<?php

namespace Glovario\Admin;

use Glovario\Domain\Renderer;
use Glovario\Domain\BuiltinVariables;
use Glovario\Domain\TypeRegistry;
use Glovario\Domain\VariableKey;
use Glovario\Frontend\TitleShortcodes;
use Glovario\Repository\VariableRepository;
use Glovario\Repository\CategoryRepository;
use Glovario\Usage\UsageScanner;
use Glovario\Usage\ReferenceReplacementService;

defined( 'ABSPATH' ) || exit;

final class AdminController {
	private $repository;
	private $types;
	private $categories;
	private $scanner;
	private $replacer;
	private $builtins;
	private $hook;
	private $value_editor;

	public function __construct( VariableRepository $repository, TypeRegistry $types, CategoryRepository $categories, UsageScanner $scanner, ReferenceReplacementService $replacer, ?BuiltinVariables $builtins = null, ?ValueEditor $value_editor = null ) {
		$this->repository = $repository;
		$this->types      = $types;
		$this->categories = $categories;
		$this->scanner     = $scanner;
		$this->replacer    = $replacer;
		$this->builtins    = $builtins ? $builtins : new BuiltinVariables( $types );
		$this->value_editor = $value_editor;
	}

	public function register() {
		add_action( 'admin_menu', array( $this, 'menu' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'assets' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'menu_icon' ) );
		add_action( 'admin_post_glovario_save_variable', array( $this, 'save' ) );
		add_action( 'admin_post_glovario_delete_variable', array( $this, 'delete' ) );
		add_action( 'admin_post_glovario_prepare_delete_variable', array( $this, 'prepare_delete' ) );
		add_action( 'admin_post_glovario_migrate_variable_key', array( $this, 'migrate_key' ) );
		add_action( 'admin_post_glovario_assign_variable_category', array( $this, 'assign_category' ) );
		add_action( 'admin_post_glovario_save_settings', array( $this, 'save_settings' ) );
		add_action( 'admin_post_glovario_create_examples', array( $this, 'create_examples' ) );
		add_filter( 'plugin_action_links_' . plugin_basename( GLOVARIO_FILE ), array( $this, 'action_links' ) );
	}

	public function menu() {
		// The menu carries the product name, which is never translated; its first item lists the variables.
		$this->hook = add_menu_page(
			__( 'Site Variables', 'glovario' ),
			GLOVARIO_PRODUCT_NAME,
			Capabilities::EDIT_VALUES,
			'glovario',
			array( $this, 'page' ),
			'none',
			58
		);
		add_submenu_page( 'glovario', __( 'Site Variables', 'glovario' ), __( 'Site Variables', 'glovario' ), Capabilities::EDIT_VALUES, 'glovario', array( $this, 'page' ) );
	}

	/**
	 * The menu shows on every admin screen, so its icon style loads everywhere.
	 */
	public function menu_icon() {
		wp_enqueue_style( 'glovario-menu-icon', GLOVARIO_URL . 'assets/menu-icon.css', array(), GLOVARIO_VERSION );
	}

	public function assets( $hook ) {
		// Every Glovario screen: submenu hooks are named after the menu title, not the slug.
		$page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing.
		if ( $hook !== $this->hook && 'glovario' !== $page && 0 !== strpos( $page, 'glovario-' ) ) {
			return;
		}
		$css_modified = filemtime( GLOVARIO_PATH . 'assets/admin.css' );
		$js_modified  = filemtime( GLOVARIO_PATH . 'assets/admin.js' );
		wp_enqueue_style( 'glovario-admin', GLOVARIO_URL . 'assets/admin.css', array(), GLOVARIO_VERSION . ( $css_modified ? '-' . $css_modified : '' ) );
		wp_enqueue_script( 'glovario-admin', GLOVARIO_URL . 'assets/admin.js', array(), GLOVARIO_VERSION . ( $js_modified ? '-' . $js_modified : '' ), true );
		// Image variables are picked from the Media Library on the edit screens.
		if ( isset( $_GET['action'] ) && in_array( $_GET['action'], array( 'add', 'edit' ), true ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput -- Read-only routing compared to fixed values.
			wp_enqueue_media();
		}
		$settings = apply_filters(
			'glovario_admin_settings',
			array(
				'chooseImage'    => __( 'Choose image', 'glovario' ),
				'changeImage'    => __( 'Change image', 'glovario' ),
				/* translators: %s: alternative text of the chosen image. */
				'altText'        => __( 'Alt text: %s', 'glovario' ),
				'noAlt'          => __( 'No alt text.', 'glovario' ),
				'useImage'       => __( 'Use this image', 'glovario' ),
				'copied'         => __( 'Copied', 'glovario' ),
				'confirmDelete'  => __( 'Delete this item? Existing usages may no longer resolve.', 'glovario' ),
				'confirmRestore' => __( 'Revert only the changes recorded in this entry? Later non-conflicting edits will be preserved.', 'glovario' ),
			)
		);
		wp_localize_script(
			'glovario-admin',
			'glovarioAdminSettings',
			$settings
		);
	}

	public function action_links( $links ) {
		array_unshift( $links, '<a href="' . esc_url( admin_url( 'admin.php?page=glovario' ) ) . '">' . esc_html__( 'Manage variables', 'glovario' ) . '</a>' );
		return $links;
	}

	/**
	 * Published titles that contain a Site Variable shortcode: their number and
	 * the first ten, for the warning shown while title integration is off.
	 *
	 * @return array{count:int,posts:\WP_Post[]}
	 */
	public static function titles_with_variables() {
		global $wpdb;
		$like  = '%' . $wpdb->esc_like( '[glvr' ) . '%';
		$count = (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_status = 'publish' AND post_type NOT IN ( 'revision', 'nav_menu_item' ) AND post_title LIKE %s", $like ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		$ids   = $count ? $wpdb->get_col( $wpdb->prepare( "SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish' AND post_type NOT IN ( 'revision', 'nav_menu_item' ) AND post_title LIKE %s ORDER BY post_date DESC LIMIT 10", $like ) ) : array(); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
		return array(
			'count' => $count,
			'posts' => array_values( array_filter( array_map( 'get_post', $ids ) ) ),
		);
	}

	/**
	 * Capability check shared by the form handlers; each handler verifies its own nonce.
	 */
	private function guard() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to manage Site Variables.', 'glovario' ), 403 );
		}
	}

	private function keep_draft( $draft ) {
		set_transient( 'glovario_form_draft_' . get_current_user_id(), $draft, 300 );
	}

