<?php
/**
 * Accessibility statement page.
 *
 * Guided creation of a statement page (or adoption of one the site already
 * has). The new page is preloaded with the statement kept in the AllAccessible
 * dashboard (same endpoint the on-page menu reads) plus a contact block from
 * the email/phone assigned in the guide, then edited in WordPress like any
 * page. Its URL is registered with AllAccessible so the on-page "Statement"
 * link opens the real page; an optional footer link covers themes that have
 * no statement link of their own.
 *
 * Registration from the admin guide happens in the browser (same app route the
 * customizer uses). The PHP write path (register_url) exists only for the
 * publish/unpublish hook, which runs with no browser.
 */
if (!defined('ABSPATH')) exit;

class AllAccessible_StatementPage {
    const OPTION_PAGE_ID    = 'aacb_statement_page_id';
    const OPTION_REGISTERED = 'aacb_statement_registered_url';
    const OPTION_FOOTER     = 'aacb_statement_footer_link';
    const META_KEY          = '_aacb_statement_page';
    const OPTION_CONTACT    = 'aacb_statement_contact';
    const AJAX_ACTION       = 'aacb_statement_guide';
    const SLUG              = 'accessibility-statement';

    public static function register() {
        add_action('transition_post_status', array(__CLASS__, 'on_status_change'), 10, 3);
        add_action('wp_footer', array(__CLASS__, 'print_footer_link'));
        add_filter('display_post_states', array(__CLASS__, 'post_state'), 10, 2);
        add_action('wp_ajax_' . self::AJAX_ACTION, array(__CLASS__, 'ajax_handle'));
    }

    /**
     * Find a statement page the site already has, best evidence first:
     * our stored id, then our meta, then the conventional slug, then a
     * title/content search.
     *
     * @return array{id:int,url:string,status:string,source:string,title:string}|null
     */
    public static function detect_existing_page() {
        $id = (int) get_option(self::OPTION_PAGE_ID);
        if ($id > 0) {
            $p = get_post($id);
            if ($p && $p->post_type === 'page' && $p->post_status !== 'trash') {
                return self::describe($p, 'option');
            }
        }

        $ids = get_posts(array(
            'post_type'      => 'page',
            'post_status'    => array('publish', 'draft', 'pending', 'private'),
            'meta_key'       => self::META_KEY,
            'posts_per_page' => 1,
            'fields'         => 'ids',
        ));
        if (!empty($ids)) {
            $p = get_post((int) $ids[0]);
            if ($p) {
                return self::describe($p, 'meta');
            }
        }

        $p = get_page_by_path(self::SLUG, OBJECT, 'page');
        if ($p && $p->post_status !== 'trash') {
            return self::describe($p, 'slug');
        }

        $found = get_posts(array(
            'post_type'      => 'page',
            'post_status'    => array('publish', 'draft'),
            's'              => 'accessibility statement',
            'posts_per_page' => 5,
        ));
        foreach ($found as $cand) {
            // Needs both words: "Accessibility Services" is not a statement.
            if (preg_match('/accessib/i', $cand->post_title) && preg_match('/statement/i', $cand->post_title)) {
                return self::describe($cand, 'title');
            }
        }
        return null;
    }

    private static function describe($p, $source) {
        return array(
            'id'     => (int) $p->ID,
            'url'    => (string) get_permalink($p),
            'status' => (string) $p->post_status,
            'source' => $source,
            'title'  => (string) $p->post_title,
        );
    }

    /**
     * The statement kept in the AllAccessible dashboard, fetched fresh
     * (the on-page menu reads the same endpoint). '' when the account has none.
     */
    public static function statement_html() {
        if (!class_exists('AllAccessible_ApiClient')) {
            return '';
        }
        $client = AllAccessible_ApiClient::get_instance();
        if (!method_exists($client, 'get_statement_html')) {
            return '';
        }
        return wp_kses_post((string) $client->get_statement_html(true));
    }

