<?php
/**
 * Plugin Name:       Delmora
 * Description:      Shows your website in Delmora: visitors and where they came from, the AI assistants and search engines that read your pages, and every form filled in as a new contact.
 * Version:           0.5.0
 * Requires at least: 6.3
 * Requires PHP:      7.4
 * Author:            Delmora
 * Author URI:        https://delmora.ai
 * License:           GPL-2.0-or-later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain:       delmora
 *
 * Room 10h, D3 (docs/build/rooms/10h-builder-paths.md). The plugin carries
 * the company's Delmora site tag:
 *  - people and forms: the tag's script on every page (it runs in the
 *    visitor's browser, so page caches and a switched-off REST API don't stop it);
 *  - forms again, from the form plugins on the server (from 0.5.0), so a
 *    visitor who blocks trackers still becomes a lead;
 *  - AI assistants and search engines, which never run scripts: seen here,
 *    on the site's own server, and reported to the same Delmora address
 *    without waiting for an answer. Nothing is written to the database per
 *    visit. A page served from a page cache never reaches PHP, so behind
 *    one the crawler count is partial.
 */

if (!defined('ABSPATH')) {
	exit;
}

define('DELMORA_VERSION', '0.5.0');
define('DELMORA_OPTION', 'delmora_site_key');

/** Where the tag lives. A test site points it elsewhere in wp-config.php. */
function delmora_origin() {
	return defined('DELMORA_TAG_ORIGIN') ? untrailingslashit(DELMORA_TAG_ORIGIN) : 'https://t.delmora.ai';
}

/** Delmora itself, where Connect sends the admin. A test site points it elsewhere in wp-config.php. */
function delmora_app() {
	return defined('DELMORA_APP_ORIGIN') ? untrailingslashit(DELMORA_APP_ORIGIN) : 'https://delmora.ai';
}

/** The saved site key, or '' when none is saved. */
function delmora_key() {
	$key = (string) get_option(DELMORA_OPTION, '');
	return preg_match('/^[a-z0-9]{24}$/', $key) ? $key : '';
}

/** The key from what was pasted: the whole line Delmora shows, its address, or the key alone. */
function delmora_parse_key($input) {
	$input = trim((string) $input);
	if (preg_match('#/s/([a-z0-9]{24})\.js#', $input, $match)) {
		return $match[1];
	}
	$input = strtolower($input);
	return preg_match('/^[a-z0-9]{24}$/', $input) ? $input : '';
}

/* People and forms: the site tag on every page. -------------------------- */

add_action('wp_enqueue_scripts', function () {
	$key = delmora_key();
	if ($key === '') {
		return;
	}
	wp_enqueue_script('delmora-tag', delmora_origin() . '/s/' . $key . '.js', array(), DELMORA_VERSION, array('strategy' => 'async', 'in_footer' => false));
});

/* AI assistants and search engines: seen on the server. ------------------ */

/**
 * The crawlers Delmora names, by a word in their user agent (the same list
 * as Delmora's own, edge/powers.js); Delmora checks again before counting.
 */
function delmora_is_crawler($user_agent) {
	if ($user_agent === '') {
		return false;
	}
	$tokens = array(
		'GPTBot', 'ChatGPT-User', 'OAI-SearchBot', 'ClaudeBot', 'Claude-User', 'Claude-SearchBot', 'anthropic-ai',
		'PerplexityBot', 'Perplexity-User', 'Google-Extended', 'Google-CloudVertexBot', 'Applebot',
		'Meta-ExternalAgent', 'Meta-ExternalFetcher', 'FacebookBot', 'Bytespider', 'CCBot', 'Amazonbot', 'DuckAssistBot',
		'MistralAI-User', 'cohere-ai', 'YouBot',
		'Googlebot', 'Google-InspectionTool', 'bingbot', 'DuckDuckBot', 'YandexBot', 'Baiduspider', 'Slurp',
	);
	foreach ($tokens as $token) {
		if (stripos($user_agent, $token) !== false) {
			return true;
		}
	}
	return false;
}

