{* Admin product-settings panel injected into the "Module Settings" tab.
   Mounted by the AdminAreaFooterOutput hook via MutationObserver into
   #tblModuleSettings as a full-width <tr>.
*}

<ul class="nav nav-tabs puq-tabs" style="margin-top:10px;">
    <li class="active"><a href="#puq-tab-general" data-toggle="tab">General</a></li>
    <li id="puq-tab-li-account" style="display:none;"><a href="#puq-tab-account" data-toggle="tab">Account limits</a></li>
    <li id="puq-tab-li-vanity" style="display:none;"><a href="#puq-tab-vanity" data-toggle="tab">Vanity limits</a></li>
    <li id="puq-tab-li-web"><a href="#puq-tab-web" data-toggle="tab">Web limits</a></li>
    <li id="puq-tab-li-mail"><a href="#puq-tab-mail" data-toggle="tab">Mail limits</a></li>
    <li id="puq-tab-li-dns"><a href="#puq-tab-dns" data-toggle="tab">DNS limits</a></li>
    <li><a href="#puq-tab-client" data-toggle="tab">Client</a></li>
    <li><a href="#puq-tab-email" data-toggle="tab">Email mapping</a></li>
    <li><a href="#puq-tab-emailtpl" data-toggle="tab">Email templates</a></li>
    <li><a href="#puq-tab-cfgopts" data-toggle="tab">Config options</a></li>
</ul>

<div class="tab-content" style="padding:15px 0;">

    <!-- General ------------------------------------------------------------ -->
    <div class="tab-pane active" id="puq-tab-general">
        <h5><i class="fa fa-server"></i> Infrastructure</h5>
        <div class="form-group">
            <label>Server Group (addon side) <span class="text-danger">*</span></label>
            <select name="packageconfigoption[2]" id="puq-sel-group" class="form-control" data-saved="{$package_options.configoption2|default:''}">
                <option value="">— Select a server group —</option>
            </select>
            <span class="help-block">
                Picks which addon server group (web + mail + dns) this product deploys into.
                Nameservers and DNS variables are configured per-group under
                <em>Addon → Server Groups → Edit → DNS variables</em>.
            </span>
        </div>

        <h5 style="margin-top:24px;"><i class="fa fa-cubes"></i> Package contents</h5>
        <div class="form-group">
            <label style="display:block;margin-bottom:4px;">What this package includes</label>
            <div style="display:flex;gap:18px;flex-wrap:wrap;">
                <label style="font-weight:normal;">
                    <input type="checkbox" name="packageconfigoption[6][role_web]" value="on"
                           {if !isset($package_options.role_web) or $package_options.role_web eq 'on'}checked{/if}>
                    <strong>Web</strong> <small class="text-muted">(domain, files, databases, FTP, cron)</small>
                </label>
                <label style="font-weight:normal;">
                    <input type="checkbox" name="packageconfigoption[6][role_mail]" value="on"
                           {if !isset($package_options.role_mail) or $package_options.role_mail eq 'on'}checked{/if}>
                    <strong>Mail</strong> <small class="text-muted">(mailboxes, webmail, mail backups)</small>
                </label>
                <label style="font-weight:normal;color:var(--puq-muted);">
                    <input type="checkbox" checked disabled>
                    <strong>DNS</strong> <small>(always active — locally managed)</small>
                </label>
            </div>
        </div>