    /**
     * "Tell us about a problem" block from the assigned contact details.
     * Empty string when neither email nor phone is set.
     *
     * @param array $c contact_email, contact_phone
     */
    public static function contact_block(array $c) {
        $email = sanitize_email(isset($c['contact_email']) ? $c['contact_email'] : '');
        $phone = sanitize_text_field(isset($c['contact_phone']) ? $c['contact_phone'] : '');
        if ($email === '' && $phone === '') {
            return '';
        }
        $contact = $email !== '' ? sprintf('<a href="mailto:%1$s">%1$s</a>', esc_attr($email)) : '';
        if ($phone !== '') {
            $contact .= ($contact !== '' ? ' ' . esc_html__('or call', 'allaccessible') . ' ' : '') . esc_html($phone);
        }
        return '<h3>' . esc_html__('Accessibility contact', 'allaccessible') . '</h3>'
             . '<p>' . esc_html__('If something on this site is hard to use, please let us know', 'allaccessible')
             . ': ' . $contact . '. '
             . esc_html__('Include the page address and what went wrong.', 'allaccessible') . '</p>';
    }

    /**
     * Create the page: dashboard statement + contact block, as an ordinary
     * WordPress page the customer edits afterwards. Registration with
     * AllAccessible happens in the browser; PHP only reports the URL.
     *
     * @param array $a contact_email, contact_phone, publish (bool)
     * @return array|WP_Error describe() of the new page
     */
    public static function create_page(array $a) {
        $publish = !empty($a['publish']);
        $contact = array(
            'contact_email' => sanitize_email(isset($a['contact_email']) ? $a['contact_email'] : ''),
            'contact_phone' => sanitize_text_field(isset($a['contact_phone']) ? $a['contact_phone'] : ''),
        );
        update_option(self::OPTION_CONTACT, $contact, false);

        $body = self::statement_html();
        if (trim(strip_tags($body)) === '') {
            $body = '<h3>' . esc_html__('Accessibility Statement', 'allaccessible') . '</h3>';
        }
        $id = wp_insert_post(array(
            'post_type'    => 'page',
            'post_status'  => $publish ? 'publish' : 'draft',
            'post_title'   => __('Accessibility statement', 'allaccessible'),
            'post_name'    => self::SLUG,
            'post_content' => $body . self::contact_block($contact),
        ), true);
        if (is_wp_error($id)) {
            return $id;
        }
        update_post_meta($id, self::META_KEY, 1);
        update_option(self::OPTION_PAGE_ID, (int) $id, false);
        return self::describe(get_post($id), 'option');
    }

    /**
     * Replace the statement text on a page we created with the current wording
     * from the dashboard. The contact block is rebuilt from the saved contact
     * details; WordPress keeps the previous body as a revision.
     *
     * @return array|WP_Error describe() of the page
     */
    public static function refresh_page() {
        $s = self::status();
        if (!$s['page'] || !in_array($s['page']['source'], array('option', 'meta'), true)) {
            return new WP_Error('aacb_not_owned', __('Only a page created by the plugin can be refreshed.', 'allaccessible'));
        }
        $body = self::statement_html();
        if (trim(strip_tags($body)) === '') {
            return new WP_Error('aacb_statement_empty', __('Could not fetch the current statement wording. Try again in a minute.', 'allaccessible'));
        }
        $contact = get_option(self::OPTION_CONTACT, array());
        $contact = is_array($contact) ? $contact : array();
        $id = wp_update_post(array('ID' => (int) $s['page']['id'], 'post_content' => $body . self::contact_block($contact)), true);
        if (is_wp_error($id)) {
            return $id;
        }
        return self::describe(get_post((int) $id), 'option');
    }

    /**
     * Use a page the site already has as its statement page.
     *
     * @return array|WP_Error
     */
    public static function adopt_existing($post_id) {
        $p = get_post((int) $post_id);
        if (!$p || $p->post_type !== 'page') {
            return new WP_Error('aacb_no_page', __('That page could not be found.', 'allaccessible'));
        }
        update_post_meta($p->ID, self::META_KEY, 1);
        update_option(self::OPTION_PAGE_ID, (int) $p->ID, false);
        return self::describe($p, 'option');
    }