	/**
	 * The values typed before a failed save of this variable, once.
	 *
	 * @param int $id Variable ID, 0 for a new variable.
	 * @return array|null
	 */
	private function take_draft( $id ) {
		$name  = 'glovario_form_draft_' . get_current_user_id();
		$draft = get_transient( $name );
		delete_transient( $name );
		return is_array( $draft ) && (int) ( $draft['id'] ?? -1 ) === (int) $id ? $draft : null;
	}

	private function redirect( $notice, $type = 'success', $args = array() ) {
		set_transient(
			'glovario_notice_' . get_current_user_id(),
			array(
				'message' => $notice,
				'type'    => $type,
			),
			60
		);
		$url = add_query_arg( $args, admin_url( 'admin.php?page=glovario' ) );
		wp_safe_redirect( $url );
		exit;
	}

	private function notice() {
		$key    = 'glovario_notice_' . get_current_user_id();
		$notice = get_transient( $key );
		if ( $notice ) {
			delete_transient( $key );
			printf( '<div class="notice notice-%1$s is-dismissible"><p>%2$s</p></div>', esc_attr( $notice['type'] ), esc_html( $notice['message'] ) );
		}
	}

	public function page() {
		if ( ! current_user_can( 'manage_options' ) ) {
			if ( $this->value_editor && current_user_can( Capabilities::EDIT_VALUES ) ) {
				echo '<div class="wrap glovario-wrap">';
				$this->notice();
				$this->value_editor->page();
				echo '</div>';
			}
			return;
		}
		$action = isset( $_GET['action'] ) ? sanitize_key( wp_unslash( $_GET['action'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		echo '<div class="wrap glovario-wrap">';
		$this->notice();
		if ( 'add' === $action || 'edit' === $action ) {
			$this->form();
		} elseif ( 'rename' === $action ) {
			$this->key_migration_confirmation();
		} elseif ( 'delete' === $action ) {
			$this->delete_confirmation();
		} else {
			$this->listing();
		}
		echo '</div>';
	}