/** A page the site served to a reader: a GET that answered with HTML, outside the admin, feeds and APIs. */
function delmora_is_page_view() {
	if (is_admin() || wp_doing_ajax() || wp_doing_cron() || (defined('REST_REQUEST') && REST_REQUEST) || is_feed() || is_robots()) {
		return false;
	}
	if (!isset($_SERVER['REQUEST_METHOD']) || $_SERVER['REQUEST_METHOD'] !== 'GET') {
		return false;
	}
	$status = http_response_code();
	if (!(($status >= 200 && $status < 300) || $status === 304)) {
		return false;
	}
	foreach (headers_list() as $header) {
		if (stripos($header, 'content-type:') === 0 && stripos($header, 'text/html') === false) {
			return false;
		}
	}
	return true;
}

add_action('shutdown', function () {
	$key = delmora_key();
	$user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? substr(sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])), 0, 500) : '';
	if ($key === '' || !delmora_is_crawler($user_agent) || !delmora_is_page_view()) {
		return;
	}
	$host = isset($_SERVER['HTTP_HOST']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])) : (string) wp_parse_url(home_url(), PHP_URL_HOST);
	$path = isset($_SERVER['REQUEST_URI']) ? esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])) : '/';
	$page = (is_ssl() ? 'https://' : 'http://') . $host . $path;
	// Sent without waiting for an answer: the crawler's page is never slowed down.
	wp_remote_post(delmora_origin() . '/c/' . $key, array(
		'blocking' => false,
		'timeout'  => 1,
		'headers'  => array('Content-Type' => 'text/plain'),
		'body'     => wp_json_encode(array('u' => substr($page, 0, 800), 'a' => $user_agent)),
	));
});

/* Forms, from the form plugins themselves (from 0.5.0). ------------------ */

/*
 * Each form plugin's own "entry received" hook hands the entry to Delmora from
 * the site's server, so a visitor whose browser blocks trackers still becomes
 * a lead: the form plugin's own connection, never a way around the blocker
 * (Nate, 2026-10-27). The tag's script stamps each form it sees sent with
 * the id it gives the entry (a hidden "_delmora" field, on sites with this
 * plugin only), so its copy and this one are one entry in Delmora, whichever
 * arrives first.
 */

// Tells the tag's script to stamp forms here.
add_filter('script_loader_tag', function ($tag, $handle) {
	return $handle === 'delmora-tag' ? preg_replace('/<script /', '<script data-delmora-forms="server" ', $tag, 1) : $tag;
}, 10, 2);

/** What the tag's script stamped on the form: the entry's id, where the visitor came from, the page. */
function delmora_stamp($raw = null) {
	if ($raw === null) {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- read inside the form plugin's own handler, which checked its nonce; JSON, each value checked or sanitized once decoded.
		$raw = isset($_POST['_delmora']) ? wp_unslash($_POST['_delmora']) : '';
	}
	$value = is_string($raw) ? json_decode($raw, true) : null;
	if (!is_array($value) && is_string($raw)) {
		// A form plugin that hands the posted fields on still slashed.
		$value = json_decode(wp_unslash($raw), true);
	}
	if (!is_array($value)) {
		return array();
	}
	$stamp = array();
	if (isset($value['i']) && is_string($value['i']) && preg_match('/^[a-z0-9]{6,64}$/', $value['i'])) {
		$stamp['id'] = $value['i'];
	}
	if (isset($value['p']) && is_string($value['p'])) {
		$stamp['page'] = esc_url_raw(substr($value['p'], 0, 500));
	}
	if (isset($value['t']) && is_string($value['t'])) {
		$stamp['title'] = sanitize_text_field(substr($value['t'], 0, 200));
	}
	if (isset($value['s']) && is_array($value['s'])) {
		$source = array();
		foreach ($value['s'] as $name => $item) {
			if (preg_match('/^(utm_source|utm_medium|utm_campaign|utm_term|utm_content|fbclid|gclid|msclkid|ttclid|referrer|landing|at)$/', (string) $name) && is_scalar($item)) {
				$source[$name] = is_string($item) ? sanitize_text_field(substr($item, 0, 300)) : $item;
			}
		}
		if ($source) {
			$stamp['source'] = $source;
		}
	}
	return $stamp;
}

