.",
            'Connect this site to your Citami dashboard. If you downloaded the ZIP from the dashboard, the key is already preloaded — no need to paste it. Otherwise: <a href="https://citeproof.co/dashboard/settings/plugin" target="_blank">Settings → Plugin</a> → <strong>"Show API key"</strong> button → Copy.'
        )); ?></p>
    </div>

    <div class="citami-settings-layout">
        <form method="post" action="options.php" class="citami-card citami-settings-form" data-citami="settings-form">
            <header class="citami-card-head">
                <div>
                    <span class="citami-eyebrow"><?php echo esc_html(citami_t('Collegamento e opzioni', 'Connection and options')); ?></span>
                    <p class="citami-muted"><?php echo esc_html(citami_t('Chiave, indirizzo della piattaforma e come arrivano i fix.', 'Key, platform address and how fixes arrive.')); ?></p>
                </div>
            </header>
            <?php
            // settings_fields() emits the nonce + option-page hidden fields
            // required by options.php to verify this submission. We add an
            // explicit wp_nonce_field as belt-and-suspenders documentation
            // — it's not strictly required (settings_fields covers it) but
            // it makes the nonce contract visible to anyone reading the
            // form.
            settings_fields('citami_settings');
            wp_nonce_field('citami_save_settings', '_citami_settings_nonce');
            ?>
            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><label for="citami_api_key">API Key</label></th>
                    <td>
                        <?php
                        // v2.7.1 — PRELOAD-HINT. Se lo ZIP arriva dal
                        // download personalizzato della dashboard, la
                        // chiave è già dentro: il campo vuoto faceva
                        // credere che mancasse e l'utente incollava il
                        // PREFISSO (ctm_xxxxxxxx, 12 char) mostrato
                        // nella cronologia download → "API key troppo
                        // corta" (successo ad Adrian su makeupon.it).
                        $citami_saved_key   = get_option('citami_api_key', '');
                        $citami_active_key  = citami_get_api_key(true);
                        $citami_is_preload  = ($citami_saved_key === '' || !is_string($citami_saved_key)) && $citami_active_key !== '';
                        // Con preload attivo il campo è RIPIEGATO in un
                        // <details>: nessuno deve più chiedersi se va
                        // riempito (Adrian: "non vorrei che qualcuno si
                        // fermi lì"). La chiave intera non si stampa
                        // mai nel form — resta un segreto, solo il
                        // prefisso è visibile. Submit col campo vuoto =
                        // '' → il sanitize lo accetta e
                        // citami_get_api_key() ricade sulla preloadata.
                        if ($citami_is_preload) :
                        ?>
                        <p class="citami-card-notice" data-citami="key-preloaded">
                            <?php echo esc_html(sprintf(
                                citami_t(
                                    '✓ Chiave già configurata dal download (prefisso %s…). Non devi fare nulla qui.',
                                    '✓ Key already configured from your download (prefix %s…). Nothing to do here.'
                                ),
                                substr($citami_active_key, 0, 12)
                            )); ?>
                        </p>
                        <details class="citami-settings-fold">
                            <summary><?php echo esc_html(citami_t('Devi sostituire la chiave (es. dopo una rotazione)? Mostra il campo', 'Need to replace the key (e.g. after a rotation)? Show the field')); ?></summary>
                            <span class="citami-settings-secret">
                                <input type="password" class="regular-text" id="citami_api_key" name="citami_api_key" value="" autocomplete="off">
                                <button type="button" class="citami-btn citami-btn--ghost citami-btn--small" data-citami-toggle-secret="citami_api_key" data-show-label="<?php echo esc_attr(citami_t('Mostra', 'Show')); ?>" data-hide-label="<?php echo esc_attr(citami_t('Nascondi', 'Hide')); ?>"><?php echo esc_html(citami_t('Mostra', 'Show')); ?></button>
                            </span>
                            <p class="description"><?php echo esc_html(citami_t('Incolla la chiave completa (68 caratteri, inizia con ctm_) — NON il prefisso breve della cronologia download. La trovi nella dashboard: Impostazioni → Plugin → «Mostra API key». Lascia vuoto per continuare a usare la chiave precaricata.', 'Paste the full key (68 characters, starts with ctm_) — NOT the short prefix from the download history. Find it in your dashboard: Settings → Plugin → "Show API key". Leave empty to keep using the preloaded key.')); ?></p>
                        </details>
                        <?php else : ?>
                        <span class="citami-settings-secret">
                            <input type="password" class="regular-text" id="citami_api_key" name="citami_api_key" value="<?php echo esc_attr($citami_saved_key); ?>" autocomplete="off" spellcheck="false">
                            <button type="button" class="citami-btn citami-btn--ghost citami-btn--small" data-citami-toggle-secret="citami_api_key" data-show-label="<?php echo esc_attr(citami_t('Mostra', 'Show')); ?>" data-hide-label="<?php echo esc_attr(citami_t('Nascondi', 'Hide')); ?>"><?php echo esc_html(citami_t('Mostra', 'Show')); ?></button>
                        </span>
                        <?php if ($citami_saved_key === '') echo wp_kses(citami_get_key_html('settings'), citami_kses_allowed()); ?>
                        <p class="description"><?php echo esc_html(citami_t('Serve la chiave completa (68 caratteri, inizia con ctm_) — NON il prefisso breve mostrato nella cronologia download. La trovi nella dashboard: Impostazioni → Plugin → «Mostra API key» → Copia.', 'Paste the full key (68 characters, starts with ctm_) — NOT the short prefix shown in the download history. Find it in your dashboard: Settings → Plugin → "Show API key" → Copy.')); ?></p>
                        <?php echo wp_kses(citami_connect_disclosure_html(), citami_kses_allowed()); ?>
