`.
+- `wpstarter_settings_tab_after`: print a section after a settings tab’s cards (tab slug).
+
+Read a setting with `WPStarter_Settings::get( 'key' )`.
+
+## Uninstall
+
+Deleting the plugin removes its settings, its cached data, who hid lines of the Plugins screen notice about replaced plugins, and the cached GitHub releases.
+
+## Changelog
+
+### 1.0.0
+
+- A fresh start, made from the parts every wpallstars plugin needs, taken from plugins in daily use: the settings screen with search, the Read Me tab, features as classes, replaced plugins, the shared GitHub updater, the release and check scripts, CI and the shared rules (`STANDARDS.md`, `DEVELOPMENT.md`, `RELEASING.md`). Earlier versions of this starter are retired; start again from this one.
+- New: `scripts/rename-plugin.sh` gives a copy of the starter its own names, and `scripts/sync-core.sh` keeps a plugin's core files the same as the starter's (`--check` lists any that differ).
+
+## Built with AI
+
+WP Plugin Starter is built and maintained with [aidevops](https://aidevops.sh), the same developer's open-source AI harness for creating and managing anything online with AI, plugins like this one included. It is free on [GitHub](https://github.com/marcusquinn/aidevops).
+
+## License
+
+GPL-2.0-or-later.
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..e9b4df5
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,130 @@
+# Releasing
+
+How every plugin made from the wpallstars starter plugin is released. This
+file is the same in each of them (names as placeholders: `STANDARDS.md`
+lists them, and the plugin's `AGENTS.md` gives its values). The plugin's own
+submission state and guideline review: `LAUNCH.md`.
+
+Releases on GitHub and the WordPress.org submission need the owner's say.
+None of the scripts below tags, publishes, uploads or commits anything.
+
+## Scripts
+
+| Script | What it does |
+|--------|--------------|
+| `scripts/build-release.sh [--ref REF] [--out DIR]` | Builds both zips from a Git ref (default `HEAD`) into `dist/` (gitignored), with `SHA256SUMS`. Files come from Git, never the working tree. |
+| `scripts/preflight-release.sh [--ref REF] [--strict] [--offline]` | Checks versions, headers, readme, both zips (layout, development files, PHP 7.4 and JS syntax, updater code), remote assets, presets and starter data where the plugin has them, and the Git tag. Errors stop a release; `--strict` also fails on warnings, for a WordPress.org submission. |
+| `scripts/plugin-check.sh [--ref REF] [--zip FILE]` | Runs Plugin Check on both zips in a disposable WordPress in Docker, then removes it. |
+
+The two builds of each version:
+
+| Zip | Contents | Goes to |
+|-----|----------|---------|
+| `{slug}-X.Y.Z.zip` | Files in Git, less `.distignore` | GitHub release asset |
+| `wordpress-org-{slug}-X.Y.Z.zip` | The same, less `.distignore-wporg` (the GitHub updater) and the `GitHub Plugin URI`, `Primary Branch` and `Release Asset` header lines | WordPress.org only |
+
+Sites install the release asset whose name starts with `{slug}` (the shared
+GitHub updater, and Git Updater where it is still active), so the
+WordPress.org zip is named differently and must never be attached to a
+GitHub release.
+
+Plugin Check reports the GitHub updater as an updater
+(`plugin_updater_detected`, `update_modification_detected`, and
+`OffloadedContent` for its raw.githubusercontent.com address) and its shared
+`wpallstars_` names as unprefixed, in the GitHub zip; `scripts/plugin-check.sh`
+lists those as expected there and fails on the updater findings in the
+WordPress.org zip.
+
+## GitHub release
+
+1. In a pull request, set the version in `{slug}.php` (`Version:` and
+ `{PREFIX}_VERSION`) and `readme.txt` (`Stable tag:`), rename the
+ changelog's Unreleased section to the version in `readme.txt`,
+ `changelog.txt` and `README.md`, and add an upgrade notice if people need
+ to act. `readme.txt` keeps only the newest version, in short, and must stay
+ under 10 KB; `changelog.txt` keeps every version in full.
+ Numbers only (`1.2.3`): sites still on Git Updater offer a `Version:` on
+ `main` to every site, and the shared updater skips tags with letters.
+2. On the pull request's branch: `scripts/preflight-release.sh` (no errors) and
+ `scripts/plugin-check.sh` (no errors).
+3. Merge, then straight away:
+
+ ```bash
+ git fetch origin
+ scripts/preflight-release.sh --ref origin/main # no errors before tagging
+ git tag -a vX.Y.Z origin/main -m "{Name} X.Y.Z"
+ scripts/build-release.sh --ref vX.Y.Z
+ git push origin vX.Y.Z
+ gh release create vX.Y.Z dist/{slug}-X.Y.Z.zip --title "{Name} X.Y.Z" --notes-file
+ ```
+
+ Sites with the shared updater see the release when they next check.
+ Sites still on Git Updater are offered the `Version:` on `main` before the
+ release exists, so do this in the same sitting as the merge.
+4. Check the release has exactly one asset, `{slug}-X.Y.Z.zip`, and on a
+ site with the previous version that **Check again** on the Updates screen
+ shows the update and that it installs.
+
+Sites read the repository without signing in, so it must be public for sites
+to get updates. While it is private, a test site can use a read-only token
+in `WPALLSTARS_GITHUB_TOKEN` (`wp-config.php`; it serves every plugin with
+the shared updater). Making it public needs the owner's say; do the quality
+sweep in `DEVELOPMENT.md` → At public launch in the same step.
+
+## WordPress.org
+
+Guidelines: [Detailed Plugin Guidelines](https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/),
+[Planning, submitting and maintaining](https://developer.wordpress.org/plugins/wordpress-org/planning-submitting-and-maintaining-plugins/),
+[Plugin readmes](https://developer.wordpress.org/plugins/wordpress-org/how-your-readme-txt-works/),
+[Plugin assets](https://developer.wordpress.org/plugins/wordpress-org/plugin-assets/),
+[Using Subversion](https://developer.wordpress.org/plugins/wordpress-org/how-to-use-subversion/).
+
+Before submitting, work through the plugin's `LAUNCH.md`: what
+`scripts/preflight-release.sh --strict` still reports, and a review of the
+code against each guideline (no code from elsewhere, external services,
+scripts and styles shipped with the plugin, links, admin notices, defaults,
+files outside the plugin folder, uninstall, GPL, name and trademarks, a
+complete plugin).
+
+### Submitting
+
+1. `scripts/build-release.sh --ref vX.Y.Z` (a version already released on
+ GitHub), then `scripts/preflight-release.sh --ref vX.Y.Z --strict` passes,
+ or every warning is accepted.
+2. `scripts/plugin-check.sh --ref vX.Y.Z` reports no errors; read every
+ warning.
+3. Test the WordPress.org zip on a clean site (latest WordPress and 6.2 with
+ PHP 7.4), with `WP_DEBUG` on: activate, turn each feature on and off,
+ deactivate, delete. `debug.log` stays empty.
+4. Signed in as the owner's WordPress.org account, upload
+ `dist/wordpress-org-{slug}-X.Y.Z.zip` at
+ [Add your plugin](https://wordpress.org/plugins/developers/add/), and ask
+ for the `{slug}` slug in the notes.