/**
 * One entry to Delmora, in the shape the tag's script sends: each field's
 * name, type, label and value. Passwords, card numbers, files and security
 * tokens are never sent.
 */
function delmora_send_form($form, $fields, $stamp = null) {
	static $sent = array();
	$key = delmora_key();
	if ($key === '') {
		return;
	}
	$stamp = is_array($stamp) ? $stamp : delmora_stamp();
	$out   = array();
	foreach ($fields as $field) {
		$name  = substr((string) ($field['n'] ?? ''), 0, 100);
		$type  = strtolower(substr((string) ($field['t'] ?? ''), 0, 20));
		$label = substr(trim(wp_strip_all_tags((string) ($field['l'] ?? ''))), 0, 120);
		$value = $field['v'] ?? '';
		if (is_array($value)) {
			$parts = array_filter(array_map('strval', array_filter($value, 'is_scalar')), 'strlen');
			$value = implode(array_keys($value) === range(0, count($value) - 1) ? ', ' : ' ', $parts);
		}
		$value = trim((string) $value);
		if ($name === '' || $value === '' || preg_match('/^(password|file|fileupload|file-upload|upload|signature|captcha|recaptcha|hcaptcha|turnstile|honeypot|submit|html|divider|section|page|pagebreak|break|hr|acceptance|quiz)$/', $type)) {
			continue;
		}
		if (preg_match('/^cc-|card|cvv|cvc|iban|ssn|passw|token|nonce|captcha/i', $name . ' ' . $label)) {
			continue;
		}
		$out[] = array('n' => $name, 't' => $type === 'phone' ? 'tel' : $type, 'l' => $label, 'v' => substr($value, 0, 2000));
		if (count($out) >= 60) {
			break;
		}
	}
	if (!$out) {
		return;
	}
	// Once per entry in a request, however many of the plugin's hooks fire for it.
	$once = md5(wp_json_encode($out));
	if (isset($sent[$once])) {
		return;
	}
	$sent[$once] = true;
	$id = $stamp['id'] ?? strtolower(bin2hex(random_bytes(10)));
	$referer = wp_get_referer();
	$body    = array(
		'id'     => $id,
		'page'   => substr((string) ($stamp['page'] ?? ($referer ? $referer : home_url('/'))), 0, 500),
		'title'  => $stamp['title'] ?? '',
		'form'   => substr(wp_strip_all_tags((string) $form), 0, 200),
		'fields' => $out,
		'source' => $stamp['source'] ?? null,
	);
	// Waited for, unlike a crawler report: an entry is a lead. A few seconds at most.
	wp_remote_post(delmora_origin() . '/f/' . $key, array(
		'timeout'    => 5,
		'user-agent' => isset($_SERVER['HTTP_USER_AGENT']) ? substr(sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])), 0, 500) : '',
		'headers'    => array('Content-Type' => 'text/plain', 'X-Delmora-From' => 'wordpress'),
		'body'       => wp_json_encode($body),
	));
}

/** A label from a field's own name ("first_name" → "first name"), for form plugins that send names only. */
function delmora_words($name) {
	return trim(preg_replace('/[\s_\-\[\]]+/', ' ', (string) $name));
}