                        <?php endif; ?>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="citami_endpoint">Endpoint</label></th>
                    <td>
                        <input type="url" class="regular-text" id="citami_endpoint" name="citami_endpoint" value="<?php echo esc_attr(get_option('citami_endpoint', citami_default_endpoint())); ?>">
                        <p class="description"><?php echo esc_html(citami_t('URL completo, es.', 'Full URL, e.g.')); ?> <code><?php echo esc_html(citami_default_endpoint()); ?></code> <?php echo esc_html(citami_t('Non cambiarlo se non te lo chiede il supporto.', 'Leave it as is unless support asks you to change it.')); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row">
                        <label for="<?php echo esc_attr(CITAMI_REVIEW_ONLY_OPT); ?>"><?php echo esc_html(citami_t('Approvazione manuale', 'Manual approval')); ?></label>
                    </th>
                    <td>
                        <?php
                        // The hidden input below is intentional: WP Settings
                        // API checkboxes don't submit when unchecked, which
                        // would silently preserve the previous value and
                        // make "uncheck to disable" a no-op. Posting '0'
                        // first means PHP's $_POST always carries a value;
                        // a checked checkbox's '1' overrides it because
                        // it's later in the form.
                        ?>
                        <input type="hidden" name="<?php echo esc_attr(CITAMI_REVIEW_ONLY_OPT); ?>" value="0">
                        <label class="citami-switch-row">
                            <input type="checkbox"
                                   id="<?php echo esc_attr(CITAMI_REVIEW_ONLY_OPT); ?>"
                                   name="<?php echo esc_attr(CITAMI_REVIEW_ONLY_OPT); ?>"
                                   value="1" <?php checked($review_only, true); ?><?php if ($review_only): // 2.60 — on → off asks first: from then on fixes change the site by themselves. ?> data-citami="review-only-toggle" onchange="if (!this.checked &amp;&amp; !confirm('<?php echo esc_js(citami_t('Da ora i fix si applicano da soli (head, llms.txt, robots.txt). Continuare?', 'From now on fixes apply on their own (head, llms.txt, robots.txt). Continue?')); ?>')) { this.checked = true; }"<?php endif; ?>>
                            <span><?php echo esc_html(citami_t('Metti in coda i fix e aspetta la mia approvazione (nessuna modifica automatica a', 'Queue fixes and wait for my approval (no automatic changes to')); ?> <code>&lt;head&gt;</code>, <code>llms.txt</code>, <code>robots.txt</code>)</span>
                        </label>
                        <p class="description">
                            <strong><?php echo esc_html(citami_t('Consigliato: attivo.', 'Recommended: on.')); ?></strong> <?php echo esc_html(sprintf(citami_t('I fix che arrivano da %s restano in "Fix in coda" finché non li approvi. Spegnilo quando ti fidi: da quel momento si applicano da soli e restano revocabili.', 'Fixes from %s wait in "Pending fixes" until you approve them. Turn it off once you trust them: from then on they apply on their own and stay revocable.'), citami_brand_name())); ?>
                        </p>
                    </td>
                </tr>
                <tr>
                    <th scope="row">
                        <label for="<?php echo esc_attr(CITAMI_ABOUT_SLUGS_OPT); ?>"><?php echo esc_html(citami_t('Slug pagina Chi siamo', '"About us" page slugs')); ?></label>
                    </th>
                    <td>
                        <input type="text" class="regular-text"
                               id="<?php echo esc_attr(CITAMI_ABOUT_SLUGS_OPT); ?>"
                               name="<?php echo esc_attr(CITAMI_ABOUT_SLUGS_OPT); ?>"
                               value="<?php echo esc_attr(get_option(CITAMI_ABOUT_SLUGS_OPT, '')); ?>"
                               placeholder="<?php echo esc_attr(citami_t('es. la-nostra-azienda, il-team', 'e.g. our-company, the-team')); ?>">
                        <p class="description"><?php echo esc_html(citami_t(
                            'Slug aggiuntivi (separati da virgola) delle pagine su cui stampare lo schema AboutPage. Si AGGIUNGONO ai default (about, chi-siamo, ...), non li sostituiscono. Lascia vuoto se la tua pagina usa già uno slug standard.',
                            'Extra slugs (comma-separated) of the pages where the AboutPage schema should print. They are ADDED to the built-in defaults (about, chi-siamo, ...), never replacing them. Leave empty if your page already uses a standard slug.'
                        )); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row">
                        <label for="<?php echo esc_attr(CITAMI_FAQ_SLUGS_OPT); ?>"><?php echo esc_html(citami_t('Slug pagina FAQ', 'FAQ page slugs')); ?></label>
                    </th>
                    <td>
                        <input type="text" class="regular-text"
                               id="<?php echo esc_attr(CITAMI_FAQ_SLUGS_OPT); ?>"
                               name="<?php echo esc_attr(CITAMI_FAQ_SLUGS_OPT); ?>"
                               value="<?php echo esc_attr(get_option(CITAMI_FAQ_SLUGS_OPT, '')); ?>"
                               placeholder="<?php echo esc_attr(citami_t('es. domande-e-risposte, assistenza', 'e.g. questions-and-answers, help')); ?>">
                        <p class="description"><?php echo esc_html(citami_t(
                            'Slug aggiuntivi (separati da virgola) delle pagine su cui stampare lo schema FAQPage. Si AGGIUNGONO ai default (faq, domande-frequenti, ...), non li sostituiscono.',
                            'Extra slugs (comma-separated) of the pages where the FAQPage schema should print. They are ADDED to the built-in defaults (faq, domande-frequenti, ...), never replacing them.'
                        )); ?></p>
                    </td>
                </tr>
            </table>
            <p class="citami-form-foot">
                <button type="submit" class="citami-btn citami-btn--primary" data-citami-busy="<?php echo esc_attr(citami_t('Salvo…', 'Saving…')); ?>"><?php echo esc_html(citami_t('Salva le modifiche', 'Save changes')); ?></button>
            </p>
        </form>
        <?php citami_render_settings_status_card($queue, $buffer_count, $queue_count, $review_only); ?>
    </div>
    <?php
}

