<?php
/**
 * Plugin Name: NMR HTML Blocks
 * Plugin URI:  https://namir.ro/nmr-html-blocks/
 * Description: Shows which plugins your pages and posts depend on and what would break if you deactivate them. Also brings back posts of removed custom post types, so they can be reviewed, exported or deleted.
 * Version:     1.0.0
 * Author:      mirceatm
 * Author URI:  https://namir.ro
 * License:     GPLv2 or later
 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 * Text Domain: nmr-html-blocks
 * Requires at least: 5.9
 * Requires PHP: 8.0
 */

if (!defined('ABSPATH')) exit;

define('NMRHTBL_VERSION', '1.0.0');
define('NMRHTBL_FILE',    __FILE__);

final class NMRHTBL_Plugin
{
    const SCREEN = 'nmr-html-blocks';

    /** Types WordPress and common plugins use internally: never exposed. */
    private const INTERNAL = [
        'post', 'page', 'attachment', 'revision', 'nav_menu_item', 'custom_css',
        'customize_changeset', 'oembed_cache', 'user_request', 'wp_block',
        'wp_template', 'wp_template_part', 'wp_global_styles', 'wp_navigation',
        'wp_font_family', 'wp_font_face', 'wp_pattern', 'auto-draft',
    ];

    /** Shortcodes whose rendered output the Pro converter turns into real core blocks (rows, columns, headings, lists, images, accordions ...). */
    private const FIX_CONVERTS = [
        'vc_row', 'vc_row_inner', 'vc_column', 'vc_column_inner', 'vc_column_text', 'vc_custom_heading', 'vc_single_image',
        'vc_separator', 'vc_empty_space', 'vc_tta_accordion', 'vc_tta_section', 'vc_raw_html',
        'trx_section', 'trx_title', 'trx_image', 'trx_list', 'trx_list_item', 'trx_button', 'trx_highlight', 'trx_tabs', 'trx_infobox',
    ];

    /** Post type => plugin that usually registers it. Only a hint; filter: nmrhtbl_sources. */
    private const SOURCES = [
        'bp-email' => 'BuddyPress', 'buddypress' => 'BuddyPress',
        'forum' => 'bbPress / BuddyPress', 'topic' => 'bbPress / BuddyPress', 'reply' => 'bbPress / BuddyPress',
        'product' => 'WooCommerce', 'product_variation' => 'WooCommerce', 'shop_order' => 'WooCommerce',
        'shop_order_refund' => 'WooCommerce', 'shop_coupon' => 'WooCommerce', 'shop_order_placehold' => 'WooCommerce',
        'tribe_events' => 'The Events Calendar', 'tribe_venue' => 'The Events Calendar',
        'tribe_organizer' => 'The Events Calendar', 'tribe-ea-record' => 'The Events Calendar',
        'wpcf7_contact_form' => 'Contact Form 7', 'flamingo_contact' => 'Flamingo', 'flamingo_inbound' => 'Flamingo',
        'flamingo_outbound' => 'Flamingo', 'elementor_library' => 'Elementor', 'acf-field-group' => 'Advanced Custom Fields',
        'acf-field' => 'Advanced Custom Fields', 'acf-post-type' => 'Advanced Custom Fields', 'acf-taxonomy' => 'Advanced Custom Fields',
        'tablepress_table' => 'TablePress', 'give_forms' => 'GiveWP', 'wpforms' => 'WPForms', 'nf_sub' => 'Ninja Forms',
        'vc_grid_item' => 'WPBakery Page Builder', 'vc4_templates' => 'WPBakery Page Builder', 'essential_grid' => 'Essential Grid',
        'sfwd-courses' => 'LearnDash', 'sfwd-lessons' => 'LearnDash', 'download' => 'Easy Digital Downloads',
        'edd_payment' => 'Easy Digital Downloads', 'edd_discount' => 'Easy Digital Downloads',
        'services' => 'a theme (typical for ThemeREX / RunCrew)', 'team' => 'a theme (typical for ThemeREX / RunCrew)',
        'testimonial' => 'a theme (typical for ThemeREX / RunCrew)', 'clients' => 'a theme', 'portfolio' => 'a theme',
    ];

    /** Phrases typical for placeholder text in theme demo content (lower case). Filter: nmrhtbl_demo_markers. */
    private const DEMO_MARKERS = [
        'lorem ipsum', 'dolor sit amet', 'sed ut perspiciatis', 'consectetuer adipiscing', 'consectetur adipiscing',
    ];

    /** Is the Pro add-on (nmr-html-blocks-pro) running? */
    static function pro_active(): bool
    {
        return class_exists('NMRHTBL_Pro');
    }

    static function init(): void
    {
        if (!is_admin()) return;
        // Late: every theme and plugin has had its chance to register its own types.
        add_action('init',       [self::class, 'register_orphans'], 99);
        add_action('admin_menu', [self::class, 'admin_menu']);
        // After WordPress has added the per-type submenus: put the overview first.
        add_action('admin_menu', [self::class, 'order_menu'], 999);
        add_action('admin_post_nmrhtbl_export', [self::class, 'export']);
        add_action('admin_post_nmrhtbl_save_settings', [self::class, 'save_settings']);
        add_action('load-plugins.php', [self::class, 'plugins_screen']);
        add_filter('plugin_action_links_' . plugin_basename(__FILE__), [self::class, 'action_links']);
    }

    // ── Discovery ─────────────────────────────────────────────────────────────

    /** @return array<string,array{total:int,statuses:array<string,int>}> keyed by post type */
    static function find_orphans(): array
    {
        global $wpdb;
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- one grouped count over all post types; no WP API does this, and the result is used once per request
        $rows = $wpdb->get_results(
            "SELECT post_type, post_status, COUNT(*) AS n FROM {$wpdb->posts} GROUP BY post_type, post_status"
        );
        $skip = apply_filters('nmrhtbl_exclude', self::INTERNAL);
        $out  = [];
        foreach ((array) $rows as $r) {
            if (in_array($r->post_type, $skip, true) || post_type_exists($r->post_type)) continue;
            if ($r->post_status === 'auto-draft') continue;
            $out[$r->post_type]['statuses'][$r->post_status] = (int) $r->n;
            $out[$r->post_type]['total'] = ($out[$r->post_type]['total'] ?? 0) + (int) $r->n;
        }
        ksort($out);
        return $out;
    }

    /** Orphans found at registration time; after that they are "registered" by this plugin. */
    private static ?array $found = null;

    static function register_orphans(): void
    {
        self::$found = self::find_orphans();
        foreach (self::$found as $type => $info) {
            // register_post_type() accepts 1-20 chars: [a-z0-9_-]
            if (strlen($type) > 20 || $type !== sanitize_key($type)) continue;

            $label = ucwords(str_replace(['-', '_'], ' ', $type));
            register_post_type($type, [
                'labels' => [
                    'name'          => $label . ' (orphan)',
                    'singular_name' => $label,
                    'all_items'     => $label . ' (' . (int) $info['total'] . ')',
                ],
                // Admin only: no front end URL, no search, no archive, no REST (classic editor,
                // so old shortcodes are not wrapped in blocks on save).
                'public'              => false,
                'publicly_queryable'  => false,
                'exclude_from_search' => true,
                'has_archive'         => false,
                'rewrite'             => false,
                'query_var'           => false,
                'show_in_rest'        => false,
                'show_ui'             => true,
                'show_in_menu'        => self::SCREEN, // all types under one main menu entry
                'show_in_admin_bar'   => false,
                'supports'            => ['title', 'editor', 'thumbnail', 'excerpt', 'custom-fields', 'page-attributes', 'revisions'],
                'capability_type'     => 'post',
                'capabilities'        => self::capabilities(),
                'map_meta_cap'        => true,
            ]);
        }
    }

