<?php
if ( ! defined( 'ABSPATH' ) ) exit;

class COOKROCO_Admin {
    private const CAP  = 'manage_options';
    private const SLUG = 'cookie-rocket';
    private COOKROCO_Consent $consent;
    private COOKROCO_Log $log;
    public function __construct( COOKROCO_Consent $consent, COOKROCO_Log $log ) {
        $this->consent = $consent; $this->log = $log;
        add_action( 'admin_menu',            [ $this, 'register_menu' ] );
        // Late: every plugin (incl. Pro) has registered by now, so the sidebar can be ordered to match the tabs.
        add_action( 'admin_menu', [ $this, 'sync_submenu_order' ], 99 );
        add_action( 'admin_init',            [ $this, 'register_settings' ] );
        add_action( 'admin_init',            [ $this, 'handle_notice_actions' ] );
        add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_scripts' ] );
        add_action( 'all_admin_notices',     [ $this, 'render_admin_chrome' ] );
        add_filter( 'admin_body_class',      [ $this, 'body_class' ] );
        add_action( 'wp_ajax_cookroco_save_settings', [ $this, 'ajax_save_settings' ] );
        add_action( 'wp_ajax_cookroco_save_design',   [ $this, 'ajax_save_design' ] );
        add_action( 'wp_ajax_cookroco_save_layout',   [ $this, 'ajax_save_layout' ] );
        add_action( 'wp_ajax_cookroco_save_content',  [ $this, 'ajax_save_content' ] );
        add_action( 'admin_init',            [ $this, 'ensure_onboarding_decided' ] );
        add_action( 'admin_post_cookroco_wizard', [ $this, 'handle_wizard' ] );
        add_action( 'admin_post_cookroco_autopilot', [ $this, 'handle_autopilot' ] );
        add_filter( 'plugin_action_links_' . plugin_basename(COOKROCO_PLUGIN_FILE), [ $this, 'plugin_links' ] );
        // The banner, its rules and its texts are written into every page: a page cache would keep
        // serving the old ones (and the old policy version) until it expired on its own.
        foreach ( [ 'cookroco_settings', 'cookroco_banner_design', 'cookroco_cookie_categories', 'cookroco_custom_services', 'cookroco_policy_page_id' ] as $opt ) {
            add_action( 'update_option_' . $opt, [ __CLASS__, 'purge_page_caches' ] );
        }
    }

    /**
     * Empties the page cache of the common caching plugins, through their own public functions
     * and actions. Each is called only if that plugin is present; once per request at most.
     */
    public static function purge_page_caches(): void {
        static $done = false;
        if ( $done ) {
            return;
        }
        $done = true;
        if ( function_exists( 'rocket_clean_domain' ) ) { rocket_clean_domain(); }              // WP Rocket.
        if ( function_exists( 'w3tc_flush_all' ) ) { w3tc_flush_all(); }                        // W3 Total Cache.
        if ( function_exists( 'wp_cache_clear_cache' ) ) { wp_cache_clear_cache(); }            // WP Super Cache.
        if ( function_exists( 'sg_cachepress_purge_cache' ) ) { sg_cachepress_purge_cache(); }  // SiteGround Optimizer.
        if ( function_exists( 'wpo_cache_flush' ) ) { wpo_cache_flush(); }                      // WP-Optimize.
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- LiteSpeed Cache's own purge action.
        do_action( 'litespeed_purge_all' );
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Cache Enabler's own purge action.
        do_action( 'cache_enabler_clear_complete_cache' );
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WP Fastest Cache's own purge action.
        do_action( 'wpfc_clear_all_cache' );
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Breeze's own purge action.
        do_action( 'breeze_clear_all_cache' );
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Hummingbird's own purge action.
        do_action( 'wphb_clear_page_cache' );
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Nginx Helper's own purge action.
        do_action( 'rt_nginx_helper_purge_all' );
    }

    /**
     * Decide, exactly once, whether to show the first-run setup wizard.
     *  - No flag at all  → an existing install that upgraded into this version (a new install
     *    would have had it seeded to '0' by COOKROCO_Core::activate). Mark it onboarded; never
     *    surprise a live site with the wizard.
     *  - Flag '0'        → a genuinely new install on its first admin visit: open the wizard once,
     *    then flip to '1' so it never auto-opens again (it stays available to re-run by hand).
     */
    public function ensure_onboarding_decided(): void {
        if ( ! current_user_can( self::CAP ) || wp_doing_ajax() ) {
            return;
        }
        // An install that predates the onboarding flag is already configured — mark it done so the
        // first-run autopilot never shows to an existing site. A genuinely new install keeps its
        // seeded '0' so the Status screen leads with the one-click autopilot hero (no forced wizard).
        if ( false === get_option( 'cookroco_onboarded', false ) ) {
            update_option( 'cookroco_onboarded', '1' );
        }
    }
    public function register_settings(): void {
        register_setting( 'cookroco_settings_group', 'cookroco_settings', [
            'type'              => 'array',
            'sanitize_callback' => [ $this, 'sanitize_settings_option' ],
            'default'           => [],
        ] );
        register_setting( 'cookroco_design_group', 'cookroco_banner_design', [
            'type'              => 'array',
            'sanitize_callback' => [ $this, 'sanitize_design_option' ],
            'default'           => [],
        ] );
        register_setting( 'cookroco_services_group', 'cookroco_custom_services', [
            'type'              => 'array',
            'sanitize_callback' => [ $this, 'sanitize_services_option' ],
            'default'           => [],
        ] );
        register_setting( 'cookroco_categories_group', 'cookroco_cookie_categories', [
            'type'              => 'array',
            'sanitize_callback' => [ $this, 'sanitize_categories_option' ],
            'default'           => [],
        ] );
    }

    public function sanitize_settings_option( $raw ): array {
        $r = is_array( $raw ) ? $raw : [];
        $c = (array) get_option( 'cookroco_settings', [] ); // Preserve fields set outside this form (layout/position via the visual picker).
        if ( ! is_array( $c ) ) { $c = []; }
        // Multi-form safe: a partial form (e.g. Blocking → Advanced) declares the checkbox keys
        // it owns via cookroco_settings[_fields][]. Checkbox keys NOT owned by the submitting
        // form are preserved from the stored value instead of being read as "absent = off" —
        // otherwise a second form that writes cookroco_settings would silently wipe the boxes it
        // doesn't render. No _fields marker = a full form (the legacy Settings page): read all.
        $scope = ( isset( $r['_fields'] ) && is_array( $r['_fields'] ) ) ? array_map( 'sanitize_key', $r['_fields'] ) : null;
        $cb = static function ( string $k, bool $default = false ) use ( $r, $c, $scope ): bool {
            $owned = ( null === $scope ) || in_array( $k, $scope, true );
            if ( $owned ) { return ! empty( $r[ $k ] ); }
            return array_key_exists( $k, $c ) ? ! empty( $c[ $k ] ) : $default;
        };
        // Off unless the owner turns it on.
        $show_floating = $cb( 'show_floating_button' );
        $law_key = in_array( $r['default_law'] ?? $c['default_law'] ?? 'generic', [ 'gdpr', 'ccpa', 'lgpd', 'lfpdppp', 'generic' ], true ) ? ( $r['default_law'] ?? $c['default_law'] ?? 'generic' ) : 'generic';
        $out = [
            'banner_variant'        => in_array( $r['banner_variant'] ?? $c['banner_variant'] ?? 'bottom_bar', [ 'bottom_bar', 'top_bar', 'modal', 'floating', 'drawer' ], true ) ? ( $r['banner_variant'] ?? $c['banner_variant'] ?? 'bottom_bar' ) : 'bottom_bar',
            'banner_position'       => in_array( $r['banner_position'] ?? $c['banner_position'] ?? 'right', [ 'left', 'right', 'center' ], true ) ? ( $r['banner_position'] ?? $c['banner_position'] ?? 'right' ) : 'right',
            'banner_font'           => in_array( $r['banner_font'] ?? $c['banner_font'] ?? 'system', [ 'system', 'match', 'custom' ], true ) ? ( $r['banner_font'] ?? $c['banner_font'] ?? 'system' ) : 'system',
            'banner_font_family'    => sanitize_text_field( mb_substr( (string) ( $r['banner_font_family'] ?? $c['banner_font_family'] ?? '' ), 0, 120 ) ),
            'bar_width'             => in_array( $r['bar_width'] ?? $c['bar_width'] ?? 'contained', [ 'contained', 'full' ], true ) ? ( $r['bar_width'] ?? $c['bar_width'] ?? 'contained' ) : 'contained',
            'show_backdrop'         => array_key_exists( 'show_backdrop', $r ) ? ! empty( $r['show_backdrop'] ) : ! empty( $c['show_backdrop'] ),
            // Banner content/typography is managed by the Cookie Banner → Content panel (AJAX).
            // The Settings form does not carry these fields, so preserve them from the existing
            // option ($c) instead of resetting to defaults.
            'show_reject_button'    => array_key_exists( 'show_reject_button', $r ) ? ! empty( $r['show_reject_button'] ) : ! empty( $c['show_reject_button'] ),
            'show_config_button'    => array_key_exists( 'show_config_button', $r ) ? ! empty( $r['show_config_button'] ) : ( array_key_exists( 'show_config_button', $c ) ? ! empty( $c['show_config_button'] ) : true ),
            'show_floating_button'  => $show_floating,
            // Under the GDPR consent lasts 13 months at most (395 days, the CNIL's ceiling).
            'consent_duration_days' => max( 1, min( 'gdpr' === $law_key ? 395 : 730, absint( $r['consent_duration_days'] ?? $c['consent_duration_days'] ?? 365 ) ) ),
            'log_retention_days'    => max( 30, min( 3650, absint( $r['log_retention_days'] ?? $c['log_retention_days'] ?? 365 ) ) ),
            'policy_version'        => mb_substr( sanitize_text_field( $r['policy_version'] ?? $c['policy_version'] ?? '1.0' ), 0, 20 ), // the consent log column holds 20 characters; a longer value would stop every record from being written
            'banner_title'          => sanitize_text_field( mb_substr( (string) ( $r['banner_title'] ?? $c['banner_title'] ?? '' ), 0, 80 ) ),
            'banner_body'           => sanitize_textarea_field( mb_substr( (string) ( $r['banner_body'] ?? $c['banner_body'] ?? '' ), 0, 1000 ) ),
            'btn_accept_text'       => sanitize_text_field( mb_substr( (string) ( $r['btn_accept_text'] ?? $c['btn_accept_text'] ?? '' ), 0, 32 ) ),
            'btn_reject_text'       => sanitize_text_field( mb_substr( (string) ( $r['btn_reject_text'] ?? $c['btn_reject_text'] ?? '' ), 0, 32 ) ),
            'btn_config_text'       => sanitize_text_field( mb_substr( (string) ( $r['btn_config_text'] ?? $c['btn_config_text'] ?? '' ), 0, 32 ) ),
            'modal_title'           => sanitize_text_field( mb_substr( (string) ( $r['modal_title'] ?? $c['modal_title'] ?? '' ), 0, 80 ) ),
            'modal_desc'            => sanitize_textarea_field( mb_substr( (string) ( $r['modal_desc'] ?? $c['modal_desc'] ?? '' ), 0, 1000 ) ),
            // Where the banner's privacy link goes when the notice lives elsewhere (a group site,
            // a legal portal). Empty = the Cookie Policy page, or else WordPress's privacy page.
            'policy_url'            => esc_url_raw( trim( (string) ( $r['policy_url'] ?? $c['policy_url'] ?? '' ) ), [ 'https', 'http' ] ),
            'title_size'            => max( 14, min( 22, intval( $r['title_size'] ?? $c['title_size'] ?? 18 ) ) ),
            'body_size'             => max( 11, min( 15, intval( $r['body_size'] ?? $c['body_size'] ?? 12 ) ) ),
            'default_law'           => $law_key,
            // Opt-out only where the law allows it: the GDPR, the LGPD and the LFPDPPP ask for
            // consent BEFORE tracking, so for them the model is always opt-in.
            'default_state'         => ( 'opt_out' === ( $r['default_state'] ?? $c['default_state'] ?? 'opt_in' ) && ! in_array( $law_key, COOKROCO_Consent::OPT_IN_LAWS, true ) ) ? 'opt_out' : 'opt_in',
            'woocommerce_mode'      => 'auto',
            'gcm_enabled'           => $cb( 'gcm_enabled', true ),
            'block_scripts'         => $cb( 'block_scripts', true ),
            'block_raw_html'        => $cb( 'block_raw_html', false ),
            'block_embeds'          => $cb( 'block_embeds', true ),
            // Off unless ticked: deleting the plugin keeps the consent records (proof of consent).
            'delete_data_on_uninstall' => $cb( 'delete_data_on_uninstall' ),
        ];
        // Keys this form does not know (Cookie Rocket Pro's, or any add-on's) are carried over from
        // the stored value. Without this, saving while Pro is not loaded (the free edition still
        // active next to it, or Pro switched off for a while) silently wiped Pro's settings.
        $out += $c;
        return apply_filters( 'cookroco_sanitize_settings', $out, $r, $c );
    }

    public function sanitize_design_option( $raw ): array {
        $r = is_array( $raw ) ? $raw : [];
        $c = get_option( 'cookroco_banner_design', [] ); // Preserve fields not present in the submitted form.
        if ( ! is_array( $c ) ) { $c = []; }
        $out = [
            'primary_color'     => sanitize_hex_color( $r['primary_color']     ?? $c['primary_color']     ?? '#111827' ),
            'text_color'        => sanitize_hex_color( $r['text_color']        ?? $c['text_color']        ?? '#1a1a1a' ),
            'background_color'  => sanitize_hex_color( $r['background_color']  ?? $c['background_color']  ?? '#ffffff' ),
            'accept_button_bg'  => sanitize_hex_color( $r['accept_button_bg']  ?? $c['accept_button_bg']  ?? '#111827' ),
            'accept_text_color' => sanitize_hex_color( $r['accept_text_color'] ?? $c['accept_text_color'] ?? '#ffffff' ),
            'reject_button_bg'  => sanitize_hex_color( $r['reject_button_bg']  ?? $c['reject_button_bg']  ?? '#6b7280' ),
            // Secondary buttons (Reject / Customize): 'outline' (default, current ghost look) or
            // 'solid' (filled with the colors below). Default preserves every existing banner.
            'secondary_btn_style' => in_array( $r['secondary_btn_style'] ?? $c['secondary_btn_style'] ?? 'outline', [ 'outline', 'solid' ], true ) ? ( $r['secondary_btn_style'] ?? $c['secondary_btn_style'] ?? 'outline' ) : 'outline',
            'secondary_btn_bg'    => sanitize_hex_color( $r['secondary_btn_bg']   ?? $c['secondary_btn_bg']   ?? '#6b7280' ),
            'secondary_btn_text'  => sanitize_hex_color( $r['secondary_btn_text'] ?? $c['secondary_btn_text'] ?? '#ffffff' ),
            'border_radius'     => self::sanitize_radius( $r['border_radius'] ?? null, $c['border_radius'] ?? '0px' ),
            // The line around the banner: on unless turned off, as every banner had it before.
            'banner_border'     => 'off' === ( $r['banner_border'] ?? $c['banner_border'] ?? 'on' ) ? 'off' : 'on',
            // The shadow under the banner: off unless turned on, as no banner had one before.
            'banner_shadow'     => 'on' === ( $r['banner_shadow'] ?? $c['banner_shadow'] ?? 'off' ) ? 'on' : 'off',
            'dark_mode'         => in_array( $r['dark_mode'] ?? $c['dark_mode'] ?? 'auto', [ 'auto', 'light', 'dark' ], true ) ? ( $r['dark_mode'] ?? $c['dark_mode'] ?? 'auto' ) : 'auto',
            'theme'             => sanitize_key( $r['theme'] ?? $c['theme'] ?? '' ),
        ];
        /**
         * Filters the sanitized banner design, so an add-on can keep and clean its own fields.
         *
         * @param array $out Sanitized design.
         * @param array $r   Submitted values.
         * @param array $c   Stored design before this save.
         */
        $out += $c; // Pro's design keys survive a save made while Pro is not loaded (see the settings above).
        return (array) apply_filters( 'cookroco_sanitize_design', $out, $r, $c );
    }

    public function sanitize_categories_option( $raw ): array {
        $existing = get_option( 'cookroco_cookie_categories', [] );
        if ( ! is_array( $existing ) ) $existing = [];
        $raw = is_array( $raw ) ? $raw : [];
        $out = [];
        // Edits the existing categories only (label/description/order) and preserves
        // required/enabled. Keys are never created here: the set of categories comes from
        // the stored option, so a crafted form cannot introduce new ones.
        foreach ( $existing as $key => $cat ) {
            if ( ! is_array( $cat ) ) { continue; } // a scalar element in a corrupt/imported categories option would fatal array_key_exists() below.
            $r = isset( $raw[ $key ] ) && is_array( $raw[ $key ] ) ? $raw[ $key ] : [];
            $out[ $key ] = [
                'label'       => sanitize_text_field( mb_substr( (string) ( $r['label'] ?? ( $cat['label'] ?? $key ) ), 0, 60 ) ),
                'description' => sanitize_textarea_field( mb_substr( (string) ( $r['description'] ?? ( $cat['description'] ?? '' ) ), 0, 300 ) ),
                'required'    => ! empty( $cat['required'] ),
                'enabled'     => array_key_exists( 'enabled', $cat ) ? ! empty( $cat['enabled'] ) : true,
                'order'       => max( 1, min( 99, absint( $r['order'] ?? ( $cat['order'] ?? 99 ) ) ) ),
            ];
        }
        return $out;
    }

    /**
     * Gives a hidden admin page (registered with parent '') its screen title.
     *
     * WordPress cannot resolve a title for a page that has no parent menu, so admin-header.php
     * hands null to strip_tags() and PHP 8.1+ writes a deprecation to the site's debug log on
     * every visit. Setting the title on the page's load hook, which runs before the header is
     * built, fills the gap that get_admin_page_title() leaves.
     *
     * @param string|false $hook       Hook suffix returned by add_submenu_page().
     * @param string       $page_title Title to show for the page.
     */
    public static function title_hidden_page( $hook, string $page_title ): void {
        if ( ! $hook ) {
            return;
        }
        add_action(
            'load-' . $hook,
            static function () use ( $page_title ) {
                global $title;
                if ( empty( $title ) ) {
                    $title = $page_title; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Fills the screen title WordPress leaves null for pages without a parent menu.
                }
            }
        );
    }

    public function register_menu(): void {
        add_menu_page( 'Cookie Rocket','Cookie Rocket',self::CAP,self::SLUG,[$this,'render_dashboard'],'dashicons-privacy',80 );
        // Four task sections in the sidebar: Status, Banner, Blocking, Compliance. Everything
        // else (Settings, Consent Log, Scanner) stays registered and routable — so every old
        // deep link keeps working — but is reached from inside its owning section, not as its
        // own sidebar item. This is the "9 destinations → 4" collapse.
        add_submenu_page( self::SLUG,__('Status','cookie-rocket'),__('Status','cookie-rocket'),self::CAP,self::SLUG,[$this,'render_dashboard'] );
        add_submenu_page( self::SLUG,__('Banner','cookie-rocket'),__('Banner','cookie-rocket'),self::CAP,self::SLUG.'-design',[$this,'render_design'] );
        add_submenu_page( self::SLUG,__('Blocking','cookie-rocket'),__('Blocking','cookie-rocket'),self::CAP,self::SLUG.'-categories',[$this,'render_categories'] );
        add_submenu_page( self::SLUG,__('Compliance','cookie-rocket'),__('Compliance','cookie-rocket'),self::CAP,self::SLUG.'-policy',[$this,'render_policy'] );
        // Absorbed pages — hidden from the sidebar (parent ''), still routable so bookmarks live.
        self::title_hidden_page( add_submenu_page( '', __('Settings','cookie-rocket'),__('Settings','cookie-rocket'),self::CAP,self::SLUG.'-settings',[$this,'render_settings'] ), __('Settings','cookie-rocket') );
        self::title_hidden_page( add_submenu_page( '', __('Scanner','cookie-rocket'),__('Scanner','cookie-rocket'),self::CAP,self::SLUG.'-scanner',[$this,'render_scanner'] ), __('Scanner','cookie-rocket') );
        self::title_hidden_page( add_submenu_page( '', __('Consent Log','cookie-rocket'),__('Consent Log','cookie-rocket'),self::CAP,self::SLUG.'-log',[$this,'render_log'] ), __('Consent Log','cookie-rocket') );
        // First-run setup wizard: hidden page, reached via auto-open on a new install or the
        // "Re-run setup" link on Status. Not a permanent destination.
        self::title_hidden_page( add_submenu_page( '', __('Set up Cookie Rocket','cookie-rocket'),__('Setup','cookie-rocket'),self::CAP,self::SLUG.'-setup',[$this,'render_wizard'] ), __('Set up Cookie Rocket','cookie-rocket') );
    }
    /**
     * Unified top navigation (a single menu): a slim brand bar + horizontal
     * tabs rendered above every Cookie Rocket admin page, so all sections feel like one app.
     * Hooked on in_admin_header; bails on any non-plugin screen.
     */
    /**
     * THE navigation: one list, one order. Both the tab bar and the sidebar read from here,
     * so they always show the same items in the same order.
     *
     * @return array<string,string> slug => label, in the order the user should see them.
     */
    public function nav_tabs(): array {
        $tabs = [
            self::SLUG                 => __( 'Status', 'cookie-rocket' ),
            self::SLUG . '-design'     => __( 'Banner', 'cookie-rocket' ),
            self::SLUG . '-categories' => __( 'Blocking', 'cookie-rocket' ),
            self::SLUG . '-policy'     => __( 'Compliance', 'cookie-rocket' ),
        ];
        return apply_filters( 'cookroco_admin_tabs', $tabs );
    }

    /**
     * A section "owns" secondary pages that are reached from inside it, not from the tab bar.
     * Used to (a) keep the right tab highlighted on those pages and (b) redirect deep links to
     * those pages to the section that owns them. One source of truth so the two never drift.
     *
     * @return array<string,string[]> owning section slug => slugs it absorbed.
     */
    protected function owned_pages(): array {
        return [
            self::SLUG                 => [ self::SLUG . '-license' ],
            self::SLUG . '-categories' => [ self::SLUG . '-scanner' ],
            self::SLUG . '-policy'     => [ self::SLUG . '-log', self::SLUG . '-settings', self::SLUG . '-rights', self::SLUG . '-regions' ],
        ];
    }

    /**
     * Order the sidebar submenu to match nav_tabs(). Registration order cannot do this on its
     * own: pages registered later (by the Pro, on a later hook) would always land at the end,
     * whatever the tab bar says. Runs late, once everyone has registered.
     */
    public function sync_submenu_order(): void {
        global $submenu;
        if ( empty( $submenu[ self::SLUG ] ) || ! is_array( $submenu[ self::SLUG ] ) ) {
            return;
        }
        $order = array_keys( $this->nav_tabs() );
        usort(
            $submenu[ self::SLUG ],
            static function ( $a, $b ) use ( $order ) {
                $ia = array_search( $a[2] ?? '', $order, true );
                $ib = array_search( $b[2] ?? '', $order, true );
                // Anything not in the canonical list keeps to the end, in its original order.
                $ia = ( false === $ia ) ? PHP_INT_MAX : $ia;
                $ib = ( false === $ib ) ? PHP_INT_MAX : $ib;
                return $ia <=> $ib;
            }
        );
    }

    /**
     * Marks the Cookie Rocket screens, so the app layout (top bar + side navigation) applies to
     * them only and never to the rest of the dashboard.
     *
     * @param string $classes Space-separated body classes.
     * @return string
     */
    public function body_class( $classes ): string {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only: picks the layout.
        $page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
        return ( 0 === strpos( $page, self::SLUG ) ) ? $classes . ' cr-app' : (string) $classes;
    }

    /**
     * The pages under Blocking, in order.
     *
     * @return array<string,array{0:string,1:string,2:string}> key => [ page slug, icon, label ].
     */
    public static function blocking_items(): array {
        return [
            'categories' => [ self::SLUG . '-categories', 'categories', __( 'Categories', 'cookie-rocket' ) ],
            'scanner'    => [ self::SLUG . '-scanner', 'scanner', __( 'Scanner', 'cookie-rocket' ) ],
        ];
    }

    /**
     * The pages under Compliance, in order; extensions add theirs through the filter.
     *
     * @return array<string,array{0:string,1:string,2:string}> key => [ page slug, icon, label ].
     */
    public static function compliance_items(): array {
        $items = [
            'policy' => [ self::SLUG . '-policy', 'policy', __( 'Policy', 'cookie-rocket' ) ],
            'log'    => [ self::SLUG . '-log', 'log', __( 'Consent Log', 'cookie-rocket' ) ],
        ];
        return (array) apply_filters( 'cookroco_compliance_subnav', $items );
    }

    /**
     * A 20px line icon for the navigation; unknown names fall back to a neutral dot.
     *
     * @param string $name Icon name.
     * @return string Static SVG markup.
     */
    private static function nav_icon( string $name ): string {
        $paths = [
            'status'     => '<path d="M4 13h6V4H4v9Zm0 7h6v-4H4v4Zm10 0h6v-9h-6v9Zm0-16v4h6V4h-6Z"/>',
            'banner'     => '<rect x="3" y="4" width="18" height="16" rx="2"/><path d="M3 15h18M7 18h4"/>',
            'blocking'   => '<circle cx="12" cy="12" r="9"/><path d="m5.7 5.7 12.6 12.6"/>',
            'categories' => '<path d="M4 6h16M4 12h16M4 18h10"/>',
            'scanner'    => '<circle cx="11" cy="11" r="7"/><path d="m20 20-4-4"/>',
            'compliance' => '<path d="M12 3 4.5 6v5.5c0 4.6 3.1 8.2 7.5 9.5 4.4-1.3 7.5-4.9 7.5-9.5V6L12 3Z"/>',
            'policy'     => '<path d="M6 3h9l4 4v14H6V3Z"/><path d="M14 3v5h5M9 13h7M9 17h5"/>',
            'log'        => '<path d="M8 6h13M8 12h13M8 18h13M3.5 6h.01M3.5 12h.01M3.5 18h.01"/>',
            'rights'     => '<circle cx="12" cy="8" r="4"/><path d="M4 21a8 8 0 0 1 16 0"/>',
            'regions'    => '<circle cx="12" cy="12" r="9"/><path d="M3 12h18M12 3c2.5 2.7 3.8 5.7 3.8 9s-1.3 6.3-3.8 9c-2.5-2.7-3.8-5.7-3.8-9S9.5 5.7 12 3Z"/>',
            'settings'   => '<path d="M4 6h10M18 6h2M4 12h4M12 12h8M4 18h12M20 18h0"/><circle cx="16" cy="6" r="2"/><circle cx="10" cy="12" r="2"/><circle cx="18" cy="18" r="2"/>',
        ];
        $body = $paths[ $name ] ?? '<circle cx="12" cy="12" r="3"/>';
        return '<svg class="cr-ico" viewBox="0 0 24 24" aria-hidden="true" focusable="false">' . $body . '</svg>';
    }