/**
 * 2.61 — the Settings "Stato" card: one row per fact (dot, label, value),
 * the long explanations folded. Reads the LAST stored check (written by
 * the cron, by saving key/endpoint and by "Check connection"): rendering
 * never waits on the platform, except for a site never checked at all,
 * which is pinged inline once.
 */
function citami_render_settings_status_card(array $queue, $buffer_count, $queue_count, $review_only) {
    $citami_health = get_option(CITAMI_HEALTH_OPT, array());
    $citami_health_ts = is_array($citami_health) && !empty($citami_health['ts']) ? intval($citami_health['ts']) : 0;
    if (citami_get_api_key() !== '' && $citami_health_ts === 0) {
        $citami_health = citami_health_ping();
        $citami_health_ts = is_array($citami_health) && !empty($citami_health['ts']) ? intval($citami_health['ts']) : 0;
    }
    $citami_health_ok  = is_array($citami_health) && !empty($citami_health['ok']);
    $citami_health_msg = is_array($citami_health) && !empty($citami_health['message'])
        ? (string) $citami_health['message']
        : citami_t('mai verificata (inserisci API key ed endpoint)', 'never checked (enter API key and endpoint)');
    $citami_health_when = $citami_health_ts > 0
        ? wp_date(get_option('date_format') . ' ' . get_option('time_format'), $citami_health_ts)
        : '';
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only: which line to highlight
    $citami_health_focus = isset($_GET['focus']) && (string) $_GET['focus'] === 'health';
    $citami_health_notice = $citami_health_focus ? get_transient('citami_health_check_notice') : null;
    if (is_array($citami_health_notice) && !empty($citami_health_notice['message'])) {
        delete_transient('citami_health_check_notice');
    } else {
        $citami_health_notice = null;
    }
    $citami_pending_n = 0;
    foreach ($queue as $citami_fix) {
        if (is_array($citami_fix) && (!isset($citami_fix['status']) || $citami_fix['status'] === 'pending')) {
            $citami_pending_n++;
        }
    }
    $citami_update = defined('CITAMI_UPDATE_TRANSIENT') ? get_transient(CITAMI_UPDATE_TRANSIENT) : false;
    $citami_update_version = is_array($citami_update) && !empty($citami_update['version']) && version_compare((string) $citami_update['version'], CITAMI_PLUGIN_VERSION, '>')
        ? (string) $citami_update['version']
        : '';
    $citami_has_key = citami_get_api_key() !== '';
    $citami_conn = citami_connection_state();
    $citami_silence = citami_cron_silence();
    $citami_cron_dot = $citami_conn['state'] === 'cron' ? 'warn' : ($citami_silence === null ? 'muted' : 'good');
    ?>
    <aside class="citami-card citami-settings-status" data-citami="settings-status">
        <header class="citami-card-head">
            <span class="citami-eyebrow"><?php echo esc_html(citami_t('Stato', 'Status')); ?></span>
            <span class="citami-pill citami-pill--<?php echo esc_attr($citami_conn['class']); ?>"><?php echo esc_html($citami_conn['label']); ?></span>
        </header>
        <ul class="citami-status citami-settings-rows">
            <li id="citami-health" class="<?php echo $citami_health_focus ? 'is-focus' : ''; ?>" data-citami="health">
                <span class="citami-dot citami-dot--<?php echo $citami_health_ok ? 'good' : ($citami_has_key ? 'bad' : 'muted'); ?>"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Connessione a Citami', 'Citami connection')); ?></span>
                <span class="citami-settings-v">
                    <strong class="<?php echo $citami_health_ok ? 'citami-good' : ($citami_has_key ? 'citami-bad' : 'citami-muted'); ?>"><?php echo esc_html($citami_health_msg); ?></strong>
                    <?php if ($citami_health_when !== '') : ?>
                        <small><?php echo esc_html(sprintf(citami_t('ultima verifica %s', 'last checked %s'), $citami_health_when)); ?></small>
                    <?php endif; ?>
                </span>
                <?php if ($citami_has_key): ?>
                <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="citami-inline-form citami-settings-check">
                    <?php wp_nonce_field('citami_settings_action', '_citami_settings_nonce'); ?>
                    <input type="hidden" name="action" value="citami_settings_action">
                    <input type="hidden" name="do" value="check">
                    <button type="submit" class="citami-btn citami-btn--small" data-citami="health-check" data-citami-busy="<?php echo esc_attr(citami_t('Verifico…', 'Checking…')); ?>"><?php echo esc_html(citami_t('Verifica connessione', 'Check connection')); ?></button>
                </form>
                <?php endif; ?>
                <?php if ($citami_health_notice): ?>
                    <p class="citami-card-notice citami-card-notice--<?php echo esc_attr(isset($citami_health_notice['type']) ? $citami_health_notice['type'] : 'info'); ?>" data-citami="health-notice" role="status"><?php echo esc_html($citami_health_notice['message']); ?></p>
                <?php endif; ?>
            </li>
            <li data-citami="cron" data-state="<?php echo esc_attr($citami_conn['state']); ?>">
                <span class="citami-dot citami-dot--<?php echo esc_attr($citami_cron_dot); ?>"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Cron di WordPress', 'WordPress cron')); ?></span>
                <span class="citami-settings-v"><?php echo esc_html($citami_silence === null ? citami_t('nessun giro registrato ancora', 'no run recorded yet') : sprintf(citami_t('ultimo giro %s fa', 'last run %s ago'), human_time_diff(time() - $citami_silence))); ?></span>
                <?php if ($citami_conn['state'] === 'cron'): ?>
                <div class="citami-settings-warn" data-citami="cron-warning">
                    <p><?php echo esc_html(citami_t('Il cron è fermo: la dashboard può segnare il sito come non connesso.', 'Cron is stalled: the dashboard may mark the site as not connected.')); ?></p>
                    <details>
                        <summary><?php echo esc_html(citami_t('Come risolvere', 'How to fix it')); ?></summary>
                        <p><?php echo esc_html($citami_conn['hint']); ?></p>
                    </details>
                </div>
                <?php endif; ?>
            </li>
            <?php $citami_usage_line = citami_usage_summary(); if ($citami_usage_line !== ''): $citami_usage_level = citami_usage_worst_level(); $citami_u = citami_usage(); ?>
            <li data-citami="usage" data-level="<?php echo esc_attr($citami_usage_level); ?>" title="<?php echo esc_attr($citami_usage_line); ?>">
                <span class="citami-dot citami-dot--<?php echo esc_attr($citami_usage_level === 'exhausted' ? 'bad' : ($citami_usage_level === 'near' ? 'warn' : 'good')); ?>"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Consumi del mese', 'This month\'s usage')); ?></span>
                <span class="citami-settings-meters">
                    <?php foreach (array('alt_text' => citami_t('Alt text', 'Alt texts'), 'aeo_draft' => citami_t('Bozze AI', 'AI drafts')) as $citami_k => $citami_lbl):
                        $citami_c = is_array($citami_u) && isset($citami_u[$citami_k]) ? $citami_u[$citami_k] : array('used' => 0, 'quota' => 0, 'level' => 'ok');
                        $citami_pct = (int) $citami_c['quota'] > 0 ? min(100, (int) round(100 * (int) $citami_c['used'] / (int) $citami_c['quota'])) : 100; ?>
                    <span class="citami-settings-meter citami-settings-meter--<?php echo esc_attr($citami_c['level']); ?>">
                        <span class="citami-settings-meter-k"><?php echo esc_html($citami_lbl); ?> <b><?php echo esc_html(sprintf('%d/%d', (int) $citami_c['used'], (int) $citami_c['quota'])); ?></b></span>
                        <span class="citami-settings-meter-bar" role="img" aria-label="<?php echo esc_attr($citami_pct . '%'); ?>"><span style="width:<?php echo (int) $citami_pct; ?>%"></span></span>
                    </span>
                    <?php endforeach; ?>
                    <small><?php echo esc_html($citami_usage_line); ?><?php if (citami_is_free_account()): ?> · <?php echo esc_html(citami_t('account gratuito', 'free account')); ?> · <?php echo wp_kses(citami_upgrade_link_html('settings_quota'), citami_kses_allowed()); ?><?php endif; ?></small>
                </span>
            </li>
            <?php endif; ?>
            <li data-citami="bot-buffer">
                <span class="citami-dot citami-dot--muted"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Visite di bot in attesa', 'Bot visits waiting')); ?></span>
                <span class="citami-settings-v"><strong><?php echo esc_html($buffer_count); ?></strong></span>
                <details class="citami-settings-more">
                    <summary><?php echo esc_html(citami_t('Cosa sono', 'What they are')); ?></summary>
                    <p><?php echo esc_html(sprintf(citami_t('Sono le visite dei crawler AI registrate sul sito e non ancora mandate a %s: partono con il prossimo invio automatico (ogni 5 minuti, quando gira il cron di WordPress), poi il numero torna a zero.', 'These are AI crawler visits recorded on the site and not yet sent to %s: they go with the next automatic send (every 5 minutes, when WordPress cron runs), then the number goes back to zero.'), citami_brand_name())); ?></p>
                </details>
            </li>
            <li data-citami="fix-count">
                <span class="citami-dot citami-dot--<?php echo $citami_pending_n > 0 ? 'warn' : ($queue_count > 0 ? 'good' : 'muted'); ?>"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Fix ricevuti (ultimi 50)', 'Fixes received (last 50)')); ?></span>
                <span class="citami-settings-v"><a href="<?php echo esc_url(citami_admin_url('pending')); ?>"><strong><?php echo esc_html($queue_count); ?></strong><?php if ($citami_pending_n > 0): ?> · <?php echo esc_html(sprintf(citami_t('%d da approvare', '%d to approve'), $citami_pending_n)); ?><?php endif; ?> → <?php echo esc_html(citami_t('Fix in coda', 'Pending fixes')); ?></a></span>
            </li>
            <li data-citami="mode">
                <span class="citami-dot citami-dot--<?php echo $review_only ? 'good' : 'muted'; ?>"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Modalità', 'Mode')); ?></span>
                <span class="citami-settings-v"><strong><?php echo esc_html($review_only ? citami_t('approvazione manuale', 'manual approval') : citami_t('applicazione automatica', 'automatic')); ?></strong></span>
            </li>
            <li data-citami="version">
                <span class="citami-dot citami-dot--<?php echo $citami_update_version !== '' ? 'warn' : 'muted'; ?>"></span>
                <span class="citami-settings-k"><?php echo esc_html(citami_t('Versione plugin', 'Plugin version')); ?></span>
                <span class="citami-settings-v"><strong><?php echo esc_html(CITAMI_PLUGIN_VERSION); ?></strong>
                <?php if ($citami_update_version !== ''): ?>
                    · <a href="<?php echo esc_url(admin_url('plugins.php')); ?>" data-citami="update-available"><?php echo esc_html(sprintf(citami_t('Aggiornamento %s disponibile → Plugin', 'Update %s available → Plugins'), $citami_update_version)); ?></a>
                <?php endif; ?>
                </span>
            </li>
        </ul>
    </aside>
    <?php
}

