<?php
/**
 * CSDT_Code_Block, the code block, its shortcode, themes and the editor paste guard.
 *
 * Methods of CSDT_DevTools, kept in a trait so the main plugin file stays readable. They run
 * as CSDT_DevTools methods: self::, static:: and CSDT_DevTools::name() resolve exactly as
 * before, and __CLASS__ . '::' . __FUNCTION__ stands in for __METHOD__ so logs keep naming the
 * class. Paths come from CSDT_PLUGIN_FILE, never __FILE__, which here would be this file.
 *
 * @package CloudScale_Cyber_DevTools
 * @since   1.10.936
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

trait CSDT_Code_Block {

    /**
     * Returns the theme registry mapping slugs to bundled stylesheet names and colours.
     *
     * Each entry maps a slug to its dark and light stylesheet name, display label, and
     * background colours for the wrapper/toolbar.
     *
     * `dark_css`/`light_css` are resolved as `assets/hljs-{name}.min.css`, so the name
     * must be a FLAT filename that exists in assets/. Five themes (Gruvbox, Solarized,
     * Panda, Tomorrow Night, Shades of Purple) shipped for a long time pointing at
     * stylesheets that were never bundled, two of them via upstream's `base16/` path,
     * which resolved to `assets/hljs-base16/...`, so choosing them enqueued a 404 and
     * the code block lost its colours entirely. The names are flat and the files are
     * present; `tests/theme-assets-test.php` now fails the build if a registry entry
     * names a stylesheet that is not in assets/.
     *
     * @since  1.7.0
     * @return array<string, array<string, string>>
     */
    public static function get_theme_registry(): array {
        return array(
            'atom-one'         => array(
                'label'         => 'Atom One',
                'dark_css'      => 'atom-one-dark',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#282c34',
                'dark_toolbar'  => '#21252b',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
            'github'           => array(
                'label'         => 'GitHub',
                'dark_css'      => 'github-dark',
                'light_css'     => 'github',
                'dark_bg'       => '#24292e',
                'dark_toolbar'  => '#1f2428',
                'light_bg'      => '#fff',
                'light_toolbar' => '#f6f8fa',
            ),
            'monokai'          => array(
                'label'         => 'Monokai',
                'dark_css'      => 'monokai',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#272822',
                'dark_toolbar'  => '#1e1f1c',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
            'nord'             => array(
                'label'         => 'Nord',
                'dark_css'      => 'nord',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#2e3440',
                'dark_toolbar'  => '#272c36',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
            'dracula'          => array(
                'label'         => 'Dracula',
                'dark_css'      => 'dracula',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#282a36',
                'dark_toolbar'  => '#21222c',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
            'tokyo-night'      => array(
                'label'         => 'Tokyo Night',
                'dark_css'      => 'tokyo-night-dark',
                'light_css'     => 'tokyo-night-light',
                'dark_bg'       => '#1a1b26',
                'dark_toolbar'  => '#16161e',
                'light_bg'      => '#d5d6db',
                'light_toolbar' => '#c8c9ce',
            ),
            'vs2015'           => array(
                'label'         => 'VS 2015 / VS Code',
                'dark_css'      => 'vs2015',
                'light_css'     => 'vs',
                'dark_bg'       => '#1e1e1e',
                'dark_toolbar'  => '#181818',
                'light_bg'      => '#fff',
                'light_toolbar' => '#f3f3f3',
            ),
            'stackoverflow'    => array(
                'label'         => 'Stack Overflow',
                'dark_css'      => 'stackoverflow-dark',
                'light_css'     => 'stackoverflow-light',
                'dark_bg'       => '#1c1b1b',
                'dark_toolbar'  => '#151414',
                'light_bg'      => '#f6f6f6',
                'light_toolbar' => '#e8e8e8',
            ),
            'night-owl'        => array(
                'label'         => 'Night Owl',
                'dark_css'      => 'night-owl',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#011627',
                'dark_toolbar'  => '#001122',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
            'gruvbox'          => array(
                'label'         => 'Gruvbox',
                'dark_css'      => 'gruvbox-dark-hard',
                'light_css'     => 'gruvbox-light-hard',
                'dark_bg'       => '#1d2021',
                'dark_toolbar'  => '#171819',
                'light_bg'      => '#f9f5d7',
                'light_toolbar' => '#ece8c8',
            ),
            'solarized'        => array(
                'label'         => 'Solarized',
                'dark_css'      => 'solarized-dark',
                'light_css'     => 'solarized-light',
                'dark_bg'       => '#002b36',
                'dark_toolbar'  => '#002530',
                'light_bg'      => '#fdf6e3',
                'light_toolbar' => '#eee8d5',
            ),
            'panda'            => array(
                'label'         => 'Panda',
                'dark_css'      => 'panda-syntax-dark',
                'light_css'     => 'panda-syntax-light',
                'dark_bg'       => '#292a2b',
                'dark_toolbar'  => '#222324',
                'light_bg'      => '#e6e6e6',
                'light_toolbar' => '#d9d9d9',
            ),
            'tomorrow'         => array(
                'label'         => 'Tomorrow Night',
                'dark_css'      => 'tomorrow-night-bright',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#000',
                'dark_toolbar'  => '#0a0a0a',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
            'shades-of-purple' => array(
                'label'         => 'Shades of Purple',
                'dark_css'      => 'shades-of-purple',
                'light_css'     => 'atom-one-light',
                'dark_bg'       => '#2d2b55',
                'dark_toolbar'  => '#252347',
                'light_bg'      => '#fafafa',
                'light_toolbar' => '#e8eaed',
            ),
        );
    }