    /**
     * Server-side registration, used only by on_status_change() (no browser
     * there). Empty string clears it.
     *
     * @return true|WP_Error
     */
    public static function register_url($url) {
        $url = (string) $url;
        if (!class_exists('AllAccessible_ApiClient')) {
            return new WP_Error('aacb_no_client', 'API client unavailable');
        }
        $r = AllAccessible_ApiClient::get_instance()->save_site_options(array('statementUrl' => $url));
        if ($r === true) {
            update_option(self::OPTION_REGISTERED, $url, false);
        }
        return $r;
    }

    /** Keep the registration honest when our page is published, unpublished or trashed. */
    public static function on_status_change($new_status, $old_status, $post) {
        if (!$post || $post->post_type !== 'page') return;
        if ((int) $post->ID !== (int) get_option(self::OPTION_PAGE_ID)) return;
        if ($new_status === $old_status) return;
        if ($new_status === 'publish') {
            self::register_url(get_permalink($post));
        } elseif ($old_status === 'publish') {
            self::register_url('');
        }
    }

    /** Everything the card, the checklist and the wizard need, in one array. */
    public static function status() {
        $page       = self::detect_existing_page();
        $registered = (string) get_option(self::OPTION_REGISTERED);
        return array(
            'page'       => $page,
            'published'  => (bool) ($page && $page['status'] === 'publish'),
            'registered' => (bool) ($page && $registered !== '' && $registered === $page['url']),
            'footer'     => (bool) get_option(self::OPTION_FOOTER),
            'edit_url'   => ($page && function_exists('get_edit_post_link')) ? (string) get_edit_post_link($page['id'], 'raw') : '',
        );
    }

    /** Label the page in the Pages list. */
    public static function post_state($states, $post) {
        if ($post && (int) $post->ID === (int) get_option(self::OPTION_PAGE_ID)) {
            $states['aacb_statement'] = __('Accessibility statement', 'allaccessible');
        }
        return $states;
    }

    /** Optional plain footer link, for themes without a statement link. */
    public static function print_footer_link() {
        if (!get_option(self::OPTION_FOOTER)) return;
        $page = self::detect_existing_page();
        if (!$page || $page['status'] !== 'publish') return;
        echo '<p class="aacb-statement-link" style="text-align:center;font-size:.875rem;margin:1em 0;"><a href="' . esc_url($page['url']) . '">' . esc_html__('Accessibility statement', 'allaccessible') . '</a></p>' . "\n";
    }

    /* ───────────────────────── Admin guide (AJAX + UI) ───────────────────────── */

    /** AJAX: create | adopt | registered | footer | status. Admin-only, nonce-checked. */
    public static function ajax_handle() {
        if (!current_user_can('manage_options')) {
            wp_send_json_error(array('message' => __('Unauthorized', 'allaccessible')), 403);
        }
        check_ajax_referer(self::AJAX_ACTION, '_wpnonce');
        $do = isset($_POST['do']) ? sanitize_key($_POST['do']) : '';
        switch ($do) {
            case 'create':
                $r = self::create_page(array(
                    'contact_email' => isset($_POST['contact_email']) ? sanitize_email(wp_unslash($_POST['contact_email'])) : '',
                    'contact_phone' => isset($_POST['contact_phone']) ? sanitize_text_field(wp_unslash($_POST['contact_phone'])) : '',
                    'publish'       => isset($_POST['publish']) && (string) $_POST['publish'] === '1',
                ));
                break;
            case 'adopt':
                $r = self::adopt_existing(isset($_POST['page_id']) ? (int) $_POST['page_id'] : 0);
                break;
            case 'refresh':
                $r = self::refresh_page();
                break;
            case 'registered': // the browser posted statementUrl to the app and got 200
                $url = isset($_POST['url']) ? esc_url_raw(wp_unslash($_POST['url'])) : '';
                update_option(self::OPTION_REGISTERED, $url, false);
                $r = array('registered' => $url);
                break;
            case 'footer':
                $on = isset($_POST['on']) && (string) $_POST['on'] === '1';
                update_option(self::OPTION_FOOTER, $on, false);
                $r = array('footer' => $on);
                break;
            case 'status':
                $r = array();
                break;
            default:
                $r = new WP_Error('aacb_bad_action', __('Unknown action', 'allaccessible'));
        }
        if (is_wp_error($r)) {
            wp_send_json_error(array('message' => $r->get_error_message()));
        }
        wp_send_json_success(array_merge(self::status(), array('result' => $r)));
    }

