<?php
namespace CustomFields;

defined( 'ABSPATH' ) || exit;

final class Admin {
    public static function boot() {
        add_action( 'admin_menu', array( __CLASS__, 'menu' ) );
        foreach ( array( 'save', 'delete', 'export', 'preview', 'import' ) as $action ) {
            add_action( 'admin_post_customfields_' . $action, array( __CLASS__, 'handle_' . $action ) );
        }
        add_action( 'wp_ajax_customfields_builder_save', array( __CLASS__, 'ajax_save' ) );
    }

    public static function menu() {
        add_menu_page( __( 'CustomFields.com', 'customfields-com' ), __( 'CustomFields.com', 'customfields-com' ), 'manage_options', 'customfields', array( __CLASS__, 'page' ), 'dashicons-feedback', 80 );
    }

    private static function require_schema_access() {
        if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'You cannot manage field schemas.', 'customfields-com' ), '', array( 'response' => 403 ) ); }
    }

    public static function fingerprint() {
        return hash( 'sha256', wp_json_encode( customfields_get_groups() ) );
    }

    private static function check_fingerprint( $value ) {
        if ( ! is_string( $value ) || ! hash_equals( self::fingerprint(), $value ) ) {
            wp_die( esc_html__( 'The schema changed in another session. Reload the editor or import preview before saving to avoid overwriting that work.', 'customfields-com' ), '', array( 'response' => 409, 'back_link' => true ) );
        }
    }

    private static function fail( $error ) {
        wp_die( esc_html( is_wp_error( $error ) ? $error->get_error_message() : (string) $error ), esc_html__( 'Schema not saved', 'customfields-com' ), array( 'response' => 400, 'back_link' => true ) );
    }

    private static function redirect( $status, $extra = array() ) {
        wp_safe_redirect( add_query_arg( array_merge( array( 'page' => 'customfields', 'cf_status' => $status ), $extra ), admin_url( 'admin.php' ) ) );
        exit;
    }

    public static function handle_save() {
        self::require_schema_access();
        $nonce = isset( $_POST['_wpnonce'] ) && is_string( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : '';
        if ( ! wp_verify_nonce( $nonce, 'customfields_save' ) ) {
            wp_die( esc_html__( 'Your session expired. Reload this page before continuing.', 'customfields-com' ), '', array( 'response' => 403 ) );
        }
        $saved = self::save_request( wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- save_request checks the unchanged schema proof, bounded complete-form shape, and Schema::validate_group/validate_groups before any write; generic text sanitation would corrupt structured defaults.
        if ( is_wp_error( $saved ) ) {
            $data = $saved->get_error_data();
            wp_die( esc_html( $saved->get_error_message() ), esc_html__( 'Schema not saved', 'customfields-com' ), array( 'response' => (int) ($data['status'] ?? 400), 'back_link' => true ) );
        }
        self::redirect( 'saved', array( 'edit' => $saved['group']['key'] ) );
    }

    public static function ajax_save() {
        if ( ! current_user_can( 'manage_options' ) ) {
            wp_send_json_error( array( 'code' => 'forbidden', 'message' => __( 'You cannot manage field schemas.', 'customfields-com' ) ), 403 );
        }
        $nonce = isset( $_POST['_wpnonce'] ) && is_string( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : '';
        if ( ! wp_verify_nonce( $nonce, 'customfields_save' ) ) {
            wp_send_json_error( array( 'code' => 'expired_nonce', 'message' => __( 'Your editing session expired. Keep this page open, sign in again in another tab, then reload before saving.', 'customfields-com' ) ), 403 );
        }
        $saved = self::save_request( wp_unslash( $_POST ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- save_request checks the unchanged schema proof, bounded complete-form shape, and Schema::validate_group/validate_groups before any write; generic text sanitation would corrupt structured defaults.
        if ( is_wp_error( $saved ) ) {
            $data = $saved->get_error_data();
            wp_send_json_error( array( 'code' => $saved->get_error_code(), 'message' => $saved->get_error_message() ), (int) ($data['status'] ?? 400) );
        }
        wp_send_json_success( array(
            'group' => $saved['group'],
            'schema_hash' => $saved['schema_hash'],
            'edit_url' => add_query_arg( array( 'page' => 'customfields', 'edit' => $saved['group']['key'] ), admin_url( 'admin.php' ) ),
            'message' => __( 'Field group saved. Your fields are ready to use.', 'customfields-com' ),
            'use_url' => Outcomes::guide_url($saved['group']['key']),
        ) );
    }

