<?php
/**
 * Code block migrator and SQL query tool AJAX handlers.
 *
 * @package CSDT_DevTools
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit; }

// The path accessor, loaded here as well as by the main file so this class can be
// loaded on its own (the build-time tests do) without a load-order dependency.
require_once __DIR__ . '/class-paths.php';

/**
 * Code-block migrator (converts legacy code blocks) plus SQL-tool and object-cache
 * drop-in AJAX handlers.
 *
 * @since 1.0.0
 */
class CSDT_Code_Migrator {

    public static function recursive_str_replace( string $from, string $to, $data ) {
        if ( is_array( $data ) ) {
            foreach ( $data as $k => $v ) {
                $data[ $k ] = self::recursive_str_replace( $from, $to, $v );
            }
            return $data;
        }
        if ( ! is_string( $data ) ) {
            return $data;
        }
        // allowed_classes=false: prevents PHP object-injection / POP-chain
        // execution if any DB cell contains attacker-supplied serialized data.
        // Objects become __PHP_Incomplete_Class; arrays and scalars deserialise
        // normally so URL rewriting still works.
        $unserialized = @unserialize( $data, array( 'allowed_classes' => false ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize,WordPress.PHP.NoSilencedErrors.Discouraged -- @ suppresses E_NOTICE on malformed data; allowed_classes=false prevents object injection
        if ( $unserialized !== false && $data !== 'b:0;' ) {
            $replaced = self::recursive_str_replace( $from, $to, $unserialized );
            return serialize( $replaced ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.serialize_serialize
        }
        return str_replace( $from, $to, $data );
    }

    /*
    ==================================================================
        6a. Settings AJAX save
        ================================================================== */

    /**
     * AJAX handler: saves the colour theme and default mode settings.
     *
     * @since  1.6.0
     * @return void Sends JSON response and exits.
     */
    public static function ajax_save_theme_setting(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }
        if ( ! check_ajax_referer( 'csdt_devtools_code_settings_inline', 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        $theme = isset( $_POST['theme'] ) ? sanitize_text_field( wp_unslash( $_POST['theme'] ) ) : 'dark';
        if ( ! in_array( $theme, array( 'dark', 'light' ), true ) ) {
            $theme = 'dark';
        }
        update_option( 'csdt_devtools_code_default_theme', $theme );

        $valid_pairs = array_keys( CSDT_DevTools::get_theme_registry() );
        $pair        = isset( $_POST['theme_pair'] ) ? sanitize_text_field( wp_unslash( $_POST['theme_pair'] ) ) : 'atom-one';
        if ( ! in_array( $pair, $valid_pairs, true ) ) {
            $pair = 'atom-one';
        }
        update_option( 'csdt_devtools_code_theme_pair', $pair );

        // Only touch the perf-monitor flag when the caller explicitly sent it.
        // The Re-apply panel saves theme settings without that checkbox in scope
        // and must not silently turn perf monitoring off.
        if ( array_key_exists( 'csdt_devtools_perf_monitor_enabled', $_POST ) ) {
            $perf_enabled = '1' === sanitize_key( wp_unslash( $_POST['csdt_devtools_perf_monitor_enabled'] ) ) ? '1' : '0';
            update_option( 'csdt_devtools_perf_monitor_enabled', $perf_enabled );
        } else {
            $perf_enabled = (string) CSDT_Options::get( 'csdt_devtools_perf_monitor_enabled' );
        }

        if ( array_key_exists( 'powered_by', $_POST ) ) {
            $powered_by = '1' === sanitize_text_field( wp_unslash( $_POST['powered_by'] ) ) ? '1' : '0';
            update_option( 'csdt_show_powered_by', $powered_by );
        }

        if ( array_key_exists( 'emoji_off', $_POST ) ) {
            $emoji_off = '1' === sanitize_text_field( wp_unslash( $_POST['emoji_off'] ) ) ? '1' : '0';
            update_option( 'csdt_emoji_polyfill_off', $emoji_off );
        }

        if ( array_key_exists( 'pdf_export', $_POST ) ) {
            $pdf_export = '1' === sanitize_text_field( wp_unslash( $_POST['pdf_export'] ) ) ? '1' : '0';
            update_option( CSDT_PDF_Export::OPTION, $pdf_export );
        }

        wp_send_json_success(
            array(
				'theme'        => $theme,
				'theme_pair'   => $pair,
				'perf_enabled' => $perf_enabled,
            )
        );
    }

    public static function ajax_save_perf_monitor(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }
        if ( ! check_ajax_referer( CSDT_DevTools::PERF_NONCE, 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }
        $enabled = isset( $_POST['enabled'] ) && '1' === sanitize_key( wp_unslash( $_POST['enabled'] ) ) ? '1' : '0';
        update_option( 'csdt_devtools_perf_monitor_enabled', $enabled );
        wp_send_json_success( array( 'perf_enabled' => $enabled ) );
    }