    /** Administrators only. */
    private static function capabilities(): array
    {
        $keys = [
            'edit_posts', 'edit_others_posts', 'publish_posts', 'read_private_posts', 'create_posts',
            'delete_posts', 'delete_private_posts', 'delete_published_posts', 'delete_others_posts',
            'edit_private_posts', 'edit_published_posts',
        ];
        return array_fill_keys($keys, 'manage_options');
    }

    // ── Overview screen ───────────────────────────────────────────────────────

    static function admin_menu(): void
    {
        add_menu_page('NMR HTML Blocks', 'NMR HTML Blocks', 'manage_options', self::SCREEN, [self::class, 'screen'], 'dashicons-archive', 80);
        add_submenu_page(self::SCREEN, 'NMR HTML Blocks', 'Overview', 'manage_options', self::SCREEN, [self::class, 'screen']);
    }

    static function order_menu(): void
    {
        global $submenu;
        if (empty($submenu[self::SCREEN])) return;
        $first = [];
        $rest  = [];
        foreach ($submenu[self::SCREEN] as $item) {
            if ($item[2] === self::SCREEN) $first[] = $item; else $rest[] = $item;
        }
        $submenu[self::SCREEN] = array_merge(array_slice($first, 0, 1), $rest);
    }

    static function action_links(array $links): array
    {
        array_unshift($links, '<a href="' . esc_url(admin_url('admin.php?page=' . self::SCREEN)) . '">Open</a>');
        return $links;
    }

    static function screen(): void
    {
        if (!current_user_can('manage_options')) wp_die(esc_html__('Sorry, you are not allowed to access this page.', 'nmr-html-blocks'));

        // Pro (or any add-on) can add tabs: filter the list, then draw the tab on nmrhtbl_render_tab_{slug}.
        $tabs = apply_filters('nmrhtbl_tabs', ['impact' => 'Plugin impact', 'orphans' => 'Orphan post types']);
        $tab  = isset($_GET['tab']) ? sanitize_key(wp_unslash($_GET['tab'])) : 'impact'; // phpcs:ignore WordPress.Security.NonceVerification
        if (!self::pro_active()) $tabs += ['fix' => 'Fix it (Pro)', 'retire' => 'Retire pages (Pro)', 'simulate' => 'Simulate (Pro)']; // teasers only, no functionality
        if (!isset($tabs[$tab])) $tab = 'impact';
        $base = admin_url('admin.php?page=' . self::SCREEN);
        echo '<div class="wrap"><h1>NMR HTML Blocks</h1><nav class="nav-tab-wrapper">';
        foreach ($tabs as $slug => $label) {
            echo '<a class="nav-tab' . ($tab === $slug ? ' nav-tab-active' : '') . '" href="' . esc_url($slug === 'impact' ? $base : $base . '&tab=' . $slug) . '">' . esc_html($label) . '</a>';
        }
        echo '</nav>';
        if ($tab !== 'orphans') self::lost_data_banner($base . '&tab=orphans');
        if ($tab === 'orphans')      self::tab_orphans();
        elseif ($tab === 'impact')   self::tab_impact();
        elseif (!self::pro_active() && in_array($tab, ['simulate', 'fix', 'retire'], true)) self::tab_pro_teaser($tab);
        else                         do_action('nmrhtbl_render_tab_' . $tab);
        echo '</div>';
    }

    // ── Tab: orphan post types ────────────────────────────────────────────────

    private static function tab_orphans(): void
    {
        $orphans = self::$found ?? self::find_orphans();
        echo '<p>Post types that exist in the database but are not registered by the active theme or plugins. All of them are listed under this menu entry, with no public URL. Review and edit them there, export them, or delete them.</p>';

        if (!$orphans) {
            echo '<div class="notice notice-success inline"><p>No orphan post types found.</p></div>';
            return;
        }

        $mostly_demo = [];
        echo '<table class="widefat striped" style="max-width:900px"><thead><tr><th>Post type</th><th>Likely source</th><th>Posts</th><th>By status</th><th>Placeholder text</th><th>Admin</th><th>Export</th></tr></thead><tbody>';
        foreach ($orphans as $type => $info) {
            $parts = [];
            foreach ($info['statuses'] as $status => $n) $parts[] = esc_html($status) . ': ' . (int) $n;

            if (strlen($type) > 20 || $type !== sanitize_key($type)) {
                $link = '<em>cannot be registered (name longer than 20 characters or invalid)</em>';
            } else {
                $link = '<a href="' . esc_url(admin_url('edit.php?post_type=' . rawurlencode($type))) . '">Open list</a>';
            }
            $demo = self::count_demo($type);
            if ($demo > 0 && $demo >= $info['total'] / 2) $mostly_demo[] = $type;
            $demo_cell = $demo ? (int) $demo . ' of ' . (int) $info['total'] : '&ndash;';
            echo '<tr><td><code>' . esc_html($type) . '</code></td><td>' . (self::source_of($type) !== '' ? esc_html(self::source_of($type)) : '&ndash;') . '</td><td>' . (int) $info['total'] . '</td><td>' . wp_kses_post(implode(', ', $parts)) . '</td><td>' . wp_kses_post($demo_cell) . '</td><td>' . wp_kses_post($link) . '</td><td>'
                . '<a href="' . esc_url(self::export_url($type, 'csv')) . '">CSV</a> &middot; <a href="' . esc_url(self::export_url($type, 'json')) . '">JSON</a></td></tr>';
        }
        echo '</tbody></table>';
        if ($mostly_demo) {
            echo '<div class="notice notice-warning inline" style="max-width:900px"><p><strong>Looks like theme demo content:</strong> '
                . esc_html(implode(', ', $mostly_demo))
                . ' (half or more of the posts contain placeholder text such as &ldquo;lorem ipsum&rdquo;). This is a guess from the text only. Open the list, check a few posts, export a copy, and delete them if they are not real content.</p></div>';
        }

        self::shortcodes_section($orphans);
        echo '<p class="description">CSV has one row per post (no content). JSON includes the content and the custom fields. Custom fields appear in the Custom Fields box (enable it in Screen Options). Old page builder shortcodes show as plain text in the editor. Back up the database before bulk deleting.</p>';
    }

    // ── Plugins screen: warn before deactivating a plugin that live content uses ──

    const OPT_CONFIRM = 'nmrhtbl_confirm';

    /** @var array<string,array{name:string,items:string[],ids:int[],pub:int,titles:string[]}>|null plugin file => usage */
    private static ?array $usage = null;

    /** Above this many published items a scan is not started automatically on the Plugins screen. */
    const AUTO_SCAN_LIMIT = 20000;

    static function plugins_screen(): void
    {
        if (!current_user_can('activate_plugins')) return;
        self::$usage = self::plugin_usage();
        if (self::$usage === null) {
            add_action('admin_notices', static function () {
                echo '<div class="notice notice-info"><p><strong>NMR HTML Blocks:</strong> this site is large, so usage warnings are off until you <a href="'
                    . esc_url(admin_url('admin.php?page=' . self::SCREEN)) . '">run the scan once</a>.</p></div>';
            });
            return;
        }
        add_filter('plugin_row_meta',     [self::class, 'row_meta'], 10, 2);
        add_filter('plugin_action_links', [self::class, 'deactivate_link'], 99, 2);
        add_action('admin_enqueue_scripts', [self::class, 'plugins_script']);
    }

