Changeset 3663491

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/assets/dist/.vite/manifest.json

-              r3549389
+              r3663491
   },
   "assets/src/main.tsx": {
     "file": "assets/main-CPlqEen8.js",
+    "file": "assets/main-V9rY9XMr.js",
     "name": "main",
     "src": "assets/src/main.tsx",
     "isEntry": true,
     "css": [
       "assets/main-DuaYQxSj.css"
+      "assets/main-D5Lgb2qa.css"
     ],
     "assets": [

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Admin.php

-              r3549389
+              r3663491
                         'wcabe-g2',
                         [ $this, 'render_page' ]
+                );
+        }
+        /**
+         * Add a shortcut to the Bulk Edit page in the WordPress admin bar.
+         *
+         * Gated by the per-user `showAdminBarShortcut` setting (default on) and the
+         * `manage_woocommerce` capability. Fires in both admin and front-end contexts
+         * wherever the admin bar renders for a capable user.
+         *
+         * @param \WP_Admin_Bar $admin_bar The admin bar instance.
+         */
+        public function add_admin_bar_link( \WP_Admin_Bar $admin_bar ): void {
+                if ( ! current_user_can( 'manage_woocommerce' ) ) {
+                        return;
+                }
+                $settings = REST\User_Settings_Controller::get_all();
+                if ( empty( $settings['showAdminBarShortcut'] ) ) {
+                        return;
+                }
+                $admin_bar->add_node(
+                        [
+                                'id'    => 'wcabe-g2-shortcut',
+                                'title' => '<span class="ab-icon dashicons dashicons-edit" aria-hidden="true"></span><span class="ab-label">'
+                                        . esc_html__( 'Bulk Edit Products', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        . '</span>',
+                                'href'  => admin_url( 'admin.php?page=wcabe-g2' ),
+                                'meta'  => [
+                                        'title' => __( 'WPMelon Advanced Bulk Edit for WooCommerce', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                ],
+                        ]
                 );
+        }
 …
                         'dimensionUnit'     => get_option( 'woocommerce_dimension_unit', 'cm' ),
                         'isPro'             => defined( 'WCABE_G2_PRO' ) && WCABE_G2_PRO,
+                        'cogsEnabled'       => Helpers\Product_Helper::is_cogs_enabled(),
+                        // URL protocols the server will accept for the Product URL field.
+                        // Localized rather than hardcoded client-side because
+                        // wp_allowed_protocols() is filterable — a site that adds a scheme must
+                        // not have the client reject it before the request reaches the
+                        // authoritative server-side check.
+                        'allowedProtocols'  => array_values( wp_allowed_protocols() ),
                         'operationsLimit'   => REST\Operations_Controller::OPERATIONS_LIMIT,
+                        // Server-authoritative page-size ceiling. The client clamps every page
+                        // size (picker, custom input, view apply, dirty baselines) to this, so a
+                        // site that LOWERS wcabe_g2_max_per_page never shows a size the products
+                        // route would silently reduce.
+                        'maxPageSize'       => Helpers\Page_Size_Helper::get_max(),
+                        // Variable-capable type slugs ('variable' + registered WC_Product_Variable
+                        // subclasses, e.g. 'variable-subscription') so the frontend's expand /
+                        // "Varies" / variation gates match the backend's (#137).
+                        'variableProductTypes' => Services\Product_Service::get_variable_product_types(),
                         'attributesSchema'  => Services\Attribute_Service::get_attribute_schema(),
+                        // Shipping classes as [ slug, name ]. Localized rather than fetched
+                        // because the grid cell editor, the bulk-edit field and the paste
+                        // resolver all need the vocabulary synchronously, before any request
+                        // resolves. The filter panel's copy arrives via GET /filters.
+                        'shippingClasses'   => Helpers\Product_Helper::get_shipping_class_terms(),
                         'pluginSettings'    => REST\Settings_Controller::get_all(),
                         'userSettings'      => REST\User_Settings_Controller::get_all(),
+                        // Sync cursor (transport, not a setting) so the client seeds its _rev counter
+                        // above the last persisted value — see get_stored_rev()/store/ui.ts (review #4).
+                        'userSettingsRev'   => REST\User_Settings_Controller::get_stored_rev(),
                 ];
 …
                         'wcabe-g2-admin',
                         $dist_url . $entry['file'],
                         [ 'wp-element', 'wp-i18n' ],
+                        [ 'wp-element', 'wp-i18n', 'wp-api-fetch' ],
                         WCABE_G2_VERSION,
                         true

