<?php

declare(strict_types=1);

function e(string $value): string
{
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

function ngixExtractSubId(string $requestUri): ?string
{
    $path = (string) parse_url($requestUri, PHP_URL_PATH);

    if ($path === '' || $path === '/') {
        return null;
    }

    $segments = explode('/', trim($path, '/'));

    if (count($segments) !== 1 || $segments[0] === '') {
        return null;
    }

    $subId = rawurldecode($segments[0]);

    if (preg_match('/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/', $subId) !== 1) {
        return null;
    }

    return $subId;
}

function ngixNormalizeRedirectHost(string $host): ?string
{
    $host = strtolower(trim($host));

    if ($host === '' || str_contains($host, '@')) {
        return null;
    }

    $host = preg_replace('/:\\d+$/', '', $host);

    if (!is_string($host) || $host === '') {
        return null;
    }

    if (str_starts_with($host, 'www.')) {
        $host = substr($host, 4);
    }

    if (str_starts_with($host, 'gen.')) {
        return null;
    }

    if (preg_match('/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}$/', $host) !== 1) {
        return null;
    }

    return $host;
}

function request_path(): string
{
    $uri = (string) ($_SERVER['REQUEST_URI'] ?? '/');
    $path = parse_url($uri, PHP_URL_PATH);

    if (!is_string($path) || $path === '') {
        return '/';
    }

    return $path;
}

function is_https_request(): bool
{
    $https = strtolower((string) ($_SERVER['HTTPS'] ?? ''));
    $forwardedProto = strtolower((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? ''));
    $cfVisitor = (string) ($_SERVER['HTTP_CF_VISITOR'] ?? '');

    return $https === 'on'
        || $https === '1'
        || $forwardedProto === 'https'
        || str_contains($cfVisitor, '"scheme":"https"');
}

function safe_host(): string
{
    $host = strtolower((string) ($_SERVER['HTTP_HOST'] ?? 'localhost'));
    $host = preg_replace('/:\\d+\\z/', '', $host) ?? 'localhost';
    $host = trim($host, '.');

    if ($host === '' || !preg_match('/\\A[a-z0-9.-]{1,253}\\z/', $host)) {
        return 'localhost';
    }

    return $host;
}

function login_url(): string
{
    $scheme = is_https_request() ? 'https' : 'http';
    $host = safe_host();

    $host = preg_replace('/\\Awww\\./i', '', $host) ?? $host;
    $host = preg_replace('/\\Agen\\./i', '', $host) ?? $host;

    return $scheme . '://gen.' . $host . '/';
}

function canonical_url(): string
{
    $scheme = is_https_request() ? 'https' : 'http';

    return $scheme . '://' . safe_host() . '/';
}

function start_secure_session(bool $https): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }

    session_set_cookie_params([
        'lifetime' => 0,
        'path' => '/',
        'domain' => '',
        'secure' => $https,
        'httponly' => true,
        'samesite' => 'Strict',
    ]);

    session_start();
}

function csrf_token(): string
{
    if (!isset($_SESSION['csrf_token']) || !is_string($_SESSION['csrf_token']) || strlen($_SESSION['csrf_token']) !== 64) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }

    return $_SESSION['csrf_token'];
}

function post_string(string $key, int $maxLength): string
{
    $value = $_POST[$key] ?? '';

    if (!is_string($value)) {
        return '';
    }

    $value = trim($value);

    if (mb_strlen($value, 'UTF-8') > $maxLength) {
        return mb_substr($value, 0, $maxLength, 'UTF-8');
    }

    return $value;
}

/**
 * @return array{type: string, message: string}
 */
function support_form_result(): array
{
    if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') {
        return ['type' => '', 'message' => ''];
    }

    $intent = $_POST['intent'] ?? '';
    if ($intent !== 'support_contact') {
        return ['type' => 'error', 'message' => 'Invalid form intent.'];
    }

    $token = $_POST['csrf_token'] ?? '';
    if (!is_string($token) || !hash_equals((string) ($_SESSION['csrf_token'] ?? ''), $token)) {
        return ['type' => 'error', 'message' => 'Invalid security token. Refresh the page and retry.'];
    }