    // ── Object cache toggle ───────────────────────────────────────────────────

    public static function get_object_cache_status(): array {
        $drop_in = CSDT_Paths::content_dir() . '/object-cache.php'; // core loads drop-ins only from directly inside the content directory

        if ( ! file_exists( $drop_in ) ) {
            return array(
				'type'    => 'none',
				'label'   => 'Not installed',
			);
        }

        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- reading drop-in header at known local path
        $head = (string) file_get_contents( $drop_in, false, null, 0, 1024 );

        if ( false !== strpos( $head, 'CSDT_APCU_AVAILABLE' ) ) {
            return array(
				'type'    => 'ours',
				'label'   => 'APCu (older CloudScale drop-in)',
			);
        }
        if ( false !== stripos( $head, 'redis' ) ) {
            return array(
				'type'    => 'redis',
				'label'   => 'Redis',
			);
        }
        if ( false !== stripos( $head, 'memcached' ) ) {
            return array(
				'type'    => 'memcached',
				'label'   => 'Memcached',
			);
        }
        return array(
			'type'    => 'other',
			'label'   => 'Third-party drop-in',
		);
    }

    public static function ajax_object_cache_toggle(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }
        if ( ! check_ajax_referer( 'csdt_object_cache_nonce', 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        // Remove is the only action: the plugin no longer ships a drop-in to install (1.10.882).
        $action  = isset( $_POST['action_type'] ) ? sanitize_key( wp_unslash( $_POST['action_type'] ) ) : '';
        $drop_in = CSDT_Paths::content_dir() . '/object-cache.php'; // core loads drop-ins only from directly inside the content directory

        if ( 'uninstall' === $action ) {
            if ( ! file_exists( $drop_in ) ) {
                wp_send_json_success( self::get_object_cache_status() );
            }
            // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- reading drop-in header at a known local path; wp_remote_get() is for URLs, not local files
            $head = (string) file_get_contents( $drop_in, false, null, 0, 1024 );
            if ( false === strpos( $head, 'CSDT_APCU_AVAILABLE' ) ) {
                wp_send_json_error( 'Not a CloudScale object cache, remove it manually if needed.' );
            }
            wp_delete_file( $drop_in );
            if ( file_exists( $drop_in ) ) {
                wp_send_json_error( 'Could not remove object-cache.php, check directory permissions.' );
            }
            wp_send_json_success( self::get_object_cache_status() );
        }

        wp_send_json_error( 'Unknown action.' );
    }

    /*
    ==================================================================
        7. MIGRATION TOOL

        ================================================================== */

    /*
    ==================================================================
        7a. Migration: Block conversion logic
        ================================================================== */

    /**
     * Returns the regex pattern that matches legacy wp:code blocks.
     *
     * @since  1.5.0
     * @return string PCRE pattern string.
     */
    private static function get_code_pattern() {
        return '#<!-- wp:(code-syntax-block/code|code)\s*(\{[^}]*\})?\s*-->\s*'
            . '<pre[^>]*class="[^"]*wp-block-code[^"]*"[^>]*>\s*'
            . '<code([^>]*)>(.*?)</code>\s*'
            . '</pre>\s*'
            . '<!-- /wp:\1\s*-->#s';
    }

    /**
     * Returns the regex pattern that matches legacy wp:preformatted blocks.
     *
     * @since  1.5.0
     * @return string PCRE pattern string.
     */
    private static function get_preformatted_pattern() {
        return '#<!-- wp:preformatted\s*(\{[^}]*\})?\s*-->\s*'
            . '<pre[^>]*class="[^"]*wp-block-preformatted[^"]*"[^>]*>(.*?)</pre>\s*'
            . '<!-- /wp:preformatted\s*-->#s';
    }

    /**
     * Converts a matched legacy wp:code block into a CloudScale block comment.
     *
     * @since  1.5.0
     * @param  array $matches preg_replace_callback match array.
     * @return string New block comment markup.
     */
    private static function convert_code_block( $matches ) {
        $block_json   = $matches[2] ?? '';
        $code_attrs   = $matches[3] ?? '';
        $code_content = $matches[4] ?? '';

        $code = html_entity_decode( $code_content, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
        $code = rtrim( $code, "\n" );

