ag::sanitize_rules(),
					array(
						'noscript' => array(),
						'iframe'   => array(
							'src'         => array(),
							'height'      => array(),
							'width'       => array(),
							'style'       => array(),
							'aria-hidden' => array(),
						),
					)
				)
			);
		} finally {
			// finally, so an exception inside the sink cannot leave the site's CSS
			// allow-list widened for the rest of the request.
			remove_filter( 'safe_style_css', array( self::class, 'allow_iframe_hiding_styles' ) );
		}
	}

	/**
	 * Adds the two declarations the noscript iframe's inline style needs to the
	 * wp_kses() CSS allow-list.
	 *
	 * Public and static only because add_filter()/remove_filter() must be handed
	 * the same callable, and WordPress invokes it from outside this class. It is
	 * NOT a hook to register anywhere: the_tag() adds it immediately before its
	 * own wp_kses() call and removes it immediately after, which is the whole
	 * point - see the comment there.
	 *
	 * @param mixed $styles The CSS property allow-list wp_kses() is about to use.
	 * @return array The allow-list plus `display` and `visibility`.
	 */
	public static function allow_iframe_hiding_styles( $styles ): array {
		$styles   = is_array( $styles ) ? $styles : array();
		$styles[] = 'display';
		$styles[] = 'visibility';

		return $styles;
	}

	/**
	 * Outputs the noscript/iframe container code right after the opening body tag.
	 *
	 * @return void
	 */
	public function body_open(): void {
		$placement = $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT );

		if ( ( GTM4WP_PLACEMENT_BODYOPEN === $placement ) || ( GTM4WP_PLACEMENT_BODYOPEN_AUTO === $placement ) ) {
			$this->the_tag();
		}
	}

	/**
	 * Inserts the GTM noscript/iframe code in the footer if code placement is set to Footer.
	 *
	 * @return void
	 */
	public function footer(): void {
		if ( GTM4WP_PLACEMENT_FOOTER === $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT ) ) {
			$this->the_tag();
		}
	}

	/**
	 * Excludes the dataLayer variable and gtm4wp* variables from being combined
	 * into the minified JS file by WP Rocket.
	 *
	 * @param array $pattern Patterns to match in inline JS content.
	 * @return array Patterns extended with the GTM4WP entries.
	 */
	public function rocket_excluded_inline_js_content( $pattern ) {
		$pattern[] = 'dataLayer';
		$pattern[] = 'gtm4wp';
		// The consent block names neither once it pushes to a custom data layer
		// name (#325, RI-34); a fixed plugin token, never the user's identifier.
		$pattern[] = ConsentDefaults::CONSENT_DEFAULT_COMMAND;

		return $pattern;
	}

	/**
	 * Returns the normalized container rows of the GTM4WP_OPTION_GTM_CONTAINERS
	 * option: one row per container with its own environment parameters,
	 * custom domain and custom path.
	 *
	 * @return array<int, array<string, string>>
	 */
	private function containers(): array {
		return ContainerRows::normalize( $this->options->get( GTM4WP_OPTION_GTM_CONTAINERS, array() ) );
	}

	/**
	 * Kill switch: decides whether the GTM container code (the <head> loader
	 * and the <noscript> iframe) may be emitted on the current request. Two
	 * independent gates can suppress it while keeping the data layer active
	 * (like placement OFF), so a cloned/staging copy of a site does not send
	 * hits to the production container without deactivating the plugin:
	 *
	 * 1. The gtm4wp_output_container filter (default true): return false from
	 *    an mu-plugin or wp-config snippet to suppress the container based on
	 *    the host name, WP_ENVIRONMENT_TYPE or any custom condition.
	 * 2. The "Only output on production environments" option: when enabled the
	 *    container is emitted only when wp_get_environment_type() is
	 *    'production' (WordPress derives it from the WP_ENVIRONMENT_TYPE
	 *    constant / environment variable, defaulting to 'production').
	 *
	 * @return bool
	 */
	private function should_output_container(): bool {
		/**
		 * Filters whether the Google Tag Manager container code is output on
		 * the current request. Return false to suppress the container <script>
		 * and the noscript iframe while keeping the data layer active - e.g.
		 * from an mu-plugin on a staging/clone copy of the site.
		 *
		 * @since 2.0.0
		 *
		 * @param bool $output_container Whether to output the container. Default true.
		 */
		if ( ! apply_filters( GTM4WP_WPFILTER_OUTPUT_CONTAINER, true ) ) {
			return false;
		}

		if ( $this->options->get( GTM4WP_OPTION_PRODUCTIONONLY ) ) {
			// wp_get_environment_type() ships with WordPress 5.5+; the guard
			// keeps the unit tests (which never load WordPress) working.
			$environment = function_exists( 'wp_get_environment_type' ) ? wp_get_environment_type() : 'production';