    /** Both transports share the same complete-form and full-registry validation. */
    private static function save_request( $request ) {
        global $wpdb;
        // Read the actual row, not a possibly stale object cache, before validating a whole-registry update.
        $row = $wpdb->get_row( $wpdb->prepare( "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s", 'customfields_groups' ), ARRAY_A ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Read authoritative workflow/metadata state for validation and conflict detection; cached values can miss concurrent edits or duplicate rows.
        if ( $wpdb->last_error ) { return new \WP_Error( 'schema_read', __( 'The field groups could not be read. Please try again.', 'customfields-com' ) ); }
        $before = $row ? maybe_unserialize( $row['option_value'] ) : array();
        if ( ! is_array( $before ) ) { return new \WP_Error( 'schema_storage', __( 'The saved field registry is not valid. Export or restore it before editing.', 'customfields-com' ) ); }
        $before = array_values( $before );
        $hash = $request['schema_hash'] ?? '';
        if ( ! is_string( $hash ) || ! hash_equals( hash( 'sha256', wp_json_encode( $before ) ), $hash ) ) { return self::save_conflict(); }
        if ( isset( $request['group_json'] ) ) {
            $json = $request['group_json'];
            if ( ! is_string( $json ) || strlen( $json ) > Schema::MAX_BYTES ) { return new \WP_Error( 'schema_size', __( 'The group exceeds the 1 MB schema limit.', 'customfields-com' ) ); }
            $raw = json_decode( $json, true, 24 );
            if ( JSON_ERROR_NONE !== json_last_error() ) { return new \WP_Error( 'schema_json', __( 'Invalid group JSON.', 'customfields-com' ) ); }
        } else {
            $raw = $request['group'] ?? array();
            $json = wp_json_encode( $raw );
            if ( false === $json || strlen( $json ) > Schema::MAX_BYTES ) { return new \WP_Error( 'schema_size', __( 'The group exceeds the 1 MB schema limit.', 'customfields-com' ) ); }
        }
        if ( ! is_array( $raw ) || ( $raw['complete'] ?? '' ) !== '1' ) { return new \WP_Error( 'schema_incomplete', __( 'The form was incomplete. Nothing was changed. Try fewer fields or increase the server max_input_vars setting.', 'customfields-com' ) ); }
        // A colon can be part of a JSON choice key, but the native "value : Label" textarea cannot represent it.
        foreach ( $before as $existing ) {
            if ( ! is_array( $existing ) || ( $existing['key'] ?? null ) !== ( $raw['key'] ?? null ) || ! is_array( $raw['fields'] ?? null ) || ! is_array( $existing['fields'] ?? null ) ) { continue; }
            foreach ( $raw['fields'] as $incoming_field ) {
                if ( ! is_array( $incoming_field ) || ! is_string( $incoming_field['choices'] ?? null ) ) { continue; }
                foreach ( $existing['fields'] ?? array() as $stored_field ) {
                    if ( ! is_array( $stored_field ) || ! is_array( $stored_field['choices'] ?? null ) ) { continue; }
                    if ( ( $stored_field['key'] ?? null ) !== ( $incoming_field['key'] ?? null ) && ( $stored_field['name'] ?? null ) !== ( $incoming_field['name'] ?? null ) ) { continue; }
                    foreach ( array_keys( $stored_field['choices'] ?? array() ) as $choice_key ) {
                        if ( false !== strpos( (string) $choice_key, ':' ) ) {
                            return new \WP_Error( 'schema_choice_text', __( 'This group contains choice values with colons. Use the JavaScript choice editor to preserve them. The text-only form cannot safely represent these values, so nothing was saved.', 'customfields-com' ) );
                        }
                    }
                }
            }
        }
        $group = Schema::validate_group( $raw );
        if ( is_wp_error( $group ) ) { return $group; }
        $groups = $before;
        $found = false;
        foreach ( $groups as $index => $existing ) {
            if ( $existing['key'] === $group['key'] ) { $groups[ $index ] = $group; $found = true; break; }
        }
        if ( ! $found ) { $groups[] = $group; }
        $valid = Schema::validate_groups( $groups );
        if ( is_wp_error( $valid ) ) { return $valid; }
        $written = self::compare_and_write( $valid, $before, $row );
        if ( is_wp_error( $written ) ) { return $written; }
        // Bind the next browser request to what this save wrote, even if another writer follows immediately.
        return array( 'group' => $group, 'schema_hash' => hash( 'sha256', wp_json_encode( $valid ) ) );
    }

    private static function save_conflict() {
        return new \WP_Error( 'schema_conflict', __( 'The schema changed in another session. Reload the editor before saving to avoid overwriting that work.', 'customfields-com' ), array( 'status' => 409 ) );
    }

    /** Atomic browser saves; public write() remains available to existing transaction-owning workflows. */
    private static function compare_and_write( $groups, $before, $row ) {
        global $wpdb;
        $name = 'customfields_groups';
        $groups = array_values( $groups );
        $serialized = maybe_serialize( $groups );
        if ( $row ) {
            do_action( 'update_option', $name, $before, $groups ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Intentionally emit the existing WordPress option lifecycle hook after the atomic option write.
            $changed = $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND BINARY option_value = BINARY %s", $serialized, $name, $row['option_value'] ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Atomic workflow write with explicit formats/prepared values; surrounding transaction performs cache invalidation after commit.
        } else {
            do_action( 'add_option', $name, $groups ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Intentionally emit the existing WordPress option lifecycle hook after the atomic option write.
            // INSERT IGNORE never replaces a row created after the initial read.
            $changed = $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')", $name, $serialized ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Atomic workflow write with explicit formats/prepared values; surrounding transaction performs cache invalidation after commit.
        }
        wp_cache_delete( $name, 'options' );
        wp_cache_delete( 'alloptions', 'options' );
        wp_cache_delete( 'notoptions', 'options' );
        if ( false === $changed ) { return new \WP_Error( 'schema_write', __( 'The field group could not be saved to the database. Your changes are still in this editor. Please try again.', 'customfields-com' ) ); }
        if ( 1 !== $changed ) {
            // MySQL reports zero affected rows for an unchanged value; verify that it is still the reviewed row.
            if ( ! $row || $serialized !== $row['option_value'] ) { return self::save_conflict(); }
            $current = $wpdb->get_var( $wpdb->prepare( "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s", $name ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Read authoritative workflow/metadata state for validation and conflict detection; cached values can miss concurrent edits or duplicate rows.
            if ( $wpdb->last_error ) { return new \WP_Error( 'schema_read', __( 'The saved field group could not be verified. Reload before trying again.', 'customfields-com' ) ); }
            if ( $current !== $serialized ) { return self::save_conflict(); }
        } elseif ( $row ) {
            do_action( 'update_option_' . $name, $before, $groups, $name ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Intentionally emit the existing WordPress option lifecycle hook after the atomic option write.
            do_action( 'updated_option', $name, $before, $groups ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Intentionally emit the existing WordPress option lifecycle hook after the atomic option write.
        } else {
            do_action( 'add_option_' . $name, $name, $groups ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Intentionally emit the existing WordPress option lifecycle hook after the atomic option write.
            do_action( 'added_option', $name, $groups ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Intentionally emit the existing WordPress option lifecycle hook after the atomic option write.
        }
        do_action( 'customfields_schema_saved', $groups, $before );
        return true;
    }

