ay,
		 * deliberately, and the reason is recorded here so the next re-derivation of
		 * that ledger finds an answer rather than re-deciding:
		 *
		 * - json_literal() emits DOUBLE quotes. This block is Google's own container
		 *   snippet reproduced byte for byte (single quotes throughout, matching 1.x
		 *   and every copy of it Google publishes), and BE-1 keeps byte-exact tests
		 *   over it. Migrating would change the emitted snippet for every site to buy
		 *   nothing.
		 * - Nothing is being reasoned about here on the basis of what the values
		 *   "happen to" contain - which is the filing #110 ruled out. Each of the four
		 *   passes an enforced allow-list on the way to this line, and none of those
		 *   allow-lists admits a quote: the container ID via ContainerRows::GTM_ID_PATTERN
		 *   in header_begin() before this method is called, the domain via
		 *   FILTER_VALIDATE_DOMAIN in container_domain(), the path via
		 *   ContainerRows::PATH_PATTERN in container_path(), and the data layer name via
		 *   ContainerRows::datalayer_name() at the reader. esc_js() is therefore a
		 *   provable no-op on all four, and the allow-lists are the actual control.
		 *
		 * If any of those four allow-lists is ever widened to admit a quote, this
		 * block has to move to json_literal() and the byte-exact tests updated with it.
		 */
		return '
' . $this->script_tag->opening_tag() . '
(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({\'gtm.start\':
new Date().getTime(),event:\'gtm.js\'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!=\'dataLayer\'?\'&l=\'+l:\'\';j.async=true;j.src=
\'//' . esc_js( $this->container_domain( $one_container ) ) . '/' . esc_js( $this->container_path( $one_container ) ) . $_gtm_loader_query .
			( '' !== $_gtm_env ? "+'" . $_gtm_env . "'" : '' ) . ';f.parentNode.insertBefore(j,f);
})(window,document,\'script\',\'' . esc_js( $datalayer_name ) . '\',\'' . esc_js( $one_gtm_id ) . '\');
</script>';
	}

	/**
	 * Returns a HTML code that includes the noscript/iframe part of the Google Tag Manager container.
	 * Can be used to manually place the snippet next to the opening body tag if the installed template
	 * does not support the wp_body_open hook.
	 *
	 * @return string The HTML code that includes the noscript/iframe part of the GTM container code.
	 */
	public function get_tag(): string {
		$no_console_log = (bool) $this->options->get( GTM4WP_OPTION_NOCONSOLELOG );
		$containers     = $this->containers();
		$excluded_role  = $this->excluded_user_role();

		$_gtm_tag = '
<!-- GTM Container placement set to ' . esc_html( $this->placement_string() ) . ' -->
<!-- Google Tag Manager (noscript) -->';

		if ( GTM4WP_PLACEMENT_OFF === $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT ) ) {
			// Placement OFF means the container code (both the head loader and
			// this noscript iframe) is never auto-emitted; only the data layer
			// stays active. Mark the code as "written" regardless of the
			// console-log setting so the iframe block below is always skipped -
			// otherwise, with console logging disabled, the iframe would still
			// be output despite the OFF placement.
			$GLOBALS['gtm4wp_container_code_written'] = true;

			if ( ! $no_console_log ) {
				$_gtm_tag .= '
' . $this->script_tag->opening_tag() . '
	console.warn && console.warn("[GTM4WP] Google Tag Manager container code placement set to OFF !!!");
	console.warn && console.warn("[GTM4WP] Data layer codes are active but GTM container must be loaded using custom coding !!!");
</script>';
			}
		} elseif ( ! $this->should_output_container() ) {
			// Kill switch (production-only option / gtm4wp_output_container
			// filter): suppress the noscript iframe exactly like placement OFF -
			// mark the code as "written" so the iframe block below is skipped
			// while the data layer stays active.
			$GLOBALS['gtm4wp_container_code_written'] = true;

			if ( ! $no_console_log ) {
				$_gtm_tag .= $this->container_suppressed_warning();
			}
		} elseif ( '' !== $excluded_role ) {
			// The user-role exclusion suppresses the <head> container loader in
			// header_begin(); this iframe is the same container by another route,
			// so it has to go with it. It used to be emitted regardless, which
			// meant an excluded user still loaded the container (and was counted
			// in the reports) whenever JavaScript was unavailable - the exact
			// case the noscript iframe exists for. Mark the code as "written" so
			// the iframe block below is skipped, exactly like placement OFF and
			// the kill switch above; the data layer stays active.
			$GLOBALS['gtm4wp_container_code_written'] = true;

			if ( ! $no_console_log ) {
				$_gtm_tag .= $this->disabled_role_warning( $excluded_role );
			}
		}

		if ( ( array() !== $containers ) && ( ! ( $GLOBALS['gtm4wp_container_code_written'] ?? false ) ) ) {
			foreach ( $containers as $one_container ) {
				$one_gtm_id = (string) ( $one_container[ ContainerRows::COLUMN_ID ] ?? '' );