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Handlers/Attribute_Handler.php

-              r3549389
+              r3663491
         /**
+         * Ensure term maps are populated. Lazy fallback for contexts
+         * where before_format_products doesn't fire (batch_update, get_variations).
+         * Ensure term maps are populated. Lazy fallback for contexts where
+         * before_format_products doesn't fire (get_variations).
+         *
+         * batch_update() DOES fire it now, from its phase-2 formatting block — do not "clean up"
+         * that do_action on the assumption this fallback covers it.
          */
         private function ensure_term_maps(): void {

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Handlers/Attribute_Save_Handler.php

-              r3549389
+              r3663491
          */
         public function validate_attribute_fields( array $errors, \WC_Product $product, array $changes ): array {
+                // Parent products only. Variation attribute selections are owned by Pro's
+                // variation handler (#131); guard here so this parent handler never processes
+                // a variation even once Pro adds attr_* to the variation allowlist (the
+                // handler builds WC_Product_Attribute objects, which is wrong for variations).
+                if ( $product instanceof \WC_Product_Variation ) {
+                        return $errors;
+                }
                 $lookup = self::get_field_lookup();
 …
          */
         public function save_attribute_fields( \WC_Product $product, array $changes, array $allowed_fields ): void {
+                // Parent products only — see validate_attribute_fields(). Pro's variation
+                // handler persists variation attribute selections (#131).
+                if ( $product instanceof \WC_Product_Variation ) {
+                        return;
+                }
                 $this->new_terms_created = false;
                 $lookup     = self::get_field_lookup();

