<?php
/**
 * Vidal Security AI — Módulo premium «Guardián IA».
 *
 * Sin clave de sitio (site_key) el plugin funciona exactamente igual que la
 * versión gratuita: este módulo no envía ni pide nada. Con la clave y el
 * interruptor activados:
 *
 *  - Registra eventos de seguridad (accesos, sondeos) en un buffer local.
 *  - Los envía por lotes cada hora a la ingesta del cerebro (n8n en V8).
 *  - Lee el reporte del cerebro — su clasificación de los eventos y el
 *    texto del «parte del guardia» — y lo muestra en el panel como dato:
 *    el Guardián asesora. Esta edición nunca aplica bloqueos ni ningún
 *    otro cambio ordenado por el servicio: todo bloqueo lo decide el
 *    propio plugin en local, con datos del propio sitio.
 *
 * Contrato con el cerebro (ajuste «Cerebro», v1.15.0):
 *  - Cerebro «n8n» (por defecto, el de siempre):
 *    Ingesta: POST https://v8.vidalbooking.com/webhook/sec-ingest  {site_key, site, events[]}
 *    Reporte: GET  https://v8.vidalbooking.com/webhook/sec-report?site_key=...
 *  - Cerebro «Vidal Flow» (el cerebro nuevo, también en V8):
 *    Ingesta: POST https://v8.vidalbooking.com/flow/sec-ingest
 *    Reporte: GET  https://v8.vidalbooking.com/flow/sec-report?site_key=...
 *  La base es fija en código (VSAI_DEFAULT_SERVER / VSAI_FLOW_BASE) y
 *  el selector SOLO ofrece estos dos servicios oficiales de Vidal: no
 *  hay ningún campo de URL libre para ningún cerebro, así la clave de
 *  sitio nunca puede enviarse a un destino arbitrario.
 *
 * @package VidalSecurityAI
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

define( 'VSAI_DEFAULT_SERVER', 'https://v8.vidalbooking.com' );
define( 'VSAI_FLOW_BASE', 'https://v8.vidalbooking.com/flow/' );
define( 'VSAI_EVENTS_MAX', 200 );

/* ------------------------------------------------------------------------
 * Ajustes y estado
 * ---------------------------------------------------------------------- */

/**
 * Ajustes premium guardados, con valores por defecto.
 *
 * @return array
 */
function vsai_premium_get_settings() {
	$saved = get_option( 'vsai_premium_settings', array() );
	if ( ! is_array( $saved ) ) {
		$saved = array();
	}
	return array_merge(
		array(
			'site_key'    => '',
			'server_url'  => VSAI_DEFAULT_SERVER,
			'brain'       => 'n8n',
			'guardian_on' => false,
		),
		$saved
	);
}

/**
 * Cerebro elegido en los ajustes: 'n8n' (el de siempre) o 'flow'
 * (Vidal Flow). Cualquier valor guardado que no sea 'flow' cae a 'n8n':
 * la lista de cerebros es cerrada a propósito (ver la cabecera del módulo).
 *
 * @return string 'n8n' | 'flow'.
 */
function vsai_premium_brain() {
	$p = vsai_premium_get_settings();
	return ( isset( $p['brain'] ) && 'flow' === $p['brain'] ) ? 'flow' : 'n8n';
}

/**
 * ¿Está el Guardián IA activo? (interruptor encendido + clave guardada).
 *
 * @return bool
 */
function vsai_premium_is_active() {
	$p = vsai_premium_get_settings();
	return ! empty( $p['guardian_on'] ) && '' !== trim( (string) $p['site_key'] );
}

/**
 * URL de un webhook del cerebro.
 *
 * @param string $which 'ingest' | 'report'.
 * @return string
 */
function vsai_premium_endpoint( $which ) {
	$p = vsai_premium_get_settings();
	if ( 'flow' === vsai_premium_brain() ) {
		// Cerebro Vidal Flow: rutas fijas oficiales (sin URL configurable).
		if ( 'ingest' === $which ) {
			return VSAI_FLOW_BASE . 'sec-ingest';
		}
		return VSAI_FLOW_BASE . 'sec-report?site_key=' . rawurlencode( trim( (string) $p['site_key'] ) );
	}
	// Base oficial fija (sin URL de servidor configurable en esta
	// edición): la clave de sitio solo viaja a los servicios de Vidal.
	$base = trailingslashit( VSAI_DEFAULT_SERVER );
	if ( 'ingest' === $which ) {
		return $base . 'webhook/sec-ingest';
	}
	return $base . 'webhook/sec-report?site_key=' . rawurlencode( trim( (string) $p['site_key'] ) );
}

/**
 * IP del visitante actual (REMOTE_ADDR validada; '' si no es válida).
 *
 * @return string
 */
function vsai_premium_client_ip() {
	$ip = '';
	if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
		$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
	}
	return ( $ip && filter_var( $ip, FILTER_VALIDATE_IP ) ) ? $ip : '';
}

/* ------------------------------------------------------------------------
 * Registro de eventos
 * ---------------------------------------------------------------------- */

/**
 * Añade un evento al buffer local (máx. 200, FIFO). Sin premium activo no
 * se registra nada: la versión gratuita no recopila eventos.
 *
 * @param string $type Tipo de evento del contrato.
 * @param array  $args Campos opcionales: ip, ua, path, user_tried, detail.
 */
function vsai_premium_log_event( $type, $args = array() ) {
	if ( ! vsai_premium_is_active() ) {
		return;
	}
	$ua = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
	// La ruta viaja sin parámetros (igual que en la red de sensores):
	// la query string se recorta para que ningún token o dato de un
	// formulario pueda colarse en un evento.
	$raw_path  = isset( $args['path'] ) ? (string) $args['path'] : ( isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '' );
	$only_path = wp_parse_url( $raw_path, PHP_URL_PATH );
	$path      = is_string( $only_path ) ? $only_path : ''; // Malformed URLs must not leak a query string.