				// esc_attr() per PART below, at the point of injection (#225). Each part
				// is already allow-list validated - the id by the pattern one line down,
				// the domain by container_domain()'s FILTER_VALIDATE_DOMAIN fallback, the
				// environment values inside container_environment() - so esc_attr() is
				// the identity function on everything the validators pass today and
				// exists for the day a pattern is widened. NOT esc_attr()/esc_url() over
				// the whole src: the environment fragment joins with raw '&' on purpose
				// (wp_kses encodes it to &amp; at output, the 1.x byte form), and
				// gtm4wp_get_the_gtm_tag() returns this string as public 1.x API -
				// pre-encoding it would change those bytes and hand third-party
				// consumers an already-escaped value to double-escape (RI-4).
				if ( preg_match( ContainerRows::GTM_ID_PATTERN, $one_gtm_id ) ) {
					$_gtm_tag .= '
				<noscript><iframe src="https://' . esc_attr( $this->container_domain( $one_container ) ) . '/ns.html?id=' . esc_attr( $one_gtm_id ) . $this->container_environment( $one_container ) . '"
				height="0" width="0" style="display:none;visibility:hidden" aria-hidden="true"></iframe></noscript>';
				}
			}

			$_gtm_tag .= '
<!-- End Google Tag Manager (noscript) -->';

			$GLOBALS['gtm4wp_container_code_written'] = true;
		}

		return $_gtm_tag;
	}

	/**
	 * Outputs a HTML code that includes the noscript/iframe part of the Google Tag Manager container.
	 *
	 * @return void
	 */
	public function the_tag(): void {
		// The iframe's inline style needs `display` and `visibility`. Whether
		// safecss_filter_attr() strips those depends on the WordPress version:
		// core added `display` to the safe_style_css default list in 7.0 and
		// `visibility` in 7.1, so on 6.3-6.9 both are stripped and on 7.0
		// `visibility` still is. While the floor is 6.3 this filter is
		// load-bearing, not belt-and-braces - drop it only in the change that
		// raises the floor past 7.1, never as a "core allows it now" cleanup.
		//
		// Widen the CSS allow-list around THIS wp_kses() call only, then put it back:
		// safe_style_css is a global WordPress control, so a filter left
		// registered would relax it for every other wp_kses()/wp_kses_post() call
		// in the same request - including wp_filter_post_kses on content saved by
		// users without unfiltered_html, and a REST save is not is_admin(). One
		// line of our own markup is not a reason to loosen the rule site-wide.
		add_filter( 'safe_style_css', array( self::class, 'allow_iframe_hiding_styles' ) );

		try {
			// print_markup_block(), not a bare wp_kses(): this block mixes the noscript
			// iframe (whose src must keep its &amp; entity form) with the console
			// warning <script> blocks that get_tag() prepends for placement OFF, the
			// kill switch and an excluded user role. wp_kses() encodes every bare
			// ampersand, so a raw echo shipped `console.warn &amp;&amp; console.warn(…)`
			// - a SyntaxError that took out the whole warning block. Only script bodies
			// get the ampersand back; the attribute is left alone.
			$this->script_tag->print_markup_block(
				$this->get_tag(),
				array_merge(
					ScriptTag::sanitize_rules(),
					array(
						'noscript' => array(),
						'iframe'   => array(
							'src'         => array(),
							'height'      => array(),
							'width'       => array(),
							'style'       => array(),
							'aria-hidden' => array(),
						),
					)
				)
			);
		} finally {
			// finally, so an exception inside the sink cannot leave the site's CSS
			// allow-list widened for the rest of the request.
			remove_filter( 'safe_style_css', array( self::class, 'allow_iframe_hiding_styles' ) );
		}
	}