        <h5 style="margin-top:24px;"><i class="fa fa-layer-group"></i> Deployment mode</h5>
        <div class="form-group">
            {assign var=puq_dmode value=($package_options.deployment_mode|default:'split')}
            <div style="display:flex;gap:24px;flex-wrap:wrap;">
                <label style="font-weight:normal;">
                    <input type="radio" name="packageconfigoption[6][deployment_mode]" value="split" id="puq-rad-mode-split"
                           {if $puq_dmode neq 'unified'}checked{/if}>
                    <strong>Split</strong>
                    <small class="text-muted">(one Hestia user per role; web / mail / dns can live on different servers)</small>
                </label>
                <label style="font-weight:normal;">
                    <input type="radio" name="packageconfigoption[6][deployment_mode]" value="unified" id="puq-rad-mode-unified"
                           {if $puq_dmode eq 'unified'}checked{/if}>
                    <strong>Unified</strong>
                    <small class="text-muted">(single Hestia user holds web + mail; DNS joins the same account when the server is in the DNS cluster)</small>
                </label>
                <label style="font-weight:normal;">
                    <input type="radio" name="packageconfigoption[6][deployment_mode]" value="vanity" id="puq-rad-mode-vanity"
                           {if $puq_dmode eq 'vanity'}checked{/if}>
                    <strong>Vanity</strong>
                    <small class="text-muted">(sell name.&lt;your-domain&gt; sites + name@&lt;your-domain&gt; mailboxes on a domain YOU own)</small>
                </label>
            </div>
            <span class="help-block" style="margin-top:8px;">
                <strong>Split</strong> is the classic mode and supports any group composition.
                <strong>Unified</strong> requires the chosen server group to contain at least one
                server with both <em>Web</em> and <em>Mail</em> capabilities ticked
                (Addon → Servers → Edit → Capabilities). Customer-facing change: a single
                <em>Account backups</em> quota replaces the separate Web / Mail backup counts.
                The mode is locked at <code>_CreateAccount</code> time — switching the product
                of an existing service between split and unified is refused.
            </span>
            <span class="help-block" style="margin-top:8px;" id="puq-vanity-mode-help">
                <strong>Vanity</strong> sells slots on a domain <em>you</em> own (configured under
                Addon → Server Groups → Edit → <em>Vanity domains</em>). The buyer picks the parent
                domain via a Configurable Option named <code>vanity_domain</code> and enters their
                name in a Custom Field named <code>vanity_name</code>; the service then gets a
                normal per-service web account for <code>name.&lt;domain&gt;</code> and ONE mailbox
                <code>name@&lt;domain&gt;</code> on your shared mail user. The module never creates or
                deletes the parent domain / zone / your provider user. Set the per-order site and
                mailbox sizes on the <em>Vanity limits</em> tab.
            </span>
            <span class="help-block" style="margin-top:8px;">
                <strong>How role gating works:</strong>
                A role is <em>enabled</em> for a service when BOTH the package-level checkbox is ticked
                AND the corresponding <code>disk_quota</code> resolves to a non-zero value. Setting
                <code>web_disk_quota=0</code> (or <code>mail_disk_quota=0</code>) via the Web/Mail tab
                <em>or</em> via a WHMCS Configurable Option behaves exactly like un-ticking the box
                here — the role is skipped entirely:
                <ul style="margin:6px 0 0 18px;font-size:12px;">
                    <li>Provisioner skips <code>createPackage</code> / <code>createUser</code> / <code>addDomain</code> for the disabled role.</li>
                    <li>Client area hides the matching tabs (Mailboxes / Databases / FTP / Cron / Web settings / Custom SSL / Backups) and dashboard cards.</li>
                    <li>Admin inline panel skips role-specific pills.</li>
                    <li><strong>DNS is never gated</strong> — DNS records are managed locally regardless of which Hestia roles are active. If the server group has no DNS servers attached, DNS provisioning is silently skipped.</li>
                </ul>
                At least one of <em>Web</em> / <em>Mail</em> must be ticked — provisioning errors otherwise.
            </span>
        </div>
    </div>