    $name = post_string('name', 80);
    $email = post_string('email', 160);
    $message = post_string('message', 800);

    if ($name === '' || $email === '' || $message === '') {
        return ['type' => 'error', 'message' => 'Name, email, and message are required.'];
    }

    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        return ['type' => 'error', 'message' => 'Invalid email address.'];
    }

    return ['type' => 'success', 'message' => 'Support message accepted. Your browser submitted the secured contact form.'];
}

try {
    $nonce = bin2hex(random_bytes(16));
} catch (Throwable $e) {
    http_response_code(500);
    header('Content-Type: text/plain; charset=UTF-8');
    header('X-Content-Type-Options: nosniff');
    echo 'Internal Server Error';
    exit;
}

$subId = ngixExtractSubId((string) ($_SERVER['REQUEST_URI'] ?? ''));
$redirectHost = ngixNormalizeRedirectHost((string) ($_SERVER['HTTP_HOST'] ?? ''));

if ($subId !== null && $redirectHost !== null) {
    header('X-Content-Type-Options: nosniff');
    header('Referrer-Policy: same-origin');
    header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
    header('Pragma: no-cache');
    header('Location: https://gen.' . $redirectHost . '/' . rawurlencode($subId), true, 302);
    exit;
}

$isHttps = is_https_request();
start_secure_session($isHttps);
$csrfToken = csrf_token();
$supportResult = support_form_result();

$path = request_path();
$isWrongPath = !in_array($path, ['/', '/index.php'], true);
$statusCode = $isWrongPath ? 404 : 200;
$brandName = 'NGIX|XCTD';
$pageTitle = $isWrongPath ? '404 - Wrong URL' : 'NGIX';
$canonical = canonical_url();
$year = date('Y');

http_response_code($statusCode);
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Referrer-Policy: same-origin');
header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()');
header('Cross-Origin-Opener-Policy: same-origin');
header('Cross-Origin-Resource-Policy: same-origin');
header('X-Robots-Tag: ' . ($isWrongPath ? 'noindex, nofollow, noarchive' : 'index, follow'));
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');
header('Vary: Accept');

if ($isHttps) {
    header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
}

$csp = [
    "default-src 'self'",
    "base-uri 'self'",
    "form-action 'self'",
    "frame-ancestors 'self'",
    "object-src 'none'",
    "img-src 'self' data:",
    "font-src 'self' data:",
    "style-src 'self' 'nonce-{$nonce}'",
    "script-src 'self' 'nonce-{$nonce}'",
    "connect-src 'self'",
    'upgrade-insecure-requests',
];
header('Content-Security-Policy: ' . implode('; ', $csp));

header('Link: </.well-known/api-catalog>; rel="api-catalog"', false);
header('Link: </auth.md>; rel="service-doc"', false);
header('Link: </health.php>; rel="status"', false);
header('Link: </privacy.html>; rel="privacy-policy"', false);
header('Link: </terms.html>; rel="terms-of-service"', false);
header('Link: </abuse.html>; rel="abuse-report"', false);
header('Link: </sitemap.xml>; rel="sitemap"', false);
header('Link: </robots.txt>; rel="robots"', false);
header('Link: </.well-known/agent-skills/index.json>; rel="https://agentskills.io/schema/v0.2.0/index.json"', false);
header('Link: </.well-known/mcp/server-card.json>; rel="https://modelcontextprotocol.io/server-card"', false);