    /**
     * The app chrome of every Cookie Rocket screen: a top bar with the product and its plan, and
     * the side navigation with every page one click away (Elementor's Editor One layout).
     */
    public function render_admin_chrome(): void {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only: highlights the current page.
        $page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
        if ( 0 !== strpos( $page, self::SLUG ) ) {
            return;
        }
        $pro = (bool) apply_filters( 'cookroco_pro_active', false );

        // Other plugins' notices: WordPress moves every notice right after `.wp-header-end`, or after the
        // first heading of the page when there is none, which put them inside the editor panel and under
        // each title. The marker comes first, so they sit above the whole Cookie Rocket app, full width,
        // as on any other WordPress screen.
        echo '<div class="cr-wp-notices"><hr class="wp-header-end"></div>';

        echo '<header class="cr-topbar-app"><a class="cr-brand" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG ) ) . '">';
        echo '<span class="cr-brand__mark"><svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M12 3 4.5 6v5.5c0 4.6 3.1 8.2 7.5 9.5 4.4-1.3 7.5-4.9 7.5-9.5V6L12 3Z"/><path d="m8.8 12.2 2.2 2.2 4.4-4.6"/></svg></span>';
        echo '<span class="cr-brand__name">Cookie Rocket</span></a><div class="cr-topbar-app__end">';
        if ( $pro ) {
            do_action( 'cookroco_appbar_pro_slot' );
        } else {
            echo '<a class="cr-btn-promo" href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=appbar' ) . '" target="_blank" rel="noopener">' . self::crown() . '<span>' . esc_html__( 'Upgrade to Pro', 'cookie-rocket' ) . '</span></a>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
        }
        echo '</div></header>';

        // Sections: a page of its own, or a group whose pages sit under it.
        $owned    = $this->owned_pages();
        $sections = [];
        foreach ( $this->nav_tabs() as $slug => $label ) {
            $key = [ self::SLUG => 'status', self::SLUG . '-design' => 'banner', self::SLUG . '-categories' => 'blocking', self::SLUG . '-policy' => 'compliance' ][ $slug ] ?? 'section';
            $sections[ $slug ] = [ $label, $key, 'blocking' === $key ? self::blocking_items() : ( 'compliance' === $key ? self::compliance_items() : [] ) ];
        }
        $sections[ self::SLUG . '-settings' ] = [ __( 'Settings', 'cookie-rocket' ), 'settings', [] ];

        echo '<nav class="cr-sidenav" aria-label="' . esc_attr__( 'Cookie Rocket', 'cookie-rocket' ) . '"><ul>';
        foreach ( $sections as $slug => [ $label, $icon, $children ] ) {
            $child_slugs = array_map( static fn( $c ) => $c[0], $children );
            $here        = $page === $slug && ! $children;
            $in_group    = $children && ( in_array( $page, $child_slugs, true ) || $page === $slug );
            // The license page belongs to Status; it has no entry of its own.
            if ( self::SLUG === $slug && in_array( $page, $owned[ self::SLUG ] ?? [], true ) ) {
                $here = true;
            }
            $href = $children ? reset( $child_slugs ) : $slug;
            echo '<li class="cr-sidenav__item' . ( $in_group ? ' is-open' : '' ) . '"><a class="cr-sidenav__link" href="' . esc_url( admin_url( 'admin.php?page=' . $href ) ) . '"' . ( $here ? ' aria-current="page"' : '' ) . ' title="' . esc_attr( $label ) . '">';
            echo self::nav_icon( $icon ) . '<span>' . esc_html( $label ) . '</span></a>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- nav_icon() is static SVG.
            if ( $children ) {
                echo '<ul class="cr-sidenav__sub">';
                foreach ( $children as [ $child, , $child_label ] ) {
                    echo '<li><a class="cr-sidenav__sublink" href="' . esc_url( admin_url( 'admin.php?page=' . $child ) ) . '"' . ( $page === $child ? ' aria-current="page"' : '' ) . '>' . esc_html( $child_label ) . '</a></li>';
                }
                echo '</ul>';
            }
            echo '</li>';
        }
        echo '</ul>';
        if ( ! $pro ) {
            // The card lives in its own track, which starts under the menu: pinned to the bottom of
            // the screen, it can never rise over the menu, whatever pushes the menu down.
            echo '<div class="cr-sidenav__end"><div class="cr-sidenav__promo"><strong>Cookie Rocket Pro</strong><p>' . esc_html__( 'Each visitor gets their own law, premium styles and a tamper-evident consent log.', 'cookie-rocket' ) . '</p>';
            echo '<a class="cr-btn-promo cr-btn-promo--outlined" href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=sidebar' ) . '" target="_blank" rel="noopener" aria-label="' . esc_attr__( 'Upgrade to Pro', 'cookie-rocket' ) . '">' . self::crown() . '<span>' . esc_html__( 'Upgrade to Pro', 'cookie-rocket' ) . '</span></a></div></div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
        }
        echo '</nav>';

        // Notes about the site live on Status, as Elementor keeps its notices to its Home screen:
        // the working screens stay clean, and the editor is a full-height workspace.
        if ( self::SLUG === $page ) {
            echo '<div class="cr-notes">';
            $this->render_chrome_notices();
            echo '</div>';
        }
    }

    /**
     * The crown that marks what Cookie Rocket Pro adds, as Elementor marks its paid features.
     *
     * @return string Static SVG markup.
     */
    public static function crown(): string {
        return '<svg class="cr-crown" viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M2.5 7.5 7.2 11 12 4l4.8 7 4.7-3.5L19.4 18H4.6L2.5 7.5ZM4.6 19.5h14.8V21H4.6v-1.5Z"/></svg>';
    }
    /**
     * Contextual cards under the tab bar — shown on Cookie Rocket pages ONLY, never as
     * global admin notices (wp.org guideline 11): (1) one-click suggestion to apply the
     * compliance framework matching the site locale; (2) a dismissible review ask after
     * two weeks of use.
     */
    /**
     * A notice driven by a FACT about the site, not by a timer.
     *
     * The banner already resolves and records each visitor's country. When a significant share
     * of incoming visitors falls under a legal framework other than the one the site applies to
     * everyone, that is a verifiable finding about the site itself, not a campaign. It appears only
     * when that finding exists, it can be dismissed, and it disappears if the distribution changes.
     *
     * It lives inside the Cookie Rocket screens (directory guideline 11: limited scope, moderate
     * use) and describes what the product does, without promising compliance (guideline 9).
     */
    /**
     * The rejection rate, as returned by get_stats().
     *
     * Every rejection is a visitor who is no longer measured in Analytics or attributed in Ads,
     * and Consent Mode advanced is what keeps that measurement when the visitor says no. A high
     * rate changes what the site is able to measure, so it is worth putting in front of the owner.
     *
     * Raised only when the rate is genuinely high and there is enough volume to say so.
     */
    private function notice_reject_rate(): void {
        if ( get_option( 'cookroco_reject_notice_dismissed' ) ) { return; }
        $st = $this->log->get_stats();
        $total = (int) ( $st['total'] ?? 0 );
        if ( $total < 100 ) { return; }           // below this volume a percentage says nothing

        $rejections = 0;
        foreach ( (array) ( $st['by_action'] ?? [] ) as $row ) {
            $a = is_array( $row ) ? ( $row['action'] ?? '' ) : '';
            if ( 'reject_all' === $a || 'withdraw' === $a ) { $rejections += (int) ( $row['count'] ?? 0 ); }
        }
        $pct = (int) round( $rejections / $total * 100 );
        if ( $pct < 25 ) { return; }              // below this there is nothing worth raising

        $s   = (array) get_option( 'cookroco_settings', [] );
        $gcm = array_key_exists( 'gcm_enabled', $s ) ? ! empty( $s['gcm_enabled'] ) : true;
        // With advanced consent mode already running there is nothing to suggest, so the
        // notice reports the figure and stops there.
        $is_pro         = (bool) apply_filters( 'cookroco_pro_active', false );
        $already_has_it = $is_pro && 'advanced' === ( $s['consent_mode'] ?? '' );
        // A Pro site on the basic mode already owns the fix: point it at the setting, never at
        // the sales page for the product it paid for.
        $owns_it        = $is_pro && ! $already_has_it;
        $url = 'https://templatesrocket.com/cookie-rocket-pro?feature=reject-rate';
        $dis = wp_nonce_url( add_query_arg( 'cookroco_reject_action', 'dismiss' ), 'cookroco_reject_action' );

        echo '<div class="cr-chrome-note"><span class="dashicons dashicons-chart-bar"></span><div>';
        echo '<strong>' . esc_html( sprintf(
            /* translators: 1: percentage of visitors who rejected, 2: number of consent decisions. */
            __( '%1$d%% of your visitors rejected cookies, out of %2$d decisions.', 'cookie-rocket' ),
            $pct, $total
        ) ) . '</strong> ';
        if ( $already_has_it ) {
            echo esc_html__( 'Consent Mode advanced is on, so your Google Ads and GA4 measurement keeps working for them. Nothing to do.', 'cookie-rocket' );
        } elseif ( $gcm && $owns_it ) {
            echo esc_html__( 'Consent Mode v2 is on, but in its basic mode Google receives nothing from those visitors. Your Pro plan includes the advanced mode: Google\'s tags load without cookies, so Google can model the visits and conversions it would otherwise lose.', 'cookie-rocket' );
        } elseif ( $gcm ) {
            echo esc_html__( 'Consent Mode v2 is on, but in its basic mode Google receives nothing from those visitors. Cookie Rocket Pro adds the advanced mode: Google\'s tags load without cookies, so Google can model the visits and conversions it would otherwise lose.', 'cookie-rocket' );
        } else {
            echo esc_html__( 'Consent Mode v2 is off, so those visitors are invisible to Google Analytics and Ads. Turning it on costs nothing.', 'cookie-rocket' );
        }
        echo '</div><span class="cr-chrome-note__actions">';
        if ( $already_has_it ) {
            // Nothing to act on here: the figure alone is the point.
        } elseif ( $gcm && $owns_it ) {
            echo '<a class="button button-primary" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-settings#blocking' ) ) . '">' . esc_html__( 'Turn on advanced mode', 'cookie-rocket' ) . '</a>';
        } elseif ( $gcm ) {
            echo '<a class="button button-primary" href="' . esc_url( $url ) . '" target="_blank" rel="noopener">' . esc_html__( 'See how', 'cookie-rocket' ) . '</a>';
        } else {
            echo '<a class="button button-primary" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-categories' ) ) . '">' . esc_html__( 'Turn it on', 'cookie-rocket' ) . '</a>';
        }
        echo '<a class="button" href="' . esc_url( $dis ) . '">' . esc_html__( 'Dismiss', 'cookie-rocket' ) . '</a></span></div>';
    }

    private function notice_visitor_law_mismatch(): void {
        if ( get_option( 'cookroco_visitor_law_notice_dismissed' ) ) { return; }
        /** Filterable so a site that already routes the applicable law per visitor can turn
         *  this notice off rather than be told about something it is already doing. */
        if ( ! apply_filters( 'cookroco_show_visitor_law_notice', true ) ) { return; }
        $s   = (array) get_option( 'cookroco_settings', [] );
        $cur = is_string( $s['default_law'] ?? null ) ? $s['default_law'] : 'generic';

        $r = $this->log->region_breakdown( 30 );
        if ( $r['total'] < 50 ) { return; }   // below this volume it is noise, not a finding

        $frameworks = [
            'gdpr'    => __( 'the European Union', 'cookie-rocket' ),
            'ccpa'    => __( 'the United States', 'cookie-rocket' ),
            'lgpd'    => __( 'Brazil', 'cookie-rocket' ),
            'lfpdppp' => __( 'Mexico', 'cookie-rocket' ),
        ];
        // The framework with the most visitors that is NOT the one the site applies today.
        $top = ''; $top_count = 0;
        foreach ( $frameworks as $k => $_ ) {
            if ( $k === $cur ) { continue; }
            if ( $r[ $k ] > $top_count ) { $top = $k; $top_count = $r[ $k ]; }
        }
        if ( '' === $top ) { return; }
        $pct = (int) round( $top_count / $r['total'] * 100 );
        if ( $pct < 15 ) { return; }          // below this it is not worth interrupting anyone

        $url = 'https://templatesrocket.com/cookie-rocket-pro?feature=visitor-law';
        echo '<div class="cr-chrome-notice">';
        echo '<p><strong>' . esc_html( sprintf(
            /* translators: 1: percentage of visitors, 2: region name. */
            __( '%1$d%% of your visitors in the last 30 days came from %2$s.', 'cookie-rocket' ),
            $pct, $frameworks[ $top ]
        ) ) . '</strong> ';
        echo esc_html__( 'Your banner applies one framework to everyone. Cookie Rocket Pro applies the one that fits each visitor\'s country.', 'cookie-rocket' ) . ' ';
        echo '<a href="' . esc_url( $url ) . '" target="_blank" rel="noopener">' . esc_html__( 'See how', 'cookie-rocket' ) . ' &rarr;</a> ';
        echo '<a href="' . esc_url( wp_nonce_url( admin_url( 'admin.php?page=' . self::SLUG . '&cr_dismiss_visitor_law=1' ), 'cr_dismiss_visitor_law' ) ) . '">' . esc_html__( 'Dismiss', 'cookie-rocket' ) . '</a></p>';
        echo '</div>';
    }

    private function render_chrome_notices(): void {
        if ( ! current_user_can( 'manage_options' ) ) return;
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- the nonce is verified below
        if ( isset( $_GET['cr_dismiss_visitor_law'] ) && check_admin_referer( 'cr_dismiss_visitor_law' ) ) {
            update_option( 'cookroco_visitor_law_notice_dismissed', 1 );
        }
        $this->notice_visitor_law_mismatch();
        $this->notice_reject_rate();
        $s   = (array) get_option( 'cookroco_settings', [] );
        $cur = is_array( $s ) ? ( $s['default_law'] ?? 'generic' ) : 'generic';
        $sug = COOKROCO_Core::locale_default_law();
        if ( 'generic' === $cur && 'generic' !== $sug && ! get_option( 'cookroco_law_notice_dismissed' ) ) {
            $labels  = self::law_names();
            $apply   = wp_nonce_url( add_query_arg( 'cookroco_law_action', 'apply' ), 'cookroco_law_action' );
            $dismiss = wp_nonce_url( add_query_arg( 'cookroco_law_action', 'dismiss' ), 'cookroco_law_action' );
            echo '<div class="cr-chrome-note"><span class="dashicons dashicons-location-alt"></span><div>';
            /* translators: %s: legal framework name, e.g. "LFPDPPP (Mexico)". */
            echo '<strong>' . esc_html( sprintf( __( 'Based on this site\'s language, %s applies to your visitors.', 'cookie-rocket' ), $labels[ $sug ] ?? $sug ) ) . '</strong> ';
            echo esc_html__( 'Apply it to use the matching legal banner text by default.', 'cookie-rocket' );
            echo '</div><span class="cr-chrome-note__actions"><a class="button button-primary" href="' . esc_url( $apply ) . '">' . esc_html__( 'Apply', 'cookie-rocket' ) . '</a><a class="button" href="' . esc_url( $dismiss ) . '">' . esc_html__( 'Dismiss', 'cookie-rocket' ) . '</a></span></div>';
        }
        // Asked on a MILESTONE, never on a timer: only once the plugin has done something
        // countable, and the wording names that thing. The counters already exist —
        // get_stats()['total'] and last_scan(). Asked once.
        if ( ! get_option( 'cookroco_review_dismissed' ) && ! get_transient( 'cookroco_review_snoozed' ) ) {
            $st    = $this->log->get_stats();
            $total = (int) ( $st['total'] ?? 0 );
            // Only trackers this site really holds count: not those Consent Mode governs, none while
            // blocking is off, and a pasted one only with raw-HTML blocking on.
            $found = 0;
            $last  = ( new COOKROCO_Scanner() )->last_scan();
            $s_now = (array) get_option( 'cookroco_settings', [] );
            if ( is_array( $last ) && ! empty( $last['found'] ) && ( ! array_key_exists( 'block_scripts', $s_now ) || ! empty( $s_now['block_scripts'] ) ) ) {
                foreach ( (array) $last['found'] as $f ) {
                    if ( empty( $f['managed'] ) && ( 'inline' !== ( $f['via'] ?? 'src' ) || ! empty( $s_now['block_raw_html'] ) ) ) {
                        $found++;
                    }
                }
            }

            $hito = '';
            if ( $total >= 100 && $found > 0 ) {
                /* translators: 1: number of trackers blocked, 2: number of consent decisions recorded. */
                $hito = sprintf( __( 'Cookie Rocket is holding %1$d trackers on this site and has recorded %2$d consent decisions.', 'cookie-rocket' ), $found, $total );
            } elseif ( $total >= 100 ) {
                /* translators: %d: number of consent decisions recorded. */
                $hito = sprintf( __( 'Cookie Rocket has recorded %d consent decisions on this site.', 'cookie-rocket' ), $total );
            } elseif ( $found >= 3 ) {
                /* translators: %d: number of trackers found and blocked. */
                $hito = sprintf( __( 'Cookie Rocket found and is holding %d trackers on this site.', 'cookie-rocket' ), $found );
            }

            if ( '' !== $hito ) {
                $never = wp_nonce_url( add_query_arg( 'cookroco_review_action', 'dismiss' ), 'cookroco_review_action' );
                $later = wp_nonce_url( add_query_arg( 'cookroco_review_action', 'later' ), 'cookroco_review_action' );
                echo '<div class="cr-chrome-note"><span class="dashicons dashicons-star-filled"></span><div>';
                echo '<strong>' . esc_html( $hito ) . '</strong> ';
                echo esc_html__( 'If that has been useful, a review helps other site owners find it.', 'cookie-rocket' );
                echo '</div><span class="cr-chrome-note__actions"><a class="button button-primary" href="https://wordpress.org/support/plugin/cookie-rocket/reviews/#new-post" target="_blank" rel="noopener">' . esc_html__( 'Leave a review', 'cookie-rocket' ) . '</a><a class="button" href="' . esc_url( $later ) . '">' . esc_html__( 'Later', 'cookie-rocket' ) . '</a><a class="button" href="' . esc_url( $never ) . '">' . esc_html__( 'Already did', 'cookie-rocket' ) . '</a></span></div>';
            }
        }
    }
    /** Handles the Apply / Dismiss links of the chrome cards (nonce-checked, admin-only). */
    public function handle_notice_actions(): void {
        if ( ! current_user_can( 'manage_options' ) ) return;
        if ( isset( $_GET['cookroco_law_action'] ) ) {
            check_admin_referer( 'cookroco_law_action' );
            if ( 'apply' === sanitize_key( wp_unslash( $_GET['cookroco_law_action'] ) ) ) {
                $s = (array) get_option( 'cookroco_settings', [] );
                if ( ! is_array( $s ) ) $s = [];
                $s['default_law'] = COOKROCO_Core::locale_default_law();
                update_option( 'cookroco_settings', $s );
            } else {
                update_option( 'cookroco_law_notice_dismissed', 1 );
            }
            wp_safe_redirect( remove_query_arg( [ 'cookroco_law_action', '_wpnonce' ] ) );
            exit;
        }
        if ( isset( $_GET['cookroco_reject_action'] ) ) {
            check_admin_referer( 'cookroco_reject_action' );
            update_option( 'cookroco_reject_notice_dismissed', 1 );
            wp_safe_redirect( remove_query_arg( [ 'cookroco_reject_action', '_wpnonce' ] ) );
            exit;
        }
        if ( isset( $_GET['cookroco_review_action'] ) ) {
            check_admin_referer( 'cookroco_review_action' );
            // "Later" only snoozes: the milestone is still there, so the question returns in 30 days.
            // "Already did" silences it for good. Asking twice is what earns one-star reviews.
            if ( 'later' === sanitize_key( wp_unslash( $_GET['cookroco_review_action'] ) ) ) {
                set_transient( 'cookroco_review_snoozed', 1, 30 * DAY_IN_SECONDS );
            } else {
                update_option( 'cookroco_review_dismissed', 1 );
            }
            wp_safe_redirect( remove_query_arg( [ 'cookroco_review_action', '_wpnonce' ] ) );
            exit;
        }
    }
    public function enqueue_scripts( string $hook ): void {
        if ( false === strpos($hook,self::SLUG) ) return;
        wp_enqueue_style(  'cookroco-admin', COOKROCO_PLUGIN_URL.'admin/assets/admin.css',  [],COOKROCO_VERSION );
        wp_enqueue_script( 'cookroco-admin', COOKROCO_PLUGIN_URL.'admin/assets/admin.js', ['jquery'],COOKROCO_VERSION,true );
        wp_localize_script( 'cookroco-admin','CookieRocketAdmin', [ 'ajaxUrl'=>admin_url('admin-ajax.php'),'nonce'=>wp_create_nonce('cookroco-admin'),'settings'=>get_option('cookroco_settings',[]),'design'=>get_option('cookroco_banner_design',[]),'categories'=>get_option('cookroco_cookie_categories',[]),'stats'=>$this->log->get_stats(),'scanningText'=>__('Scanning…','cookie-rocket'),'saveErrorText'=>__('Could not save — your changes were not stored. Please try again.','cookie-rocket'),'savedText'=>__('Saved.','cookie-rocket'),'adjustedText'=>__('Saved. Some values were changed to what is allowed — check:','cookie-rocket'),'activeText'=>__('Active','cookie-rocket') ] );
    }
    /**
     * First-run setup wizard — a short linear guide that leaves blocking, the banner and the
     * cookie policy configured without the owner opening a single options screen. Server-rendered (one step per request, advanced by a
     * nonce-checked POST); it reuses the real scanner and policy creation, so it configures the
     * same state the manual screens do. Not a permanent menu item.
     */
    public function render_wizard(): void {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only step selector; each advancing action is nonce-checked in handle_wizard().
        $step = isset( $_GET['step'] ) ? max( 1, min( 5, absint( wp_unslash( $_GET['step'] ) ) ) ) : 1;
        $s    = (array) get_option( 'cookroco_settings', [] );
        if ( ! is_array( $s ) ) { $s = []; }
        $post   = admin_url( 'admin-post.php' );
        $setup  = admin_url( 'admin.php?page=' . self::SLUG . '-setup' );
        $titles = [
            1 => __( 'Your region & law', 'cookie-rocket' ),
            2 => __( 'Scan your site', 'cookie-rocket' ),
            3 => __( 'Your banner', 'cookie-rocket' ),
            4 => __( 'Your cookie policy', 'cookie-rocket' ),
            5 => __( "You're all set", 'cookie-rocket' ),
        ];

        echo '<div class="wrap cr-wrap cr-wizard">';
        echo '<div class="cr-wizard__head"><span class="cr-wizard__brand"><span class="dashicons dashicons-privacy"></span>Cookie Rocket</span>';
        /* translators: 1: current step number, 2: total steps. */
        echo '<span class="cr-wizard__progress">' . esc_html( sprintf( __( 'Step %1$d of %2$d', 'cookie-rocket' ), $step, 5 ) ) . '</span></div>';
        echo '<div class="cr-wizard__bar"><span style="width:' . esc_attr( (string) ( $step * 20 ) ) . '%"></span></div>';
        echo '<div class="cr-card cr-wizard__card"><h1>' . esc_html( $titles[ $step ] ) . '</h1>';