    /** @return array<string,array>|null null = not computed (large site, no cached scan) */
    private static function plugin_usage(): ?array
    {
        global $wpdb;
        $scan = get_transient(self::LIVE_CACHE);
        if (!is_array($scan) || !isset($scan['sc'], $scan['bl'])) {
            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- plain count, run only when the Plugins screen opens
            $n = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_status IN ('publish','private')");
            if ($n > self::AUTO_SCAN_LIMIT) return null;
            $scan = self::scan_live();
        }
        [$groups] = self::build_impact($scan);

        if (!function_exists('get_plugins')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
        $by_slug = [];
        foreach (get_plugins() as $file => $data) {
            $by_slug[strpos($file, '/') === false ? $file : strstr($file, '/', true)] = [$file, $data['Name']];
        }

        $out = [];
        foreach ($groups as $g) {
            if ($g['p']['kind'] !== 'plugin' || !isset($by_slug[$g['p']['slug']])) continue;
            [$file, $name] = $by_slug[$g['p']['slug']];
            $ids    = array_values(array_unique($g['ids']));
            $public = array_values(array_filter($ids, [self::class, 'is_public']));
            $items  = [];
            foreach ($g['items'] as $it) $items[] = $it['label'];
            $out[$file] = [
                'name'   => $name,
                'items'  => $items,
                'ids'    => $ids,
                'pub'    => count($public),
                'titles' => array_map(static fn($id) => wp_strip_all_tags(get_the_title($id)) ?: '#' . $id, array_slice($public, 0, 5)),
            ];
        }
        return $out;
    }

    static function row_meta(array $meta, string $file): array
    {
        $u = self::$usage[$file] ?? null;
        if (!$u) return $meta;
        $shown = array_slice($u['items'], 0, 4);
        $meta[] = '<span style="color:' . ($u['pub'] ? '#b32d2e' : '#50575e') . '"><strong>Used in ' . count($u['ids']) . ' posts (' . (int) $u['pub'] . ' public):</strong> '
            . esc_html(implode(' ', $shown)) . (count($u['items']) > 4 ? ' &hellip;' : '') . '</span> '
            . '<details style="display:inline"><summary>Show</summary>' . self::post_links($u['ids']) . '</details>';
        return $meta;
    }

    private static function confirm_text(string $file): string
    {
        $u = self::$usage[$file];
        $text = sprintf("Deactivating %s will break %d post(s), %d of them public, that use its shortcodes or blocks:\n", $u['name'], count($u['ids']), $u['pub']);
        foreach ($u['titles'] as $t) $text .= "\n• " . $t;
        if ($u['pub'] > count($u['titles'])) $text .= "\n• and " . ($u['pub'] - count($u['titles'])) . ' more';
        return $text . "\n\nBased on shortcodes and dynamic blocks in your content only. Continue?";
    }

    private static function wants_confirm(string $file): bool
    {
        return get_option(self::OPT_CONFIRM, '1') === '1' && !empty(self::$usage[$file]['pub']);
    }

    static function deactivate_link(array $actions, string $file): array
    {
        if (isset($actions['deactivate']) && self::wants_confirm($file)) {
            $actions['deactivate'] = preg_replace('/^<a /', '<a data-nmrhtbl="' . esc_attr(self::confirm_text($file)) . '" ', $actions['deactivate'], 1);
        }
        return $actions;
    }

    static function plugins_script(): void
    {
        $messages = [];
        foreach (array_keys((array) self::$usage) as $file) {
            if (self::wants_confirm($file)) $messages[$file] = self::confirm_text($file);
        }
        if (!$messages) return;
        wp_register_script('nmrhtbl-plugins', false, [], '1.0.0', true);
        wp_enqueue_script('nmrhtbl-plugins');
        $js = 'var nmrhtblMsgs=' . wp_json_encode($messages, JSON_HEX_TAG | JSON_HEX_AMP | JSON_UNESCAPED_UNICODE) . ';'
            . '(function(){'
            . 'document.addEventListener("click",function(e){var a=e.target.closest&&e.target.closest("a[data-nmrhtbl]");if(a&&!window.confirm(a.getAttribute("data-nmrhtbl")))e.preventDefault();});'
            . 'var f=document.getElementById("bulk-action-form");if(!f)return;'
            . 'f.addEventListener("submit",function(e){'
            . 'var a=f.querySelector("[name=action]"),b=f.querySelector("[name=action2]");'
            . 'if(!((a&&a.value==="deactivate-selected")||(b&&b.value==="deactivate-selected")))return;'
            . 'var m=[];f.querySelectorAll("input[name=\"checked[]\"]:checked").forEach(function(c){if(nmrhtblMsgs[c.value])m.push(nmrhtblMsgs[c.value]);});'
            . 'if(m.length&&!window.confirm(m.join("\n\n-----\n\n")))e.preventDefault();'
            . '});})();';
        wp_add_inline_script('nmrhtbl-plugins', $js);
    }

    static function save_settings(): void
    {
        if (!current_user_can('manage_options')) wp_die(esc_html__('Sorry, you are not allowed to do that.', 'nmr-html-blocks'), 403);
        check_admin_referer('nmrhtbl_settings');
        update_option(self::OPT_CONFIRM, !empty($_POST['confirm']) ? '1' : '0');
        wp_safe_redirect(admin_url('admin.php?page=' . self::SCREEN . '&saved=1'));
        exit;
    }

    // ── Tab: plugin impact (live content, detection only) ─────────────────────

    const LIVE_CACHE = 'nmrhtbl_live_scan2';
    const SRC_CACHE  = 'nmrhtbl_src_index';