    <!-- Account limits (configoption7 — unified mode only) ------------------
         When deployment_mode=unified, DISK_QUOTA / BANDWIDTH / BACKUPS apply
         to the whole Hestia user (web + mail + dns live in one account), so
         the per-role fields in Web/Mail tabs are hidden in favour of these
         single shared values. resolveLimits() merges these keys into the
         payload only when the service was provisioned in unified mode. -->
    <div class="tab-pane" id="puq-tab-account">
        <h5><i class="fa fa-user-cog"></i> Unified account quotas</h5>
        <p class="text-muted small">
            One Hestia user holds the entire service. DISK_QUOTA / BANDWIDTH / BACKUPS
            are pulled from these fields; <em>Web limits</em> and <em>Mail limits</em> below
            only contribute the role-specific keys (databases, mailboxes, etc).
        </p>
        <div class="row">
            <div class="col-md-4 form-group">
                <label>Account disk quota (MB) <code class="text-muted">DISK_QUOTA</code></label>
                <input type="number" name="packageconfigoption[7][total_disk_quota]" class="form-control" value="{$package_options.total_disk_quota|default:'2048'}" min="0">
                <span class="help-block">Combined Web + Mail + DNS storage. Configurable Option override: <code>total_disk_quota</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label>Account bandwidth (MB / month) <code class="text-muted">BANDWIDTH</code></label>
                <input type="number" name="packageconfigoption[7][total_bandwidth]" class="form-control" value="{$package_options.total_bandwidth|default:'0'}" min="0">
                <span class="help-block">0 = unlimited. Configurable Option override: <code>total_bandwidth</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label>Account backups kept <code class="text-muted">BACKUPS</code></label>
                <input type="number" name="packageconfigoption[7][account_backups]" class="form-control" value="{$package_options.account_backups|default:'0'}" min="0">
                <span class="help-block">Replaces separate Web / Mail backup counts. 0 = backups disabled. Configurable Option override: <code>account_backups</code>.</span>
            </div>
        </div>
        <div class="row">
            <div class="col-md-4 form-group">
                <label><input type="checkbox" name="packageconfigoption[7][account_backups_incremental]" value="on" {if $package_options.account_backups_incremental eq 'on'}checked{/if}>
                    Incremental backups <code class="text-muted">BACKUPS_INCREMENTAL</code></label>
            </div>
        </div>
    </div>

    <!-- Vanity limits (deployment_mode=vanity only) -----------------------
         vanity_site_disk_quota -> the per-service web user's DISK_QUOTA (the
         site). vanity_mail_quota -> the single name-at-domain mailbox quota.
         Both live here (not on Web/Mail tabs) so the vanity product form is
         self-contained. Stored in configoption7/8 so resolveLimits() merges
         them; overridable via WHMCS Configurable Options of the same name. -->
    <div class="tab-pane" id="puq-tab-vanity">
        <h5><i class="fa fa-at"></i> Vanity slot sizes</h5>
        <p class="text-muted small">
            The buyer's <code>vanity_name</code> + the chosen <code>vanity_domain</code> become
            <code>name.&lt;domain&gt;</code> (a normal per-service web account) and
            <code>name@&lt;domain&gt;</code> (one mailbox on your shared provider mail user).
            Tick <em>Web</em> and/or <em>Mail</em> in General to control which the buyer gets.
        </p>
        <div class="row">
            <div class="col-md-4 form-group">
                <label>Website quota (MB) <code class="text-muted">DISK_QUOTA</code></label>
                <input type="number" name="packageconfigoption[7][vanity_site_disk_quota]" class="form-control" value="{$package_options.vanity_site_disk_quota|default:'1024'}" min="0">
                <span class="help-block"><strong>0 = no website</strong> (Web role skipped). Configurable Option override: <code>vanity_site_disk_quota</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label>Mailbox quota (MB)</label>
                <input type="number" name="packageconfigoption[8][vanity_mail_quota]" class="form-control" value="{$package_options.vanity_mail_quota|default:'1024'}" min="0">
                <span class="help-block"><strong>0 = no mailbox</strong> (Mail role skipped). Configurable Option override: <code>vanity_mail_quota</code>.</span>
            </div>
        </div>

        <hr>
        <h5><i class="fa fa-server"></i> Web account &amp; mailbox limits</h5>
        <p class="text-muted small">Apply to the vanity web account + the single mailbox. Moved here from the Web / Mail tabs (hidden in Vanity mode).</p>
        <div class="row" id="puq-vanity-extra"><!-- JS relocates the marked Web/Mail fields here in vanity mode --></div>

        <div class="alert alert-info" style="font-size:12px;margin-top:8px;">
            <i class="fa fa-info-circle"></i>
            Required WHMCS setup for this product:
            <ul style="margin:6px 0 0 18px;">
                <li>A <strong>Configurable Option</strong> named <code>vanity_domain</code> whose option values are the exact parent-domain strings from this group's <em>Vanity domains</em> list (the buyer picks one).</li>
                <li>A product <strong>Custom Field</strong> named <code>vanity_name</code> (text) — the buyer's chosen name. May be left for the client to fill in after order; they'll be prompted in the client area.</li>
            </ul>
            The per-role Disk / Bandwidth / Backups / Subdomains fields are not used in vanity mode (the website size is <em>Website quota</em> above).
        </div>
    </div>