        if ( 1 === $step ) {
            $law   = in_array( $s['default_law'] ?? '', [ 'gdpr', 'ccpa', 'lgpd', 'lfpdppp', 'generic' ], true ) ? $s['default_law'] : COOKROCO_Core::locale_default_law();
            $opts = self::law_names();
            echo '<p class="cr-wizard__lead">' . esc_html__( 'We detected the framework that fits your site language. Confirm it, or pick another — you can change it later.', 'cookie-rocket' ) . '</p>';
            echo '<form method="post" action="' . esc_url( $post ) . '"><input type="hidden" name="action" value="cookroco_wizard"><input type="hidden" name="step" value="1">';
            wp_nonce_field( 'cookroco_wizard' );
            echo '<div class="cr-field"><label for="cr-wiz-law">' . esc_html__( 'Compliance framework', 'cookie-rocket' ) . '</label><select id="cr-wiz-law" name="default_law">';
            foreach ( $opts as $lk => $ll ) { echo '<option value="' . esc_attr( $lk ) . '" ' . selected( $law, $lk, false ) . '>' . esc_html( $ll ) . '</option>'; }
            echo '</select></div>';
            echo '<p class="cr-wizard__actions"><button type="submit" class="button button-primary button-hero">' . esc_html__( 'Continue', 'cookie-rocket' ) . '</button></p></form>';
        } elseif ( 2 === $step ) {
            $scan  = get_option( 'cookroco_last_scan', [] );
            $found = ( is_array( $scan ) && ! empty( $scan['found'] ) ) ? count( $scan['found'] ) : 0;
            $done  = is_array( $scan ) && ! empty( $scan['time'] );
            echo '<p class="cr-wizard__lead">' . esc_html__( 'We check your site for known trackers, list their cookies on your policy, and block each one until the visitor accepts its category.', 'cookie-rocket' ) . '</p>';
            if ( $done ) {
                /* translators: %d: number of trackers found. */
                echo '<p class="cr-wizard__note"><span class="dashicons dashicons-yes-alt"></span>' . esc_html( sprintf( _n( 'Scan complete — %d tracker found.', 'Scan complete — %d trackers found.', $found, 'cookie-rocket' ), $found ) ) . '</p>';
            }
            echo '<form method="post" action="' . esc_url( $post ) . '"><input type="hidden" name="action" value="cookroco_wizard"><input type="hidden" name="step" value="2">';
            wp_nonce_field( 'cookroco_wizard' );
            echo '<p class="cr-wizard__actions"><button type="submit" class="button button-primary button-hero">' . ( $done ? esc_html__( 'Scan again & continue', 'cookie-rocket' ) : esc_html__( 'Scan my site', 'cookie-rocket' ) ) . '</button> <a class="cr-wizard__skip" href="' . esc_url( $setup . '&step=3' ) . '">' . esc_html__( 'Skip', 'cookie-rocket' ) . '</a></p></form>';
        } elseif ( 3 === $step ) {
            $d       = get_option( 'cookroco_banner_design', [] );
            $active  = is_array( $d ) ? (string) ( $d['theme'] ?? '' ) : '';
            $pos     = sanitize_key( $s['banner_position'] ?? 'right' );
            echo '<p class="cr-wizard__lead">' . esc_html__( 'Pick a neutral starting look and where it appears. You can fine-tune colors later in Banner.', 'cookie-rocket' ) . '</p>';
            echo '<form method="post" action="' . esc_url( $post ) . '"><input type="hidden" name="action" value="cookroco_wizard"><input type="hidden" name="step" value="3">';
            wp_nonce_field( 'cookroco_wizard' );
            echo '<div class="cr-field"><label for="cr-wiz-theme">' . esc_html__( 'Style', 'cookie-rocket' ) . '</label><select id="cr-wiz-theme" name="theme">';
            foreach ( self::banner_themes() as $key => $t ) {
                if ( ! empty( $t['pro'] ) ) { continue; }
                echo '<option value="' . esc_attr( $key ) . '" ' . selected( $active, $key, false ) . '>' . esc_html( $t['name'] ) . '</option>';
            }
            echo '</select></div>';
            echo '<div class="cr-field"><label for="cr-wiz-pos">' . esc_html__( 'Position', 'cookie-rocket' ) . '</label><select id="cr-wiz-pos" name="banner_position"><option value="right" ' . selected( $pos, 'right', false ) . '>' . esc_html__( 'Right', 'cookie-rocket' ) . '</option><option value="left" ' . selected( $pos, 'left', false ) . '>' . esc_html__( 'Left', 'cookie-rocket' ) . '</option></select></div>';
            echo '<p class="cr-wizard__actions"><button type="submit" class="button button-primary button-hero">' . esc_html__( 'Continue', 'cookie-rocket' ) . '</button> <a class="cr-wizard__skip" href="' . esc_url( $setup . '&step=4' ) . '">' . esc_html__( 'Skip', 'cookie-rocket' ) . '</a></p></form>';
        } elseif ( 4 === $step ) {
            $pid    = (int) get_option( 'cookroco_policy_page_id', 0 );
            $exists = $pid && get_post_status( $pid ) && 'trash' !== get_post_status( $pid );
            echo '<p class="cr-wizard__lead">' . esc_html__( 'Publish a page that lists every cookie your site uses, grouped by purpose — a required disclosure, generated for you.', 'cookie-rocket' ) . '</p>';
            echo '<form method="post" action="' . esc_url( $post ) . '"><input type="hidden" name="action" value="cookroco_wizard"><input type="hidden" name="step" value="4">';
            wp_nonce_field( 'cookroco_wizard' );
            if ( $exists ) {
                echo '<p class="cr-wizard__note"><span class="dashicons dashicons-yes-alt"></span>' . esc_html__( 'Your cookie policy page is already published.', 'cookie-rocket' ) . '</p>';
                echo '<p class="cr-wizard__actions"><button type="submit" class="button button-primary button-hero">' . esc_html__( 'Continue', 'cookie-rocket' ) . '</button></p>';
            } else {
                echo '<input type="hidden" name="create_policy" value="1">';
                echo '<p class="cr-wizard__actions"><button type="submit" class="button button-primary button-hero">' . esc_html__( 'Create my cookie policy', 'cookie-rocket' ) . '</button> <a class="cr-wizard__skip" href="' . esc_url( $setup . '&step=5' ) . '">' . esc_html__( 'Skip', 'cookie-rocket' ) . '</a></p>';
            }
            echo '</form>';
        } else {
            // What is actually running, read from the settings: nothing here may promise more.
            $laws    = self::law_names();
            $law_key = (string) ( $s['default_law'] ?? 'generic' );
            $cur_law = $laws[ $law_key ] ?? $laws['generic'];
            $opt_out = 'opt_out' === ( $s['default_state'] ?? 'opt_in' ) && ! in_array( $law_key, COOKROCO_Consent::OPT_IN_LAWS, true );
            $on      = static fn( string $k ): bool => array_key_exists( $k, $s ) ? ! empty( $s[ $k ] ) : true;
            echo '<p class="cr-wizard__lead">' . esc_html__( 'Your banner is live. Here is what is running:', 'cookie-rocket' ) . '</p>';
            echo '<ul class="cr-wizard__summary">';
            /* translators: %s: the active compliance framework, e.g. GDPR. */
            echo '<li><span class="dashicons dashicons-yes"></span>' . esc_html( sprintf( __( 'Compliance: %s', 'cookie-rocket' ), $cur_law ) ) . '</li>';
            echo '<li><span class="dashicons dashicons-yes"></span>' . ( $opt_out ? esc_html__( 'Optional cookies run until the visitor rejects them (opt-out)', 'cookie-rocket' ) : esc_html__( 'Block optional cookies until the visitor accepts (opt-in)', 'cookie-rocket' ) ) . '</li>';
            if ( $on( 'block_scripts' ) && $on( 'gcm_enabled' ) ) {
                echo '<li><span class="dashicons dashicons-yes"></span>' . esc_html__( 'Auto-blocking and Consent Mode v2 active', 'cookie-rocket' ) . '</li>';
            }
            echo '<li><span class="dashicons dashicons-yes"></span>' . esc_html__( 'Cookie banner live on your site', 'cookie-rocket' ) . '</li>';
            echo '</ul>';
            echo '<p class="cr-wizard__actions"><a class="button button-primary button-hero" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG ) ) . '">' . esc_html__( 'Go to Status', 'cookie-rocket' ) . '</a></p>';
        }
        echo '</div></div>';
    }

    /** Process one wizard step (nonce + capability checked) and advance to the next. */
    public function handle_wizard(): void {
        if ( ! current_user_can( self::CAP ) ) { wp_die( esc_html__( 'Insufficient permissions.', 'cookie-rocket' ) ); }
        check_admin_referer( 'cookroco_wizard' );
        $step = isset( $_POST['step'] ) ? absint( wp_unslash( $_POST['step'] ) ) : 1;
        switch ( $step ) {
            case 1:
                $law = isset( $_POST['default_law'] ) ? sanitize_key( wp_unslash( $_POST['default_law'] ) ) : 'generic';
                if ( in_array( $law, [ 'gdpr', 'ccpa', 'lgpd', 'lfpdppp', 'generic' ], true ) ) {
                    $s = (array) get_option( 'cookroco_settings', [] ); if ( ! is_array( $s ) ) { $s = []; }
                    $s['default_law'] = $law; update_option( 'cookroco_settings', $s );
                }
                break;
            case 2:
                if ( class_exists( 'COOKROCO_Scanner' ) ) { ( new COOKROCO_Scanner() )->scan(); }
                break;
            case 3:
                $theme  = isset( $_POST['theme'] ) ? sanitize_key( wp_unslash( $_POST['theme'] ) ) : '';
                $themes = self::banner_themes();
                if ( isset( $themes[ $theme ] ) && empty( $themes[ $theme ]['pro'] ) ) {
                    $d = get_option( 'cookroco_banner_design', [] ); if ( ! is_array( $d ) ) { $d = []; }
                    $d = array_merge( $d, $themes[ $theme ]['values'] ); $d['theme'] = $theme;
                    update_option( 'cookroco_banner_design', $d );
                }
                $pos = isset( $_POST['banner_position'] ) ? sanitize_key( wp_unslash( $_POST['banner_position'] ) ) : '';
                if ( in_array( $pos, [ 'left', 'right' ], true ) ) {
                    $s = (array) get_option( 'cookroco_settings', [] ); if ( ! is_array( $s ) ) { $s = []; }
                    $s['banner_position'] = $pos; update_option( 'cookroco_settings', $s );
                }
                break;
            case 4:
                $pid    = (int) get_option( 'cookroco_policy_page_id', 0 );
                $exists = $pid && get_post_status( $pid ) && 'trash' !== get_post_status( $pid );
                if ( ! $exists && ! empty( $_POST['create_policy'] ) ) {
                    $new = wp_insert_post( [
                        'post_title'   => __( 'Cookie Policy', 'cookie-rocket' ),
                        'post_content' => '[' . COOKROCO_Policy::SHORTCODE . ']',
                        'post_status'  => 'publish',
                        'post_type'    => 'page',
                    ] );
                    if ( $new && ! is_wp_error( $new ) ) { update_option( 'cookroco_policy_page_id', (int) $new ); }
                }
                break;
        }
        update_option( 'cookroco_onboarded', '1' );
        $next   = $step + 1;
        $target = ( $next > 5 )
            ? admin_url( 'admin.php?page=' . self::SLUG )
            : admin_url( 'admin.php?page=' . self::SLUG . '-setup&step=' . $next );
        wp_safe_redirect( $target );
        exit;
    }

    /** Per-region consent-text presets: law => [ label, banner title, banner body ]. Shared by the
     *  Banner content panel and the one-click autopilot so both write the same region-correct copy. */
    /**
     * The compliance frameworks by name, in the one order every list uses. The CCPA / CPRA is
     * California's law, but Cookie Rocket applies it to the whole United States (Pro: Regions).
     *
     * @return array<string,string> law key => name.
     */
    /**
     * What each consent-log action means, in the site's language.
     *
     * @return array<string,string> action key => label.
     */
    public static function action_labels(): array {
        return [
            'accept_all'  => __( 'Accepted all', 'cookie-rocket' ),
            'reject_all'  => __( 'Rejected', 'cookie-rocket' ),
            'custom'      => __( 'Customized', 'cookie-rocket' ),
            'withdraw'    => __( 'Withdrew', 'cookie-rocket' ),
            'gpc_opt_out' => __( 'Opted out (GPC signal)', 'cookie-rocket' ),
        ];
    }

    /**
     * The corner radius: a length in px from 0 to 40, so no corner can cut into the banner's
     * content (the inner spacing is never under 12 px). Without Pro only the offered corners
     * are taken; a value saved before is kept.
     *
     * @param mixed  $raw     Submitted value, or null.
     * @param string $current Value saved now.
     * @return string
     */
    public static function sanitize_radius( $raw, $current ): string {
        $norm = static function ( $v ): string {
            return preg_match( '/^\s*(\d{1,3})\s*(px)?\s*$/', (string) $v, $m ) ? min( 40, (int) $m[1] ) . 'px' : '';
        };
        $cur = $norm( $current );
        $cur = '' === $cur ? '0px' : $cur;
        if ( null === $raw ) {
            return $cur;
        }
        $new = $norm( $raw );
        if ( '' === $new ) {
            return $cur;
        }
        // Any corner from 0 to 40 px ($norm clamps it) is stored as given: the editor offers four
        // presets, and nothing in this plugin is held back for another edition to unlock.
        return $new;
    }

    /**
     * Banner font modes offered in the editor, value => label. Filterable so an add-on can add its
     * own (Cookie Rocket Pro adds a self-hosted family) without this plugin carrying that code.
     *
     * @return array<string,string>
     */
    public static function font_choices(): array {
        $choices = [
            'match'  => __( 'Match my site', 'cookie-rocket' ),
            'system' => __( 'System default', 'cookie-rocket' ),
        ];
        return (array) apply_filters( 'cookroco_font_choices', $choices );
    }

    public static function law_names(): array {
        return [
            'gdpr'    => __( 'GDPR (EU)', 'cookie-rocket' ),
            'ccpa'    => __( 'United States (CCPA / CPRA)', 'cookie-rocket' ),
            'lfpdppp' => __( 'LFPDPPP (Mexico)', 'cookie-rocket' ),
            'lgpd'    => __( 'LGPD (Brazil)', 'cookie-rocket' ),
            'generic' => __( 'Generic', 'cookie-rocket' ),
        ];
    }

    /**
     * Banner text templates, one per framework: the same title and message the banner uses for that
     * law (COOKROCO_Consent::law_texts), so a template and the default can never drift apart.
     *
     * @return array<string,array{0:string,1:string,2:string}> law key => [ name, title, message ].
     */
    public static function law_templates(): array {
        $out = [];
        foreach ( self::law_names() as $key => $name ) {
            $t           = COOKROCO_Consent::law_texts( $key );
            $out[ $key ] = [ $name, $t['title'], $t['body'] ];
        }
        return $out;
    }

    /** Friendly region name for a law key, for the autopilot result. */
    private static function region_label( string $law ): string {
        $map = [
            'gdpr'    => __( 'European Union (GDPR)', 'cookie-rocket' ),
            'lgpd'    => __( 'Brazil (LGPD)', 'cookie-rocket' ),
            'lfpdppp' => __( 'Mexico (LFPDPPP)', 'cookie-rocket' ),
            'ccpa'    => __( 'United States (CCPA / CPRA)', 'cookie-rocket' ),
            'generic' => __( 'Generic framework', 'cookie-rocket' ),
        ];
        return $map[ $law ] ?? $map['generic'];
    }

    /**
     * One-click autopilot: the whole setup in a single action. Detects the region from the site
     * locale, writes the region-correct banner copy, scans for trackers (which auto-enables the
     * detected categories so they appear in the policy), and publishes the cookie-policy page.
     * The visitor-facing banner is already live from activation, so this only fills in the rest.
     */
    public function handle_autopilot(): void {
        if ( ! current_user_can( self::CAP ) ) { wp_die( esc_html__( 'Insufficient permissions.', 'cookie-rocket' ) ); }
        check_admin_referer( 'cookroco_autopilot' );

        $s = (array) get_option( 'cookroco_settings', [] ); if ( ! is_array( $s ) ) { $s = []; }
        $law = COOKROCO_Core::locale_default_law();
        $s['default_law'] = $law;
        // The law's own text applies while the title and message are empty. Writing it in would turn it into
        // custom text, and Cookie Rocket Pro would then show it to visitors under every other law.
        unset( $s['banner_title'], $s['banner_body'] );
        update_option( 'cookroco_settings', $s );

        $found   = [];
        if ( class_exists( 'COOKROCO_Scanner' ) ) {
            $res   = ( new COOKROCO_Scanner() )->scan();
            $found = ( is_array( $res ) && ! empty( $res['found'] ) ) ? (array) $res['found'] : [];
        }
        // A tracker pasted straight into the theme or header is only held by raw-HTML blocking. The
        // owner asked for an automatic setup, so it is switched on when the scan finds one: otherwise
        // the result would report as blocked a tracker that loads before consent.
        $has_inline = (bool) array_filter( $found, static fn( $f ) => empty( $f['managed'] ) && 'inline' === ( $f['via'] ?? 'src' ) );
        if ( $has_inline && empty( $s['block_raw_html'] ) ) {
            $s['block_raw_html'] = true;
            update_option( 'cookroco_settings', $s );
        }
        $blocking = ! array_key_exists( 'block_scripts', $s ) || ! empty( $s['block_scripts'] );
        $managed  = count( array_filter( $found, static fn( $f ) => ! empty( $f['managed'] ) ) );
        $blocked  = $blocking ? count( $found ) - $managed : 0;

        $pid    = (int) get_option( 'cookroco_policy_page_id', 0 );
        $exists = $pid && get_post_status( $pid ) && 'trash' !== get_post_status( $pid );
        $policy = $exists ? 'existing' : 'failed';
        if ( ! $exists ) {
            $new = wp_insert_post( [
                'post_title'   => __( 'Cookie Policy', 'cookie-rocket' ),
                'post_content' => '[' . COOKROCO_Policy::SHORTCODE . ']',
                'post_status'  => 'publish',
                'post_type'    => 'page',
            ] );
            if ( $new && ! is_wp_error( $new ) ) { update_option( 'cookroco_policy_page_id', (int) $new ); $pid = (int) $new; $policy = 'created'; }
        }

        // The title visitors will see: the law's own, since the custom one was cleared above.
        $title = (string) ( COOKROCO_Consent::law_texts( $law )['title'] ?? '' );
        set_transient( 'cookroco_autopilot_result', [ 'law' => $law, 'found' => count( $found ), 'blocked' => $blocked, 'managed' => $managed, 'raw_on' => $has_inline, 'policy' => (int) $pid, 'policy_state' => $policy, 'title' => $title ], 300 );
        update_option( 'cookroco_onboarded', '1' );
        wp_safe_redirect( admin_url( 'admin.php?page=' . self::SLUG . '&autopilot=done' ) );
        exit;
    }

    /** First-run hero: the single "set up my whole site in one click" call to action. */
    private function render_autopilot_hero(): void {
        $shield = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/><path d="M9 12l2 2 4-4"/></svg>';
        echo '<div class="cr-autopilot">';
        echo '<span class="cr-autopilot__icon">' . $shield . '</span>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static inline SVG.
        echo '<h2 class="cr-autopilot__title">' . esc_html__( 'Set up your cookie banner in one click', 'cookie-rocket' ) . '</h2>';
        echo '<p class="cr-autopilot__lead">' . esc_html__( 'Cookie Rocket will pick the law for your site\'s language, scan for trackers, write your banner and publish your cookie policy — automatically. No screens to click through, no account, no cloud.', 'cookie-rocket' ) . '</p>';
        echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '">';
        echo '<input type="hidden" name="action" value="cookroco_autopilot">';
        wp_nonce_field( 'cookroco_autopilot' );
        echo '<button type="submit" class="button button-primary button-hero cr-autopilot__go cr-scan-trigger">' . esc_html__( 'Set up automatically', 'cookie-rocket' ) . '</button>';
        echo '</form>';
        echo '<a class="cr-autopilot__manual" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-setup' ) ) . '">' . esc_html__( 'I’ll configure it myself', 'cookie-rocket' ) . '</a>';
        echo '</div>';
    }

    /** Post-autopilot celebration: exactly what was configured, so the owner sees the value at a glance. */
    private function render_autopilot_result( array $r ): void {
        $check   = '<span class="cr-autopilot__check"><span class="dashicons dashicons-yes"></span></span>';
        $preview = home_url( '/?cookroco_preview=1' );
        echo '<div class="cr-autopilot cr-autopilot--done">';
        echo '<span class="cr-autopilot__icon cr-autopilot__icon--ok"><span class="dashicons dashicons-yes-alt"></span></span>';
        echo '<h2 class="cr-autopilot__title">' . esc_html__( 'Your setup is complete.', 'cookie-rocket' ) . '</h2>';
        echo '<ul class="cr-autopilot__list">';
        echo '<li>' . $check . esc_html( sprintf( /* translators: %s: region/law name. */ __( 'Region detected: %s', 'cookie-rocket' ), self::region_label( (string) $r['law'] ) ) ) . '</li>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $check is a static icon.
        $found   = (int) ( $r['found'] ?? 0 );
        $blocked = (int) ( $r['blocked'] ?? $found );
        $managed = (int) ( $r['managed'] ?? 0 );
        echo '<li>' . $check . esc_html( sprintf( /* translators: %d: number of trackers. */ _n( '%d tracker found and blocked until consent', '%d trackers found and blocked until consent', $blocked, 'cookie-rocket' ), $blocked ) ) . '</li>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
        echo '<li>' . $check . esc_html( sprintf( /* translators: %s: banner title. */ __( 'Banner published: “%s”', 'cookie-rocket' ), (string) ( $r['title'] ?? '' ) ) ) . '</li>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
        if ( $managed > 0 ) {
            echo '<li>' . $check . esc_html__( 'Google Tag Manager: its tags wait for consent through Consent Mode v2', 'cookie-rocket' ) . '</li>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
        }
        if ( ! empty( $r['raw_on'] ) ) {
            echo '<li>' . $check . esc_html__( 'Scripts pasted into your theme are held too (raw HTML blocking turned on)', 'cookie-rocket' ) . '</li>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
        }
        $policy = (string) ( $r['policy_state'] ?? 'created' );
        if ( 'failed' === $policy ) {
            echo '<li><span class="cr-autopilot__check cr-autopilot__check--warn"><span class="dashicons dashicons-warning"></span></span>' . esc_html__( 'The cookie policy page could not be created. Add the [cookie_rocket_policy] shortcode to a page.', 'cookie-rocket' ) . '</li>';
        } else {
            echo '<li>' . $check . esc_html( 'existing' === $policy ? __( 'Cookie policy page: already in place, kept as it was', 'cookie-rocket' ) : __( 'Cookie policy page created', 'cookie-rocket' ) ) . '</li>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
        }
        echo '</ul>';
        echo '<div class="cr-autopilot__actions">';
        echo '<a class="button button-primary" href="' . esc_url( $preview ) . '" target="_blank" rel="noopener">' . esc_html__( 'See your banner', 'cookie-rocket' ) . '</a>';
        echo '<a class="button" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-design' ) ) . '">' . esc_html__( 'Review settings', 'cookie-rocket' ) . '</a>';
        echo '</div>';
        echo '</div>';
    }

    /**
     * Premium dashboard / welcome screen — the plugin landing page.
     * Status hero, key stats, quick actions and the Pro showcase.
     */
    public function render_dashboard(): void {
        $s      = (array) get_option( 'cookroco_settings', [] );
        $stats  = $this->log->get_stats();
        $total  = (int) ( $stats['total'] ?? 0 );
        $last7  = (int) ( $stats['last7days'] ?? 0 );
        $scan   = get_option( 'cookroco_last_scan', [] );
        $found  = ( is_array( $scan ) && ! empty( $scan['found'] ) ) ? count( $scan['found'] ) : 0;
        $scan_t = ( is_array( $scan ) && ! empty( $scan['time'] ) ) ? mysql2date( (string) get_option( 'date_format', 'M j, Y' ), $scan['time'] ) : '';
        $gcm    = array_key_exists( 'gcm_enabled', $s ) ? ! empty( $s['gcm_enabled'] ) : true;
        $blk    = array_key_exists( 'block_scripts', $s ) ? ! empty( $s['block_scripts'] ) : true;
        $policy = (int) get_option( 'cookroco_policy_page_id', 0 );
        $base   = 'admin.php?page=' . self::SLUG;

        $scanned   = is_array( $scan ) && ! empty( $scan['time'] );
        $policy_ok = $policy && get_post_status( $policy ) && 'trash' !== get_post_status( $policy );

        // Title on the left, the two things people come here to do on the right (Elementor's admin header).
        $rescan_head = wp_nonce_url( admin_url( $base . '-scanner&cr_scan=1' ), 'cookroco_scan' );
        echo '<div class="wrap cr-wrap cr-dash"><div class="cr-page-head"><h1>' . esc_html__( 'Status', 'cookie-rocket' ) . '</h1><div class="cr-page-head__actions">';
        echo '<a class="button" href="' . esc_url( home_url( '/?cookroco_preview=1' ) ) . '" target="_blank" rel="noopener">' . esc_html__( 'See the banner', 'cookie-rocket' ) . '</a>';
        echo '<a class="button button-primary" href="' . esc_url( $rescan_head ) . '">' . esc_html__( 'Scan the site', 'cookie-rocket' ) . '</a></div></div>';

        // ─── One-click autopilot: the answer to "the other tools are complicated" ───
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only view flag after our own redirect.
        $ap_done = isset( $_GET['autopilot'] ) && 'done' === sanitize_key( wp_unslash( $_GET['autopilot'] ) );
        $ap_res  = get_transient( 'cookroco_autopilot_result' );
        if ( $ap_done && is_array( $ap_res ) ) {
            $this->render_autopilot_result( $ap_res );
            delete_transient( 'cookroco_autopilot_result' );
        } elseif ( '0' === (string) get_option( 'cookroco_onboarded', '1' ) ) {
            // Fresh install: the one-click setup leads, and the rest of the dashboard follows
            // below it, so anyone who would rather explore on their own still can.
            $this->render_autopilot_hero();
        }

        // ─── Overview: the stat indicators (kept — Site-Kit style) ───
        $log_url = admin_url( $base . '-log' );
        $scan_pg = admin_url( $base . '-scanner' );
        $rescan  = wp_nonce_url( admin_url( $base . '-scanner&cr_scan=1' ), 'cookroco_scan' );
        $grid  = '<div class="cr-stat-grid">';
        $grid .= $this->dash_stat( 'dashicons-yes-alt', number_format_i18n( $total ), __( 'Consents recorded', 'cookie-rocket' ), __( 'Every decision, stored as proof', 'cookie-rocket' ), $log_url, __( 'View the log', 'cookie-rocket' ) );
        $grid .= $this->dash_stat( 'dashicons-chart-bar', number_format_i18n( $last7 ), __( 'Last 7 days', 'cookie-rocket' ), __( 'New consents this week', 'cookie-rocket' ), $log_url, __( 'See this week', 'cookie-rocket' ) );
        // When the last scan could not read a SINGLE page, its zero does not mean "clean",
        // it means "unknown". Only a scan that actually read something may report a count.
		$cr_attempted = ( is_array( $scan ) && ! empty( $scan['scanned'] ) ) ? count( (array) $scan['scanned'] ) : 0;
		$cr_failed   = ( is_array( $scan ) && ! empty( $scan['errors'] ) ) ? count( (array) $scan['errors'] ) : 0;
		$cr_scan_unreadable = $cr_attempted > 0 && $cr_failed >= $cr_attempted;
		if ( $cr_scan_unreadable ) {
			$grid .= $this->dash_stat( 'dashicons-warning', '—', __( 'Trackers detected', 'cookie-rocket' ), __( 'None of your pages could be read — the result below is not a clean bill of health', 'cookie-rocket' ), $scan_pg, __( 'See why', 'cookie-rocket' ) );
		} else {
			$grid .= $this->dash_stat( 'dashicons-search', number_format_i18n( $found ), __( 'Trackers detected', 'cookie-rocket' ), __( 'Found in your latest scan', 'cookie-rocket' ), $scan_pg, __( 'Open the scanner', 'cookie-rocket' ) );
		}
        $grid .= $this->dash_stat( 'dashicons-clock', $scan_t ? $scan_t : '—', __( 'Last scan', 'cookie-rocket' ), __( 'Re-scan when your site changes', 'cookie-rocket' ), $rescan, __( 'Re-scan now', 'cookie-rocket' ), true );
        $grid .= '</div>';
        echo wp_kses_post( $grid );