	private function listing() {
		$paged      = isset( $_GET['glovario_page'] ) ? max( 1, absint( $_GET['glovario_page'] ) ) : 1; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$search     = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$category   = isset( $_GET['glovario_category'] ) ? sanitize_text_field( wp_unslash( $_GET['glovario_category'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$type       = isset( $_GET['glovario_type'] ) ? sanitize_key( wp_unslash( $_GET['glovario_type'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$orderby    = isset( $_GET['orderby'] ) ? sanitize_key( wp_unslash( $_GET['orderby'] ) ) : 'label'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$order      = isset( $_GET['order'] ) && 'desc' === strtolower( sanitize_text_field( wp_unslash( $_GET['order'] ) ) ) ? 'DESC' : 'ASC'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$query_args = compact( 'search', 'category', 'type', 'orderby', 'order' );
		$per_page   = 50;
		$total      = $this->repository->count( $query_args );
		$variables  = $this->repository->all(
			array_merge(
				$query_args,
				array(
					'number' => $per_page,
					'offset' => ( $paged - 1 ) * $per_page,
				)
			)
		);
		$categories = $this->categories->all();
		$return_args = array_merge( array( 'page' => 'glovario' ), $this->public_query_args( $query_args ) );
		if ( 1 < $paged ) {
			$return_args['glovario_page'] = $paged;
		}
		$return_url = add_query_arg( $return_args, admin_url( 'admin.php' ) );
		?>
		<h1 class="wp-heading-inline"><?php esc_html_e( 'Site Variables', 'glovario' ); ?></h1>
		<a class="page-title-action" href="<?php echo esc_url( admin_url( 'admin.php?page=glovario&action=add' ) ); ?>"><?php esc_html_e( 'Add New Variable', 'glovario' ); ?></a>
		<hr class="wp-header-end">
		<p><?php esc_html_e( 'Reusable site content for shortcodes, blocks, and theme code. Do not store passwords, API keys, or other secrets here.', 'glovario' ); ?></p>
		<?php
		/**
		 * Fires above the variable list, after the introduction.
		 */
		do_action( 'glovario_admin_before_variable_list' );
		$this->creation_prompt();
		if ( 0 === $total && '' === $search && '' === $category && '' === $type ) {
			$this->onboarding();
		}
		?>
		<form method="get" class="glovario-variable-filters">
			<input type="hidden" name="page" value="glovario">
			<p class="search-box"><label class="screen-reader-text" for="glovario-variable-search"><?php esc_html_e( 'Search variables', 'glovario' ); ?></label><input type="search" id="glovario-variable-search" name="s" value="<?php echo esc_attr( $search ); ?>" placeholder="<?php esc_attr_e( 'Search variables', 'glovario' ); ?>"><button class="button" type="submit"><?php esc_html_e( 'Search variables', 'glovario' ); ?></button></p>
			<div class="tablenav top"><div class="alignleft actions">
				<label class="screen-reader-text" for="glovario-category-filter"><?php esc_html_e( 'Filter by category', 'glovario' ); ?></label>
				<select id="glovario-category-filter" name="glovario_category"><option value=""><?php esc_html_e( 'All categories', 'glovario' ); ?></option><option value="uncategorized" <?php selected( $category, 'uncategorized' ); ?>><?php esc_html_e( 'Uncategorized', 'glovario' ); ?></option>
				<?php
				foreach ( $categories as $filter_category ) :
					?>
					<option value="<?php echo esc_attr( $filter_category['id'] ); ?>" <?php selected( (string) $category, (string) $filter_category['id'] ); ?>><?php echo esc_html( $filter_category['name'] ); ?></option><?php endforeach; ?></select>
				<label class="screen-reader-text" for="glovario-type-filter"><?php esc_html_e( 'Filter by variable type', 'glovario' ); ?></label>
				<select id="glovario-type-filter" name="glovario_type"><option value=""><?php esc_html_e( 'All variable types', 'glovario' ); ?></option>
				<?php
				foreach ( $this->types->all() as $filter_type => $config ) :
					?>
					<option value="<?php echo esc_attr( $filter_type ); ?>" <?php selected( $type, $filter_type ); ?>><?php echo esc_html( $config['label'] ); ?></option><?php endforeach; ?></select>
				<button class="button" type="submit"><?php esc_html_e( 'Filter', 'glovario' ); ?></button>
				<?php
				if ( $search || $category || $type ) :
					?>
					<a class="button" href="<?php echo esc_url( admin_url( 'admin.php?page=glovario' ) ); ?>"><?php esc_html_e( 'Clear filters', 'glovario' ); ?></a><?php endif; ?>
			</div></div>
		</form>
		<table class="wp-list-table widefat fixed striped table-view-list glovario-variable-list">
			<thead><tr>
				<th><?php $this->sortable_heading( __( 'Label', 'glovario' ), 'label', $query_args ); ?></th>
				<th><?php $this->sortable_heading( __( 'Key', 'glovario' ), 'key', $query_args ); ?></th>
				<th><?php esc_html_e( 'Type', 'glovario' ); ?></th>
				<th><?php $this->sortable_heading( __( 'Category', 'glovario' ), 'category', $query_args ); ?></th>
				<th><?php esc_html_e( 'Value preview', 'glovario' ); ?></th>
				<th><?php esc_html_e( 'References', 'glovario' ); ?></th>
				<th><?php $this->sortable_heading( __( 'Last updated', 'glovario' ), 'updated_at', $query_args ); ?></th>
				<th><?php esc_html_e( 'Actions', 'glovario' ); ?></th>
			</tr></thead>
			<tbody>
			<?php if ( ! $variables ) : ?>
				<tr><td colspan="8"><?php echo $search || $category || $type ? esc_html__( 'No variables match the current search and filters.', 'glovario' ) : esc_html__( 'No Site Variables yet. Add your first variable to get started.', 'glovario' ); ?></td></tr>
				<?php
			else :
				foreach ( $variables as $variable ) :
					$shortcode = '[glvr key="' . $variable['variable_key'] . '"]';
					$token     = '{{glvr:' . $variable['variable_key'] . '}}';
					$type      = $this->types->all()[ $variable['type'] ]['label'] ?? $variable['type'];
					?>
				<tr>
					<td><strong><?php echo esc_html( $variable['label'] ); ?></strong></td>
					<td><code><?php echo esc_html( $variable['variable_key'] ); ?></code></td>
					<td><?php echo esc_html( $type ); ?></td>
					<td><?php CategorySelector::render( $variable, $categories, $return_url ); ?></td>
					<td class="glovario-preview"><?php echo 'image' === $variable['type'] && TypeRegistry::is_image( $variable['value'] ) ? wp_get_attachment_image( absint( $variable['value'] ), array( 40, 40 ) ) . ' ' . esc_html( Renderer::text( $variable['value'], 'image' ) ) : esc_html( wp_html_excerpt( $variable['value'], 80, '&hellip;' ) ); ?></td>
					<td class="glovario-reference-actions"><div><code><?php echo esc_html( $shortcode ); ?></code> <button type="button" class="button-link glovario-copy" aria-live="polite" data-copy="<?php echo esc_attr( $shortcode ); ?>"><?php esc_html_e( 'Copy Shortcode', 'glovario' ); ?></button></div><div><code><?php echo esc_html( $token ); ?></code> <button type="button" class="button-link glovario-copy" aria-live="polite" data-copy="<?php echo esc_attr( $token ); ?>"><?php esc_html_e( 'Copy Token', 'glovario' ); ?></button></div></td>
					<td><?php echo esc_html( get_date_from_gmt( $variable['updated_at'], get_option( 'date_format' ) . ' ' . get_option( 'time_format' ) ) ); ?></td>
					<td class="glovario-actions">
						<a href="
						<?php
						echo esc_url(
							add_query_arg(
								array(
									'action' => 'edit',
									'id'     => $variable['id'],
								),
								admin_url( 'admin.php?page=glovario' )
							)
						);
						?>
									"><?php esc_html_e( 'Edit', 'glovario' ); ?></a>
										<?php do_action( 'glovario_admin_variable_row_actions', $variable ); ?>
						<form class="glovario-inline-form" method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
							<input type="hidden" name="action" value="glovario_prepare_delete_variable"><input type="hidden" name="id" value="<?php echo esc_attr( $variable['id'] ); ?>">
							<?php wp_nonce_field( 'glovario_delete_variable_' . $variable['id'] ); ?>
							<button class="button-link-delete glovario-confirm-delete" type="submit" data-confirm="<?php esc_attr_e( 'Delete this variable? If it is used somewhere, you will first see where and choose what happens to those references.', 'glovario' ); ?>"><?php esc_html_e( 'Delete', 'glovario' ); ?></button>
						</form>
					</td>
				</tr>
							<?php
			endforeach;
endif;
			?>
			</tbody>
		</table>
		<?php if ( $total > $per_page ) : ?>
			<div class="tablenav"><div class="tablenav-pages">
			<?php
			echo wp_kses_post(
				paginate_links(
					array(
						'base'    => str_replace( '999999999', '%#%', add_query_arg( array_merge( $this->public_query_args( $query_args ), array( 'glovario_page' => '999999999' ) ), admin_url( 'admin.php?page=glovario' ) ) ),
						'format'  => '',
						'current' => $paged,
						'total'   => (int) ceil( $total / $per_page ),
					)
				)
			);
			?>
			</div></div>
		<?php endif; ?>
		<?php $this->builtin_listing(); ?>
		<?php do_action( 'glovario_admin_after_variable_list' ); ?>
		<?php ProNotice::render(); ?>
		<hr>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="glovario_save_settings">
			<?php wp_nonce_field( 'glovario_save_settings' ); ?>
			<h2><?php esc_html_e( 'Title integration', 'glovario' ); ?></h2>
			<?php
			$titles_on = '1' === get_option( TitleShortcodes::OPTION, '0' );
			$titles    = self::titles_with_variables();
			if ( ! $titles_on && $titles['count'] ) :
				?>
				<div class="notice notice-warning inline glovario-title-integration-warning"><p>
					<?php
					/* translators: %s: number of published titles. */
					echo esc_html( sprintf( _n( '%s published title contains Site Variables and shows the shortcode to visitors while title integration is off.', '%s published titles contain Site Variables and show the shortcode to visitors while title integration is off.', $titles['count'], 'glovario' ), number_format_i18n( $titles['count'] ) ) );
					?>
				</p><ul class="glovario-title-integration-warning__list">
					<?php foreach ( $titles['posts'] as $title_post ) : ?>
						<li><a href="<?php echo esc_url( get_edit_post_link( $title_post->ID, 'url' ) ); ?>"><?php echo esc_html( $title_post->post_title ); ?></a></li>
					<?php endforeach; ?>
					<?php if ( $titles['count'] > count( $titles['posts'] ) ) : ?>
						<?php /* translators: %s: number of further titles not listed. */ ?>
						<li><?php echo esc_html( sprintf( __( 'And %s more.', 'glovario' ), number_format_i18n( $titles['count'] - count( $titles['posts'] ) ) ) ); ?></li>
					<?php endif; ?>
				</ul></div>
			<?php endif; ?>
			<?php
			$confirm_off = $titles_on && $titles['count']
				/* translators: %s: number of published titles. */
				? sprintf( _n( 'Turn off title integration? %s published title contains Site Variables and will show the shortcode to visitors.', 'Turn off title integration? %s published titles contain Site Variables and will show the shortcode to visitors.', $titles['count'], 'glovario' ), number_format_i18n( $titles['count'] ) )
				: '';
			?>
			<label><input type="checkbox" name="title_shortcodes" value="1" <?php checked( $titles_on ); ?><?php echo $confirm_off ? ' data-glovario-confirm-off="' . esc_attr( $confirm_off ) . '"' : ''; ?>> <?php esc_html_e( 'Resolve Site Variable shortcodes in frontend post and page titles.', 'glovario' ); ?></label>
			<p class="description"><?php esc_html_e( 'When enabled, the post editor includes a Site Variables panel for inserting a selected shortcode into the title. The raw shortcode remains visible while editing.', 'glovario' ); ?></p>
			<h2><?php esc_html_e( 'Data retention', 'glovario' ); ?></h2>
			<label><input type="checkbox" name="delete_on_uninstall" value="1" <?php checked( get_option( 'glovario_delete_on_uninstall' ), '1' ); ?>> <?php /* translators: Glovario is the product name; do not translate it. */ esc_html_e( 'Delete all Glovario data when the plugin is uninstalled.', 'glovario' ); ?></label>
			<p class="description"><?php esc_html_e( 'Off by default. Deactivation never deletes data.', 'glovario' ); ?></p>
			<?php $redirects = \Glovario\Frontend\SlugFollow::page_redirects(); ?>
			<?php if ( $redirects ) : ?>
				<div class="notice notice-info inline glovario-redirects-notice">
					<p><strong>
					<?php
					/* translators: %s: number of earlier page addresses. Glovario is the product name; do not translate it. */
					echo esc_html( sprintf( _n( '%s earlier page address redirects to its page through Glovario.', '%s earlier page addresses redirect to their pages through Glovario.', count( $redirects ), 'glovario' ), number_format_i18n( count( $redirects ) ) ) );
					?>
					</strong></p>
					<p><?php /* translators: Glovario is the product name; do not translate it. */ esc_html_e( 'WordPress does not redirect earlier page addresses by itself, so Glovario does it for pages whose address changed with a variable\'s value. Deleting all data removes these redirects. To keep them, recreate them with a redirection plugin or your server\'s redirect rules:', 'glovario' ); ?></p>
					<ul class="glovario-redirects-notice__list">
						<?php foreach ( array_slice( $redirects, 0, 20 ) as $redirect ) : ?>
							<li><code><?php echo esc_html( $redirect['from'] ); ?></code> &rarr; <code><?php echo esc_html( $redirect['to'] ); ?></code></li>
						<?php endforeach; ?>
						<?php if ( count( $redirects ) > 20 ) : ?>
							<?php /* translators: %s: number of further redirects not listed. */ ?>
							<li><?php echo esc_html( sprintf( __( 'And %s more.', 'glovario' ), number_format_i18n( count( $redirects ) - 20 ) ) ); ?></li>
						<?php endif; ?>
					</ul>
					<p><?php esc_html_e( 'Earlier addresses of posts are redirected by WordPress itself and are not affected.', 'glovario' ); ?></p>
				</div>
			<?php endif; ?>
			<?php submit_button( __( 'Save settings', 'glovario' ), 'secondary', 'submit', false ); ?>
		</form>
		<?php
	}