+5. Review takes about 1 to 10 business days. Reply to the reviewer's email
+ from the same account; fix issues in the repository, not in a copy.
+
+### After approval (Subversion)
+
+The SVN repository is `https://plugins.svn.wordpress.org/{slug}/` (or the
+slug given). It is for releases only, not development. The SVN password is
+separate from the account password and is set on the WordPress.org profile
+(see Using Subversion). Install Subversion first (`brew install subversion`).
+
+1. Check out the empty repository: `svn co https://plugins.svn.wordpress.org/{slug}/ svn-{slug}`.
+2. Unzip the WordPress.org build's `{slug}/` folder into `trunk/` (no zip
+ files in SVN), `svn add` new files, `svn rm` removed ones.
+3. Copy trunk to the tag: `svn cp trunk tags/X.Y.Z`. `Stable tag:` in
+ `trunk/readme.txt` and `tags/X.Y.Z/readme.txt` must be `X.Y.Z`; never
+ `trunk`.
+4. Put the banners, icons and screenshots in `assets/`.
+5. `svn ci -m "Release X.Y.Z"`, then check the plugin page and download.
+6. Consider release confirmation emails (Plugin Handbook → Release
+ Confirmation Emails), so a release goes out only after it is confirmed.
+
+Each later WordPress.org release: build from the tag that is already on GitHub,
+`--strict` preflight, Plugin Check, then steps 2 to 5. Readme-only changes
+(such as raising Tested up to) go to trunk and the current tag.
+
+Once listed, sites with the GitHub build update from WordPress.org, unless
+the plugin returns true from `wpallstars_github_updater_early` (a setting
+such as Early updates from GitHub), which keeps them on GitHub releases.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..75cc438
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,37 @@
+# Security policy
+
+## Supported versions
+
+Security fixes go into the latest release only. Update to it before
+reporting, and check that the problem is still there.
+
+## Reporting a vulnerability
+
+Please do not open a public issue, pull request or discussion for a
+security problem.
+
+Report it privately on GitHub: open the repository's **Security** tab and
+choose **Report a vulnerability**. Include:
+
+- the WP Plugin Starter version, and whether it came from GitHub or
+ WordPress.org;
+- the WordPress and PHP versions;
+- the feature involved and the settings needed;
+- steps to reproduce it, and what an attacker gains (for example, which
+ role they need and what they can then read or change).
+
+We reply within 30 days, agree a fix and a date with you, and credit you in
+the changelog unless you would rather not be named. If it is urgent (for
+example, it is already being used against sites), report it on GitHub and
+also email security@evergreen.je with a link to the report. Follow-up
+emails are welcome.
+
+## Scope
+
+In scope: the code in this repository, as installed from a GitHub release
+or WordPress.org.
+
+Out of scope: other plugins, themes and services that WP Plugin Starter
+recommends, links to or works with (report those to their makers), and
+problems that need an administrator account, since administrators can
+already run code on their site.
diff --git a/STANDARDS.md b/STANDARDS.md
new file mode 100644
index 0000000..7df23c3
--- /dev/null
+++ b/STANDARDS.md
@@ -0,0 +1,278 @@
+# Plugin standards
+
+Rules every plugin made from the wpallstars starter plugin follows. This file
+is the same in each of them: the starter holds the master copy, so a lesson
+learned in one plugin goes into the starter's copy and then to every plugin
+(`scripts/sync-core.sh` shows the differences). Never put rules for one
+plugin here; they go in its `AGENTS.md`.
+
+Names below are placeholders. Each plugin's `AGENTS.md` gives its values:
+
+| Placeholder | Meaning | Example |
+|---|---|---|
+| `{slug}` | Folder, main file and text domain | `my-plugin` |
+| `{prefix}` | Option, hook, function and file prefix: `{PREFIX}` in lower case | `myplugin` |
+| `{Prefix}` | Class prefix (`@package`) | `MyPlugin` |
+| `{PREFIX}` | Constant prefix | `MYPLUGIN` |
+| `{Name}` | Plugin name | My Plugin |
+| `{css}` | CSS class and data attribute prefix (`{css}-card`, `data-{css}-setting`) | `mp` |
+
+Minimums: **WordPress 6.2, PHP 7.4** (`readme.txt`, plugin header).
+How changes are made and checked: `DEVELOPMENT.md`. Releases: `RELEASING.md`.
+
+## Structure
+
+- Core files are listed in `scripts/core-files.txt`: the feature registry
+ (`includes/class-{prefix}.php`), the base feature
+ (`includes/class-{prefix}-feature.php`), the settings store
+ (`includes/class-{prefix}-settings.php`), the admin screen and Read Me tab
+ (`admin/`), the shared GitHub updater (`includes/github-updater/`), the
+ scripts, the CI workflow and tool configuration, and the shared docs (this
+ file, `DEVELOPMENT.md`, `RELEASING.md`, `CONTRIBUTING.md`, `SECURITY.md`).
+ A plugin's copy differs from the starter's only in the names above. They
+ hold no code for one plugin: they read `{Prefix}_Setup`
+ (`includes/class-{prefix}-setup.php`: features, settings tabs, header
+ links, settings version and history, the plugin's own helpers and admin
+ parts) or use hooks (`{prefix}_admin_tabs` for tabs,
+ `{prefix}_admin_enqueue` for the plugin's own admin CSS and JS,
+ `scripts/preflight-plugin.sh` for its own release checks). Anything only
+ one plugin needs goes there, in a feature, or in its own file loaded from
+ there. To change a core file, change the starter first, then run
+ `scripts/sync-core.sh` in each plugin; `scripts/sync-core.sh --check` lists
+ core files that differ. A new plugin starts as a copy of the starter
+ renamed with `scripts/rename-plugin.sh`.
+- One class per feature in `includes/features/`, extending `{Prefix}_Feature`,
+ registered in `{Prefix}_Setup::FEATURES`. Features some builds leave out
+ go in `{Prefix}_Setup::OPTIONAL_FEATURES` and load only when present.
+- `settings()` declares the schema; the admin screen renders, searches and
+ saves it with no extra code. Field types and keys: `README.md` → Developers.
+- `boot()` returns early unless `self::enabled()`. Features are **off by
+ default**; the plugin's `AGENTS.md` lists any the owner asked to be on.
+ Turning another feature on by default needs the owner's say.
+- A feature that replaces another plugin sets `'replaces' => array(slug => name)`
+ and imports that plugin's settings in `migrate()` with
+ `self::import_setting()` (fills only unset keys). It never writes or
+ deletes the other plugin's options. While that plugin is active the
+ feature waits, and the Plugins screen suggests deactivating and deleting
+ it (`admin/includes/class-replaced-plugins.php`) with no extra code.
+- Migrations run once per `{Prefix}_Setup::DB_VERSION`. After a release, a
+ new or changed import needs a version bump and a line in its docblock.
+- New options, post meta, user meta, transients, cron hooks and files must be
+ removed in `uninstall.php`.
+- `README.md` is also the plugin's Read Me tab
+ (`admin/includes/class-readme-manager.php`), which renders headings, lists,
+ tables, bold, italic, inline code, links (http(s) and `#heading` links,
+ with GitHub-style heading IDs) and images from the plugin folder on a line
+ of their own (``). Use only that Markdown,
+ or extend the renderer in the same change.