    <!-- Web limits (configoption7) — Hestia package vars for the WEB user --
         Every key is named after its Hestia package KEY (lowercase, role-
         prefixed). The buildPackagePayload mapping is 1:1.
            web_disk_quota         → DISK_QUOTA       (split mode)
            web_bandwidth          → BANDWIDTH        (split mode)
            web_databases          → DATABASES
            web_cron_jobs          → CRON_JOBS
            web_backups            → BACKUPS          (split mode)
            web_backups_incremental→ BACKUPS_INCREMENTAL (split mode)
            web_aliases            → WEB_ALIASES (subdomains / web aliases)
         Unified mode pulls DISK_QUOTA / BANDWIDTH / BACKUPS from the Account
         tab; the matching rows here are hidden by JS and ignored at deploy.
         Module-local (no Hestia KEY):
            web_ftp_accounts, web_php_version, web_ssl_auto -->
    <div class="tab-pane" id="puq-tab-web">
        <h5><i class="fa fa-server"></i> Hestia package quotas</h5>
        <div class="row">
            <div class="col-md-4 form-group puq-split-only">
                <label>Disk quota (MB) <code class="text-muted">DISK_QUOTA</code></label>
                <input type="number" name="packageconfigoption[7][web_disk_quota]" class="form-control" value="{$package_options.web_disk_quota|default:'1024'}" min="0">
                <span class="help-block"><strong>0 = role disabled</strong> (acts like un-ticking <em>Web</em> in General). Configurable Option override: <code>web_disk_quota</code>.</span>
            </div>
            <div class="col-md-4 form-group puq-split-only">
                <label>Bandwidth (MB / month) <code class="text-muted">BANDWIDTH</code></label>
                <input type="number" name="packageconfigoption[7][web_bandwidth]" class="form-control" value="{$package_options.web_bandwidth|default:'0'}" min="0">
                <span class="help-block">Outgoing traffic. 0 = unlimited. Configurable Option override: <code>web_bandwidth</code>.</span>
            </div>
            <div class="col-md-4 form-group puq-vanity-field">
                <label>Cron jobs <code class="text-muted">CRON_JOBS</code></label>
                <input type="number" name="packageconfigoption[7][web_cron_jobs]" class="form-control" value="{$package_options.web_cron_jobs|default:'5'}" min="0">
                <span class="help-block">0 = unlimited. Configurable Option override: <code>web_cron_jobs</code>.</span>
            </div>
        </div>
        <div class="row puq-split-only">
            <div class="col-md-4 form-group">
                <label>Backups kept <code class="text-muted">BACKUPS</code></label>
                <input type="number" name="packageconfigoption[7][web_backups]" class="form-control" value="{$package_options.web_backups|default:'0'}" min="0">
                <span class="help-block">0 = backups disabled. Configurable Option override: <code>web_backups</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label><input type="checkbox" name="packageconfigoption[7][web_backups_incremental]" value="on" {if $package_options.web_backups_incremental eq 'on'}checked{/if}>
                    Incremental backups <code class="text-muted">BACKUPS_INCREMENTAL</code></label>
            </div>
        </div>
        <div class="row">
            <div class="col-md-3 form-group">
                <label>Max subdomains <code class="text-muted">WEB_ALIASES</code></label>
                <input type="number" name="packageconfigoption[7][web_aliases]" class="form-control" value="{$package_options.web_aliases|default:'0'}" min="0">
                <span class="help-block">Aliases / subdomains under the main web domain. Sets Hestia <code>WEB_ALIASES</code>. 0 = none.</span>
            </div>
            <div class="col-md-3 form-group puq-vanity-field">
                <label>Max databases <code class="text-muted">DATABASES</code></label>
                <input type="number" name="packageconfigoption[7][web_databases]" class="form-control" value="{$package_options.web_databases|default:'5'}" min="0">
                <span class="help-block">Configurable Option override: <code>web_databases</code>.</span>
            </div>
        </div>