    /** Schema writes never delete, rename, or migrate content metadata. */
    public static function write( $groups ) {
        $before = customfields_get_groups();
        update_option( 'customfields_groups', array_values( $groups ), false );
        do_action( 'customfields_schema_saved', $groups, $before );
    }

    public static function handle_delete() {
        self::require_schema_access();
        $nonce = isset( $_POST['_wpnonce'] ) && is_string( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : '';
        if ( ! wp_verify_nonce( $nonce, 'customfields_delete' ) ) {
            wp_die( esc_html__( 'Your session expired. Reload this page before continuing.', 'customfields-com' ), '', array( 'response' => 403 ) );
        }
        self::check_fingerprint( isset( $_POST['schema_hash'] ) && is_string( $_POST['schema_hash'] ) ? filter_var( wp_unslash( $_POST['schema_hash'] ), FILTER_VALIDATE_REGEXP, array( 'options' => array( 'regexp' => '/^[a-f0-9]{64}$/D' ) ) ) : '' );
        $key = isset( $_POST['group_key'] ) && is_string( $_POST['group_key'] ) ? sanitize_text_field(wp_unslash( $_POST['group_key'] )) : '';
        $groups = array_values( array_filter( customfields_get_groups(), static function( $group ) use ( $key ) { return $group['key'] !== $key; } ) );
        self::write( $groups );
        self::redirect( 'deleted' );
    }

    public static function handle_export() {
        self::require_schema_access();
        $nonce = isset( $_GET['_wpnonce'] ) && is_string( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
        if ( ! wp_verify_nonce( $nonce, 'customfields_export' ) ) {
            wp_die( esc_html__( 'Your session expired. Reload this page before continuing.', 'customfields-com' ), '', array( 'response' => 403 ) );
        }
        nocache_headers();
        header( 'Content-Type: application/json; charset=utf-8' );
        header( 'Content-Disposition: attachment; filename="customfields-schema.json"' );
        header( 'X-Content-Type-Options: nosniff' );
        echo Schema::encode( customfields_get_groups() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- JSON download, not HTML.
        exit;
    }

    public static function handle_preview() {
        self::require_schema_access();
        $nonce = isset( $_POST['_wpnonce'] ) && is_string( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : '';
        if ( ! wp_verify_nonce( $nonce, 'customfields_preview' ) ) {
            wp_die( esc_html__( 'Your session expired. Reload this page before continuing.', 'customfields-com' ), '', array( 'response' => 403 ) );
        }
        $incoming = Schema::decode( isset( $_POST['schema_json'] ) && is_string( $_POST['schema_json'] ) ? wp_unslash( $_POST['schema_json'] ) : '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Schema::decode bounds the JSON and immediately runs Schema::validate_groups, which sanitizes labels, defaults and every typed field; text sanitation would corrupt schema content.
        if ( is_wp_error( $incoming ) ) { self::fail( $incoming ); }
        $by_key = array();
        foreach ( customfields_get_groups() as $group ) { $by_key[ $group['key'] ] = $group; }
        $changes = array();
        foreach ( $incoming as $group ) {
            $changes[] = array( 'title' => $group['title'], 'operation' => isset( $by_key[ $group['key'] ] ) ? 'replace' : 'add', 'fields' => count( $group['fields'] ) );
            $by_key[ $group['key'] ] = $group;
        }
        $merged = Schema::validate_groups( array_values( $by_key ) );
        if ( is_wp_error( $merged ) ) { self::fail( $merged ); }
        $token = wp_generate_password( 32, false, false );
        set_transient( 'customfields_import_' . get_current_user_id(), array( 'groups' => $merged, 'changes' => $changes, 'hash' => self::fingerprint(), 'token' => $token ), 15 * MINUTE_IN_SECONDS );
        self::redirect( 'preview', array( 'preview_token' => $token ) );
    }

    public static function handle_import() {
        self::require_schema_access();
        $nonce = isset( $_POST['_wpnonce'] ) && is_string( $_POST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) : '';
        if ( ! wp_verify_nonce( $nonce, 'customfields_import' ) ) {
            wp_die( esc_html__( 'Your session expired. Reload this page before continuing.', 'customfields-com' ), '', array( 'response' => 403 ) );
        }
        $preview = get_transient( 'customfields_import_' . get_current_user_id() );
        if ( ! is_array( $preview ) ) { self::fail( __( 'The preview expired. Validate the JSON again.', 'customfields-com' ) ); }
        if ( ! self::preview_matches( $preview, isset( $_POST['preview_token'] ) && is_string( $_POST['preview_token'] ) ? filter_var( wp_unslash( $_POST['preview_token'] ), FILTER_VALIDATE_REGEXP, array( 'options' => array( 'regexp' => '/^[a-zA-Z0-9]{32}$/D' ) ) ) : '' ) ) {
            self::fail( __( 'This import preview was replaced in another tab. Review and validate the intended JSON again.', 'customfields-com' ) );
        }
        self::check_fingerprint( $preview['hash'] );
        // Revalidate because an extension could have been disabled after the preview.
        $groups = Schema::validate_groups( $preview['groups'] );
        if ( is_wp_error( $groups ) ) { self::fail( $groups ); }
        self::write( $groups );
        delete_transient( 'customfields_import_' . get_current_user_id() );
        self::redirect( 'imported' );
    }

    public static function page() {
        if ( ! current_user_can( 'manage_options' ) ) { return; }
        $edit = isset( $_GET['edit'] ) && is_string( $_GET['edit'] ) ? sanitize_text_field( wp_unslash( $_GET['edit'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
        $status = isset( $_GET['cf_status'] ) && is_string( $_GET['cf_status'] ) ? sanitize_key( wp_unslash( $_GET['cf_status'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
        $messages = array( 'saved' => __( 'Field group saved. Existing content values were kept.', 'customfields-com' ), 'deleted' => __( 'Field group removed. Stored content values were kept.', 'customfields-com' ), 'imported' => __( 'Schema imported. Content values were not changed.', 'customfields-com' ) );
        echo '<div class="wrap cf-admin"><header class="cf-header cf-studio-header"><a class="cf-brand" href="' . esc_url( admin_url( 'admin.php?page=customfields' ) ) . '"><span class="cf-brand-mark" aria-hidden="true">{ }</span><span>' . esc_html__( 'CustomFields.com', 'customfields-com' ) . '<span class="cf-brand-subtitle">' . esc_html__( 'Content studio', 'customfields-com' ) . '</span></span></a><span class="cf-edition-pill">' . esc_html( Workspace::pro_available() ? __( 'Pro', 'customfields-com' ) : ( defined( 'CUSTOMFIELDS_PRO_VERSION' ) ? __( 'Pro · activate licence', 'customfields-com' ) : __( 'Free', 'customfields-com' ) ) ) . '</span><nav class="cf-header-actions" aria-label="' . esc_attr__( 'Schema tools', 'customfields-com' ) . '"><a class="button cf-export-button" href="' . esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=customfields_export' ), 'customfields_export' ) ) . '">' . esc_html__( 'Export JSON', 'customfields-com' ) . '</a>' . ( Workspace::pro_available() ? '<span class="cf-beta-label">' . esc_html__( 'Private beta', 'customfields-com' ) . '</span>' : '' ) . '</nav></header>';
        if ( isset( $messages[ $status ] ) ) { echo '<div class="notice notice-success is-dismissible"><p>' . esc_html( $messages[ $status ] ) . '</p></div>'; }
        if ( $edit ) {
            $group = array( 'key' => 'group_' . wp_generate_uuid4(), 'title' => '', 'target' => 'post', 'post_types' => array( 'post' ), 'fields' => array() );
            $found = 'new' === $edit;
            foreach ( customfields_get_groups() as $existing ) { if ( $existing['key'] === $edit ) { $group = $existing; $found = true; break; } }
            if ( $found ) { self::editor( $group ); }
            else { echo '<div class="notice notice-error"><p>' . esc_html__( 'The requested group does not exist.', 'customfields-com' ) . '</p></div>'; self::listing(); }
        } else {
            self::listing();
            self::import_panel( $status );
        }
        echo '<p class="cf-footer">' . esc_html__( 'Your content stays on this site. No account required for Free.', 'customfields-com' ) . '</p></div>';
    }