        $lang = '';

        if ( ! empty( $block_json ) ) {
            $json = json_decode( $block_json, true );
            if ( isset( $json['language'] ) ) {
                $lang = $json['language'];
            }
        }

        if ( empty( $lang ) && preg_match( '/lang=["\']([^"\']+)["\']/', $code_attrs, $lm ) ) {
            $lang = $lm[1];
        }

        if ( empty( $lang ) && preg_match( '/class=["\'][^"\']*language-([a-zA-Z0-9+#._-]+)/', $code_attrs, $lm ) ) {
            $lang = $lm[1];
        }

        return self::build_migrate_block( $code, $lang );
    }

    /**
     * Converts a matched legacy wp:preformatted block into a CloudScale block comment.
     *
     * @since  1.5.0
     * @param  array $matches preg_replace_callback match array.
     * @return string New block comment markup.
     */
    private static function convert_preformatted_block( $matches ) {
        $code_content = $matches[2] ?? '';

        $code = str_ireplace( array( '<br>', '<br/>', '<br />' ), "\n", $code_content );
        $code = wp_strip_all_tags( $code );
        $code = html_entity_decode( $code, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
        $code = rtrim( $code, "\n" );

        return self::build_migrate_block( $code, '' );
    }

    /**
     * Opening and closing comment of a Code Block Pro block (the kevinbatdorf/code-block-pro plugin).
     *
     * @since 1.10.1012
     */
    const CBP_OPEN  = '<!-- wp:kevinbatdorf/code-block-pro';
    const CBP_CLOSE = '<!-- /wp:kevinbatdorf/code-block-pro';

    /**
     * The languages the CloudScale block highlights, the only ones a migration may carry over.
     * Mermaid and the chart languages are left out on purpose: Code Block Pro showed their
     * source as text, and here they would be drawn as a picture.
     *
     * @since 1.10.1012
     */
    const HIGHLIGHT_LANGUAGES = array(
        'bash',
        'c',
        'cpp',
        'csharp',
        'css',
        'dockerfile',
        'go',
        'graphql',
        'hcl',
        'xml',
        'java',
        'javascript',
        'json',
        'kotlin',
        'lua',
        'makefile',
        'markdown',
        'perl',
        'php',
        'python',
        'r',
        'ruby',
        'rust',
        'scss',
        'sql',
        'swift',
        'toml',
        'typescript',
        'yaml',
    );

    /**
     * Code Block Pro (Shiki) language ids that are spelled differently here.
     *
     * @since 1.10.1012
     */
    const CBP_LANGUAGE_ALIASES = array(
        'sh'           => 'bash',
        'shell'        => 'bash',
        'shellscript'  => 'bash',
        'shellsession' => 'bash',
        'console'      => 'bash',
        'zsh'          => 'bash',
        'js'           => 'javascript',
        'jsx'          => 'javascript',
        'mjs'          => 'javascript',
        'ts'           => 'typescript',
        'tsx'          => 'typescript',
        'py'           => 'python',
        'rb'           => 'ruby',
        'rs'           => 'rust',
        'yml'          => 'yaml',
        'md'           => 'markdown',
        'tf'           => 'hcl',
        'terraform'    => 'hcl',
        'html'         => 'xml',
        'svg'          => 'xml',
        'docker'       => 'dockerfile',
        'make'         => 'makefile',
        'cs'           => 'csharp',
        'c#'           => 'csharp',
        'c++'          => 'cpp',
        'golang'       => 'go',
        'kt'           => 'kotlin',
        'jsonc'        => 'json',
        'json5'        => 'json',
    );

    /**
     * Finds every Code Block Pro block in post content.
     *
     * Walks the string with strpos() and never a regex. One of these blocks carries its code
     * three times over (the attribute, a copy button and the coloured markup), so a long listing
     * runs to hundreds of kilobytes, and a lazy pattern across that much text hits the PCRE
     * limits, where preg_replace_callback() answers null and the caller would save an empty post.
     *
     * A block with no closing comment, or with another opening comment before its own close, is
     * not returned: it is damaged, and it is left exactly as it is.
     *
     * @since  1.10.1012
     * @param  string $content Post content.
     * @return array<int, array{start:int, length:int, attrs:string, inner:string}>
     */
    private static function find_cbp_blocks( string $content ): array {
        $found  = array();
        $offset = 0;
        $open   = strlen( self::CBP_OPEN );

        while ( false !== ( $start = strpos( $content, self::CBP_OPEN, $offset ) ) ) {
            $offset = $start + $open;

            // "code-block-pro" must be the whole block name, not the front of a longer one.
            $next = substr( $content, $offset, 1 );
            if ( '' === $next || ! ctype_space( $next ) ) {
                continue;
            }

            $head_end = strpos( $content, '-->', $offset );
            if ( false === $head_end ) {
                break;
            }
            $attrs  = trim( substr( $content, $offset, $head_end - $offset ) );
            $offset = $head_end + 3;