$acceptHeader = $_SERVER['HTTP_ACCEPT'] ?? '';
$accept = is_string($acceptHeader) ? $acceptHeader : '';

if (str_contains($accept, 'text/markdown')) {
    header('Content-Type: text/markdown; charset=UTF-8');
    echo "# NGIX|XCTD\n\n";
    echo "Static Gateway / Faded Inverse\n\n";
    echo "## Discovery\n\n";
    echo "- [Home](/)\n";
    echo "- [Privacy Policy](/privacy.html)\n";
    echo "- [Terms of Service](/terms.html)\n";
    echo "- [Abuse Reporting](/abuse.html)\n";
    echo "- [Sitemap](/sitemap.xml)\n";
    echo "- [Robots](/robots.txt)\n";
    echo "- [API Catalog](/.well-known/api-catalog)\n";
    echo "- [API Authentication](/auth.md)\n";
    echo "- [Health Check](/health.php)\n";
    echo "- [Agent Skills](/.well-known/agent-skills/index.json)\n";
    echo "- [MCP Server Card](/.well-known/mcp/server-card.json)\n";
    exit;
}

header('Content-Type: text/html; charset=UTF-8');

$schema = [
    '@context' => 'https://schema.org',
    '@type' => 'WebPage',
    'name' => $brandName,
    'url' => $canonical,
    'description' => 'Secure static gateway welcome page for authenticated workspace access.',
    'inLanguage' => 'en',
];
$schemaJson = json_encode(
    $schema,
    JSON_UNESCAPED_SLASHES
    | JSON_UNESCAPED_UNICODE
    | JSON_HEX_TAG
    | JSON_HEX_AMP
    | JSON_HEX_APOS
    | JSON_HEX_QUOT
    | JSON_THROW_ON_ERROR,
);
?>
<!doctype html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title><?= e($pageTitle); ?></title>
    <meta name="description" content="Secure static gateway welcome page for authenticated workspace access.">
    <meta name="robots" content="<?= $isWrongPath ? 'noindex,nofollow,noarchive' : 'index,follow'; ?>">
    <link rel="canonical" href="<?= e($canonical); ?>">
    <link rel="icon" href="/favicon.ico" sizes="any">
    <link rel="apple-touch-icon" href="/assets/apple-touch-icon.png">
    <meta name="theme-color" content="#ff5a0a">
    <style nonce="<?= e($nonce); ?>">
        :root{--bg:#fffaf6;--surface:rgba(255,255,255,.86);--surface-strong:#fff;--text:#171717;--muted:#575757;--soft:#fff0e7;--line:rgba(255,90,10,.18);--orange:#ff5a0a;--orange-2:#f24b00;--shadow:0 1.25rem 3.5rem rgba(28,18,11,.11);--radius:.3rem;--max:74rem;--font-cursive:cursive;--font-mono:monospace}
*{box-sizing:border-box}
html{width:100%;height:100%;overflow:hidden;background:var(--bg);color:var(--text);text-size-adjust:100%}
body{width:100%;height:100dvh;min-height:100svh;margin:0;overflow:hidden;font-family:var(--font-cursive);background:radial-gradient(circle at 50% 9%,rgb(255 90 10/.1),transparent 22rem),linear-gradient(180deg,#fff 0%,#fffaf6 54%,#fff6ee 100%)}
body::before,body::after{position:fixed;z-index:0;pointer-events:none;content:"";border-radius:999rem}
body::before{width:18rem;height:18rem;left:-7rem;top:8rem;background:rgb(255 90 10/.08);filter:blur(.25rem)}
body::after{width:15rem;height:15rem;right:-6rem;top:18rem;background:rgb(255 190 123/.14);filter:blur(.25rem)}
a,button,input,textarea,select{-webkit-tap-highlight-color:#fff0}
body,.page,.topbar,.hero,.shell,.hero-inner,.copy,.actions,.legal-details,.support-card,.footer-copy{user-select:none;-webkit-user-select:none}
input,textarea,select{user-select:text;-webkit-user-select:text}
::selection{background:#fff0;color:inherit}
input::selection,textarea::selection{background:rgb(255 90 10/.22);color:inherit}
a{color:inherit;text-decoration:none}
img{user-select:none;-webkit-user-select:none;-webkit-user-drag:none;-webkit-touch-callout:none}
.page{position:relative;z-index:1;display:flex;width:100%;height:100dvh;min-height:100svh;flex-direction:column;overflow:hidden}
.topbar{display:flex;flex:0 0 auto;align-items:center;justify-content:space-between;width:min(100%,var(--max));margin:0 auto;padding:clamp(.72rem,1.8dvh,1.05rem) clamp(1rem,4vw,2rem)}
.brand{display:inline-flex;font-family:var(--font-cursive);align-items:center;gap:.65rem;font-size:clamp(.72rem,1.45dvh,.86rem);font-weight:850;letter-spacing:.01em}
.brand-mark{display:grid;width:2.35rem;height:2.35rem;place-items:center;border:1px solid var(--line);border-radius:var(--radius);background:var(--surface-strong);box-shadow:0 .75rem 1.75rem rgb(255 90 10/.1)}