    private static function listing() {
        do_action('customfields_dashboard_top');
        $groups = customfields_get_groups();
        $new_url = admin_url( 'admin.php?page=customfields&edit=new' );
        echo '<section class="cf-dashboard-intro"><div><p class="cf-eyebrow">' . esc_html__( 'YOUR WORKSPACE', 'customfields-com' ) . '</p><h1>' . esc_html__( 'Field groups', 'customfields-com' ) . '</h1><p>' . esc_html__( 'Create fields, choose where they appear, then enter values in your WordPress content.', 'customfields-com' ) . '</p></div><a class="button button-primary cf-new-group" href="' . esc_url( $new_url ) . '"><span aria-hidden="true">+</span> ' . esc_html__( 'New field group', 'customfields-com' ) . '</a></section>';
        echo '<div class="cf-section-title cf-dashboard-tools"><h2>' . esc_html__( 'Field groups', 'customfields-com' ) . ' <span class="cf-count">' . count( $groups ) . '</span></h2><label class="cf-search"><span class="screen-reader-text">' . esc_html__( 'Find a field group', 'customfields-com' ) . '</span><input type="search" id="cf-group-search" placeholder="' . esc_attr__( 'Search groups…', 'customfields-com' ) . '"></label></div>';
        if ( ! $groups ) {
            echo '<section class="cf-empty cf-dashboard-empty"><span class="cf-empty-icon dashicons dashicons-layout" aria-hidden="true"></span><h2>' . esc_html__( 'Your first field group starts here.', 'customfields-com' ) . '</h2><p>' . esc_html__( 'A field group is a small collection of extra details. Try a project brief, event details, or a team profile.', 'customfields-com' ) . '</p><a class="button button-primary" href="' . esc_url( $new_url ) . '">' . esc_html__( 'Create a field group', 'customfields-com' ) . '</a></section>';
            return;
        }
        $targets = Schema::targets();
        $hash = self::fingerprint();
        echo '<div class="cf-group-grid cf-groups">';
        foreach ( $groups as $group ) {
            $target = $group['target'] ?? 'post';
            $location = $targets[ $target ] ?? $target;
            if ( 'post' === $target ) {
                $labels = array();
                foreach ( $group['post_types'] as $type ) { $object = get_post_type_object( $type ); $labels[] = $object ? $object->labels->name : $type; }
                $location = implode( ', ', $labels );
            } elseif ( 'term' === $target ) { $location = implode( ', ', $group['taxonomies'] ?? array() ); }
            $edit_url = add_query_arg( array( 'page' => 'customfields', 'edit' => $group['key'] ), admin_url( 'admin.php' ) );
            echo '<article class="cf-group-card" data-group-key="' . esc_attr( $group['key'] ) . '"><div class="cf-group-card-meta"><span class="cf-location-chip">' . esc_html( $location ) . '</span><span class="cf-field-count">' . esc_html( sprintf( /* translators: %s: Localized number of fields. */ _n( '%s field', '%s fields', count( $group['fields'] ), 'customfields-com' ), number_format_i18n( count( $group['fields'] ) ) ) ) . '</span></div><h3><a class="cf-group-title" href="' . esc_url( $edit_url ) . '">' . esc_html( $group['title'] ) . '</a></h3><div class="cf-group-field-tags" aria-label="' . esc_attr__( 'Fields in this group', 'customfields-com' ) . '">';
            foreach ( array_slice( $group['fields'], 0, 4 ) as $field ) { echo '<span>' . esc_html( $field['label'] ) . '</span>'; }
            if ( count( $group['fields'] ) > 4 ) { echo '<span>+' . ( count( $group['fields'] ) - 4 ) . '</span>'; }
            if ( ! $group['fields'] ) { echo '<span>' . esc_html__( 'Ready for your first field', 'customfields-com' ) . '</span>'; }
            echo '</div><footer class="cf-group-card-footer"><a class="cf-edit-group" href="' . esc_url( $edit_url ) . '">' . esc_html__( 'Edit group', 'customfields-com' ) . ' <span aria-hidden="true">→</span></a><form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" class="cf-delete-group">';
            wp_nonce_field( 'customfields_delete' );
            echo '<input type="hidden" name="action" value="customfields_delete"><input type="hidden" name="group_key" value="' . esc_attr( $group['key'] ) . '"><input type="hidden" name="schema_hash" value="' . esc_attr( $hash ) . '"><button type="submit" class="button-link-delete">' . esc_html__( 'Remove', 'customfields-com' ) . '<span class="screen-reader-text"> ' . esc_html( $group['title'] ) . '</span></button></form></footer></article>';
        }
        echo '</div><p class="description cf-schema-note">' . esc_html__( 'Removing a group keeps its saved content. Export JSON to keep a copy of your field definitions.', 'customfields-com' ) . '</p>';
    }