        // ─── Slim, light header (brand + live status) — no heavy wall ───
        $head  = '<div class="cr-topbar"><div class="cr-topbar__brand">';
        $head .= '<span class="cr-topbar__logo"><span class="dashicons dashicons-shield-alt"></span></span>';
        // "Live" only when something actually holds trackers back: with both switches off the site
        // would be told it is protected while nothing is blocked.
        $live  = $blk || $gcm;
        $head .= '<div class="cr-topbar__txt"><strong>' . esc_html( $live ? __( 'Protection is live', 'cookie-rocket' ) : __( 'Protection is off', 'cookie-rocket' ) ) . '</strong><span>' . esc_html( $live ? __( 'Real blocking, Consent Mode v2 and cookie scanning — on your site, with no pageview limits and no account.', 'cookie-rocket' ) : __( 'Automatic blocking and Consent Mode v2 are both off, so trackers load before visitors decide. Turn them on in Settings → Blocking.', 'cookie-rocket' ) ) . '</span></div></div>';
        $head .= '<div class="cr-topbar__chips">';
        $head .= $this->dash_pill( $blk, $blk ? __( 'Auto-blocking on', 'cookie-rocket' ) : __( 'Auto-blocking off', 'cookie-rocket' ) );
        $head .= $this->dash_pill( $gcm, $gcm ? __( 'Consent Mode v2 on', 'cookie-rocket' ) : __( 'Consent Mode v2 off', 'cookie-rocket' ) );
        $head .= '<a class="cr-topbar__setup" href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-setup' ) ) . '">' . esc_html__( 'Re-run setup', 'cookie-rocket' ) . '</a>';
        $head .= '</div></div>';
        echo '<div class="cr-cols"><div class="cr-cols__main">';
        echo wp_kses_post( $head );

        // ─── What's left: the compliance verdict + the single next action ───
        // No numbered wizard checklist. Each remaining task is a plain, actionable row; the
        // top-priority one carries the primary button. When nothing is left, it collapses to
        // an "all set" line with a quiet re-scan. Priority order: scan, then policy (the banner
        // is always live, so it's never a pending task — it's the resolved baseline).
        $todo = [];
        if ( ! $scanned ) {
            $todo[] = [ __( 'Scan your site', 'cookie-rocket' ), __( 'See which trackers you have and list their cookies.', 'cookie-rocket' ), $base . '-scanner', __( 'Scan now', 'cookie-rocket' ) ];
        }
        if ( ! $policy_ok ) {
            $todo[] = [ __( 'Publish your cookie policy', 'cookie-rocket' ), __( 'A required privacy disclosure, in one click.', 'cookie-rocket' ), $base . '-policy', __( 'Create page', 'cookie-rocket' ) ];
        }

        if ( empty( $todo ) ) {
            $rescan_all = wp_nonce_url( admin_url( $base . '-scanner&cr_scan=1' ), 'cookroco_scan' );
            $nx  = '<div class="cr-card cr-next cr-next--done"><div class="cr-next__done">';
            $nx .= '<span class="cr-next__done-icon dashicons dashicons-yes-alt"></span>';
            $nx .= '<div class="cr-next__done-txt"><strong>' . esc_html__( 'You\'re all set', 'cookie-rocket' ) . '</strong><span>' . esc_html__( 'Protection is live and your setup is complete.', 'cookie-rocket' ) . '</span></div>';
            $nx .= '<a class="button cr-next__rescan" href="' . esc_url( $rescan_all ) . '">' . esc_html__( 'Re-scan site', 'cookie-rocket' ) . '</a>';
            $nx .= '</div></div>';
        } else {
            $left = count( $todo );
            $nx  = '<div class="cr-card cr-next"><div class="cr-card__head"><h2>' . esc_html__( 'Finish setup', 'cookie-rocket' ) . '</h2>';
            /* translators: %d: number of setup steps still pending. */
            $nx .= '<span class="cr-next__count">' . esc_html( sprintf( _n( '%d step left', '%d steps left', $left, 'cookie-rocket' ), $left ) ) . '</span></div>';
            $nx .= '<ul class="cr-next__list">';
            foreach ( $todo as $i => $t ) {
                $btn = ( 0 === $i ) ? 'button button-primary' : 'button';
                $nx .= '<li class="cr-next__item' . ( 0 === $i ? ' is-priority' : '' ) . '">';
                $nx .= '<span class="cr-next__txt"><strong>' . esc_html( $t[0] ) . '</strong><span>' . esc_html( $t[1] ) . '</span></span>';
                $nx .= '<a class="' . esc_attr( $btn ) . '" href="' . esc_url( admin_url( $t[2] ) ) . '">' . esc_html( $t[3] ) . '</a>';
                $nx .= '</li>';
            }
            $nx .= '</ul></div>';
        }
        echo wp_kses_post( $nx );
        echo '</div><aside class="cr-cols__side">';

        // ─── Your setup: config at a glance ───
        $variant_labels = [ 'bottom_bar' => __( 'Bottom bar', 'cookie-rocket' ), 'top_bar' => __( 'Top bar', 'cookie-rocket' ), 'modal' => __( 'Center popup', 'cookie-rocket' ), 'floating' => __( 'Floating box', 'cookie-rocket' ), 'drawer' => __( 'Side panel', 'cookie-rocket' ) ];
        $cur_variant    = sanitize_key( $s['banner_variant'] ?? 'bottom_bar' );
        $variant_label  = $variant_labels[ $cur_variant ] ?? $variant_labels['bottom_bar'];
        $reject_on      = array_key_exists( 'show_reject_button', $s ) ? ! empty( $s['show_reject_button'] ) : true;
        $lang_name      = function_exists( 'locale_get_display_language' ) ? locale_get_display_language( get_locale(), get_locale() ) : get_bloginfo( 'language' );
        $setup_items    = [
            /**
             * The compliance line of "Your setup": the site's framework. Cookie Rocket Pro adds its regions.
             *
             * @param string $label Name of the default framework.
             */
            [ 'dashicons-shield', __( 'Compliance', 'cookie-rocket' ), (string) apply_filters( 'cookroco_setup_compliance', self::law_names()[ (string) ( $s['default_law'] ?? 'generic' ) ] ?? self::law_names()['generic'] ), $base . '-settings' ],
            [ 'dashicons-translation', __( 'Language', 'cookie-rocket' ), sprintf( /* translators: %s: current site language name. */ __( 'Auto · %s', 'cookie-rocket' ), ucfirst( (string) $lang_name ) ), $base . '-design' ],
            [ 'dashicons-align-center', __( 'Layout', 'cookie-rocket' ), $variant_label, $base . '-design' ],
            [ 'dashicons-yes-alt', __( 'Reject button', 'cookie-rocket' ), $reject_on ? __( 'Shown', 'cookie-rocket' ) : __( 'Hidden', 'cookie-rocket' ), $base . '-design' ],
        ];
        $setup  = '<div class="cr-card cr-setup"><div class="cr-card__head"><h2>' . esc_html__( 'Your setup', 'cookie-rocket' ) . '</h2></div><div class="cr-setup-grid">';
        foreach ( $setup_items as $it ) {
            $setup .= '<a class="cr-setup-item" href="' . esc_url( admin_url( $it[3] ) ) . '"><span class="cr-setup-item__icon dashicons ' . esc_attr( $it[0] ) . '"></span><span class="cr-setup-item__txt"><span class="cr-setup-item__label">' . esc_html( $it[1] ) . '</span><span class="cr-setup-item__val">' . esc_html( $it[2] ) . '</span></span></a>';
        }
        $setup .= '</div></div>';
        echo wp_kses_post( $setup );

        // ─── Pro (single contained panel at the bottom) ───
        if ( apply_filters( 'cookroco_pro_active', false ) ) {
            do_action( 'cookroco_dashboard_pro_slot' );
        } else {
            $this->render_pro_panel();
        }

        echo '</aside></div></div>';
    }

    private function dash_pill( bool $on, string $label ): string {
        $cls  = $on ? 'cr-pill cr-pill--on' : 'cr-pill cr-pill--off';
        $icon = $on ? 'dashicons-yes' : 'dashicons-minus';
        return '<span class="' . esc_attr( $cls ) . '"><span class="dashicons ' . esc_attr( $icon ) . '"></span>' . esc_html( $label ) . '</span>';
    }

    private function dash_stat( string $icon, string $value, string $label, string $desc = '', string $link_url = '', string $link_text = '', bool $value_is_text = false ): string {
        $num_cls = 'cr-stat__num' . ( $value_is_text ? ' cr-stat__num--text' : '' );
        $out  = '<div class="cr-stat"><span class="dashicons ' . esc_attr( $icon ) . ' cr-stat__icon"></span>';
        $out .= '<div class="' . esc_attr( $num_cls ) . '">' . esc_html( $value ) . '</div>';
        $out .= '<div class="cr-stat__label">' . esc_html( $label ) . '</div>';
        if ( '' !== $desc ) {
            $out .= '<div class="cr-stat__desc">' . esc_html( $desc ) . '</div>';
        }
        if ( '' !== $link_url && '' !== $link_text ) {
            $out .= '<a class="cr-stat__link" href="' . esc_url( $link_url ) . '">' . esc_html( $link_text ) . ' &rarr;</a>';
        }
        return $out . '</div>';
    }

    private function dash_action( string $page, string $icon, string $title, string $desc ): string {
        return '<a class="cr-action" href="' . esc_url( admin_url( $page ) ) . '">'
            . '<span class="cr-action__icon"><span class="dashicons ' . esc_attr( $icon ) . '"></span></span>'
            . '<span class="cr-action__body"><strong>' . esc_html( $title ) . '</strong><span>' . esc_html( $desc ) . '</span></span>'
            . '<span class="cr-action__arrow dashicons dashicons-arrow-right-alt2"></span></a>';
    }

    public function render_settings(): void {
        $s   = (array) get_option( 'cookroco_settings', [] );
        $gcm = array_key_exists( 'gcm_enabled', $s ) ? ! empty( $s['gcm_enabled'] ) : true;
        $blk = array_key_exists( 'block_scripts', $s ) ? ! empty( $s['block_scripts'] ) : true;
        $buf = array_key_exists( 'block_raw_html', $s ) ? ! empty( $s['block_raw_html'] ) : false;
        $emb = array_key_exists( 'block_embeds', $s ) ? ! empty( $s['block_embeds'] ) : true;
        $pro = (bool) apply_filters( 'cookroco_pro_active', false );
        $vendor_list = implode( ', ', wp_list_pluck( COOKROCO_Blocker::vendors(), 'label' ) );

        /**
         * Filters the Settings tabs. An add-on adds a tab here and fills it on 'cookroco_settings_tab'.
         *
         * @param array<string,string> $tabs key => label.
         */
        $tabs = (array) apply_filters(
            'cookroco_settings_tabs',
            [
                'general'    => __( 'General', 'cookie-rocket' ),
                'blocking'   => __( 'Blocking', 'cookie-rocket' ),
                'shortcodes' => __( 'Shortcodes', 'cookie-rocket' ),
            ]
        );
        $row = static function ( string $label, string $control, string $desc = '', string $for = '' ): void {
            echo '<tr><th scope="row">' . ( $for ? '<label for="' . esc_attr( $for ) . '">' . esc_html( $label ) . '</label>' : esc_html( $label ) ) . '</th><td>';
            echo $control; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- built from escaped parts below.
            if ( '' !== $desc ) {
                echo '<p class="description">' . wp_kses_post( $desc ) . '</p>';
            }
            echo '</td></tr>';
        };
        $check = static fn( string $name, bool $on, string $text ): string => '<label><input type="checkbox" name="' . esc_attr( 'cookroco_settings[' . $name . ']' ) . '" value="1" ' . checked( $on, true, false ) . '> ' . esc_html( $text ) . '</label>';

        echo '<div class="wrap cr-wrap cr-settings"><h1>' . esc_html__( 'Settings', 'cookie-rocket' ) . '</h1>';
        echo '<form method="post" action="options.php" class="cr-settings__form">';
        settings_fields( 'cookroco_settings_group' );

        // Folder tabs, as Elementor's Settings: one form, every tab saved together.
        echo '<div class="cr-ntabs" role="tablist" aria-label="' . esc_attr__( 'Settings', 'cookie-rocket' ) . '">';
        $first = true;
        foreach ( $tabs as $key => $label ) {
            echo '<button type="button" class="cr-ntab" role="tab" id="' . esc_attr( 'cr-stab-btn-' . $key ) . '" aria-controls="' . esc_attr( 'cr-stab-' . $key ) . '" aria-selected="' . ( $first ? 'true' : 'false' ) . '" tabindex="' . ( $first ? '0' : '-1' ) . '" data-tab="' . esc_attr( $key ) . '">' . esc_html( $label ) . '</button>';
            $first = false;
        }
        echo '</div>';

        foreach ( $tabs as $key => $label ) {
            echo '<div class="cr-stab" role="tabpanel" id="' . esc_attr( 'cr-stab-' . $key ) . '" aria-labelledby="' . esc_attr( 'cr-stab-btn-' . $key ) . '"' . ( 'general' === $key ? '' : ' hidden' ) . '>';
            if ( 'general' === $key ) {
                $law_now  = in_array( $s['default_law'] ?? 'generic', [ 'gdpr', 'ccpa', 'lgpd', 'lfpdppp', 'generic' ], true ) ? ( $s['default_law'] ?? 'generic' ) : 'generic';
                $law_opts = self::law_names();
                $opts     = '';
                foreach ( $law_opts as $lk => $ll ) {
                    $opts .= '<option value="' . esc_attr( $lk ) . '" ' . selected( $law_now, $lk, false ) . '>' . esc_html( $ll ) . '</option>';
                }
                echo '<h2 class="cr-stab__title">' . esc_html__( 'Consent', 'cookie-rocket' ) . '</h2><p class="cr-stab__lead">' . esc_html__( 'The law, how long a decision lasts and when to ask again.', 'cookie-rocket' ) . '</p><table class="form-table" role="presentation">';
                $row( __( 'Compliance framework', 'cookie-rocket' ), '<select id="cookroco-default-law" name="cookroco_settings[default_law]">' . $opts . '</select>', __( 'The law whose text the banner uses by default. New installs pick it from the site language; the words themselves are in Banner → Content.', 'cookie-rocket' ), 'cookroco-default-law' );
                $row( __( 'Consent duration', 'cookie-rocket' ), '<span class="cr-unit"><input id="cookroco-consent-duration" type="number" name="cookroco_settings[consent_duration_days]" value="' . esc_attr( (string) min( 'gdpr' === ( $s['default_law'] ?? '' ) ? 395 : 730, absint( $s['consent_duration_days'] ?? 365 ) ) ) . '" min="1" max="' . ( 'gdpr' === ( $s['default_law'] ?? '' ) ? '395' : '730' ) . '"> ' . esc_html__( 'days', 'cookie-rocket' ) . '</span>', 'gdpr' === ( $s['default_law'] ?? '' ) ? __( 'After this many days the banner asks again. The CNIL recommends 6 months (180 days) and caps it at 13 months.', 'cookie-rocket' ) : __( 'After this many days the banner asks again.', 'cookie-rocket' ), 'cookroco-consent-duration' );
                $row( __( 'Policy version', 'cookie-rocket' ), '<input id="cookroco-policy-version" type="text" maxlength="20" name="cookroco_settings[policy_version]" value="' . esc_attr( (string) ( $s['policy_version'] ?? '1.0' ) ) . '" class="small-text">', __( 'Raise it when you change your cookie policy: every visitor is asked again.', 'cookie-rocket' ), 'cookroco-policy-version' );
                $row( __( 'Privacy notice link', 'cookie-rocket' ), '<input id="cookroco-policy-url" type="url" name="cookroco_settings[policy_url]" value="' . esc_attr( (string) ( $s['policy_url'] ?? '' ) ) . '" class="regular-text" placeholder="https://">', __( 'Where the “Privacy policy” link on the banner goes. Leave it empty to use your Cookie Policy page or, without one, the privacy page set in Settings → Privacy. Use it when your notice lives on another site.', 'cookie-rocket' ), 'cookroco-policy-url' );
                $row( __( 'Change of mind', 'cookie-rocket' ), $check( 'show_floating_button', ! empty( $s['show_floating_button'] ), __( 'Show a button on every page to change or withdraw consent', 'cookie-rocket' ) ), __( 'Off by default. Visitors must be able to change their decision as easily as they made it: without this button, put the [cookie-rocket-preferences] shortcode in your footer, which adds a “Manage cookies” button there.', 'cookie-rocket' ) );
                do_action( 'cookroco_settings_rows_general', $s );
                // Cookie Rocket Pro asks this in its own Data tab, next to how long records are kept.
                if ( ! apply_filters( 'cookroco_pro_active', false ) ) {
                    $row( __( 'On uninstall', 'cookie-rocket' ), $check( 'delete_data_on_uninstall', ! empty( $s['delete_data_on_uninstall'] ), __( 'Delete all Cookie Rocket data when the plugin is deleted', 'cookie-rocket' ) ), __( 'Off by default: deleting the plugin keeps your settings and the consent log, which is your proof of consent.', 'cookie-rocket' ) );
                }
                echo '</table>';
                if ( ! $pro ) {
                    echo '<div class="cr-promo-row"><h2 class="cr-stab__title">' . esc_html__( 'Each visitor, their own law', 'cookie-rocket' ) . ' <span class="cr-chip cr-chip--promo">' . self::crown() . esc_html__( 'Pro', 'cookie-rocket' ) . '</span></h2>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
                    echo '<div class="cr-promo-alert">' . self::crown() . '<div><strong>' . esc_html__( 'GDPR for Europe, CCPA for the United States, LFPDPPP for Mexico', 'cookie-rocket' ) . '</strong><p>' . esc_html__( 'Cookie Rocket Pro detects each visitor\'s country and shows them their law, also behind page caching.', 'cookie-rocket' ) . '</p>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
                    echo '<a class="cr-btn-promo" href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=settings-geo' ) . '" target="_blank" rel="noopener">' . self::crown() . esc_html__( 'Upgrade to Pro', 'cookie-rocket' ) . '</a></div></div></div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
                }
            } elseif ( 'blocking' === $key ) {
                echo '<h2 class="cr-stab__title">' . esc_html__( 'Script blocking', 'cookie-rocket' ) . '</h2><p class="cr-stab__lead">' . esc_html__( 'What stays blocked until the visitor accepts.', 'cookie-rocket' ) . '</p><table class="form-table" role="presentation">';
                $row( __( 'Google Consent Mode v2', 'cookie-rocket' ), $check( 'gcm_enabled', $gcm, __( 'Send Consent Mode v2, denied by default, to Google Analytics, Ads and Tag Manager', 'cookie-rocket' ) ), __( 'Recommended. It gates Google cookies the way Google asks, even where a script is not blocked.', 'cookie-rocket' ) );
                /* translators: %s: list of the providers blocked, such as "Google Analytics, Meta Pixel". */
                $row( __( 'Automatic blocking', 'cookie-rocket' ), $check( 'block_scripts', $blk, __( 'Hold scripts from known providers until the visitor accepts their category', 'cookie-rocket' ) ), sprintf( __( 'Covers the scripts your plugins and theme load: %s.', 'cookie-rocket' ), esc_html( $vendor_list ) ) );
                $row( __( 'Embed placeholders', 'cookie-rocket' ), $check( 'block_embeds', $emb, __( 'Hold YouTube, Vimeo, Maps and social embeds until consent, with a click-to-load placeholder', 'cookie-rocket' ) ), __( 'A tidy placeholder instead of an empty space; the content loads the moment the visitor accepts.', 'cookie-rocket' ) );
                $row( __( 'Scripts in the page code', 'cookie-rocket' ), $check( 'block_raw_html', $buf, __( 'Also hold scripts pasted into the theme or the header, and embeds placed with page builders', 'cookie-rocket' ) ), __( 'Turn it on if a tracker is pasted in the &lt;head&gt; rather than added by a plugin, or if you place YouTube, Vimeo or Maps with a page builder. It reads the whole page before sending it, which some caching plugins do not expect: test it after turning it on. Off by default.', 'cookie-rocket' ) );
                do_action( 'cookroco_settings_rows_blocking', $s );
                echo '</table>';
            } elseif ( 'shortcodes' === $key ) {
                echo '<h2 class="cr-stab__title">' . esc_html__( 'Shortcodes', 'cookie-rocket' ) . '</h2><p class="cr-stab__lead">' . esc_html__( 'Paste them into any page, post or widget.', 'cookie-rocket' ) . '</p><table class="form-table" role="presentation">';
                foreach ( [ '[cookie-rocket-preferences]' => __( 'A button that opens the cookie preferences', 'cookie-rocket' ), '[cookie-rocket-withdraw]' => __( 'A link that withdraws consent', 'cookie-rocket' ), '[cookie_rocket_policy]' => __( 'The table of your cookie declaration', 'cookie-rocket' ) ] as $code => $what ) {
                    $row( $what, '<span class="cr-copy"><code>' . esc_html( $code ) . '</code><button type="button" class="button cr-copy__btn" data-copy="' . esc_attr( $code ) . '" data-done="' . esc_attr__( 'Copied', 'cookie-rocket' ) . '">' . esc_html__( 'Copy', 'cookie-rocket' ) . '</button></span>' );
                }
                echo '</table>';
            } else {
                do_action( 'cookroco_settings_tab', $key, $s );
            }
            echo '</div>';
        }

        // Save stays in reach at the bottom of the screen, and says when something is unsaved.
        echo '<div class="cr-savebar"><span class="cr-savebar__dirty" hidden>' . esc_html__( 'You have unsaved changes', 'cookie-rocket' ) . '</span>';
        submit_button( __( 'Save changes', 'cookie-rocket' ) );
        echo '</div></form></div>';
    }

    /**
     * Pro features showcase panel.
     * Standalone, additive — Pro features visible but disabled, with a single CTA.
     * Follows wp.org guideline 11 (no popups, no admin notices, single discreet CTA).
     * Outputs directly to satisfy Plugin Check's escape-on-output rule.
     */
    private function render_pro_panel(): void {
        $features = [
            [ 'dashicons-location-alt',  __('Automatic geolocation','cookie-rocket'), __('Each visitor gets the law of their country, GDPR, LGPD or LFPDPPP, also behind page caching.','cookie-rocket') ],
            [ 'dashicons-search',        __('Automatic monthly re-scan','cookie-rocket'),        __('Re-scans your site every month and emails you when a new tracker appears, so your cookie inventory stays current without you thinking about it.','cookie-rocket') ],
            [ 'dashicons-shield',        __('Tamper-evident consent ledger','cookie-rocket'),    __('Every consent decision is sealed into a SHA-256 hash chain. One click verifies integrity and exports an audit evidence report you can hand to a client.','cookie-rocket') ],
            [ 'dashicons-privacy',       __('ARCO / DSAR rights channel','cookie-rocket'),      __('Data-subject requests arrive through a form on your own site and are handled from this dashboard. No external service involved.','cookie-rocket') ],
            [ 'dashicons-media-text',    __('Generated privacy notice','cookie-rocket'),        __('Built from your business details, with the elements the law that applies to each visitor requires.','cookie-rocket') ],
            [ 'dashicons-download',      __('Audit log + CSV export','cookie-rocket'),   __('Complete consent log (IP hash, date, categories, policy version) exportable to CSV.','cookie-rocket') ],
            [ 'dashicons-controls-repeat',__('Customizable floating button','cookie-rocket'),  __('The button visitors use to change their choice, your way: text, icon or both, its icon, side, distance from the edge, colors, shape, size and shadow.','cookie-rocket') ],
        ];
        $url = 'https://templatesrocket.com/cookie-rocket-pro?feature=panel';

        echo '<div class="cr-propanel">';
        // The crown sits in the column of the feature icons and the title lines up with their names.
        echo '<div class="cr-propanel__head"><span class="cr-propanel__mark">' . self::crown() . '</span><div><h2>Cookie Rocket Pro</h2><p>' . esc_html__( 'Premium features for professional sites', 'cookie-rocket' ) . '</p></div></div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
        echo '<ul class="cr-propanel__list">';
        foreach ( $features as $f ) {
            echo '<li class="cr-propanel__item">';
            echo '<span class="cr-propanel__icon dashicons ' . esc_attr( $f[0] ) . '"></span>';
            echo '<div class="cr-propanel__txt"><strong>' . esc_html( $f[1] ) . '</strong><p>' . esc_html( $f[2] ) . '</p></div>';
            echo '</li>';
        }
        echo '</ul>';
        echo '<div class="cr-propanel__foot"><a class="cr-btn-promo" href="' . esc_url( $url ) . '" target="_blank" rel="noopener">' . self::crown() . esc_html__( 'See Cookie Rocket Pro', 'cookie-rocket' ) . '</a><span>' . esc_html__( 'Auto-updates + premium support included', 'cookie-rocket' ) . '</span></div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- crown() is static SVG.
        echo '</div>';
    }
    /**
     * One-click banner themes; Cookie Rocket Pro adds its own through the cookroco_banner_themes filter.
     * Each 'values' maps to cookroco_banner_design keys.
     */
    public static function banner_themes(): array {
        $themes = [
            // Neutral, non-imposing schemes (greys / black / white) — they fit any site; the user
            // then customises freely with the color fields. No brand colors are forced.
            'light'    => [ 'name' => __( 'Light', 'cookie-rocket' ),    'desc' => __( 'White with near-black buttons. The safe choice for most sites.', 'cookie-rocket' ), 'pro' => false, 'values' => [ 'banner_border' => 'on', 'banner_shadow' => 'off', 'background_color' => '#ffffff', 'text_color' => '#1a1a1a', 'accept_button_bg' => '#1a1a1a', 'accept_text_color' => '#ffffff', 'primary_color' => '#1a1a1a', 'border_radius' => '0', 'dark_mode' => 'light' ] ],
            'dark'     => [ 'name' => __( 'Dark', 'cookie-rocket' ),     'desc' => __( 'Near-black with light buttons, for sites with a dark design.', 'cookie-rocket' ), 'pro' => false, 'values' => [ 'banner_border' => 'on', 'banner_shadow' => 'off', 'background_color' => '#18181b', 'text_color' => '#f4f4f5', 'accept_button_bg' => '#f4f4f5', 'accept_text_color' => '#18181b', 'primary_color' => '#f4f4f5', 'border_radius' => '0', 'dark_mode' => 'dark' ] ],
            'soft'     => [ 'name' => __( 'Soft', 'cookie-rocket' ),     'desc' => __( 'Warm off-white and charcoal: quieter, for editorial and lifestyle sites.', 'cookie-rocket' ), 'pro' => false, 'values' => [ 'banner_border' => 'on', 'banner_shadow' => 'off', 'background_color' => '#f7f6f3', 'text_color' => '#3a3a3a', 'accept_button_bg' => '#3a3a3a', 'accept_text_color' => '#ffffff', 'primary_color' => '#3a3a3a', 'border_radius' => '0', 'dark_mode' => 'light' ] ],
            'graphite' => [ 'name' => __( 'Graphite', 'cookie-rocket' ), 'desc' => __( 'Blue-black with pale buttons, for dark or technical sites.', 'cookie-rocket' ), 'pro' => false,  'values' => [ 'banner_border' => 'on', 'banner_shadow' => 'off', 'background_color' => '#1f2430', 'text_color' => '#e5e7eb', 'accept_button_bg' => '#e5e7eb', 'accept_text_color' => '#1f2430' ] ],
        ];
        return apply_filters( 'cookroco_banner_themes', $themes );
    }