    /**
     * Registers the block type and all its scripts and stylesheets.
     *
     * @since  1.0.0
     * @return void
     */
    public static function register_block() {
        // Serve hljs and its theme CSS from the plugin's own /assets/ directory so
        // they are not blocked by a strict CSP that would otherwise require an external CDN allowlist.
        $assets = plugins_url( 'assets/', CSDT_PLUGIN_FILE );

        wp_register_script(
            'csdt-hljs-core',
            $assets . 'highlight.min.js',
            array(),
            self::HLJS_VERSION,
            true
        );

        // highlight.js's browser bundle is the "common" build: 34 grammars, which does
        // NOT include Dockerfile even though the block's language picker offers it, a
        // Dockerfile block rendered with no colours at all and logged an "unknown
        // language" warning. This is upstream's own grammar for that version, loaded as
        // a separate file so the vendor bundle stays byte-identical to the published one.
        // It self-registers against window.hljs, so it must load after the core bundle.
        wp_register_script(
            'csdt-hljs-lang-dockerfile',
            $assets . 'hljs-lang-dockerfile.min.js',
            array( 'csdt-hljs-core' ),
            self::HLJS_VERSION,
            true
        );

        // Mermaid draws a code block whose language is `mermaid` as a diagram. 5.5 MB, so it is
        // registered here and enqueued only by render_block() when a page actually has one; every
        // other page pays nothing. Bundled rather than fetched from a CDN, for the same reason as
        // highlight.js above. Not a dependency of the front-end script: that script waits for it.
        wp_register_script(
            'csdt-mermaid',
            $assets . 'mermaid.min.js',
            array(),
            self::MERMAID_VERSION,
            true
        );

        // Chart.js draws a code block whose language is `chart` as a line, bar or pie chart. The
        // same arrangement as Mermaid: registered here, enqueued only by render_block() for a
        // chart block. cs-chart-block.js reads the author's text and styles the chart.
        wp_register_script(
            'csdt-chartjs',
            $assets . 'chartjs.min.js',
            array(),
            self::CHARTJS_VERSION,
            true
        );
        wp_register_script(
            'csdt-chart-block',
            $assets . 'cs-chart-block.js',
            array( 'csdt-chartjs' ),
            self::VERSION,
            true
        );