	/**
	 * First-run guide shown while the site has no variables yet.
	 */
	private function onboarding() {
		?>
		<section class="glovario-onboarding" aria-labelledby="glovario-onboarding-heading">
			<h2 id="glovario-onboarding-heading"><?php esc_html_e( 'Write it once. Change it everywhere.', 'glovario' ); ?></h2>
			<ol class="glovario-onboarding__steps">
				<li><strong><?php esc_html_e( 'Create a variable', 'glovario' ); ?></strong><span><?php esc_html_e( 'Add one here, or select any text in the block editor, Classic Editor, Elementor, or Beaver Builder and click Make variable.', 'glovario' ); ?></span></li>
				<li><strong><?php esc_html_e( 'Use it anywhere', 'glovario' ); ?></strong><span><?php esc_html_e( 'Click Insert variable in any editor, use the Site Variable block, or paste its shortcode.', 'glovario' ); ?></span></li>
				<li><strong><?php esc_html_e( 'Edit it once', 'glovario' ); ?></strong><span><?php esc_html_e( 'Change the value here and every page, title, and menu that uses it updates at once.', 'glovario' ); ?></span></li>
			</ol>
			<div class="glovario-onboarding__actions">
				<a class="button button-primary" href="<?php echo esc_url( admin_url( 'admin.php?page=glovario&action=add' ) ); ?>"><?php esc_html_e( 'Add your first variable', 'glovario' ); ?></a>
				<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
					<input type="hidden" name="action" value="glovario_create_examples">
					<?php wp_nonce_field( 'glovario_create_examples' ); ?>
					<button type="submit" class="button"><?php esc_html_e( 'Create example variables', 'glovario' ); ?></button>
				</form>
			</div>
		</section>
		<?php
	}

	/**
	 * Example variables offered by the first-run guide. Placeholder contact data
	 * uses reserved fictional values (555 numbers, example.com).
	 *
	 * @return array[]
	 */
	public function example_variables() {
		$site = get_bloginfo( 'name' );
		return array(
			array( 'company_name', __( 'Company name', 'glovario' ), 'text', '' !== $site ? $site : __( 'Example Company', 'glovario' ) ),
			array( 'company_phone', __( 'Phone number', 'glovario' ), 'text', '+1 (555) 010-0100' ),
			array( 'company_email', __( 'Contact email', 'glovario' ), 'email', 'hello@example.com' ),
			array( 'company_address', __( 'Address', 'glovario' ), 'multiline', __( "123 Example Street\nExample City", 'glovario' ) ),
			array( 'opening_hours', __( 'Opening hours', 'glovario' ), 'text', __( 'Mon–Fri 9:00–18:00', 'glovario' ) ),
		);
	}

	public function create_examples() {
		$this->guard();
		check_admin_referer( 'glovario_create_examples' );
		$created = $this->install_examples();
		$this->redirect(
			sprintf(
				/* translators: %d: number of example variables created. */
				_n( '%d example variable created. Edit it to match your site.', '%d example variables created. Edit them to match your site.', $created, 'glovario' ),
				$created
			)
		);
	}

	/**
	 * Create the example variables that do not exist yet, in an "Examples" category.
	 *
	 * @return int Number of variables created.
	 */
	public function install_examples() {
		$name     = __( 'Examples', 'glovario' );
		$category = null;
		foreach ( $this->categories->all() as $existing ) {
			if ( sanitize_title( $name ) === $existing['slug'] ) {
				$category = $existing;
			}
		}
		$category = $category ? $category : $this->categories->insert( array( 'name' => $name ) );
		$created  = 0;
		foreach ( $this->example_variables() as $example ) {
			list( $key, $label, $type, $value ) = $example;
			if ( $this->repository->find_by_key( $key ) ) {
				continue;
			}
			$result = $this->repository->insert(
				array(
					'variable_key' => $key,
					'label'        => $label,
					'type'         => $type,
					'value'        => $this->types->sanitize( $value, $type ),
					'description'  => __( 'Example created by the first-run guide. Edit or delete it at any time.', 'glovario' ),
					'category_id'  => is_wp_error( $category ) ? 0 : $category['id'],
				)
			);
			if ( ! is_wp_error( $result ) ) {
				++$created;
			}
		}
		return $created;
	}

	private function creation_prompt() {
		$created_id = isset( $_GET['glovario_created'] ) ? absint( $_GET['glovario_created'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$variable   = $created_id ? $this->repository->find( $created_id ) : null;
		if ( ! $variable || '' === (string) $variable['value'] || 'image' === $variable['type'] ) {
			return;
		}
		$url = add_query_arg(
			array(
				'page'        => 'glovario-content-conversion',
				'variable_id' => $variable['id'],
			),
			admin_url( 'admin.php' )
		);
		?>
		<div class="notice notice-info inline"><p><strong><?php esc_html_e( 'Already using this text on your site?', 'glovario' ); ?></strong> <?php esc_html_e( 'Review exact matches and selectively convert supported content into variable references.', 'glovario' ); ?> <a class="button" href="<?php echo esc_url( $url ); ?>"><?php esc_html_e( 'Find matching content', 'glovario' ); ?></a></p></div>
		<?php
	}

	private function builtin_listing() {
		$variables = $this->builtins->all();
		if ( ! $variables ) {
			return;
		}
		$types = $this->types->all();
		?>
		<h2><?php esc_html_e( 'Built-in variables', 'glovario' ); ?></h2>
		<p><?php esc_html_e( 'These read-only values come directly from WordPress and stay current automatically.', 'glovario' ); ?></p>
		<table class="widefat striped glovario-system-table"><thead><tr><th><?php esc_html_e( 'Variable', 'glovario' ); ?></th><th><?php esc_html_e( 'Type', 'glovario' ); ?></th><th><?php esc_html_e( 'Current value', 'glovario' ); ?></th><th><?php esc_html_e( 'References', 'glovario' ); ?></th><th><?php esc_html_e( 'Actions', 'glovario' ); ?></th></tr></thead><tbody>
		<?php foreach ( $variables as $variable ) : ?>
			<?php
			$shortcode = '[glvr key="' . $variable['variable_key'] . '"]';
			$token     = '{{glvr:' . $variable['variable_key'] . '}}';
			$usage_url = add_query_arg(
				array(
					'page'         => 'glovario-usage',
					'variable_key' => $variable['variable_key'],
				),
				admin_url( 'admin.php' )
			);
			?>
			<tr><td><strong><?php echo esc_html( $variable['label'] ); ?></strong> <span class="glovario-system-badge"><?php esc_html_e( 'Built-in', 'glovario' ); ?></span><br><code><?php echo esc_html( $variable['variable_key'] ); ?></code><p class="description"><?php echo esc_html( $variable['description'] ); ?></p></td><td><?php echo esc_html( $types[ $variable['type'] ]['label'] ?? $variable['type'] ); ?></td><td class="glovario-preview"><?php echo '' === (string) $variable['value'] ? '<span class="description">' . esc_html__( '(empty)', 'glovario' ) . '</span>' : esc_html( wp_html_excerpt( $variable['value'], 80, '&hellip;' ) ); ?></td><td class="glovario-reference-actions"><div><code><?php echo esc_html( $shortcode ); ?></code> <button type="button" class="button-link glovario-copy" aria-live="polite" data-copy="<?php echo esc_attr( $shortcode ); ?>"><?php esc_html_e( 'Copy Shortcode', 'glovario' ); ?></button></div><div><code><?php echo esc_html( $token ); ?></code> <button type="button" class="button-link glovario-copy" aria-live="polite" data-copy="<?php echo esc_attr( $token ); ?>"><?php esc_html_e( 'Copy Token', 'glovario' ); ?></button></div>
			<?php if ( BuiltinVariables::CURRENT_DATE_KEY === $variable['variable_key'] ) : ?>
				<p class="description"><?php echo wp_kses_post( __( 'Optional per-reference formats: <code>[glvr key="glovario_builtin_current_date" format="full"]</code> or <code>{{glvr:glovario_builtin_current_date|format=full}}</code>. The block provides a Date format selector.', 'glovario' ) ); ?></p>
			<?php endif; ?>
			</td><td><a href="<?php echo esc_url( $usage_url ); ?>"><?php esc_html_e( 'Find usages', 'glovario' ); ?></a></td></tr>
		<?php endforeach; ?>
		</tbody></table>
		<?php
	}