        <hr>
        <h5><i class="fa fa-folder-open"></i> Module-local limits</h5>
        <p class="text-muted small">Enforced by client-area CRUD (our DB tables) — not pushed to Hestia.</p>
        <div class="row">
            <div class="col-md-4 form-group puq-vanity-field">
                <label>Max FTP accounts</label>
                <input type="number" name="packageconfigoption[7][web_ftp_accounts]" class="form-control" value="{$package_options.web_ftp_accounts|default:'0'}" min="0">
                <span class="help-block">Configurable Option override: <code>web_ftp_accounts</code>.</span>
            </div>
            <div class="col-md-4 form-group puq-vanity-field">
                <label>Default PHP version</label>
                <input type="text" name="packageconfigoption[7][web_php_version]" class="form-control" value="{$package_options.web_php_version|default:'8.2'}" placeholder="8.2">
            </div>
            <div class="col-md-4 form-group puq-vanity-field">
                <label><input type="checkbox" name="packageconfigoption[7][web_ssl_auto]" value="on" {if $package_options.web_ssl_auto eq 'on'}checked{/if}> Auto-install Let's Encrypt on account create</label>
            </div>
        </div>
    </div>

    <!-- Mail limits (configoption8) — Hestia package vars for the MAIL user --
         Same naming convention as web. Hestia-backed keys:
            mail_disk_quota        → DISK_QUOTA
            mail_accounts          → MAIL_ACCOUNTS
            mail_rate_limit        → RATE_LIMIT
            mail_backups           → BACKUPS
            mail_backups_incremental → BACKUPS_INCREMENTAL
         BANDWIDTH is forced unlimited (mail bandwidth not tracked).
         Module-local: mail_forwarders, mail_aliases, mail_autoresponder, mail_spam_filter -->
    <div class="tab-pane" id="puq-tab-mail">
        <h5><i class="fa fa-envelope"></i> Hestia package quotas</h5>
        <div class="row">
            <div class="col-md-4 form-group puq-split-only">
                <label>Disk quota (MB) <code class="text-muted">DISK_QUOTA</code></label>
                <input type="number" name="packageconfigoption[8][mail_disk_quota]" class="form-control" value="{$package_options.mail_disk_quota|default:'1024'}" min="0">
                <span class="help-block"><strong>0 = role disabled</strong> (acts like un-ticking <em>Mail</em> in General). Configurable Option override: <code>mail_disk_quota</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label>Mail accounts <code class="text-muted">MAIL_ACCOUNTS</code></label>
                <input type="number" name="packageconfigoption[8][mail_accounts]" class="form-control" value="{$package_options.mail_accounts|default:'10'}" min="0">
                <span class="help-block">Configurable Option override: <code>mail_accounts</code>.</span>
            </div>
            <div class="col-md-4 form-group puq-vanity-field">
                <label>Rate limit (email / hour) <code class="text-muted">RATE_LIMIT</code></label>
                <input type="number" name="packageconfigoption[8][mail_rate_limit]" class="form-control" value="{$package_options.mail_rate_limit|default:'0'}" min="0">
                <span class="help-block">Outgoing emails per mailbox per hour. 0 = unlimited.</span>
            </div>
        </div>
        <div class="row puq-split-only">
            <div class="col-md-4 form-group">
                <label>Backups kept <code class="text-muted">BACKUPS</code></label>
                <input type="number" name="packageconfigoption[8][mail_backups]" class="form-control" value="{$package_options.mail_backups|default:'0'}" min="0">
                <span class="help-block">0 = backups disabled. Independent from web backups. Configurable Option override: <code>mail_backups</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label><input type="checkbox" name="packageconfigoption[8][mail_backups_incremental]" value="on" {if $package_options.mail_backups_incremental eq 'on'}checked{/if}>
                    Incremental backups <code class="text-muted">BACKUPS_INCREMENTAL</code></label>
            </div>
        </div>