+- Update `README.md` (feature section, hooks, changelog), `changelog.txt`
+ (the user-facing changelog entry) and `readme.txt` in the same change.
+ `readme.txt` must stay under 10 KB for WordPress.org: one short line per
+ feature, every service the plugin contacts under External services, and
+ only the newest version's changelog, in short. Details go in `README.md`.
+- `.distignore` lists files kept out of the release zip. Add new
+ development-only files there (the preflight fails when a known one gets in),
+ then check the build with Plugin Check.
+
+## Code rules
+
+- PHP 7.4 syntax and WordPress 6.2 APIs. Guard newer core APIs with
+ `function_exists()` or `method_exists()`.
+- Capability and nonce checks on every admin action and AJAX handler; escape on
+ output; sanitise through the schema.
+- Prefix everything global with `{prefix}_`, `{Prefix}_` or `{PREFIX}_`. The
+ shared GitHub updater is the one exception: its `wpallstars_` names are the
+ same in every plugin, so that one copy can stand in for the others.
+- Admin copy: short, plain words, sentence case, no jargon.
+- Decide for the user. Within a feature, the plugin makes the choices
+ (which plugins, screens or items it applies to) from what it can detect.
+ Settings are there to bypass something that causes a problem, not choices
+ people need to understand first. A new setting must earn its place;
+ prefer detecting the right behaviour plus a short bypass list.
+- Site owner in control, performance first: the owner decides what their site
+ sends, contacts and shows. Calls to outside services are opt-in where they
+ are not the point of the feature, made only as often and for as long as
+ needed (cache answers, never on every page load), and never block a
+ visitor's page when they can run later. Features that rein in other
+ plugins hand the choice to the owner instead of deciding for them.
+ WordPress update checks and downloads are the exception: leave them alone
+ (next rule).
+- Do not change WordPress update behaviour (update transients, `auto_update_*`
+ filters, update checks) outside the shared GitHub updater. Plugin Check
+ reports `plugin_updater_detected` as an error, and WordPress.org asks plugins
+ not to interfere with the updater.
+- Leave no PHP errors, warnings, notices or deprecations behind. Fix any that
+ the plugin causes as you find them, in the same change when it is small,
+ or as a tracked issue. That includes ones in other plugins that only happen
+ because of this one. Messages that other plugins cause on their own are
+ theirs: mention them, do not hide them.
+
+## Updates from GitHub
+
+The one exception to the update rule, at the owner's request (for speed,
+reliability and site owners' control, and because the plugins are released
+on GitHub first): the shared GitHub updater in `includes/github-updater/`.
+It replaces Git Updater.
+
+- Every plugin made from the starter carries a copy. Each copy registers its
+ version from `load.php` when its plugin loads; on `plugins_loaded` only the
+ newest copy loads, once, and serves every installed plugin with a
+ `GitHub Plugin URI` header. One update check covers them all.
+- It adds GitHub releases of those plugins to core's own update check and
+ `plugins_api`, and leaves the download, install, auto-updates and rollback
+ to core. It only adds entries for those plugins; it never removes or blocks
+ other updates.
+- It is the same in every plugin apart from its text domain and `@package`.
+ Change it in the starter, raise the version in its `load.php`, and copy it
+ to each plugin. Plugins change what it does only through its filters
+ (`wpallstars_github_updater_enabled`, `wpallstars_github_updater_early`,
+ `wpallstars_github_plugins`, `wpallstars_github_token`), never by calling
+ its class: another plugin's copy may be the one that runs.
+- Keep anything that installs or updates code from outside WordPress.org in
+ that folder (and in a feature listed in `.distignore-wporg`, when a plugin
+ has a setting for it), because the WordPress.org build leaves them out.
+- Never add an `Update URI` header. Tokens for private repositories come only
+ from `wp-config.php` (`WPALLSTARS_GITHUB_TOKEN`) or the filter, go only to
+ api.github.com and are never stored.
+
+## Releases
+
+GitHub releases are the early channel; WordPress.org gets settled versions.
+Sites install the latest GitHub release whose tag is a plain version and the
+asset whose name starts with the plugin folder (the shared updater; Git
+Updater, where still active, reads `Version:` on `main` instead), so:
+
+- Publish the GitHub release (tag `vX.Y.Z`, asset `{slug}-X.Y.Z.zip` with a
+ `{slug}/` folder, built with `.distignore`) straight after the version
+ change reaches `main`.
+- Never put a pre-release version (`-beta1`, `-rc1`) in `Version:` on `main`;
+ mark test releases as pre-releases on GitHub.
+- The WordPress.org build is the release build without the files in
+ `.distignore-wporg` (the GitHub updater) and the `GitHub Plugin URI`,
+ `Primary Branch` and `Release Asset` header lines. Its zip is named
+ `wordpress-org-{slug}-X.Y.Z.zip` so no updater picks it; never attach it
+ to a GitHub release.
+- Any plugin released on GitHub (made from the starter or not) follows the
+ same pattern: a `GitHub Plugin URI: owner/repo` header (and
+ `Release Asset: true`), plain version tags, and a `{folder}-X.Y.Z.zip`
+ asset with a `{folder}/` inside.
+- Build both zips with `scripts/build-release.sh`, check them with
+ `scripts/preflight-release.sh` and `scripts/plugin-check.sh`. None of them
+ tags, publishes or uploads anything.
+- Releasing and submitting to WordPress.org need the owner's say. A private
+ repository cannot be read by sites without a token
+ (`WPALLSTARS_GITHUB_TOKEN`).
+
+Details: `RELEASING.md`; the plugin's own submission state: `LAUNCH.md`.
+
+## Front-end styling and dark mode
+
+Block, shortcode and other front-end styles must work with the Kadence Pro
+dark mode switcher (and themes that switch palettes the same way).
+
+- How it switches: Kadence adds `color-switch-dark` or `color-switch-light` to
+ ``. The dark class sets `color-scheme: dark` and redefines
+ `--global-palette1`…`15` and `--wp--preset--color--theme-palette-N` **on
+ ``**. `` stays `color-scheme: light`. Palette 3 is the strongest
+ text and palette 9 the page background in light mode; dark mode swaps them.
+- Use `currentColor`, `inherit`, translucent neutrals (for example
+ `rgba(127, 127, 127, 0.12)`) or palette variables, never fixed light or dark
+ colours for text, backgrounds or borders.
+- Do not use `@media (prefers-color-scheme)` to follow the site: it tracks the
+ visitor's system, not the switcher.
+- Do not define custom properties on `:root` from palette variables; they
+ resolve above `` and keep the light values. Read palette variables
+ where they are used, or define derived ones on the block.
+- Preset references (`var:preset|color|theme-palette3`) become CSS variables
+ with kebab-cased slugs, as core does: `--wp--preset--color--theme-palette-3`.
+ Use `_wp_to_kebab_case()` in PHP and the same rule in editor JS (a hyphen
+ between letters and digits, lower case).
+- Embedded pages (iframes) do not follow the switcher: they see the visitor's
+ system setting, and the browser paints their own background behind them, so
+ they stay readable in both modes. Do not make iframes transparent or tint them.
+- Test light and dark with the Kadence theme by toggling the body class (see
+ Testing, step 5).