	$event = array(
		'ts'         => time(),
		'type'       => sanitize_key( $type ),
		'ip'         => isset( $args['ip'] ) ? $args['ip'] : vsai_premium_client_ip(),
		'ua'         => substr( isset( $args['ua'] ) ? $args['ua'] : $ua, 0, 200 ),
		'path'       => substr( $path, 0, 200 ),
		'user_tried' => substr( isset( $args['user_tried'] ) ? (string) $args['user_tried'] : '', 0, 100 ),
		'detail'     => substr( isset( $args['detail'] ) ? (string) $args['detail'] : '', 0, 300 ),
	);

	$events   = get_option( 'vsai_events', array() );
	$events   = is_array( $events ) ? $events : array();
	$events[] = $event;
	if ( count( $events ) > VSAI_EVENTS_MAX ) {
		$events = array_slice( $events, -VSAI_EVENTS_MAX );
	}
	update_option( 'vsai_events', $events, false );
}

/**
 * Envía una ALERTA URGENTE al cerebro para reenvío inmediato por WhatsApp
 * (v1.10.0). Solo con el Guardián activo; freno anti-duplicados de 6 h por
 * clave. El cerebro elige la plantilla según el idioma registrado del sitio
 * y el teléfono del dueño registrado para la clave: el plugin no conoce
 * números ni credenciales de mensajería.
 *
 * @param string $title      Titular corto y humano.
 * @param string $detail     Una o dos frases con lo esencial.
 * @param string $dedupe_key Clave del incidente (p. ej. 'pay_wave').
 */
function vsai_premium_send_urgent( $title, $detail, $dedupe_key ) {
	if ( ! vsai_premium_is_active() ) {
		return;
	}
	$k = 'vsai_urg_' . md5( (string) $dedupe_key );
	if ( get_transient( $k ) ) {
		return;
	}
	set_transient( $k, 1, 6 * HOUR_IN_SECONDS );
	$p       = vsai_premium_get_settings();
	$payload = array(
		'site_key' => trim( (string) $p['site_key'] ),
		'site'     => (string) wp_parse_url( home_url(), PHP_URL_HOST ),
		'events'   => array(
			array(
				'ts'         => time(),
				'type'       => 'urgent',
				'urgent'     => true,
				'title'      => substr( (string) $title, 0, 120 ),
				'detail'     => substr( (string) $detail, 0, 300 ),
				'ip'         => '',
				'ua'         => '',
				'path'       => '',
				'user_tried' => '',
			),
		),
	);
	wp_safe_remote_post(
		vsai_premium_endpoint( 'ingest' ),
		array(
			'timeout' => 8,
			'redirection' => 0,
			'limit_response_size' => 1048576,
			'headers' => array( 'Content-Type' => 'application/json' ),
			'body'    => wp_json_encode( $payload ),
		)
	);
}

/**
 * Hook: intento de acceso fallido.
 *
 * @param string $username Nombre intentado.
 */
function vsai_premium_on_login_failed( $username ) {
	vsai_premium_log_event( 'login_fail', array( 'user_tried' => $username ) );
}
add_action( 'wp_login_failed', 'vsai_premium_on_login_failed' );

/**
 * Hook: acceso correcto.
 *
 * @param string  $user_login Nombre de usuario.
 * @param WP_User $user       Usuario (no usado).
 */
function vsai_premium_on_login( $user_login, $user ) {
	vsai_premium_log_event( 'login_success', array( 'user_tried' => $user_login ) );
}
add_action( 'wp_login', 'vsai_premium_on_login', 10, 2 );

/**
 * Detección simple de sondeos: 404 en rutas típicas de escaneo
 * (/.env, /wp-config.php, /phpmyadmin, /.git). Se cuenta por IP en un
 * transient de 10 minutos y se registra como máximo un evento scan_probe
 * por IP cada 5 minutos, para no saturar el buffer.
 */
function vsai_premium_detect_probes() {
	if ( ! is_404() || ! vsai_premium_is_active() ) {
		return;
	}
	$uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
	if ( '' === $uri ) {
		return;
	}
	$path    = strtolower( (string) wp_parse_url( $uri, PHP_URL_PATH ) );
	$needles = array( '/.env', 'wp-config.php', '/phpmyadmin', '.git' );
	$hit     = false;
	foreach ( $needles as $n ) {
		if ( false !== strpos( $path, $n ) ) {
			$hit = true;
			break;
		}
	}
	if ( ! $hit ) {
		return;
	}
	$ip = vsai_premium_client_ip();
	if ( '' === $ip ) {
		return;
	}
	$count_key = 'vsai_probe_' . md5( $ip );
	$count     = (int) get_transient( $count_key );
	set_transient( $count_key, $count + 1, 10 * MINUTE_IN_SECONDS );

	$log_key = 'vsai_probelog_' . md5( $ip );
	if ( false === get_transient( $log_key ) ) {
		set_transient( $log_key, 1, 5 * MINUTE_IN_SECONDS );
		vsai_premium_log_event(
			'scan_probe',
			array(
				'path'   => $uri,
				'detail' => sprintf( 'Sondeo a ruta sensible (van %d en 10 min desde esta IP)', $count + 1 ),
			)
		);
	}
}
add_action( 'template_redirect', 'vsai_premium_detect_probes' );

/* ------------------------------------------------------------------------
 * Envío por lotes (WP-Cron cada hora)
 * ---------------------------------------------------------------------- */

/**
 * Mantiene el cron horario programado solo mientras el Guardián esté activo.
 */
function vsai_premium_maybe_schedule() {
	if ( vsai_premium_is_active() ) {
		if ( ! wp_next_scheduled( 'vsai_send_events' ) ) {
			wp_schedule_event( time() + 5 * MINUTE_IN_SECONDS, 'hourly', 'vsai_send_events' );
		}
	} elseif ( wp_next_scheduled( 'vsai_send_events' ) ) {
		wp_clear_scheduled_hook( 'vsai_send_events' );
	}
}
add_action( 'init', 'vsai_premium_maybe_schedule' );