    /**
     * What the Pro styles look like, shown in the free edition as pictures that lead to Cookie
     * Rocket Pro. Only the colors of the picture: the free edition cannot apply them (WordPress.org
     * guideline 5). Branded shows a sample brand color, painted as the Pro paints it.
     *
     * @return array<string,array>
     */
    private static function pro_style_previews(): array {
        return [
            'glass'        => [ 'name' => __( 'Glass', 'cookie-rocket' ),        'desc' => __( 'A cool blue-grey tint that sits calmly on light pages.', 'cookie-rocket' ), 'pro' => true, 'values' => [ 'background_color' => '#eef1f5', 'text_color' => '#1f2937', 'accept_button_bg' => '#1f2937', 'accept_text_color' => '#ffffff' ] ],
            'branded'      => [ 'name' => __( 'Branded', 'cookie-rocket' ),      'desc' => __( 'Takes your brand color, from Elementor, your theme or your logo, and adjusts it so every text stays readable.', 'cookie-rocket' ), 'pro' => true, 'values' => [ 'background_color' => '#ffffff', 'text_color' => '#1a1a1a', 'accept_button_bg' => '#2563eb', 'accept_text_color' => '#ffffff' ] ],
            'frosted'      => [ 'name' => __( 'Frosted', 'cookie-rocket' ),      'desc' => __( 'Translucent: the page shows through, softly blurred, with twin light buttons.', 'cookie-rocket' ), 'pro' => true, 'values' => [ 'background_color' => '#f4f4f4', 'text_color' => '#171a20', 'accept_button_bg' => '#ffffff', 'accept_text_color' => '#393c41', 'border_radius' => '8' ] ],
            'frosted_dark' => [ 'name' => __( 'Frosted Dark', 'cookie-rocket' ), 'desc' => __( 'Translucent and dark: the page shows through, softly blurred, with twin buttons in a lighter tint.', 'cookie-rocket' ), 'pro' => true, 'values' => [ 'background_color' => '#16171b', 'text_color' => '#f2f2f3', 'accept_button_bg' => '#34363d', 'accept_text_color' => '#f2f2f3', 'border_radius' => '8' ] ],
        ];
    }

    /**
     * A Cookie Rocket Pro option, shown in the free edition as a picture of what it does, with a
     * lock: it opens the Cookie Rocket Pro page and applies nothing. The free edition carries no
     * setting and no code of the option (WordPress.org guideline 5); Pro fills the same place with
     * the real control.
     *
     * @param string $feature What the Pro page shows first (?feature=).
     * @param string $title   The option.
     * @param string $desc    What it gives, or empty.
     * @param string $pics    The picture, from sample_tile() or fixed markup.
     */
    private static function pro_sample( string $feature, string $title, string $desc, string $pics ): void {
        echo '<a class="cr-pro-sample" href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=' . $feature ) . '" target="_blank" rel="noopener">';
        echo '<span class="cr-pro-sample__head"><span class="cr-pro-sample__title">' . esc_html( $title ) . '</span><span class="cr-theme-pro">PRO</span></span>';
        if ( '' !== $desc ) {
            echo '<span class="cr-pro-sample__desc">' . esc_html( $desc ) . '</span>';
        }
        // Two, three or a single row of drawings; four go two by two.
        $n = substr_count( $pics, 'class="cr-pro-sample__tile' );
        echo '<span class="cr-pro-sample__pics" style="--cr-sample-cols:' . ( 4 === $n ? 2 : max( 1, min( 3, $n ) ) ) . '" aria-hidden="true">' . $pics . '</span>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- sample_tile() escapes every part; the rest is fixed markup.
        echo '<span class="cr-theme-lock" aria-hidden="true"><span class="dashicons dashicons-lock"></span></span>';
        echo '</a>';
    }

    /**
     * One drawing of a Pro sample: a shape painted with fixed values, and its name.
     *
     * @param string $name  Name under the shape.
     * @param string $style Inline style of the shape.
     * @param string $class Extra classes of the shape.
     * @param string $text  Text drawn inside the shape.
     * @return string Escaped markup.
     */
    private static function sample_tile( string $name, string $style = '', string $class = '', string $text = '' ): string {
        $shape = '<span class="' . esc_attr( trim( 'cr-pro-sample__shape ' . $class ) ) . '"' . ( '' !== $style ? ' style="' . esc_attr( $style ) . '"' : '' ) . '>' . esc_html( $text ) . '</span>';
        return '<span class="cr-pro-sample__tile">' . $shape . '<span class="cr-pro-sample__name">' . esc_html( $name ) . '</span></span>';
    }

    
    public function render_design(): void {
        $d      = get_option( 'cookroco_banner_design', [] );
        $active = isset( $d['theme'] ) ? (string) $d['theme'] : '';

        $s_now   = (array) get_option( 'cookroco_settings', [] );
        $variant = sanitize_key( is_array( $s_now ) ? ( $s_now['banner_variant'] ?? 'bottom_bar' ) : 'bottom_bar' );
        $pos     = sanitize_key( is_array( $s_now ) ? ( $s_now['banner_position'] ?? 'right' ) : 'right' );
        $layouts = [ 'bottom_bar' => __( 'Bottom bar', 'cookie-rocket' ), 'top_bar' => __( 'Top bar', 'cookie-rocket' ), 'modal' => __( 'Center popup', 'cookie-rocket' ), 'floating' => __( 'Floating box', 'cookie-rocket' ), 'drawer' => __( 'Side panel', 'cookie-rocket' ) ];

        $tab_icon = static fn( string $d ): string => '<svg class="cr-ico" viewBox="0 0 24 24" aria-hidden="true" focusable="false">' . $d . '</svg>';

        // Elementor's editor: the controls in a panel on the left, the live page on the right.
        echo '<div class="wrap cr-wrap cr-editor"><div class="cr-editor__app"><div class="cr-editor__panel">';
        echo '<h1 class="cr-editor__title">' . esc_html__( 'Cookie Banner', 'cookie-rocket' ) . '</h1>';
        echo '<nav class="cr-subnav" aria-label="' . esc_attr__( 'Banner sections', 'cookie-rocket' ) . '">';
        echo '<button type="button" class="cr-subnav__item is-active" data-panel="layout">' . $tab_icon( '<rect x="3" y="4" width="18" height="16" rx="2"/><path d="M3 15h18"/>' ) . '<span>' . esc_html__( 'Layout', 'cookie-rocket' ) . '</span></button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG.
        echo '<button type="button" class="cr-subnav__item" data-panel="content">' . $tab_icon( '<path d="M4 7V5h16v2M9 19h6M12 5v14"/>' ) . '<span>' . esc_html__( 'Content', 'cookie-rocket' ) . '</span></button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG.
        echo '<button type="button" class="cr-subnav__item" data-panel="style">' . $tab_icon( '<circle cx="12" cy="12" r="9"/><path d="M12 3v18M12 3a9 9 0 0 1 0 18"/>' ) . '<span>' . esc_html__( 'Style & colors', 'cookie-rocket' ) . '</span></button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG.
        echo '</nav>';

        echo '<div class="cr-editor__main">';

        // ─── Panel: Layout ───
        echo '<div class="cr-panel is-active" data-panel="layout"><div class="cr-card">';
        echo '<div class="cr-card__head"><h2>' . esc_html__( 'Where & how the banner appears', 'cookie-rocket' ) . '</h2></div>';
        echo '<div class="cr-layout-grid">';
        foreach ( $layouts as $key => $label ) {
            $sel = ( $key === $variant ) ? ' is-selected' : '';
            echo '<div class="cr-layout-card cr-lay-' . esc_attr( $key ) . esc_attr( $sel ) . '" role="button" tabindex="0" data-variant="' . esc_attr( $key ) . '">';
            echo '<div class="cr-layout-diagram"><span class="cr-layout-bar"></span></div>';
            echo '<div class="cr-layout-name">' . esc_html( $label ) . '</div>';
            echo '</div>';
        }
        echo '</div>';
        // Right under the cards it describes, not below the backdrop options.
        echo '<p class="cr-subnote">' . esc_html__( 'Click a layout to apply it instantly — all layouts are free.', 'cookie-rocket' ) . '</p>';
        echo '<div class="cr-layout-pos" id="cr-layout-pos"' . ( in_array( $variant, [ 'floating', 'drawer' ], true ) ? '' : ' style="display:none"' ) . '>';
        echo '<span class="cr-layout-pos__label">' . esc_html__( 'Position', 'cookie-rocket' ) . '</span>';
        foreach ( [ 'left' => __( 'Left', 'cookie-rocket' ), 'right' => __( 'Right', 'cookie-rocket' ) ] as $pk => $pl ) {
            echo '<button type="button" class="cr-pos-btn' . ( $pk === $pos ? ' is-selected' : '' ) . '" data-pos="' . esc_attr( $pk ) . '">' . esc_html( $pl ) . '</button>';
        }
        echo '</div>';
        // Bar width (only for bottom/top bars): contained card or full-width edge-to-edge.
        $bar_w  = sanitize_key( $s_now['bar_width'] ?? 'contained' );
        $is_bar = in_array( $variant, [ 'bottom_bar', 'top_bar' ], true );
        echo '<div class="cr-layout-pos" id="cr-layout-barw"' . ( $is_bar ? '' : ' style="display:none"' ) . '>';
        echo '<span class="cr-layout-pos__label">' . esc_html__( 'Bar width', 'cookie-rocket' ) . '</span>';
        foreach ( [ 'contained' => __( 'Contained', 'cookie-rocket' ), 'full' => __( 'Full width', 'cookie-rocket' ) ] as $bk => $bl ) {
            echo '<button type="button" class="cr-pos-btn cr-barw-btn' . ( $bk === $bar_w ? ' is-selected' : '' ) . '" data-barw="' . esc_attr( $bk ) . '">' . esc_html( $bl ) . '</button>';
        }
        echo '</div>';
        echo '<div class="cr-layout-bd"><label class="cr-check"><input type="checkbox" id="cr-bd-toggle" ' . checked( ! empty( $s_now['show_backdrop'] ), true, false ) . '> ' . esc_html__( 'Dim the page behind the banner (backdrop)', 'cookie-rocket' ) . '</label></div>';
        // Blurring the page behind the banner is a Pro refinement of the backdrop. The free plugin
        // carries none of its code and no disabled control: a picture shows what it does, and Pro
        // fills this slot with the real setting.
        if ( has_action( 'cookroco_layout_pro_slot' ) ) {
            do_action( 'cookroco_layout_pro_slot', $s_now );
        } else {
            self::pro_sample( 'blur', __( 'Blur the page behind the banner', 'cookie-rocket' ), __( 'Frosts the page instead of only darkening it.', 'cookie-rocket' ), '<span class="cr-pro-sample__tile is-wide"><span class="cr-pro-sample__shape is-blur"><i></i><i></i><i></i><i></i><b></b></span></span>' );
        }

        echo '</div></div>';

        // ─── Panel: Content (banner text — merge-safe AJAX save) ───
        echo '<div class="cr-panel" data-panel="content" hidden><div class="cr-card">';
        echo '<div class="cr-card__head"><h2>' . esc_html__( 'Banner text', 'cookie-rocket' ) . '</h2></div>';
        echo '<div class="cr-content-form">';
        // Per-region consent-text templates (fill the title + message; the user then edits).
        $tpls = self::law_templates();
        echo '<div class="cr-field"><label for="cr-c-tpl">' . esc_html__( 'Consent text template', 'cookie-rocket' ) . '</label>';
        echo '<select id="cr-c-tpl"><option value="">' . esc_html__( 'Choose a starting template…', 'cookie-rocket' ) . '</option>';
        foreach ( $tpls as $tk => $tv ) {
            echo '<option value="' . esc_attr( $tk ) . '" data-title="' . esc_attr( $tv[1] ) . '" data-body="' . esc_attr( $tv[2] ) . '">' . esc_html( $tv[0] ) . '</option>';
        }
        echo '</select><p class="description">' . esc_html__( 'Fills the title and message with a preset for your region — then edit as you like.', 'cookie-rocket' ) . '</p></div>';
        echo '<div class="cr-field"><label for="cr-c-title">' . esc_html__( 'Title', 'cookie-rocket' ) . '</label>';
        echo '<input type="text" id="cr-c-title" name="banner_title" maxlength="80" value="' . esc_attr( $s_now['banner_title'] ?? '' ) . '" placeholder="' . esc_attr__( 'We use cookies', 'cookie-rocket' ) . '"></div>';
        echo '<div class="cr-field"><label for="cr-c-body">' . esc_html__( 'Message', 'cookie-rocket' ) . '</label>';
        echo '<textarea id="cr-c-body" name="banner_body" rows="3" maxlength="1000" placeholder="' . esc_attr__( 'We use cookies to improve your experience, analyze traffic and personalize content.', 'cookie-rocket' ) . '">' . esc_textarea( $s_now['banner_body'] ?? '' ) . '</textarea></div>';
        echo '<div class="cr-field-row">';
        echo '<div class="cr-field cr-field--grow"><label for="cr-c-accept">' . esc_html__( 'Accept button', 'cookie-rocket' ) . '</label><input type="text" id="cr-c-accept" name="btn_accept_text" maxlength="32" value="' . esc_attr( $s_now['btn_accept_text'] ?? '' ) . '" placeholder="' . esc_attr__( 'Accept all', 'cookie-rocket' ) . '"></div>';
        echo '<div class="cr-field cr-field--grow"><label for="cr-c-reject">' . esc_html__( 'Reject button', 'cookie-rocket' ) . '</label><input type="text" id="cr-c-reject" name="btn_reject_text" maxlength="32" value="' . esc_attr( $s_now['btn_reject_text'] ?? '' ) . '" placeholder="' . esc_attr__( 'Reject', 'cookie-rocket' ) . '"></div>';
        echo '<div class="cr-field cr-field--grow"><label for="cr-c-config">' . esc_html__( 'Customize button', 'cookie-rocket' ) . '</label><input type="text" id="cr-c-config" name="btn_config_text" maxlength="32" value="' . esc_attr( $s_now['btn_config_text'] ?? '' ) . '" placeholder="' . esc_attr__( 'Customize', 'cookie-rocket' ) . '"></div>';
        echo '</div>';
        echo '<div class="cr-field"><label class="cr-check"><input type="checkbox" id="cr-c-showreject" name="show_reject_button" value="1" ' . checked( array_key_exists( 'show_reject_button', $s_now ) ? ! empty( $s_now['show_reject_button'] ) : true, true, false ) . '> ' . esc_html__( 'Show the “Reject all” button on the banner', 'cookie-rocket' ) . '</label></div>';
        $show_cfg = array_key_exists( 'show_config_button', $s_now ) ? ! empty( $s_now['show_config_button'] ) : true;
        echo '<div class="cr-field"><label class="cr-check"><input type="checkbox" id="cr-c-showconfig" name="show_config_button" value="1" ' . checked( $show_cfg, true, false ) . '> ' . esc_html__( 'Show the “Customize” button on the banner', 'cookie-rocket' ) . '</label></div>';
        echo '<div class="cr-content-sub">' . esc_html__( 'Preferences modal', 'cookie-rocket' ) . '</div>';
        echo '<div class="cr-field"><label for="cr-c-mtitle">' . esc_html__( 'Modal title', 'cookie-rocket' ) . '</label>';
        echo '<input type="text" id="cr-c-mtitle" name="modal_title" maxlength="80" value="' . esc_attr( $s_now['modal_title'] ?? '' ) . '" placeholder="' . esc_attr__( 'Cookie preferences', 'cookie-rocket' ) . '"></div>';
        echo '<div class="cr-field"><label for="cr-c-mdesc">' . esc_html__( 'Modal description', 'cookie-rocket' ) . '</label>';
        echo '<textarea id="cr-c-mdesc" name="modal_desc" rows="2" maxlength="1000" placeholder="' . esc_attr__( 'Choose which cookies you allow. Strictly necessary ones are always active.', 'cookie-rocket' ) . '">' . esc_textarea( $s_now['modal_desc'] ?? '' ) . '</textarea></div>';
        echo '<div class="cr-field-row">';
        echo '<div class="cr-field cr-field--num"><label for="cr-c-tsize">' . esc_html__( 'Title size', 'cookie-rocket' ) . '</label><input type="number" id="cr-c-tsize" name="title_size" min="14" max="22" value="' . esc_attr( (string) ( $s_now['title_size'] ?? 18 ) ) . '"></div>';
        echo '<div class="cr-field cr-field--num"><label for="cr-c-bsize">' . esc_html__( 'Text size', 'cookie-rocket' ) . '</label><input type="number" id="cr-c-bsize" name="body_size" min="11" max="15" value="' . esc_attr( (string) ( $s_now['body_size'] ?? 12 ) ) . '"></div>';
        echo '</div>';
        // ─── Typography: the font, then (Pro) weight, italic, underline and capitals. The font is
        // the host site's, a neutral system stack or (Pro) one hosted on this site. Never a webfont
        // from a CDN: loading Google Fonts live sends each visitor's IP to Google, which is itself
        // a GDPR violation. ───
        $bfont    = sanitize_key( $s_now['banner_font'] ?? 'system' );
        $bfamily  = (string) ( $s_now['banner_font_family'] ?? '' );
        $font_pro = has_action( 'cookroco_font_pro_slot' );
        echo '<div class="cr-typo"><h3 class="cr-typo__title">' . esc_html__( 'Typography', 'cookie-rocket' ) . '</h3>';
        echo '<div class="cr-field"><label for="cr-banner-font">' . esc_html__( 'Banner font', 'cookie-rocket' ) . '</label>';
        echo '<select id="cr-banner-font" data-cr-content="banner_font">';
        foreach ( self::font_choices() as $fval => $flabel ) {
            echo '<option value="' . esc_attr( $fval ) . '" ' . selected( $bfont, $fval, false ) . '>' . esc_html( $flabel ) . '</option>';
        }
        echo '</select>';
        /**
         * Fires right after the banner font select, for an add-on that offers more choices
         * (Cookie Rocket Pro: the family of a self-hosted font).
         *
         * @param string $bfont   Chosen font mode.
         * @param string $bfamily Stored font family.
         */
        do_action( 'cookroco_font_field_after', $bfont, $bfamily );
        echo '<p class="cr-subnote">' . esc_html__( 'Match my site reuses your theme font — native look, zero extra load, no external fonts. Cookie Rocket never loads a font from an external CDN, so it never sends your visitors\' IP to a third party.', 'cookie-rocket' ) . '</p></div>';
        if ( $font_pro ) {
            do_action( 'cookroco_font_pro_slot', $s_now );
        }
        if ( ! $font_pro ) {
            self::pro_sample(
                'fonts',
                __( 'Google Fonts and your own font files, hosted on your site', 'cookie-rocket' ),
                '',
                self::sample_tile( __( 'Google Fonts', 'cookie-rocket' ), 'font-family:Georgia,"Times New Roman",serif', 'is-type', 'Aa' )
                . self::sample_tile( __( 'Your own font', 'cookie-rocket' ), '', 'is-type dashicons-before dashicons-upload' )
            );
        }
        // Bold, italic, underline and capitals for the title, the text and the buttons: Pro.
        if ( has_action( 'cookroco_typography_pro_slot' ) ) {
            do_action( 'cookroco_typography_pro_slot', $s_now, $d );
        } else {
            self::pro_sample(
                'typography',
                __( 'Bold, italic, underline and capitals for the title, the text and the buttons', 'cookie-rocket' ),
                '',
                self::sample_tile( __( 'Bold', 'cookie-rocket' ), 'font-weight:700', 'is-type', 'Aa' )
                . self::sample_tile( __( 'Italic', 'cookie-rocket' ), 'font-style:italic;font-family:Georgia,serif', 'is-type', 'Aa' )
                . self::sample_tile( __( 'Underline', 'cookie-rocket' ), 'text-decoration:underline', 'is-type', 'Aa' )
                . self::sample_tile( __( 'Capitals', 'cookie-rocket' ), 'letter-spacing:.04em', 'is-type', 'AA' )
            );
        }
        echo '</div>';
        echo '<p class="cr-content-actions"><button type="button" class="button button-primary" id="cr-save-content">' . esc_html__( 'Save text', 'cookie-rocket' ) . '</button> <span class="cr-content-saved" hidden><span class="dashicons dashicons-yes"></span>' . esc_html__( 'Saved', 'cookie-rocket' ) . '</span></p>';
        echo '</div>';
        echo '<p class="cr-subnote">' . esc_html__( 'Leave a field empty to use the default text for your compliance framework, in your site\'s language.', 'cookie-rocket' ) . '</p>';
        echo '</div></div>';

        // ─── Panel: Style & colors (accordions) ───
        echo '<div class="cr-panel" data-panel="style" hidden>';

        // Accordion: style presets.
        echo '<div class="cr-acc is-open"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Style presets', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body">';
        // What a preset is, before the choice: the look changes, the content and layout stay.
        echo '<p class="cr-subnote cr-theme-intro">' . ( apply_filters( 'cookroco_pro_active', false ) ? esc_html__( 'Neutral starting points that fit any site — pick one, then make it match your brand with the colors below. Nothing forces a look on your site.', 'cookie-rocket' ) : esc_html__( 'Neutral starting points that fit any site — pick one, then make it match your brand with the colors below. Nothing forces a look on your site.', 'cookie-rocket' ) ) . '</p>';
        echo '<div class="cr-theme-grid">';
        // What can be applied first; the Pro styles last, as pictures that lead to Cookie Rocket Pro.
        // Two passes keep each group's order.
        $themes = self::banner_themes();
        if ( ! apply_filters( 'cookroco_pro_active', false ) ) {
            $themes += self::pro_style_previews();
        }
        $themes = array_merge( array_filter( $themes, static fn( $t ) => empty( $t['pro'] ) ), array_filter( $themes, static fn( $t ) => ! empty( $t['pro'] ) ) );
        foreach ( $themes as $key => $t ) {
            $v   = $t['values'];
            $bg  = $v['background_color'] ?? '#ffffff';
            $tx  = $v['text_color'] ?? '#111827';
            $ab  = $v['accept_button_bg'] ?? '#111827';
            $abt = $v['accept_text_color'] ?? '#ffffff';
            $pro = ! empty( $t['pro'] );
            $sel = ( '' !== $active && $key === $active );
            $cls = 'cr-theme-card' . ( $pro ? ' is-pro' : '' ) . ( $sel ? ' is-selected' : '' ) . ( in_array( $key, [ 'frosted', 'frosted_dark' ], true ) ? ' is-frosted' : '' );
            $rad = min( 8, absint( $v['border_radius'] ?? 0 ) );
            $did = 'cr-theme-desc-' . $key;
            // A Pro style is only its picture here: it opens Cookie Rocket Pro and carries nothing to apply.
            echo '<div class="' . esc_attr( $cls ) . '" role="' . ( $pro ? 'link' : 'button' ) . '" tabindex="0" aria-describedby="' . esc_attr( $did ) . '" data-pro="' . ( $pro ? '1' : '0' ) . '" data-theme="' . esc_attr( $key ) . '"' . ( $pro ? '' : ' data-values="' . esc_attr( (string) wp_json_encode( $v ) ) . '"' ) . ' data-pro-url="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=theme-' . $key ) . '">';
            echo '<div class="cr-theme-card__meta"><div class="cr-theme-card__name">' . esc_html( $t['name'] );
            if ( $pro ) {
                echo ' <span class="cr-theme-pro">PRO</span>';
            } elseif ( $sel ) {
                echo ' <span class="cr-theme-active">' . esc_html__( 'Active', 'cookie-rocket' ) . '</span>';
            }
            echo '</div><p class="cr-theme-card__desc" id="' . esc_attr( $did ) . '">' . esc_html( $t['desc'] ?? '' ) . '</p></div>';
            // The banner as visitors see it, on a page, with its real text and its three buttons.
            echo '<div class="cr-theme-stage" aria-hidden="true"><span class="cr-theme-page"><i></i><i></i><i></i><i></i></span>';
            echo '<div class="cr-theme-mini" style="--bg:' . esc_attr( $bg ) . ';--tx:' . esc_attr( $tx ) . ';--ab:' . esc_attr( $ab ) . ';--abt:' . esc_attr( $abt ) . ';--rad:' . esc_attr( (string) $rad ) . 'px">';
            echo '<span class="cr-theme-mini__txt"><span class="cr-theme-mini__t">' . esc_html__( 'We value your privacy', 'cookie-rocket' ) . '</span><span class="cr-theme-mini__p">' . esc_html__( 'We use first- and third-party cookies to improve your browsing experience and analyze traffic. You can accept all, reject them, or customize your choice.', 'cookie-rocket' ) . '</span></span>';
            echo '<span class="cr-theme-mini__btns"><span class="is-config">' . esc_html__( 'Customize', 'cookie-rocket' ) . '</span><span>' . esc_html__( 'Reject All', 'cookie-rocket' ) . '</span><span>' . esc_html__( 'Accept All', 'cookie-rocket' ) . '</span></span>';
            echo '</div>';
            if ( $pro ) {
                echo '<span class="cr-theme-lock"><span class="dashicons dashicons-lock"></span></span>';
            }
            echo '</div></div>';
        }
        echo '</div>';
        echo '</div></div>';