        // Vega draws a code block whose language is `vega` or `vega-lite` from a JSON
        // specification. Four scripts, enqueued only by render_block() for such a block:
        // Vega itself, its expression interpreter (so no chart needs eval, which a strict
        // Content Security Policy forbids), Vega-Lite (compiles the shorter grammar to Vega),
        // and cs-vega-block.js, which reads the block and applies the theme.
        wp_register_script(
            'csdt-vega',
            $assets . 'vega.min.js',
            array(),
            self::VEGA_VERSION,
            true
        );
        wp_register_script(
            'csdt-vega-interpreter',
            $assets . 'vega-interpreter.js',
            array( 'csdt-vega' ),
            self::VEGA_INTERPRETER_VERSION,
            true
        );
        wp_register_script(
            'csdt-vega-lite',
            $assets . 'vega-lite.min.js',
            array( 'csdt-vega' ),
            self::VEGA_LITE_VERSION,
            true
        );
        wp_register_script(
            'csdt-vega-block',
            $assets . 'cs-vega-block.js',
            array( 'csdt-vega', 'csdt-vega-interpreter', 'csdt-vega-lite' ),
            self::VERSION,
            true
        );

        // Register both theme stylesheets from the selected pair
        $pair_slug = get_option( 'csdt_devtools_code_theme_pair', 'atom-one' );
        $registry  = self::get_theme_registry();
        $pair      = isset( $registry[ $pair_slug ] ) ? $registry[ $pair_slug ] : $registry['atom-one'];

        wp_register_style(
            'csdt-hljs-theme-dark',
            $assets . 'hljs-' . $pair['dark_css'] . '.min.css',
            array(),
            self::HLJS_VERSION
        );
        wp_register_style(
            'csdt-hljs-theme-light',
            $assets . 'hljs-' . $pair['light_css'] . '.min.css',
            array(),
            self::HLJS_VERSION
        );

        wp_register_style(
            'csdt-code-block-frontend',
            plugins_url( 'assets/cs-code-block.css', CSDT_PLUGIN_FILE ),
            array( 'csdt-hljs-theme-dark', 'csdt-hljs-theme-light' ),
            self::VERSION
        );

        // Builds the PNG that Copy hands over for a drawn block. Small, and a dependency of
        // the frontend script so it is always there when a diagram or chart is.
        wp_register_script(
            'csdt-code-image',
            plugins_url( 'assets/cs-code-image.js', CSDT_PLUGIN_FILE ),
            array(),
            self::VERSION,
            true
        );

        wp_register_script(
            'csdt-code-block-frontend',
            plugins_url( 'assets/cs-code-block.js', CSDT_PLUGIN_FILE ),
            array( 'csdt-hljs-core', 'csdt-hljs-lang-dockerfile', 'csdt-code-image' ),
            self::VERSION,
            true
        );

        wp_register_style(
            'csdt-code-block-editor',
            plugins_url( 'assets/cs-code-block-editor.css', CSDT_PLUGIN_FILE ),
            array(),
            self::VERSION
        );

        wp_register_script(
            'csdt-code-block-editor-script',
            plugins_url( 'blocks/code/editor.js', CSDT_PLUGIN_FILE ),
            array( 'wp-blocks', 'wp-element', 'wp-block-editor', 'wp-components', 'wp-i18n', 'wp-data', 'wp-hooks' ),
            self::VERSION,
            true
        );

        register_block_type(
            dirname( CSDT_PLUGIN_FILE ) . '/blocks/code',
            array(
                'render_callback' => array( __CLASS__, 'render_block' ),
                'editor_script'   => 'csdt-code-block-editor-script',
            )
        );
    }