/**
 * Trabajo del cron: envía el buffer a la ingesta y, si el cerebro responde
 * 2xx, lo vacía y refresca el reporte. Si falla, conserva los eventos
 * (recortados al máximo) y espera a la siguiente hora: nunca entra en bucle.
 */
function vsai_premium_send_events() {
	if ( ! vsai_premium_is_active() ) {
		return;
	}
	$events = get_option( 'vsai_events', array() );
	if ( ! is_array( $events ) || empty( $events ) ) {
		// Latido de inventario (v1.19.0): sin eventos, si el último
		// inventario enviado tiene más de 20 h (o nunca se envió), se
		// hace UNA ingesta con events: [] + inventario para que Bruno
		// pueda revisar las vulnerabilidades conocidas del sitio.
		if ( function_exists( 'vsai_vuln_build_inventory' ) ) {
			$last_sent = get_transient( 'vsai_vuln_sent' );
			if ( ! $last_sent || ( time() - (int) $last_sent ) > 20 * HOUR_IN_SECONDS ) {
				$p        = vsai_premium_get_settings();
				$payload  = array(
					'site_key'   => trim( (string) $p['site_key'] ),
					'site'       => (string) wp_parse_url( home_url(), PHP_URL_HOST ),
					'events'     => array(),
					'inventario' => vsai_vuln_build_inventory(),
				);
				$response = wp_safe_remote_post(
					vsai_premium_endpoint( 'ingest' ),
					array(
						'timeout' => 15,
						'redirection' => 0,
			'limit_response_size' => 1048576,
			'headers' => array( 'Content-Type' => 'application/json' ),
						'body'    => wp_json_encode( $payload ),
					)
				);
				if ( ! is_wp_error( $response ) ) {
					$code = (int) wp_remote_retrieve_response_code( $response );
					if ( $code >= 200 && $code < 300 ) {
						set_transient( 'vsai_vuln_sent', time(), WEEK_IN_SECONDS );
					}
				}
			}
		}
		// Sin eventos también aprovechamos para refrescar el reporte.
		vsai_premium_fetch_report( true );
		return;
	}
	$p        = vsai_premium_get_settings();
	$payload  = array(
		'site_key' => trim( (string) $p['site_key'] ),
		'site'     => (string) wp_parse_url( home_url(), PHP_URL_HOST ),
		'events'   => array_values( $events ),
	);
	// Inventario de versiones (v1.19.0): viaja en cada ingesta con
	// eventos para el cruce de vulnerabilidades conocidas de Bruno.
	if ( function_exists( 'vsai_vuln_build_inventory' ) ) {
		$payload['inventario'] = vsai_vuln_build_inventory();
	}
	$response = wp_safe_remote_post(
		vsai_premium_endpoint( 'ingest' ),
		array(
			'timeout' => 15,
			'redirection' => 0,
			'limit_response_size' => 1048576,
			'headers' => array( 'Content-Type' => 'application/json' ),
			'body'    => wp_json_encode( $payload ),
		)
	);
	if ( is_wp_error( $response ) ) {
		return; // Se conserva el buffer y se reintenta en la próxima hora.
	}
	$code = (int) wp_remote_retrieve_response_code( $response );
	if ( $code >= 200 && $code < 300 ) {
		vsai_ack_queue( 'vsai_events', $events );
		if ( isset( $payload['inventario'] ) ) {
			set_transient( 'vsai_vuln_sent', time(), WEEK_IN_SECONDS );
		}
		vsai_premium_fetch_report( true );
	}
}
add_action( 'vsai_send_events', 'vsai_premium_send_events' );

/* ------------------------------------------------------------------------
 * Reporte del cerebro (solo lectura en esta edición)
 * ---------------------------------------------------------------------- */

/**
 * Pide el reporte al cerebro (cache transient de 10 minutos).
 * Edición WordPress.org: el reporte es un DATO que se muestra; jamás
 * se aplica como orden (sin bloqueos remotos de ningún tipo).
 *
 * @param bool $force Ignora la caché.
 * @return array|null El reporte decodificado, o null si no se pudo obtener.
 */
function vsai_premium_fetch_report( $force = false ) {
	if ( ! vsai_premium_is_active() ) {
		return null;
	}
	if ( ! $force ) {
		$cached = get_transient( 'vsai_report' );
		if ( is_array( $cached ) ) {
			return $cached;
		}
	}
	$response = wp_safe_remote_get( vsai_premium_endpoint( 'report' ), array( 'timeout' => 10, 'redirection' => 0, 'limit_response_size' => 1048576 ) );
	if ( is_wp_error( $response ) ) {
		return null;
	}
	$code = (int) wp_remote_retrieve_response_code( $response );
	if ( $code < 200 || $code >= 300 ) {
		return null;
	}
	$data = json_decode( wp_remote_retrieve_body( $response ), true );
	if ( ! is_array( $data ) ) {
		return null;
	}
	set_transient( 'vsai_report', $data, 10 * MINUTE_IN_SECONDS );
	// Copia persistente del último parte bueno: la tarjeta Centinela lo
	// muestra sin tener que llamar fuera cada vez que se abre el panel.
	update_option( 'vsai_last_report', array( 'at' => time(), 'data' => $data ), false );
	return $data;
}

/* Edición WordPress.org: sin bloqueos ordenados por el servicio.
 * Nada de lo que llegue del cerebro se aplica como orden en esta
 * edición: ningún servicio externo puede ordenar un bloqueo ni
 * ningún otro cambio en este sitio. Todo bloqueo de esta edición
 * lo decide el propio plugin en local, con datos del propio sitio. */

/* ------------------------------------------------------------------------
 * Handlers de administración (guardar ajustes / probar conexión)
 * ---------------------------------------------------------------------- */

/**
 * Handler: guardar los ajustes del Guardián IA (admin-post).
 */
function vsai_handle_save_premium() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You do not have permission to do this.', 'vidal-security-ai' ) );
	}
	check_admin_referer( 'vsai_save_premium' );

	$key = isset( $_POST['vsai_site_key'] ) ? sanitize_text_field( wp_unslash( $_POST['vsai_site_key'] ) ) : '';
	// Sin URL de servidor configurable: el endpoint es siempre el
	// oficial de Vidal (VSAI_DEFAULT_SERVER); ver vsai_premium_endpoint().
	$url = VSAI_DEFAULT_SERVER;
	// Cerebro: lista cerrada ('n8n' | 'flow'); lo demás cae a 'n8n'.
	$brain = isset( $_POST['vsai_brain'] ) ? sanitize_key( wp_unslash( $_POST['vsai_brain'] ) ) : 'n8n';
	if ( ! in_array( $brain, array( 'n8n', 'flow' ), true ) ) {
		$brain = 'n8n';
	}
	update_option(
		'vsai_premium_settings',
		array(
			'site_key'    => trim( $key ),
			'server_url'  => $url,
			'brain'       => $brain,
			'guardian_on' => ! empty( $_POST['vsai_guardian_on'] ),
		)
	);
	if ( ! vsai_premium_is_active() ) {
		// Guardián apagado: los eventos encolados (IP, agentes de
		// usuario, nombres) no se conservan en la base de datos.
		delete_option( 'vsai_events' );
		wp_clear_scheduled_hook( 'vsai_send_events' );
		wp_clear_scheduled_hook( 'vsai_daily_round' );
	}
	delete_transient( 'vsai_report' );
	wp_safe_redirect( admin_url( 'admin.php?page=vidal-security-ai&vsai_notice=prem_saved#vsai-premium' ) );
	exit;
}
add_action( 'admin_post_vsai_save_premium', 'vsai_handle_save_premium' );

/**
 * Handler: «Probar conexión» — hace el GET al reporte y deja el resultado
 * en un transient para mostrarlo al volver al panel (admin-post).
 */
function vsai_handle_test_connection() {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( esc_html__( 'You do not have permission to do this.', 'vidal-security-ai' ) );
	}
	check_admin_referer( 'vsai_test_connection' );

