<?php
// ─── SunScope Extra — Dev Pro Unlock ──────────────────────────────────────────
// JSON endpoint for the site owner's own testing. Visiting the app with
// ?dev=<DEV_UNLOCK_TOKEN> triggers a call here; only a matching token flips
// Pro on. Replaces the old bare ?pro=1 trick, which anyone could type in.
//
// Returns {"ok": bool}

require __DIR__ . '/secrets.local.php';

header('Content-Type: application/json');

$token = trim($_GET['token'] ?? $_POST['token'] ?? '');

$ok = $token !== '' && hash_equals(DEV_UNLOCK_TOKEN, $token);

echo json_encode(['ok' => $ok]);