            // Written as one self-closing comment: there is no markup and no closing comment.
            if ( '/' === substr( $attrs, -1 ) ) {
                $found[] = array(
                    'start'  => $start,
                    'length' => $offset - $start,
                    'attrs'  => trim( substr( $attrs, 0, -1 ) ),
                    'inner'  => '',
                );
                continue;
            }

            $close = strpos( $content, self::CBP_CLOSE, $offset );
            if ( false === $close ) {
                continue;
            }
            $nested = strpos( $content, self::CBP_OPEN, $offset );
            if ( false !== $nested && $nested < $close ) {
                continue;
            }
            $close_end = strpos( $content, '-->', $close );
            if ( false === $close_end ) {
                continue;
            }

            $found[] = array(
                'start'  => $start,
                'length' => $close_end + 3 - $start,
                'attrs'  => $attrs,
                'inner'  => substr( $content, $offset, $close - $offset ),
            );
            $offset = $close_end + 3;
        }

        return $found;
    }

    /**
     * Reads the attributes of a Code Block Pro block.
     *
     * @since  1.10.1012
     * @param  string $attrs_json The JSON from the opening comment.
     * @return array<string, mixed> Empty when there is none or it does not parse.
     */
    private static function cbp_attrs( string $attrs_json ): array {
        if ( '' === $attrs_json ) {
            return array();
        }
        $attrs = json_decode( $attrs_json, true );
        return is_array( $attrs ) ? $attrs : array();
    }

    /**
     * The code held by a Code Block Pro block, exactly as the author typed it.
     *
     * The `code` attribute is the author's text and is used whenever it is there. A block
     * without one is read from the copy button, then from the coloured markup. A block that
     * yields nothing by any of the three answers null and is not converted.
     *
     * @since  1.10.1012
     * @param  array<string, mixed> $attrs Block attributes.
     * @param  string               $inner The markup between the two comments.
     * @return string|null
     */
    private static function cbp_code( array $attrs, string $inner ): ?string {
        $code = null;

        if ( isset( $attrs['code'] ) && is_string( $attrs['code'] ) && '' !== trim( $attrs['code'] ) ) {
            $code = $attrs['code'];
        } else {
            $from = stripos( $inner, '<textarea' );
            $from = false === $from ? false : strpos( $inner, '>', $from );
            $to   = false === $from ? false : stripos( $inner, '</textarea>', $from );
            if ( false !== $from && false !== $to ) {
                $code = html_entity_decode( substr( $inner, $from + 1, $to - $from - 1 ), ENT_QUOTES | ENT_HTML5, 'UTF-8' );
            } else {
                $from = stripos( $inner, '<code' );
                $from = false === $from ? false : strpos( $inner, '>', $from );
                $to   = false === $from ? false : strripos( $inner, '</code>' );
                if ( false !== $from && false !== $to && $to > $from ) {
                    $code = html_entity_decode( wp_strip_all_tags( substr( $inner, $from + 1, $to - $from - 1 ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' );
                }
            }
        }

        if ( null === $code ) {
            return null;
        }
        $code = rtrim( str_replace( "\r\n", "\n", $code ), "\n" );
        return '' === trim( $code ) ? null : $code;
    }

    /**
     * The language to carry over from a Code Block Pro block.
     *
     * @since  1.10.1012
     * @param  mixed $lang The block's `language` attribute.
     * @return string A language this block highlights, or '' to let it detect one.
     */
    private static function cbp_language( $lang ): string {
        if ( ! is_string( $lang ) ) {
            return '';
        }
        $lang = strtolower( trim( $lang ) );
        $lang = self::CBP_LANGUAGE_ALIASES[ $lang ] ?? $lang;
        return in_array( $lang, self::HIGHLIGHT_LANGUAGES, true ) ? $lang : '';
    }

    /**
     * Converts one Code Block Pro block found by find_cbp_blocks().
     *
     * @since  1.10.1012
     * @param  array{start:int, length:int, attrs:string, inner:string} $block The block.
     * @return string|null New block comment markup, or null when no code could be read.
     */
    private static function convert_cbp_block( array $block ): ?string {
        $attrs = self::cbp_attrs( $block['attrs'] );
        $code  = self::cbp_code( $attrs, $block['inner'] );
        if ( null === $code ) {
            return null;
        }

        // The text Code Block Pro printed in the block's header bar, when the author set one.
        $title = isset( $attrs['headerString'] ) && is_string( $attrs['headerString'] ) ? trim( wp_strip_all_tags( $attrs['headerString'] ) ) : '';

        return self::build_migrate_block( $code, self::cbp_language( $attrs['language'] ?? '' ), $title );
    }