			if ( 'production' !== $environment ) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Returns the first role of the current user that the "Exclude user roles"
	 * option turns the container code off for, or an empty string when the
	 * container may be emitted for this user.
	 *
	 * Both container sinks ask this - the <head> loader in header_begin() and
	 * the <noscript> iframe in get_tag() - so an excluded role suppresses the
	 * whole container. The check used to live inline in header_begin() only,
	 * which left the iframe (the very fallback that loads GTM when JavaScript
	 * does not run) firing for an excluded user.
	 *
	 * @return string The matching excluded role, or '' when none matches.
	 */
	private function excluded_user_role(): string {
		$disabled_roles = explode( ',', (string) $this->options->get( GTM4WP_OPTION_NOGTMFORLOGGEDIN ) );
		$current_user   = wp_get_current_user();

		foreach ( (array) ( $current_user->roles ?? array() ) as $user_role ) {
			if ( in_array( $user_role, $disabled_roles, true ) ) {
				return (string) $user_role;
			}
		}

		return '';
	}

	/**
	 * Returns the environment query string fragment of one container row,
	 * empty unless both the gtm_auth and gtm_preview parameters are set.
	 *
	 * @param array<string, string> $container One container row.
	 * @return string
	 */
	private function container_environment( array $container ): string {
		$gtm_auth    = (string) ( $container[ ContainerRows::COLUMN_AUTH ] ?? '' );
		$gtm_preview = (string) ( $container[ ContainerRows::COLUMN_PREVIEW ] ?? '' );

		if ( ( '' === $gtm_auth ) || ( '' === $gtm_preview ) ) {
			return '';
		}

		// Re-validate at the output sink (PA-2), not just on save: these values
		// also reach the row from a 1.x migration and from the
		// GTM4WP_HARDCODED_GTM_ENV_* wp-config constants, neither of which went
		// through the admin schema sanitizer. A stray & would otherwise inject
		// extra query parameters into the container loader URL and the noscript
		// iframe src. Malformed values are dropped whole (both parameters are
		// meaningless alone) - Notices warns the admin so this is never silent.
		if ( ! preg_match( ContainerRows::AUTH_PATTERN, $gtm_auth )
			|| ! preg_match( ContainerRows::PREVIEW_PATTERN, $gtm_preview )
		) {
			return '';
		}

		return '&gtm_auth=' . esc_attr( $gtm_auth ) . '&gtm_preview=' . esc_attr( $gtm_preview ) . '&gtm_cookies_win=x';
	}

	/**
	 * Tells whether the GTM container ID must be left out of the container
	 * loader URL of one container row.
	 *
	 * This is only honored together with a custom loader path: it targets
	 * server side GTM setups where the container is selected by the request
	 * path/domain and the ID is configured on the server. Without a custom
	 * path the checkbox has no effect, so the default www.googletagmanager.com
	 * loader never ends up without an ID.
	 *
	 * @param array<string, string> $container One container row.
	 * @return bool
	 */
	private function container_omit_id( array $container ): bool {
		$no_id       = '' !== (string) ( $container[ ContainerRows::COLUMN_NO_ID ] ?? '' );
		$custom_path = '' !== (string) ( $container[ ContainerRows::COLUMN_PATH ] ?? '' );

		return $no_id && $custom_path;
	}

	/**
	 * Returns the validated GTM container domain of one container row,
	 * falling back to the default Google domain on invalid custom values.
	 *
	 * @param array<string, string> $container One container row.
	 * @return string
	 */
	private function container_domain( array $container ): string {
		$custom_domain    = (string) ( $container[ ContainerRows::COLUMN_DOMAIN ] ?? '' );
		$_gtm_domain_test = ( '' === $custom_domain ) ? 'www.googletagmanager.com' : strtolower( $custom_domain );
		$_gtm_domain_name = filter_var( $_gtm_domain_test, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME );

		if ( false === $_gtm_domain_name ) {
			return 'www.googletagmanager.com';
		}

		return $_gtm_domain_name;
	}

	/**
	 * Returns the validated GTM container script path of one container row,
	 * falling back to gtm.js on invalid custom values.
	 *
	 * @param array<string, string> $container One container row.
	 * @return string
	 */
	private function container_path( array $container ): string {
		$custom_path      = (string) ( $container[ ContainerRows::COLUMN_PATH ] ?? '' );
		$_gtm_domain_path = ( '' === $custom_path ) ? 'gtm.js' : $custom_path;

		// Use the shared constant rather than a retyped copy: this allow-list is
		// security relevant, and the inline duplicate had already drifted from it.
		if ( ! preg_match( ContainerRows::PATH_PATTERN, $_gtm_domain_path ) ) {
			return 'gtm.js';
		}

		return $_gtm_domain_path;
	}
}