    /**
     * Enqueues the paste-time fence/bracket recovery interceptor and localizes
     * the AJAX endpoint + nonce it uses to report failures via Telegram.
     *
     * @since  1.10.265
     * @return void
     */
    public static function enqueue_paste_guard_script() {
        wp_enqueue_script(
            'csdt-code-block-paste-guard',
            plugins_url( 'blocks/code/paste-guard.js', CSDT_PLUGIN_FILE ),
            array( 'wp-blocks', 'wp-data', 'wp-dom-ready' ),
            self::VERSION,
            true
        );

        $data = array(
            'ajax_url' => admin_url( 'admin-ajax.php' ),
            'nonce'    => wp_create_nonce( 'csdt_devtools_paste_guard' ),
        );
        wp_add_inline_script( 'csdt-code-block-paste-guard', 'window.csdtPasteGuardData=' . wp_json_encode( $data ) . ';', 'before' );
    }

    /**
     * AJAX handler: reports that the client-side paste-time fence/bracket
     * recovery interceptor (blocks/code/paste-guard.js) either failed outright,
     * or that the older reactive merge fallback (cs-convert.js) had to run,
     * meaning the interceptor's detection missed a real case. Sends a Telegram
     * alert so the detection heuristic can be tightened, throttled to at most
     * one alert per layer every 30 minutes.
     *
     * @since  1.10.265
     * @return void
     */
    public static function ajax_paste_recovery_failed(): void {
        check_ajax_referer( 'csdt_devtools_paste_guard', 'nonce' );
        // Capability floor: this only fires from the block editor, so require the
        // editing capability, otherwise any logged-in user could drive error_log
        // writes / Telegram beacons (log-flood / alert-spam).
        if ( ! current_user_can( 'edit_posts' ) ) {
            wp_send_json_error( 'Unauthorized', 403 );
        }

        try {
            $layer     = sanitize_text_field( wp_unslash( $_POST['layer'] ?? 'interceptor' ) ); // 'interceptor' | 'merge-fallback' | 'diagnostic'
            $error_msg = sanitize_text_field( wp_unslash( $_POST['error_msg'] ?? '' ) );
            $snippet   = sanitize_textarea_field( wp_unslash( $_POST['snippet'] ?? '' ) );
            $post_id   = absint( wp_unslash( $_POST['post_id'] ?? 0 ) );

            if ( ! $error_msg && ! in_array( $layer, array( 'merge-fallback', 'diagnostic' ), true ) ) {
                wp_send_json_error( 'No error message', 400 );
                return;
            }

            self::log( '[CSDT] Paste-guard ' . $layer . ': ' . $error_msg . ( $snippet ? ( ' | snippet: ' . $snippet ) : '' ) );

            // Diagnostic beacons are for debugging the interceptor itself,
            // always logged above (unthrottled, so every real paste attempt
            // during an active investigation is visible), never alerted.
            if ( 'diagnostic' === $layer ) {
                wp_send_json_success( 'logged' );
                return;
            }

            if ( ! class_exists( 'CSDT_Telegram' ) || ! CSDT_Telegram::is_configured() ) {
                wp_send_json_success( 'logged' );
                return;
            }
            if ( CSDT_Options::get( 'csdt_notify_telegram_enabled' ) !== '1' ) {
                wp_send_json_success( 'logged' );
                return;
            }

            // Throttle per layer so a burst of failures from one bad paste
            // sends exactly one alert, and the two layers never share a window. Option-backed
            // (CSDT_Alert_Window): a transient window reset on every deploy's cache flush.
            if ( ! CSDT_Alert_Window::claim( 'paste_guard_' . $layer, 30 * MINUTE_IN_SECONDS ) ) {
                wp_send_json_success( 'throttled' );
                return;
            }

            $site  = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ) ?: home_url();
            $level = 'merge-fallback' === $layer ? 'warning' : 'error';
            $title = 'merge-fallback' === $layer
                ? 'Paste recovered only by the reactive INI-merge safety net, content may still be corrupted, interceptor missed this case'
                : 'Paste-time fence/bracket recovery interceptor failed';