/* ────────────────────────────────────────────────────────────────── */
/*  Pending Fixes tab (v2.1.0) — review/approve/reject queued fixes    */
/* ────────────────────────────────────────────────────────────────── */

/**
 * 2.60 — readable name of a fix type (the raw slug stays in the title attribute for support).
 */
function citami_fix_type_label($fix_type) {
    switch ((string) $fix_type) {
        case 'meta_tags':
            return citami_t("Meta tag nell'<head>", 'Meta tags in the <head>');
        case 'robots_txt':
            return citami_t('Regole robots.txt', 'robots.txt rules');
        case 'llms_txt':
            return citami_t('File llms.txt', 'llms.txt file');
        case 'schema_injection':
        case 'schema_markup':
            return citami_t('Dati strutturati (JSON-LD)', 'Structured data (JSON-LD)');
        case 'faq_page':
            return citami_t('Pagina FAQ', 'FAQ page');
    }
    return citami_t('Da fare a mano', 'To do by hand');
}

/** 2.60 — an ISO date of the queue, in the site's date and time format ('' when empty). */
function citami_fix_when($iso) {
    $iso = (string) $iso;
    if ($iso === '') {
        return '';
    }
    $ts = strtotime($iso);
    if (!$ts) {
        return $iso;
    }
    $df = (string) get_option('date_format');
    $tf = (string) get_option('time_format');
    return wp_date(($df !== '' ? $df : 'd/m/Y') . ' ' . ($tf !== '' ? $tf : 'H:i'), $ts);
}

/** 2.60 — status of a queue row: array(pill class, label). 2.61 — design-system pills. */
function citami_fix_status_label($status) {
    switch ((string) $status) {
        case 'pending':     return array('citami-pill--warn', citami_t('Da approvare', 'To approve'));
        case 'applied':     return array('citami-pill--ok', citami_t('Applicato', 'Applied'));
        case 'rejected':    return array('citami-pill--bad', citami_t('Rifiutato', 'Rejected'));
        case 'failed':      return array('citami-pill--bad', citami_t('Non riuscito', 'Failed'));
        case 'rolled_back': return array('citami-pill--muted', citami_t('Revocato', 'Revoked'));
        case 'manual':      return array('citami-pill--warn', citami_t('Da fare a mano', 'To do by hand'));
    }
    return array('citami-pill--muted', ucfirst((string) $status));
}

/** 2.60 — the pages a JSON-LD payload lands on: home | about | faq (router of citami_store_schema_payload). */
function citami_fix_schema_targets($code) {
    $decoded = json_decode((string) $code, true);
    $targets = array();
    if (is_array($decoded)) {
        $nodes = (isset($decoded['@graph']) && is_array($decoded['@graph'])) ? $decoded['@graph'] : array($decoded);
        foreach ($nodes as $node) {
            if (is_array($node)) {
                $targets[citami_schema_target($node)] = true;
            }
        }
    }
    $out = array();
    foreach (array('home', 'about', 'faq') as $k) {
        if (isset($targets[$k])) {
            $out[] = $k;
        }
    }
    return $out ? $out : array('home');
}

/** 2.60 — where an applied fix can be seen on the site ('' for manual types). */
function citami_fix_site_url($fix_type) {
    switch ((string) $fix_type) {
        case 'robots_txt':
            return home_url('/robots.txt');
        case 'llms_txt':
            return home_url('/llms.txt');
        case 'faq_page':
            $ours = function_exists('get_posts') ? get_posts(array(
                'post_type'   => 'page',
                'post_status' => array('publish'),
                'meta_key'    => '_citami_faq_page', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- one flag on at most a handful of pages
                'meta_value'  => '1', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
                'numberposts' => 1,
            )) : array();
            if (!empty($ours) && is_object($ours[0]) && function_exists('get_permalink')) {
                $link = (string) get_permalink($ours[0]);
                if ($link !== '') {
                    return $link;
                }
            }
            return home_url('/faq/');
        case 'meta_tags':
        case 'schema_injection':
        case 'schema_markup':
            return home_url('/');
    }
    return '';
}

/** 2.60 — the confirm asked before an approval that rewrites a public file or page ('' = no confirm). */
function citami_fix_approve_confirm($fix_type, $code) {
    switch ((string) $fix_type) {
        case 'robots_txt':
            return sprintf(citami_t('Aggiungo queste righe al robots.txt del sito (%s): cambia cosa possono leggere i crawler. Continuare?', 'These lines will be added to the site robots.txt (%s): it changes what crawlers may read. Continue?'), home_url('/robots.txt'));
        case 'llms_txt':
            return sprintf(citami_t('Il file %s del sito viene sostituito con questo contenuto. Continuare?', 'The site file %s will be replaced with this content. Continue?'), home_url('/llms.txt'));
        case 'faq_page':
            return sprintf(citami_t('Creo o aggiorno la pagina pubblica /faq con %d domande e risposte, visibile a tutti. Continuare?', 'The public /faq page will be created or updated with %d questions and answers, visible to everyone. Continue?'), count(citami_faq_pairs_from_jsonld((string) $code)));
    }
    return '';
}