    /**
     * Shortcodes and namespaced blocks used by live content (public post types and reusable blocks,
     * status publish/private). Raw scan only; providers are resolved when the report is drawn.
     *
     * @return array{scanned:int,time:int,sc:array,bl:array}
     */
    static function scan_live(bool $force = false): array
    {
        if (!$force) {
            $c = get_transient(self::LIVE_CACHE);
            if (is_array($c) && isset($c['sc'], $c['bl'])) return $c;
        }
        global $wpdb;
        $types = array_values(array_diff(array_unique(array_merge(array_keys(get_post_types(['public' => true])), ['wp_block'])), ['attachment']));
        $ph    = implode(',', array_fill(0, count($types), '%s'));
        $sc    = [];
        $bl    = [];
        $count = 0;
        $last  = 0;
        $cap   = 5000;
        do {
            // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $ph is a list of %s placeholders; scanning content in batches cannot use a WP API
            $rows = $wpdb->get_results($wpdb->prepare(
                "SELECT ID, post_content FROM {$wpdb->posts} WHERE post_type IN ($ph) AND post_status IN ('publish','private') AND ID > %d ORDER BY ID LIMIT 200",
                array_merge($types, [$last])
            ));
            // phpcs:enable
            foreach ((array) $rows as $r) {
                $last = (int) $r->ID;
                $count++;
                $txt = (string) $r->post_content;
                if (preg_match_all('/(?<!\[)\[([a-z][a-z0-9_-]*)(?=[\s\]\/])/i', $txt, $m)) {
                    // "Strong" = looks like a real shortcode: has a closing tag or attributes in this post.
                    $closers = preg_match_all('/\[\/([a-z][a-z0-9_-]*)\]/i', $txt, $cm) ? array_flip(array_map('strtolower', $cm[1])) : [];
                    $withat  = preg_match_all('/(?<!\[)\[([a-z][a-z0-9_-]*)\s+[a-z_-]+\s*=/i', $txt, $am) ? array_flip(array_map('strtolower', $am[1])) : [];
                    foreach (array_count_values(array_map('strtolower', $m[1])) as $tag => $n) {
                        $sc[$tag]['n'] = ($sc[$tag]['n'] ?? 0) + $n;
                        if (isset($closers[$tag]) || isset($withat[$tag])) $sc[$tag]['strong'] = ($sc[$tag]['strong'] ?? 0) + $n;
                        if (count($sc[$tag]['ids'] ?? []) < $cap) $sc[$tag]['ids'][] = $last;
                    }
                }
                if (preg_match_all('/<!--\s+wp:([a-z][a-z0-9-]*\/[a-z][a-z0-9-]*)[\s\/-]/', $txt, $m)) {
                    foreach (array_count_values($m[1]) as $name => $n) {
                        $bl[$name]['n'] = ($bl[$name]['n'] ?? 0) + $n;
                        if (count($bl[$name]['ids'] ?? []) < $cap) $bl[$name]['ids'][] = $last;
                    }
                }
            }
        } while ($rows && count($rows) === 200);

        $out = ['scanned' => $count, 'time' => time(), 'sc' => $sc, 'bl' => $bl];
        set_transient(self::LIVE_CACHE, $out, 10 * MINUTE_IN_SECONDS);
        return $out;
    }

    /**
     * Who defined this callback? Reflection gives the file; the folder tells the plugin or theme.
     *
     * @param mixed $cb
     * @return array{kind:string,slug:string}
     */
    /** The folder that holds all plugins (parent of this plugin's folder), without trailing slash. */
    private static function plugins_root(): string
    {
        return wp_normalize_path(dirname(untrailingslashit(plugin_dir_path(NMRHTBL_FILE))));
    }

    static function provider_of($cb): array
    {
        $unknown = ['kind' => 'unknown', 'slug' => ''];
        try {
            if ($cb instanceof Closure)                                  $r = new ReflectionFunction($cb);
            elseif (is_string($cb) && str_contains($cb, '::'))           $r = new ReflectionMethod(...explode('::', $cb, 2));
            elseif (is_string($cb))                                      $r = new ReflectionFunction($cb);
            elseif (is_array($cb) && count($cb) === 2)                   $r = new ReflectionMethod($cb[0], $cb[1]);
            elseif (is_object($cb))                                      $r = new ReflectionMethod($cb, '__invoke');
            else return $unknown;
            $file = $r->getFileName();
        } catch (Throwable $e) {
            return $unknown;
        }
        if (!$file) return $unknown;
        $f = wp_normalize_path($file);

        $roots = [['plugin', self::plugins_root() . '/'], ['theme', wp_normalize_path(get_theme_root()) . '/']];
        // Must-use plugins: the folder is taken from the loaded files, not from a constant.
        foreach (array_unique(array_map('dirname', wp_get_mu_plugins())) as $mu) $roots[] = ['mu', wp_normalize_path($mu) . '/'];
        foreach ($roots as [$kind, $root]) {
            if (str_starts_with($f, $root)) {
                return ['kind' => $kind, 'slug' => explode('/', substr($f, strlen($root)))[0]];
            }
        }
        if (str_starts_with($f, wp_normalize_path(ABSPATH))) return ['kind' => 'core', 'slug' => ''];
        return $unknown;
    }

    /** Display name and state of a provider. */
    static function provider_label(array $p): array
    {
        if ($p['kind'] === 'plugin') {
            if (!function_exists('get_plugins')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
            foreach (get_plugins() as $file => $data) {
                if ((strpos($file, '/') === false ? $file : strstr($file, '/', true)) === $p['slug']) {
                    return ['name' => $data['Name'], 'note' => is_plugin_active($file) ? 'plugin, active' : 'plugin, inactive'];
                }
            }
            return ['name' => $p['slug'], 'note' => 'plugin'];
        }
        if ($p['kind'] === 'mu') return ['name' => $p['slug'], 'note' => 'must-use plugin (cannot be deactivated here)'];
        if ($p['kind'] === 'theme') {
            $t = wp_get_theme($p['slug']);
            return ['name' => $t->exists() ? $t->get('Name') : $p['slug'], 'note' => 'theme'];
        }
        return ['name' => 'Unknown', 'note' => 'provider could not be determined'];
    }

    /**
     * Which installed (even inactive) plugin or theme calls add_shortcode() for which tag.
     * Reads PHP files, so it only runs when asked; the result is cached for an hour.
     *
     * @return array{time:int,files:int,capped:bool,map:array<string,string[]>}
     */
    static function build_source_index(): array
    {
        if (function_exists('set_time_limit')) @set_time_limit(60); // phpcs:ignore WordPress.PHP.NoSilencedErrors, Squiz.PHP.DiscouragedFunctions.Discouraged -- a scan of many files can take longer than the default limit
        $roots  = ['plugin' => self::plugins_root(), 'theme' => get_theme_root()];
        $skip   = ['node_modules', 'vendor', 'tests', '.git'];
        $map    = [];
        $files  = 0;
        $limit  = 20000;
        $capped = false;
        foreach ($roots as $kind => $root) {
            if (!is_dir($root)) continue;
            $root = wp_normalize_path($root) . '/';
            $it = new RecursiveIteratorIterator(new RecursiveCallbackFilterIterator(
                new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS),
                static fn($cur) => !($cur->isDir() && in_array($cur->getFilename(), $skip, true))
            ));
            foreach ($it as $f) {
                if (!$f->isFile() || strtolower($f->getExtension()) !== 'php' || $f->getSize() > 2 * MB_IN_BYTES) continue;
                if (++$files > $limit) { $capped = true; break 2; }
                $code = file_get_contents($f->getPathname());
                if ($code === false) continue;
                $tags = [];
                if (stripos($code, 'add_shortcode') !== false && preg_match_all('/add_shortcode\s*\(\s*[\'"]([A-Za-z0-9_-]+)[\'"]/', $code, $m)) $tags = $m[1];
                // Shortcode classes that declare their tag as a property: protected $slug = 'tec_tickets_checkout';
                if (stripos($code, 'shortcode') !== false && preg_match_all('/\$slug\s*=\s*[\'"]([A-Za-z0-9_-]+)[\'"]/', $code, $m)) $tags = array_merge($tags, $m[1]);
                // Docblock of a shortcode class: " * Shortcode [tec_tickets_checkout]." (Event Tickets, The Events Calendar)
                if (stripos($code, 'shortcode') !== false && preg_match_all('/Shortcode\s+\[([A-Za-z0-9_-]+)\]/', $code, $m)) $tags = array_merge($tags, $m[1]);
                if (!$tags) continue;
                $slug = explode('/', substr(wp_normalize_path($f->getPathname()), strlen($root)))[0];
                foreach ($tags as $tag) $map[strtolower($tag)][$kind . ':' . $slug] = true;
            }
        }
        $map = array_map('array_keys', $map);
        $out = ['time' => time(), 'files' => $files, 'capped' => $capped, 'map' => $map];
        set_transient(self::SRC_CACHE, $out, HOUR_IN_SECONDS);
        return $out;
    }