    /**
     * The guide. $context = 'dashboard' | 'wizard'. Three states:
     *   a page we do not own was found  → offer to use it or create a new one
     *   a page we own exists            → status, link-it, footer toggle, edit
     *   nothing                         → two questions (contact, publish/draft)
     * Everything here is admin-initiated; nothing runs on page load.
     */
    public static function render_guide($context = 'dashboard') {
        $s     = self::status();
        $nonce = wp_create_nonce(self::AJAX_ACTION);
        $owned = $s['page'] && ($s['page']['source'] === 'option' || $s['page']['source'] === 'meta');
        $found = $s['page'] && !$owned;
        $saved = get_option(self::OPTION_CONTACT, array());
        $saved = is_array($saved) ? $saved : array();
        ?>
        <div class="aacb-statement-guide"
             data-context="<?php echo esc_attr($context); ?>"
             data-nonce="<?php echo esc_attr($nonce); ?>"
             data-ajax="<?php echo esc_url(admin_url('admin-ajax.php')); ?>"
             data-app="<?php echo esc_url(class_exists('AllAccessible_ApiClient') ? AllAccessible_ApiClient::APP_BASE_URL : 'https://app.allaccessible.org'); ?>"
             data-account="<?php echo esc_attr((string) get_option('aacb_accountID')); ?>"
             data-sub="<?php echo (int) get_option('aacb_siteID'); ?>">

            <?php if ($found) :
                $fp = get_post((int) $s['page']['id']);
                $f_status = $s['page']['status'] === 'publish' ? __('Published', 'allaccessible') : ($s['page']['status'] === 'draft' ? __('Draft', 'allaccessible') : ucfirst($s['page']['status']));
                $f_when   = $fp ? date_i18n(get_option('date_format'), strtotime($fp->post_date)) : '';
                $f_author = ($fp && $fp->post_author) ? get_the_author_meta('display_name', (int) $fp->post_author) : '';
            ?>
                <div class="aacb-found aacb-statement-found">
                    <span class="aacb-found__icon" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 3H6a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V9z"/><path d="M14 3v6h6M8 13h8M8 17h5"/></svg></span>
                    <div class="aacb-found__body">
                        <p class="aacb-found__title"><?php esc_html_e('Is this your statement page?', 'allaccessible'); ?></p>
                        <p class="aacb-found__meta">
                            <?php
                            $meta = array('“' . $s['page']['title'] . '”', $f_status);
                            if ($f_when !== '') {
                                /* translators: 1: date, 2: author display name */
                                $meta[] = $f_author !== '' ? sprintf(__('created %1$s by %2$s', 'allaccessible'), $f_when, $f_author) : sprintf(__('created %s', 'allaccessible'), $f_when);
                            }
                            echo esc_html(implode(' · ', $meta));
                            ?>
                        </p>
                        <div class="aacb-found__actions">
                            <button type="button" class="aacx-v2__btn aacx-v2__btn--primary aacx-v2__btn--sm" data-act="adopt" data-page-id="<?php echo (int) $s['page']['id']; ?>" data-page-url="<?php echo esc_url($s['page']['url']); ?>" data-page-status="<?php echo esc_attr($s['page']['status']); ?>"><?php esc_html_e('Yes, use this page', 'allaccessible'); ?></button>
                            <button type="button" class="aacx-v2__btn aacx-v2__btn--secondary aacx-v2__btn--sm" data-act="show-form"><?php esc_html_e('No, create a new one', 'allaccessible'); ?></button>
                            <?php if ($s['edit_url']) : ?><a href="<?php echo esc_url($s['edit_url']); ?>" style="font-size:var(--aacx-text-sm);"><?php esc_html_e('Open in editor', 'allaccessible'); ?></a><?php endif; ?>
                        </div>
                        <p class="aacb-found__meta" style="margin-top:var(--aacx-space-2);color:var(--aacx-text-muted);font-size:var(--aacx-text-xs);"><?php esc_html_e('Using it links the page to AllAccessible. Nothing on the page itself changes.', 'allaccessible'); ?></p>
                    </div>
                </div>
            <?php endif; ?>