        <hr>
        <h5><i class="fa fa-folder-open"></i> Module-local limits</h5>
        <p class="text-muted small">Enforced in our DB tables — not part of Hestia's package.</p>
        <div class="row">
            <div class="col-md-4 form-group">
                <label>Max forwarders</label>
                <input type="number" name="packageconfigoption[8][mail_forwarders]" class="form-control" value="{$package_options.mail_forwarders|default:'10'}" min="0">
            </div>
            <div class="col-md-4 form-group">
                <label>Max aliases</label>
                <input type="number" name="packageconfigoption[8][mail_aliases]" class="form-control" value="{$package_options.mail_aliases|default:'10'}" min="0">
            </div>
            <div class="col-md-4 form-group">
                <label><input type="checkbox" name="packageconfigoption[8][mail_autoresponder]" value="on" {if $package_options.mail_autoresponder eq 'on'}checked{/if}> Autoresponders enabled</label>
                <label><input type="checkbox" name="packageconfigoption[8][mail_spam_filter]" value="on" {if $package_options.mail_spam_filter eq 'on'}checked{/if}> Spam filter enabled</label>
            </div>
        </div>
    </div>

    <!-- DNS limits (configoption9) — Hestia package vars for the DNS user --
            dns_records      → DNS_RECORDS
            dns_disk_quota   → DISK_QUOTA
         Module-local: dns_default_ttl, dns_allowed_record_types -->
    <div class="tab-pane" id="puq-tab-dns">
        <div class="row">
            <div class="col-md-4 form-group">
                <label>Max DNS records <code class="text-muted">DNS_RECORDS</code></label>
                <input type="number" name="packageconfigoption[9][dns_records]" class="form-control" value="{$package_options.dns_records|default:'50'}" min="0">
                <span class="help-block">0 = unlimited. Configurable Option override: <code>dns_records</code>.</span>
            </div>
            <div class="col-md-4 form-group">
                <label>Disk quota (MB) <code class="text-muted">DISK_QUOTA</code></label>
                <input type="number" name="packageconfigoption[9][dns_disk_quota]" class="form-control" value="{$package_options.dns_disk_quota|default:'256'}" min="0">
                <span class="help-block">DNS user disk allowance for zone files.</span>
            </div>
            <div class="col-md-4 form-group">
                <label>Default TTL (seconds)</label>
                <input type="number" name="packageconfigoption[9][dns_default_ttl]" class="form-control" value="{$package_options.dns_default_ttl|default:'3600'}" min="60" max="86400">
            </div>
            <div class="col-md-12 form-group">
                <label>Allowed record types (CSV)</label>
                <div style="display:flex;gap:6px;align-items:stretch;">
                    <input type="text" id="puq-dns-types-input" name="packageconfigoption[9][dns_allowed_record_types]" class="form-control" style="flex:1;font-family:monospace;" value="{$package_options.dns_allowed_record_types|default:'A,AAAA,CNAME,MX,TXT,NS,SRV,CAA,PTR,DNSKEY,DS,NAPTR,TLSA'}">
                    <button type="button" class="btn btn-default" title="Replace the field with the full supported list" onclick="this.previousElementSibling.value='A,AAAA,CNAME,MX,TXT,NS,SRV,CAA,PTR,DNSKEY,DS,NAPTR,TLSA';this.previousElementSibling.focus();return false;">Use all 13</button>
                </div>
                <span class="help-block" style="font-size:12px;">
                    Comma-separated subset of supported types. Customers see ONLY the types listed here in the client-area record editor.<br>
                    <strong>Copy-paste full list:</strong>
                    <code style="user-select:all;padding:3px 6px;background:#f5f5f5;border:1px solid #ddd;border-radius:3px;display:inline-block;margin:4px 0;cursor:text;">A,AAAA,CNAME,MX,TXT,NS,SRV,CAA,PTR,DNSKEY,DS,NAPTR,TLSA</code><br>
                    <strong>Supported by both DNS backends</strong> (HestiaCP BIND + PowerDNS):
                    <code>A</code> IPv4 ·
                    <code>AAAA</code> IPv6 ·
                    <code>CNAME</code> alias ·
                    <code>NS</code> nameserver ·
                    <code>MX</code> mail server ·
                    <code>TXT</code> free-form text (SPF/DKIM/DMARC/verification) ·
                    <code>SRV</code> service location ·
                    <code>CAA</code> certificate-authority authorization ·
                    <code>PTR</code> reverse-DNS pointer ·
                    <code>DNSKEY</code> DNSSEC public key ·
                    <code>DS</code> DNSSEC delegation signer ·
                    <code>NAPTR</code> naming-authority pointer (ENUM/SIP) ·
                    <code>TLSA</code> TLS certificate association (DANE).
                </span>
            </div>
        </div>
    </div>