    /** Text for the "Installed provider" column. */
    private static function describe_sources(string $tag, array $src): string
    {
        $found = $src['map'][$tag] ?? [];
        // WPBakery defines its shortcodes through its own map, not with a literal add_shortcode().
        if (!$found && str_starts_with($tag, 'vc_')) {
            if (!function_exists('get_plugins')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
            foreach (get_plugins() as $file => $data) {
                if ($data['Name'] === 'WPBakery Page Builder') { $found = ['plugin:' . (strstr($file, '/', true) ?: $file)]; break; }
            }
        }
        if (!$found) return 'not found in installed plugins or themes';
        $out = [];
        foreach ($found as $k) {
            [$kind, $slug] = explode(':', $k, 2);
            $lab   = self::provider_label(['kind' => $kind, 'slug' => $slug]);
            $state = $lab['note'] === 'plugin, active'
                ? 'active, so it probably registers this later (likely fine)'
                : ($lab['note'] === 'theme' ? ($slug === get_stylesheet() || $slug === get_template() ? 'active theme, probably registers it later' : 'not the active theme') : 'not active: activating it restores this');
            $out[] = '<strong>' . esc_html($lab['name']) . '</strong><br><span class="description">' . esc_html($state) . '</span>';
        }
        return implode('<br>', $out);
    }

    /** Can a visitor who is not logged in open this post? */
    static function is_public(int $id): bool
    {
        return get_post_status($id) === 'publish' && get_post_field('post_password', $id) === '';
    }

    static function status_badge(int $id): string
    {
        $st = get_post_status($id);
        if ($st === 'publish') {
            return get_post_field('post_password', $id) !== ''
                ? '<span style="color:#996800">password protected</span>'
                : '<strong style="color:#b32d2e">public</strong>';
        }
        $names = ['private' => 'private', 'draft' => 'draft', 'pending' => 'pending review', 'future' => 'scheduled', 'trash' => 'trash'];
        return '<span style="color:#50575e">' . esc_html($names[$st] ?? (string) $st) . '</span>';
    }

    /** "14 (9 public)": how many of these posts a visitor can reach. */
    static function count_label(array $ids): string
    {
        $ids = array_values(array_unique($ids));
        $pub = count(array_filter($ids, [self::class, 'is_public']));
        return count($ids) . ' <span class="description">(' . $pub . ' public)</span>';
    }

    static function post_links(array $ids, int $max = 15): string
    {
        $ids = array_values(array_unique($ids));
        // Public first: those are the ones visitors see.
        usort($ids, static fn($a, $b) => (int) self::is_public($b) <=> (int) self::is_public($a));
        $html = '<ul style="margin:.5em 0 0 1.2em;list-style:disc">';
        foreach (array_slice($ids, 0, $max) as $id) {
            $title = get_the_title($id);
            $edit  = get_edit_post_link($id);
            $label = esc_html($title !== '' ? $title : '(no title) #' . $id);
            $front = (int) get_option('page_on_front') === $id ? ' <strong>[front page]</strong>' : ((int) get_option('page_for_posts') === $id ? ' <strong>[posts page]</strong>' : '');
            $view  = self::is_public($id) ? ' &middot; <a href="' . esc_url(get_permalink($id)) . '" target="_blank" rel="noopener">view</a>' : '';
            $html .= '<li>' . ($edit ? '<a href="' . esc_url($edit) . '">' . $label . '</a>' : $label) . $front
                . ' &middot; ' . self::status_badge($id)
                . ' <span class="description">' . esc_html(get_post_type($id) ?: '') . ' #' . (int) $id . ', /' . esc_html(get_post_field('post_name', $id)) . '/</span>' . $view . '</li>';
        }
        if (count($ids) > $max) $html .= '<li class="description">and ' . (count($ids) - $max) . ' more</li>';
        return $html . '</ul>';
    }

    /**
     * Group what live content uses by who provides it.
     *
     * @return array{0:array,1:array} [providers keyed "kind:slug", unregistered shortcodes/blocks]
     */
    static function build_impact(array $scan): array
    {
        global $shortcode_tags;
        $groups = [];
        $dead   = [];
        $add = static function (array &$groups, array $p, string $label, array $c) {
            $key = $p['kind'] . ':' . $p['slug'];
            $groups[$key]['p']       = $p;
            $groups[$key]['items'][] = ['label' => $label, 'n' => $c['n'], 'ids' => $c['ids']];
            $groups[$key]['ids']     = array_merge($groups[$key]['ids'] ?? [], $c['ids']);
        };

        foreach ($scan['sc'] as $tag => $c) {
            if (isset($shortcode_tags[$tag])) {
                $add($groups, self::provider_of($shortcode_tags[$tag]), '[' . $tag . ']', $c);
            } else {
                $dead[] = ['tag' => $tag, 'label' => '[' . $tag . ']', 'n' => $c['n'], 'ids' => $c['ids'], 'strong' => $c['strong'] ?? 0];
            }
        }
        $registry = WP_Block_Type_Registry::get_instance();
        foreach ($scan['bl'] as $name => $c) {
            if (str_starts_with($name, 'core/') || str_starts_with($name, 'core-embed/')) continue; // WordPress core (legacy embed names are migrated automatically)
            $bt = $registry->get_registered($name);
            if (!$bt) {
                $dead[] = ['label' => 'block ' . $name, 'n' => $c['n'], 'ids' => $c['ids']];
            } elseif (is_callable($bt->render_callback)) { // static blocks keep their saved HTML; only dynamic ones depend on the plugin
                $add($groups, self::provider_of($bt->render_callback), 'block ' . $name, $c);
            }
        }
        unset($groups['core:']);
        return [$groups, $dead];
    }

    private static function tab_impact(): void
    {
        global $shortcode_tags;

        $force = false;
        if (isset($_GET['rescan'])) { // phpcs:ignore WordPress.Security.NonceVerification -- verified next line
            check_admin_referer('nmrhtbl_rescan');
            $force = true;
        }
        $scan = self::scan_live($force);

        echo '<p>If you deactivate a plugin or switch the theme, anything it renders in your pages and posts stops working. This lists what your live content uses and where it comes from. Nothing is changed.</p>';
        echo '<p class="description">Scanned ' . (int) $scan['scanned'] . ' published items on ' . esc_html(wp_date('Y-m-d H:i', $scan['time']))
            . ' &middot; <a href="' . esc_url(wp_nonce_url(admin_url('admin.php?page=' . self::SCREEN . '&rescan=1'), 'nmrhtbl_rescan')) . '">Scan again</a></p>';