            <?php if ($owned) : ?>
                <div class="aacb-statement-done">
                    <div class="aacb-done">
                        <span class="aacb-check__mark <?php echo $s['published'] ? 'aacb-check__mark--done' : 'aacb-check__mark--next'; ?>" aria-hidden="true"><?php echo $s['published'] ? '✓' : '○'; ?></span>
                        <div class="aacb-done__body">
                            <p class="aacb-done__title">
                                <?php if ($s['published'] && $s['registered']) : ?>
                                    <?php esc_html_e('Your accessibility statement is live and linked', 'allaccessible'); ?>
                                <?php elseif ($s['published']) : ?>
                                    <?php esc_html_e('Your accessibility statement is live', 'allaccessible'); ?>
                                <?php else : ?>
                                    <?php esc_html_e('Your accessibility statement is still a draft', 'allaccessible'); ?>
                                <?php endif; ?>
                            </p>
                            <p class="aacb-done__meta">
                                <a href="<?php echo esc_url($s['page']['url']); ?>" target="_blank" rel="noopener"><?php echo esc_html($s['page']['url']); ?></a>
                                <?php if ($s['published'] && $s['registered']) : ?>
                                    · <?php esc_html_e('visitors reach it from the accessibility menu', 'allaccessible'); ?>
                                <?php elseif (!$s['published']) : ?>
                                    · <?php esc_html_e('nothing is public until you publish it', 'allaccessible'); ?>
                                <?php endif; ?>
                            </p>
                        </div>
                        <div class="aacb-done__actions">
                            <?php if (!$s['published']) : ?>
                                <a class="aacx-v2__btn aacx-v2__btn--primary aacx-v2__btn--sm" href="<?php echo esc_url($s['edit_url']); ?>"><?php esc_html_e('Review and publish', 'allaccessible'); ?></a>
                            <?php elseif (!$s['registered']) : ?>
                                <button type="button" class="aacx-v2__btn aacx-v2__btn--primary aacx-v2__btn--sm" data-act="link" data-page-url="<?php echo esc_url($s['page']['url']); ?>"><?php esc_html_e('Link it to AllAccessible', 'allaccessible'); ?></button>
                                <a class="aacx-v2__btn aacx-v2__btn--secondary aacx-v2__btn--sm" href="<?php echo esc_url($s['edit_url']); ?>"><?php esc_html_e('Edit wording', 'allaccessible'); ?></a>
                            <?php else : ?>
                                <a class="aacx-v2__btn aacx-v2__btn--secondary aacx-v2__btn--sm" href="<?php echo esc_url($s['page']['url']); ?>" target="_blank" rel="noopener"><?php esc_html_e('View page', 'allaccessible'); ?></a>
                                <a class="aacx-v2__btn aacx-v2__btn--secondary aacx-v2__btn--sm" href="<?php echo esc_url($s['edit_url']); ?>"><?php esc_html_e('Edit wording', 'allaccessible'); ?></a>
                            <?php endif; ?>
                            <button type="button" class="aacx-v2__btn aacx-v2__btn--ghost aacx-v2__btn--sm" data-act="refresh" data-arm="<?php esc_attr_e('Click again to replace the page text', 'allaccessible'); ?>"><?php esc_html_e('Refresh from AllAccessible', 'allaccessible'); ?></button>
                        </div>
                    </div>
                    <p class="aacb-done__meta" style="margin-top:var(--aacx-space-2);color:var(--aacx-text-muted);font-size:var(--aacx-text-xs);"><?php esc_html_e('Refresh replaces the statement text with the current wording from your AllAccessible dashboard. Your contact details stay, and the previous version is kept in the page\'s revisions.', 'allaccessible'); ?></p>
                    <p class="aacb-statement-msg" role="status" aria-live="polite" style="margin:var(--aacx-space-2) 0 0;font-size:var(--aacx-text-sm);"></p>
                    <label style="display:flex; gap: var(--aacx-space-2); align-items:center; margin-top: var(--aacx-space-3); font-size: var(--aacx-text-sm);">
                        <input type="checkbox" data-act="footer" <?php checked($s['footer']); ?>>
                        <?php esc_html_e('Also add a small “Accessibility statement” link at the bottom of every page', 'allaccessible'); ?>
                    </label>
                </div>
            <?php endif; ?>