    {* DB limits tab fully removed — every DB-related field is now under Web
       limits: web_databases (Hestia DATABASES) is on the Web tab alongside
       web_ftp_accounts (module-local). *}

    <!-- Client permissions (configoption12) --------------------------------- -->
    <div class="tab-pane" id="puq-tab-client">
        <p class="text-muted"><small>Toggles controlling which client-area pages/actions are visible. Unchecked = hidden.</small></p>
        <div class="row">
            <div class="col-md-4">
                <h5>Mail</h5>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_create_mailbox]" value="on" {if $package_options.allow_create_mailbox eq 'on'}checked{/if}> Create mailbox</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_delete_mailbox]" value="on" {if $package_options.allow_delete_mailbox eq 'on'}checked{/if}> Delete mailbox</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_change_password]" value="on" {if $package_options.allow_change_password eq 'on'}checked{/if}> Change mailbox password</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_mailbox_settings]" value="on" {if $package_options.allow_mailbox_settings eq 'on'}checked{/if}> Mailbox settings — forwards / auto-responder <span class="label label-info">Vanity</span></label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_webmail_link]" value="on" {if $package_options.allow_webmail_link eq 'on'}checked{/if}> Webmail SSO link</label></div>
                <p class="text-muted" style="margin-top:4px;"><small>For <strong>Vanity</strong> products the client gets a single fixed mailbox; “Create / Delete mailbox” don’t apply — use “Mailbox settings” + “Change password”.</small></p>
            </div>
            <div class="col-md-4">
                <h5>Storage</h5>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_create_db]" value="on" {if $package_options.allow_create_db eq 'on'}checked{/if}> Create database</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_delete_db]" value="on" {if $package_options.allow_delete_db eq 'on'}checked{/if}> Delete database</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_create_ftp]" value="on" {if $package_options.allow_create_ftp eq 'on'}checked{/if}> Create FTP account</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_file_manager_link]" value="on" {if $package_options.allow_file_manager_link eq 'on'}checked{/if}> File manager SSO link</label></div>
            </div>
            <div class="col-md-4">
                <h5>DNS / SSL / Misc</h5>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_dns_edit]" value="on" {if $package_options.allow_dns_edit eq 'on'}checked{/if}> Edit DNS records</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_external_dns]" value="on" {if $package_options.allow_external_dns eq 'on'}checked{/if}> Allow external-DNS mode (skip our nameservers)</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_ssl_install]" value="on" {if $package_options.allow_ssl_install eq 'on'}checked{/if}> Install SSL certificates</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_cron_jobs]" value="on" {if $package_options.allow_cron_jobs eq 'on'}checked{/if}> Manage cron jobs</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_hosting_settings]" value="on" {if $package_options.allow_hosting_settings eq 'on'}checked{/if}> Web settings (PHP backend template, HTTPS redirect)</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_backups]" value="on" {if $package_options.allow_backups eq 'on'}checked{/if}> Backups (list / create / delete / restore)</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_logs_view]" value="on" {if $package_options.allow_logs_view eq 'on'}checked{/if}> View server logs (apache access/error, exim main)</label></div>
                <div class="checkbox"><label><input type="checkbox" name="packageconfigoption[12][allow_redeploy]" value="on" {if $package_options.allow_redeploy eq 'on'}checked{/if}> Client-side redeploy</label></div>
            </div>
        </div>
    </div>