            $msg = sprintf(
                "%s\nSite: %s\nPost: #%d\nURL: %s\nError: %s\nClipboard snippet:\n%s",
                $title,
                $site,
                $post_id,
                $post_id ? esc_url_raw( (string) get_edit_post_link( $post_id, 'raw' ) ) : '',
                $error_msg ?: '(n/a, merge fallback fired without a JS error)',
                mb_substr( $snippet, 0, 500 )
            );

            CSDT_Alert_Events::send( CSDT_Alert_Events::GENERAL, $msg, 'CloudScale Cyber Devtools', $level );
            wp_send_json_success( 'sent' );
        } catch ( \Throwable $e ) {
            CSDT_Ajax::fail( $e, __CLASS__ . '::' . __FUNCTION__ );
        }
    }


    /**
     * Enqueues the block editor auto-convert script and attaches the toast inline style.
     *
     * @since  1.5.0
     * @return void
     */
    public static function enqueue_convert_script() {
        wp_enqueue_script(
            'csdt-code-block-convert',
            plugins_url( 'assets/cs-convert.js', CSDT_PLUGIN_FILE ),
            // Depends on csdt-code-block-paste-guard so window.csdtPasteGuardData
            // (read by cs-convert.js's reportMergeFallback()) is guaranteed to be
            // printed before this script runs, regardless of enqueue call order.
            array( 'wp-blocks', 'wp-data', 'csdt-code-block-paste-guard' ),
            self::VERSION,
            true
        );
        // The toast's rules live in assets/cs-code-block-editor.css, the stylesheet this
        // editor already loads. They used to be a PHP string passed to wp_add_inline_style();
        // WordPress.org reads that as inline CSS, which it is.
    }

    /**
     * Enqueues the Replace Post with Clipboard button script in the block editor.
     *
     * @since  1.10.265
     * @return void
     */
    public static function enqueue_replace_post_script() {
        wp_enqueue_script(
            'csdt-replace-post',
            plugins_url( 'assets/cs-replace-post.js', CSDT_PLUGIN_FILE ),
            // Depends on csdt-code-block-paste-guard so window.__csPasteGuard
            // (the shared fence-detection helpers) is guaranteed to be defined
            // before this script runs, regardless of enqueue call order.
            array( 'wp-blocks', 'wp-data', 'wp-dom-ready', 'csdt-code-block-paste-guard' ),
            self::VERSION,
            true
        );
        wp_enqueue_style(
            'csdt-replace-post',
            plugins_url( 'assets/cs-replace-post.css', CSDT_PLUGIN_FILE ),
            array( 'wp-edit-post' ),
            self::VERSION
        );
    }


    /**
     * Renders a code block on the frontend.
     *
     * @since  1.0.0
     * @param  array  $attributes    Block attributes.
     * @param  string $block_content Existing block content (unused).
     * @return string HTML output.
     */
    public static function render_block( $attributes, $_block_content = '' ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed -- block render callback; second arg required by register_block_type arity
        self::maybe_enqueue_frontend();
        ++self::$instance_count;

        $id    = 'cs-code-' . self::$instance_count;
        $code  = isset( $attributes['content'] ) ? $attributes['content'] : '';
        $lang  = isset( $attributes['language'] ) ? $attributes['language'] : '';
        if ( self::is_mermaid( $lang ) ) {
            wp_enqueue_script( 'csdt-mermaid' );
        }
        if ( self::is_chart( $lang ) ) {
            wp_enqueue_script( 'csdt-chart-block' );
        }
        if ( self::is_vega( $lang ) ) {
            wp_enqueue_script( 'csdt-vega-block' );
        }
        $title = isset( $attributes['title'] ) ? $attributes['title'] : '';
        $theme = isset( $attributes['theme'] ) ? $attributes['theme'] : '';