            <form class="aacb-statement-form" <?php if ($s['page']) echo 'hidden'; ?> onsubmit="return false;">
                <p style="margin:0 0 var(--aacx-space-4); font-size: var(--aacx-text-sm);"><?php esc_html_e('We will create a page with the current statement wording from your AllAccessible dashboard. You choose when it goes live.', 'allaccessible'); ?></p>
                <div class="aacx-v2__field" style="margin-bottom: var(--aacx-space-4);">
                    <label class="aacx-v2__label" for="aacb-st-email"><?php esc_html_e('Accessibility contact email', 'allaccessible'); ?></label>
                    <input class="aacx-v2__input" id="aacb-st-email" type="email" name="contact_email" value="<?php echo esc_attr(isset($saved['contact_email']) ? $saved['contact_email'] : ''); ?>" placeholder="accessibility@example.com">
                    <label class="aacx-v2__label" for="aacb-st-phone" style="margin-top: var(--aacx-space-2);"><?php esc_html_e('Phone (optional)', 'allaccessible'); ?></label>
                    <input class="aacx-v2__input" id="aacb-st-phone" type="text" name="contact_phone" value="<?php echo esc_attr(isset($saved['contact_phone']) ? $saved['contact_phone'] : ''); ?>">
                </div>
                <fieldset class="aacx-v2__field" style="margin-bottom: var(--aacx-space-4); border:0; padding:0;">
                    <legend class="aacx-v2__label" style="margin-bottom: var(--aacx-space-2);"><?php esc_html_e('How should we create it?', 'allaccessible'); ?></legend>
                    <div class="aacb-choices">
                        <label class="aacb-choice"><input type="radio" name="publish" value="0" checked><span><span class="aacb-choice__title"><?php esc_html_e('Save as a draft', 'allaccessible'); ?></span><span class="aacb-choice__desc"><?php esc_html_e('Review it in the editor first. Recommended.', 'allaccessible'); ?></span></span></label>
                        <label class="aacb-choice"><input type="radio" name="publish" value="1"><span><span class="aacb-choice__title"><?php esc_html_e('Publish right away', 'allaccessible'); ?></span><span class="aacb-choice__desc"><?php esc_html_e('Goes live at /accessibility-statement and links from the accessibility menu.', 'allaccessible'); ?></span></span></label>
                    </div>
                </fieldset>
                <div style="display:flex; gap: var(--aacx-space-3); align-items:center; flex-wrap:wrap;">
                    <button type="button" class="aacx-v2__btn aacx-v2__btn--primary" data-act="create"><?php esc_html_e('Create my statement page', 'allaccessible'); ?> <span aria-hidden="true">→</span></button>
                    <span class="aacb-statement-msg" role="status" aria-live="polite"></span>
                </div>
            </form>
        </div>
        <?php
        self::print_guide_script();
    }