// Contact Form 7: sent, or saved but its email failed (the lead counts either way).
foreach (array('wpcf7_mail_sent', 'wpcf7_mail_failed') as $delmora_cf7_hook) {
	add_action($delmora_cf7_hook, function ($contact_form) {
		if (!class_exists('WPCF7_Submission') || !is_object($contact_form)) {
			return;
		}
		$submission = WPCF7_Submission::get_instance();
		$posted     = $submission ? $submission->get_posted_data() : array();
		$fields     = array();
		foreach ($contact_form->scan_form_tags() as $tag) {
			if ($tag->name !== '' && isset($posted[$tag->name])) {
				$fields[] = array('n' => $tag->name, 't' => $tag->basetype, 'l' => delmora_words($tag->name), 'v' => $posted[$tag->name]);
			}
		}
		delmora_send_form($contact_form->title(), $fields);
	});
}

// WPForms (Lite and Pro).
add_action('wpforms_process_complete', function ($fields, $entry, $form_data) {
	$out = array();
	foreach ((array) $fields as $id => $field) {
		$out[] = array('n' => 'wpforms-' . $id, 't' => $field['type'] ?? '', 'l' => $field['name'] ?? '', 'v' => $field['value'] ?? '');
	}
	delmora_send_form($form_data['settings']['form_title'] ?? '', $out);
}, 10, 3);

// Gravity Forms.
add_action('gform_after_submission', function ($entry, $form) {
	$out = array();
	foreach ((array) ($form['fields'] ?? array()) as $field) {
		if (is_object($field) && method_exists($field, 'get_value_export')) {
			$out[] = array('n' => 'input_' . $field->id, 't' => (string) $field->type, 'l' => (string) $field->label, 'v' => $field->get_value_export($entry, (string) $field->id, true));
		}
	}
	delmora_send_form($form['title'] ?? '', $out);
}, 10, 2);

// Elementor Pro forms.
add_action('elementor_pro/forms/new_record', function ($record) {
	if (!is_object($record) || !method_exists($record, 'get')) {
		return;
	}
	$out = array();
	foreach ((array) $record->get('fields') as $id => $field) {
		$out[] = array('n' => (string) ($field['id'] ?? $id), 't' => (string) ($field['type'] ?? ''), 'l' => (string) ($field['title'] ?? ''), 'v' => $field['value'] ?? '');
	}
	delmora_send_form((string) $record->get_form_settings('form_name'), $out);
});

// Ninja Forms (its forms send without the page's form, so they carry no stamp and the tag never sees them).
add_action('ninja_forms_after_submission', function ($form_data) {
	$out = array();
	foreach ((array) ($form_data['fields'] ?? array()) as $field) {
		$out[] = array('n' => (string) ($field['key'] ?? ''), 't' => (string) ($field['type'] ?? ''), 'l' => (string) ($field['label'] ?? ''), 'v' => $field['value'] ?? '');
	}
	delmora_send_form((string) ($form_data['settings']['title'] ?? ''), $out);
});

// Fluent Forms: names only; a name made of parts (first, last) is sent part by part.
function delmora_fluent_entry($entry_id, $form_data, $form) {
	$out = array();
	foreach ((array) $form_data as $name => $value) {
		if (strpos((string) $name, '_') === 0) {
			continue;
		}
		if (is_array($value) && $value && array_keys($value) !== range(0, count($value) - 1)) {
			foreach ($value as $part => $item) {
				$out[] = array('n' => $name . '[' . $part . ']', 't' => '', 'l' => delmora_words($part), 'v' => $item);
			}
			continue;
		}
		$out[] = array('n' => (string) $name, 't' => '', 'l' => delmora_words($name), 'v' => $value);
	}
	// Fluent sends the whole form as one string ("data") and keeps only its own fields, so the stamp is read from that string.
	$raw = isset($form_data['_delmora']) ? (string) $form_data['_delmora'] : '';
	// phpcs:disable WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- read inside Fluent's own handler, which checked its nonce; only the stamp is taken, and checked once decoded.
	if ($raw === '' && isset($_POST['data']) && is_string($_POST['data'])) {
		parse_str(wp_unslash($_POST['data']), $posted);
		// phpcs:enable
		$raw = isset($posted['_delmora']) && is_string($posted['_delmora']) ? $posted['_delmora'] : '';
	}
	delmora_send_form(is_object($form) && isset($form->title) ? $form->title : '', $out, delmora_stamp($raw));
}
// The hook was renamed in Fluent Forms 4.3; the old name still fires there, so only one is used.
add_action('plugins_loaded', function () {
	$old = defined('FLUENTFORM_VERSION') && version_compare(FLUENTFORM_VERSION, '4.3.0', '<');
	add_action($old ? 'fluentform_submission_inserted' : 'fluentform/submission_inserted', 'delmora_fluent_entry', 10, 3);
});