	$ok  = false;
	$msg = '';
	if ( ! vsai_premium_is_active() ) {
		$msg = __( 'First save a site key and turn on the Guardian switch.', 'vidal-security-ai' );
	} else {
		delete_transient( 'vsai_report' );
		$response = wp_safe_remote_get( vsai_premium_endpoint( 'report' ), array( 'timeout' => 10, 'redirection' => 0, 'limit_response_size' => 1048576 ) );
		if ( is_wp_error( $response ) ) {
			$msg = sprintf( /* translators: %s: mensaje de error */ __( 'Could not reach the server: %s', 'vidal-security-ai' ), $response->get_error_message() );
		} else {
			$code = (int) wp_remote_retrieve_response_code( $response );
			$data = json_decode( wp_remote_retrieve_body( $response ), true );
			if ( $code >= 200 && $code < 300 && is_array( $data ) ) {
				$ok = true;
				set_transient( 'vsai_report', $data, 10 * MINUTE_IN_SECONDS );
			} elseif ( 404 === $code ) {
				$msg = __( 'The server answered 404: check that the site key belongs to this site.', 'vidal-security-ai' );
			} elseif ( 401 === $code || 403 === $code ) {
				$msg = __( 'The server rejected the site key (401/403): copy it again exactly as given.', 'vidal-security-ai' );
			} else {
				$msg = sprintf( /* translators: %d: código HTTP */ __( 'The server answered HTTP %d. Try again in a few minutes.', 'vidal-security-ai' ), $code );
			}
		}
	}
	set_transient(
		'vsai_conn_result_' . get_current_user_id(),
		array( 'ok' => $ok, 'msg' => $msg ),
		2 * MINUTE_IN_SECONDS
	);
	wp_safe_redirect( admin_url( 'admin.php?page=vidal-security-ai&vsai_notice=' . ( $ok ? 'prem_test_ok' : 'prem_test_fail' ) . '#vsai-premium' ) );
	exit;
}
add_action( 'admin_post_vsai_test_connection', 'vsai_handle_test_connection' );

/* ------------------------------------------------------------------------
 * Render: sección de ajustes premium (la llama admin-page.php)
 * ---------------------------------------------------------------------- */

/**
 * Pinta la tarjeta de ajustes del Guardián IA con el diseño del panel.
 */
function vsai_premium_render_settings() {
	$p        = vsai_premium_get_settings();
	$active   = vsai_premium_is_active();
	$events   = get_option( 'vsai_events', array() );
	$n_events = is_array( $events ) ? count( $events ) : 0;
	$result   = get_transient( 'vsai_conn_result_' . get_current_user_id() );
	?>
	<section class="vsai-section" id="vsai-premium">
		<div class="vsai-section__head">
			<h2 class="vsai-section__title">🤖 <?php esc_html_e( 'AI Guardian (premium)', 'vidal-security-ai' ); ?></h2>
			<?php if ( $active ) : ?>
				<span class="vsai-badge vsai-badge--live"><?php esc_html_e( 'Active', 'vidal-security-ai' ); ?></span>
			<?php else : ?>
				<span class="vsai-badge vsai-badge--off"><?php esc_html_e( 'Not active', 'vidal-security-ai' ); ?></span>
			<?php endif; ?>
		</div>

		<?php if ( is_array( $result ) && ! $result['ok'] && '' !== $result['msg'] ) : ?>
			<div class="vsai-notice vsai-notice--fail"><?php echo esc_html( $result['msg'] ); ?></div>
		<?php endif; ?>

		<div class="vsai-panel vsai-panel--premium">
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
				<input type="hidden" name="action" value="vsai_save_premium">
				<?php wp_nonce_field( 'vsai_save_premium' ); ?>

				<div class="vsai-field">
					<label for="vsai_site_key"><?php esc_html_e( 'Site key', 'vidal-security-ai' ); ?></label>
					<input type="password" id="vsai_site_key" name="vsai_site_key" value="<?php echo esc_attr( $p['site_key'] ); ?>" autocomplete="off" spellcheck="false">
					<p class="vsai-field__help"><?php esc_html_e( 'The key that identifies THIS site to your Guardian. Leave it empty and save to disconnect the site.', 'vidal-security-ai' ); ?></p>
				</div>

				<div class="vsai-field">
					<span class="vsai-field__label"><?php esc_html_e( 'Brain', 'vidal-security-ai' ); ?></span>
					<label class="vsai-radio-row">
						<input type="radio" name="vsai_brain" value="n8n" <?php checked( 'flow' !== vsai_premium_brain() ); ?>>
						<?php esc_html_e( 'n8n — the usual brain (in Vidal’s cloud)', 'vidal-security-ai' ); ?>
					</label>
					<label class="vsai-radio-row">
						<input type="radio" name="vsai_brain" value="flow" <?php checked( 'flow' === vsai_premium_brain() ); ?>>
						<?php esc_html_e( 'Vidal Flow — the new brain (also in Vidal’s cloud)', 'vidal-security-ai' ); ?>
					</label>
					<p class="vsai-field__help"><?php esc_html_e( 'Which brain judges your site’s events. Both are official Vidal services — there is no free URL field, so your site key never goes anywhere else.', 'vidal-security-ai' ); ?></p>
				</div>

				<div class="vsai-field">
					<p class="vsai-field__help">📲 <?php esc_html_e( 'Urgent alerts by WhatsApp: while the Guardian is active, the truly urgent incidents (payment failures, unexplained file changes, a new administrator, a 24-hour block) are also sent at once by WhatsApp to the phone registered for this site — no repeats for 6 hours.', 'vidal-security-ai' ); ?></p>
				</div>

				<div class="vsai-toggle-row">
					<div class="vsai-toggle-row__info">
						<span class="vsai-toggle-row__icon">🛡️</span>
						<div>
							<strong><?php esc_html_e( 'AI Guardian', 'vidal-security-ai' ); ?></strong>
							<p><?php esc_html_e( 'By enabling this option, you authorize sending this site host, site key, IP addresses, user agents, paths without query parameters, login usernames, security incident details and software versions to v8.vidalbooking.com. Events are sent hourly; urgent incident details are sent immediately. Reports are advisory. Turn it off to stop future requests and clear the local queue.', 'vidal-security-ai' ); ?></p>
						</div>
					</div>
					<label class="vsai-switch" aria-label="<?php esc_attr_e( 'AI Guardian', 'vidal-security-ai' ); ?>">
						<input type="checkbox" name="vsai_guardian_on" value="1" <?php checked( ! empty( $p['guardian_on'] ) ); ?>>
						<span class="vsai-switch__slider"></span>
					</label>
				</div>

				<div class="vsai-actions-row">
					<button type="submit" class="vsai-btn vsai-btn--primary">💾 <?php esc_html_e( 'Save Guardian settings', 'vidal-security-ai' ); ?></button>
				</div>
			</form>