        // The color + advanced fields live in one form (saves to cookroco_banner_design).
        echo '<form method="post" action="options.php" id="cr-design-form">';
        settings_fields( 'cookroco_design_group' );
        echo '<input type="hidden" name="cookroco_banner_design[theme]" id="cr-design-theme" value="' . esc_attr( $active ) . '">';
        // Hidden fields so one-click presets can also set dark_mode + primary_color (they have no visible control) and they serialize into the AJAX save.
        echo '<input type="hidden" name="cookroco_banner_design[dark_mode]" value="' . esc_attr( $d['dark_mode'] ?? 'auto' ) . '">';
        echo '<input type="hidden" name="cookroco_banner_design[primary_color]" value="' . esc_attr( $d['primary_color'] ?? '#111827' ) . '">';

        // Accordion: colors — three groups, one per thing they paint, each with its live contrast.
        echo '<div class="cr-acc is-open"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Colors', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body cr-colors">';
        $color_field = static function ( string $key, string $label, string $desc, string $default ) use ( $d ): void {
            $value = sanitize_hex_color( (string) ( $d[ $key ] ?? '' ) ) ?: $default;
            $id    = 'cr-color-' . str_replace( '_', '-', $key );
            echo '<div class="cr-cfield"><label for="' . esc_attr( $id ) . '">' . esc_html( $label ) . '</label>';
            echo '<div class="cr-cfield__ctl"><input type="color" id="' . esc_attr( $id ) . '" name="' . esc_attr( 'cookroco_banner_design[' . $key . ']' ) . '" value="' . esc_attr( $value ) . '" aria-describedby="' . esc_attr( $id . '-desc' ) . '">';
            /* translators: %s: the name of a color field, such as "Background". */
            echo '<input type="text" class="cr-hex" value="' . esc_attr( $value ) . '" maxlength="7" spellcheck="false" autocomplete="off" aria-label="' . esc_attr( sprintf( __( '%s, hex code', 'cookie-rocket' ), $label ) ) . '"></div>';
            echo '<p class="cr-cfield__desc" id="' . esc_attr( $id . '-desc' ) . '">' . esc_html( $desc ) . '</p></div>';
        };
        // Live contrast of each pair, filled in by the script; a pair below its minimum shows a Fix.
        $contrast_line = static function ( array $pairs ): void {
            echo '<p class="cr-cgroup__contrast" aria-live="polite">';
            foreach ( $pairs as [ $fg, $bg, $min, $label ] ) {
                echo '<span class="cr-ratio" data-fg="' . esc_attr( $fg ) . '" data-bg="' . esc_attr( $bg ) . '" data-min="' . esc_attr( $min ) . '" data-label="' . esc_attr( $label ) . '"></span>';
            }
            echo '</p>';
        };

        echo '<div class="cr-cgroup"><h3 class="cr-cgroup__title">' . esc_html__( 'Banner', 'cookie-rocket' ) . '</h3>';
        echo '<p class="cr-cgroup__desc">' . esc_html__( 'The surface and its words: the title, the message and the policy link.', 'cookie-rocket' ) . '</p>';
        echo '<div class="cr-cfields">';
        $color_field( 'background_color', __( 'Background', 'cookie-rocket' ), __( 'Behind the whole banner.', 'cookie-rocket' ), '#ffffff' );
        $color_field( 'text_color', __( 'Text', 'cookie-rocket' ), __( 'The title and the message. The message uses a softer shade of it.', 'cookie-rocket' ), '#1a1a1a' );
        echo '</div>';
        /* translators: %s: a contrast ratio such as 17.4 */
        $contrast_line( [ [ 'text_color', 'background_color', '4.5', __( 'Text %s:1', 'cookie-rocket' ) ] ] );
        echo '</div>';

        echo '<div class="cr-cgroup"><h3 class="cr-cgroup__title">' . esc_html__( 'Accept and Reject', 'cookie-rocket' ) . '</h3>';
        echo '<p class="cr-cgroup__desc">' . esc_html__( 'Both buttons share these colors, so refusing looks as easy as accepting, as EU rules ask.', 'cookie-rocket' ) . '</p>';
        echo '<div class="cr-cfields">';
        $color_field( 'accept_button_bg', __( 'Fill', 'cookie-rocket' ), __( 'The color of both buttons.', 'cookie-rocket' ), '#111827' );
        $color_field( 'accept_text_color', __( 'Label', 'cookie-rocket' ), __( 'The text on both buttons.', 'cookie-rocket' ), '#ffffff' );
        echo '</div>';
        /* translators: %s: a contrast ratio such as 17.4 */
        $contrast_line( [ [ 'accept_text_color', 'accept_button_bg', '4.5', __( 'Label %s:1', 'cookie-rocket' ) ] ] );
        echo '</div>';

        $sec_style = in_array( $d['secondary_btn_style'] ?? 'outline', [ 'outline', 'solid' ], true ) ? ( $d['secondary_btn_style'] ?? 'outline' ) : 'outline';
        echo '<div class="cr-cgroup"><h3 class="cr-cgroup__title">' . esc_html__( 'Customize', 'cookie-rocket' ) . '</h3>';
        echo '<p class="cr-cgroup__desc">' . esc_html__( 'The third button, which opens the detailed choices. Outline keeps it quieter than Accept and Reject.', 'cookie-rocket' ) . '</p>';
        echo '<div class="cr-cfields"><div class="cr-cfield"><label for="cr-sec-style">' . esc_html__( 'Style', 'cookie-rocket' ) . '</label><div class="cr-cfield__ctl"><select id="cr-sec-style" name="cookroco_banner_design[secondary_btn_style]"><option value="outline" ' . selected( $sec_style, 'outline', false ) . '>' . esc_html__( 'Outline (recommended)', 'cookie-rocket' ) . '</option><option value="solid" ' . selected( $sec_style, 'solid', false ) . '>' . esc_html__( 'Solid', 'cookie-rocket' ) . '</option></select></div></div></div>';
        echo '<div class="cr-cfields cr-sec-color-row">';
        $color_field( 'secondary_btn_bg', __( 'Fill', 'cookie-rocket' ), __( 'The color of the Customize button.', 'cookie-rocket' ), '#6b7280' );
        $color_field( 'secondary_btn_text', __( 'Label', 'cookie-rocket' ), __( 'The text on the Customize button.', 'cookie-rocket' ), '#ffffff' );
        echo '</div>';
        echo '<div class="cr-sec-color-row">';
        /* translators: %s: a contrast ratio such as 17.4 */
        $contrast_line( [ [ 'secondary_btn_text', 'secondary_btn_bg', '4.5', __( 'Label %s:1', 'cookie-rocket' ) ] ] );
        echo '</div></div>';

        // The contrast strings the script needs, translated once.
        /* translators: %s: the minimum contrast ratio, such as 4.5 */
        echo '<div id="cr-contrast" hidden data-needs="' . esc_attr__( 'needs %s:1', 'cookie-rocket' ) . '" data-fix="' . esc_attr__( 'Fix it', 'cookie-rocket' ) . '"></div>';
        echo '</div></div>';

        // Accordion: corners — the one shape setting, shown as the shapes themselves.
        $rad_now = preg_replace( '/^(\d{1,3})$/', '${1}px', trim( (string) ( $d['border_radius'] ?? '0px' ) ) );
        $rad_now = '' === $rad_now ? '0px' : $rad_now;
        $corners = [
            '0px'  => __( 'Square', 'cookie-rocket' ),
            '4px'  => __( 'Subtle', 'cookie-rocket' ),
            '8px'  => __( 'Soft', 'cookie-rocket' ),
            '12px' => __( 'Rounded', 'cookie-rocket' ),
        ];
        if ( ! isset( $corners[ $rad_now ] ) && ! has_action( 'cookroco_corners_pro_slot' ) ) {
            $corners[ $rad_now ] = __( 'Current', 'cookie-rocket' ); // A value saved before these choices existed is kept (Pro shows it in its custom radius).
        }
        echo '<div class="cr-acc is-open"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Corners', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body cr-shape">';
        echo '<fieldset class="cr-cgroup cr-corners"><legend class="screen-reader-text">' . esc_html__( 'Corners', 'cookie-rocket' ) . '</legend>';
        echo '<p class="cr-cgroup__desc">' . esc_html__( 'The corners of the banner and of all its buttons.', 'cookie-rocket' ) . '</p>';
        // The saved value lives in one field, so the preview, saving and style presets use it as before.
        echo '<input type="hidden" id="cr-radius" name="cookroco_banner_design[border_radius]" value="' . esc_attr( $rad_now ) . '">';
        echo '<div class="cr-corners__list">';
        foreach ( $corners as $value => $name ) {
            $cid = 'cr-radius-' . sanitize_key( $value );
            echo '<label class="cr-corner" for="' . esc_attr( $cid ) . '"><input type="radio" id="' . esc_attr( $cid ) . '" name="cr-radius-choice" value="' . esc_attr( $value ) . '" ' . checked( $rad_now, $value, false ) . '>';
            echo '<span class="cr-corner__shape" style="border-radius:' . esc_attr( $value ) . '" aria-hidden="true"></span>';
            echo '<span class="cr-corner__name">' . esc_html( $name ) . '</span><span class="cr-corner__value">' . esc_html( str_replace( 'px', ' px', $value ) ) . '</span></label>';
        }
        echo '</div>';
        // A radius of the owner's own choosing: Pro.
        if ( has_action( 'cookroco_corners_pro_slot' ) ) {
            do_action( 'cookroco_corners_pro_slot', $rad_now, $corners );
        } else {
            $radii = '';
            foreach ( [ 6, 14, 20 ] as $px ) {
                /* translators: %d: a size in pixels. */
                $radii .= self::sample_tile( sprintf( __( '%d px', 'cookie-rocket' ), $px ), 'border-radius:' . $px . 'px', 'is-radius' );
            }
            self::pro_sample( 'radius', __( 'Custom radius', 'cookie-rocket' ), __( 'Any radius from 0 to 40 px.', 'cookie-rocket' ), $radii );
        }
        echo '</fieldset>';
        echo '</div></div>';

        // Accordion: border — on or off here; its color and thickness come with Pro.
        $border_now = 'off' === ( $d['banner_border'] ?? 'on' ) ? 'off' : 'on';
        echo '<div class="cr-acc is-open"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Border', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body cr-shape">';
        echo '<fieldset class="cr-cgroup cr-corners cr-border"><legend class="screen-reader-text">' . esc_html__( 'Border', 'cookie-rocket' ) . '</legend>';
        echo '<p class="cr-cgroup__desc">' . esc_html__( 'A line around the banner.', 'cookie-rocket' ) . '</p>';
        echo '<input type="hidden" id="cr-border" name="cookroco_banner_design[banner_border]" value="' . esc_attr( $border_now ) . '" data-cr-choices="cr-border-choice">';
        echo '<div class="cr-corners__list">';
        foreach ( [ 'on' => __( 'With border', 'cookie-rocket' ), 'off' => __( 'No border', 'cookie-rocket' ) ] as $value => $name ) {
            echo '<label class="cr-corner" for="' . esc_attr( 'cr-border-' . $value ) . '"><input type="radio" id="' . esc_attr( 'cr-border-' . $value ) . '" name="cr-border-choice" value="' . esc_attr( $value ) . '" ' . checked( $border_now, $value, false ) . '>';
            echo '<span class="cr-corner__shape' . ( 'off' === $value ? ' is-borderless' : '' ) . '" aria-hidden="true"></span>';
            echo '<span class="cr-corner__name">' . esc_html( $name ) . '</span></label>';
        }
        echo '</div>';
        // Color and thickness are a Pro refinement: the free plugin carries none of their code, only
        // a picture of them; Pro fills the slot with the real controls.
        if ( has_action( 'cookroco_border_pro_slot' ) ) {
            do_action( 'cookroco_border_pro_slot', $d );
        } else {
            self::pro_sample(
                'border',
                __( 'Border color and thickness', 'cookie-rocket' ),
                '',
                self::sample_tile( __( 'Thin, 1 px', 'cookie-rocket' ), 'border:1px solid #2563eb' )
                . self::sample_tile( __( 'Medium, 2 px', 'cookie-rocket' ), 'border:2px solid #2563eb' )
                . self::sample_tile( __( 'Thick, 3 px', 'cookie-rocket' ), 'border:3px solid #2563eb' )
            );
        }
        echo '</fieldset>';
        echo '</div></div>';

        // Accordion: shadow — on or off here; its intensity comes with Pro.
        $shadow_now = 'on' === ( $d['banner_shadow'] ?? 'off' ) ? 'on' : 'off';
        echo '<div class="cr-acc is-open"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Shadow', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body cr-shape">';
        echo '<fieldset class="cr-cgroup cr-corners cr-shadow"><legend class="screen-reader-text">' . esc_html__( 'Shadow', 'cookie-rocket' ) . '</legend>';
        echo '<p class="cr-cgroup__desc">' . esc_html__( 'A soft shadow that lifts the banner off the page.', 'cookie-rocket' ) . '</p>';
        echo '<input type="hidden" id="cr-shadow" name="cookroco_banner_design[banner_shadow]" value="' . esc_attr( $shadow_now ) . '" data-cr-choices="cr-shadow-choice">';
        echo '<div class="cr-corners__list">';
        foreach ( [ 'off' => __( 'No shadow', 'cookie-rocket' ), 'on' => __( 'With shadow', 'cookie-rocket' ) ] as $value => $name ) {
            echo '<label class="cr-corner" for="' . esc_attr( 'cr-shadow-' . $value ) . '"><input type="radio" id="' . esc_attr( 'cr-shadow-' . $value ) . '" name="cr-shadow-choice" value="' . esc_attr( $value ) . '" ' . checked( $shadow_now, $value, false ) . '>';
            echo '<span class="cr-corner__shape' . ( 'on' === $value ? ' is-shadowed' : '' ) . '" aria-hidden="true"></span>';
            echo '<span class="cr-corner__name">' . esc_html( $name ) . '</span></label>';
        }
        echo '</div>';
        if ( has_action( 'cookroco_shadow_pro_slot' ) ) {
            do_action( 'cookroco_shadow_pro_slot', $d );
        } else {
            self::pro_sample(
                'shadow',
                __( 'Shadow intensity', 'cookie-rocket' ),
                '',
                self::sample_tile( __( 'Soft', 'cookie-rocket' ), 'box-shadow:0 4px 4px rgba(0,0,0,.16)', 'is-shadow' )
                . self::sample_tile( _x( 'Medium', 'shadow intensity', 'cookie-rocket' ), 'box-shadow:0 6px 14px rgba(0,0,0,.2)', 'is-shadow' )
                . self::sample_tile( __( 'Strong', 'cookie-rocket' ), 'box-shadow:0 10px 24px rgba(0,0,0,.3)', 'is-shadow' )
            );
        }
        echo '</fieldset>';
        echo '</div></div>';

        // Accordions: button text and inner spacing — refinements Cookie Rocket Pro fills in.
        $pro_section = static function ( string $key, string $title, string $desc, string $sample, string $pics, callable $slot ): void {
            echo '<div class="cr-acc is-open"><button type="button" class="cr-acc__head"><span>' . esc_html( $title ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body cr-shape">';
            echo '<div class="cr-cgroup ' . esc_attr( 'cr-' . $key ) . '"><p class="cr-cgroup__desc">' . esc_html( $desc ) . '</p>';
            if ( ! $slot() ) {
                self::pro_sample( $key, $sample, '', $pics );
            }
            echo '</div></div></div>';
        };
        $button_rows = '';
        foreach ( [ 12 => __( 'Regular', 'cookie-rocket' ), 14 => __( 'Semibold', 'cookie-rocket' ), 16 => __( 'Bold', 'cookie-rocket' ) ] as $px => $weight ) {
            /* translators: %d: a size in pixels. */
            $button_rows .= self::sample_tile( sprintf( __( '%d px', 'cookie-rocket' ), $px ) . ' · ' . $weight, 'font-size:' . $px . 'px;font-weight:' . [ 12 => 400, 14 => 600, 16 => 700 ][ $px ], 'is-button', __( 'Accept All', 'cookie-rocket' ) );
        }
        $pro_section(
            'buttons',
            __( 'Button text', 'cookie-rocket' ),
            __( 'The size and weight of the words on every button. Accept and Reject always share them.', 'cookie-rocket' ),
            __( 'Button text size and weight', 'cookie-rocket' ),
            $button_rows,
            static function () use ( $d ): bool {
                if ( ! has_action( 'cookroco_buttons_pro_slot' ) ) {
                    return false;
                }
                do_action( 'cookroco_buttons_pro_slot', $d );
                return true;
            }
        );
        $pro_section(
            'spacing',
            __( 'Inner spacing', 'cookie-rocket' ),
            __( 'The room between the edge of the banner and its content.', 'cookie-rocket' ),
            __( 'Compact, normal or roomy spacing', 'cookie-rocket' ),
            self::sample_tile( __( 'Compact', 'cookie-rocket' ), 'padding:5px', 'is-space' )
            . self::sample_tile( __( 'Normal', 'cookie-rocket' ), 'padding:8px', 'is-space' )
            . self::sample_tile( __( 'Roomy', 'cookie-rocket' ), 'padding:11px', 'is-space' ),
            static function () use ( $d ): bool {
                if ( ! has_action( 'cookroco_spacing_pro_slot' ) ) {
                    return false;
                }
                do_action( 'cookroco_spacing_pro_slot', $d );
                return true;
            }
        );

        submit_button();
        echo '</form>';
        echo '</div>'; // panel: style

        echo '</div>'; // editor__main
        echo '</div>'; // editor__panel

        // ─── Live preview: the real banner, updated instantly as you edit (WYSIWYG) ───
        echo '<section class="cr-editor__stage" aria-label="' . esc_attr__( 'Live preview', 'cookie-rocket' ) . '">';
        echo '<div class="cr-stage__bar"><div class="cr-devices" role="group" aria-label="' . esc_attr__( 'Preview size', 'cookie-rocket' ) . '">';
        foreach (
            [
                'desktop' => [ __( 'Desktop', 'cookie-rocket' ), '<rect x="3" y="4" width="18" height="12" rx="2"/><path d="M8 20h8M12 16v4"/>' ],
                'tablet'  => [ __( 'Tablet', 'cookie-rocket' ), '<rect x="5" y="3" width="14" height="18" rx="2"/><path d="M11 18h2"/>' ],
                'mobile'  => [ __( 'Mobile', 'cookie-rocket' ), '<rect x="7" y="3" width="10" height="18" rx="2"/><path d="M11 18h2"/>' ],
            ] as $device => [ $device_label, $device_icon ]
        ) {
            echo '<button type="button" class="cr-device" data-device="' . esc_attr( $device ) . '" aria-pressed="' . ( 'desktop' === $device ? 'true' : 'false' ) . '" aria-label="' . esc_attr( $device_label ) . '" title="' . esc_attr( $device_label ) . '">' . $tab_icon( $device_icon ) . '</button>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG.
        }
        echo '</div><span class="cr-stage__hint">' . esc_html__( 'Every change shows here at once.', 'cookie-rocket' ) . '</span></div>';
        echo '<div class="cr-preview__stage"><div class="cr-preview__device" data-device="desktop"><iframe id="cr-preview-frame" src="' . esc_url( home_url( '/?cookroco_preview=1' ) ) . '" title="' . esc_attr__( 'Banner preview', 'cookie-rocket' ) . '"></iframe></div></div>';
        echo '</section>';
        echo '</div></div>'; // editor__app, wrap
    }
    public function render_scanner(): void {
        $scanner = new COOKROCO_Scanner();
        if ( isset( $_GET['cr_scan'] ) ) {
            check_admin_referer( 'cookroco_scan' );
            // The result reports when nothing could be read. 'Scan complete' is shown only for a scan
            // that actually read something: announcing it over a total failure is false reassurance.
            $res_scan = $scanner->scan();
            if ( empty( $res_scan['blind'] ) ) {
                echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Scan complete.', 'cookie-rocket' ) . '</p></div>';
            } else {
                echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'None of your pages could be read, so nothing was changed. Your previous result is still shown below.', 'cookie-rocket' ) . '</p></div>';
            }
        }
        $s         = (array) get_option( 'cookroco_settings', [] );
        $blocking  = array_key_exists( 'block_scripts', $s ) ? ! empty( $s['block_scripts'] ) : true;
        $raw_blocking = ! empty( $s['block_raw_html'] );
        $raw_url      = admin_url( 'admin.php?page=' . self::SLUG . '-categories' );
        $last      = $scanner->last_scan();
        $found     = ( is_array( $last ) && ! empty( $last['found'] ) ) ? $last['found'] : [];
        $age       = $scanner->scan_age_days();
        $pages      = ( is_array( $last ) && ! empty( $last['scanned'] ) ) ? count( (array) $last['scanned'] ) : 0;
        $policy    = (int) get_option( 'cookroco_policy_page_id', 0 );
        $scan_url  = wp_nonce_url( admin_url( 'admin.php?page=' . self::SLUG . '-scanner&cr_scan=1' ), 'cookroco_scan' );
        $pro_url   = 'https://templatesrocket.com/cookie-rocket-pro?feature=scanner';
        $is_pro    = apply_filters( 'cookroco_pro_active', false );

        echo '<div class="wrap cr-wrap"><h1>' . esc_html__( 'Scanner', 'cookie-rocket' ) . '</h1>';
        echo '<p class="cr-lead">' . esc_html__( 'Scan your site to discover which third-party tracking services are present. Detected cookies are listed on your Cookie Policy automatically, and Cookie Rocket blocks each tracker until the visitor accepts its category.', 'cookie-rocket' ) . '</p>';

        // ── Necessity card: a scan is a point-in-time snapshot that ages as the site changes. ──
        if ( null === $age ) {
            $card  = '<div class="cr-scan-cta"><span class="dashicons dashicons-search"></span>';
            $card .= '<div class="cr-scan-state__body"><strong>' . esc_html__( 'Run your first scan', 'cookie-rocket' ) . '</strong>';
            $card .= '<p>' . esc_html__( 'See exactly which trackers load on your site and which cookies they set.', 'cookie-rocket' ) . '</p></div>';
            $card .= '<a class="button button-primary cr-scan-trigger" href="' . esc_url( $scan_url ) . '">' . esc_html__( 'Scan my site now', 'cookie-rocket' ) . '</a></div>';
            echo wp_kses_post( $card );
        } elseif ( $age >= COOKROCO_Scanner::STALE_DAYS ) {
            /* translators: %d: number of days since the last scan. */
            $heading = esc_html( sprintf( _n( 'Your last scan was %d day ago', 'Your last scan was %d days ago', $age, 'cookie-rocket' ), $age ) );
            $card  = '<div class="cr-scan-state cr-scan-state--stale"><span class="dashicons dashicons-warning"></span>';
            $card .= '<div class="cr-scan-state__body"><strong>' . $heading . '</strong>';
            $card .= '<p>' . esc_html__( 'Websites change constantly — a new plugin, embed or pixel can start tracking visitors without being disclosed. Your inventory is out of date.', 'cookie-rocket' ) . '</p>';
            if ( ! $is_pro ) {
                $card .= '<p class="cr-scan-state__pro"><span class="dashicons dashicons-lock"></span>' . esc_html__( 'Cookie Rocket Pro re-scans automatically every month and emails you when it finds a new tracker, so your cookie inventory stays current.', 'cookie-rocket' ) . '</p>';
            }
            $card .= '</div>';
            $card .= '<a class="button button-primary cr-scan-trigger" href="' . esc_url( $scan_url ) . '">' . esc_html__( 'Re-scan now', 'cookie-rocket' ) . '</a></div>';
            echo wp_kses_post( $card );
        } else {
            if ( 0 === $age ) {
                $heading = esc_html__( 'Scanned today', 'cookie-rocket' );
            } else {
                /* translators: %d: number of days since the last scan. */
                $heading = esc_html( sprintf( _n( 'Scanned %d day ago', 'Scanned %d days ago', $age, 'cookie-rocket' ), $age ) );
            }
            $card  = '<div class="cr-scan-state cr-scan-state--fresh"><span class="dashicons dashicons-yes-alt"></span>';
            $card .= '<div class="cr-scan-state__body"><strong>' . $heading . '</strong>';
            $card .= '<p>' . esc_html__( 'This is a point-in-time snapshot. As your site changes, new trackers can appear.', 'cookie-rocket' ) . ( $is_pro ? '' : ' <span class="cr-scan-state__pro">' . esc_html__( 'Pro keeps it monitored automatically.', 'cookie-rocket' ) . '</span>' ) . '</p></div>';
            $card .= '<a class="button cr-scan-trigger" href="' . esc_url( $scan_url ) . '">' . esc_html__( 'Scan again', 'cookie-rocket' ) . '</a></div>';
            echo wp_kses_post( $card );
        }