+
+## Testing
+
+CI (`.github/workflows/ci.yml`) runs the code checks, the release preflight,
+Plugin Check and a smoke test on every pull request; details and local
+commands: `DEVELOPMENT.md`.
+
+While a repository is private, CI and review apps only advise: nothing is
+required to merge, for speed. Fix failures your change causes before merging;
+open an issue for any other failure and merge anyway. Do not turn on branch
+protection, required checks or paid reviewers. At public launch (owner's say),
+run the full sweep in `DEVELOPMENT.md` → At public launch, which makes the
+checks required.
+
+The checks catch errors, not wrong behaviour, so also verify on real
+WordPress:
+
+1. `scripts/lint.sh` (syntax, ShellCheck, PHPCS, PHPStan; run
+ `composer install` once). Fix findings in the code; never grow
+ `phpstan-baseline.neon` or add a `phpcs:ignore` without a reason.
+2. The user reviews on one local test site per plugin, shared by every
+ session and worktree. It shows a **combined preview**: `origin/main` plus
+ every open pull request from the repository, merged together. Update it
+ only with the script, from any worktree:
+
+ ```bash
+ scripts/preview-site.sh # the first run on a clone takes the site: scripts/preview-site.sh ""
+ scripts/preview-site.sh --dry-run # report what would be included, copy nothing
+ ```
+
+ It fetches `origin`, merges each open PR's branch onto `origin/main` in PR
+ order without touching any checkout, leaves out branches that conflict
+ (and lists them), copies the result with `.distignore` applied (exactly
+ what a release build contains), and writes
+ `/wp-content/{slug}-synced-from.txt` listing what is included.
+ A lock stops two runs at once. Because every run includes everyone's
+ pushed work, no session hides another's.
+
+ - **Never** `rsync` your worktree into the shared site: it hides every
+ other session's work until the next run. Do not use Git hooks either:
+ they are shared by every worktree and would deploy the wrong checkout.
+ - Only pushed work with an open PR is included. Before asking the user to
+ look at unmerged work, push the branch and open a draft PR, then run the
+ script. It says so if the branch you run it from is missing or has
+ commits that are not pushed.
+ - After merging a PR, run the script again, then check that the stamp
+ lists your merge in `main` before telling the user to look.
+ - Conflicts only in `changelog.txt`, `readme.txt` or `README.md` do not
+ leave a branch out: every PR adds lines at the top of the same
+ changelogs, so each merge to `main` would otherwise drop every other
+ open PR. The preview keeps both sides' lines there and says so in the
+ stamp; still merge `origin/main` into your branch before it merges.
+ - If your branch is left out because it conflicts in other files, merge
+ `origin/main` into it (or wait for the other PR), push and run the
+ script again. Tell the user which PRs are left out.
+ - To check your branch on its own, or for checks the user will not look
+ at, use a throwaway site of your own (step 4's Docker image on a free
+ port), which no one else overwrites:
+ `rsync -a --delete --delete-excluded --exclude-from=.distignore ./ "/wp-content/plugins/{slug}/"`.
+ - Size every test site, shared or throwaway, as `DEVELOPMENT.md` → Test
+ site resources says. PHP's defaults fill up and the slowdowns look like
+ bugs.
+
+3. Exercise the changed feature through the admin UI or HTTP, and check
+ the debug log for new messages mentioning `{slug}` or a plugin it affects
+ (`wp-content/debug.log`, or the file Debug Log Manager writes in
+ `wp-content/uploads/debug-log-manager/` when it is active). For settings
+ imports, seed the replaced plugin's options and delete `{prefix}_options`
+ and `{prefix}_db_version` while the plugin is inactive, then activate it.
+4. For changes that touch core APIs, also smoke-test on WordPress 6.2 with
+ PHP 7.4 (`scripts/smoke-test.sh --wp 6.2 --php 7.4`, or the
+ `wordpress:php7.4-apache` Docker image with
+ `wp core download --version=6.2 --force`).
+5. For front-end styling, view the page with the Kadence theme in light and
+ dark mode. Without Kadence Pro, simulate the switcher: print a
+ `body.color-switch-dark { color-scheme: dark; --global-palette1: …; }`
+ rule with a dark palette (palette 3 light, palette 9 dark, and the matching
+ `--wp--preset--color--theme-palette-N: var(--global-paletteN)` lines), then
+ swap the body class between `color-switch-light` and `color-switch-dark`.
+ Check text, backgrounds, borders and palette colours chosen in block
+ settings in both.
+
+Note: since WordPress 5.6, posts restored from the Bin become drafts. Republish
+test posts after bulk-trash tests.
diff --git a/admin/css/wpstarter-admin.css b/admin/css/wpstarter-admin.css
new file mode 100644
index 0000000..2fdada1
--- /dev/null
+++ b/admin/css/wpstarter-admin.css
@@ -0,0 +1,848 @@
+/**
+ * WP Plugin Starter admin screen.
+ *
+ * Scoped to .wps-wrap. Uses core admin tokens so the screen follows the
+ * active admin colour scheme; core buttons, notices and plugin cards keep
+ * their native styles. Logical properties keep RTL working without a
+ * separate stylesheet.