	public function delete_confirmation() {
		$id       = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$variable = $id ? $this->repository->find( $id ) : null;
		if ( ! $variable ) {
			echo '<h1>' . esc_html__( 'Variable not found.', 'glovario' ) . '</h1>';
			return;
		}
		$matches = $this->scanner->matches( $variable['variable_key'] );
		$total   = count( $matches );
		$sample  = $matches ? reset( $matches ) : null;
		?>
		<h1><?php esc_html_e( 'Delete Site Variable', 'glovario' ); ?></h1>
		<div class="notice notice-warning inline"><p><strong><?php echo esc_html( $variable['label'] ); ?></strong> <code><?php echo esc_html( $variable['variable_key'] ); ?></code></p>
		<?php
		if ( $total ) :
			?>
			<?php /* translators: %d: number of detected usage locations. */ ?>
			<p><?php printf( esc_html( _n( 'This variable is currently used in %d detected location.', 'This variable is currently used in %d detected locations.', $total, 'glovario' ) ), absint( $total ) ); ?> <?php esc_html_e( 'Choose what should happen to the detected references before the variable is removed.', 'glovario' ); ?></p>
			<?php
else :
	?>
			<p><?php esc_html_e( 'No usages were detected in scanned content.', 'glovario' ); ?></p><?php endif; ?>
		<p><?php esc_html_e( 'Usage detection is not exhaustive: references in PHP, themes, plugins, or unsupported builder storage may not be detectable.', 'glovario' ); ?></p></div>
		<?php
		if ( $total ) :
			?>
			<p><a class="button" href="
			<?php
			echo esc_url(
				add_query_arg(
					array(
						'page' => 'glovario-usage',
						'variable_id' => $id,
					),
					admin_url( 'admin.php' )
				)
			);
			?>
		"><?php esc_html_e( 'View usages', 'glovario' ); ?></a></p><?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>"><input type="hidden" name="action" value="glovario_delete_variable"><input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>"><?php wp_nonce_field( 'glovario_delete_variable_' . $id ); ?>
		<?php if ( $total ) : ?>
			<fieldset class="glovario-delete-strategies"><legend class="glovario-delete-strategies-legend"><?php esc_html_e( 'Choose how to handle detected references', 'glovario' ); ?></legend><ul class="glovario-delete-strategy-list">
			<?php
			$strategies = array(
				'keep'  => array(
					'label'       => __( 'Leave the references in place', 'glovario' ),
					'description' => __( 'The stored shortcode, token, or block remains, but it will no longer resolve after deletion.', 'glovario' ),
				),
				'value' => array(
					'label'       => __( 'Replace references with the current value', 'glovario' ),
					'description' => __( 'Detected references become a static snapshot of the current variable value.', 'glovario' ),
				),
				'empty' => array(
					'label'       => __( 'Replace references with an empty string', 'glovario' ),
					'description' => __( 'Detected references are removed without inserting replacement text.', 'glovario' ),
				),
			);
			foreach ( $strategies as $strategy => $config ) :
				$preview = $sample ? $this->replacer->preview( $variable, $sample, $strategy ) : null;
				?>
				<li class="glovario-delete-strategy"><label class="glovario-delete-strategy-choice"><input type="radio" name="delete_strategy" value="<?php echo esc_attr( $strategy ); ?>" <?php checked( 'keep', $strategy ); ?>> <strong><?php echo esc_html( $config['label'] ); ?></strong></label><p class="description"><?php echo esc_html( $config['description'] ); ?></p>
				<?php
				if ( $preview ) :
					?>
					<div class="glovario-delete-preview"><strong><?php echo esc_html( sprintf( /* translators: %s: detected usage location title. */ __( 'Real example from %s', 'glovario' ), $preview['location'] ) ); ?></strong><span><b><?php esc_html_e( 'Before:', 'glovario' ); ?></b> <code><?php echo wp_kses( $this->highlight_preview( $preview['before'], $variable, $strategy, 'before' ), array( 'mark' => array( 'class' => true ) ) ); ?></code></span><span><b><?php esc_html_e( 'After:', 'glovario' ); ?></b> <code><?php echo wp_kses( $this->highlight_preview( $preview['after_display'], $variable, $strategy, 'after' ), array( 'mark' => array( 'class' => true ) ) ); ?></code></span></div><?php endif; ?></li>
			<?php endforeach; ?>
			</ul></fieldset>
			<?php
		else :
			?>
			<input type="hidden" name="delete_strategy" value="keep"><?php endif; ?>
		<p><button class="button button-primary" type="submit"><?php esc_html_e( 'Delete variable', 'glovario' ); ?></button> <a class="button" href="<?php echo esc_url( admin_url( 'admin.php?page=glovario' ) ); ?>"><?php esc_html_e( 'Cancel', 'glovario' ); ?></a></p></form>
		<?php
	}

	private function highlight_preview( $text, $variable, $strategy, $phase ) {
		$key = preg_quote( $variable['variable_key'], '~' );
		$strip_markers = false;
		if ( 'before' === $phase ) {
			$pattern = '~(\{\{glvr:\s*' . $key . '(?:\|format=[a-z]+)?\s*\}\}|\[glvr\b[^\]]*\bkey\s*=\s*"' . $key . '"[^\]]*\]|\[glvr\b[^\]]*\bkey\s*=\s*\'' . $key . '\'[^\]]*\]|<Site Variable block:\s*' . $key . '>)~i';
			$class   = 'glovario-delete-highlight glovario-delete-highlight--reference';
		} elseif ( 'keep' === $strategy ) {
			$pattern = '~(\{\{glvr:\s*' . $key . '(?:\|format=[a-z]+)?\s*\}\}|\[glvr\b[^\]]*\bkey\s*=\s*"' . $key . '"[^\]]*\]|\[glvr\b[^\]]*\bkey\s*=\s*\'' . $key . '\'[^\]]*\]|<Site Variable block:\s*' . $key . '>)~i';
			$class   = 'glovario-delete-highlight glovario-delete-highlight--dead';
		} elseif ( 'empty' === $strategy ) {
			return esc_html( $text );
		} else {
			$pattern       = '~(' . preg_quote( ReferenceReplacementService::PREVIEW_START, '~' ) . '.*?' . preg_quote( ReferenceReplacementService::PREVIEW_END, '~' ) . ')~u';
			$class         = 'glovario-delete-highlight glovario-delete-highlight--replacement';
			$strip_markers = true;
		}
		$parts = preg_split( $pattern, (string) $text, -1, PREG_SPLIT_DELIM_CAPTURE );
		if ( false === $parts ) {
			return esc_html( $text );
		}
		$html = '';
		foreach ( $parts as $index => $part ) {
			if ( 1 === $index % 2 ) {
				if ( $strip_markers ) {
					$part = str_replace( array( ReferenceReplacementService::PREVIEW_START, ReferenceReplacementService::PREVIEW_END ), '', $part );
				}
				$html .= '<mark class="' . esc_attr( $class ) . '">' . esc_html( $part ) . '</mark>';
			} else {
				$html .= esc_html( $part );
			}
		}
		return $html;
	}