    /** Describe the current placement without requiring the settings panel to be open. */
    private static function editor_location_summary( $group ) {
        $target = $group['target'] ?? 'post';
        $targets = Schema::targets();
        $labels = array();
        foreach ( $target === 'post' ? ( $group['post_types'] ?? array() ) : ( $target === 'term' ? ( $group['taxonomies'] ?? array() ) : array() ) as $name ) {
            $object = $target === 'post' ? get_post_type_object( $name ) : get_taxonomy( $name );
            $labels[] = $object ? $object->labels->name : $name;
        }
        $summary = $labels ? implode( ', ', $labels ) : ( $targets[ $target ] ?? $target );
        if ( $target === 'post' && ( ! empty( $group['post_ids'] ) || ! empty( $group['page_templates'] ) ) ) { $summary .= ' · ' . __( 'Specific location rules', 'customfields-com' ); }
        return $summary;
    }

    private static function editor( $group ) {
        // Do not turn an unavailable extension's settings into a lossy core-only form.
        if ( $group['title'] ) {
            $compatible = Schema::validate_group( $group );
            if ( is_wp_error( $compatible ) ) {
                echo '<div class="notice notice-warning"><p>' . esc_html( $compatible->get_error_message() ) . '</p><p>' . esc_html__( 'The group is read-only until its schema can be fully understood. Export JSON to keep all definitions.', 'customfields-com' ) . '</p></div>';
                return;
            }
        }
        echo '<h1 class="screen-reader-text">' . esc_html__( 'Build your field group', 'customfields-com' ) . '</h1><div class="cf-workspace"><form id="cf-builder" class="cf-builder-main" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" method="post">';
        wp_nonce_field( 'customfields_save' );
        echo '<input type="hidden" name="action" value="customfields_save"><input type="hidden" name="schema_hash" value="' . esc_attr( self::fingerprint() ) . '"><input type="hidden" name="group[key]" value="' . esc_attr( $group['key'] ) . '"><div class="cf-studio-toolbar"><a class="cf-back-link" href="' . esc_url( admin_url( 'admin.php?page=customfields' ) ) . '"><span aria-hidden="true">←</span> ' . esc_html__( 'Field groups', 'customfields-com' ) . '</a><div class="cf-save-controls"><span id="cf-save-status" role="status" aria-live="polite">' . esc_html( $group['title'] ? __( 'All changes saved', 'customfields-com' ) : __( 'New field group', 'customfields-com' ) ) . '</span><button type="submit" class="button button-primary cf-save">' . esc_html__( 'Save group', 'customfields-com' ) . '</button></div></div><div id="cf-builder-errors" role="alert" hidden></div>';
        echo '<div id="cf-builder-next" class="cf-builder-next"' . ($group['title'] ? '' : ' hidden') . ' data-ready="' . esc_attr__('Your saved group is ready.', 'customfields-com') . '" data-dirty="' . esc_attr__('Save your changes before continuing.', 'customfields-com') . '"><span>' . esc_html__('Your saved group is ready.', 'customfields-com') . '</span><a href="' . esc_url(Outcomes::guide_url($group['key'])) . '" data-guide-url="' . esc_url(Outcomes::guide_url($group['key'])) . '" target="_blank" rel="noopener">' . esc_html__('Next: enter real values', 'customfields-com') . '<span class="screen-reader-text">' . esc_html__(' (opens in a new tab)', 'customfields-com') . '</span> →</a><noscript><small>' . esc_html__('This opens the last saved group. Save any edits first.', 'customfields-com') . '</small></noscript></div>';
        echo '<section class="cf-panel cf-title-panel"><label class="cf-label" for="cf-group-title">' . esc_html__( 'FIELD GROUP', 'customfields-com' ) . '</label><input id="cf-group-title" class="large-text cf-title-input" name="group[title]" maxlength="200" required value="' . esc_attr( $group['title'] ) . '" placeholder="' . esc_attr__( 'Give your group a name…', 'customfields-com' ) . '">' . ( $group['title'] ? '' : '<p class="description">' . esc_html__( 'For example: Project details or Team profile.', 'customfields-com' ) . '</p>' ) . '</section>';
        echo '<details id="cf-group-location" class="cf-group-location-settings"><summary><span class="cf-location-caption">' . esc_html__( 'Show on', 'customfields-com' ) . '</span><strong id="cf-location-summary" data-specific="' . esc_attr__( 'Specific location rules', 'customfields-com' ) . '">' . esc_html( self::editor_location_summary( $group ) ) . '</strong><span class="cf-location-change">' . esc_html__( 'Change', 'customfields-com' ) . '</span></summary><section class="cf-panel cf-location-panel"><label class="cf-label" for="cf-group-target">' . esc_html__( 'Content location', 'customfields-com' ) . '</label><select id="cf-group-target" name="group[target]">';
        $targets = Schema::targets();
        $target = $group['target'] ?? 'post';
        if ( ! isset( $targets[ $target ] ) ) { $targets[ $target ] = $target . ' (' . __( 'extension inactive', 'customfields-com' ) . ')'; }
        foreach ( $targets as $value => $label ) { echo '<option value="' . esc_attr( $value ) . '"' . selected( $target, $value, false ) . '>' . esc_html( $label ) . '</option>'; }
        echo '</select><fieldset id="cf-post-types"><legend class="cf-label">' . esc_html__( 'Content types', 'customfields-com' ) . '</legend><div class="cf-post-type-choices">';
        $post_types = get_post_types( array( 'show_ui' => true ), 'objects' );
        foreach ( $group['post_types'] as $type ) {
            if ( ! isset( $post_types[ $type ] ) ) { $post_types[ $type ] = (object) array( 'name' => $type, 'label' => $type . ' (' . __( 'not registered', 'customfields-com' ) . ')' ); }
        }
        foreach ( $post_types as $type ) {
            if ( in_array( $type->name, array( 'attachment', 'wp_block', 'wp_template', 'wp_template_part', 'wp_navigation', 'wp_font_family', 'wp_font_face' ), true ) ) { continue; }
            echo '<label class="cf-check cf-type-option"><input type="checkbox" name="group[post_types][]" value="' . esc_attr( $type->name ) . '"' . checked( in_array( $type->name, $group['post_types'], true ), true, false ) . '> ' . esc_html( $type->label ) . '</label>';
        }