    /**
     * Replaces every readable Code Block Pro block in post content.
     *
     * @since  1.10.1012
     * @param  string $content Post content.
     * @return string
     */
    private static function convert_cbp_content( string $content ): string {
        $out  = '';
        $from = 0;
        foreach ( self::find_cbp_blocks( $content ) as $block ) {
            $converted = self::convert_cbp_block( $block );
            if ( null === $converted ) {
                continue;
            }
            $out .= substr( $content, $from, $block['start'] - $from ) . $converted;
            $from = $block['start'] + $block['length'];
        }
        return $out . substr( $content, $from );
    }

    /**
     * Builds a CloudScale block comment from code content and an optional language slug.
     *
     * @since  1.5.0
     * @param  string $code Code content.
     * @param  string $lang  Language identifier, or empty string for auto-detect.
     * @param  string $title Title shown above the code, or empty string for none.
     * @return string Block comment markup.
     */
    private static function build_migrate_block( $code, $lang, $title = '' ) {
        $attrs = array( 'content' => $code );
        if ( ! empty( $lang ) ) {
            $attrs['language'] = $lang;
        }
        if ( '' !== $title ) {
            $attrs['title'] = $title;
        }

        // serialize_block_attributes(), not wp_json_encode(): core escapes
        // `--`, `<`, `>`, `&` and `"` to \u-sequences precisely because this
        // JSON lives inside an HTML comment. Raw `-->` in code would terminate
        // the comment (breaking the block into raw text the editor then
        // mangles into shortcode/paragraph fragments), and raw `<`/`>`/`--`
        // get eaten by wp_kses on any save without unfiltered_html (e.g. cron).
        $attrs_json = serialize_block_attributes( $attrs );

        return '<!-- wp:cloudscale/code-block ' . $attrs_json . ' /-->';
    }

    /**
     * LIKE patterns for the five legacy block markers the migrator converts.
     *
     * @since 1.10.878
     * @return string[]
     */
    private static function migrate_block_like_patterns(): array {
        global $wpdb;
        return array_map(
            static function ( string $marker ) use ( $wpdb ): string {
                return '%' . $wpdb->esc_like( $marker ) . '%';
            },
            array( '<!-- wp:code ', '<!-- wp:code-->', '<!-- wp:code-syntax-block/code', '<!-- wp:preformatted', self::CBP_OPEN )
        );
    }

    /**
     * Counts the total number of legacy code blocks in post content.
     *
     * @since  1.5.0
     * @param  string $content Post content.
     * @return int Number of legacy code blocks found.
     */
    private static function count_migrate_blocks( $content ) {
        $count  = preg_match_all( self::get_code_pattern(), $content, $m );
        $count += preg_match_all( self::get_preformatted_pattern(), $content, $m );
        foreach ( self::find_cbp_blocks( (string) $content ) as $block ) {
            if ( null !== self::convert_cbp_block( $block ) ) {
                ++$count;
            }
        }
        return $count;
    }

    /**
     * Converts all legacy code and preformatted blocks in post content to CloudScale blocks.
     *
     * @since  1.5.0
     * @param  string $content Post content.
     * @return string Post content with legacy blocks replaced.
     */
    private static function convert_content( $content ) {
        // Code Block Pro first: its markup holds a <pre> of its own, and it is replaced whole
        // before either pattern below reads the content.
        $content = self::convert_cbp_content( (string) $content );

        // `?? $content`: preg_replace_callback() answers null when a pattern runs into a PCRE
        // limit, and both callers write the result straight to the post. Null there is an
        // empty post; the unconverted content is the safe answer.
        $content = preg_replace_callback( self::get_code_pattern(), array( __CLASS__, 'convert_code_block' ), $content ) ?? $content;
        $content = preg_replace_callback( self::get_preformatted_pattern(), array( __CLASS__, 'convert_preformatted_block' ), $content ) ?? $content;
        return $content;
    }

    /**
     * Truncates a string to a maximum byte length, appending an ellipsis when cut.
     *
     * @since  1.5.0
     * @param  string $str String to truncate.
     * @param  int    $max Maximum byte length.
     * @return string Truncated string.
     */
    private static function truncate_block( $str, $max ) {
        if ( strlen( $str ) <= $max ) {
            return $str;
        }
        return substr( $str, 0, $max ) . "\n... [truncated]";
    }

    /**
     * Builds a before/after preview array for all legacy blocks in post content.
     *
     * @since  1.5.0
     * @param  string $content Post content.
     * @return array<int, array<string, mixed>> Preview data for each block found.
     */
    private static function get_migration_preview( $content ) {
        $blocks = array();

        preg_match_all( self::get_code_pattern(), $content, $matches, PREG_SET_ORDER );
        foreach ( $matches as $match ) {
            $original  = $match[0];
            $converted = self::convert_code_block( $match );