        // ── Results ──
        if ( $found ) {
            echo '<h2 class="cr-subhead">' . esc_html__( 'Detected on your site', 'cookie-rocket' ) . '</h2>';
            $new_ids = ( is_array( $last ) && ! empty( $last['new'] ) ) ? (array) $last['new'] : [];
            if ( $new_ids && ! empty( $last['prev_found'] ) ) {
                $names = [];
                foreach ( $new_ids as $id ) { $names[] = $found[ $id ]['label'] ?? $id; }
                echo '<p class="cr-hint cr-hint--plain"><strong>' . esc_html(
                    sprintf(
                        /* translators: %d: number of trackers that appeared since the previous scan. */
                        _n( '%d tracker is new since your last scan:', '%d trackers are new since your last scan:', count( $new_ids ), 'cookie-rocket' ),
                        count( $new_ids )
                    )
                ) . '</strong> ' . esc_html( implode( ', ', $names ) ) . '</p>';
            }
            // A table wider than a phone scrolls inside this card; tabindex lets a keyboard reach it (WCAG 2.1.1).
            echo '<div class="cr-card cr-log-card cr-scan-card" tabindex="0" role="region" aria-label="' . esc_attr__( 'Detected on your site', 'cookie-rocket' ) . '">';
            echo '<table class="wp-list-table widefat striped cr-scan-table"><thead><tr>';
            echo '<th>' . esc_html__( 'Service', 'cookie-rocket' ) . '</th><th>' . esc_html__( 'Category', 'cookie-rocket' ) . '</th><th>' . esc_html__( 'Known cookies', 'cookie-rocket' ) . '</th><th>' . esc_html__( 'Status', 'cookie-rocket' ) . '</th>';
            echo '</tr></thead><tbody>';
            foreach ( $found as $f ) {
                echo '<tr><td><strong>' . esc_html( $f['label'] ?? '' ) . '</strong></td>';
                echo '<td><span class="cr-tag cr-tag--muted">' . esc_html( $f['cat'] ?? '' ) . '</span></td>';
                echo '<td class="cr-mono">' . esc_html( implode( ', ', (array) ( $f['cookies'] ?? [] ) ) ) . '</td><td>';
                if ( ! empty( $f['managed'] ) ) {
                    // The GTM container is deliberately not blocked: Consent Mode governs it.
                    echo '<span class="cr-status cr-status--ok"><span class="dashicons dashicons-yes"></span>' . esc_html__( 'Governed by Consent Mode v2', 'cookie-rocket' ) . '</span>';
                } elseif ( ! $blocking ) {
                    echo '<span class="cr-status cr-status--off">' . esc_html__( 'Detected · blocking off', 'cookie-rocket' ) . '</span>';
                } elseif ( 'inline' === ( $f['via'] ?? 'src' ) && ! $raw_blocking ) {
                    // script_loader_tag only reaches enqueued scripts, so this one is reported as it
                    // actually is, together with the switch that does handle it.
                    // The link goes OUTSIDE the span: .cr-status is inline-flex, and an <a> inside it
                    // becomes another flex item, breaking the line and leaving the separator hanging.
                    echo '<span class="cr-status cr-status--off">' . esc_html__( 'Pasted directly into the HTML', 'cookie-rocket' ) . '</span>';
                    echo '<a class="cr-status__fix" href="' . esc_url( $raw_url ) . '">' . esc_html__( 'Turn on raw HTML blocking', 'cookie-rocket' ) . '</a>';
                } else {
                    echo '<span class="cr-status cr-status--ok"><span class="dashicons dashicons-yes"></span>' . esc_html__( 'Blocked until consent', 'cookie-rocket' ) . '</span>';
                }
                echo '</td></tr>';
            }
            echo '</tbody></table>';
            echo '</div>';

            echo '<p class="cr-hint"><span class="dashicons dashicons-media-text"></span><span>';
            if ( $policy ) {
                echo esc_html__( 'These cookies are listed automatically on your Cookie Policy page.', 'cookie-rocket' );
            } else {
                echo esc_html__( 'These cookies will be listed automatically once you create your Cookie Policy page.', 'cookie-rocket' ) . ' <a href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-policy' ) ) . '">' . esc_html__( 'Create it', 'cookie-rocket' ) . ' &rarr;</a>';
            }
            echo '</span></p>';

            // Pages that could NOT be read are always reported, whether or not the scan found
            // anything, so a blocked URL never disappears from the report behind a finding.
            $unreadable = ( is_array( $last ) && ! empty( $last['errors'] ) ) ? (array) $last['errors'] : [];
            $read_ok    = max( 0, $pages - count( $unreadable ) );            if ( $read_ok > 0 ) {
                /* translators: %d: number of pages scanned. */
                echo '<p class="cr-hint cr-hint--plain">' . esc_html( sprintf( _n( 'Scanned %d key page.', 'Scanned %d key pages.', $read_ok, 'cookie-rocket' ), $read_ok ) ) . ( $is_pro ? '' : ' ' . esc_html__( 'Pro re-scans automatically every month and emails you when something new appears.', 'cookie-rocket' ) ) . '</p>';
            }
            if ( $unreadable ) {
                echo '<p class="cr-hint cr-hint--plain"><strong>' . esc_html(
                    sprintf(
                        /* translators: %d: number of URLs that could not be read. */
                        _n( '%d page could not be read, so this result is incomplete.', '%d pages could not be read, so this result is incomplete.', count( $unreadable ), 'cookie-rocket' ),
                        count( $unreadable )
                    )
                ) . '</strong> ' . esc_html__( 'Run the scan again when your site responds normally.', 'cookie-rocket' ) . '</p>';
                echo '<ul class="cr-hint cr-hint--plain" style="margin:4px 0 0 18px;list-style:disc">';
                foreach ( array_slice( $unreadable, 0, 5 ) as $u ) {
                    echo '<li>' . esc_html( (string) $u ) . '</li>';
                }
                echo '</ul>';
            }        } elseif ( null !== $age ) {
            // If any URL could not be read, it is named, and nothing is claimed about what was
            // never looked at: zero findings from a failed request is not a clean site.
            $failures = ( is_array( $last ) && ! empty( $last['errors'] ) ) ? (array) $last['errors'] : [];
            if ( $failures ) {
                echo '<p class="cr-hint cr-hint--plain"><strong>' . esc_html(
                    sprintf(
                        /* translators: %d: number of URLs that could not be read. */
                        _n( '%d page could not be read, so this result is incomplete.', '%d pages could not be read, so this result is incomplete.', count( $failures ), 'cookie-rocket' ),
                        count( $failures )
                    )
                ) . '</strong> ' . esc_html__( 'Run the scan again when your site responds normally.', 'cookie-rocket' ) . '</p>';
                echo '<ul class="cr-hint cr-hint--plain" style="margin:4px 0 0 18px;list-style:disc">';
                foreach ( array_slice( $failures, 0, 5 ) as $u ) {
                    echo '<li>' . esc_html( (string) $u ) . '</li>';
                }
                echo '</ul>';
            } else {
                echo '<p class="cr-hint cr-hint--plain">' . esc_html__( 'No known tracking services were detected on the scanned pages. As you add analytics, ads or embeds, run the scan again.', 'cookie-rocket' ) . '</p>';
            }
        }

        // ── Pro slot: the Pro panel renders here; otherwise the Pro features are listed. ──
        if ( $is_pro ) {
            do_action( 'cookroco_scanner_pro_slot', $last );
        } else {
            $hooks = [
                __( 'Automatic monthly re-scan + email alert when a new tracker appears', 'cookie-rocket' ),
                __( 'Tamper-evident consent ledger — every decision sealed in a hash chain', 'cookie-rocket' ),
                __( 'Self-hosted ARCO / DSAR rights channel, handled from this dashboard', 'cookie-rocket' ),
                __( 'Privacy notice generated for the law that applies to each visitor', 'cookie-rocket' ),
                __( 'Exportable compliance report — proof for clients and audits', 'cookie-rocket' ),
            ];
            echo '<div class="cr-pro-hooks"><h2>' . esc_html__( 'Put your cookie monitoring on autopilot', 'cookie-rocket' ) . '</h2><ul>';
            foreach ( $hooks as $h ) {
                echo '<li><span class="dashicons dashicons-lock"></span><span>' . esc_html( $h ) . '</span></li>';
            }
            echo '</ul><a class="button button-primary" href="' . esc_url( $pro_url ) . '" target="_blank" rel="noopener">' . esc_html__( 'See Cookie Rocket Pro', 'cookie-rocket' ) . ' &rarr;</a></div>';
        }

        echo '</div>';
    }
    public function render_policy(): void {
        $page_id = (int) get_option( 'cookroco_policy_page_id', 0 );
        $page    = $page_id ? get_post( $page_id ) : null;
        $exists  = ( $page && 'trash' !== $page->post_status );

        if ( isset( $_GET['cr_create_policy'] ) && ! $exists ) {
            check_admin_referer( 'cookroco_create_policy' );
            $new_id = wp_insert_post( [
                'post_title'   => __( 'Cookie Policy', 'cookie-rocket' ),
                'post_content' => '[' . COOKROCO_Policy::SHORTCODE . ']',
                'post_status'  => 'publish',
                'post_type'    => 'page',
            ] );
            if ( $new_id && ! is_wp_error( $new_id ) ) {
                update_option( 'cookroco_policy_page_id', (int) $new_id );
                $page_id = (int) $new_id;
                $page    = get_post( $page_id );
                $exists  = true;
                echo '<div class="notice notice-success is-dismissible"><p>' . esc_html__( 'Cookie Policy page created.', 'cookie-rocket' ) . '</p></div>';
            } else {
                echo '<div class="notice notice-error is-dismissible"><p>' . esc_html__( 'Could not create the page. Please add the shortcode to a page manually.', 'cookie-rocket' ) . '</p></div>';
            }
        }

        $shortcode = '[' . COOKROCO_Policy::SHORTCODE . ']';
        $scan      = get_option( 'cookroco_last_scan', [] );
        $has_scan  = is_array( $scan ) && ! empty( $scan['found'] );

        echo '<div class="wrap cr-wrap cr-policy"><h1>' . esc_html__( 'Cookie policy', 'cookie-rocket' ) . '</h1>';
        echo '<p class="cr-lead">' . esc_html__( 'Generate a cookie declaration that lists every cookie your site uses, grouped by category, with its provider, purpose and duration. The list is built from your latest scan plus a built-in catalog of common cookies, and updates automatically.', 'cookie-rocket' ) . '</p>';

        echo '<div class="cr-card cr-policy-card">';
        echo '<div class="cr-card__head"><h2>' . esc_html__( 'Your cookie declaration page', 'cookie-rocket' ) . '</h2></div>';
        if ( $exists ) {
            echo '<p class="cr-policy-status"><span class="dashicons dashicons-yes-alt"></span>'
                . sprintf(
                    /* translators: %s: the page title, already escaped and wrapped in <strong>. */
                    esc_html__( 'Published as %s', 'cookie-rocket' ),
                    '<strong>' . esc_html( get_the_title( $page_id ) ) . '</strong>'
                ) . '</p>';
            echo '<p class="cr-actions"><a href="' . esc_url( (string) get_permalink( $page_id ) ) . '" target="_blank" rel="noopener" class="button button-primary">' . esc_html__( 'View page', 'cookie-rocket' ) . '</a> ';
            echo '<a href="' . esc_url( (string) get_edit_post_link( $page_id, 'url' ) ) . '" class="button">' . esc_html__( 'Edit page', 'cookie-rocket' ) . '</a></p>';
        } else {
            echo '<p class="cr-policy-help">' . esc_html__( 'Create a ready-made page that displays your live cookie declaration — one click, no setup.', 'cookie-rocket' ) . '</p>';
            $create_url = wp_nonce_url( admin_url( 'admin.php?page=' . self::SLUG . '-policy&cr_create_policy=1' ), 'cookroco_create_policy' );
            echo '<p class="cr-actions"><a href="' . esc_url( $create_url ) . '" class="button button-primary">' . esc_html__( 'Create Cookie Policy page', 'cookie-rocket' ) . '</a></p>';
        }
        echo '<div class="cr-shortcode"><label for="cookroco-policy-shortcode">' . esc_html__( 'Or paste this shortcode on any page', 'cookie-rocket' ) . '</label>';
        echo '<input id="cookroco-policy-shortcode" type="text" readonly onclick="this.select()" value="' . esc_attr( $shortcode ) . '"></div>';
        echo '</div>'; // card

        if ( ! $has_scan ) {
            echo '<div class="cr-note"><span class="dashicons dashicons-lightbulb"></span><p>' . wp_kses_post(
                sprintf(
                    /* translators: %s: URL of the Scanner admin page. */
                    __( '<strong>Tip:</strong> <a href="%s">run the Scanner</a> first so the third-party cookies detected on your site appear in the declaration. Strictly-necessary cookies are always listed.', 'cookie-rocket' ),
                    esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-scanner' ) )
                )
            ) . '</p></div>';
        }

        // ─── Advanced: legal defaults (relocated from the former Settings page). These are
        // select/number/text fields, which the sanitizer already preserves from stored values;
        // the _none sentinel in _fields tells it this form owns no checkboxes, so it never wipes
        // the blocking boxes it doesn't render. ───
        $s = (array) get_option( 'cookroco_settings', [] );
        if ( ! is_array( $s ) ) { $s = []; }
        $law_now  = in_array( $s['default_law'] ?? 'generic', [ 'gdpr', 'ccpa', 'lgpd', 'lfpdppp', 'generic' ], true ) ? ( $s['default_law'] ?? 'generic' ) : 'generic';
        $law_opts = self::law_names();
        echo '<div class="cr-acc" id="legal-defaults"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Advanced — legal defaults', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body">';
        echo '<form method="post" action="options.php">';
        settings_fields( 'cookroco_settings_group' );
        echo '<input type="hidden" name="cookroco_settings[_fields][]" value="_none">';
        echo '<table class="form-table">';
        echo '<tr><th scope="row"><label for="cookroco-default-law">' . esc_html__( 'Compliance framework', 'cookie-rocket' ) . '</label></th><td><select id="cookroco-default-law" name="cookroco_settings[default_law]">';
        foreach ( $law_opts as $lk => $ll ) { echo '<option value="' . esc_attr( $lk ) . '" ' . selected( $law_now, $lk, false ) . '>' . esc_html( $ll ) . '</option>'; }
        echo '</select><p class="description">' . esc_html__( 'Sets the banner\'s default legal text (override it anytime in Banner → Content). New installs pick this automatically from the site language.', 'cookie-rocket' ) . '</p></td></tr>';
        $state_now = ( 'opt_out' === ( $s['default_state'] ?? 'opt_in' ) && ! in_array( $law_now, COOKROCO_Consent::OPT_IN_LAWS, true ) ) ? 'opt_out' : 'opt_in';
        echo '<tr><th scope="row"><label for="cookroco-default-state">' . esc_html__( 'Before the visitor decides', 'cookie-rocket' ) . '</label></th><td><select id="cookroco-default-state" name="cookroco_settings[default_state]">';
        echo '<option value="opt_in" ' . selected( $state_now, 'opt_in', false ) . '>' . esc_html__( 'Block optional cookies until the visitor accepts (opt-in)', 'cookie-rocket' ) . '</option>';
        echo '<option value="opt_out" ' . selected( $state_now, 'opt_out', false ) . disabled( in_array( $law_now, COOKROCO_Consent::OPT_IN_LAWS, true ), true, false ) . '>' . esc_html__( 'Allow them until the visitor rejects (opt-out)', 'cookie-rocket' ) . '</option>';
        echo '</select><p class="description">' . esc_html__( 'Opt-out is only available under CCPA / CPRA and Generic. The GDPR, the LGPD and the LFPDPPP require consent before any optional cookie, so with them the banner always asks first.', 'cookie-rocket' ) . '</p>';
        if ( ! apply_filters( 'cookroco_pro_active', false ) ) {
            echo '<p class="description">' . esc_html__( 'Visitors from several regions? Cookie Rocket Pro applies each region its own rules on the same site: opt-out for the United States, opt-in for the EU.', 'cookie-rocket' ) . ' <a href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=regions' ) . '" target="_blank" rel="noopener">' . esc_html__( 'See Regions in Pro', 'cookie-rocket' ) . ' &rarr;</a></p>';
        }
        echo '</td></tr>';
        echo '<tr><th scope="row"><label for="cookroco-consent-duration">' . esc_html__( 'Consent duration (days)', 'cookie-rocket' ) . '</label></th><td><input id="cookroco-consent-duration" type="number" name="cookroco_settings[consent_duration_days]" value="' . esc_attr( (string) min( 'gdpr' === $law_now ? 395 : 730, absint( $s['consent_duration_days'] ?? 365 ) ) ) . '" min="1" max="' . ( 'gdpr' === $law_now ? '395' : '730' ) . '"></td></tr>';
        echo '<tr><th scope="row"><label for="cookroco-log-retention">' . esc_html__( 'Keep consent records for (days)', 'cookie-rocket' ) . '</label></th><td><input id="cookroco-log-retention" type="number" name="cookroco_settings[log_retention_days]" value="' . esc_attr( (string) ( $s['log_retention_days'] ?? 365 ) ) . '" min="30" max="3650"><p class="description">' . esc_html__( 'A weekly job deletes records older than this. Raise it if you need to keep proof of consent for longer.', 'cookie-rocket' ) . ' ' . esc_html__( 'A record is never deleted before the consent it proves has expired.', 'cookie-rocket' ) . '</p></td></tr>';
        echo '<tr><th scope="row"><label for="cookroco-policy-version">' . esc_html__( 'Policy version', 'cookie-rocket' ) . '</label></th><td><input id="cookroco-policy-version" type="text" maxlength="20" name="cookroco_settings[policy_version]" value="' . esc_attr( $s['policy_version'] ?? '1.0' ) . '" class="regular-text"><p class="description">' . esc_html__( 'Increment to re-ask consent after policy changes.', 'cookie-rocket' ) . '</p></td></tr>';
        echo '</table>';
        submit_button();
        echo '</form>';
        echo '</div></div>';

        echo '</div>';
    }
    public function render_log(): void {
        $per_page = 20;
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only pagination of an admin view; no state change.
        $page_num = isset( $_GET['log_page'] ) ? max( 1, absint( wp_unslash( $_GET['log_page'] ) ) ) : 1;
        $offset   = ( $page_num - 1 ) * $per_page;
        $stats    = $this->log->get_stats();
        $total    = (int) ( $stats['total'] ?? 0 );
        $last7    = (int) ( $stats['last7days'] ?? 0 );
        $records  = $this->log->get_records( $per_page, $offset );
        $labels   = self::action_labels();

        // A person's records, searched by POST: an IP address typed here never lands in a URL, a
        // server log or the browser history. false = no search; null = neither an ID nor an IP.
        $query = '';
        $found = false;
        if ( isset( $_POST['cr_log_q'] ) && check_admin_referer( 'cookroco_log_find', 'cr_log_nonce' ) && current_user_can( self::CAP ) ) {
            $query = sanitize_text_field( wp_unslash( $_POST['cr_log_q'] ) );
            $found = $this->log->find_records( $query );
            if ( is_array( $found ) ) {
                $records = $found;
            }
        }

        // What each column means, in the screen itself, for whoever reads the log for the first time.
        $help = [
            'date'    => [ __( 'Date', 'cookie-rocket' ), __( 'When the visitor made the choice, in your site’s time zone.', 'cookie-rocket' ) ],
            'action'  => [ __( 'Action', 'cookie-rocket' ), __( 'What the visitor chose: Accepted all, Rejected (only strictly necessary cookies), Customized (categories picked one by one), Withdrew (took their consent back) or Opted out (their browser sent a Global Privacy Control signal).', 'cookie-rocket' ) ],
            'cats'    => [ __( 'Categories accepted', 'cookie-rocket' ), __( 'The cookie categories the visitor allowed. Strictly necessary cookies are always on and need no consent.', 'cookie-rocket' ) ],
            'policy'  => [ __( 'Policy', 'cookie-rocket' ), __( 'The version of your cookie policy in force when the visitor chose. Raise it whenever you change the policy, and every consent stays tied to the text the visitor saw.', 'cookie-rocket' ) ],
            'consent' => [ __( 'Consent ID', 'cookie-rocket' ), __( 'The ID of the visitor’s browser. It stays the same while they keep their cookies, and the visitor can see it in their cookie preferences: ask them for it to find their records.', 'cookie-rocket' ) ],
            'visitor' => [ __( 'Visitor', 'cookie-rocket' ), __( 'A code made from the visitor’s internet connection (IP address) and a secret key of your site. The IP address itself is never stored, and the code cannot be turned back into it. The same connection gives the same code; a phone that changes network gets a new one.', 'cookie-rocket' ) ],
        ];

        echo '<div class="wrap cr-wrap cr-log"><h1>' . esc_html__( 'Consent Log', 'cookie-rocket' ) . '</h1>';
        echo '<p class="cr-lead">' . esc_html__( 'An auditable record of every consent decision on your site. Each row is one visitor choice; the visitor is identified only by a one-way hash — no raw IP is stored.', 'cookie-rocket' ) . '</p>';
        $ret  = COOKROCO_Log::retention_days();
        /* translators: %d: number of days consent records are kept before automatic deletion. */
        $ret_note = sprintf( _n( 'Records are kept for %d day, then deleted automatically.', 'Records are kept for %d days, then deleted automatically.', $ret, 'cookie-rocket' ), $ret );
        /**
         * Filters the retention sentence on the Consent Log (Cookie Rocket Pro: sealed records are kept).
         *
         * @param string $ret_note Sentence.
         * @param int    $ret      Retention in days.
         */
        $ret_note = (string) apply_filters( 'cookroco_retention_note', $ret_note, $ret );
        echo '<p class="cr-hint cr-hint--plain cr-log-retention">' . esc_html( $ret_note ) . ' <a href="' . esc_url( (string) apply_filters( 'cookroco_retention_url', admin_url( 'admin.php?page=' . self::SLUG . '-policy#legal-defaults' ) ) ) . '">' . esc_html__( 'Change retention', 'cookie-rocket' ) . '</a></p>';

        // The same metric must look the same everywhere: this uses the canonical stat
        // component (.cr-stat).
        echo '<div class="cr-stat-grid">';
        echo '<div class="cr-stat"><span class="cr-stat__num">' . esc_html( number_format_i18n( $total ) ) . '</span><span class="cr-stat__label">' . esc_html__( 'Total consents', 'cookie-rocket' ) . '</span></div>';
        echo '<div class="cr-stat"><span class="cr-stat__num">' . esc_html( number_format_i18n( $last7 ) ) . '</span><span class="cr-stat__label">' . esc_html__( 'Last 7 days', 'cookie-rocket' ) . '</span></div>';
        echo '</div>';
        // The stat grid holds stats and nothing else. The actions slot renders AFTER it —
        // inside the grid, a button row became a grid cell and got stretched like a card.
        do_action( 'cookroco_log_actions_slot', $total );

        echo '<div class="cr-acc cr-log-help" id="cr-log-help"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'How to read this log', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body">';
        echo '<dl class="cr-log-help__list">';
        foreach ( $help as $key => [ $term, $text ] ) {
            echo '<dt id="' . esc_attr( 'cr-log-help-' . $key ) . '" tabindex="-1">' . esc_html( $term ) . '</dt><dd>' . esc_html( $text );
            if ( 'policy' === $key ) {
                echo ' <a href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-policy#legal-defaults' ) ) . '">' . esc_html__( 'Change the policy version', 'cookie-rocket' ) . '</a>';
            }
            echo '</dd>';
        }
        echo '</dl>';
        echo '<p class="cr-log-help__note">' . esc_html__( 'This log identifies no one by name. To find a person’s records, ask them for their consent ID, or for the IP address they used, and search for it below.', 'cookie-rocket' ) . '</p>';
        echo '</div></div>';

        echo '<form method="post" class="cr-log-find" action="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-log' ) ) . '">';
        wp_nonce_field( 'cookroco_log_find', 'cr_log_nonce' );
        echo '<label for="cr-log-q">' . esc_html__( 'Find a person’s records', 'cookie-rocket' ) . '</label>';
        echo '<span class="cr-log-find__row"><input type="search" id="cr-log-q" name="cr_log_q" value="' . esc_attr( $query ) . '" placeholder="' . esc_attr__( 'Consent ID or IP address', 'cookie-rocket' ) . '" autocomplete="off" spellcheck="false" aria-describedby="cr-log-find-help"><button type="submit" class="button">' . esc_html__( 'Find', 'cookie-rocket' ) . '</button></span>';
        echo '<span class="cr-log-find__help" id="cr-log-find-help">' . esc_html__( 'The IP address is only used for this search and is never stored.', 'cookie-rocket' ) . '</span>';
        echo '</form>';
        if ( false !== $found ) {
            echo '<p class="cr-log-found" role="status">';
            if ( null === $found ) {
                esc_html_e( 'Enter a consent ID (at least 6 characters) or an IP address.', 'cookie-rocket' );
            } elseif ( ! $found ) {
                esc_html_e( 'No record matches this consent ID or IP address.', 'cookie-rocket' );
            } else {
                /* translators: %d: number of consent records found. */
                echo esc_html( sprintf( _n( '%d record matches.', '%d records match.', count( $found ), 'cookie-rocket' ), count( $found ) ) );
            }
            echo ' <a href="' . esc_url( admin_url( 'admin.php?page=' . self::SLUG . '-log' ) ) . '">' . esc_html__( 'Show all records', 'cookie-rocket' ) . '</a></p>';
        }

        if ( $records ) {
            // A table wider than a phone scrolls inside this card; tabindex lets a keyboard reach it (WCAG 2.1.1).
            echo '<div class="cr-card cr-log-card" tabindex="0" role="region" aria-label="' . esc_attr__( 'Consent Log', 'cookie-rocket' ) . '">';
            echo '<table class="wp-list-table widefat striped"><thead><tr>';
            foreach ( $help as $key => [ $term ] ) {
                /* translators: %s: a column of the consent log, such as Date. */
                echo '<th scope="col">' . esc_html( $term ) . ' <a class="cr-th-help" href="#' . esc_attr( 'cr-log-help-' . $key ) . '" aria-label="' . esc_attr( sprintf( __( 'About %s', 'cookie-rocket' ), $term ) ) . '">?</a></th>';
            }
            echo '</tr></thead><tbody>';
            foreach ( $records as $r ) {
                $cats       = json_decode( (string) ( $r['categories_accepted'] ?? '[]' ), true );
                $cats       = is_array( $cats ) ? implode( ', ', array_map( 'sanitize_text_field', $cats ) ) : '';
                $action_key = (string) ( $r['action'] ?? '' );
                $act        = $labels[ $action_key ] ?? $action_key;
                $tone       = ( 'accept_all' === $action_key ) ? 'ok' : 'muted';
                echo '<tr>';
                echo '<td class="cr-log-date">' . esc_html( $r['created_at'] ?? '' ) . '</td>';
                echo '<td><span class="cr-tag cr-tag--' . esc_attr( $tone ) . '">' . esc_html( $act ) . '</span></td>';
                echo '<td>' . ( '' !== $cats ? esc_html( $cats ) : '<span class="cr-log-muted">&mdash;</span>' ) . '</td>';
                echo '<td>' . esc_html( $r['policy_version'] ?? '' ) . '</td>';
                echo '<td class="cr-log-hash">' . esc_html( substr( (string) ( $r['session_id'] ?? '' ), 0, 8 ) ) . '</td>';
                echo '<td class="cr-log-hash">' . esc_html( substr( (string) ( $r['ip_hash'] ?? '' ), 0, 12 ) ) . '</td>';
                echo '</tr>';
            }
            echo '</tbody></table>';
            echo '</div>'; // card