+ */
+
+.wps-wrap {
+ --wps-accent: var(--wp-admin-theme-color, #2271b1);
+ --wps-accent-dark: var(--wp-admin-theme-color-darker-10, #135e96);
+ --wps-text: #1d2327;
+ --wps-muted: #646970;
+ --wps-border: #dcdcde;
+ --wps-surface: #fff;
+ --wps-subtle: #f6f7f7;
+ --wps-success: #008a20;
+ --wps-error: #d63638;
+ --wps-radius: 8px;
+ --wps-shadow: 0 1px 2px rgba(0, 0, 0, 0.04);
+ --wps-focus: 0 0 0 2px var(--wps-surface), 0 0 0 4px var(--wps-accent);
+
+ margin-block-start: 0;
+ margin-inline-start: -20px;
+ margin-inline-end: 0;
+ color: var(--wps-text);
+ /* Start below the Screen Options / Notices tabs, so they never narrow the header. */
+ clear: both;
+}
+
+.wps-wrap *,
+.wps-wrap *::before,
+.wps-wrap *::after {
+ box-sizing: border-box;
+}
+
+/* Header ------------------------------------------------------------- */
+
+.wps-header {
+ display: flex;
+ flex-wrap: wrap;
+ align-items: center;
+ gap: 12px 24px;
+ padding: 14px 24px;
+ background: var(--wps-surface);
+ border-block-end: 1px solid var(--wps-border);
+}
+
+.wps-header__brand {
+ display: flex;
+ align-items: center;
+ gap: 10px;
+}
+
+.wps-header__logo {
+ display: inline-flex;
+ align-items: center;
+ justify-content: center;
+ width: 32px;
+ height: 32px;
+ font-size: 20px;
+ color: #fff;
+ background: var(--wps-accent);
+ border-radius: 6px;
+}
+
+.wps-wrap .wps-header__title {
+ margin: 0;
+ padding: 0;
+ font-size: 20px;
+ font-weight: 600;
+ line-height: 1.3;
+}
+
+.wps-header__actions {
+ display: flex;
+ flex-wrap: wrap;
+ align-items: center;
+ gap: 8px;
+ margin-inline-start: auto;
+}
+
+.wps-wrap .wps-header__support {
+ display: inline-flex;
+ align-items: center;
+ gap: 4px;
+}
+
+/* line-height: 1 stops the icon taking the button's taller line height,
+ which draws the glyph below the middle of its box. */
+.wps-wrap .wps-header__support .dashicons {
+ width: 18px;
+ height: 18px;
+ font-size: 18px;
+ line-height: 1;
+}
+
+/* Search ------------------------------------------------------------- */
+
+/* Stretch, so the field always matches the button's height, whatever
+ size the admin colour scheme or WordPress version gives buttons. */
+.wps-search {
+ display: flex;
+ align-items: stretch;
+ gap: 6px;
+}
+
+.wps-search__field {
+ position: relative;
+ display: flex;
+ align-items: stretch;
+}
+
+.wps-wrap .wps-search__icon {
+ position: absolute;
+ inset-block: 0;
+ inset-inline-start: 9px;
+ margin-block: auto;
+ color: var(--wps-muted);
+ pointer-events: none;
+}
+
+.wps-wrap .wps-search__input {
+ width: 260px;
+ max-width: 100%;
+ height: auto;
+ min-height: 30px;
+ margin: 0;
+ padding-block: 0;
+ padding-inline: 34px 10px;
+ font-size: 14px;
+ line-height: normal;
+ color: var(--wps-text);
+ background: var(--wps-surface);
+ /* Border and corners stay core's, so they match core buttons in each version. */
+ box-shadow: none;
+ transition: border-color 0.1s ease-in-out, box-shadow 0.1s ease-in-out;
+}
+
+.wps-wrap .wps-search__input::placeholder {
+ color: var(--wps-muted);
+ opacity: 1;
+}
+
+.wps-wrap .wps-search__input:hover {
+ border-color: var(--wps-accent);
+}
+
+.wps-wrap .wps-search__input:focus {
+ border-color: var(--wps-accent);
+ box-shadow: 0 0 0 1px var(--wps-accent);
+ outline: 2px solid transparent;
+}
+
+.wps-wrap .wps-search__field:focus-within .wps-search__icon {
+ color: var(--wps-accent);
+}
+
+.wps-wrap .wps-search__button {
+ margin: 0;
+}
+
+.wps-wrap .wps-search__group {
+ margin: 24px 0 8px;
+ font-size: 14px;
+ font-weight: 600;
+}
+
+.wps-wrap .wps-search__group:first-of-type {
+ margin-block-start: 8px;
+}
+
+/* Navigation --------------------------------------------------------- */
+
+.wps-nav {
+ display: flex;
+ flex-wrap: wrap;
+ align-items: stretch;
+ padding-inline: 12px;
+ background: var(--wps-surface);
+ border-block-end: 1px solid var(--wps-border);
+ overflow-x: auto;
+}
+
+.wps-nav__group {
+ display: flex;
+ align-items: stretch;
+}
+
+.wps-nav__group + .wps-nav__group {
+ margin-inline-start: 8px;
+ padding-inline-start: 8px;
+ border-inline-start: 1px solid var(--wps-border);
+}
+
+.wps-nav__tab {
+ display: inline-flex;
+ align-items: center;
+ padding: 14px 12px 11px;
+ font-size: 14px;
+ font-weight: 500;
+ color: var(--wps-muted);
+ text-decoration: none;
+ white-space: nowrap;
+ border-block-end: 3px solid transparent;
+ transition: color 0.1s ease, border-color 0.1s ease;
+}
+
+.wps-nav__tab:hover {
+ color: var(--wps-text);
+}
+
+.wps-nav__tab:focus {
+ outline: none;
+ box-shadow: none;
+}
+
+.wps-nav__tab:focus-visible {
+ outline: 2px solid var(--wps-accent);
+ outline-offset: -4px;
+ border-radius: 4px;
+}
+
+.wps-nav__tab.is-active {
+ color: var(--wps-text);
+ font-weight: 600;
+ border-block-end-color: var(--wps-accent);
+}
+
+/* Main --------------------------------------------------------------- */
+
+.wps-wrap > .notice,
+.wps-wrap > div.updated,
+.wps-wrap > div.error {
+ margin: 16px 24px 0;
+}
+
+.wps-main {
+ max-width: 1200px;
+ padding: 24px;
+}
+
+.wps-section {
+ max-width: 860px;
+}
+
+.wps-section__intro {
+ margin-block-end: 16px;
+}
+
+.wps-wrap .wps-section__title {
+ margin: 0 0 4px;
+ font-size: 18px;
+ font-weight: 600;
+}
+
+.wps-section__desc,
+.wps-section__hint {
+ margin: 0;
+ color: var(--wps-muted);
+}
+
+.wps-section__hint {
+ margin-block-start: 4px;
+ font-size: 12px;
+}
+
+/* Cards -------------------------------------------------------------- */
+
+.wps-card {
+ background: var(--wps-surface);
+ border: 1px solid var(--wps-border);
+ border-radius: var(--wps-radius);
+ box-shadow: var(--wps-shadow);
+}
+
+.wps-cards {
+ display: grid;
+ gap: 12px;
+}
+
+/* A settings tab with nothing in it yet. */
+.wps-empty {
+ padding: 16px 20px;
+ color: var(--wps-muted);
+}
+
+.wps-empty p {
+ margin: 0;
+}
+
+.wps-badge {
+ display: inline-block;
+ padding: 2px 8px;
+ font-size: 11px;
+ font-weight: 500;
+ line-height: 1.6;
+ color: var(--wps-muted);
+ vertical-align: middle;
+ background: var(--wps-subtle);
+ border: 1px solid var(--wps-border);
+ border-radius: 999px;
+}
+
+.wps-badge--success {
+ color: #00450c;
+ background: #edfaef;
+ border-color: #b8e6bf;
+}
+