            $lang = '';
            if ( preg_match( '/"language":"([^"]+)"/', $converted, $lm ) ) {
                $lang = $lm[1];
            }

            $code_preview = html_entity_decode( $match[4], ENT_QUOTES | ENT_HTML5, 'UTF-8' );
            $first_line   = strtok( $code_preview, "\n" );
            if ( strlen( $first_line ) > 80 ) {
                $first_line = substr( $first_line, 0, 80 ) . '...';
            }

            $blocks[] = array(
                'index'      => count( $blocks ) + 1,
                'type'       => 'wp:code',
                'language'   => $lang ?: '(auto detect)',
                'first_line' => $first_line,
                'original'   => htmlspecialchars( self::truncate_block( $original, 500 ) ),
                'converted'  => htmlspecialchars( self::truncate_block( $converted, 500 ) ),
            );
        }

        preg_match_all( self::get_preformatted_pattern(), $content, $matches, PREG_SET_ORDER );
        foreach ( $matches as $match ) {
            $original  = $match[0];
            $converted = self::convert_preformatted_block( $match );

            $code_raw   = str_ireplace( array( '<br>', '<br/>', '<br />' ), "\n", $match[2] );
            $code_raw   = wp_strip_all_tags( $code_raw );
            $code_raw   = html_entity_decode( $code_raw, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
            $first_line = strtok( $code_raw, "\n" );
            if ( strlen( $first_line ) > 80 ) {
                $first_line = substr( $first_line, 0, 80 ) . '...';
            }

            $blocks[] = array(
                'index'      => count( $blocks ) + 1,
                'type'       => 'wp:preformatted',
                'language'   => '(auto detect)',
                'first_line' => $first_line,
                'original'   => htmlspecialchars( self::truncate_block( $original, 500 ) ),
                'converted'  => htmlspecialchars( self::truncate_block( $converted, 500 ) ),
            );
        }

        foreach ( self::find_cbp_blocks( (string) $content ) as $block ) {
            $converted = self::convert_cbp_block( $block );
            if ( null === $converted ) {
                continue;
            }

            $attrs      = self::cbp_attrs( $block['attrs'] );
            $lang       = self::cbp_language( $attrs['language'] ?? '' );
            $first_line = (string) strtok( (string) self::cbp_code( $attrs, $block['inner'] ), "\n" );
            if ( strlen( $first_line ) > 80 ) {
                $first_line = substr( $first_line, 0, 80 ) . '...';
            }

            $blocks[] = array(
                'index'      => count( $blocks ) + 1,
                'type'       => 'code-block-pro',
                'language'   => $lang ?: '(auto detect)',
                'first_line' => $first_line,
                'original'   => htmlspecialchars( self::truncate_block( substr( $content, $block['start'], $block['length'] ), 500 ) ),
                'converted'  => htmlspecialchars( self::truncate_block( $converted, 500 ) ),
            );
        }

        return $blocks;
    }

    /*
    ==================================================================
        7b. Migration: AJAX handlers
        ================================================================== */

    /**
     * AJAX handler: scans all posts for legacy code blocks and returns a list.
     *
     * @since  1.5.0
     * @return void Sends JSON response and exits.
     */
    public static function ajax_scan() {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }

        if ( ! check_ajax_referer( CSDT_DevTools::MIGRATE_NONCE, 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        global $wpdb;

        $like = self::migrate_block_like_patterns();
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
        $posts = $wpdb->get_results(
            $wpdb->prepare(
                "SELECT ID, post_title, post_status, post_date, post_content
                 FROM %i
                 WHERE post_type IN ('post', 'page')
                   AND post_status != 'trash'
                   AND ( post_content LIKE %s OR post_content LIKE %s OR post_content LIKE %s OR post_content LIKE %s OR post_content LIKE %s )
                 ORDER BY post_date DESC",
                $wpdb->posts,
                $like[0],
                $like[1],
                $like[2],
                $like[3],
                $like[4]
            )
        );

        if ( $posts === null ) {
            wp_send_json_error( 'Database error: ' . ( $wpdb->last_error ?: 'could not query posts' ) );
        }

        $results = array();
        foreach ( $posts as $post ) {
            $count = self::count_migrate_blocks( $post->post_content );
            if ( $count > 0 ) {
                $results[] = array(
                    'id'          => (int) $post->ID,
                    'title'       => $post->post_title,
                    'status'      => $post->post_status,
                    'date'        => wp_date( 'd M Y', strtotime( $post->post_date ) ),
                    'block_count' => $count,
                    'edit_url'    => get_edit_post_link( $post->ID, 'raw' ),
                    'view_url'    => get_permalink( $post->ID ),
                );
            }
        }

        wp_send_json_success(
            array(
				'posts'        => $results,
				'total_posts'  => count( $results ),
				'total_blocks' => array_sum( array_column( $results, 'block_count' ) ),
            )
        );
    }