// Formidable Forms.
add_action('frm_after_create_entry', function ($entry_id, $form_id) {
	if (!class_exists('FrmEntry') || !class_exists('FrmField')) {
		return;
	}
	$entry = FrmEntry::getOne($entry_id, true);
	if (!$entry || empty($entry->metas)) {
		return;
	}
	$out = array();
	foreach (FrmField::get_all_for_form($form_id) as $field) {
		if (isset($entry->metas[$field->id])) {
			$out[] = array('n' => (string) $field->field_key, 't' => (string) $field->type, 'l' => (string) $field->name, 'v' => $entry->metas[$field->id]);
		}
	}
	$form = class_exists('FrmForm') ? FrmForm::getOne($form_id) : null;
	delmora_send_form($form ? $form->name : '', $out);
}, 30, 2);

/* Connect by signing in to Delmora. ------------------------------------- */

/**
 * After the admin approves Delmora in WordPress's own "Authorize application"
 * screen, Delmora calls this with the application password it was given, to
 * set the site tag. Only an administrator's password gets in.
 */
add_action('rest_api_init', function () {
	register_rest_route('delmora/v1', '/connect', array(
		'methods'             => 'POST',
		'permission_callback' => function () {
			return current_user_can('manage_options');
		},
		'args'                => array('site_key' => array('type' => 'string', 'required' => true)),
		'callback'            => function (WP_REST_Request $request) {
			$key = delmora_parse_key($request->get_param('site_key'));
			if ($key === '') {
				return new WP_Error('delmora_key', 'Not a Delmora site key.', array('status' => 400));
			}
			update_option(DELMORA_OPTION, $key);
			return array('connected' => true, 'version' => DELMORA_VERSION);
		},
	));
	// Removing the tag in Delmora clears it here too.
	register_rest_route('delmora/v1', '/connect', array(
		'methods'             => 'DELETE',
		'permission_callback' => function () {
			return current_user_can('manage_options');
		},
		'callback'            => function () {
			delete_option(DELMORA_OPTION);
			return array('connected' => false);
		},
	));
	register_rest_route('delmora/v1', '/status', array(
		'methods'             => 'GET',
		'permission_callback' => function () {
			return current_user_can('manage_options');
		},
		'callback'            => function () {
			return array('connected' => delmora_key() !== '', 'version' => DELMORA_VERSION, 'site' => home_url('/'));
		},
	));
});

/* Pages Delmora publishes (room 10j). -------------------------------------- */

// The page's search description, set by Delmora with the page.
add_action('init', function () {
	register_post_meta('page', 'delmora_description', array(
		'type'          => 'string',
		'single'        => true,
		'show_in_rest'  => true,
		'auth_callback' => function () {
			return current_user_can('edit_pages');
		},
	));
});

function delmora_page_description() {
	if (!is_singular('page')) {
		return '';
	}
	return (string) get_post_meta(get_queried_object_id(), 'delmora_description', true);
}