/**
 * 2.60 — the "what changes / where" line of a queue row, by type. FAQ
 * pages list their questions and answers here, not only as raw code.
 */
function citami_fix_effect_html($fix_type, $code) {
    $link = function ($url, $text) {
        return '<a href="' . esc_url($url) . '" target="_blank" rel="noopener">' . esc_html($text) . '</a>';
    };
    $extra = '';
    switch ((string) $fix_type) {
        case 'meta_tags':
            $line = esc_html(citami_t("Aggiunge questi tag nell'<head> di ogni pagina del sito (invisibili ai visitatori, letti da motori e AI).", 'Adds these tags to the <head> of every page of the site (invisible to visitors, read by search engines and AI).'));
            break;
        case 'robots_txt':
            $line = esc_html(citami_t('Aggiunge queste righe a robots.txt:', 'Adds these lines to robots.txt:')) . ' ' . $link(home_url('/robots.txt'), '/robots.txt');
            break;
        case 'llms_txt':
            $line = esc_html(citami_t('Sostituisce il file', 'Replaces the file')) . ' ' . $link(home_url('/llms.txt'), '/llms.txt') . ' ' . esc_html(citami_t('con il contenuto qui sotto.', 'with the content below.'));
            break;
        case 'schema_injection':
        case 'schema_markup':
            $names = array(
                'home'  => citami_t('home page', 'home page'),
                'about' => citami_t('pagina Chi siamo', 'About page'),
                'faq'   => citami_t('pagina FAQ', 'FAQ page'),
            );
            $where = array();
            foreach (citami_fix_schema_targets($code) as $k) {
                $where[] = $names[$k];
            }
            $line = esc_html(sprintf(citami_t('Aggiunge dati strutturati (JSON-LD, invisibili ai visitatori) a: %s.', 'Adds structured data (JSON-LD, invisible to visitors) to: %s.'), implode(', ', $where)));
            break;
        case 'faq_page':
            $line = esc_html(citami_t('Crea o aggiorna la pagina pubblica', 'Creates or updates the public page')) . ' ' . $link(home_url('/faq/'), '/faq') . ' ' . esc_html(citami_t('con queste domande e risposte (più il loro schema FAQPage).', 'with these questions and answers (plus their FAQPage schema).'));
            $pairs = citami_faq_pairs_from_jsonld((string) $code);
            if ($pairs) {
                $extra = '<ol class="citami-fix-faq" data-citami="fix-faq">';
                foreach ($pairs as $pair) {
                    $extra .= '<li><strong>' . esc_html(wp_strip_all_tags($pair['q'])) . '</strong><br>' . esc_html(wp_strip_all_tags($pair['a'])) . '</li>';
                }
                $extra .= '</ol>';
            } else {
                $extra = '<p class="citami-fix-faq-empty">' . esc_html(citami_t('Nessuna domanda/risposta leggibile nel codice: l\'approvazione non andrebbe a buon fine.', 'No readable question/answer in the code: the approval would fail.')) . '</p>';
            }
            break;
        default:
            $line = esc_html(citami_t('Non cambia nulla da solo: va fatto a mano, seguendo il codice qui sotto.', 'Changes nothing on its own: it is done by hand, following the code below.'));
    }
    return '<p class="citami-fix-effect" data-citami="fix-effect"><strong>' . esc_html(citami_t('Cosa cambia:', 'What changes:')) . '</strong> ' . $line . '</p>' . $extra;
}

/** 2.60 — HTML id of a queue row (queue ids look like fix_6523….1234). */
function citami_fix_anchor($id) {
    return 'citami-fix-' . preg_replace('/[^A-Za-z0-9_\-]/', '-', (string) $id);
}

/** 2.60 — transient holding the one-shot outcome shown inside a queue row. */
function citami_fix_notice_key($id) {
    return 'citami_fix_notice_' . md5((string) $id);
}

/**
 * Render the Pending Fixes review table. Approve/Reject submit to
 * admin-post.php?action=citami_fix_action which routes to
 * citami_handle_fix_action(); every action comes back to its row.
 */
function citami_render_pending_fixes_tab(array $queue) {
    $review_only = citami_is_review_only();
    if (empty($queue) && citami_get_api_key() === '') {
        echo wp_kses(citami_connect_card_html('pending'), citami_kses_allowed());
        return;
    }
    if (empty($queue) && citami_is_free_account()) {
        echo wp_kses('<section class="citami-card citami-connect-card" data-citami="fixes-upgrade"><span class="citami-eyebrow">' . esc_html(citami_t('Account gratuito', 'Free account')) . '</span><h2>' . esc_html(citami_t('Correzioni dall\'audit', 'Fixes from the audit')) . '</h2><p>' . esc_html(citami_upgrade_line('fixes')) . '</p><p class="citami-actions">' . citami_upgrade_link_html('pending_fixes', citami_t('Vedi i piani', 'See the plans')) . '</p></section>', citami_kses_allowed());
        return;
    }
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only: which row to highlight
    $focus = isset($_GET['focus']) ? sanitize_text_field(wp_unslash((string) $_GET['focus'])) : '';
    $counts = array('pending' => 0, 'manual' => 0, 'applied' => 0, 'closed' => 0, 'failed' => 0);
    foreach ($queue as $fix) {
        if (!is_array($fix)) continue;
        $st = isset($fix['status']) ? (string) $fix['status'] : 'pending';
        if ($st === 'pending' || $st === 'manual' || $st === 'applied' || $st === 'failed') {
            $counts[$st]++;
        } elseif ($st === 'rejected' || $st === 'rolled_back') {
            $counts['closed']++;
        }
    }
    ?>
    <div class="citami-page-head">
        <p class="citami-muted"><?php echo wp_kses_post(citami_t(
            'Ogni fix ricevuto da Citami viene accodato qui. Clicca <strong>Approva</strong> per applicarlo al sito (JSON-LD, meta tag, llms.txt, robots.txt) o <strong>Rifiuta</strong> per scartarlo. Un fix applicato si toglie dal sito con <strong>Revoca</strong>. La coda mantiene gli ultimi 50.',
            'Every fix received from Citami is queued here. Click <strong>Approve</strong> to apply it to your site (JSON-LD, meta tags, llms.txt, robots.txt) or <strong>Reject</strong> to discard it. An applied fix comes off the site with <strong>Revoke</strong>. The queue keeps the latest 50.'
        )); ?></p>
    </div>
    <?php if (!$review_only): ?>
        <div class="notice notice-info inline" data-citami="auto-apply-notice">
            <p><?php echo wp_kses_post(citami_t(
                "<strong>Auto-apply attivo:</strong> i fix arrivano già applicati al sito e questa lista ne è lo storico. Per toglierne uno dal sito usa <strong>Revoca</strong> sulla sua riga: rimuove quello che il fix aveva aggiunto (blocco nel <code>&lt;head&gt;</code>, regole di robots.txt, llms.txt, pagina FAQ).",
                '<strong>Auto-apply enabled:</strong> fixes arrive already applied to your site and this list is their history. To take one off the site use <strong>Revoke</strong> on its row: it removes what the fix had added (<code>&lt;head&gt;</code> block, robots.txt rules, llms.txt, FAQ page).'
            )); ?></p>
        </div>
    <?php endif; ?>

    <?php if (empty($queue)): ?>
        <section class="citami-card" data-citami="fixes-empty">
            <p class="citami-empty"><?php echo esc_html(citami_t('Nessun fix in coda al momento.', 'No fixes in the queue right now.')); ?></p>
            <p class="description"><?php echo esc_html(citami_t('Qui arrivano i fix che la dashboard genera dopo ogni audit: dati strutturati, meta tag, llms.txt, robots.txt. Con l\'auto-apply attivo si applicano da soli e qui resta lo storico; altrimenti li approvi o li rifiuti uno per uno.', 'The fixes the dashboard generates after every audit land here: structured data, meta tags, llms.txt, robots.txt. With auto-apply on they apply themselves and this is the history; otherwise you approve or reject them one by one.')); ?></p>
        </section>
        <?php return; endif; ?>