    /**
     * AJAX handler: returns a before/after preview of the migration for a single post.
     *
     * @since  1.5.0
     * @return void Sends JSON response and exits.
     */
    public static function ajax_preview() {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }

        if ( ! check_ajax_referer( CSDT_DevTools::MIGRATE_NONCE, 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        $post_id = absint( wp_unslash( $_POST['post_id'] ?? 0 ) );
        $post    = get_post( $post_id );

        if ( ! $post ) {
            wp_send_json_error( 'Post not found.' );
        }

        $blocks = self::get_migration_preview( $post->post_content );

        wp_send_json_success(
            array(
				'post_id'     => $post_id,
				'title'       => $post->post_title,
				'block_count' => count( $blocks ),
				'blocks'      => $blocks,
            )
        );
    }

    /**
     * AJAX handler: migrates all legacy code blocks in a single post.
     *
     * @since  1.5.0
     * @return void Sends JSON response and exits.
     */
    public static function ajax_migrate_single() {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }

        // A MINTED TEST SESSION MUST NOT REACH THIS. Both scoped test roles hold manage_options, so
        // the check above is a capability check and not an identity one. Added 2026-08-17 with seven
        // sibling handlers, after widening tests/db-access-escalation-test.php to enumerate every
        // registration style and every file rather than `array( __CLASS__,` in cloudscale-cyber-devtools.php.
        if ( CSDT_DevTools::viewer_is_test_session() ) {
            wp_send_json_error( 'Not available to a test session.', 403 );
        }

        if ( ! check_ajax_referer( CSDT_DevTools::MIGRATE_NONCE, 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        $post_id = absint( wp_unslash( $_POST['post_id'] ?? 0 ) );
        $post    = get_post( $post_id );

        if ( ! $post ) {
            wp_send_json_error( 'Post not found.' );
        }

        $count       = self::count_migrate_blocks( $post->post_content );
        $new_content = self::convert_content( $post->post_content );

        if ( $new_content === $post->post_content ) {
            wp_send_json_error( 'No legacy code blocks found in this post.' );
        }

        global $wpdb;
        $wpdb->update( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- code migration custom table
            $wpdb->posts,
            array( 'post_content' => $new_content ),
            array( 'ID' => $post_id ),
            array( '%s' ),
            array( '%d' )
        );
        clean_post_cache( $post_id );

        wp_send_json_success(
            array(
				'post_id'         => $post_id,
				'blocks_migrated' => $count,
				'message'         => 'Migrated ' . $count . ' block(s) in "' . esc_html( $post->post_title ) . '".',
            )
        );
    }

    /**
     * AJAX handler: migrates all legacy code blocks across all matching posts.
     *
     * @since  1.5.0
     * @return void Sends JSON response and exits.
     */
    public static function ajax_migrate_all() {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }

        // A MINTED TEST SESSION MUST NOT REACH THIS. Both scoped test roles hold manage_options, so
        // the check above is a capability check and not an identity one. Added 2026-08-17 with seven
        // sibling handlers, after widening tests/db-access-escalation-test.php to enumerate every
        // registration style and every file rather than `array( __CLASS__,` in cloudscale-cyber-devtools.php.
        if ( CSDT_DevTools::viewer_is_test_session() ) {
            wp_send_json_error( 'Not available to a test session.', 403 );
        }

        if ( ! check_ajax_referer( CSDT_DevTools::MIGRATE_NONCE, 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        global $wpdb;

        $like = self::migrate_block_like_patterns();
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
        $posts = $wpdb->get_results(
            $wpdb->prepare(
                "SELECT ID, post_title, post_content
                 FROM %i
                 WHERE post_type IN ('post', 'page')
                   AND post_status != 'trash'
                   AND ( post_content LIKE %s OR post_content LIKE %s OR post_content LIKE %s OR post_content LIKE %s OR post_content LIKE %s )
                 ORDER BY ID ASC",
                $wpdb->posts,
                $like[0],
                $like[1],
                $like[2],
                $like[3],
                $like[4]
            )
        );

        $migrated_posts  = 0;
        $migrated_blocks = 0;
        $details         = array();

        foreach ( $posts as $post ) {
            $count = self::count_migrate_blocks( $post->post_content );
            if ( $count === 0 ) {
                continue;
            }