        echo '</div><details class="cf-advanced-settings cf-location-advanced"><summary>' . esc_html__( 'Narrow to specific posts or templates', 'customfields-com' ) . '</summary><div class="cf-two-col"><label class="cf-label">' . esc_html__( 'Specific post IDs', 'customfields-com' ) . '<input class="widefat" name="group[post_ids]" value="' . esc_attr( implode( ', ', $group['post_ids'] ?? array() ) ) . '" placeholder="123, 456"></label><label class="cf-label">' . esc_html__( 'Page templates', 'customfields-com' ) . '<textarea class="widefat" rows="2" name="group[page_templates]" placeholder="templates/project.php">' . esc_textarea( implode( "\n", $group['page_templates'] ?? array() ) ) . '</textarea></label></div><p class="description">' . esc_html__( 'Optional. Separate IDs with commas and template filenames with new lines. When both are supplied, both must match.', 'customfields-com' ) . '</p></details></fieldset><fieldset id="cf-term-taxonomies"><legend class="cf-label">' . esc_html__( 'Taxonomies', 'customfields-com' ) . '</legend><div class="cf-post-type-choices">';
        $taxonomies = get_taxonomies( array( 'show_ui' => true ), 'objects' );
        foreach ( $group['taxonomies'] ?? array() as $tax ) { if ( ! isset( $taxonomies[$tax] ) ) { $taxonomies[$tax] = (object) array( 'name' => $tax, 'label' => $tax ); } }
        foreach ( $taxonomies as $tax ) { echo '<label class="cf-check cf-type-option"><input type="checkbox" name="group[taxonomies][]" value="' . esc_attr( $tax->name ) . '"' . checked( in_array( $tax->name, $group['taxonomies'] ?? array(), true ), true, false ) . '> ' . esc_html( $tax->label ) . '</label>'; }
        echo '</div></fieldset>';
        echo '</section></details><div class="cf-section-title cf-fields-title"><div><h2>' . esc_html__( 'Your fields', 'customfields-com' ) . ' <span id="cf-fields-count" class="cf-count">' . count( $group['fields'] ) . '</span></h2><p class="description">' . esc_html__( 'Add a field, edit its settings, or drag to reorder.', 'customfields-com' ) . '</p></div><button type="button" class="button cf-add-field"><span aria-hidden="true">+</span> ' . esc_html__( 'Add field', 'customfields-com' ) . '</button></div><div class="cf-builder-tools"><label class="cf-search"><span class="screen-reader-text">' . esc_html__( 'Find a field', 'customfields-com' ) . '</span><input type="search" id="cf-field-search" placeholder="' . esc_attr__( 'Find a field…', 'customfields-com' ) . '"></label><button type="button" class="button cf-collapse-all">' . esc_html__( 'Collapse all', 'customfields-com' ) . '</button></div><section id="cf-starter-kits" class="cf-starter-kits" aria-label="' . esc_attr__( 'Starter kits', 'customfields-com' ) . '"' . ( $group['fields'] ? ' hidden' : '' ) . '></section><section id="cf-builder-empty" class="cf-empty cf-builder-empty"' . ( $group['fields'] ? ' hidden' : '' ) . '><span class="dashicons dashicons-plus-alt2" aria-hidden="true"></span><h3>' . esc_html__( 'Add your first field', 'customfields-com' ) . '</h3><p>' . esc_html__( 'Start with a ready-made kit above, or add your first field.', 'customfields-com' ) . '</p><button type="button" class="button button-primary cf-add-field">' . esc_html__( 'Choose a field type', 'customfields-com' ) . '</button></section><div id="cf-fields">';
        foreach ( $group['fields'] as $index => $field ) { self::field_editor( $field, $index ); }
        echo '</div><button type="button" class="button cf-add-field cf-add-bottom">+ ' . esc_html__( 'Add another field', 'customfields-com' ) . '</button><button type="button" id="cf-undo-remove" class="button cf-undo-remove" hidden>' . esc_html__( 'Undo remove', 'customfields-com' ) . '</button>';
        echo '<details id="cf-group-advanced" class="cf-group-advanced"><summary><strong>' . esc_html__( 'Storage & group options', 'customfields-com' ) . '</strong><span id="cf-storage-summary">' . esc_html( ( $group['storage'] ?? 'metadata' ) === 'custom_table' ? __( 'Custom table + compatibility mirror', 'customfields-com' ) : __( 'WordPress metadata', 'customfields-com' ) ) . '</span></summary><p class="description">' . esc_html__( 'The default storage works for ordinary field groups. Change it only when you have prepared a different storage setup.', 'customfields-com' ) . '</p>';
        do_action( 'customfields_group_editor_settings', $group );
        echo '</details><p class="screen-reader-text" id="cf-builder-status" role="status" aria-live="polite"></p><input type="hidden" name="group[complete]" value="1"><noscript><p class="notice notice-info">' . esc_html__( 'JavaScript is needed to add, reorder, or preview fields. Existing fields can still be edited and saved using this form. Storage keys are in each field’s advanced settings.', 'customfields-com' ) . '</p></noscript></form>';
        echo '<aside id="cf-live-preview" class="cf-live-preview cf-preview-panel"><div class="cf-preview-heading"><div><p class="cf-eyebrow">' . esc_html__( 'TRY IT OUT', 'customfields-com' ) . '</p><h2>' . esc_html__( 'Live preview', 'customfields-com' ) . '</h2></div><span class="cf-preview-dot" aria-hidden="true"></span></div><p class="cf-preview-description">' . esc_html__( 'Try the fields with sample values. These values are never saved.', 'customfields-com' ) . '</p><div id="cf-preview-fields"><p class="cf-preview-empty">' . esc_html__( 'Your fields will appear here as you build.', 'customfields-com' ) . '</p></div><button type="button" class="button-link cf-reset-preview">' . esc_html__( 'Reset preview', 'customfields-com' ) . '</button><details class="cf-preview-help"><summary>' . esc_html__( 'How to use your fields', 'customfields-com' ) . '</summary><p>' . esc_html__( 'Save the group, then open the content you selected above to enter real values.', 'customfields-com' ) . '</p><p>' . esc_html__( 'Display a value with the Custom Field block, a shortcode, or your theme.', 'customfields-com' ) . '</p><code>[customfield name="field_name"]</code></details></aside></div><form id="cf-preview-form" class="cf-preview-form" aria-hidden="true" hidden></form><dialog id="cf-field-picker" class="cf-field-picker" aria-labelledby="cf-picker-title"><div class="cf-picker-heading"><div><p class="cf-eyebrow">' . esc_html__( 'BUILD YOUR CONTENT', 'customfields-com' ) . '</p><h2 id="cf-picker-title">' . esc_html__( 'Choose a field type', 'customfields-com' ) . '</h2></div><button type="button" class="button cf-close-picker" aria-label="' . esc_attr__( 'Close field picker', 'customfields-com' ) . '">×</button></div><label class="cf-search"><span class="screen-reader-text">' . esc_html__( 'Search field types', 'customfields-com' ) . '</span><input id="cf-picker-search" type="search" placeholder="' . esc_attr__( 'Search field types…', 'customfields-com' ) . '"></label><div id="cf-picker-grid" class="cf-picker-grid"></div></dialog><template id="cf-field-template">';
        self::field_editor( array( 'key' => '__FIELD_KEY__', 'label' => '', 'name' => '', 'type' => 'text', 'required' => false, 'instructions' => '', 'choices' => array(), 'default' => '' ), '__INDEX__' );
        echo '</template>';
    }