            $total_pages = false === $found ? (int) ceil( $total / $per_page ) : 1;
            if ( $total_pages > 1 ) {
                $base = admin_url( 'admin.php?page=' . self::SLUG . '-log' );
                echo '<div class="cr-pager">';
                if ( $page_num > 1 ) {
                    echo '<a class="button" href="' . esc_url( $base . '&log_page=' . ( $page_num - 1 ) ) . '">&laquo; ' . esc_html__( 'Previous', 'cookie-rocket' ) . '</a>';
                }
                /* translators: 1: current page number, 2: total number of pages */
                echo '<span class="cr-pager__info">' . esc_html( sprintf( __( 'Page %1$d of %2$d', 'cookie-rocket' ), $page_num, $total_pages ) ) . '</span>';
                if ( $page_num < $total_pages ) {
                    echo '<a class="button" href="' . esc_url( $base . '&log_page=' . ( $page_num + 1 ) ) . '">' . esc_html__( 'Next', 'cookie-rocket' ) . ' &raquo;</a>';
                }
                echo '</div>';
            }
        } elseif ( false === $found ) {
            echo '<div class="cr-card"><p class="cr-empty">' . esc_html__( 'No consents recorded yet. Decisions will appear here once visitors interact with your banner.', 'cookie-rocket' ) . '</p></div>';
        }

        if ( ! apply_filters( 'cookroco_pro_active', false ) ) {
            echo '<div class="cr-pronote"><span class="cr-pronote__icon"><span class="dashicons dashicons-lock"></span></span>';
            echo '<div class="cr-pronote__txt"><strong>' . esc_html__( 'Export and evidence report', 'cookie-rocket' ) . '</strong>';
            echo '<p>' . esc_html__( 'Export the full consent log to CSV and issue an evidence report anchored to a tamper-evident chain — in Cookie Rocket Pro.', 'cookie-rocket' ) . ' <a href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=log' ) . '" target="_blank" rel="noopener">' . esc_html__( 'See Pro', 'cookie-rocket' ) . ' &rarr;</a></p></div></div>';
        }
        echo '</div>'; // wrap
    }
    public function render_categories(): void {
        $cats = get_option( 'cookroco_cookie_categories', [] );
        if ( ! is_array( $cats ) ) $cats = [];
        uasort( $cats, fn( $a, $b ) => ( $a['order'] ?? 99 ) <=> ( $b['order'] ?? 99 ) );

        // Per-category dashicon for quick visual scanning; unknown keys fall back to a generic one.
        $icons = [
            'necessary'       => 'shield-alt',
            'functional'      => 'admin-settings',
            'analytics'       => 'chart-bar',
            'marketing'       => 'megaphone',
            'personalization' => 'admin-customizer',
            'social'          => 'share',
        ];

        echo '<div class="wrap cr-wrap cr-cats"><h1>' . esc_html__( 'Categories', 'cookie-rocket' ) . '</h1>';
        echo '<p class="cr-lead">' . esc_html__( 'Rename, describe and reorder the consent categories shown on your banner. The strictly-necessary category is always on and cannot be turned off.', 'cookie-rocket' ) . '</p>';

        echo '<form method="post" action="options.php" class="cr-cats-form">';
        settings_fields( 'cookroco_categories_group' );
        echo '<div class="cr-cat-grid">';
        foreach ( $cats as $key => $cat ) {
            $key   = (string) $key;
            $icon  = $icons[ $key ] ?? 'category';
            $title = ucwords( str_replace( [ '_', '-' ], ' ', $key ) );
            $req   = ! empty( $cat['required'] );
            $field = 'cookroco_cookie_categories[' . $key . ']'; // raw base; escaped inline at each echo.

            echo '<div class="cr-cat-card">';
            echo '<div class="cr-cat-card__head">';
            echo '<span class="cr-cat-card__icon"><span class="dashicons dashicons-' . esc_attr( $icon ) . '"></span></span>';
            echo '<span class="cr-cat-card__title">' . esc_html( $title ) . '</span>';
            if ( $req ) {
                echo '<span class="cr-badge cr-badge--on">' . esc_html__( 'Always on', 'cookie-rocket' ) . '</span>';
            }
            echo '</div>';

            echo '<div class="cr-cat-card__body">';
            echo '<div class="cr-field-row">';
            echo '<div class="cr-field cr-field--grow"><label for="' . esc_attr( 'cr-cat-' . $key . '-label' ) . '">' . esc_html__( 'Display name', 'cookie-rocket' ) . '</label>';
            echo '<input type="text" id="' . esc_attr( 'cr-cat-' . $key . '-label' ) . '" name="' . esc_attr( $field . '[label]' ) . '" value="' . esc_attr( $cat['label'] ?? '' ) . '" maxlength="60"></div>';
            echo '<div class="cr-field cr-field--num"><label for="' . esc_attr( 'cr-cat-' . $key . '-order' ) . '">' . esc_html__( 'Order', 'cookie-rocket' ) . '</label>';
            echo '<input type="number" id="' . esc_attr( 'cr-cat-' . $key . '-order' ) . '" name="' . esc_attr( $field . '[order]' ) . '" value="' . esc_attr( (string) ( $cat['order'] ?? 99 ) ) . '" min="1" max="99"></div>';
            echo '</div>';
            echo '<div class="cr-field"><label for="' . esc_attr( 'cr-cat-' . $key . '-desc' ) . '">' . esc_html__( 'Description', 'cookie-rocket' ) . '</label>';
            echo '<textarea id="' . esc_attr( 'cr-cat-' . $key . '-desc' ) . '" name="' . esc_attr( $field . '[description]' ) . '" rows="2" maxlength="300">' . esc_textarea( $cat['description'] ?? '' ) . '</textarea></div>';
            echo '</div>'; // body
            echo '</div>'; // card
        }
        echo '</div>'; // grid
        submit_button( __( 'Save changes', 'cookie-rocket' ) );
        echo '</form>';

        // ─── Advanced: script blocking (relocated here from the former Settings page, so the
        // controls that decide WHAT gets blocked live in the section named Blocking). Saved with
        // the "owned fields" pattern so this partial form never wipes the other cookroco_settings. ───
        $s   = (array) get_option( 'cookroco_settings', [] );
        if ( ! is_array( $s ) ) { $s = []; }
        $gcm = array_key_exists( 'gcm_enabled', $s )    ? ! empty( $s['gcm_enabled'] )    : true;
        $blk = array_key_exists( 'block_scripts', $s )  ? ! empty( $s['block_scripts'] )  : true;
        $emb = array_key_exists( 'block_embeds', $s )   ? ! empty( $s['block_embeds'] )   : true;
        $buf = array_key_exists( 'block_raw_html', $s ) ? ! empty( $s['block_raw_html'] ) : false;
        $vendor_list = implode( ', ', wp_list_pluck( COOKROCO_Blocker::vendors(), 'label' ) );
        echo '<div class="cr-acc"><button type="button" class="cr-acc__head"><span>' . esc_html__( 'Advanced — script blocking', 'cookie-rocket' ) . '</span><span class="dashicons dashicons-arrow-down-alt2"></span></button><div class="cr-acc__body">';
        echo '<form method="post" action="options.php">';
        settings_fields( 'cookroco_settings_group' );
        foreach ( [ 'gcm_enabled', 'block_scripts', 'block_embeds', 'block_raw_html' ] as $fk ) {
            echo '<input type="hidden" name="cookroco_settings[_fields][]" value="' . esc_attr( $fk ) . '">';
        }
        echo '<table class="form-table">';
        echo '<tr><th>' . esc_html__( 'Google Consent Mode v2', 'cookie-rocket' ) . '</th><td><label><input type="checkbox" name="cookroco_settings[gcm_enabled]" value="1" ' . checked( $gcm, true, false ) . '> ' . esc_html__( 'Emit Consent Mode v2 (default: denied) for Google Analytics / Ads / Tag Manager', 'cookie-rocket' ) . '</label><p class="description">' . esc_html__( 'Recommended. Gates Google cookies the official way, even without blocking the script.', 'cookie-rocket' ) . '</p></td></tr>';
        echo '<tr><th>' . esc_html__( 'Auto-block tracking scripts', 'cookie-rocket' ) . '</th><td><label><input type="checkbox" name="cookroco_settings[block_scripts]" value="1" ' . checked( $blk, true, false ) . '> ' . esc_html__( 'Neutralize scripts from known providers until the visitor accepts their category', 'cookie-rocket' ) . '</label><p class="description">' . wp_kses_post( __( 'Blocks <strong>enqueued</strong> scripts from known providers and re-activates them on consent. Covers:', 'cookie-rocket' ) ) . ' ' . esc_html( $vendor_list ) . '.</p></td></tr>';
        echo '<tr><th>' . esc_html__( 'Smart embed placeholders', 'cookie-rocket' ) . '</th><td><label><input type="checkbox" name="cookroco_settings[block_embeds]" value="1" ' . checked( $emb, true, false ) . '> ' . esc_html__( 'Block third-party embeds (YouTube, Vimeo, Maps, social) until consent and show a click-to-load placeholder', 'cookie-rocket' ) . '</label></td></tr>';
        echo '<tr><th>' . esc_html__( 'Block scripts in raw HTML', 'cookie-rocket' ) . '</th><td><label><input type="checkbox" name="cookroco_settings[block_raw_html]" value="1" ' . checked( $buf, true, false ) . '> ' . esc_html__( 'Also block scripts pasted directly into the theme / header (output buffering)', 'cookie-rocket' ) . '</label><p class="description">' . esc_html__( 'Enable only if you insert analytics/pixels directly in the head (not via a plugin). It buffers the page and can interact with caching — test it. Default: off.', 'cookie-rocket' ) . '</p></td></tr>';
        echo '</table>';
        submit_button();
        echo '</form>';
        echo '</div></div>';

        // ─── Your own services: whatever the plugin does not recognize, the owner declares
        // here. With a name, script signatures and cookies, it gets blocked and declared. ───
        $services = COOKROCO_Blocker::custom_services();
        $cats_svc  = [ 'analytics' => __( 'Statistics & Analytics', 'cookie-rocket' ), 'marketing' => __( 'Marketing & Advertising', 'cookie-rocket' ), 'functional' => __( 'Functional & Preferences', 'cookie-rocket' ), 'personalization' => __( 'Personalization', 'cookie-rocket' ), 'social' => __( 'Social Media & Embeds', 'cookie-rocket' ) ];
        echo '<h2 style="margin-top:32px">' . esc_html__( 'Your own services', 'cookie-rocket' ) . '</h2>';
        $known = count( array_filter( array_keys( COOKROCO_Blocker::vendors() ), static fn( $k ) => 0 !== strpos( (string) $k, 'custom_' ) ) );
        /* translators: %d: number of services Cookie Rocket recognizes on its own. */
        echo '<p class="cr-lead">' . esc_html( sprintf( _n( 'Cookie Rocket recognizes %d common service. Anything else on your site is neither blocked nor declared until you name it here. Add the script address so it can be blocked, and its cookies so they appear on your cookie policy.', 'Cookie Rocket recognizes %d common services. Anything else on your site is neither blocked nor declared until you name it here. Add the script address so it can be blocked, and its cookies so they appear on your cookie policy.', $known, 'cookie-rocket' ), $known ) ) . '</p>';
        echo '<form method="post" action="options.php">';
        settings_fields( 'cookroco_services_group' );
        // One card per service, the new one last: a title, then every field with its label above it.
        echo '<div class="cr-services">';
        $i = 0;
        foreach ( array_merge( array_values( $services ), [ null ] ) as $svc ) {
            $n      = 'cookroco_custom_services[' . $i . ']';
            $is_new = ( null === $svc );
            $title  = $is_new ? __( 'Add a service', 'cookie-rocket' ) : (string) ( $svc['label'] ?? '' );
            echo '<div class="cr-service' . ( $is_new ? ' is-new' : '' ) . '" role="group" aria-labelledby="' . esc_attr( 'cr-svc-title-' . $i ) . '">';
            echo '<h3 class="cr-service__title" id="' . esc_attr( 'cr-svc-title-' . $i ) . '">' . esc_html( '' !== $title ? $title : __( 'Service', 'cookie-rocket' ) ) . '</h3>';
            echo '<div class="cr-service__row">';
            echo '<p class="cr-service__field"><label for="' . esc_attr( 'cr-svc-' . $i ) . '">' . esc_html__( 'Service', 'cookie-rocket' ) . '</label>';
            echo '<input type="text" id="' . esc_attr( 'cr-svc-' . $i ) . '" name="' . esc_attr( $n . '[label]' ) . '" value="' . esc_attr( $svc['label'] ?? '' ) . '" placeholder="' . esc_attr__( 'Intercom', 'cookie-rocket' ) . '" maxlength="60"></p>';
            echo '<p class="cr-service__field"><label for="' . esc_attr( 'cr-svc-cat-' . $i ) . '">' . esc_html__( 'Category', 'cookie-rocket' ) . '</label>';
            echo '<select id="' . esc_attr( 'cr-svc-cat-' . $i ) . '" name="' . esc_attr( $n . '[cat]' ) . '">';
            foreach ( $cats_svc as $k => $etiqueta ) {
                echo '<option value="' . esc_attr( $k ) . '" ' . selected( $svc['cat'] ?? 'analytics', $k, false ) . '>' . esc_html( $etiqueta ) . '</option>';
            }
            echo '</select></p>';
            echo '</div>';
            echo '<p class="cr-service__field"><label for="' . esc_attr( 'cr-svc-src-' . $i ) . '">' . esc_html__( 'Script address', 'cookie-rocket' ) . '</label>';
            echo '<input type="text" id="' . esc_attr( 'cr-svc-src-' . $i ) . '" name="' . esc_attr( $n . '[src]' ) . '" value="' . esc_attr( implode( ', ', $svc['src'] ?? [] ) ) . '" placeholder="widget.intercom.io, js.intercomcdn.com" aria-describedby="' . esc_attr( 'cr-svc-src-help-' . $i ) . '">';
            echo '<span class="cr-service__help" id="' . esc_attr( 'cr-svc-src-help-' . $i ) . '">' . esc_html__( 'Part of the script URL, enough to recognize it. Separate several with commas.', 'cookie-rocket' ) . '</span></p>';
            $lines = [];
            foreach ( (array) ( $svc['cookies'] ?? [] ) as $c ) {
                $lines[] = $c['name'] . ' | ' . $c['purpose'] . ' | ' . $c['duration'];
            }
            echo '<p class="cr-service__field"><label for="' . esc_attr( 'cr-svc-ck-' . $i ) . '">' . esc_html__( 'Cookies it sets', 'cookie-rocket' ) . '</label>';
            echo '<textarea id="' . esc_attr( 'cr-svc-ck-' . $i ) . '" name="' . esc_attr( $n . '[cookies]' ) . '" rows="3" placeholder="' . esc_attr__( 'intercom-id-* | Identifies the visitor across chat sessions | 9 months', 'cookie-rocket' ) . '" aria-describedby="' . esc_attr( 'cr-svc-ck-help-' . $i ) . '">' . esc_textarea( implode( "\n", $lines ) ) . '</textarea>';
            echo '<span class="cr-service__help" id="' . esc_attr( 'cr-svc-ck-help-' . $i ) . '">' . esc_html__( 'One per line: name | what it is for | how long it lasts. A trailing * covers a family of cookies.', 'cookie-rocket' ) . '</span></p>';
            if ( ! $is_new ) {
                echo '<p class="cr-service__help">' . esc_html__( 'Clear the name to remove it.', 'cookie-rocket' ) . '</p>';
            }
            echo '</div>';
            $i++;
        }
        echo '</div>';
        submit_button( __( 'Save services', 'cookie-rocket' ) );
        echo '</form>';

        if ( ! apply_filters( 'cookroco_pro_active', false ) ) {
            echo '<div class="cr-pronote"><span class="cr-pronote__icon"><span class="dashicons dashicons-lock"></span></span>';
            echo '<div class="cr-pronote__txt"><strong>' . esc_html__( 'Regions', 'cookie-rocket' ) . '</strong>';
            echo '<p>' . esc_html__( 'Different rules for the EU, the United States, Mexico and Brazil on the same site: consent model, Reject button, consent duration and banner text per region, with country exceptions — in Cookie Rocket Pro.', 'cookie-rocket' ) . ' <a href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=categories' ) . '" target="_blank" rel="noopener">' . esc_html__( 'See Pro', 'cookie-rocket' ) . ' &rarr;</a></p></div></div>';
        }
        echo '</div>'; // wrap
    }
    /**
     * Services declared by the site owner.
     *
     * The plugin recognizes a fixed list of providers and any real site uses more. Anything absent
     * from that list is neither blocked nor declared, which leaves the cookie policy
     * incomplete with nothing to signal it. Here the owner names the service, gives its
     * script signatures and describes its cookies, and both happen.
     *
     * @param mixed $raw Raw form input.
     * @return array
     */
    public function sanitize_services_option( $raw ): array {
        $out = [];
        foreach ( (array) $raw as $svc ) {
            if ( ! is_array( $svc ) ) { continue; }
            $label = sanitize_text_field( (string) ( $svc['label'] ?? '' ) );
            if ( '' === trim( $label ) ) { continue; } // a row with no name is an empty row
            $id = sanitize_key( substr( sanitize_title( $label ), 0, 40 ) );
            if ( '' === $id ) { continue; }

            // WordPress runs this twice on the very first save (update_option → add_option), the
            // second time on what the first returned: lists instead of the form's text. Both shapes
            // are read, or the first service ever saved would keep "Array" as its script and cookie.

            // Signatures: one per line or comma-separated. Whatever identifies the script.
            $src        = $svc['src'] ?? '';
            $signatures = is_array( $src ) ? $src : preg_split( '/[\r\n,]+/', (string) $src );
            $signatures = array_values( array_filter( array_map( fn( $f ) => sanitize_text_field( trim( is_scalar( $f ) ? (string) $f : '' ) ), (array) $signatures ) ) );

            // Cookies: one per line, "name | purpose | duration" (or the list a first pass made of them).
            $cookies = [];
            $lines   = $svc['cookies'] ?? '';
            if ( is_array( $lines ) ) {
                $lines = array_map( static fn( $c ) => is_array( $c ) ? implode( ' | ', [ (string) ( $c['name'] ?? '' ), (string) ( $c['purpose'] ?? '' ), (string) ( $c['duration'] ?? '' ) ] ) : ( is_scalar( $c ) ? (string) $c : '' ), $lines );
            } else {
                $lines = preg_split( '/[\r\n]+/', (string) $lines );
            }
            foreach ( $lines as $line ) {
                $line = trim( (string) $line );
                if ( '' === $line ) { continue; }
                $parts  = array_map( 'trim', explode( '|', $line ) );
                $name  = sanitize_text_field( $parts[0] ?? '' );
                if ( '' === $name ) { continue; }
                $cookies[] = [
                    'name'     => $name,
                    'purpose'  => sanitize_text_field( $parts[1] ?? '' ),
                    'duration' => sanitize_text_field( $parts[2] ?? '' ),
                ];
            }

            $out[ $id ] = [
                'label'   => $label,
                'cat'     => in_array( $svc['cat'] ?? '', [ 'analytics', 'marketing', 'functional', 'personalization', 'social' ], true ) ? $svc['cat'] : 'analytics',
                'src'     => $signatures,
                'inline'  => [],
                'cookies' => $cookies,
            ];
        }
        return $out;
    }

    public function ajax_save_settings(): void {
        $this->verify_nonce();
        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Nonce checked in verify_nonce(); array sanitized via sanitize_settings_option().
        $raw = isset( $_POST['settings'] ) ? (array) wp_unslash( $_POST['settings'] ) : [];
        update_option( 'cookroco_settings', $this->sanitize_settings_option( $raw ) );
        // A value the rules changed (an invalid Tag Manager ID, a duration over the GDPR's ceiling)
        // goes back to the screen, so the owner sees what was stored instead of a plain "Saved".
        $stored   = (array) get_option( 'cookroco_settings', [] );
        $adjusted = [];
        foreach ( $raw as $k => $v ) {
            if ( '_fields' === $k || ! is_scalar( $v ) || ! array_key_exists( $k, $stored ) || ! is_scalar( $stored[ $k ] ) || is_bool( $stored[ $k ] ) ) {
                continue;
            }
            if ( (string) $stored[ $k ] !== trim( (string) $v ) ) {
                $adjusted[ sanitize_key( (string) $k ) ] = (string) $stored[ $k ];
            }
        }
        wp_send_json_success( [ 'message' => __( 'Saved.', 'cookie-rocket' ), 'adjusted' => $adjusted ] );
    }
    public function ajax_save_design(): void {
        $this->verify_nonce();
        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Nonce checked in verify_nonce(); array sanitized via sanitize_design_option().
        $raw = isset( $_POST['design'] ) ? (array) wp_unslash( $_POST['design'] ) : [];
        update_option( 'cookroco_banner_design', $this->sanitize_design_option( $raw ) );
        wp_send_json_success( [ 'message' => __( 'Saved.', 'cookie-rocket' ) ] );
    }
    /** Save only the banner layout + position (merged into settings, preserving everything else). */
    public function ajax_save_layout(): void {
        $this->verify_nonce();
        // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce checked in verify_nonce(); all inputs unslashed + sanitized via sanitize_key() and validated against allow-lists below.
        $variant   = isset( $_POST['variant'] ) ? sanitize_key( wp_unslash( $_POST['variant'] ) ) : '';
        $position  = isset( $_POST['position'] ) ? sanitize_key( wp_unslash( $_POST['position'] ) ) : '';
        $bar_width = isset( $_POST['bar_width'] ) ? sanitize_key( wp_unslash( $_POST['bar_width'] ) ) : '';
        $has_bd    = array_key_exists( 'show_backdrop', $_POST );
        $backdrop  = ! empty( $_POST['show_backdrop'] );
        // phpcs:enable WordPress.Security.NonceVerification.Missing
        $s = (array) get_option( 'cookroco_settings', [] );
        if ( ! is_array( $s ) ) { $s = []; }
        if ( in_array( $variant, [ 'bottom_bar', 'top_bar', 'modal', 'floating', 'drawer' ], true ) ) {
            $s['banner_variant'] = $variant;
        }
        if ( in_array( $position, [ 'left', 'right', 'center' ], true ) ) {
            $s['banner_position'] = $position;
        }
        if ( in_array( $bar_width, [ 'contained', 'full' ], true ) ) {
            $s['bar_width'] = $bar_width;
        }
        if ( $has_bd ) {
            $s['show_backdrop'] = $backdrop;
        }
        update_option( 'cookroco_settings', $s );
        wp_send_json_success( [ 'variant' => $s['banner_variant'] ?? '', 'position' => $s['banner_position'] ?? 'right' ] );
    }
    /**
     * Save the banner content fields (title, message, button labels, font sizes) from the
     * Cookie Banner → Content panel. Merge-safe: reads the existing settings and overwrites
     * ONLY the content keys, so unrelated settings (script blocking, duration, etc.) are kept.
     */
    public function ajax_save_content(): void {
        $this->verify_nonce();
        $s = (array) get_option( 'cookroco_settings', [] );
        if ( ! is_array( $s ) ) { $s = []; }
        // phpcs:disable WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Nonce checked in verify_nonce(); the array is unslashed here and every field is sanitized individually below.
        $r = isset( $_POST['content'] ) ? (array) wp_unslash( $_POST['content'] ) : [];
        // phpcs:enable WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
        $s['banner_title']       = sanitize_text_field( mb_substr( (string) ( $r['banner_title'] ?? '' ), 0, 80 ) );
        $s['banner_body']        = sanitize_textarea_field( mb_substr( (string) ( $r['banner_body'] ?? '' ), 0, 1000 ) );
        $s['btn_accept_text']    = sanitize_text_field( mb_substr( (string) ( $r['btn_accept_text'] ?? '' ), 0, 32 ) );
        $s['btn_reject_text']    = sanitize_text_field( mb_substr( (string) ( $r['btn_reject_text'] ?? '' ), 0, 32 ) );
        $s['btn_config_text']    = sanitize_text_field( mb_substr( (string) ( $r['btn_config_text'] ?? '' ), 0, 32 ) );
        $s['modal_title']        = sanitize_text_field( mb_substr( (string) ( $r['modal_title'] ?? '' ), 0, 80 ) );
        $s['modal_desc']         = sanitize_textarea_field( mb_substr( (string) ( $r['modal_desc'] ?? '' ), 0, 1000 ) );
        $s['show_reject_button'] = ! empty( $r['show_reject_button'] );
        $s['show_config_button'] = ! empty( $r['show_config_button'] );
        $s['title_size']         = max( 14, min( 22, intval( $r['title_size'] ?? 18 ) ) );
        $s['body_size']          = max( 11, min( 15, intval( $r['body_size'] ?? 12 ) ) );
        if ( array_key_exists( 'banner_font', $r ) ) {
            $fonts              = array_keys( self::font_choices() );
            $s['banner_font']   = in_array( (string) $r['banner_font'], $fonts, true ) ? (string) $r['banner_font'] : 'system';
        }
        if ( array_key_exists( 'banner_font_family', $r ) ) {
            $s['banner_font_family'] = sanitize_text_field( mb_substr( (string) $r['banner_font_family'], 0, 120 ) );
        }
        /**
         * Content fields an add-on adds to this panel (Cookie Rocket Pro: typography).
         *
         * @param array $s Settings about to be saved.
         * @param array $r Raw posted content, unslashed.
         */
        $s = (array) apply_filters( 'cookroco_sanitize_content', $s, $r );
        update_option( 'cookroco_settings', $s );
        wp_send_json_success( [ 'message' => __( 'Saved.', 'cookie-rocket' ) ] );
    }
    private function verify_nonce(): void {
        if (!current_user_can(self::CAP)) wp_send_json_error(['message'=>__('You do not have permission to change these settings.','cookie-rocket')],403);
        if (!wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['_nonce']??'')),'cookroco-admin')) wp_send_json_error(['message'=>__('This page has expired. Reload it and try again.','cookie-rocket')],403);
    }
    public function plugin_links( array $links ): array {
        $extra = ['<a href="'.esc_url(admin_url('admin.php?page='.self::SLUG)).'">'.esc_html__('Settings','cookie-rocket').'</a>'];
        if ( ! apply_filters( 'cookroco_pro_active', false ) ) {
            $extra[] = '<a href="' . esc_url( 'https://templatesrocket.com/cookie-rocket-pro?feature=pluginlist' ) . '" target="_blank" rel="noopener">'.esc_html__('Get Pro','cookie-rocket').'</a>';
        }
        return array_merge($extra,$links);
    }
}