    /** One inline script per page. The guide reloads after each admin action. */
    private static function print_guide_script() {
        static $printed = false;
        if ($printed) return;
        $printed = true;
        $strings = array(
            'working'   => __('Working…', 'allaccessible'),
            'failed'    => __('Something went wrong. Please try again.', 'allaccessible'),
            'unlinked'  => __('Page saved, but AllAccessible could not be told about it yet. Use “Link it now” on the Dashboard.', 'allaccessible'),
            'dashboard' => admin_url('admin.php?page=allaccessible#aacb-statement-card'),
        );
        ?>
        <script>
        (function () {
            var T = <?php echo wp_json_encode($strings); ?>;
            document.querySelectorAll('.aacb-statement-guide').forEach(function (root) {
                var ajax = root.getAttribute('data-ajax'), nonce = root.getAttribute('data-nonce');
                var msg = root.querySelector('.aacb-statement-msg');
                function say(t) { if (msg) msg.textContent = t; }
                function post(fields) {
                    var fd = new FormData();
                    fd.append('action', '<?php echo esc_js(self::AJAX_ACTION); ?>');
                    fd.append('_wpnonce', nonce);
                    Object.keys(fields).forEach(function (k) { fd.append(k, fields[k]); });
                    return fetch(ajax, { method: 'POST', credentials: 'same-origin', body: fd }).then(function (r) { return r.json(); });
                }
                // Same app route the customizer and language card post to from the
                // browser: it verifies accountID owns the subdomain and busts the edge
                // license cache. Then record locally that the app accepted it.
                function registerWithApp(url) {
                    return fetch(root.getAttribute('data-app') + '/api/save-site-options/' + root.getAttribute('data-sub'), {
                        method: 'POST', headers: { 'Content-Type': 'application/json' },
                        body: JSON.stringify({ accountID: root.getAttribute('data-account'), subdomainID: root.getAttribute('data-sub'), statementUrl: url })
                    }).then(function (r) {
                        if (!r.ok) throw new Error('save-site-options ' + r.status);
                        return post({ 'do': 'registered', url: url });
                    }).catch(function () { say(T.unlinked); });
                }
                function finish() {
                    if (root.getAttribute('data-context') === 'wizard') { window.location.href = T.dashboard; return; }
                    window.location.reload();
                }
                root.addEventListener('click', function (e) {
                    var btn = e.target.closest('[data-act]'); if (!btn || btn.type === 'checkbox') return;
                    var act = btn.getAttribute('data-act');
                    if (act === 'show-form') {
                        root.querySelector('.aacb-statement-form').hidden = false;
                        var banner = root.querySelector('.aacb-statement-found'); if (banner) banner.hidden = true;
                        return;
                    }
                    if (act === 'refresh' && btn.getAttribute('data-armed') !== '1') {
                        btn.setAttribute('data-armed', '1'); btn.textContent = btn.getAttribute('data-arm'); btn.classList.add('aacx-v2__btn--secondary');
                        return;
                    }
                    if (act === 'link') {
                        btn.disabled = true; say(T.working);
                        registerWithApp(btn.getAttribute('data-page-url')).then(finish);
                        return;
                    }
                    var fields = { 'do': act };
                    if (act === 'adopt') fields.page_id = btn.getAttribute('data-page-id');
                    if (act === 'create') {
                        var f = root.querySelector('.aacb-statement-form');
                        fields.contact_email = f.contact_email.value;
                        fields.contact_phone = f.contact_phone.value;
                        fields.publish = f.publish.value;
                    }
                    btn.disabled = true; say(T.working);
                    post(fields).then(function (res) {
                        if (!res || !res.success) { say((res && res.data && res.data.message) || T.failed); btn.disabled = false; return; }
                        var page = res.data && res.data.page;
                        // A new draft goes straight to the editor so the owner can read
                        // and publish it; a published page stays here (it is already live).
                        if (act === 'create' && page && page.status !== 'publish' && res.data.edit_url) { window.location.href = res.data.edit_url; return 'redirected'; }
                        if (page && page.status === 'publish') { return registerWithApp(page.url); }
                    }).then(function (r) { if (r !== 'redirected') finish(); });
                });
                root.addEventListener('change', function (e) {
                    var cb = e.target.closest('input[data-act="footer"]'); if (!cb) return;
                    post({ 'do': 'footer', on: cb.checked ? '1' : '0' });
                });
            });
        })();
        </script>
        <?php
    }

    /** Dashboard card wrapper around the guide. */
    public static function render_card() {
        ?>
        <div class="aacx-v2__card aacx-v2__card--elevated" id="aacb-statement-card" style="margin-bottom: var(--aacx-space-6);">
            <div class="aacx-v2__card-header">
                <div>
                    <h3 style="margin: 0;"><?php esc_html_e('Accessibility statement', 'allaccessible'); ?></h3>
                    <p style="font-size: var(--aacx-text-xs); color: var(--aacx-text-muted); margin: 2px 0 0;"><?php esc_html_e('A page that tells visitors what you do for accessibility and how to reach you. Once linked, the on-page accessibility menu opens it.', 'allaccessible'); ?></p>
                </div>
            </div>
            <div class="aacx-v2__card-body"><?php self::render_guide('dashboard'); ?></div>
        </div>
        <?php
    }
}