	/**
	 * Adds the two declarations the noscript iframe's inline style needs to the
	 * wp_kses() CSS allow-list.
	 *
	 * Public and static only because add_filter()/remove_filter() must be handed
	 * the same callable, and WordPress invokes it from outside this class. It is
	 * NOT a hook to register anywhere: the_tag() adds it immediately before its
	 * own wp_kses() call and removes it immediately after, which is the whole
	 * point - see the comment there.
	 *
	 * @param mixed $styles The CSS property allow-list wp_kses() is about to use.
	 * @return array The allow-list plus `display` and `visibility`.
	 */
	public static function allow_iframe_hiding_styles( $styles ): array {
		$styles   = is_array( $styles ) ? $styles : array();
		$styles[] = 'display';
		$styles[] = 'visibility';

		return $styles;
	}

	/**
	 * Outputs the noscript/iframe container code right after the opening body tag.
	 *
	 * @return void
	 */
	public function body_open(): void {
		$placement = $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT );

		if ( ( GTM4WP_PLACEMENT_BODYOPEN === $placement ) || ( GTM4WP_PLACEMENT_BODYOPEN_AUTO === $placement ) ) {
			$this->the_tag();
		}
	}

	/**
	 * Inserts the GTM noscript/iframe code in the footer if code placement is set to Footer.
	 *
	 * @return void
	 */
	public function footer(): void {
		if ( GTM4WP_PLACEMENT_FOOTER === $this->options->get( GTM4WP_OPTION_GTM_PLACEMENT ) ) {
			$this->the_tag();
		}
	}

	/**
	 * Excludes the dataLayer variable and gtm4wp* variables from being combined
	 * into the minified JS file by WP Rocket.
	 *
	 * @param array $pattern Patterns to match in inline JS content.
	 * @return array Patterns extended with the GTM4WP entries.
	 */
	public function rocket_excluded_inline_js_content( $pattern ) {
		$pattern[] = 'dataLayer';
		$pattern[] = 'gtm4wp';
		// The consent block names neither once it pushes to a custom data layer
		// name (#325, RI-34); a fixed plugin token, never the user's identifier.
		$pattern[] = ConsentDefaults::CONSENT_DEFAULT_COMMAND;

		return $pattern;
	}

	/**
	 * Returns the normalized container rows of the GTM4WP_OPTION_GTM_CONTAINERS
	 * option: one row per container with its own environment parameters,
	 * custom domain and custom path.
	 *
	 * @return array<int, array<string, string>>
	 */
	private function containers(): array {
		return ContainerRows::normalize( $this->options->get( GTM4WP_OPTION_GTM_CONTAINERS, array() ) );
	}

	/**
	 * Kill switch: decides whether the GTM container code (the <head> loader
	 * and the <noscript> iframe) may be emitted on the current request. Two
	 * independent gates can suppress it while keeping the data layer active
	 * (like placement OFF), so a cloned/staging copy of a site does not send
	 * hits to the production container without deactivating the plugin:
	 *
	 * 1. The gtm4wp_output_container filter (default true): return false from
	 *    an mu-plugin or wp-config snippet to suppress the container based on
	 *    the host name, WP_ENVIRONMENT_TYPE or any custom condition.
	 * 2. The "Only output on production environments" option: when enabled the
	 *    container is emitted only when wp_get_environment_type() is
	 *    'production' (WordPress derives it from the WP_ENVIRONMENT_TYPE
	 *    constant / environment variable, defaulting to 'production').
	 *
	 * @return bool
	 */
	private function should_output_container(): bool {
		/**
		 * Filters whether the Google Tag Manager container code is output on
		 * the current request. Return false to suppress the container <script>
		 * and the noscript iframe while keeping the data layer active - e.g.
		 * from an mu-plugin on a staging/clone copy of the site.
		 *
		 * @since 2.0.0
		 *
		 * @param bool $output_container Whether to output the container. Default true.
		 */
		if ( ! apply_filters( GTM4WP_WPFILTER_OUTPUT_CONTAINER, true ) ) {
			return false;
		}

		if ( $this->options->get( GTM4WP_OPTION_PRODUCTIONONLY ) ) {
			// wp_get_environment_type() ships with WordPress 5.5+; the guard
			// keeps the unit tests (which never load WordPress) working.
			$environment = function_exists( 'wp_get_environment_type' ) ? wp_get_environment_type() : 'production';