			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" class="vsai-actions-row">
				<input type="hidden" name="action" value="vsai_test_connection">
				<?php wp_nonce_field( 'vsai_test_connection' ); ?>
				<button type="submit" class="vsai-btn vsai-btn--ghost">🔌 <?php esc_html_e( 'Test connection', 'vidal-security-ai' ); ?></button>
				<span class="vsai-muted"><?php esc_html_e( 'It asks the Guardian for its report and tells you right here if everything answers.', 'vidal-security-ai' ); ?></span>
			</form>

			<div class="vsai-premium__status">
				<div class="vsai-stat">
					<span class="vsai-stat__num"><?php echo esc_html( $n_events ); ?></span>
					<span class="vsai-stat__label"><?php esc_html_e( 'Queued events', 'vidal-security-ai' ); ?></span>
				</div>
			</div>
		</div>
	</section>
	<?php
}

/* ------------------------------------------------------------------------
 * Render: «El parte del guardia» (la llama admin-page.php)
 * ---------------------------------------------------------------------- */

/**
 * Etiquetas legibles para las estadísticas del reporte.
 *
 * @return array
 */
function vsai_premium_stat_labels() {
	return array(
		'events'        => __( 'Events', 'vidal-security-ai' ),
		'login_fail'    => __( 'Failed logins', 'vidal-security-ai' ),
		'login_success' => __( 'Successful logins', 'vidal-security-ai' ),
		'xmlrpc_hit'    => __( 'XML-RPC hits', 'vidal-security-ai' ),
		'scan_probe'    => __( 'Probes', 'vidal-security-ai' ),
		'user_enum'     => __( 'Enumerations', 'vidal-security-ai' ),
		'file_change'   => __( 'File changes', 'vidal-security-ai' ),
		'attacks'       => __( 'Attacks', 'vidal-security-ai' ),
		'blocked'       => __( 'Blocked IPs', 'vidal-security-ai' ),
		'noise'         => __( 'Noise ignored', 'vidal-security-ai' ),
	);
}

/**
 * Normaliza las estadísticas del reporte a clave => número.
 * Acepta un objeto asociativo o una lista de {type|key, count|value}.
 *
 * @param mixed $stats Dato crudo del reporte.
 * @return array
 */
function vsai_premium_normalize_stats( $stats ) {
	$out = array();
	if ( ! is_array( $stats ) ) {
		return $out;
	}
	foreach ( $stats as $k => $v ) {
		if ( is_numeric( $v ) ) {
			$out[ (string) $k ] = (int) $v;
		} elseif ( is_array( $v ) ) {
			$key = isset( $v['type'] ) ? (string) $v['type'] : ( isset( $v['key'] ) ? (string) $v['key'] : '' );
			$num = null;
			if ( isset( $v['count'] ) && is_numeric( $v['count'] ) ) {
				$num = (int) $v['count'];
			} elseif ( isset( $v['value'] ) && is_numeric( $v['value'] ) ) {
				$num = (int) $v['value'];
			}
			if ( '' !== $key && null !== $num ) {
				$out[ $key ] = $num;
			}
		}
	}
	return $out;
}

/**
 * Pinta la sección del parte: real si el Guardián está activo y responde;
 * marcador comercial (sin datos inventados) si no hay premium.
 */
function vsai_premium_render_report_section() {
	if ( ! vsai_premium_is_active() ) {
		?>
		<section class="vsai-section">
			<div class="vsai-report vsai-report--locked">
				<p class="vsai-report__icon">🛡️</p>
				<h2 class="vsai-report__title"><?php esc_html_e( 'Your guard’s report', 'vidal-security-ai' ); ?></h2>
				<p><?php esc_html_e( 'Imagine opening your panel and reading: “Last night there were 212 attempts to log in as ‘admin’; 3 attacking IPs were stopped at the door by the site’s own local guards and your site is clean.” That is what the AI Guardian does: it watches, classifies every attack with artificial intelligence and tells you about it in human language, here and by email.', 'vidal-security-ai' ); ?></p>
				<p><?php esc_html_e( 'Activate it above with your site key and this space becomes your daily security report.', 'vidal-security-ai' ); ?></p>
			</div>
		</section>
		<?php
		return;
	}

	$report = vsai_premium_fetch_report();
	?>
	<section class="vsai-section">
		<div class="vsai-report">
			<div class="vsai-report__head">
				<h2 class="vsai-report__title">🛡️ <?php esc_html_e( 'Your guard’s report', 'vidal-security-ai' ); ?></h2>
				<span class="vsai-badge vsai-badge--live"><?php esc_html_e( 'AI Guardian · live', 'vidal-security-ai' ); ?></span>
			</div>
			<?php if ( null === $report ) : ?>
				<p class="vsai-report__error">⚠️ <?php esc_html_e( 'Right now your Guardian could not be reached (no connection, or the server did not answer). Your site stays protected by the local hardening; the report will be back as soon as the cloud answers.', 'vidal-security-ai' ); ?></p>
			<?php else : ?>
				<?php
				$text = '';
				foreach ( array( 'parte', 'text', 'summary', 'report' ) as $k ) {
					if ( ! empty( $report[ $k ] ) && is_string( $report[ $k ] ) ) {
						$text = $report[ $k ];
						break;
					}
				}
				if ( '' !== $text ) :
					?>
					<div class="vsai-report__text"><?php echo nl2br( esc_html( $text ) ); ?></div>
				<?php endif; ?>

				<?php
				$stats = array();
				foreach ( array( 'stats', 'last_24h', 'summary_24h', 'totals' ) as $k ) {
					if ( isset( $report[ $k ] ) ) {
						$stats = vsai_premium_normalize_stats( $report[ $k ] );
						if ( ! empty( $stats ) ) {
							break;
						}
					}
				}
				if ( ! empty( $stats ) ) :
					$labels = vsai_premium_stat_labels();
					?>
					<div class="vsai-report__stats">
						<?php foreach ( $stats as $k => $v ) : ?>
							<div class="vsai-stat vsai-stat--dark">
								<span class="vsai-stat__num"><?php echo esc_html( $v ); ?></span>
								<span class="vsai-stat__label"><?php echo esc_html( isset( $labels[ $k ] ) ? $labels[ $k ] : ucfirst( str_replace( '_', ' ', $k ) ) ); ?></span>
							</div>
						<?php endforeach; ?>
					</div>
				<?php endif; ?>