    <div class="citami-kpis" data-citami="fix-kpis">
        <div class="citami-kpi"><span class="citami-kpi-label"><?php echo esc_html(citami_t('In attesa', 'Waiting')); ?></span><span class="citami-kpi-value"><?php echo (int) $counts['pending']; ?></span><?php if ($counts['manual'] > 0): ?><span class="citami-kpi-delta"><?php echo esc_html(sprintf(citami_t('+ %d da fare a mano', '+ %d to do by hand'), $counts['manual'])); ?></span><?php endif; ?></div>
        <div class="citami-kpi"><span class="citami-kpi-label"><?php echo esc_html(citami_t('Applicati', 'Applied')); ?></span><span class="citami-kpi-value"><?php echo (int) $counts['applied']; ?></span><?php if ($counts['failed'] > 0): ?><span class="citami-kpi-delta"><?php echo esc_html(sprintf(citami_t('%d non riusciti', '%d failed'), $counts['failed'])); ?></span><?php endif; ?></div>
        <div class="citami-kpi"><span class="citami-kpi-label"><?php echo esc_html(citami_t('Revocati / rifiutati', 'Revoked / rejected')); ?></span><span class="citami-kpi-value"><?php echo (int) $counts['closed']; ?></span></div>
    </div>

    <section class="citami-card citami-card--table">
        <header class="citami-card-head">
            <span class="citami-eyebrow"><?php echo esc_html(citami_t('Fix ricevuti', 'Fixes received')); ?></span>
            <span class="citami-muted"><?php echo esc_html(sprintf(citami_t('%d nella coda · gli ultimi 50', '%d in the queue · the latest 50'), count($queue))); ?></span>
        </header>
    <table class="widefat fixed citami-fixes" data-citami="fixes">
        <thead>
            <tr>
                <th class="citami-fix-col-when"><?php echo esc_html(citami_t('Ricevuto', 'Received')); ?></th>
                <th class="citami-fix-col-type"><?php echo esc_html(citami_t('Tipo', 'Type')); ?></th>
                <th><?php echo esc_html(citami_t('Cosa cambia / dove', 'What changes / where')); ?></th>
                <th class="citami-fix-col-status"><?php echo esc_html(citami_t('Stato', 'Status')); ?></th>
                <th class="citami-fix-col-actions"><?php echo esc_html(citami_t('Azioni', 'Actions')); ?></th>
            </tr>
        </thead>
        <tbody>
        <?php foreach ($queue as $fix):
            if (!is_array($fix)) continue;
            $id          = isset($fix['id']) ? (string) $fix['id'] : '';
            $status      = isset($fix['status']) ? (string) $fix['status'] : 'pending';
            $fix_type    = isset($fix['fix_type']) ? (string) $fix['fix_type'] : '';
            $title       = isset($fix['title']) ? (string) $fix['title'] : citami_t('(senza titolo)', '(untitled)');
            $description = isset($fix['description']) ? (string) $fix['description'] : '';
            $code        = isset($fix['code_snippet']) ? (string) $fix['code_snippet'] : '';
            $received    = citami_fix_when(isset($fix['received_at']) ? $fix['received_at'] : '');
            $actioned_at = citami_fix_when(isset($fix['actioned_at']) ? $fix['actioned_at'] : '');
            $action_msg  = isset($fix['action_message']) ? (string) $fix['action_message'] : '';
            $is_focus    = $focus !== '' && $id === $focus;
            $row_notice  = null;
            if ($is_focus) {
                $row_notice = get_transient(citami_fix_notice_key($id));
                if (is_array($row_notice) && !empty($row_notice['message'])) {
                    delete_transient(citami_fix_notice_key($id));
                } else {
                    $row_notice = null;
                }
            }
            list($badge_class, $label) = citami_fix_status_label($status);
            $site_url = $status === 'applied' ? citami_fix_site_url($fix_type) : '';
            $confirm  = citami_fix_approve_confirm($fix_type, $code);
        ?>
            <tr id="<?php echo esc_attr(citami_fix_anchor($id)); ?>" class="<?php echo $is_focus ? 'is-focus' : ''; ?>" data-citami="fix-row" data-status="<?php echo esc_attr($status); ?>">
                <td class="citami-fix-col-when">
                    <?php echo esc_html($received); ?>
                    <?php if ($actioned_at): ?>
                        <br><small class="citami-muted"><?php echo esc_html(citami_t('gestito:', 'handled:')); ?> <?php echo esc_html($actioned_at); ?></small>
                    <?php endif; ?>
                </td>
                <td class="citami-fix-col-type"><span class="citami-pill citami-pill--type" title="<?php echo esc_attr($fix_type); ?>"><?php echo esc_html(citami_fix_type_label($fix_type)); ?></span></td>
                <td>
                    <?php if ($row_notice): ?>
                        <p class="citami-card-notice citami-card-notice--<?php echo esc_attr(isset($row_notice['type']) ? $row_notice['type'] : 'info'); ?>" data-citami="row-notice" role="status"><?php echo wp_kses(citami_notice_text_html($row_notice), citami_kses_allowed()); ?></p>
                    <?php endif; ?>
                    <strong><?php echo esc_html($title); ?></strong>
                    <?php if ($description): ?>
                        <p class="citami-fix-desc citami-muted"><?php echo esc_html($description); ?></p>
                    <?php endif; ?>
                    <?php echo wp_kses(citami_fix_effect_html($fix_type, $code), citami_kses_allowed()); ?>
                    <?php if ($code !== ''): ?>
                        <details class="citami-fix-code-fold">
                            <summary><?php echo esc_html(citami_t('Anteprima codice', 'Code preview')); ?></summary>
                            <?php echo wp_kses(citami_render_fix_preview($fix_type, $code), citami_kses_allowed()); ?>
                        </details>
                    <?php endif; ?>
                </td>
                <td class="citami-fix-col-status">
                    <span class="citami-pill <?php echo esc_attr($badge_class); ?>"><?php echo esc_html($label); ?></span>
                    <?php if ($action_msg && $status !== 'pending'): ?>
                        <small class="citami-fix-msg citami-muted"><?php echo esc_html($action_msg); ?></small>
                    <?php endif; ?>
                </td>
                <td class="citami-fix-col-actions"><div class="citami-fix-actions">
                    <?php if ($status === 'pending'): ?>
                        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="citami-inline-form">
                            <?php wp_nonce_field('citami_fix_action_' . $id, '_citami_fix_nonce'); ?>
                            <input type="hidden" name="action" value="citami_fix_action">
                            <input type="hidden" name="fix_id" value="<?php echo esc_attr($id); ?>">
                            <input type="hidden" name="decision" value="approve">
                            <button type="submit" class="citami-btn citami-btn--primary citami-btn--small" data-citami-busy="<?php echo esc_attr(citami_t('Applico…', 'Applying…')); ?>"<?php if ($confirm !== ''): ?> onclick="return confirm('<?php echo esc_js($confirm); ?>');"<?php endif; ?>><?php echo esc_html(citami_t('Approva', 'Approve')); ?></button>
                        </form>
                        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="citami-inline-form">
                            <?php wp_nonce_field('citami_fix_action_' . $id, '_citami_fix_nonce'); ?>
                            <input type="hidden" name="action" value="citami_fix_action">
                            <input type="hidden" name="fix_id" value="<?php echo esc_attr($id); ?>">
                            <input type="hidden" name="decision" value="reject">
                            <button type="submit" class="citami-btn citami-btn--ghost citami-btn--small" data-citami-busy="<?php echo esc_attr(citami_t('Rifiuto…', 'Rejecting…')); ?>"><?php echo esc_html(citami_t('Rifiuta', 'Reject')); ?></button>
                        </form>
                    <?php elseif ($status === 'applied'): ?>
                        <?php if ($site_url !== ''): ?>
                            <a class="citami-btn citami-btn--ghost citami-btn--small" href="<?php echo esc_url($site_url); ?>" target="_blank" rel="noopener" data-citami="fix-view"><?php echo esc_html(citami_t('Vedi sul sito', 'View on site')); ?></a>
                        <?php endif; ?>
                        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="citami-inline-form">
                            <?php wp_nonce_field('citami_fix_action_' . $id, '_citami_fix_nonce'); ?>
                            <input type="hidden" name="action" value="citami_fix_action">
                            <input type="hidden" name="fix_id" value="<?php echo esc_attr($id); ?>">
                            <input type="hidden" name="decision" value="revoke">
                            <button type="submit" class="citami-btn citami-btn--ghost citami-btn--small" data-citami-busy="<?php echo esc_attr(citami_t('Revoco…', 'Revoking…')); ?>" onclick="return confirm('<?php echo esc_js(citami_t('Rimuovere questo fix dal sito?', 'Remove this fix from the site?')); ?>');"><?php echo esc_html(citami_t('Revoca', 'Revoke')); ?></button>
                        </form>
                    <?php else: ?>
                        <span class="citami-muted">—</span>
                    <?php endif; ?>
                </div></td>
            </tr>
        <?php endforeach; ?>
        </tbody>
    </table>
    </section>
    <?php
}