// Said through the SEO plugin the site has, else on its own.
add_filter('wpseo_metadesc', function ($text) { $own = delmora_page_description(); return $own !== '' ? $own : $text; });
add_filter('rank_math/frontend/description', function ($text) { $own = delmora_page_description(); return $own !== '' ? $own : $text; });
add_filter('aioseo_description', function ($text) { $own = delmora_page_description(); return $own !== '' ? $own : $text; });
add_action('wp_head', function () {
	if (defined('WPSEO_VERSION') || class_exists('RankMath') || defined('AIOSEO_VERSION')) {
		return;
	}
	$own = delmora_page_description();
	if ($own !== '') {
		echo '<meta name="description" content="' . esc_attr($own) . '">' . "\n";
	}
}, 2);

// IndexNow: Delmora tells search engines about each new page; the key file proves it may.
add_action('parse_request', function () {
	$key = (string) get_option('delmora_indexnow_key', '');
	if ($key === '' || !isset($_SERVER['REQUEST_URI'])) {
		return;
	}
	$path = (string) wp_parse_url(esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])), PHP_URL_PATH);
	if ($path === '/' . $key . '.txt') {
		header('Content-Type: text/plain; charset=utf-8');
		echo esc_html($key);
		exit;
	}
});

add_action('rest_api_init', function () {
	register_rest_route('delmora/v1', '/indexnow', array(
		'methods'             => 'POST',
		'permission_callback' => function () {
			return current_user_can('manage_options');
		},
		'args'                => array('key' => array('type' => 'string', 'required' => true)),
		'callback'            => function (WP_REST_Request $request) {
			$key = (string) $request->get_param('key');
			if (!preg_match('/^[a-f0-9]{32}$/', $key)) {
				return new WP_Error('delmora_indexnow', 'Not an IndexNow key.', array('status' => 400));
			}
			update_option('delmora_indexnow_key', $key);
			return array('saved' => true);
		},
	));
});

/*
 * Google's and Bing's verification tags (room 10g, from 0.4.0): Delmora puts the site in Google
 * Search Console and Bing Webmaster Tools under its own accounts and shows its searches in
 * Analytics; the engines check these two tags on the home page. Set and removed by Delmora only.
 */

add_action('rest_api_init', function () {
	register_rest_route('delmora/v1', '/verification', array(
		'methods'             => 'POST',
		'permission_callback' => function () {
			return current_user_can('manage_options');
		},
		'callback'            => function (WP_REST_Request $request) {
			$clean = function ($value) {
				$value = is_string($value) ? trim($value) : '';
				return preg_match('/^[A-Za-z0-9_\-=.+\/]{4,200}$/', $value) ? $value : '';
			};
			$tags = array('google' => $clean($request->get_param('google')), 'bing' => $clean($request->get_param('bing')));
			if ($tags['google'] === '' && $tags['bing'] === '') {
				delete_option('delmora_verification');
			} else {
				update_option('delmora_verification', $tags, true);
			}
			return array('saved' => true, 'tags' => $tags);
		},
	));
});

// Every page, before anything else in the head; whatever SEO plugin the site has.
add_action('wp_head', function () {
	$tags = get_option('delmora_verification', array());
	if (!is_array($tags)) {
		return;
	}
	if (!empty($tags['google'])) {
		echo '<meta name="google-site-verification" content="' . esc_attr($tags['google']) . '">' . "\n";
	}
	if (!empty($tags['bing'])) {
		echo '<meta name="msvalidate.01" content="' . esc_attr($tags['bing']) . '">' . "\n";
	}
}, 1);


