<?php
session_start();
$PASSWORD='stepaway'; // Change before public launch
$root=__DIR__;
$dataDir=$root.'/data';
$files=[
  'settings'=>'data/settings.json',
  'variables'=>'data/variables.json',
  'cases'=>'data/cases.json',
  'cards'=>'data/cards.json',
  'campaigns'=>'data/campaigns.json',
  'wrinkles'=>'data/wrinkles.json'
];
function h($s){return htmlspecialchars((string)$s,ENT_QUOTES,'UTF-8');}
function read_json_file($path,$fallback=[]){ if(!file_exists($path)) return $fallback; $raw=file_get_contents($path); $j=json_decode($raw,true); return is_array($j)?$j:$fallback; }
function write_json_file($path,$data){ $dir=dirname($path); if(!is_dir($dir)) @mkdir($dir,0755,true); $tmp=$path.'.tmp'; file_put_contents($tmp,json_encode($data,JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES|JSON_UNESCAPED_UNICODE),LOCK_EX); rename($tmp,$path); }
function tuning_bundle(){ global $root,$files; $bundle=['schema'=>'stepaway-tuning-export-v1','exportedAt'=>gmdate('c'),'files'=>[]]; foreach($files as $key=>$rel){ $bundle['files'][$key]=read_json_file($root.'/'.$rel,[]); } return $bundle; }
function apply_tuning_bundle($bundle,&$msg){ global $root,$files; if(!is_array($bundle)||($bundle['schema']??'')!=='stepaway-tuning-export-v1'||empty($bundle['files'])||!is_array($bundle['files'])){ $msg='Import rejected: not a Step Away tuning export.'; return false; } $count=0; foreach($files as $key=>$rel){ if(array_key_exists($key,$bundle['files'])){ write_json_file($root.'/'.$rel,$bundle['files'][$key]); $count++; } } $msg='Imported tuning bundle. Files updated: '.$count.'.'; return true; }
if(isset($_POST['password'])){ if($_POST['password']===$PASSWORD) $_SESSION['tuning_ok']=true; }
if(isset($_GET['logout'])){ unset($_SESSION['tuning_ok']); header('Location: tuning.php'); exit; }
if(empty($_SESSION['tuning_ok'])){ echo '<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="assets/css/app.css"><main class="app-shell"><section class="panel"><h1 style="color:#17130f;text-shadow:none">Step Away Tuning</h1><p>Hidden route for variable export/import. Mechanics stay locked; variables can move.</p><form method="post"><input class="search" type="password" name="password" placeholder="Password"><button class="primary">Enter</button></form></section></main>'; exit; }
$msg='';
if(($_GET['download']??'')==='1'){
  header('Content-Type: application/json; charset=utf-8');
  header('Content-Disposition: attachment; filename="stepaway_tuning_export_v3_0.json"');
  echo json_encode(tuning_bundle(),JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES|JSON_UNESCAPED_UNICODE); exit;
}
if($_SERVER['REQUEST_METHOD']==='POST' && ($_POST['action']??'')==='import'){
  $raw=$_POST['bundle']??'';
  $bundle=json_decode($raw,true);
  if(json_last_error()!==JSON_ERROR_NONE) $msg='JSON error: '.json_last_error_msg();
  else apply_tuning_bundle($bundle,$msg);
}
$bundle=json_encode(tuning_bundle(),JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES|JSON_UNESCAPED_UNICODE);
?><!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Step Away Tuning</title><link rel="stylesheet" href="assets/css/app.css"><style>textarea{width:100%;min-height:58vh;background:#fffaf1;border:1px solid #d4c8b8;border-radius:16px;padding:12px;font-family:ui-monospace,monospace;font-size:13px}.admin-tabs{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}.admin-tabs a{background:#20272f;color:#f7efe4;padding:10px 12px;border-radius:12px;text-decoration:none;font-weight:900}.note{background:#fffaf1;border:1px solid #d4c8b8;border-radius:16px;padding:12px}</style></head><body><main class="app-shell"><section class="panel"><p class="eyebrow">Variables, not mechanics</p><h1 style="color:#17130f;text-shadow:none">Step Away Tuning</h1><p><?php echo h($msg); ?></p><div class="admin-tabs"><a href="index.php">Open app</a><a href="admin.php">Admin</a><a href="tuning.php?download=1">Download tuning JSON</a><a href="?logout=1">Logout</a></div><div class="note"><b>Locked rule:</b> the cards are the human language, the app is the hidden pressure system. Change values, ranges, feedback and case text here. Do not change the core loop until playtest evidence demands it.</div><h2>Export / Import bundle</h2><form method="post"><input type="hidden" name="action" value="import"><textarea name="bundle"><?php echo h($bundle); ?></textarea><button class="primary big">Import pasted tuning bundle</button></form></section></main></body></html>