        [$groups, $dead] = self::build_impact($scan);

        uasort($groups, static fn($a, $b) => count(array_unique($b['ids'])) <=> count(array_unique($a['ids'])));

        echo '<h2>What your live content depends on</h2>';
        if (!$groups) {
            echo '<p>No shortcodes or dynamic blocks from plugins or the theme were found in live content.</p>';
        } else {
            echo '<table class="widefat striped" style="max-width:1000px"><thead><tr><th>Provider</th><th>Used in your content</th><th>Posts affected if removed</th></tr></thead><tbody>';
            foreach ($groups as $g) {
                $lab = self::provider_label($g['p']);
                usort($g['items'], static fn($a, $b) => $b['n'] <=> $a['n']);
                $items = [];
                foreach ($g['items'] as $it) $items[] = '<code>' . esc_html($it['label']) . '</code> &times;' . (int) $it['n'];
                $ids = array_values(array_unique($g['ids']));
                echo '<tr><td><strong>' . esc_html($lab['name']) . '</strong><br><span class="description">' . esc_html($lab['note']) . '</span></td><td>'
                    . wp_kses_post(implode(', ', $items)) . '</td><td>' . wp_kses_post(self::count_label($ids))
                    . '<details><summary>Show</summary>' . wp_kses_post(self::post_links($ids)) . '</details></td></tr>';
            }
            echo '</tbody></table>';
        }

        // Short bare words such as [at], [i], [if] are almost always plain text, not shortcodes.
        $texty = [];
        $real  = [];
        foreach ($dead as $d) {
            if (isset($d['tag']) && ($d['strong'] ?? 0) === 0 && !preg_match('/[_-]/', $d['tag'])) $texty[] = $d; else $real[] = $d;
        }

        $src = get_transient(self::SRC_CACHE);
        if (isset($_GET['findsrc'])) { // phpcs:ignore WordPress.Security.NonceVerification -- verified next line
            check_admin_referer('nmrhtbl_findsrc');
            $src = self::build_source_index();
        }

        echo '<h2 style="margin-top:2em">Nothing registers these right now</h2>';
        if (!$real) {
            echo '<p>No shortcodes or blocks without a provider were found.</p>';
        } else {
            echo '<p>These were not registered while this admin page loaded, so a visitor may see them as raw text or nothing. Two possible reasons: the plugin that provides them is <strong>not active</strong> (then your pages are really broken), or it is active but <strong>registers them later</strong>, only on the front end (then it is fine). '
                . 'Check a live page to be sure.</p>';
            if (is_array($src)) {
                echo '<p class="description">Installed plugin and theme files searched ' . esc_html(wp_date('Y-m-d H:i', $src['time'])) . ' (' . (int) $src['files'] . ' files' . ($src['capped'] ? ', stopped at the limit' : '') . '). '
                    . '<a href="' . esc_url(wp_nonce_url(admin_url('admin.php?page=' . self::SCREEN . '&findsrc=1'), 'nmrhtbl_findsrc')) . '">Search again</a></p>';
            } else {
                echo '<p><a class="button" href="' . esc_url(wp_nonce_url(admin_url('admin.php?page=' . self::SCREEN . '&findsrc=1'), 'nmrhtbl_findsrc')) . '">Find which installed plugin or theme provides them</a> <span class="description">reads the PHP files in your plugins and themes folders once (can take a few seconds)</span></p>';
            }
            usort($real, static fn($a, $b) => $b['n'] <=> $a['n']);
            echo '<table class="widefat striped" style="max-width:1000px"><thead><tr><th>Shortcode / block</th><th>Occurrences</th><th>Posts</th><th>Installed provider</th></tr></thead><tbody>';
            foreach ($real as $d) {
                $ids  = array_values(array_unique($d['ids']));
                $prov = isset($d['tag']) && is_array($src) ? self::describe_sources($d['tag'], $src) : '&ndash;';
                echo '<tr><td><code>' . esc_html($d['label']) . '</code></td><td>' . (int) $d['n'] . '</td><td>' . wp_kses_post(self::count_label($ids))
                    . '<details><summary>Show</summary>' . wp_kses_post(self::post_links($ids)) . '</details></td><td>' . wp_kses_post($prov) . '</td></tr>';
            }
            echo '</tbody></table>';
        }

        if ($texty) {
            usort($texty, static fn($a, $b) => $b['n'] <=> $a['n']);
            $parts = [];
            foreach ($texty as $d) $parts[] = '<code>' . esc_html($d['label']) . '</code> &times;' . (int) $d['n'];
            echo '<h3 style="margin-top:1.5em">Probably plain text</h3><p class="description">Short words in brackets with no attributes and no closing tag, for example an obfuscated e-mail address. Not treated as shortcodes: ' . wp_kses_post(implode(', ', $parts)) . '</p>';
        }

        if (isset($_GET['saved'])) echo '<div class="notice notice-success inline"><p>Saved.</p></div>'; // phpcs:ignore WordPress.Security.NonceVerification
        echo '<h2 style="margin-top:2em">Plugins screen</h2><form method="post" action="' . esc_url(admin_url('admin-post.php')) . '">';
        wp_nonce_field('nmrhtbl_settings');
        echo '<input type="hidden" name="action" value="nmrhtbl_save_settings"><p><label><input type="checkbox" name="confirm" value="1"' . checked(get_option(self::OPT_CONFIRM, '1'), '1', false) . '> Ask for confirmation before deactivating a plugin that public pages use</label></p>'
            . '<p class="description">The Plugins screen always shows which posts use each plugin. This only controls the confirmation dialog.</p>';
        submit_button('Save', 'secondary', 'submit', false);
        echo '</form>';

        echo '<p class="description" style="margin-top:2em"><strong>What this does not check:</strong> shortcodes in widgets, options or custom fields, page builder data stored in post meta (for example Elementor), and anything a plugin does through hooks, CSS or JavaScript. Use it as a first warning, then test on a copy of the site.</p>';
    }

    // ── Shortcode inventory (detection only, nothing is written) ──────────────

    /**
     * Opening shortcode tags used in the posts of one type. Shortcodes are not registered any more,
     * so shortcode_parse_atts()/get_shortcode_regex() cannot be used: scan the text.
     *
     * @return array{tags:array<string,array{n:int,posts:int}>,posts:int,total:int}
     */
    static function scan_shortcodes(string $type): array
    {
        global $wpdb;
        $tags = [];
        $with = 0;
        $last = 0;
        do {
            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- batched scan of the content of types WordPress no longer registers
            $rows = $wpdb->get_results($wpdb->prepare(
                "SELECT ID, post_content FROM {$wpdb->posts} WHERE post_type = %s AND post_status <> 'auto-draft' AND ID > %d ORDER BY ID LIMIT 200",
                $type, $last
            ));
            foreach ((array) $rows as $r) {
                $last = (int) $r->ID;
                if (!preg_match_all('/(?<!\[)\[([a-z][a-z0-9_-]*)(?=[\s\]\/])/i', (string) $r->post_content, $m)) continue;
                $with++;
                foreach (array_count_values(array_map('strtolower', $m[1])) as $tag => $n) {
                    $tags[$tag]['n']     = ($tags[$tag]['n'] ?? 0) + $n;
                    $tags[$tag]['posts'] = ($tags[$tag]['posts'] ?? 0) + 1;
                }
            }
        } while ($rows && count($rows) === 200);

        uasort($tags, static fn($a, $b) => $b['n'] <=> $a['n']);
        return ['tags' => $tags, 'posts' => $with, 'total' => array_sum(array_column($tags, 'n'))];
    }

    private static function demo_markers(): array
    {
        return array_map('strtolower', (array) apply_filters('nmrhtbl_demo_markers', self::DEMO_MARKERS));
    }