/* What search engines and AI assistants need, where the site has none (room 10j, E2). */

add_action('rest_api_init', function () {
	$admin = function () {
		return current_user_can('manage_options');
	};
	register_rest_route('delmora/v1', '/fixes', array(
		array(
			'methods'             => 'POST',
			'permission_callback' => $admin,
			'callback'            => function (WP_REST_Request $request) {
				$fixes = $request->get_param('fixes');
				if (!is_array($fixes) || !isset($fixes['siteName']) || !is_array($fixes['org'] ?? null)) {
					return new WP_Error('delmora_fixes', 'Not Delmora fixes.', array('status' => 400));
				}
				update_option('delmora_fixes', array(
					'org'         => $fixes['org'],
					'description' => sanitize_text_field((string) ($fixes['description'] ?? '')),
					'image'       => esc_url_raw((string) ($fixes['image'] ?? '')),
					'siteName'    => sanitize_text_field((string) $fixes['siteName']),
					'llms'        => sanitize_textarea_field((string) ($fixes['llms'] ?? '')),
				), false);
				return array('saved' => true);
			},
		),
		array(
			'methods'             => 'DELETE',
			'permission_callback' => $admin,
			'callback'            => function () {
				delete_option('delmora_fixes');
				return array('removed' => true);
			},
		),
	));
});

function delmora_fixes() {
	$fixes = get_option('delmora_fixes', array());
	return is_array($fixes) && isset($fixes['siteName']) ? $fixes : null;
}

function delmora_has_seo_plugin() {
	return defined('WPSEO_VERSION') || class_exists('RankMath') || defined('AIOSEO_VERSION');
}

// The front page: the business for machines; and, without an SEO plugin (which says these itself), a description and a link preview.
add_action('wp_head', function () {
	$fixes = delmora_fixes();
	if (!$fixes || !is_front_page()) {
		return;
	}
	echo '<script type="application/ld+json">' . wp_json_encode($fixes['org'], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_HEX_TAG) . '</script>' . "\n";
	if (delmora_has_seo_plugin()) {
		return;
	}
	if ($fixes['description'] !== '') {
		echo '<meta name="description" content="' . esc_attr($fixes['description']) . '">' . "\n";
	}
	echo '<meta property="og:site_name" content="' . esc_attr($fixes['siteName']) . '">' . "\n";
	if ($fixes['image'] !== '') {
		echo '<meta property="og:image" content="' . esc_url($fixes['image']) . '">' . "\n";
	}
}, 3);

// llms.txt: answered here only when the site has no file of its own (a real file never reaches WordPress).
add_action('parse_request', function () {
	if (!isset($_SERVER['REQUEST_URI'])) {
		return;
	}
	$path = (string) wp_parse_url(esc_url_raw(wp_unslash($_SERVER['REQUEST_URI'])), PHP_URL_PATH);
	if ($path !== '/llms.txt') {
		return;
	}
	$fixes = delmora_fixes();
	if (!$fixes || $fixes['llms'] === '') {
		return;
	}
	header('Content-Type: text/plain; charset=utf-8');
	echo $fixes['llms']; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- plain text, sanitized when saved.
	exit;
}, 5);

/** Delmora's connect page, with this site and the way back to this settings page. */
function delmora_connect_url() {
	return add_query_arg(array(
		'site'  => home_url('/'),
		'admin' => admin_url('options-general.php?page=delmora'),
	), delmora_app() . '/connect/wordpress');
}

/* Settings → Delmora. ---------------------------------------------------- */

add_action('admin_init', function () {
	register_setting('delmora', DELMORA_OPTION, array(
		'type'              => 'string',
		'default'           => '',
		'sanitize_callback' => function ($input) {
			$key = delmora_parse_key($input);
			if ($key === '' && trim((string) $input) !== '') {
				add_settings_error(DELMORA_OPTION, 'delmora_key', __('That is not a Delmora site key. Copy the line from Delmora (Settings → Domains → Your site tag) and paste it here.', 'delmora'));
				return delmora_key();
			}
			return $key;
		},
	));
});

add_action('admin_menu', function () {
	add_options_page(__('Delmora', 'delmora'), __('Delmora', 'delmora'), 'manage_options', 'delmora', 'delmora_settings_page');
});

add_filter('plugin_action_links_' . plugin_basename(__FILE__), function ($links) {
	array_unshift($links, '<a href="' . esc_url(admin_url('options-general.php?page=delmora')) . '">' . esc_html__('Settings', 'delmora') . '</a>');
	return $links;
});