.brand-mark svg{display:block;width:1.45rem;height:1.45rem}
.status-pill{display:inline-flex;font-family:var(--font-cursive);align-items:center;gap:.5rem;min-height:2.35rem;padding:0 .9rem;border:1px solid var(--line);border-radius:var(--radius);background:rgb(255 255 255/.72);color:#7a3414;font-size:.82rem;font-weight:800;box-shadow:0 .75rem 1.8rem rgb(28 18 11/.06);backdrop-filter:blur(.75rem)}
.status-dot{width:.5rem;height:.5rem;border-radius:999rem;background:var(--orange);box-shadow:0 0 0 .25rem rgb(255 90 10/.12)}
.hero{position:relative;display:grid;flex:1 1 auto;min-height:0;width:min(100%,var(--max));margin:0 auto;overflow:hidden;padding:clamp(.2rem,1.2dvh,.85rem) clamp(1rem,4vw,2rem) clamp(5.15rem,11dvh,7.35rem);place-items:center;text-align:center}
.cloud,.bird,.dots{position:absolute;pointer-events:none;opacity:.52}
.cloud{width:clamp(5.8rem,13vw,10rem);height:auto;stroke:#d7d2ce;fill:none;stroke-width:4;stroke-linecap:round;stroke-linejoin:round}
.cloud-left{left:clamp(1rem,9vw,5rem);top:5.8rem}
.cloud-right{right:clamp(1rem,12vw,7rem);top:2.2rem;transform:scale(.82)}
.bird{right:clamp(3rem,11vw,8rem);top:8.6rem;width:clamp(4rem,8vw,5.8rem);stroke:#3e3e3e;fill:none;stroke-width:4;stroke-linecap:round}
.dots{width:5.6rem;height:5.6rem;background-image:radial-gradient(circle,rgb(255 90 10/.18) .12rem,transparent .14rem);background-size:.82rem .82rem}
.dots-left{left:clamp(1rem,10vw,5.4rem);top:18rem}
.dots-right{right:clamp(1rem,10vw,5.4rem);bottom:13rem}
.hero-inner{position:relative;z-index:2;display:grid;justify-items:center;width:100%}
.logo-card{display:grid;width:min(100%,67rem);justify-items:center;margin-top:clamp(.25rem,2vh,1.5rem)}
.main-logo{display:block;width:min(100%,52rem);max-height:clamp(14rem,43dvh,31rem);height:auto;object-fit:contain;user-select:none;-webkit-user-drag:none;filter:drop-shadow(0 1.2rem 2.4rem rgb(23 23 23/.1))}
.copy{width:min(100%,48rem);margin-top:clamp(.4rem,1.6vw,.85rem)}
.eyebrow{margin:0 0 .45rem;color:var(--orange);font-family:var(--font-mono);font-size:clamp(.72rem,1vw,.84rem);font-weight:850;letter-spacing:.24em;text-transform:uppercase}
.copy h1{margin:0;color:var(--text);font-family:var(--font-cursive);font-size:clamp(1.25rem,2.25vw,2.05rem);line-height:1.16;letter-spacing:0}
.copy p{margin:.58rem auto 0;color:var(--muted);font-family:var(--font-cursive);font-size:clamp(.96rem,1.25vw,1.08rem);line-height:1.42}
.actions{display:flex;flex-wrap:wrap;align-items:center;justify-content:center;gap:.85rem;margin-top:1.15rem}
.btn{display:inline-flex;align-items:center;justify-content:center;gap:.6rem;min-width:11rem;min-height:2.95rem;padding:.72rem 1.25rem;border:1px solid #fff0;border-radius:var(--radius);cursor:pointer;font:inherit;font-weight:850;transition:transform 160ms ease,box-shadow 160ms ease,border-color 160ms ease,background 160ms ease}
.btn svg{width:1.12rem;height:1.12rem;flex:0 0 auto}
.btn-primary{background:linear-gradient(135deg,var(--orange),var(--orange-2));color:#fff;box-shadow:0 1rem 2rem rgb(255 90 10/.25)}
.btn-secondary{border-color:rgb(255 90 10/.72);background:rgb(255 255 255/.78);color:#1d1d1d}
.btn:hover,.btn:focus-visible{transform:translateY(-.08rem);outline:none}
.btn-primary:hover,.btn-primary:focus-visible{box-shadow:0 1.15rem 2.35rem rgb(255 90 10/.33)}
.btn-secondary:hover,.btn-secondary:focus-visible{background:var(--soft)}
.footer-wave{position:absolute;right:0;bottom:0;left:0;z-index:0;height:clamp(5.4rem,10dvh,7.4rem);overflow:hidden;pointer-events:none}
.footer-wave::before,.footer-wave::after{position:absolute;content:"";border-radius:50% 50% 0 0}
.footer-wave::before{right:-12%;bottom:-6.35rem;left:-12%;height:12.5rem;background:linear-gradient(135deg,var(--orange),#ff7a1a);box-shadow:inset 0 .45rem 0 rgb(181 55 0/.22)}
.footer-wave::after{right:-22%;bottom:-7.6rem;width:58%;height:10.5rem;background:rgb(255 255 255/.1)}
.footer-copy{position:absolute;right:1rem;bottom:.8rem;font-family:var(--font-mono);left:1rem;z-index:2;color:rgb(255 255 255/.92);font-size:clamp(.72rem,1.45dvh,.86rem);text-align:center}