    private static function field_editor( $field, $index ) {
        $prefix = 'group[fields][' . $index . ']';
        $id = 'cf-editor-' . $index;
        $expanded = 0 === $index || '__INDEX__' === $index;
        $choices = array();
        foreach ( $field['choices'] as $key => $label ) { $choices[] = $key . ' : ' . $label; }
        $types = Fields::types();
        if ( ! isset( $types[ $field['type'] ] ) ) { $types[ $field['type'] ] = $field['type'] . ' (' . __( 'extension inactive', 'customfields-com' ) . ')'; }
        echo '<section class="cf-field-card' . ( $expanded ? ' is-expanded' : '' ) . '" data-field-key="' . esc_attr( $field['key'] ) . '"><header class="cf-field-header"><button type="button" class="cf-drag-field" aria-label="' . esc_attr__( 'Drag to reorder field. Use the move buttons for keyboard reordering.', 'customfields-com' ) . '"><span aria-hidden="true">⠿</span></button><div class="cf-field-summary"><strong class="cf-field-heading">' . esc_html( $field['label'] ?: __( 'Untitled field', 'customfields-com' ) ) . '</strong><span class="cf-field-type-badge">' . esc_html( $types[ $field['type'] ] ) . '</span></div><div class="cf-field-actions"><button type="button" class="button cf-toggle-field" aria-expanded="' . ( $expanded ? 'true' : 'false' ) . '" aria-controls="' . esc_attr( $id . '-settings' ) . '">' . esc_html( $expanded ? __( 'Done', 'customfields-com' ) : __( 'Edit', 'customfields-com' ) ) . '</button><button type="button" class="button cf-duplicate-field" aria-label="' . esc_attr__( 'Duplicate field', 'customfields-com' ) . '"><span class="dashicons dashicons-admin-page" aria-hidden="true"></span><span class="screen-reader-text">' . esc_html__( 'Duplicate', 'customfields-com' ) . '</span></button><button type="button" class="button cf-move-up" aria-label="' . esc_attr__( 'Move field up', 'customfields-com' ) . '">↑</button><button type="button" class="button cf-move-down" aria-label="' . esc_attr__( 'Move field down', 'customfields-com' ) . '">↓</button><button type="button" class="button-link-delete cf-remove-field" aria-label="' . esc_attr__( 'Remove field', 'customfields-com' ) . '"><span class="dashicons dashicons-trash" aria-hidden="true"></span><span class="screen-reader-text">' . esc_html__( 'Remove', 'customfields-com' ) . '</span></button></div></header><div id="' . esc_attr( $id . '-settings' ) . '" class="cf-field-settings"' . ( $expanded ? '' : ' hidden' ) . '><input type="hidden" name="' . esc_attr( $prefix . '[key]' ) . '" value="' . esc_attr( $field['key'] ) . '"><div class="cf-two-col cf-field-basics"><div><label class="cf-label" for="' . esc_attr( $id . '-label' ) . '">' . esc_html__( 'Field label', 'customfields-com' ) . '</label><input class="widefat cf-field-label" id="' . esc_attr( $id . '-label' ) . '" name="' . esc_attr( $prefix . '[label]' ) . '" maxlength="200" required value="' . esc_attr( $field['label'] ) . '" placeholder="' . esc_attr__( 'e.g. Project name', 'customfields-com' ) . '"></div><div><label class="cf-label" for="' . esc_attr( $id . '-type' ) . '">' . esc_html__( 'Field type', 'customfields-com' ) . '</label><select class="widefat cf-field-type" id="' . esc_attr( $id . '-type' ) . '" name="' . esc_attr( $prefix . '[type]' ) . '">';
        foreach ( $types as $type => $label ) { echo '<option value="' . esc_attr( $type ) . '"' . selected( $field['type'], $type, false ) . '>' . esc_html( $label ) . '</option>'; }
        echo '</select></div></div><div class="cf-choice-setting"><label class="cf-label" for="' . esc_attr( $id . '-choices' ) . '">' . esc_html__( 'Choices', 'customfields-com' ) . '</label><textarea class="widefat" rows="4" id="' . esc_attr( $id . '-choices' ) . '" name="' . esc_attr( $prefix . '[choices]' ) . '" data-choices-json="' . esc_attr( wp_json_encode( $field['choices'] ) ) . '">' . esc_textarea( implode( "\n", $choices ) ) . '</textarea><p class="description">' . esc_html__( 'One per line, written as value : Label.', 'customfields-com' ) . '</p></div><label class="cf-check cf-required-setting"><input type="checkbox" name="' . esc_attr( $prefix . '[required]' ) . '" value="1"' . checked( $field['required'], true, false ) . '> ' . esc_html__( 'Make this a required field', 'customfields-com' ) . '</label><details class="cf-advanced-settings"><summary>' . esc_html__( 'Storage key, defaults & validation', 'customfields-com' ) . '</summary><div class="cf-two-col"><div><label class="cf-label" for="' . esc_attr( $id . '-name' ) . '">' . esc_html__( 'Storage key', 'customfields-com' ) . '</label><input class="widefat cf-field-name" id="' . esc_attr( $id . '-name' ) . '" name="' . esc_attr( $prefix . '[name]' ) . '" maxlength="64" pattern="[a-z][a-z0-9_]*" required value="' . esc_attr( $field['name'] ) . '"><p class="description">' . esc_html__( 'Generated from the label. Changing an existing key does not move saved content.', 'customfields-com' ) . '</p></div><div class="cf-default-setting"><label class="cf-label" for="' . esc_attr( $id . '-default' ) . '">' . esc_html__( 'Default value', 'customfields-com' ) . '</label><textarea rows="2" class="widefat cf-field-default" id="' . esc_attr( $id . '-default' ) . '" name="' . esc_attr( $prefix . '[default]' ) . '">' . esc_textarea( is_scalar( $field['default'] ) ? (string) $field['default'] : ( in_array( $field['type'], array( 'multiselect', 'checkboxes' ), true ) ? implode( "\n", $field['default'] ) : wp_json_encode( $field['default'] ) ) ) . '</textarea><p class="description cf-default-hint">' . esc_html__( 'Checkbox: 1 or 0. Multiple choices: one value per line. References: an existing item ID. Defaults apply only when no value is stored.', 'customfields-com' ) . '</p></div></div><label class="cf-label" for="' . esc_attr( $id . '-instructions' ) . '">' . esc_html__( 'Help text for editors', 'customfields-com' ) . '</label><textarea class="widefat" rows="2" maxlength="2000" id="' . esc_attr( $id . '-instructions' ) . '" name="' . esc_attr( $prefix . '[instructions]' ) . '" placeholder="' . esc_attr__( 'A useful hint, if this field needs one.', 'customfields-com' ) . '">' . esc_textarea( $field['instructions'] ) . '</textarea>';
        echo '<fieldset class="cf-number-setting"' . ( 'number' === $field['type'] ? '' : ' hidden disabled' ) . '><legend class="cf-label">' . esc_html__( 'Number limits', 'customfields-com' ) . '</legend><div class="cf-two-col">';
        foreach ( array( 'min' => __( 'Minimum', 'customfields-com' ), 'max' => __( 'Maximum', 'customfields-com' ), 'step' => __( 'Step (or any)', 'customfields-com' ) ) as $setting => $label ) { echo '<label>' . esc_html( $label ) . '<input class="widefat" name="' . esc_attr( $prefix . '[' . $setting . ']' ) . '" value="' . esc_attr( $field[$setting] ?? ( 'step' === $setting ? 'any' : '' ) ) . '"></label>'; }
        echo '</div></fieldset><fieldset class="cf-length-setting"' . ( in_array( $field['type'], array( 'text', 'textarea', 'email', 'url', 'wysiwyg' ), true ) ? '' : ' hidden disabled' ) . '><legend class="cf-label">' . esc_html__( 'Text length', 'customfields-com' ) . '</legend><div class="cf-two-col">';
        foreach ( array( 'minlength' => __( 'Minimum characters', 'customfields-com' ), 'maxlength' => __( 'Maximum characters', 'customfields-com' ) ) as $setting => $label ) { echo '<label>' . esc_html( $label ) . '<input class="widefat" type="number" min="0" max="100000" name="' . esc_attr( $prefix . '[' . $setting . ']' ) . '" value="' . esc_attr( $field[$setting] ?? '' ) . '"></label>'; }
        echo '</div></fieldset><fieldset class="cf-post-reference-setting"' . ( 'post' === $field['type'] ? '' : ' hidden disabled' ) . '><legend class="cf-label">' . esc_html__( 'Allowed post types (comma separated)', 'customfields-com' ) . '</legend><input class="widefat" name="' . esc_attr( $prefix . '[post_types]' ) . '" value="' . esc_attr( implode( ', ', $field['post_types'] ?? array( 'post' ) ) ) . '"></fieldset><fieldset class="cf-taxonomy-reference-setting"' . ( 'taxonomy' === $field['type'] ? '' : ' hidden disabled' ) . '><legend class="cf-label">' . esc_html__( 'Taxonomy name', 'customfields-com' ) . '</legend><input class="widefat" name="' . esc_attr( $prefix . '[taxonomy]' ) . '" value="' . esc_attr( $field['taxonomy'] ?? 'category' ) . '"></fieldset>';
        echo '</details>';
        do_action( 'customfields_field_editor_settings', $field, $prefix );
        echo '</div></section>';
    }