/**
 * Render a human-readable preview of a fix's code_snippet, escaped for
 * safe output in admin context (the code is admin-side display only —
 * it is never echoed unescaped in the front-end).
 */
function citami_render_fix_preview($fix_type, $code) {
    if ($code === '') {
        return '<em>' . esc_html(citami_t('(nessun codice associato)', '(no code attached)')) . '</em>';
    }

    switch ($fix_type) {
        case 'schema_injection':
        case 'schema_markup':
            // Pretty-print JSON if parsable; otherwise show raw.
            $decoded = json_decode($code, true);
            if (json_last_error() === JSON_ERROR_NONE) {
                $pretty = wp_json_encode($decoded, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
                return '<pre class="citami-fix-code">' . esc_html($pretty) . '</pre>';
            }
            return '<pre class="citami-fix-code citami-fix-code--bad">' . esc_html($code) . '</pre><p class="citami-bad"><small>' . esc_html(citami_t('JSON non leggibile: così com\'è non si può applicare.', 'Unreadable JSON: it cannot be applied as it is.')) . '</small></p>';

        case 'meta_tags':
        case 'llms_txt':
        case 'robots_txt':
        default:
            return '<pre class="citami-fix-code">' . esc_html($code) . '</pre>';
    }
}

/**
 * Apply a queued fix's code to the site. Mirrors the auto-apply branches
 * of citami_rest_apply_fix but operates on a stored queue entry. Returns
 * array('ok' => bool, 'message' => string).
 */
function citami_apply_queued_fix(array $fix) {
    $fix_type = isset($fix['fix_type']) ? (string) $fix['fix_type'] : '';
    $title    = isset($fix['title']) ? (string) $fix['title'] : '';
    $code     = isset($fix['code_snippet']) ? (string) $fix['code_snippet'] : '';
    $fix_id   = isset($fix['fix_id']) ? (string) $fix['fix_id'] : '';

    if (!in_array($fix_type, array('llms_txt', 'robots_txt', 'schema_injection', 'schema_markup', 'meta_tags', 'faq_page'), true)) {
        // Manual-only fix types (bio_author, content_restructure, etc.)
        // — record approval but no auto-application is possible. Operator must
        // edit the site manually using the code preview.
        return array(
            'ok'      => true,
            'manual'  => true,
            'message' => citami_t('Da fare a mano: questo tipo di fix non si applica da solo. Usa il codice qui sotto.', 'To do by hand: this fix type does not apply itself. Use the code below.'),
        );
    }
    // 2.59 — the same routine as the platform push, title and fix id included,
    // so Revoke finds what this approval wrote (robots rules, llms.txt, FAQ page).
    $res = citami_apply_fix_now($fix_type, $title, $code, $fix_id);
    if (is_wp_error($res)) {
        return array('ok' => false, 'message' => $res->get_error_message());
    }
    $data = (array) $res->get_data();
    return array('ok' => !empty($data['success']), 'message' => isset($data['message']) ? (string) $data['message'] : '');
}

/**
 * 2.60 — back to the queue row that was acted on, with its outcome inside
 * the row (shown once) and the row highlighted.
 */
function citami_fix_redirect_to_row($fix_id, array $notice) {
    set_transient(citami_fix_notice_key($fix_id), $notice, 120);
    wp_safe_redirect(citami_admin_url('pending', array('focus' => (string) $fix_id)) . '#' . citami_fix_anchor($fix_id));
    exit;
}

/**
 * Admin-post handler for Approve/Reject/Revoke. Validates capability +
 * nonce, routes to citami_apply_queued_fix on approve, marks rejected on
 * reject, rolls back on revoke. Comes back to the row (2.60).
 */
function citami_handle_fix_action() {
    if (!current_user_can('manage_options')) {
        wp_die(esc_html(citami_t('Permesso negato.', 'Permission denied.')), '', array('response' => 403));
    }

    $fix_id   = isset($_POST['fix_id']) ? sanitize_text_field(wp_unslash($_POST['fix_id'])) : '';
    $decision = isset($_POST['decision']) ? sanitize_key((string) $_POST['decision']) : '';
    $nonce    = isset($_POST['_citami_fix_nonce']) ? sanitize_text_field(wp_unslash($_POST['_citami_fix_nonce'])) : '';

    if ($fix_id === '' || !in_array($decision, array('approve', 'reject', 'revoke'), true)) {
        wp_die(esc_html(citami_t('Parametri mancanti.', 'Missing parameters.')), '', array('response' => 400));
    }

    if (!wp_verify_nonce($nonce, 'citami_fix_action_' . $fix_id)) {
        wp_die(esc_html(citami_t('Nonce non valido o scaduto. Ricarica la pagina e riprova.', 'Invalid or expired nonce. Reload the page and try again.')), '', array('response' => 403));
    }

    $queue = get_option(CITAMI_FIX_QUEUE_OPT, array());
    if (!is_array($queue)) $queue = array();
    $target = null;
    foreach ($queue as $fix) {
        if (is_array($fix) && isset($fix['id']) && $fix['id'] === $fix_id) {
            $target = $fix;
            break;
        }
    }

    if (!$target) {
        // No row to come back to: the message goes on top of the tab.
        set_transient('citami_action_notice', array(
            'type'    => 'error',
            'message' => citami_t('Fix non trovato (potrebbe essere uscito dalla coda dei 50 più recenti).', 'Fix not found (it may have dropped out of the 50 most recent).'),
        ), 30);
        wp_safe_redirect(citami_admin_url('pending'));
        exit;
    }