	public function prepare_delete() {
		$this->guard();
		$id = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : 0;
		check_admin_referer( 'glovario_delete_variable_' . $id );
		$variable = $id ? $this->repository->find( $id ) : null;
		if ( ! $variable ) {
			$this->redirect( __( 'Variable not found.', 'glovario' ), 'error' );
		}
		if ( ! $this->scanner->matches( $variable['variable_key'] ) ) {
			if ( ! $this->repository->delete( $id ) ) {
				$this->redirect( __( 'The variable could not be deleted.', 'glovario' ), 'error' );
			}
			$this->redirect( __( 'Unused variable deleted.', 'glovario' ) );
		}
		wp_safe_redirect(
			add_query_arg(
				array(
					'page' => 'glovario',
					'action' => 'delete',
					'id' => $id,
				),
				admin_url( 'admin.php' )
			)
		);
		exit;
	}

	private function sortable_heading( $label, $column, $query_args ) {
		$current = $query_args['orderby'] === $column;
		$next    = $current && 'ASC' === $query_args['order'] ? 'desc' : 'asc';
		$url     = add_query_arg(
			array_merge(
				$this->public_query_args( $query_args ),
				array(
					'orderby' => $column,
					'order'   => $next,
				)
			),
			admin_url( 'admin.php?page=glovario' )
		);
		$class = 'manage-column sortable ' . ( $current ? 'sorted ' . strtolower( $query_args['order'] ) : 'desc' );
		echo '<a class="' . esc_attr( $class ) . '" href="' . esc_url( $url ) . '"><span>' . esc_html( $label ) . '</span><span class="sorting-indicators"><span class="sorting-indicator asc" aria-hidden="true"></span><span class="sorting-indicator desc" aria-hidden="true"></span></span></a>';
	}

	private function public_query_args( $query_args ) {
		return array_filter(
			array(
				's'            => $query_args['search'],
				'glovario_category' => $query_args['category'],
				'glovario_type'     => $query_args['type'],
				'orderby'      => $query_args['orderby'],
				'order'        => strtolower( $query_args['order'] ),
			),
			static function ( $value ) {
				return '' !== $value;
			}
		);
	}

	private function form() {
		$id       = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$variable = $id ? $this->repository->find( $id ) : null;
		if ( $id && ! $variable ) {
			$this->redirect( __( 'Variable not found.', 'glovario' ), 'error' );
		}
		$variable = $variable ? $variable : array(
			'id'           => 0,
			'label'        => '',
			'variable_key' => '',
			'type'         => 'text',
			'value'        => '',
			'description'  => '',
			'category_id'  => 0,
		);
		$draft    = $this->take_draft( $id );
		if ( $draft ) {
			$variable = array_merge( $variable, array_intersect_key( $draft, array_flip( array( 'label', 'variable_key', 'type', 'value', 'description', 'category_id' ) ) ) );
		}
		?>
		<h1><?php echo $id ? esc_html__( 'Edit Site Variable', 'glovario' ) : esc_html__( 'Add New Site Variable', 'glovario' ); ?></h1>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="glovario_save_variable">
			<input type="hidden" name="id" value="<?php echo esc_attr( $variable['id'] ); ?>">
			<?php wp_nonce_field( 'glovario_save_variable' ); ?>
			<table class="form-table" role="presentation"><tbody>
			<tr><th scope="row"><label for="glovario-label"><?php esc_html_e( 'Label', 'glovario' ); ?></label></th><td><input class="regular-text" id="glovario-label" name="label" type="text" maxlength="191" required value="<?php echo esc_attr( $variable['label'] ); ?>"></td></tr>
			<tr><th scope="row"><label for="glovario-key"><?php esc_html_e( 'Key', 'glovario' ); ?></label></th><td><input class="regular-text code" id="glovario-key" name="variable_key" type="text" maxlength="191" pattern="[a-z0-9_\-]+"<?php echo $id ? ' required' : ''; ?> value="<?php echo esc_attr( $variable['variable_key'] ); ?>" <?php wp_readonly( (bool) $id ); ?>>
			<?php if ( $id ) : ?>
				<p class="description"><?php esc_html_e( 'Keys identify references and cannot be changed during a normal edit.', 'glovario' ); ?> <a href="
				<?php
				echo esc_url(
					add_query_arg(
						array(
							'page' => 'glovario',
							'action' => 'rename',
							'id' => $id,
						),
						admin_url( 'admin.php' )
					)
				);
				?>
										"><?php esc_html_e( 'Review and migrate this key', 'glovario' ); ?></a></p>
			<?php else : ?>
				<p class="description"><?php esc_html_e( 'Leave empty to generate one from the label.', 'glovario' ); ?> <?php esc_html_e( 'Lowercase letters, numbers, hyphens, and underscores only. Keys must be unique.', 'glovario' ); ?></p>
			<?php endif; ?></td></tr>
			<tr><th scope="row"><label for="glovario-type"><?php esc_html_e( 'Type', 'glovario' ); ?></label></th><td><select id="glovario-type" name="type">
			<?php
			foreach ( $this->types->all() as $key => $config ) :
				?>
				<option value="<?php echo esc_attr( $key ); ?>" <?php selected( $variable['type'], $key ); ?>><?php echo esc_html( $config['label'] ); ?></option><?php endforeach; ?></select></td></tr>
			<tr><th scope="row"><label for="glovario-category"><?php esc_html_e( 'Category', 'glovario' ); ?></label></th><td><select id="glovario-category" name="category_id"><option value="0"><?php esc_html_e( 'Uncategorized', 'glovario' ); ?></option>
			<?php
			foreach ( $this->categories->all() as $category ) :
				?>
				<option value="<?php echo esc_attr( $category['id'] ); ?>" <?php selected( (int) $variable['category_id'], (int) $category['id'] ); ?>><?php echo esc_html( $category['name'] ); ?></option><?php endforeach; ?></select> <a href="<?php echo esc_url( admin_url( 'admin.php?page=glovario-categories' ) ); ?>"><?php esc_html_e( 'Manage categories', 'glovario' ); ?></a></td></tr>
			<?php $is_image = 'image' === $variable['type']; ?>
			<tr><th scope="row"><label for="<?php echo esc_attr( $is_image ? 'glovario-value-image' : 'glovario-value' ); ?>"><?php esc_html_e( 'Value', 'glovario' ); ?></label></th><td>
				<div data-glovario-value-for="text"<?php echo $is_image ? ' hidden' : ''; ?>><textarea class="large-text" rows="5" id="glovario-value" name="value" <?php disabled( $is_image ); ?>><?php echo esc_textarea( $is_image ? '' : $variable['value'] ); ?></textarea><p class="description"><?php echo wp_kses_post( __( 'Text and Multiline values can reference another variable with <code>[glvr key="another_key"]</code>. Nested shortcode references resolve recursively. Use <code>{{glvr:variable_key}}</code> in supported post, excerpt, and text-widget content.', 'glovario' ) ); ?></p></div>
				<div data-glovario-value-for="image"<?php echo $is_image ? '' : ' hidden'; ?>><?php ImageField::render( 'value', 'glovario-value-image', $is_image ? $variable['value'] : '', ! $is_image ); ?><p class="description"><?php echo wp_kses_post( __( 'Shows the image with its alternative text. Use <code>[glvr key="variable_key" size="medium"]</code> for a smaller size; titles and menus show the alternative text.', 'glovario' ) ); ?></p></div>
			</td></tr>
			<tr><th scope="row"><label for="glovario-description"><?php esc_html_e( 'Description', 'glovario' ); ?></label></th><td><textarea class="large-text" rows="3" id="glovario-description" name="description"><?php echo esc_textarea( $variable['description'] ); ?></textarea><p class="description"><?php esc_html_e( 'Optional internal note for administrators.', 'glovario' ); ?></p></td></tr>
			</tbody></table>
			<p class="submit glovario-form-actions">
				<?php submit_button( $id ? __( 'Update Variable', 'glovario' ) : __( 'Add Variable', 'glovario' ), 'primary', 'submit', false ); ?>
				<a class="button" href="<?php echo esc_url( admin_url( 'admin.php?page=glovario' ) ); ?>"><?php esc_html_e( 'Cancel', 'glovario' ); ?></a>
			</p>
		</form>
		<?php do_action( 'glovario_admin_after_variable_form', $variable ); ?>
		<?php
	}