+/* Setting cards ------------------------------------------------------ */
+
+/* Clip the header hover and panel backgrounds to the rounded corners. */
+.wps-setting {
+ position: relative;
+ overflow: hidden;
+}
+
+/* "On" stripe drawn above the header/panel backgrounds so hover never hides it. */
+.wps-setting::before {
+ content: "";
+ position: absolute;
+ z-index: 1;
+ inset-block: 0;
+ inset-inline-start: 0;
+ width: 3px;
+ background: var(--wps-accent);
+ opacity: 0;
+ pointer-events: none;
+ transition: opacity 0.15s ease;
+}
+
+.wps-setting.is-on::before {
+ opacity: 1;
+}
+
+.wps-setting__header {
+ display: grid;
+ grid-template-columns: auto 1fr auto;
+ align-items: center;
+ gap: 16px;
+ padding: 16px 20px;
+}
+
+.wps-setting.has-panel .wps-setting__header {
+ cursor: pointer;
+}
+
+.wps-setting.has-panel .wps-setting__header:hover {
+ background: #fcfcfc;
+}
+
+.wps-setting__text {
+ min-width: 0;
+}
+
+/* Status sits beside the title so showing/hiding it never reflows the description. */
+.wps-setting__title-row {
+ display: flex;
+ flex-wrap: wrap;
+ align-items: center;
+ gap: 4px 10px;
+ min-height: 20px;
+}
+
+.wps-setting__title {
+ font-size: 14px;
+ font-weight: 600;
+}
+
+.wps-setting__desc {
+ margin: 2px 0 0;
+ color: var(--wps-muted);
+}
+
+.wps-replaces {
+ margin: 4px 0 0;
+ font-size: 12px;
+ color: var(--wps-muted);
+}
+
+.wps-replaces__active {
+ color: #996800;
+}
+
+.wps-wrap .wps-setting__expand {
+ display: inline-flex;
+ align-items: center;
+ gap: 4px;
+ padding: 6px 8px;
+ color: var(--wps-accent);
+ text-decoration: none;
+ border-radius: 4px;
+}
+
+.wps-wrap .wps-setting__expand:hover {
+ background: var(--wps-subtle);
+}
+
+.wps-wrap .wps-setting__expand:focus-visible {
+ outline: none;
+ box-shadow: var(--wps-focus);
+}
+
+.wps-setting__expand .dashicons {
+ transition: transform 0.15s ease;
+}
+
+.wps-setting__expand[aria-expanded="true"] .dashicons {
+ transform: rotate(180deg);
+}
+
+.wps-setting__panel {
+ padding: 4px 20px 8px;
+ border-block-start: 1px solid var(--wps-border);
+ background: #fcfcfc;
+}
+
+.wps-setting__panel[hidden] {
+ display: none;
+}
+
+/* Status a feature prints above its options (wpstarter_setting_panel). */
+.wps-panel-note {
+ padding: 12px 0;
+ border-block-end: 1px solid #f0f0f1;
+ color: var(--wps-muted);
+}
+
+.wps-panel-note p {
+ margin: 0 0 6px;
+}
+
+.wps-panel-note p:last-child {
+ margin-block-end: 0;
+}
+
+.wps-panel-note--warning {
+ color: #1d2327;
+}
+
+.wps-panel-note--warning p::before {
+ content: "\f534";
+ margin-inline-end: 6px;
+ font: 16px/1 dashicons;
+ vertical-align: -3px;
+ color: #dba617;
+}
+
+.wps-media__preview {
+ flex: none;
+ width: 64px;
+ height: 64px;
+ object-fit: contain;
+ background: repeating-conic-gradient(#f0f0f1 0% 25%, #fff 0% 50%) 0 0 / 16px 16px;
+ border: 1px solid var(--wps-border);
+ border-radius: 4px;
+}
+
+.wps-code {
+ max-width: 100%;
+ margin: 6px 0 0;
+ padding: 10px 12px;
+ overflow-x: auto;
+ font-size: 12px;
+ line-height: 1.5;
+ color: #1d2327;
+ background: #f6f7f7;
+ border: 1px solid var(--wps-border);
+ border-radius: 4px;
+ white-space: pre;
+}
+
+/* Fields ------------------------------------------------------------- */
+
+.wps-field {
+ display: grid;
+ grid-template-columns: 200px 1fr;
+ gap: 8px 24px;
+ padding: 16px 0;
+}
+
+.wps-field + .wps-field {
+ border-block-start: 1px solid #f0f0f1;
+}
+
+.wps-field__label {
+ padding-block-start: 6px;
+ font-weight: 600;
+}
+
+.wps-field__control .description {
+ margin-block-start: 6px;
+}
+
+.wps-field__unit {
+ color: var(--wps-muted);
+}
+
+.wps-field__control textarea.large-text {
+ max-width: 480px;
+}
+
+.wps-media {
+ display: flex;
+ flex-wrap: wrap;
+ gap: 8px 12px;
+ align-items: center;
+}
+
+.wps-media__preview[hidden],
+.wps-media__remove[hidden] {
+ display: none;
+}
+
+.wps-checkboxes {
+ display: flex;
+ flex-wrap: wrap;
+ gap: 6px 20px;
+ margin: 0;
+ padding: 6px 0 0;
+ border: 0;
+}
+
+.wps-checkbox {
+ display: inline-flex;
+ align-items: center;
+ gap: 6px;
+}
+
+/* Long lists, such as every active plugin: columns that scroll. */
+.wps-checkboxes.is-long {
+ display: block;
+ max-height: 320px;
+ overflow-y: auto;
+ columns: 16em auto;
+ column-gap: 20px;
+ padding: 6px 8px;
+ border: 1px solid #dcdcde;
+ border-radius: 4px;
+}
+
+.wps-checkboxes.is-long .wps-checkbox {
+ display: flex;
+ align-items: flex-start;
+ margin-block-end: 6px;
+ break-inside: avoid;
+}
+
+.wps-checkboxes.is-long .wps-checkbox input {
+ margin-block-start: 2px;
+}
+
+.wps-checkboxes__all {
+ display: block;
+ margin-block-end: 4px;
+}
+
+.wps-tokens {
+ display: block;
+ margin-block-start: 6px;
+}
+
+.wps-wrap .wps-token {
+ margin: 2px 4px 2px 0;
+ padding: 0;
+ cursor: pointer;
+ background: none;
+ border: 0;
+}
+
+.wps-token code {
+ display: inline-block;
+ padding: 1px 6px;
+ font-size: 12px;
+ background: var(--wps-subtle);
+ border: 1px solid var(--wps-border);
+ border-radius: 4px;
+}
+
+.wps-token:hover code,
+.wps-token:focus-visible code {
+ color: var(--wps-accent);
+ border-color: var(--wps-accent);
+}
+
+.wps-token:focus {
+ outline: none;
+}
+
+/* Switch ------------------------------------------------------------- */
+
+.wps-switch {
+ position: relative;
+ display: inline-block;
+ flex: none;
+ width: 36px;
+ height: 20px;
+ vertical-align: middle;
+}
+
+.wps-wrap .wps-switch__input {
+ position: absolute;
+ inset: 0;
+ z-index: 1;
+ width: 100%;
+ height: 100%;
+ margin: 0;
+ cursor: pointer;
+ opacity: 0;
+}
+
+.wps-switch__track {
+ position: absolute;
+ inset: 0;
+ background: #fff;
+ border: 1px solid #1e1e1e;
+ border-radius: 999px;
+ transition: background-color 0.15s ease, border-color 0.15s ease;
+}
+
+.wps-switch__track::after {
+ content: "";
+ position: absolute;
+ inset-block-start: 3px;
+ inset-inline-start: 3px;
+ width: 12px;
+ height: 12px;
+ background: #1e1e1e;
+ border-radius: 50%;
+ transition: transform 0.15s ease, background-color 0.15s ease;
+}
+
+.wps-switch__input:checked + .wps-switch__track {
+ background: var(--wps-accent);
+ border-color: var(--wps-accent);
+}
+
+.wps-switch__input:checked + .wps-switch__track::after {