.shell{position:relative;z-index:2;display:grid;width:100%;grid-template-columns:minmax(0,1fr) minmax(16rem,20rem);align-items:center;gap:clamp(1rem,2.8vw,2rem)}
.support-card{display:grid;gap:.85rem;padding:1rem;border:1px solid var(--line);border-radius:var(--radius);background:rgb(255 255 255/.74);box-shadow:var(--shadow);backdrop-filter:blur(.75rem);text-align:left}
.support-card h2{margin:0;color:var(--text);font-family:var(--font-mono);font-size:.86rem;letter-spacing:.12em;text-transform:uppercase}
.support-card p{margin:0;color:var(--muted);font-family:var(--font-cursive);font-size:.92rem;line-height:1.35}
.support-form{display:grid;gap:.62rem}
.field{display:grid;gap:.25rem}
.field label{color:#7a3414;font-family:var(--font-mono);font-size:.68rem;font-weight:850;letter-spacing:.12em;text-transform:uppercase}
.field input,.field textarea{width:100%;border:1px solid rgb(255 90 10/.22);border-radius:var(--radius);background:#fff;color:var(--text);font:inherit;font-size:.9rem;outline:none;padding:.65rem .72rem}
.field textarea{min-height:6.4rem;resize:vertical}
.field input:focus,.field textarea:focus{border-color:rgb(255 90 10/.76);box-shadow:0 0 0 .18rem rgb(255 90 10/.12)}
.support-submit{width:100%;min-height:2.55rem;border:0;border-radius:var(--radius);background:linear-gradient(135deg,var(--orange),var(--orange-2));color:#fff;cursor:pointer;font:inherit;font-weight:850}
.support-note{color:var(--muted);font-family:var(--font-mono);font-size:.68rem;line-height:1.35}
.legal-details{display:flex;flex-wrap:wrap;align-items:center;justify-content:center;gap:.5rem .68rem;margin-top:1rem;font-family:var(--font-mono);font-size:.72rem}
.legal-details a{padding:.28rem .45rem;border:1px solid rgb(255 90 10/.18);border-radius:var(--radius);background:rgb(255 255 255/.62);color:#7a3414;font-weight:850}
.legal-details a:hover,.legal-details a:focus-visible{outline:none;background:var(--soft);border-color:rgb(255 90 10/.48)}
.toast{position:fixed;right:1rem;bottom:1rem;z-index:5;max-width:min(22rem,calc(100vw - 2rem));padding:.8rem .95rem;border:1px solid var(--line);border-radius:var(--radius);background:#fff;color:var(--text);box-shadow:var(--shadow);font-family:var(--font-mono);font-size:.78rem}
.toast[data-type="success"]{border-color:rgb(22 163 74/.28)}
.toast[data-type="error"]{border-color:rgb(220 38 38/.28)}