			if ( 'production' !== $environment ) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Returns the first role of the current user that the "Exclude user roles"
	 * option turns the container code off for, or an empty string when the
	 * container may be emitted for this user.
	 *
	 * Both container sinks ask this - the <head> loader in header_begin() and
	 * the <noscript> iframe in get_tag() - so an excluded role suppresses the
	 * whole container. The check used to live inline in header_begin() only,
	 * which left the iframe (the very fallback that loads GTM when JavaScript
	 * does not run) firing for an excluded user.
	 *
	 * @return string The matching excluded role, or '' when none matches.
	 */
	private function excluded_user_role(): string {
		$disabled_roles = explode( ',', (string) $this->options->get( GTM4WP_OPTION_NOGTMFORLOGGEDIN ) );
		$current_user   = wp_get_current_user();

		foreach ( (array) ( $current_user->roles ?? array() ) as $user_role ) {
			if ( in_array( $user_role, $disabled_roles, true ) ) {
				return (string) $user_role;
			}
		}

		return '';
	}

	/**
	 * Returns the environment query string fragment of one container row,
	 * empty unless both the gtm_auth and gtm_preview parameters are set.
	 *
	 * @param array<string, string> $container One container row.
	 * @return string
	 */
	private function container_environment( array $container ): string {
		$gtm_auth    = (string) ( $container[ ContainerRows::COLUMN_AUTH ] ?? '' );
		$gtm_preview = (string) ( $container[ ContainerRows::COLUMN_PREVIEW ] ?? '' );

		if ( ( '' === $gtm_auth ) || ( '' === $gtm_preview ) ) {
			return '';
		}

		// Re-validate at the output sink (PA-2), not just on save: these values
		// also reach the row from a 1.x migration and from the
		// GTM4WP_HARDCODED_GTM_ENV_* wp-config constants, neither of which went
		// through the admin schema sanitizer. A stray & would otherwise inject
		// extra query parameters into the container loader URL and the noscript
		// iframe src. Malformed values are dropped whole (both parameters are
		// meaningless alone) - Notices warns the admin so this is never silent.
		if ( ! preg_match( ContainerRows::AUTH_PATTERN, $gtm_auth )
			|| ! preg_match( ContainerRows::PREVIEW_PATTERN, $gtm_preview )
		) {
			return '';
		}

		return '&gtm_auth=' . esc_attr( $gtm_auth ) . '&gtm_preview=' . esc_attr( $gtm_preview ) . '&gtm_cookies_win=x';
	}

	/**
	 * Tells whether the GTM container ID must be left out of the container
	 * loader URL of one container row.
	 *
	 * This is only honored together with a custom loader path: it targets
	 * server side GTM setups where the container is selected by the request
	 * path/domain and the ID is configured on the server. Without a custom
	 * path the checkbox has no effect, so the default www.googletagmanager.com
	 * loader never ends up without an ID.
	 *
	 * @param array<string, string> $container One container row.
	 * @return bool
	 */
	private function container_omit_id( array $container ): bool {
		$no_id       = '' !== (string) ( $container[ ContainerRows::COLUMN_NO_ID ] ?? '' );
		$custom_path = '' !== (string) ( $container[ ContainerRows::COLUMN_PATH ] ?? '' );

		return $no_id && $custom_path;
	}

	/**
	 * Returns the validated GTM container domain of one container row,
	 * falling back to the default Google domain on invalid custom values.
	 *
	 * @param array<string, string> $container One container row.
	 * @return string
	 */
	private function container_domain( array $container ): string {
		$custom_domain    = (string) ( $container[ ContainerRows::COLUMN_DOMAIN ] ?? '' );
		$_gtm_domain_test = ( '' === $custom_domain ) ? 'www.googletagmanager.com' : strtolower( $custom_domain );
		$_gtm_domain_name = filter_var( $_gtm_domain_test, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME );

		if ( false === $_gtm_domain_name ) {
			return 'www.googletagmanager.com';
		}

		return $_gtm_domain_name;
	}

	/**
	 * Returns the validated GTM container script path of one container row,
	 * falling back to gtm.js on invalid custom values.
	 *
	 * @param array<string, string> $container One container row.
	 * @return string
	 */
	private function container_path( array $container ): string {
		$custom_path      = (string) ( $container[ ContainerRows::COLUMN_PATH ] ?? '' );
		$_gtm_domain_path = ( '' === $custom_path ) ? 'gtm.js' : $custom_path;

		// Use the shared constant rather than a retyped copy: this allow-list is
		// security relevant, and the inline duplicate had already drifted from it.
		if ( ! preg_match( ContainerRows::PATH_PATTERN, $_gtm_domain_path ) ) {
			return 'gtm.js';
		}

		return $_gtm_domain_path;
	}
}