+ background: #fff;
+ transform: translateX(16px);
+}
+
+[dir="rtl"] .wps-switch__input:checked + .wps-switch__track::after {
+ transform: translateX(-16px);
+}
+
+.wps-switch__input:focus-visible + .wps-switch__track {
+ box-shadow: var(--wps-focus);
+}
+
+.wps-switch__input:disabled + .wps-switch__track {
+ opacity: 0.5;
+}
+
+/* Save status -------------------------------------------------------- */
+
+.wps-status {
+ display: inline-flex;
+ align-items: center;
+ gap: 4px;
+ min-height: 20px;
+ font-size: 12px;
+ color: var(--wps-muted);
+ white-space: nowrap;
+}
+
+.wps-field__control .wps-status {
+ margin-inline-start: 8px;
+}
+
+.wps-status.is-saving::before {
+ content: "";
+ width: 12px;
+ height: 12px;
+ border: 2px solid var(--wps-border);
+ border-block-start-color: var(--wps-accent);
+ border-radius: 50%;
+ animation: wps-spin 0.8s linear infinite;
+}
+
+.wps-status.is-saved {
+ color: var(--wps-success);
+}
+
+.wps-status.is-saved::before {
+ content: "\f147";
+ font: normal 18px/1 dashicons;
+}
+
+.wps-status.is-error {
+ color: var(--wps-error);
+ white-space: normal;
+}
+
+@keyframes wps-spin {
+ to {
+ transform: rotate(360deg);
+ }
+}
+
+/* Read Me ------------------------------------------------------------ */
+
+.wps-readme {
+ max-width: 820px;
+ padding: 24px 32px;
+ font-size: 14px;
+ line-height: 1.65;
+}
+
+.wps-readme-image {
+ margin: 0 0 16px;
+}
+
+.wps-readme-image img {
+ display: block;
+ max-width: 100%;
+ height: auto;
+ border-radius: var(--wps-radius);
+}
+
+/* The banner at the top of README.md fills the top of the card. */
+.wps-readme > .wps-readme-image:first-child {
+ margin: -24px -32px 24px;
+}
+
+.wps-readme > .wps-readme-image:first-child img {
+ width: 100%;
+ border-radius: calc(var(--wps-radius) - 1px) calc(var(--wps-radius) - 1px) 0 0;
+}
+
+.wps-wrap .wps-readme h2 {
+ margin: 0 0 8px;
+ font-size: 22px;
+}
+
+.wps-wrap .wps-readme h3 {
+ margin: 24px 0 8px;
+ padding-block-start: 16px;
+ font-size: 16px;
+ border-block-start: 1px solid #f0f0f1;
+}
+
+.wps-wrap .wps-readme h4 {
+ margin: 16px 0 6px;
+ font-size: 14px;
+}
+
+.wps-readme ul,
+.wps-readme ol {
+ margin: 8px 0 12px;
+ padding-inline-start: 22px;
+}
+
+.wps-readme ul {
+ list-style: disc;
+}
+
+.wps-readme ol {
+ list-style: decimal;
+}
+
+.wps-readme-table {
+ margin: 8px 0 16px;
+ overflow-x: auto;
+}
+
+.wps-readme table {
+ border-collapse: collapse;
+ font-size: 13px;
+ line-height: 1.5;
+}
+
+.wps-readme th,
+.wps-readme td {
+ padding: 6px 10px;
+ text-align: start;
+ vertical-align: top;
+ border: 1px solid rgba(127, 127, 127, 0.25);
+}
+
+.wps-readme th {
+ background: rgba(127, 127, 127, 0.08);
+}
+
+/* Responsive --------------------------------------------------------- */
+
+@media screen and (max-width: 782px) {
+ .wps-wrap {
+ margin-inline-start: -10px;
+ }
+
+ .wps-header,
+ .wps-main {
+ padding-inline: 12px;
+ }
+
+ .wps-nav {
+ flex-wrap: nowrap;
+ }
+
+ /* Brand and website link on the first row, search across the second. */
+ .wps-search {
+ order: 1;
+ flex: 1 1 100%;
+ min-width: 0;
+ }
+
+ .wps-search__field {
+ flex: 1 1 0;
+ min-width: 0;
+ }
+
+ .wps-wrap .wps-search__input {
+ flex: 1 1 0;
+ width: auto;
+ min-width: 0;
+ min-height: 40px;
+ font-size: 16px;
+ }
+
+ .wps-search .button {
+ flex-shrink: 0;
+ }
+
+ .wps-setting__header {
+ grid-template-columns: auto 1fr;
+ }
+
+ .wps-setting__expand {
+ grid-column: 2;
+ justify-self: start;
+ }
+
+ .wps-field {
+ grid-template-columns: 1fr;
+ }
+}
+
+@media (prefers-reduced-motion: reduce) {
+ .wps-wrap *,
+ .wps-wrap *::before,
+ .wps-wrap *::after {
+ transition: none !important;
+ animation: none !important;
+ }
+}
diff --git a/admin/data/readme.php b/admin/data/readme.php
new file mode 100644
index 0000000..80f48a1
--- /dev/null
+++ b/admin/data/readme.php
@@ -0,0 +1,30 @@
+ __('Read Me', 'wp-plugin-starter-template'),
+ 'content' => $content,
+ );
+}
diff --git a/admin/images/banner.svg b/admin/images/banner.svg
new file mode 100644
index 0000000..d76298e
--- /dev/null
+++ b/admin/images/banner.svg
@@ -0,0 +1,434 @@
+
+
+
+
diff --git a/admin/includes/class-admin-manager.php b/admin/includes/class-admin-manager.php
new file mode 100644
index 0000000..a5a890d
--- /dev/null
+++ b/admin/includes/class-admin-manager.php
@@ -0,0 +1,360 @@
+
+ */
+ public static function settings_tabs() {
+ return WPStarter_Setup::settings_tabs();
+ }
+
+ /**
+ * Registered tabs.
+ *
+ * @return array
+ */
+ public static function get_tabs() {
+ $tabs = array();
+
+ // Settings tabs without settings are hidden (they can be filled via
+ // the schema filter). With no settings at all, the first tab shows
+ // and says so, so a new plugin still has a settings screen.
+ $settings_tabs = self::settings_tabs();
+ $has_settings = false;
+ foreach (array_keys($settings_tabs) as $slug) {
+ if (WPStarter_Settings::fields_for_tab($slug)) {
+ $has_settings = true;
+ break;
+ }
+ }
+ foreach ($settings_tabs as $slug => $tab) {
+ if ($has_settings && !WPStarter_Settings::fields_for_tab($slug)) {
+ continue;
+ }
+ if (!$has_settings && $tabs) {
+ break;
+ }
+ $tabs[$slug] = array(
+ 'label' => $tab['label'],
+ 'group' => 'settings',
+ 'render' => function () use ($slug, $tab) {
+ WPStarter_Settings_Manager::render_tab($slug, $tab['label'], $tab['description']);
+ },
+ );
+ }
+
+ $tabs += array(
+ 'readme' => array(
+ 'label' => __('Read Me', 'wp-plugin-starter-template'),
+ 'group' => 'about',
+ 'render' => array('WPStarter_Readme_Manager', 'display_tab_content'),
+ ),
+ );
+
+ /**
+ * Filter the admin tabs.
+ *
+ * @param array $tabs Tabs keyed by slug: label, group (settings|discover|about),
+ * render callback, optional capability.
+ */
+ $tabs = (array) apply_filters('wpstarter_admin_tabs', $tabs);
+
+ // Hide tabs the current user cannot use.
+ return array_filter($tabs, function ($tab) {
+ return empty($tab['capability']) || current_user_can($tab['capability']);
+ });
+ }
+
+ /**
+ * Active tab slug, falling back to the first registered tab.
+ *
+ * @return string
+ */
+ public static function get_active_tab() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only navigation.