    private static function import_panel( $status ) {
        $preview = 'preview' === $status ? get_transient( 'customfields_import_' . get_current_user_id() ) : false;
        $token = isset( $_GET['preview_token'] ) && is_string( $_GET['preview_token'] ) ? sanitize_text_field(wp_unslash( $_GET['preview_token'] )) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only, user-bound preview.
        if ( is_array( $preview ) && ! self::preview_matches( $preview, $token ) ) {
            echo '<div class="notice notice-warning"><p>' . esc_html__( 'This import preview has been replaced by a newer preview. Validate the intended JSON again.', 'customfields-com' ) . '</p></div>';
            $preview = false;
        }
        if ( is_array( $preview ) ) {
            echo '<section class="cf-panel cf-import"><h2>' . esc_html__( 'Review import', 'customfields-com' ) . '</h2><p>' . esc_html__( 'Groups with matching keys will have their definitions replaced. Other groups and all content values will be kept.', 'customfields-com' ) . '</p><ul>';
            foreach ( $preview['changes'] as $change ) {
                echo '<li><strong>' . esc_html( 'replace' === $change['operation'] ? __( 'Replace', 'customfields-com' ) : __( 'Add', 'customfields-com' ) ) . ':</strong> ' . esc_html( $change['title'] ) . ' (' . intval( $change['fields'] ) . ' ' . esc_html__( 'fields', 'customfields-com' ) . ')</li>';
            }
            echo '</ul><form action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" method="post"><input type="hidden" name="action" value="customfields_import">';
            wp_nonce_field( 'customfields_import' );
            echo '<input type="hidden" name="preview_token" value="' . esc_attr( $preview['token'] ) . '">';
            submit_button( __( 'Apply reviewed import', 'customfields-com' ), 'primary', 'submit', false );
            echo '</form></section>';
        }
        echo '<details class="cf-panel cf-import"><summary>' . esc_html__( 'Import a CustomFields.com JSON schema', 'customfields-com' ) . '</summary><p>' . esc_html__( 'Paste a CustomFields.com export. Validation and a review screen come before any changes. This imports field definitions, not content values.', 'customfields-com' ) . '</p><form action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" method="post"><input type="hidden" name="action" value="customfields_preview">';
        wp_nonce_field( 'customfields_preview' );
        echo '<label class="screen-reader-text" for="cf-schema-json">' . esc_html__( 'Schema JSON', 'customfields-com' ) . '</label><textarea class="widefat code" id="cf-schema-json" name="schema_json" rows="10" required maxlength="1048576" spellcheck="false"></textarea>';
        submit_button( __( 'Validate and preview', 'customfields-com' ), 'secondary' );
        echo '</form></details>';
    }

    public static function preview_matches( $preview, $token ) {
        return is_array( $preview ) && isset( $preview['token'] ) && is_string( $preview['token'] ) && is_string( $token ) && hash_equals( $preview['token'], $token );
    }
}