				<?php if ( ! empty( $report['verdicts'] ) && is_array( $report['verdicts'] ) ) : ?>
					<ul class="vsai-report__list">
						<?php
						foreach ( $report['verdicts'] as $v ) {
							$line = '';
							if ( is_string( $v ) ) {
								$line = $v;
							} elseif ( is_array( $v ) ) {
								foreach ( array( 'text', 'message', 'summary', 'detail' ) as $k ) {
									if ( ! empty( $v[ $k ] ) && is_string( $v[ $k ] ) ) {
										$line = $v[ $k ];
										break;
									}
								}
								if ( '' === $line && ! empty( $v['ip'] ) ) {
									$line = sprintf(
										/* translators: 1: IP 2: acción/veredicto */
										__( 'IP %1$s — %2$s', 'vidal-security-ai' ),
										(string) $v['ip'],
										isset( $v['verdict'] ) ? (string) $v['verdict'] : ( isset( $v['action'] ) ? (string) $v['action'] : '' )
									);
								}
							}
							if ( '' !== $line ) {
								echo '<li>' . esc_html( $line ) . '</li>';
							}
						}
						?>
					</ul>
				<?php endif; ?>

			<?php endif; ?>
		</div>
	</section>
	<?php
}

/* ------------------------------------------------------------------------
 * El Centinela (v1.14.0): el agente IA, VISIBLE en el panel
 *
 * Gratis y premium comparten la MISMA lista de beneficios: en gratis se
 * ve apagada, con candado, como «todo lo que te pierdes»; en premium se
 * ve encendida, con los datos reales donde el producto los tiene.
 * Las rondas son reales: un WP-Cron diario (08:00, hora del sitio) pide
 * el parte al cerebro y guarda el resultado; si el cerebro no responde,
 * la ronda queda registrada como «sin conexión» — nunca se finge.
 * ---------------------------------------------------------------------- */

define( 'VSAI_ROUNDS_MAX', 14 );

/**
 * La lista de beneficios premium, compartida por los dos estados de la
 * tarjeta Centinela. SOLO funciones premium reales y ya construidas.
 *
 * @return array Lista de [emoji, etiqueta].
 */
function vsai_sentinel_benefit_labels() {
	return array(
		array( '👁️', __( 'An AI agent watching your site 24/7', 'vidal-security-ai' ) ),
		array( '🚨', __( 'Daily rounds with a plain-language report', 'vidal-security-ai' ) ),
		array( '📲', __( 'Urgent alerts by WhatsApp', 'vidal-security-ai' ) ),
		array( '🧠', __( 'AI threat classification: noise vs. real attacks', 'vidal-security-ai' ) ),
		array( '🌐', __( 'A shared threat network protecting every connected site', 'vidal-security-ai' ) ),
		array( '🛡️', __( 'This live sentinel in your dashboard', 'vidal-security-ai' ) ),
	);
}

/**
 * Rondas guardadas (la más reciente primero). Solo lectura local.
 *
 * @return array
 */
function vsai_sentinel_get_rounds() {
	$rounds = get_option( 'vsai_rounds', array() );
	return is_array( $rounds ) ? $rounds : array();
}

/**
 * Estado de una ronda a partir de sus datos: 'offline' si el cerebro no
 * respondió, 'quiet' si respondió y no hubo nada, 'active' si hubo
 * eventos o bloqueos. Función pura (la batería lógica la replica).
 *
 * @param bool $ok      ¿Respondió el cerebro?
 * @param int  $events  Eventos del parte.
 * @param int  $blocked Bloqueos del parte.
 * @return string
 */
function vsai_sentinel_round_state( $ok, $events, $blocked ) {
	if ( ! $ok ) {
		return 'offline';
	}
	if ( (int) $events <= 0 && (int) $blocked <= 0 ) {
		return 'quiet';
	}
	return 'active';
}

/**
 * Mantiene programada la ronda diaria (08:00 hora del sitio) SOLO
 * mientras el Guardián esté activo; si se apaga, se desprograma.
 */
function vsai_sentinel_maybe_schedule() {
	if ( vsai_premium_is_active() ) {
		if ( ! wp_next_scheduled( 'vsai_daily_round' ) ) {
			$when = time() + DAY_IN_SECONDS;
			if ( function_exists( 'wp_timezone' ) ) {
				try {
					$next = new DateTimeImmutable( 'today 08:00', wp_timezone() );
					if ( $next->getTimestamp() <= time() ) {
						$next = $next->modify( '+1 day' );
					}
					$when = $next->getTimestamp();
				} catch ( Exception $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement -- Cae al +1 día calculado arriba.
				}
			}
			wp_schedule_event( $when, 'daily', 'vsai_daily_round' );
		}
	} elseif ( wp_next_scheduled( 'vsai_daily_round' ) ) {
		wp_clear_scheduled_hook( 'vsai_daily_round' );
	}
}
add_action( 'init', 'vsai_sentinel_maybe_schedule' );

/**
 * Trabajo de la ronda diaria: pide el parte al cerebro (forzando la
 * consulta) y guarda el resultado en el registro local de rondas.
 * Sin respuesta del cerebro, la ronda se guarda como «sin conexión».
 */
function vsai_sentinel_run_round() {
	if ( ! vsai_premium_is_active() ) {
		return;
	}
	$report = vsai_premium_fetch_report( true );
	$round  = array(
		'ts'       => time(),
		'ok'       => is_array( $report ),
		'events'   => null,
		'blocked'  => null,
		'patterns' => null,
	);
	if ( is_array( $report ) ) {
		$totals           = ( isset( $report['totals'] ) && is_array( $report['totals'] ) ) ? $report['totals'] : array();
		$round['events']  = isset( $totals['events'] ) ? (int) $totals['events'] : 0;
		$round['patterns'] = isset( $totals['patterns'] ) ? (int) $totals['patterns'] : 0;
		$round['blocked'] = ( isset( $report['blocked_ips'] ) && is_array( $report['blocked_ips'] ) )
			? count( $report['blocked_ips'] )
			: 0;
	}
	$round['state'] = vsai_sentinel_round_state( $round['ok'], (int) $round['events'], (int) $round['blocked'] );

	$rounds = vsai_sentinel_get_rounds();
	array_unshift( $rounds, $round );
	$rounds = array_slice( $rounds, 0, VSAI_ROUNDS_MAX );
	update_option( 'vsai_rounds', $rounds, false );
}
add_action( 'vsai_daily_round', 'vsai_sentinel_run_round' );

/**
 * Hora legible de una ronda: «hoy a las …» si es de hoy (hora del sitio).
 *
 * @param int $ts Marca de tiempo.
 * @return string
 */
function vsai_sentinel_round_when( $ts ) {
	$fmt = get_option( 'date_format' ) . ' ' . get_option( 'time_format' );
	if ( date_i18n( 'Y-m-d', $ts ) === date_i18n( 'Y-m-d' ) ) {
		return sprintf(
			/* translators: %s: hora de la ronda */
			__( 'Last round: today at %s', 'vidal-security-ai' ),
			date_i18n( get_option( 'time_format' ), $ts )
		);
	}
	return sprintf(
		/* translators: %s: fecha y hora de la ronda */
		__( 'Last round: %s', 'vidal-security-ai' ),
		date_i18n( $fmt, $ts )
	);
}