@media (max-width:960px){.shell{grid-template-columns:1fr}.support-card{width:min(100%,25rem);justify-self:center}.hero-inner{order:1}.support-card{order:2}}
@media (max-width:760px){.topbar{padding-top:.6rem;padding-bottom:.45rem}.status-pill{display:none}.hero{padding-top:.15rem;padding-bottom:clamp(4.85rem,10dvh,6.3rem)}.cloud-left,.cloud-right,.bird,.dots{opacity:.24}.cloud-left{left:.85rem;top:3.8rem}.cloud-right{right:.5rem;top:1.2rem}.bird{right:1rem;top:8rem}.dots-left{left:.9rem;top:14.5rem}.dots-right{right:1rem;bottom:12rem}.main-logo{width:min(100%,38rem);max-height:38dvh}.copy h1{max-width:24rem}.copy p{max-width:25rem}.actions{width:100%}.btn{width:min(100%,20rem)}.support-card{display:none}.legal-details{margin-top:.72rem;font-size:.68rem}}
@media (max-height:680px){.brand-mark{width:2rem;height:2rem}.brand-mark svg{width:1.25rem;height:1.25rem}.main-logo{max-height:37dvh}.copy p{margin-top:.42rem;line-height:1.32}.actions{margin-top:.75rem;gap:.62rem}.btn{min-height:2.62rem;padding:.58rem 1rem}}
@media (max-height:560px){.status-pill,.cloud,.bird,.dots{display:none}.main-logo{max-height:34dvh}.copy p{display:none}}
@media (prefers-reduced-motion:reduce){*,*::before,*::after{scroll-behavior:auto!important;transition-duration:.001ms!important;animation-duration:.001ms!important;animation-iteration-count:1!important}}
    </style>
    <script type="application/ld+json" nonce="<?= e($nonce); ?>"><?= $schemaJson; ?></script>
</head>
<body>
    <div class="page">
        <header class="topbar" aria-label="Page header">
            <a class="brand" aria-label="Wrong URL homepage"></a>
            <div class="status-pill" aria-label="Fallback page status">
                <span class="status-dot" aria-hidden="true"></span>
                <span><?= $isWrongPath ? '404 fallback' : 'homepage'; ?></span>
            </div>
        </header>

        <main class="hero" aria-labelledby="page-title">
            <svg class="cloud cloud-left" viewBox="0 0 160 60" aria-hidden="true" focusable="false">
                <path d="M18 48h123M36 48c-12-23 20-33 33-17 10-31 55-22 54 7 15-3 26 2 30 10"/>
            </svg>
            <svg class="cloud cloud-right" viewBox="0 0 160 60" aria-hidden="true" focusable="false">
                <path d="M18 48h123M36 48c-12-23 20-33 33-17 10-31 55-22 54 7 15-3 26 2 30 10"/>
            </svg>
            <svg class="bird" viewBox="0 0 150 60" aria-hidden="true" focusable="false">
                <path d="M16 38c11-16 24-16 34 0M68 32c10-17 25-17 36 0M112 39c8-12 18-12 27 0"/>
            </svg>
            <span class="dots dots-left" aria-hidden="true"></span>
            <span class="dots dots-right" aria-hidden="true"></span>