    <!-- Email mapping (configoption13) — per-event template OVERRIDE --------
         Leave an event blank to use the module's own default template (the one
         created on the "Email templates" tab). Pick a template here only to
         override that default for this product. -->
    <div class="tab-pane" id="puq-tab-email">
        <p class="text-muted"><small>
            For each event, leave blank to send the module's <strong>default</strong> template
            (create them on the <em>Email templates</em> tab), or pick a specific WHMCS template
            to override it for this product.
        </small></p>
        <div class="row">
            {foreach from=['account_ready','vanity_account_ready','deploy_failed','mailbox_created','database_created','ftp_created','ssl_installed','ssl_custom_installed','ssl_custom_expiring_14','ssl_custom_expiring_3','ssl_custom_expired','quota_warning_80','quota_exceeded','dns_zone_deployed','backup_created','backup_restored','backup_failed'] item=evt}
            <div class="col-md-4 form-group">
                <label>{$evt|replace:'_':' '|capitalize}</label>
                <select name="packageconfigoption[13][{$evt}]" class="form-control puq-email-tpl" data-saved="{$package_options.$evt|default:''}">
                    <option value="">— default —</option>
                    {foreach from=$server_options.email_templates item=tpl}
                        <option value="{$tpl}">{$tpl}</option>
                    {/foreach}
                </select>
            </div>
            {/foreach}
        </div>
    </div>

    <!-- Email templates auto-provisioner ------------------------------------
         Creates the WHMCS Product/Service email templates the module sends
         (welcome, vanity welcome with mail credentials + config, ssl, quota,
         backups, …). Two scopes per row + bulk: "Create missing" (never
         touches existing) and "Reset to default" (overwrites body/subject back
         to the shipped default — for when a template was edited and broken). -->
    <div class="tab-pane" id="puq-tab-emailtpl">
        <h5><i class="fa fa-envelope-open-text"></i> Default email templates</h5>
        <p class="text-muted small">
            Creates the WHMCS <strong>Product/Service</strong> email templates this module sends.
            Each notification event uses its default template here unless you override it on the
            <em>Email mapping</em> tab. The <strong>Vanity Welcome</strong> includes the customer's
            site address, mailbox login &amp; password, webmail link and full IMAP/POP3/SMTP setup.
            <br>
            <strong>Create missing</strong> only adds templates that don't exist yet (safe to click
            repeatedly — your edits are kept). <strong>Reset to default</strong> overwrites an
            existing template's subject &amp; body back to the shipped default — use it if a template
            was edited and needs restoring.
        </p>
        <p>
            <button type="button" class="btn btn-success btn-sm" id="puq-emailtpl-create-all"><i class="fa fa-magic"></i> Create all missing</button>
            <button type="button" class="btn btn-warning btn-sm" id="puq-emailtpl-reset-all"><i class="fa fa-undo"></i> Reset all to default</button>
            <button type="button" class="btn btn-default btn-sm" id="puq-emailtpl-refresh"><i class="fa fa-sync"></i> Refresh</button>
            <span id="puq-emailtpl-msg" style="margin-left:10px;font-size:13px;"></span>
        </p>
        <div id="puq-emailtpl-list"><div class="text-muted small">Open this tab to load status…</div></div>
    </div>

    <!-- Config options auto-provisioner ------------------------------------
         Creates the WHMCS Configurable Options the module reads (limits +,
         in vanity, the domain). Idempotent — runs against the addon AJAX
         endpoints cross-page (addonmodules.php). -->
    <div class="tab-pane" id="puq-tab-cfgopts">
        <h5><i class="fa fa-sliders-h"></i> Configurable Options</h5>
        <p class="text-muted small">
            The module reads its per-order limits (and, in Vanity, the parent domain) from WHMCS
            <strong>Configurable Options</strong>, and the customer's name (Vanity) from a product
            <strong>Custom Field</strong> <code>vanity_name</code>. This creates the ones this product
            needs — found by name, missing ones added. Safe to run any number of times;
            existing options and values are never changed. Prices start at 0 — tune them under
            <em>Configurable Options</em> afterwards. The set shown depends on the Deployment mode +
            ticked roles above; for Vanity, the <code>vanity_domain</code> values come from the group's
            Vanity domains.
        </p>
        <p>
            <button type="button" class="btn btn-success btn-sm" id="puq-cfgopts-create"><i class="fa fa-magic"></i> Create / sync missing</button>
            <button type="button" class="btn btn-default btn-sm" id="puq-cfgopts-refresh"><i class="fa fa-sync"></i> Refresh</button>
            <span id="puq-cfgopts-msg" style="margin-left:10px;font-size:13px;"></span>
        </p>
        <div id="puq-cfgopts-list"><div class="text-muted small">Open this tab to load status…</div></div>
    </div>

</div>