        $gh_view_url = '';
        $gh_label    = 'GitHub';
        if ( ! empty( $attributes['githubUrl'] ) && ! empty( $attributes['githubShowLink'] ) ) {
            $provider = CSDT_Git_Providers::detect( (string) $attributes['githubUrl'] );
            $parts    = $provider ? $provider->parse( (string) $attributes['githubUrl'] ) : null;
            if ( $provider && $parts ) {
                // Whole-file link (no line anchor), the stored block doesn't carry line numbers.
                $gh_view_url = $provider->view_url( $parts, 0, 0 );
                $gh_label    = $provider->label();
            }
        }

        return self::build_html( $id, $code, $lang, $title, $theme, $gh_view_url, $gh_label );
    }

    /**
     * Whether a block's language asks for a Mermaid diagram rather than highlighted code.
     *
     * @since  1.10.947
     * @param  string $lang Block language attribute.
     * @return bool
     */
    public static function is_mermaid( $lang ) {
        return 'mermaid' === strtolower( trim( (string) $lang ) );
    }

    /**
     * Whether a block's language asks for a chart drawn by Chart.js rather than highlighted code.
     *
     * @param  string $lang Block language attribute.
     * @return bool
     */
    public static function is_chart( $lang ) {
        return in_array( strtolower( trim( (string) $lang ) ), self::CHART_LANGS, true );
    }

    /**
     * Whether a block's language asks for a chart drawn by Vega (a Vega or Vega-Lite
     * specification in JSON) rather than highlighted code.
     *
     * @param  string $lang Block language attribute.
     * @return bool
     */
    public static function is_vega( $lang ) {
        return in_array( strtolower( trim( (string) $lang ) ), self::VEGA_LANGS, true );
    }

    /**
     * Returns the inline SVG mark for a source provider. GitHub keeps its octocat;
     * other providers (GitLab, future) use a neutral git-branch glyph so we never
     * render a wrong-brand logo. Markup is a fixed literal, safe to echo directly.
     *
     * @since  1.10.265
     * @param  string $label Provider label ("GitHub", "GitLab", …).
     * @return string Inline SVG markup.
     */
    private static function source_icon_svg( $label ) {
        if ( 'GitHub' === $label ) {
            return '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 .5C5.65.5.5 5.65.5 12c0 5.08 3.29 9.39 7.86 10.91.58.1.79-.25.79-.56v-2.2c-3.2.7-3.88-1.36-3.88-1.36-.52-1.32-1.27-1.67-1.27-1.67-1.04-.71.08-.69.08-.69 1.15.08 1.76 1.18 1.76 1.18 1.02 1.75 2.68 1.24 3.34.95.1-.74.4-1.24.73-1.53-2.55-.29-5.24-1.28-5.24-5.7 0-1.26.45-2.29 1.18-3.1-.12-.29-.51-1.46.11-3.04 0 0 .97-.31 3.17 1.18a11 11 0 0 1 2.88-.39c.98 0 1.97.13 2.88.39 2.2-1.49 3.17-1.18 3.17-1.18.62 1.58.23 2.75.11 3.04.74.81 1.18 1.84 1.18 3.1 0 4.43-2.69 5.41-5.25 5.69.41.36.78 1.06.78 2.14v3.17c0 .31.21.67.8.56C20.21 21.39 23.5 17.08 23.5 12 23.5 5.65 18.35.5 12 .5z"/></svg>';
        }
        return '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><line x1="6" y1="3" x2="6" y2="15"/><circle cx="18" cy="6" r="3"/><circle cx="6" cy="18" r="3"/><path d="M18 9a9 9 0 0 1-9 9"/></svg>';
    }

    /**
     * Builds the full HTML markup for a code block.
     *
     * @since  1.0.0
     * @param  string $id    Unique HTML element ID.
     * @param  string $code  Code content to display.
     * @param  string $lang  Language identifier for highlight.js, or empty for auto-detect.
     * @param  string $title Optional filename or title label.
     * @param  string $theme Per-block colour-theme override slug, or empty for site default.
     * @param  string $gh_view_url Source "view file" URL, or empty when not linked.
     * @param  string $gh_label    Provider label for link text ("GitHub", "GitLab").
     * @return string HTML markup.
     */
    private static function build_html( $id, $code, $lang, $title, $theme, $gh_view_url = '', $gh_label = 'GitHub' ) {
        $lang_class = $lang ? 'language-' . esc_attr( $lang ) : '';