+ $tab = isset($_GET['tab']) ? sanitize_key(wp_unslash($_GET['tab'])) : '';
+ if (self::SEARCH === $tab && '' !== self::search_query()) {
+ return $tab;
+ }
+
+ $tabs = self::get_tabs();
+ $tab = WPStarter_Settings::resolve_tab($tab);
+ if (!isset($tabs[$tab])) {
+ $tab = (string) key($tabs);
+ }
+ return $tab;
+ }
+
+ /**
+ * Current settings search text.
+ *
+ * @return string
+ */
+ public static function search_query() {
+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only search.
+ $query = isset($_GET['s']) ? sanitize_text_field(wp_unslash($_GET['s'])) : '';
+ return trim(function_exists('mb_substr') ? mb_substr($query, 0, 100) : substr($query, 0, 100));
+ }
+
+ /**
+ * URL of a tab.
+ *
+ * @param string $tab Tab slug.
+ * @param array $args Extra query args.
+ * @return string
+ */
+ public static function tab_url($tab, array $args = array()) {
+ return add_query_arg(array_merge(array('page' => self::PAGE, 'tab' => $tab), $args), admin_url('options-general.php'));
+ }
+
+ /**
+ * Add the Settings link on the Plugins screen.
+ *
+ * @param array $links Action links.
+ * @return array
+ */
+ public static function plugin_action_links($links) {
+ array_unshift($links, sprintf('%s', esc_url(add_query_arg('page', self::PAGE, admin_url('options-general.php'))), esc_html__('Settings', 'wp-plugin-starter-template')));
+ return $links;
+ }
+
+ /**
+ * Register Settings → WP Plugin Starter.
+ */
+ public static function register_admin_menu() {
+ add_options_page(
+ __('WP Plugin Starter', 'wp-plugin-starter-template'),
+ __('WP Plugin Starter', 'wp-plugin-starter-template'),
+ 'manage_options',
+ self::PAGE,
+ array(__CLASS__, 'render_settings_page')
+ );
+ }
+
+ /**
+ * Enqueue the admin stylesheet and script on our screen only.
+ *
+ * @param string $hook Current admin page hook.
+ */
+ public static function enqueue_assets($hook) {
+ if (self::HOOK !== $hook) {
+ return;
+ }
+
+ $tab = self::get_active_tab();
+ $css = file_exists(WPSTARTER_DIR . 'admin/css/wpstarter-admin.css') ? filemtime(WPSTARTER_DIR . 'admin/css/wpstarter-admin.css') : WPSTARTER_VERSION;
+ $js = file_exists(WPSTARTER_DIR . 'admin/js/wpstarter-admin.js') ? filemtime(WPSTARTER_DIR . 'admin/js/wpstarter-admin.js') : WPSTARTER_VERSION;
+
+ wp_enqueue_style('wpstarter-admin', WPSTARTER_URL . 'admin/css/wpstarter-admin.css', array('dashicons'), $css);
+
+ /**
+ * Filter the admin script's dependencies; enqueue what a tab needs.
+ *
+ * @param string[] $deps Script handles.
+ * @param string $tab Active tab.
+ */
+ $deps = (array) apply_filters('wpstarter_admin_script_deps', array('jquery', 'wp-a11y', 'wp-i18n'), $tab);
+
+ if (self::shows_media_field($tab)) {
+ wp_enqueue_media();
+ }
+
+ wp_enqueue_script('wpstarter-admin', WPSTARTER_URL . 'admin/js/wpstarter-admin.js', $deps, $js, true);
+ wp_set_script_translations('wpstarter-admin', 'wp-plugin-starter-template');
+
+ /**
+ * Filter the data the admin script reads (wpstarterAdmin).
+ *
+ * @param array $data Script data.
+ * @param string $tab Active tab.
+ */
+ wp_localize_script('wpstarter-admin', 'wpstarterAdmin', (array) apply_filters('wpstarter_admin_script_data', array(
+ 'ajaxUrl' => admin_url('admin-ajax.php'),
+ 'nonce' => wp_create_nonce(WPStarter_Settings::NONCE),
+ 'tab' => $tab,
+ 'i18n' => array(
+ 'saving' => __('Saving…', 'wp-plugin-starter-template'),
+ 'saved' => __('Saved', 'wp-plugin-starter-template'),
+ 'saveFailed' => __('Could not save. Please try again.', 'wp-plugin-starter-template'),
+ 'chooseImage' => __('Choose a picture', 'wp-plugin-starter-template'),
+ 'useImage' => __('Use this picture', 'wp-plugin-starter-template'),
+ ),
+ ), $tab));
+
+ /**
+ * Fires after the admin stylesheet and script are enqueued: enqueue
+ * the plugin's own, depending on 'wpstarter-admin'.
+ *
+ * @param string $tab Active tab.
+ */
+ do_action('wpstarter_admin_enqueue', $tab);
+ }
+
+ /**
+ * Whether a tab (or the search results) may show a media field, which
+ * needs the media dialog.
+ *
+ * @param string $tab Tab slug.
+ * @return bool
+ */
+ private static function shows_media_field($tab) {
+ $schema = WPStarter_Settings::schema();
+ foreach ($schema as $field) {
+ if (!isset($field['type']) || 'media' !== $field['type']) {
+ continue;
+ }
+ if (self::SEARCH === $tab) {
+ return true;
+ }
+ $field_tab = isset($field['tab']) ? $field['tab'] : '';
+ if (!$field_tab && isset($field['parent'], $schema[$field['parent']]['tab'])) {
+ $field_tab = $schema[$field['parent']]['tab'];
+ }
+ if ($field_tab === $tab) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Render the page chrome and the active tab.
+ */
+ public static function render_settings_page() {
+ if (!current_user_can('manage_options')) {
+ return;
+ }
+
+ $tabs = self::get_tabs();
+ $active = self::get_active_tab();
+ $links = WPStarter_Setup::header_links();
+ $groups = array(
+ 'settings' => __('Settings', 'wp-plugin-starter-template'),
+ 'discover' => __('Discover', 'wp-plugin-starter-template'),
+ 'about' => __('About', 'wp-plugin-starter-template'),
+ );
+ ?>
+
+
+
+ ';
+ $list = '';
+ }
+ if ($table) {
+ $html .= ('head' === $table ? '' : '') . '
';
+ $table = '';
+ }
+ };
+
+ foreach ($lines as $line) {
+ $trim = trim($line);
+
+ if ('' === $trim || '#' === $trim) {
+ $close_list();
+ continue;
+ }
+
+ // An image on a line of its own, from the plugin's own folder.
+ if (preg_match('/^!\[([^\]]*)\]\(([^)\s]+)\)$/', $trim, $m)) {
+ $close_list();
+ $html .= self::image($m[2], $m[1]);
+ continue;
+ }
+
+ if (preg_match('/^(#{1,4})\s+(.+)$/', $trim, $m)) {
+ $close_list();
+ $level = min(4, strlen($m[1]) + 1); // h1 is reserved for the page title.
+ $html .= sprintf('
+
+
+
+
+
+
+
+ + + + : core's #wpbody already carries role="main". ?> +
+
+
+
+
+
+
+
+
+ + + + + : core's #wpbody already carries role="main". ?> +
+
+
+ %3$s |