add_action('rest_api_init', function () {

  // 1) LIST: GET {BASE}/?guid=...
  register_rest_route('stripo/v1', '/', [
    'methods'  => 'GET',
    'permission_callback' => '__return_true',
    'callback' => function (WP_REST_Request $req) {
      $guid = sanitize_text_field($req->get_param('guid'));
      // Beispiel: Letzte 50 Attachments aus Mediathek holen (optional: nach $guid filtern)
      $attachments = get_posts([
        'post_type'      => 'attachment',
        'post_status'    => 'inherit',
        'posts_per_page' => 50,
        'orderby'        => 'date',
        'order'          => 'DESC',
      ]);

      $items = [];
      foreach ($attachments as $att) {
        $url  = wp_get_attachment_url($att->ID);
        if (!$url) continue;
        $meta = wp_get_attachment_metadata($att->ID);
        $path = get_attached_file($att->ID);
        $size = ($path && file_exists($path)) ? filesize($path) : 0;
        $width  = is_array($meta) && !empty($meta['width'])  ? (int)$meta['width']  : null;
        $height = is_array($meta) && !empty($meta['height']) ? (int)$meta['height'] : null;

        $items[] = [
          'url'          => $url,
          'originalName' => basename(parse_url($url, PHP_URL_PATH)),
          'uploadTime'   => (int) (get_post_time('U', true, $att->ID) * 1000), // ms
          'size'         => (int) $size,
          'height'       => $height,
          'width'        => $width,
          'thumbnailUrl' => wp_get_attachment_image_url($att->ID, 'thumbnail'),
        ];
      }
      return new WP_REST_Response($items, 200, ['Content-Type' => 'application/json']);
    }
  ]);

  // 2) UPLOAD: POST {BASE}/  (multipart: guid, file)
  register_rest_route('stripo/v1', '/', [
    'methods'  => 'POST',
    'permission_callback' => '__return_true', // ggf. eigene Basic-Auth prüfen!
    'callback' => function (WP_REST_Request $req) {
      if (empty($_FILES['file'])) {
        return new WP_Error('bad_request', 'Missing file', ['status' => 400]);
      }
      require_once ABSPATH . 'wp-admin/includes/file.php';
      require_once ABSPATH . 'wp-admin/includes/media.php';
      require_once ABSPATH . 'wp-admin/includes/image.php';

      // Upload nach /uploads
      $overrides = ['test_form' => false];
      $file = wp_handle_upload($_FILES['file'], $overrides);
      if (isset($file['error'])) {
        return new WP_Error('upload_error', $file['error'], ['status' => 500]);
      }

      // Attachment in Mediathek anlegen
      $wp_filetype = wp_check_filetype($file['file']);
      $attachment_id = wp_insert_attachment([
        'post_mime_type' => $wp_filetype['type'],
        'post_title'     => sanitize_file_name(basename($file['file'])),
        'post_content'   => '',
        'post_status'    => 'inherit'
      ], $file['file']);

      $attach_data = wp_generate_attachment_metadata($attachment_id, $file['file']);
      wp_update_attachment_metadata($attachment_id, $attach_data);

      $url   = wp_get_attachment_url($attachment_id);
      $path  = get_attached_file($attachment_id);
      $size  = ($path && file_exists($path)) ? filesize($path) : 0;
      $width  = !empty($attach_data['width'])  ? (int)$attach_data['width']  : null;
      $height = !empty($attach_data['height']) ? (int)$attach_data['height'] : null;

      // Antwortformat gemäß Stripo
      $payload = [
        'url'          => $url,
        'originalName' => basename($path),
        'uploadTime'   => (int) (current_time('timestamp', true) * 1000), // ms
        'size'         => (int) $size,
        'height'       => $height,
        'width'        => $width,
        'thumbnailUrl' => wp_get_attachment_image_url($attachment_id, 'thumbnail'),
      ];
      return new WP_REST_Response($payload, 200, ['Content-Type' => 'application/json']);
    }
  ]);

  // 3) INFO: GET {BASE}/info?src=...
  register_rest_route('stripo/v1', '/info', [
    'methods'  => 'GET',
    'permission_callback' => '__return_true',
    'callback' => function (WP_REST_Request $req) {
      $src = $req->get_param('src');
      if (!$src || !filter_var($src, FILTER_VALIDATE_URL)) {
        return new WP_Error('bad_request', 'Missing or invalid src', ['status' => 400]);
      }
      $site_host = parse_url(home_url(), PHP_URL_HOST);
      $src_host  = parse_url($src, PHP_URL_HOST);
      if (!hash_equals($site_host, $src_host)) {
        return new WP_Error('forbidden', 'Foreign host not allowed', ['status' => 403]);
      }
      $originalName = basename(parse_url($src, PHP_URL_PATH));
      $sizeBytes = 0; $width = null; $height = null; $mime = null;