    /** Does this text contain placeholder (lorem ipsum style) text? */
    static function looks_like_demo(string $text): bool
    {
        $text = strtolower($text);
        foreach (self::demo_markers() as $m) {
            if ($m !== '' && str_contains($text, $m)) return true;
        }
        return false;
    }

    /** Posts of one type whose title, excerpt or content contains placeholder text. */
    static function count_demo(string $type): int
    {
        global $wpdb;
        $markers = array_filter(self::demo_markers(), 'strlen');
        if (!$markers) return 0;
        $likes = [];
        $args  = [$type];
        foreach ($markers as $m) {
            $likes[] = '(post_content LIKE %s OR post_title LIKE %s OR post_excerpt LIKE %s)';
            $like    = '%' . $wpdb->esc_like($m) . '%';
            array_push($args, $like, $like, $like);
        }
        $sql = "SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_type = %s AND post_status <> 'auto-draft' AND (" . implode(' OR ', $likes) . ')'; // $likes holds only LIKE %s placeholders
        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter -- placeholders only, every value is passed to prepare()
        return (int) $wpdb->get_var($wpdb->prepare($sql, $args));
    }

    private static function source_of(string $type): string
    {
        $map = apply_filters('nmrhtbl_sources', self::SOURCES);
        return $map[$type] ?? '';
    }

    /** What the Pro fix does with a dead shortcode: 'convert' (real blocks) or 'simplify' (text and images kept, layout simplified). */
    private static function fix_mode(string $tag): string
    {
        return (string) apply_filters('nmrhtbl_fix_mode', in_array($tag, self::FIX_CONVERTS, true) ? 'convert' : 'simplify', $tag);
    }

    const PRO_URL = 'https://namir.ro/downloads/nmr-html-blocks-pro/';

    /** Static picture of a Pro tab, so free users see what they would get. Nothing here works. */
    private static function tab_pro_teaser(string $tab): void
    {
        if ($tab === 'retire') {
            $title = 'Retire pages: clean out demo and leftover pages safely';
            $text  = 'Pro suggests pages with placeholder text, lets you make them private or trash them in bulk, and sends visitors from the old address to a page you choose with a 301 redirect. You confirm a summary first, and every page can be restored.';
            $mock  = '<tr><td>Pages</td><td><label><input type="checkbox" checked disabled> Home 3 <em>(placeholder text)</em></label><br><label><input type="checkbox" checked disabled> Shop layout 2 <em>(placeholder text, in a menu)</em></label></td></tr>'
                   . '<tr><td>Action</td><td>Make private &middot; Move to trash</td></tr>'
                   . '<tr><td>Redirect to</td><td>Home page &middot; A page &middot; An address</td></tr>'
                   . '<tr><td></td><td><button class="button button-primary" disabled>Review changes</button></td></tr>';
        } elseif ($tab === 'simulate') {
            $title = 'Simulate: see a page without a plugin, before you deactivate it';
            $text  = 'Pick a page and one or more plugins. Pro shows the page as if they were off: their shortcodes, blocks, scripts, styles and hooks are switched off for that one view. Administrators only, nothing is changed, and the view is not indexed or cached.';
            $mock  = '<tr><td>Page</td><td><select disabled><option>Home</option></select></td></tr>'
                   . '<tr><td>Switch off</td><td><label><input type="checkbox" checked disabled> WPBakery Page Builder</label><br><label><input type="checkbox" disabled> Contact Form 7</label></td></tr>'
                   . '<tr><td></td><td><button class="button button-primary" disabled>Preview without these plugins</button></td></tr>';
        } else {
            $title = 'Fix it: turn pages into plain WordPress blocks';
            $text  = 'Pick the plugin or theme you want to leave. Pro converts the pages that use its shortcodes, shows Before and After side by side, backs up each page, and lets you undo every conversion. Rules decide what happens to each shortcode.';
            $mock  = '<tr><td>Leaving</td><td><select disabled><option>WPBakery Page Builder</option></select></td></tr>'
                   . '<tr><td>Pages</td><td>Home &middot; About &middot; Services &middot; Contact<br><em>Before | After, scrolling together</em></td></tr>'
                   . '<tr><td></td><td><button class="button button-primary" disabled>Apply</button> <button class="button" disabled>Discard</button> <button class="button" disabled>Undo</button></td></tr>';
        }
        echo '<div style="max-width:900px;margin-top:16px"><h2>' . esc_html($title) . '</h2><p>' . esc_html($text) . '</p>';
        echo '<div style="opacity:.75;border:1px dashed #c3c4c7;background:#fff;padding:8px 16px;pointer-events:none"><p class="description">Preview of the Pro screen. Nothing on it works in this version.</p>'
            . '<table class="form-table" role="presentation">' . $mock . '</table></div>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $mock is built above from literals only
        printf(
            '<p style="margin-top:16px"><a class="button button-primary" href="%s" target="_blank" rel="noopener">Get NMR HTML Blocks Pro</a></p></div>',
            esc_url(self::PRO_URL)
        );
    }

    /** Free-version advertisement: content hidden by removed post types can be reached again. */
    private static function lost_data_banner(string $url): void
    {
        $orphans = self::$found ?? self::find_orphans();
        if (!$orphans) return;
        $names = [];
        foreach (array_slice($orphans, 0, 4, true) as $type => $info) {
            $names[] = esc_html(ucfirst(str_replace(['_', '-'], ' ', (string) $type))) . ' (' . (int) $info['total'] . ')';
        }
        printf(
            '<div class="notice notice-success inline" style="max-width:900px"><p><strong>Get your lost data back.</strong> Content left behind by a removed theme or plugin is still in your database: %s%s. NMR HTML Blocks makes it visible again in the admin, so you can review, edit, export or delete it. <a href="%s">Show me my lost data</a></p></div>',
            implode(', ', $names), count($orphans) > 4 ? ' and more' : '', esc_url($url) // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- every name is passed through esc_html() above
        );
    }

    /** Upsell box: what the Pro add-on does, with the numbers found on this site. */
    private static function pro_preview(int $built, int $grand, int $active): void
    {
        $url = self::PRO_URL;
        echo '<div class="notice notice-info inline" style="max-width:900px;padding:12px 16px">';
        echo '<h3 style="margin:0 0 6px">Fix this with NMR HTML Blocks Pro</h3>';
        printf(
            '<p>%d of %d dead shortcode occurrences (%d%%) convert directly to plain WordPress blocks; the rest keep their text and images with a simpler layout. %s</p>',
            (int) $built, (int) $grand, (int) round(100 * $built / $grand),
            $active ? (int) $active . ' more still work and need no fix.' : ''
        );
        echo '<div style="display:flex;gap:12px;flex-wrap:wrap;margin:10px 0">'
            . '<div style="flex:1;min-width:220px;border:1px solid #c3c4c7;background:#fff;padding:8px 12px"><strong>Before</strong><br><code>[vc_row][vc_column][vc_column_text]Hello[/vc_column_text][/vc_column][/vc_row]</code></div>'
            . '<div style="flex:1;min-width:220px;border:1px solid #00a32a;background:#fff;padding:8px 12px"><strong>After</strong><br>Group, Columns and Paragraph blocks. No old plugin or theme needed.</div>'
            . '</div>';
        echo '<ul style="list-style:disc;margin-left:20px">'
            . '<li><strong>Fix it:</strong> convert the pages to blocks, with a before/after preview of each page.</li>'
            . '<li><strong>Backup and undo:</strong> every page is backed up and each conversion can be undone.</li>'
            . '<li><strong>Rules:</strong> per shortcode, convert it, keep it live, remove it, or replace it with your own HTML or blocks.</li>'
            . '<li><strong>Retire pages:</strong> make demo and leftover pages private or trash them in bulk, with 301 redirects and restore.</li>'
            . '<li><strong>Simulate:</strong> preview any page as if a plugin were deactivated, before you deactivate it.</li>'
            . '<li><strong>Pictures:</strong> images that would disappear with the old plugin or theme are copied into your Media Library.</li>'
            . '</ul>';
        printf(
            '<p><a class="button button-primary" href="%s" target="_blank" rel="noopener">Get NMR HTML Blocks Pro</a> <span class="description">This plugin changes nothing on your site.</span></p>',
            esc_url($url)
        );
        echo '</div>';
    }