/**
 * La cara de Bruno, el guardia virtual (v1.16.0): guardia de seguridad
 * serio con gorra e insignia, uniforme y auricular. SVG en línea con
 * animaciones SMIL (parpadeo y mirada que escanea); sin assets externos.
 * Encendido: anillo verde girando. Apagado: gris y quieto (sin anillo).
 *
 * @param int  $size Lado en píxeles.
 * @param bool $on   Guardián activo o dormido.
 * @return string SVG.
 */
function vsai_bruno_face_svg( $size = 84, $on = true ) {
	$blink  = 'values="3.5;3.5;0.3;3.5;3.5" keyTimes="0;.52;.57;.62;1" dur="4.4s" repeatCount="indefinite"';
	$blinkp = 'values="1.7;1.7;0.2;1.7;1.7" keyTimes="0;.52;.57;.62;1" dur="4.4s" repeatCount="indefinite"';
	$ring   = $on
		? '<circle cx="50" cy="50" r="48" fill="none" stroke="#34d399" stroke-width="1.6" stroke-dasharray="5 5" opacity=".65"><animateTransform attributeName="transform" type="rotate" from="0 50 50" to="360 50 50" dur="30s" repeatCount="indefinite"/></circle>'
		: '';
	$style  = $on ? '' : ' vsai-bruno--off';
	$scan   = $on
		? '<animateTransform attributeName="transform" type="translate" values="0 0;-1.3 0;-1.3 0;1.3 0;1.3 0;0 0" keyTimes="0;.2;.45;.65;.88;1" dur="6s" repeatCount="indefinite"/>'
		: '';
	$eyes   = $on
		? '<ellipse cx="40.5" cy="43.5" rx="3.1" ry="3.5" fill="#ffffff"><animate attributeName="ry" ' . $blink . '/></ellipse>'
			. '<ellipse cx="59.5" cy="43.5" rx="3.1" ry="3.5" fill="#ffffff"><animate attributeName="ry" ' . $blink . '/></ellipse>'
			. '<g><circle cx="40.5" cy="44" r="1.7" fill="#1f2937"><animate attributeName="r" ' . $blinkp . '/></circle>'
			. '<circle cx="59.5" cy="44" r="1.7" fill="#1f2937"><animate attributeName="r" ' . $blinkp . '/></circle>' . $scan . '</g>'
		: '<path d="M37.4 43.5 h6.2 M56.4 43.5 h6.2" stroke="#1f2937" stroke-width="1.8" stroke-linecap="round"/>';
	return '<svg class="vsai-bruno' . $style . '" width="' . (int) $size . '" height="' . (int) $size . '" viewBox="0 0 100 100" role="img" aria-label="Bruno">'
		. '<circle cx="50" cy="50" r="48" fill="#0b1a33"/>' . $ring
		. '<path d="M13 100 C13 79 29 71 50 71 C71 71 87 79 87 100 Z" fill="#1e3a8a"/>'
		. '<path d="M43 72 L50 83 L57 72 L55 100 L45 100 Z" fill="#e8edf5"/>'
		. '<path d="M47.5 75 L52.5 75 L51 84 L50 88 L49 84 Z" fill="#1f2937"/>'
		. '<rect x="44.5" y="59" width="11" height="13" rx="3" fill="#dfa06e"/>'
		. '<circle cx="30.5" cy="43" r="3.8" fill="#f2c49b"/><circle cx="69.5" cy="43" r="3.8" fill="#f2c49b"/>'
		. '<rect x="31" y="21" width="38" height="43" rx="11" fill="#f2c49b"/>'
		. '<path d="M28.5 25 C28.5 11 39 5 50 5 C61 5 71.5 11 71.5 25 Z" fill="#16294f"/>'
		. '<ellipse cx="50" cy="26.5" rx="25" ry="3.2" fill="#0b1a33"/>'
		. '<path d="M50 11.5 l3.8 1.5 v3.2 c0 2.6-1.6 4.2-3.8 5.1 c-2.2-0.9-3.8-2.5-3.8-5.1 v-3.2 z" fill="#fbbf24"/>'
		. '<rect x="36" y="37" width="9" height="2.3" rx="1.1" fill="#4a3220"/><rect x="55" y="37" width="9" height="2.3" rx="1.1" fill="#4a3220"/>'
		. $eyes
		. '<path d="M50 46.5 L48.8 52 L51.2 52" stroke="#d99a5c" stroke-width="1.3" fill="none" stroke-linecap="round"/>'
		. '<rect x="44.5" y="57.5" width="11" height="2.1" rx="1" fill="#8a5a33"/>'
		. '<circle cx="69.5" cy="45" r="1.9" fill="#111827"/>'
		. '<path d="M69.5 47 C69.5 54 66 56 66 62" stroke="#111827" stroke-width="1.2" fill="none"/>'
		. '</svg>';
}

/**
 * Tarjeta Centinela — estado PREMIUM (encendida): la lista compartida,
 * en vivo, con los datos reales donde el producto los tiene.
 */
function vsai_sentinel_render_card_on() {
	// Último parte conocido: primero la copia guardada; si nunca se ha
	// traído, se pide (queda en caché para el resto del panel).
	$last = get_option( 'vsai_last_report', array() );
	$data = ( is_array( $last ) && isset( $last['data'] ) && is_array( $last['data'] ) ) ? $last['data'] : null;
	if ( null === $data ) {
		$data = vsai_premium_fetch_report();
	}
	$events24 = ( is_array( $data ) && isset( $data['totals']['events'] ) ) ? (int) $data['totals']['events'] : null;
	$rounds   = vsai_sentinel_get_rounds();
	$next     = wp_next_scheduled( 'vsai_daily_round' );