        // Opt-in, default OFF per WordPress.org Guideline 10 (front-end credit
        // links must not ship enabled by default).
        $cloudscale_link = CSDT_Login::credit_opted_in() ? '<a class="cs-code-brand" href="https://help.cloudscale.consulting/plugin-help/cyber-devtools/code-block/" target="_blank" rel="noopener noreferrer"><span class="cs-brand-bolt">&#9889;</span> Powered by CloudScale</a>' : '';

        $title_html = '';
        if ( $title ) {
            $title_html = '<div class="cs-code-title">' . esc_html( $title ) . '</div>';
        }

        // Built by concatenation, not captured from a template: WordPress.org rejects a plugin
        // that manages its own output buffer, and this is the front-end path every code block on
        // the site goes through. Markup and escaping are unchanged -- each interpolation below is
        // the same esc_*() call it was inside the template.
        $lines_title  = esc_attr__( 'Toggle line numbers', 'cloudscale-cyber-devtools' );
        $theme_attr   = $theme ? ' data-theme="' . esc_attr( $theme ) . '"' : '';

        // esc_html() first, then the two bracket characters to entities, so a shortcode written
        // inside a code block is displayed rather than run by the shortcode parser.
        $code_html    = str_replace( array( '[', ']' ), array( '&#91;', '&#93;' ), esc_html( $code ) );

        $gh_button = '';
        $gh_footer = '';
        if ( $gh_view_url ) {
            /* translators: %s is the name of the code hosting service (e.g. GitHub, GitLab) */
            $gh_title  = esc_attr( sprintf( __( 'View source on %s', 'cloudscale-cyber-devtools' ), $gh_label ) );
            $gh_button = '<a class="cs-code-gh-btn" href="' . esc_url( $gh_view_url ) . '"'
                . ' target="_blank" rel="noopener noreferrer"'
                . ' title="' . $gh_title . '" aria-label="' . $gh_title . '">'
                . self::source_icon_svg( $gh_label )
                . '<span class="cs-gh-label">' . esc_html__( 'Linked', 'cloudscale-cyber-devtools' ) . '</span>'
                . '</a>';
            $gh_footer_label = sprintf(
                /* translators: %s: source provider name, e.g. GitHub or GitLab. */
                __( '%s repo:', 'cloudscale-cyber-devtools' ),
                $gh_label
            );
            $gh_footer       = '<div class="cs-code-gh-footer">'
                . '<a class="cs-code-gh-link" href="' . esc_url( $gh_view_url ) . '" target="_blank" rel="noopener noreferrer">'
                . self::source_icon_svg( $gh_label )
                . '<span>' . esc_html( $gh_footer_label ) . '</span>'
                . '</a></div>';
        }

        return '<div class="cs-code-wrapper" id="' . esc_attr( $id ) . '"' . $theme_attr . '>'
            . '<div class="cs-code-toolbar">'
            . wp_kses_post( $cloudscale_link )
            . wp_kses_post( $title_html )
            . '<span class="cs-code-lang-badge"></span>'
            . '<div class="cs-code-actions">'
            . $gh_button
            . '<button type="button" class="cs-code-lines-toggle" title="' . $lines_title . '" aria-label="' . $lines_title . '">'
            . self::ICON_LINES_SVG
            . '</button>'
            . '<button type="button" class="cs-code-theme-toggle" title="' . esc_attr__( 'Toggle light/dark mode', 'cloudscale-cyber-devtools' ) . '" aria-label="' . esc_attr__( 'Toggle theme', 'cloudscale-cyber-devtools' ) . '">'
            . self::ICON_SUN_SVG . self::ICON_MOON_SVG
            . '</button>'
            . '<button type="button" class="cs-code-copy" title="' . esc_attr__( 'Copy to clipboard', 'cloudscale-cyber-devtools' ) . '" aria-label="' . esc_attr__( 'Copy code', 'cloudscale-cyber-devtools' ) . '">'
            . self::ICON_COPY_SVG . self::ICON_CHECK_SVG
            . '<span class="cs-copy-label">' . esc_html__( 'Copy', 'cloudscale-cyber-devtools' ) . '</span>'
            . '</button>'
            . '</div></div>'
            . '<div class="cs-code-body">'
            . '<pre><code class="' . esc_attr( $lang_class ) . '">' . $code_html . '</code></pre>'
            . '</div>'
            . $gh_footer
            . '</div>';
    }