            $new_content = self::convert_content( $post->post_content );

            if ( $new_content !== $post->post_content ) {
                $wpdb->update( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- code migration custom table
                    $wpdb->posts,
                    array( 'post_content' => $new_content ),
                    array( 'ID' => $post->ID ),
                    array( '%s' ),
                    array( '%d' )
                );
                clean_post_cache( $post->ID );

                ++$migrated_posts;
                $migrated_blocks += $count;
                $details[]        = '#' . $post->ID . ': ' . esc_html( $post->post_title ) . ' (' . $count . ' blocks)';
            }
        }

        wp_send_json_success(
            array(
				'migrated_posts'  => $migrated_posts,
				'migrated_blocks' => $migrated_blocks,
				'details'         => $details,
            )
        );
    }

    /**
     * Walks parsed blocks recursively, clearing the `theme` attribute on every
     * cloudscale/code-block. Other attributes are left untouched.
     *
     * @param array $blocks  Parsed blocks (by reference for mutation).
     * @param int   $cleared Counter incremented per block where theme was reset.
     * @return void
     */
    private static function clear_theme_on_cs_blocks( array &$blocks, int &$cleared ): void {
        foreach ( $blocks as &$b ) {
            if ( ! is_array( $b ) ) {
				continue; }
            if ( ( $b['blockName'] ?? '' ) === 'cloudscale/code-block' ) {
                $attrs = $b['attrs'] ?? array();
                if ( ! empty( $attrs['theme'] ) ) {
                    $attrs['theme'] = '';
                    $b['attrs']     = $attrs;
                    ++$cleared;
                }
            }
            if ( ! empty( $b['innerBlocks'] ) && is_array( $b['innerBlocks'] ) ) {
                self::clear_theme_on_cs_blocks( $b['innerBlocks'], $cleared );
            }
        }
        unset( $b );
    }

    /**
     * AJAX handler: clears the per-block `theme` override on every
     * cloudscale/code-block across all posts so they inherit the site-wide
     * default. Other attributes (language, title, GitHub source, etc.) are
     * never touched.
     *
     * @since  1.9.0
     * @return void Sends JSON response and exits.
     */
    public static function ajax_reset_theme_all(): void {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( 'Forbidden', 403 );
        }

        // A MINTED TEST SESSION MUST NOT REACH THIS. Both scoped test roles hold manage_options, so
        // the check above is a capability check and not an identity one. Added 2026-08-17 with seven
        // sibling handlers, after widening tests/db-access-escalation-test.php to enumerate every
        // registration style and every file rather than `array( __CLASS__,` in cloudscale-cyber-devtools.php.
        if ( CSDT_DevTools::viewer_is_test_session() ) {
            wp_send_json_error( 'Not available to a test session.', 403 );
        }
        if ( ! check_ajax_referer( CSDT_DevTools::MIGRATE_NONCE, 'nonce', false ) ) {
            wp_send_json_error( 'Bad nonce', 403 );
        }

        global $wpdb;
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
        $posts = $wpdb->get_results(
            $wpdb->prepare(
                "SELECT ID, post_title, post_content
                 FROM %i
                 WHERE post_type NOT IN ('revision', 'auto-draft')
                   AND post_status NOT IN ('trash', 'auto-draft')
                   AND post_content LIKE %s
                 ORDER BY ID ASC",
                $wpdb->posts,
                '%' . $wpdb->esc_like( '<!-- wp:cloudscale/code-block' ) . '%'
            )
        );

        $posts_scanned = 0;
        $posts_changed = 0;
        $blocks_reset  = 0;
        $details       = array();

        foreach ( $posts as $post ) {
            ++$posts_scanned;
            $blocks   = parse_blocks( $post->post_content );
            $per_post = 0;
            self::clear_theme_on_cs_blocks( $blocks, $per_post );
            if ( $per_post === 0 ) {
				continue; }

            $new_content = serialize_blocks( $blocks );
            if ( $new_content === $post->post_content ) {
				continue; }

            // $wpdb->update writes the post_content verbatim (no wp_unslash dance), so
            // the JSON-escaped attrs from serialize_blocks survive intact.
            $wpdb->update( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- code migration custom table
                $wpdb->posts,
                array( 'post_content' => $new_content ),
                array( 'ID' => $post->ID ),
                array( '%s' ),
                array( '%d' )
            );
            clean_post_cache( $post->ID );

            ++$posts_changed;
            $blocks_reset += $per_post;
            $details[]     = '#' . $post->ID . ': ' . esc_html( $post->post_title ) . ' (' . $per_post . ' blocks)';
        }

        wp_send_json_success(
            array(
				'posts_scanned' => $posts_scanned,
				'posts_changed' => $posts_changed,
				'blocks_reset'  => $blocks_reset,
				'details'       => $details,
            )
        );
    }
}