    private static function shortcodes_section(array $orphans): void
    {
        echo '<h2 style="margin-top:2em">Shortcodes found</h2>';
        echo '<p>Dead shortcodes left by page builders show up as raw text such as <code>[vc_row]</code>. This is what the posts contain.</p>';

        $grand  = 0; // occurrences that really are dead (no active plugin renders them)
        $built  = 0;
        $active = 0;
        foreach (array_keys($orphans) as $type) {
            $scan = self::scan_shortcodes($type);
            echo '<h3><code>' . esc_html($type) . '</code></h3>';
            if (!$scan['tags']) {
                echo '<p>No shortcodes found.</p>';
                continue;
            }
            echo '<p>' . (int) $scan['total'] . ' shortcode occurrences in ' . (int) $scan['posts'] . ' posts.</p>';
            echo '<table class="widefat striped" style="max-width:900px"><thead><tr><th>Shortcode</th><th>Occurrences</th><th>Posts</th><th>Fix it in Pro</th></tr></thead><tbody>';
            $shown = 0;
            foreach ($scan['tags'] as $tag => $c) {
                $alive = shortcode_exists($tag);
                $sug   = $alive ? '' : self::fix_mode($tag);
                if ($alive) {
                    $active += $c['n'];
                } else {
                    $grand += $c['n'];
                    $built += $sug === 'convert' ? $c['n'] : 0;
                }
                if (++$shown > 60) continue; // totals still count the rest
                echo '<tr><td><code>[' . esc_html($tag) . ']</code></td><td>' . (int) $c['n'] . '</td><td>' . (int) $c['posts'] . '</td><td>'
                    . ($alive ? 'Still works (a plugin or theme renders it)' : ($sug === 'convert' ? 'Converts to blocks' : 'Text and images kept, layout simplified')) . '</td></tr>';
            }
            echo '</tbody></table>';
            if ($shown > 60) echo '<p class="description">' . (int) ($shown - 60) . ' more shortcodes not shown.</p>';
        }

        if ($grand && !self::pro_active()) {
            self::pro_preview($built, $grand, $active);
        } elseif (!$grand && $active) {
            echo '<div class="notice notice-success inline" style="max-width:900px"><p>All the shortcodes found are still rendered by an active plugin or theme. Nothing needs fixing.</p></div>';
        }
    }

    // ── Export ────────────────────────────────────────────────────────────────

    private static function export_url(string $type, string $format): string
    {
        return wp_nonce_url(
            admin_url('admin-post.php?action=nmrhtbl_export&type=' . rawurlencode($type) . '&format=' . $format),
            'nmrhtbl_export_' . $type
        );
    }

    static function export(): void
    {
        $type   = isset($_GET['type']) ? sanitize_text_field(wp_unslash($_GET['type'])) : '';
        $format = isset($_GET['format']) && $_GET['format'] === 'json' ? 'json' : 'csv';

        if (!current_user_can('manage_options')) wp_die(esc_html__('Sorry, you are not allowed to do that.', 'nmr-html-blocks'), 403);
        check_admin_referer('nmrhtbl_export_' . $type);

        $orphans = self::$found ?? self::find_orphans();
        if ($type === '' || !isset($orphans[$type])) wp_die(esc_html__('Unknown post type.', 'nmr-html-blocks'), 404);

        global $wpdb;
        nocache_headers();
        $name = 'nmr-orphan-' . sanitize_file_name($type) . '-' . gmdate('Ymd');
        if ($format === 'json') {
            header('Content-Type: application/json; charset=utf-8');
            header('Content-Disposition: attachment; filename="' . $name . '.json"');
            echo '[';
        } else {
            header('Content-Type: text/csv; charset=utf-8');
            header('Content-Disposition: attachment; filename="' . $name . '.csv"');
            echo "\xEF\xBB\xBF"; // BOM so Excel reads UTF-8 (Romanian diacritics)
            $out = fopen('php://output', 'w');
            fputcsv($out, ['ID', 'title', 'slug', 'status', 'date', 'modified', 'content_length', 'placeholder_text', 'shortcodes', 'custom_fields']);
        }

        $first = true;
        $last  = 0;
        do {
            // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- batched read of one post type for the export
            $rows = $wpdb->get_results($wpdb->prepare(
                "SELECT * FROM {$wpdb->posts} WHERE post_type = %s AND post_status <> 'auto-draft' AND ID > %d ORDER BY ID LIMIT 200",
                $type, $last
            ));
            foreach ((array) $rows as $r) {
                $last = (int) $r->ID;
                preg_match_all('/(?<!\[)\[([a-z][a-z0-9_-]*)(?=[\s\]\/])/i', (string) $r->post_content, $m);
                $tags = array_values(array_unique(array_map('strtolower', $m[1])));
                $meta = get_post_meta($r->ID);
                $meta = array_filter((array) $meta, static fn($k) => $k !== '_edit_lock' && $k !== '_edit_last', ARRAY_FILTER_USE_KEY);

                if ($format === 'json') {
                    echo ($first ? '' : ',') . wp_json_encode([
                        'ID' => (int) $r->ID, 'title' => $r->post_title, 'slug' => $r->post_name, 'status' => $r->post_status,
                        'date' => $r->post_date, 'modified' => $r->post_modified, 'excerpt' => $r->post_excerpt,
                        'content' => $r->post_content, 'placeholder_text' => self::looks_like_demo($r->post_title . ' ' . $r->post_excerpt . ' ' . $r->post_content), 'shortcodes' => $tags,
                        'custom_fields' => array_map(static fn($v) => array_map('maybe_unserialize', $v), $meta),
                    ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
                } else {
                    fputcsv($out, array_map([self::class, 'csv_safe'], [
                        (string) $r->ID, $r->post_title, $r->post_name, $r->post_status, $r->post_date, $r->post_modified,
                        (string) strlen($r->post_content), self::looks_like_demo($r->post_title . ' ' . $r->post_excerpt . ' ' . $r->post_content) ? 'yes' : '', implode(' ', $tags), implode(' ', array_keys($meta)),
                    ]));
                }
                $first = false;
            }
        } while ($rows && count($rows) === 200);

        if ($format === 'json') echo ']';
        exit;
    }

    /** Stop spreadsheets from running a cell that starts with = + - @ as a formula. */
    static function csv_safe(string $v): string
    {
        return $v !== '' && strpbrk($v[0], "=+-@\t\r") !== false ? "'" . $v : $v;
    }
}

NMRHTBL_Plugin::init();