function delmora_settings_page() {
	if (!current_user_can('manage_options')) {
		return;
	}
	$key     = delmora_key();
	// phpcs:disable WordPress.Security.NonceVerification.Recommended -- only says how Delmora's connect page came back; changes nothing.
	$outcome = isset($_GET['delmora']) ? sanitize_key(wp_unslash($_GET['delmora'])) : '';
	$reason  = isset($_GET['reason']) ? sanitize_text_field(wp_unslash($_GET['reason'])) : '';
	// phpcs:enable
	?>
	<div class="wrap">
		<h1><?php esc_html_e('Delmora', 'delmora'); ?></h1>
		<?php if ($outcome === 'failed') : ?>
			<div class="notice notice-error inline"><p><strong><?php esc_html_e('Not connected.', 'delmora'); ?></strong> <?php echo esc_html($reason !== '' ? $reason : __('Something went wrong. Press Connect with Delmora again.', 'delmora')); ?></p></div>
		<?php elseif ($outcome === 'declined') : ?>
			<div class="notice notice-warning inline"><p><?php esc_html_e('You declined the connection in WordPress, so nothing changed.', 'delmora'); ?></p></div>
		<?php endif; ?>
		<?php if ($key !== '') : ?>
			<div class="notice notice-success inline"><p><strong><?php esc_html_e('Connected.', 'delmora'); ?></strong> <?php esc_html_e('Delmora counts your visitors, the AI assistants and search engines that read your pages, and turns your forms into contacts. Open your website once, then see it in Delmora under Analytics → Website.', 'delmora'); ?></p></div>
		<?php else : ?>
			<p><?php esc_html_e('Sign in to Delmora and approve the connection. Nothing to copy or paste.', 'delmora'); ?></p>
			<p><a class="button button-primary button-hero" href="<?php echo esc_url(delmora_connect_url()); ?>"><?php esc_html_e('Connect with Delmora', 'delmora'); ?></a></p>
		<?php endif; ?>
		<details <?php echo $key !== '' ? 'open' : ''; ?> style="margin-top:24px">
			<summary style="cursor:pointer"><?php echo $key !== '' ? esc_html__('Your site tag', 'delmora') : esc_html__('Or paste the line from Delmora', 'delmora'); ?></summary>
			<form method="post" action="options.php">
				<?php settings_fields('delmora'); ?>
				<table class="form-table" role="presentation">
					<tr>
						<th scope="row"><label for="delmora_site_key"><?php esc_html_e('Your site tag', 'delmora'); ?></label></th>
						<td>
							<input name="<?php echo esc_attr(DELMORA_OPTION); ?>" id="delmora_site_key" type="text" class="large-text code" value="<?php echo esc_attr($key); ?>" placeholder="&lt;script async src=&quot;https://t.delmora.ai/s/…&quot;&gt;&lt;/script&gt;" autocomplete="off" />
							<p class="description"><?php esc_html_e('In Delmora: Settings → Domains → Your site tag. The whole line or just the key. Leave it empty to disconnect.', 'delmora'); ?></p>
						</td>
					</tr>
				</table>
				<?php submit_button($key !== '' ? __('Save', 'delmora') : __('Connect', 'delmora')); ?>
			</form>
		</details>
		<?php if ($key !== '') : ?>
			<p class="description"><?php esc_html_e('Forms come in as contacts: Contact Form 7, WPForms, Gravity Forms, Elementor, Ninja Forms, Fluent Forms and Formidable straight from the form plugin, even for visitors who block trackers, and any other form that sends like a normal web form. Passwords, card numbers and files are never read. If your host serves pages from a cache, some search engine and AI visits are served without WordPress and are not counted.', 'delmora'); ?></p>
		<?php endif; ?>
	</div>
	<?php
}