	public function save() {
		$this->guard();
		check_admin_referer( 'glovario_save_variable' );
		$id          = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : 0;
		$existing    = $id ? $this->repository->find( $id ) : null;
		$raw_key     = $existing ? $existing['variable_key'] : ( isset( $_POST['variable_key'] ) ? strtolower( trim( wp_unslash( $_POST['variable_key'] ) ) ) : '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Strictly validated and passed through sanitize_key below.
		$label       = isset( $_POST['label'] ) ? sanitize_text_field( wp_unslash( $_POST['label'] ) ) : '';
		if ( ! $existing && '' === $raw_key && '' !== $label ) {
			// An empty key on a new variable is generated from the label, as in Make variable.
			$raw_key = VariableKey::from_label( $label, $this->repository );
		}
		$key         = sanitize_key( $raw_key );
		$type        = isset( $_POST['type'] ) ? sanitize_key( wp_unslash( $_POST['type'] ) ) : '';
		$raw_value   = isset( $_POST['value'] ) ? wp_unslash( $_POST['value'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Validated and sanitized according to selected type below.
		$description = isset( $_POST['description'] ) ? sanitize_textarea_field( wp_unslash( $_POST['description'] ) ) : '';
		$category_id = isset( $_POST['category_id'] ) ? absint( $_POST['category_id'] ) : 0;
		if ( $category_id && ! $this->categories->find( $category_id ) ) {
			$category_id = 0;
		}

		$back = $id ? array(
			'action' => 'edit',
			'id'     => $id,
		) : array( 'action' => 'add' );
		// On an error the form comes back with what was typed.
		$draft = array(
			'id'           => $id,
			'label'        => $label,
			'variable_key' => $existing ? $existing['variable_key'] : ( isset( $_POST['variable_key'] ) ? sanitize_text_field( wp_unslash( $_POST['variable_key'] ) ) : '' ),
			'type'         => $type,
			'value'        => $raw_value,
			'description'  => $description,
			'category_id'  => $category_id,
		);

		if ( '' === $label || '' === $key || ! preg_match( '/^[a-z0-9_-]+$/', $raw_key ) || $key !== $raw_key ) {
			$this->keep_draft( $draft );
			$this->redirect( __( 'Enter a label and a valid key using lowercase letters, numbers, hyphens, or underscores.', 'glovario' ), 'error', $back );
		}
		$validation = $this->types->validate( $raw_value, $type );
		if ( is_wp_error( $validation ) ) {
			$this->keep_draft( $draft );
			$this->redirect( $validation->get_error_message(), 'error', $back );
		}
		$value = $this->types->sanitize( $raw_value, $type );

		$data                 = compact( 'label', 'type', 'value', 'description', 'category_id' );
		$data['variable_key'] = $key;
		$result               = $id ? $this->repository->update( $id, $data ) : $this->repository->insert( $data );
		if ( is_wp_error( $result ) ) {
			$this->keep_draft( $draft );
			$this->redirect( $result->get_error_message(), 'error', $back );
		}
		/**
		 * Filters where the administrator lands after saving a variable
		 * (query arguments for the Site Variables screen).
		 *
		 * @param array $args     Query arguments; empty for the list.
		 * @param array $variable Saved variable.
		 * @param bool  $created  Whether the variable is new.
		 */
		$args = apply_filters( 'glovario_variable_saved_redirect_args', $id ? array() : array( 'glovario_created' => $result['id'] ), $result, ! $id );
		$this->redirect(
			$id ? __( 'Variable updated.', 'glovario' ) : __( 'Variable created.', 'glovario' ),
			'success',
			$args
		);
	}

	private function key_migration_confirmation() {
		$id       = isset( $_GET['id'] ) ? absint( $_GET['id'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only screen routing; nothing is changed.
		$variable = $id ? $this->repository->find( $id ) : null;
		if ( ! $variable ) {
			echo '<h1>' . esc_html__( 'Variable not found.', 'glovario' ) . '</h1>';
			return;
		}
		$matches = $this->scanner->matches( $variable['variable_key'] );
		?>
		<h1><?php esc_html_e( 'Review Key Migration', 'glovario' ); ?></h1>
		<div class="notice notice-warning inline"><p><strong><?php esc_html_e( 'Changing a key is a sensitive operation.', 'glovario' ); ?></strong> <?php /* translators: Glovario is the product name; do not translate it. */ esc_html_e( 'Glovario will migrate every detected reference with the same engine used by safe deletion. Review the affected locations before continuing.', 'glovario' ); ?></p><p><?php esc_html_e( 'References in PHP, themes, plugins, or unsupported builder storage cannot be detected and must be updated manually.', 'glovario' ); ?></p></div>
		<p><strong><?php esc_html_e( 'Current key', 'glovario' ); ?>:</strong> <code><?php echo esc_html( $variable['variable_key'] ); ?></code></p>
		<?php /* translators: %d: number of detected usage locations. */ ?>
		<p><?php printf( esc_html( _n( '%d detected location will be reviewed for migration.', '%d detected locations will be reviewed for migration.', count( $matches ), 'glovario' ) ), absint( count( $matches ) ) ); ?></p>
		<?php if ( $matches ) : ?>
		<table class="widefat striped"><thead><tr><th><?php esc_html_e( 'Location', 'glovario' ); ?></th><th><?php esc_html_e( 'Context or status', 'glovario' ); ?></th><th><?php esc_html_e( 'Detected as', 'glovario' ); ?></th></tr></thead><tbody>
			<?php foreach ( $matches as $match ) : ?>
			<tr><td><a href="<?php echo esc_url( $match['edit_link'] ); ?>"><?php echo esc_html( $match['title'] ); ?></a></td><td><?php echo esc_html( $match['context'] ); ?></td><td><?php echo esc_html( implode( ', ', $match['sources'] ) ); ?></td></tr>
		<?php endforeach; ?>
		</tbody></table>
		<?php endif; ?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="glovario_migrate_variable_key"><input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>"><input type="hidden" name="old_key" value="<?php echo esc_attr( $variable['variable_key'] ); ?>"><input type="hidden" name="reference_fingerprint" value="<?php echo esc_attr( $this->reference_fingerprint( $matches ) ); ?>">
			<?php wp_nonce_field( 'glovario_migrate_variable_key_' . $id ); ?>
			<p><label for="glovario-new-key"><strong><?php esc_html_e( 'New key', 'glovario' ); ?></strong></label><br><input class="regular-text code" id="glovario-new-key" name="new_key" type="text" maxlength="191" pattern="[a-z0-9_\-]+" required></p>
			<p><label><input type="checkbox" name="confirm_migration" value="1" required> <?php esc_html_e( 'I reviewed the detected locations and understand that unsupported references require manual changes.', 'glovario' ); ?></label></p>
			<?php submit_button( __( 'Migrate key and references', 'glovario' ), 'primary', 'submit', false ); ?> <a class="button" href="
			<?php
			echo esc_url(
				add_query_arg(
					array(
						'page' => 'glovario',
						'action' => 'edit',
						'id' => $id,
					),
					admin_url( 'admin.php' )
				)
			);
			?>
			"><?php esc_html_e( 'Cancel', 'glovario' ); ?></a>
		</form>
		<?php
	}