	$details = array(
		0 => null !== $events24 ? sprintf(
			/* translators: %d: eventos vigilados en 24 h */
			__( 'Events watched (24 h): %d', 'vidal-security-ai' ),
			$events24
		) : null,
		1 => ! empty( $rounds ) ? vsai_sentinel_round_when( (int) $rounds[0]['ts'] ) : null,
		2 => __( 'Active', 'vidal-security-ai' ),
		3 => null,
		4 => null,
		5 => null,
	);
	?>
	<section class="vsai-section">
		<div class="vsai-sentinel vsai-sentinel--on">
			<div class="vsai-sentinel__head">
				<div class="vsai-sentinel__title-wrap">
					<?php vsai_print_panel_html( vsai_bruno_face_svg( 84, true ) ); ?>
					<span class="vsai-pulse" aria-hidden="true"></span>
					<div>
						<h2 class="vsai-sentinel__title">🛡️ <?php esc_html_e( 'AI agent on alert', 'vidal-security-ai' ); ?></h2>
						<p class="vsai-sentinel__sub"><?php esc_html_e( 'Your AI agent is awake and watching your site. This is working for you right now:', 'vidal-security-ai' ); ?></p>
					</div>
				</div>
				<span class="vsai-badge vsai-badge--live"><?php esc_html_e( 'On watch', 'vidal-security-ai' ); ?></span>
			</div>
			<ul class="vsai-sentinel__list">
				<?php foreach ( vsai_sentinel_benefit_labels() as $i => $b ) : ?>
					<li class="vsai-sentinel__row">
						<span class="vsai-sentinel__mark vsai-sentinel__mark--on">✓</span>
						<div>
							<strong><?php echo esc_html( $b[0] . ' ' . $b[1] ); ?></strong>
							<?php if ( ! empty( $details[ $i ] ) ) : ?>
								<p><?php echo esc_html( $details[ $i ] ); ?></p>
							<?php endif; ?>
						</div>
					</li>
				<?php endforeach; ?>
			</ul>
			<?php if ( $next ) : ?>
				<p class="vsai-sentinel__foot">
					<?php
					printf(
						/* translators: %s: fecha y hora de la próxima ronda */
						esc_html__( 'Next round: %s', 'vidal-security-ai' ),
						esc_html( date_i18n( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $next ) )
					);
					?>
				</p>
			<?php endif; ?>
		</div>
	</section>
	<?php
}

/**
 * Tarjeta Centinela — estado GRATIS (apagada): la MISMA lista, con
 * candado, como «todo lo que te pierdes», y el botón de activación por
 * la vía de siempre (los ajustes del Guardián, en esta misma página).
 * Sin datos y SIN ninguna llamada externa.
 */
function vsai_sentinel_render_card_off() {
	?>
	<section class="vsai-section">
		<div class="vsai-sentinel vsai-sentinel--off">
			<div class="vsai-sentinel__head">
				<div class="vsai-sentinel__title-wrap">
					<?php vsai_print_panel_html( vsai_bruno_face_svg( 84, false ) ); ?>
					<div>
						<h2 class="vsai-sentinel__title">🛡️ <?php esc_html_e( 'AI agent off', 'vidal-security-ai' ); ?></h2>
						<p class="vsai-sentinel__sub"><?php esc_html_e( 'Your free protection keeps working, but the AI agent is asleep.', 'vidal-security-ai' ); ?></p>
					</div>
				</div>
				<span class="vsai-badge vsai-badge--off"><?php esc_html_e( 'Off', 'vidal-security-ai' ); ?></span>
			</div>
			<p class="vsai-sentinel__missing"><?php esc_html_e( 'Everything you are missing:', 'vidal-security-ai' ); ?></p>
			<ul class="vsai-sentinel__list">
				<?php foreach ( vsai_sentinel_benefit_labels() as $b ) : ?>
					<li class="vsai-sentinel__row">
						<span class="vsai-sentinel__mark vsai-sentinel__mark--off">🔒</span>
						<div>
							<strong><?php echo esc_html( $b[0] . ' ' . $b[1] ); ?></strong>
						</div>
					</li>
				<?php endforeach; ?>
			</ul>
			<div class="vsai-sentinel__cta">
				<a class="vsai-btn vsai-btn--primary" href="#vsai-premium">🛡️ <?php esc_html_e( 'Turn on the AI Guardian', 'vidal-security-ai' ); ?></a>
				<p><?php esc_html_e( 'You only need your site key: paste it in the AI Guardian settings on this page and the agent wakes up.', 'vidal-security-ai' ); ?></p>
			</div>
		</div>
	</section>
	<?php
}

/**
 * Tarjeta Centinela: despacha según el estado del Guardián.
 */
function vsai_sentinel_render_card() {
	if ( vsai_premium_is_active() ) {
		vsai_sentinel_render_card_on();
	} else {
		vsai_sentinel_render_card_off();
	}
}

/**
 * Sección «🚨 Rondas de vigilancia»: historial real de rondas en
 * premium; explicación que vende (sin rondas fingidas) en gratis.
 */
function vsai_sentinel_render_rounds() {
	?>
	<section class="vsai-section">
		<div class="vsai-section__head">
			<h2 class="vsai-section__title">🚨 <?php esc_html_e( 'Watch rounds', 'vidal-security-ai' ); ?></h2>
		</div>
		<?php if ( ! vsai_premium_is_active() ) : ?>
			<div class="vsai-panel vsai-rounds vsai-rounds--locked">
				<p><?php esc_html_e( 'Rounds are part of the AI Guardian: with the agent off, nobody makes the morning round. Turn it on and every day you will find here what your sentinel saw during the night.', 'vidal-security-ai' ); ?></p>
			</div>
			<?php return; ?>
		<?php endif; ?>

		<div class="vsai-panel vsai-rounds">
			<p class="vsai-rounds__intro"><?php esc_html_e( 'Every morning at 8:00 AM your agent reviews the night and writes down what it found.', 'vidal-security-ai' ); ?></p>
			<?php $rounds = vsai_sentinel_get_rounds(); ?>
			<?php if ( empty( $rounds ) ) : ?>
				<p class="vsai-muted"><?php esc_html_e( 'No rounds yet — the first one lands here tomorrow morning.', 'vidal-security-ai' ); ?></p>
			<?php else : ?>
				<ul class="vsai-rounds__list">
					<?php foreach ( array_slice( $rounds, 0, 7 ) as $r ) : ?>
						<?php $r_state = isset( $r['state'] ) ? $r['state'] : 'quiet'; ?>
						<li class="vsai-rounds__row">
							<span class="vsai-rounds__when"><?php echo esc_html( date_i18n( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $r['ts'] ) ); ?></span>
							<span class="vsai-rounds__state vsai-rounds__state--<?php echo esc_attr( $r_state ); ?>">
								<?php if ( 'offline' === $r_state ) : ?>
									⚠️ <?php esc_html_e( 'No connection — the Guardian did not answer.', 'vidal-security-ai' ); ?>
								<?php elseif ( 'quiet' === $r_state ) : ?>
									✅ <?php esc_html_e( 'All quiet — nothing to report.', 'vidal-security-ai' ); ?>
								<?php else : ?>
									🚨 <?php
									printf(
										/* translators: 1: eventos vigilados 2: bloqueos */
										esc_html__( 'Events watched: %1$d · Blocks: %2$d', 'vidal-security-ai' ),
										(int) $r['events'],
										(int) $r['blocked']
									);
									?>
								<?php endif; ?>
							</span>
						</li>
					<?php endforeach; ?>
				</ul>
			<?php endif; ?>
		</div>
	</section>
	<?php
}