    /**
     * Enqueues frontend scripts and styles on first block render, then localises config.
     *
     * @since  1.0.0
     * @return void
     */
    private static function maybe_enqueue_frontend() {
        if ( self::$assets_enqueued ) {
            return;
        }
        self::$assets_enqueued = true;

        wp_enqueue_style( 'csdt-hljs-theme-dark' );
        wp_enqueue_style( 'csdt-hljs-theme-light' );
        wp_enqueue_style( 'csdt-code-block-frontend' );
        wp_enqueue_script( 'csdt-hljs-core' );
        wp_enqueue_script( 'csdt-code-block-frontend' );

        $default_theme = get_option( 'csdt_devtools_code_default_theme', 'dark' );
        $pair_slug     = get_option( 'csdt_devtools_code_theme_pair', 'atom-one' );
        $registry      = self::get_theme_registry();
        $pair          = isset( $registry[ $pair_slug ] ) ? $registry[ $pair_slug ] : $registry['atom-one'];

        wp_localize_script(
            'csdt-code-block-frontend',
            'csdtDevtoolsCodeConfig',
            array(
				'defaultTheme' => $default_theme,
				'themePair'    => $pair_slug,
				'darkBg'       => $pair['dark_bg'],
				'darkToolbar'  => $pair['dark_toolbar'],
				'lightBg'      => $pair['light_bg'],
				'lightToolbar' => $pair['light_toolbar'],
			)
        );
    }


    /**
     * Registers the [csdt_devtools_code] shortcode.
     *
     * @since  1.0.0
     * @return void
     */
    public static function register_shortcode() {
        add_shortcode( 'csdt_devtools_code', array( __CLASS__, 'render_shortcode' ) );
    }

    /**
     * Renders the [csdt_devtools_code] shortcode.
     *
     * @since  1.0.0
     * @param  array       $atts    Shortcode attributes.
     * @param  string|null $content Shortcode content.
     * @return string HTML output.
     */
    public static function render_shortcode( $atts, $content = null ) {
        $atts = shortcode_atts(
            array(
				'lang'  => '',
				'theme' => '',
				'title' => '',
            ),
            $atts,
            'csdt_devtools_code'
        );

        $code = self::decode_shortcode_content( $content );

        return self::render_block(
            array(
				'content'  => $code,
				'language' => $atts['lang'],
				'title'    => $atts['title'],
				'theme'    => $atts['theme'],
            )
        );
    }

    /**
     * Decodes WordPress-mangled HTML entities and line breaks from shortcode content.
     *
     * @since  1.0.0
     * @param  string|null $content Raw shortcode content.
     * @return string Plain-text code with entities decoded.
     */
    private static function decode_shortcode_content( $content ) {
        $content = preg_replace( '#^<p>|</p>$#i', '', trim( $content ) );
        $content = str_replace(
            array( '<br />', '<br/>', '<br>', '&#8220;', '&#8221;', '&#8216;', '&#8217;', '&nbsp;', '&#038;' ),
            array( "\n", "\n", "\n", '"', '"', "'", "'", ' ', '&' ),
            $content
        );
        $content = html_entity_decode( $content, ENT_QUOTES, 'UTF-8' );
        return trim( $content );
    }
}