	public function migrate_key() {
		$this->guard();
		$id = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : 0;
		check_admin_referer( 'glovario_migrate_variable_key_' . $id );
		$variable = $id ? $this->repository->find( $id ) : null;
		$new_raw  = isset( $_POST['new_key'] ) ? strtolower( trim( wp_unslash( $_POST['new_key'] ) ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Strict validation follows.
		$new_key  = sanitize_key( $new_raw );
		$old_key  = isset( $_POST['old_key'] ) ? sanitize_key( wp_unslash( $_POST['old_key'] ) ) : '';
		if ( ! $variable || $variable['variable_key'] !== $old_key ) {
			$this->redirect( __( 'The variable key changed after the review. Start the migration again.', 'glovario' ), 'error' );
		}
		if ( ! isset( $_POST['confirm_migration'] ) || '' === $new_key || $new_key !== $new_raw || ! preg_match( '/^[a-z0-9_-]+$/', $new_raw ) || $new_key === $old_key || BuiltinVariables::is_reserved_key( $new_key ) || $this->repository->find_by_key( $new_key ) ) {
			$this->redirect(
				__( 'Enter a different, unique key using lowercase letters, numbers, hyphens, or underscores, and confirm the reviewed migration.', 'glovario' ),
				'error',
				array(
					'action' => 'rename',
					'id' => $id,
				)
			);
		}
		$matches = $this->scanner->matches( $old_key );
		$posted  = isset( $_POST['reference_fingerprint'] ) ? sanitize_text_field( wp_unslash( $_POST['reference_fingerprint'] ) ) : '';
		if ( ! hash_equals( $this->reference_fingerprint( $matches ), $posted ) ) {
			$this->redirect(
				__( 'Detected references changed after the review. Review the updated locations before migrating.', 'glovario' ),
				'error',
				array(
					'action' => 'rename',
					'id' => $id,
				)
			);
		}
		$result = $this->replacer->migrate_key(
			$variable,
			$new_key,
			$matches,
			function () use ( $id, $variable, $new_key ) {
				$updated                 = $variable;
				$updated['variable_key'] = $new_key;
				return $this->repository->update( $id, $updated );
			}
		);
		if ( is_wp_error( $result ) ) {
			$this->redirect(
				$result->get_error_message(),
				'error',
				array(
					'action' => 'rename',
					'id' => $id,
				)
			);
		}
		$this->redirect( __( 'Variable key and detected references migrated.', 'glovario' ) );
	}

	private function reference_fingerprint( $matches ) {
		$locations = array();
		foreach ( $matches as $match ) {
			$locations[] = array(
				'storage' => $match['storage'] ?? $match['kind'],
				'id'      => absint( $match['id'] ?? 0 ),
				'rule_id' => absint( $match['rule_id'] ?? 0 ),
			);
		}
		return hash( 'sha256', wp_json_encode( $locations ) );
	}

	public function delete() {
		$this->guard();
		$id = isset( $_POST['id'] ) ? absint( $_POST['id'] ) : 0;
		check_admin_referer( 'glovario_delete_variable_' . $id );
		$variable = $id ? $this->repository->find( $id ) : null;
		if ( ! $variable ) {
			$this->redirect( __( 'Variable not found.', 'glovario' ), 'error' );
		}
		$matches  = $this->scanner->matches( $variable['variable_key'] );
		$strategy = isset( $_POST['delete_strategy'] ) ? sanitize_key( wp_unslash( $_POST['delete_strategy'] ) ) : '';
		if ( $matches && ! in_array( $strategy, array( 'keep', 'value', 'empty' ), true ) ) {
			$this->redirect(
				__( 'Choose how to handle detected references.', 'glovario' ),
				'error',
				array(
					'action' => 'delete',
					'id' => $id,
				)
			);
		}
		if ( $matches && in_array( $strategy, array( 'value', 'empty' ), true ) ) {
			$result = $this->replacer->replace(
				$variable,
				$matches,
				$strategy,
				function () use ( $id ) {
					return $this->repository->delete( $id ) ? true : new \WP_Error( 'delete_failed', __( 'The variable could not be deleted.', 'glovario' ) );
				}
			);
			if ( is_wp_error( $result ) ) {
				$this->redirect(
					$result->get_error_message(),
					'error',
					array(
						'action' => 'delete',
						'id' => $id,
					)
				);
			}
			$this->redirect( __( 'Variable deleted.', 'glovario' ) );
		}
		if ( ! $id || ! $this->repository->delete( $id ) ) {
			$this->redirect( __( 'The variable could not be deleted.', 'glovario' ), 'error' );
		}
		$this->redirect( __( 'Variable deleted.', 'glovario' ) );
	}

	public function assign_category() {
		$this->guard();
		$id = isset( $_POST['variable_id'] ) ? absint( $_POST['variable_id'] ) : 0;
		check_admin_referer( 'glovario_assign_variable_category_' . $id );
		$variable   = $id ? $this->repository->find( $id ) : null;
		$category_id = isset( $_POST['category_id'] ) ? absint( $_POST['category_id'] ) : 0;
		$return_url  = isset( $_POST['return_to'] ) ? wp_validate_redirect( esc_url_raw( wp_unslash( $_POST['return_to'] ) ), admin_url( 'admin.php?page=glovario' ) ) : admin_url( 'admin.php?page=glovario' );
		if ( ! $variable ) {
			$this->redirect_to( $return_url, __( 'Variable not found.', 'glovario' ), 'error' );
		}
		if ( $category_id && ! $this->categories->find( $category_id ) ) {
			$this->redirect_to( $return_url, __( 'Select a valid variable category.', 'glovario' ), 'error' );
		}
		$result = $this->repository->assign_category( $id, $category_id );
		if ( is_wp_error( $result ) ) {
			$this->redirect_to( $return_url, $result->get_error_message(), 'error' );
		}
		$this->redirect_to( $return_url, __( 'Variable category updated.', 'glovario' ) );
	}

	public function save_settings() {
		$this->guard();
		check_admin_referer( 'glovario_save_settings' );
		update_option( TitleShortcodes::OPTION, isset( $_POST['title_shortcodes'] ) ? '1' : '0', true ); // Read on every front-end request.
		update_option( 'glovario_delete_on_uninstall', isset( $_POST['delete_on_uninstall'] ) ? '1' : '0', false );
		$this->redirect( __( 'Settings saved.', 'glovario' ) );
	}

	private function redirect_to( $url, $notice, $type = 'success' ) {
		set_transient(
			'glovario_notice_' . get_current_user_id(),
			array(
				'message' => $notice,
				'type'    => $type,
			),
			60
		);
		wp_safe_redirect( $url );
		exit;
	}
}