            <div class="shell">
                <section class="hero-inner">
                    <div class="logo-card">
                        <img class="main-logo" src="/assets/fox-chase-logo.png" width="1402" height="886" alt="Wrong URL fox logo with invalid or missing sub_id detail" draggable="false" decoding="async">
                    </div>

                    <div class="copy">
                        <p class="eyebrow">WELCOME</p>
                        <h1 id="page-title">NGIX | XCTD</h1>
                        <p>Designed for speed. Built for reliability. Protected by default.</p>
                        <p>Authenticate to continue to your secure workspace.</p>
                    </div>

                    <nav class="actions" aria-label="Authentication actions">
                        <a class="btn btn-primary" href="<?php echo login_url(); ?>">
                            <svg viewBox="0 0 24 24" fill="none" aria-hidden="true" focusable="false">
                                <path d="M12 2.75a4.75 4.75 0 0 0-4.75 4.75V10H6a2 2 0 0 0-2 2v7.25a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V12a2 2 0 0 0-2-2h-1.25V7.5A4.75 4.75 0 0 0 12 2.75Zm-2.75 7.25V7.5a2.75 2.75 0 0 1 5.5 0V10h-5.5Z" fill="currentColor"/>
                            </svg>
                            <span>Sign In</span>
                        </a>
                        <a class="btn btn-secondary" href="/">
                            <svg viewBox="0 0 24 24" fill="none" aria-hidden="true" focusable="false">
                                <path d="M3 10.6 12 3l9 7.6V21h-6v-6H9v6H3V10.6Z" fill="currentColor"/>
                            </svg>
                            <span>Homepage</span>
                        </a>
                    </nav>

                    <nav class="legal-details" aria-label="Site details">
                        <a href="/privacy.html">Privacy</a>
                        <a href="/terms.html">Terms</a>
                        <a href="/abuse.html">Abuse</a>
                        <a href="/sitemap.xml">Sitemap</a>
                        <a href="/robots.txt">Robots</a>
                    </nav>
                </section>

                <aside class="support-card" aria-labelledby="support-title">
                    <h2 id="support-title">Contact Support</h2>
                    <p>Send a secured support request for access, abuse reports, or wrong-path handling.</p>
                    <form class="support-form" method="post" action="<?= e($path); ?>">
                        <input type="hidden" name="intent" value="support_contact">
                        <input type="hidden" name="csrf_token" value="<?= e($csrfToken); ?>">
                        <div class="field">
                            <label for="support-name">Name</label>
                            <input id="support-name" name="name" type="text" autocomplete="name" maxlength="80" required>
                        </div>
                        <div class="field">
                            <label for="support-email">Email</label>
                            <input id="support-email" name="email" type="email" autocomplete="email" maxlength="160" required>
                        </div>
                        <div class="field">
                            <label for="support-message">Message</label>
                            <textarea id="support-message" name="message" maxlength="800" required></textarea>
                        </div>
                        <button class="support-submit" type="submit">Send Support Request</button>
                    </form>
                    <div class="support-note">Protected with same-site session cookies, CSRF token, strict validation, and escaped output.</div>
                </aside>
            </div>
        </main>

        <footer class="footer-wave" aria-hidden="true"></footer>
        <div class="footer-copy">© <?= e($year); ?> NGIX ⸺ XCTD. All rights reserved.</div>
    </div>

    <?php if ($supportResult['message'] !== '') : ?>
        <div class="toast" data-type="<?= e($supportResult['type']); ?>" role="status" aria-live="polite"><?= e($supportResult['message']); ?></div>
    <?php endif; ?>

    <script nonce="<?= e($nonce); ?>">
        (() => {
            'use strict';

            const blockImageEvent = (event) => {
                const target = event.target;

                if (!(target instanceof Element)) {
                    return;
                }

                if (target.closest('img')) {
                    event.preventDefault();
                }
            };

            document.addEventListener('contextmenu', blockImageEvent, {capture: true});
            document.addEventListener('dragstart', blockImageEvent, {capture: true});
        })();
    </script>

</body>
</html>