<?php
declare(strict_types=1);

define('RS_RUNTIME_SETTINGS_ALLOWED', true);
require_once __DIR__ . '/_runtime-settings.php';

$funnelKey = rs_runtime_string($_GET['funnel'] ?? '', 64);
if (!preg_match('/^[a-z0-9_-]{1,64}$/', $funnelKey)) {
    $funnelKey = '';
}

$settings = rs_runtime_read_settings();
$funnels = is_array($settings['funnels'] ?? null) ? $settings['funnels'] : [];
$knownFunnel = $funnelKey !== '' && is_array($funnels[$funnelKey] ?? null);
$meta = $knownFunnel ? rs_runtime_meta_config(false, $funnelKey) : rs_runtime_default_meta_settings();
$enabled = (bool) ($meta['enabled'] ?? false) && !rs_runtime_is_placeholder((string) ($meta['pixel_id'] ?? ''));
$pixelId = $enabled ? (string) $meta['pixel_id'] : '';

header('Content-Type: application/javascript; charset=utf-8');
header('Cache-Control: no-store, max-age=0');

if (!$enabled) {
    echo "window.__rsMeta={enabled:false,pixelId:'',funnel:null,pageViewEventId:null};\n";
    exit;
}

// One shared event id per page load for the PageView event. meta-track.js
// initializes the browser pixel and sends the matching CAPI event only after
// CookieYes has granted the advertisement category.
$pageViewEventId = bin2hex(random_bytes(16));

// The browser only receives its public configuration. The CAPI token and test
// event code stay server-side and are never emitted into the page.
$pixelJson = json_encode($pixelId, JSON_UNESCAPED_SLASHES);
$funnelJson = json_encode($funnelKey, JSON_UNESCAPED_SLASHES);
$pageViewIdJson = json_encode($pageViewEventId, JSON_UNESCAPED_SLASHES);
?>
window.__rsMeta={enabled:true,pixelId:<?= $pixelJson ?>,funnel:<?= $funnelJson ?>,pageViewEventId:<?= $pageViewIdJson ?>};