    $current_status = isset($target['status']) ? (string) $target['status'] : 'pending';
    $title = isset($target['title']) && (string) $target['title'] !== '' ? (string) $target['title'] : citami_t('(senza titolo)', '(untitled)');
    // v2.13.0 — 'revoke' undoes an APPLIED fix (rollback by fix id / title).
    if ($decision === 'revoke') {
        if ($current_status !== 'applied') {
            citami_fix_redirect_to_row($fix_id, array(
                'type'    => 'warning',
                'message' => citami_t('Solo un fix applicato può essere revocato.', 'Only an applied fix can be revoked.'),
            ));
        }
        $removed = citami_rollback_fix(
            isset($target['fix_id']) ? (string) $target['fix_id'] : '',
            isset($target['title']) ? (string) $target['title'] : ''
        );
        $n_removed = array_sum($removed) - $removed['queue'];
        if ($n_removed === 0) {
            // 2.59 — nothing found to remove: say so instead of a green "(0)".
            citami_fix_redirect_to_row($fix_id, array(
                'type'    => 'warning',
                'message' => citami_t('Non ho trovato sul sito niente da rimuovere per questo fix (forse è già stato tolto a mano). Il fix resta segnato come applicato.', 'Nothing to remove was found on the site for this fix (it may have been removed by hand). The fix stays marked as applied.'),
            ));
        }
        citami_update_fix_in_queue($fix_id, array(
            'status'         => 'rolled_back',
            'actioned_at'    => gmdate('c'),
            'actioned_by'    => wp_get_current_user()->user_login ?? 'unknown',
            'action_message' => citami_t('Revocato dall\'admin: rimosso dal sito.', 'Revoked by admin: removed from the site.'),
        ));
        // WP25 — the platform learns the fix is no longer live.
        citami_sync_report(isset($target['fix_id']) ? (string) $target['fix_id'] : $fix_id, false, citami_t('Revocato dall\'admin in WordPress: rimosso dal sito.', 'Revoked by the admin in WordPress: removed from the site.'), 'revoked');
        citami_fix_redirect_to_row($fix_id, array(
            'type'    => 'success',
            'message' => sprintf(citami_t('Fix rimosso dal sito: %d elementi tolti.', 'Fix removed from the site: %d items taken out.'), $n_removed),
        ));
    }
    if ($current_status !== 'pending') {
        list(, $status_label) = citami_fix_status_label($current_status);
        citami_fix_redirect_to_row($fix_id, array(
            'type'    => 'warning',
            'message' => sprintf(citami_t('Fix già gestito (stato: %s).', 'Fix already handled (status: %s).'), $status_label),
        ));
    }

    $user = wp_get_current_user();
    $actor = $user && !empty($user->ID) && isset($user->user_login) ? (string) $user->user_login : 'unknown';

    if ($decision === 'reject') {
        citami_update_fix_in_queue($fix_id, array(
            'status'         => 'rejected',
            'actioned_at'    => gmdate('c'),
            'actioned_by'    => $actor,
            'action_message' => citami_t("Rifiutato dall'admin.", 'Rejected by admin.'),
        ));
        // WP25 — the platform stops waiting for it.
        citami_sync_report(isset($target['fix_id']) ? (string) $target['fix_id'] : $fix_id, false, citami_t("Rifiutato dall'admin in WordPress.", 'Rejected by the admin in WordPress.'), 'rejected');
        citami_fix_redirect_to_row($fix_id, array(
            'type'    => 'success',
            'message' => sprintf(citami_t('Fix rifiutato: «%s». Sul sito non è cambiato nulla.', 'Fix rejected: "%s". Nothing changed on the site.'), $title),
        ));
    }

    $result = citami_apply_queued_fix($target);
    $manual = !empty($result['manual']);
    citami_update_fix_in_queue($fix_id, array(
        'status'         => $manual ? 'manual' : ($result['ok'] ? 'applied' : 'failed'),
        'actioned_at'    => gmdate('c'),
        'actioned_by'    => $actor,
        'action_message' => $result['message'],
    ));
    // WP25 — approving in wp-admin is an application too: report it like the sync pull does.
    // 2.65 — a manual-only fix approved here is not live: nothing to report.
    if (!$manual) {
        citami_sync_report(isset($target['fix_id']) ? (string) $target['fix_id'] : $fix_id, (bool) $result['ok'], (string) $result['message'], $result['ok'] ? 'applied' : 'failed');
    }
    if ($manual) {
        $notice = array('type' => 'warning', 'message' => (string) $result['message']);
    } elseif ($result['ok']) {
        $notice = array('type' => 'success', 'message' => citami_t('Fix applicato: ', 'Fix applied: ') . $result['message']);
    } else {
        $notice = array('type' => 'error', 'message' => citami_t('Errore applicazione: ', 'Could not apply: ') . $result['message']);
    }
    citami_fix_redirect_to_row($fix_id, $notice);
}
add_action('admin_post_citami_fix_action', 'citami_handle_fix_action');

/**
 * 2.60 — Settings tab actions. do=check runs the connection check on
 * demand (the page itself only reads the last stored result) and comes
 * back to the Status line with the outcome there.
 */
function citami_handle_settings_action() {
    if (!current_user_can('manage_options')) {
        wp_die(esc_html(citami_t('Permesso negato.', 'Permission denied.')), '', array('response' => 403));
    }
    $nonce = isset($_POST['_citami_settings_nonce']) ? sanitize_text_field(wp_unslash($_POST['_citami_settings_nonce'])) : '';
    if (!wp_verify_nonce($nonce, 'citami_settings_action')) {
        wp_die(esc_html(citami_t('Nonce non valido o scaduto. Ricarica la pagina e riprova.', 'Invalid or expired nonce. Reload the page and try again.')), '', array('response' => 403));
    }
    $do = isset($_POST['do']) ? sanitize_key((string) $_POST['do']) : '';
    if ($do === 'check') {
        if (citami_get_api_key() === '') {
            $notice = array('type' => 'warning', 'message' => citami_t('Prima inserisci e salva la API key, poi verifica la connessione.', 'Enter and save the API key first, then check the connection.'));
        } else {
            $health = citami_health_ping();
            $ok = is_array($health) && !empty($health['ok']);
            $msg = is_array($health) && isset($health['message']) ? (string) $health['message'] : '';
            $notice = $ok
                ? array('type' => 'success', 'message' => sprintf(citami_t('Connessione verificata ora: %s.', 'Connection checked just now: %s.'), $msg))
                : array('type' => 'error', 'message' => sprintf(citami_t('Connessione non riuscita: %s. Controlla chiave ed endpoint qui sopra.', 'Connection failed: %s. Check the key and endpoint above.'), $msg));
        }
        set_transient('citami_health_check_notice', $notice, 120);
        wp_safe_redirect(citami_admin_url('general', array('focus' => 'health')) . '#citami-health');
        exit;
    }
    wp_safe_redirect(citami_admin_url('general'));
    exit;
}
add_action('admin_post_citami_settings_action', 'citami_handle_settings_action');

/**
 * 2.56.1 — links on the Plugins screen: Settings always, "Get started"
 * (the guided first run) until the site is connected.
 */
function citami_plugin_action_links($links) {
    $links = is_array($links) ? $links : array();
    $own = array('<a href="' . esc_url(citami_admin_url('general')) . '">' . esc_html(citami_t('Impostazioni', 'Settings')) . '</a>');
    if (citami_get_api_key() === '' && function_exists('citami_setup_url')) {
        $own[] = '<a href="' . esc_url(citami_setup_url(1)) . '" style="font-weight:600">' . esc_html(citami_t('Inizia', 'Get started')) . '</a>';
    }
    return array_merge($own, $links);
}
if (defined('CITAMI_PLUGIN_FILE') && function_exists('plugin_basename')) {
    add_filter('plugin_action_links_' . plugin_basename(CITAMI_PLUGIN_FILE), 'citami_plugin_action_links');
}