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Helpers/Product_Helper.php

-              r3549389
+              r3663491
         /**
+         * Request-level cache of the shipping class term list.
+         *
+         * @var array|null
+         */
+        private static $shipping_classes_cache = null;
+        /**
+         * Every shipping class on the site, as [ 'slug' => ..., 'name' => ... ].
+         *
+         * Sorted by name, empty classes included — this is a picker list, not a
+         * report. No 'count': WooCommerce registers product_shipping_class for
+         * variations as well as products, so a term whose only users are variations
+         * carries count > 0 while the (deliberately parent-level) shipping class
+         * filter returns nothing for it. Shipping a number that contradicts the
+         * filter is worse than shipping no number.
+         *
+         * @return array<int, array{slug: string, name: string}>
+         */
+        public static function get_shipping_class_terms(): array {
+                self::register_shipping_class_hooks();
+                if ( null !== self::$shipping_classes_cache ) {
+                        return self::$shipping_classes_cache;
+                }
+                $terms = get_terms( [
+                        'taxonomy'   => 'product_shipping_class',
+                        'hide_empty' => false,
+                        'orderby'    => 'name',
+                ] );
+                if ( is_wp_error( $terms ) || empty( $terms ) ) {
+                        self::$shipping_classes_cache = [];
+                        return [];
+                }
+                $result = [];
+                foreach ( $terms as $term ) {
+                        $result[] = [
+                                'slug' => $term->slug,
+                                'name' => wp_specialchars_decode( $term->name ),
+                        ];
+                }
+                self::$shipping_classes_cache = $result;
+                return $result;
+        }
+        /**
+         * A product's OWN shipping class slug, or '' when it has none.
+         *
+         * 'edit' context is load-bearing, and get_shipping_class() must never be
+         * substituted here. That getter resolves through get_shipping_class_id() in
+         * default (view) context, and WC_Product_Variation::get_shipping_class_id()
+         * falls back to the PARENT's class in view context. A variation that
+         * inherits would then display the parent's class as though it were its own,
+         * the user would "change" a value that was never set, and the diff engine
+         * would compare against a value the variation does not store. '' here means
+         * exactly "this row stores no class of its own" — rendered as "Same as
+         * parent" on variations and "No shipping class" on parents.
+         *
+         * @param \WC_Product $product
+         * @return string Term slug, or '' when unset (or the term has been deleted).
+         */
+        public static function get_shipping_class_slug( \WC_Product $product ): string {
+                $term_id = (int) $product->get_shipping_class_id( 'edit' );
+                if ( $term_id <= 0 ) {
+                        return '';
+                }
+                $term = get_term( $term_id, 'product_shipping_class' );
+                if ( ! $term || is_wp_error( $term ) ) {
+                        return '';
+                }
+                return (string) $term->slug;
+        }
+        /**
+         * Clear the request-level shipping class cache.
+         *
+         * Also the callback registered on the term CRUD hooks below, so the cache
+         * self-invalidates whenever a shipping class is created, renamed, or
+         * deleted — a request that lists classes, creates one, then lists again
+         * (or a test suite that creates a term as a fixture) sees it immediately,
+         * with no manual clear to remember. Still exposed publicly for tests that
+         * insert terms directly via wp_insert_term() outside any of those hooks'
+         * normal request lifecycle (e.g. across PHPUnit test classes sharing one
+         * process, where fixtures roll back but this static would otherwise not).
+         */
+        public static function clear_shipping_class_cache(): void {
+                self::$shipping_classes_cache = null;
+        }
+        /**
+         * Wire up cache invalidation on shipping-class term CRUD.
+         *
+         * Called unconditionally on every get_shipping_class_terms() rather than
+         * behind an "already registered" flag: WP_UnitTestCase snapshots $wp_filter
+         * before the first test and restores that snapshot after EVERY test's
+         * tearDown, silently stripping any add_action() call made mid-test. A
+         * once-only static flag would go stale the moment that happens — it would
+         * report "registered" while the underlying hook was actually gone. Calling
+         * add_action() every time is cheap and safe: WP_Hook computes the same
+         * identity string for this array callback on every call, so re-adding it
+         * overwrites the same slot rather than creating a duplicate.
+         */
+        private static function register_shipping_class_hooks(): void {
+                add_action( 'create_product_shipping_class', [ self::class, 'clear_shipping_class_cache' ] );
+                add_action( 'edited_product_shipping_class', [ self::class, 'clear_shipping_class_cache' ] );
+                add_action( 'delete_product_shipping_class', [ self::class, 'clear_shipping_class_cache' ] );
+        }
+        /**
+         * Whether WooCommerce's Cost of Goods Sold feature is enabled.
+         *
+         * Intentionally NOT memoized: the underlying option already lives in WP's
+         * alloptions cache, so repeated calls are cheap, and a static cache would
+         * go stale when the option is toggled within a single request (e.g. tests).
+         * Callers must gate WC's get_cogs_value()/set_cogs_value() on this — those
+         * methods emit wc_doing_it_wrong() when the feature is disabled.
+         *
+         * @return bool
+         */
+        public static function is_cogs_enabled(): bool {
+                return class_exists( '\Automattic\WooCommerce\Utilities\FeaturesUtil' )
+                        && \Automattic\WooCommerce\Utilities\FeaturesUtil::feature_is_enabled( 'cost_of_goods_sold' );
+        }
+        /**
+         * Upload date of an image attachment, or '' when there is no usable image.
+         *
+         * The single source of truth for the "Image uploaded" value: the grid/CSV
+         * cell, the per-variation filter predicate, and the SQL filter must all agree
+         * on which _thumbnail_id values count. A stale ID (deleted attachment) or one
+         * pointing at a non-attachment post yields '' here, mirroring the query's
+         * post_type = 'attachment' join gate.
+         *
+         * @param int $image_id Attachment ID from _thumbnail_id.
+         * @return string 'Y-m-d H:i:s' in site time, or '' when unusable.
+         */
+        public static function get_image_upload_date( int $image_id ): string {
+                if ( $image_id <= 0 || 'attachment' !== get_post_type( $image_id ) ) {
+                        return '';
+                }
+                // 'raw' context — the SQL filter compares the raw post_date column, and
+                // display context would run the post_date filter, breaking that parity.
+                return (string) get_post_field( 'post_date', $image_id, 'raw' );
+        }
+        /**
          * Format a WC_Product into a flat array for the grid.
+         *
          * @param \WC_Product $product
+         * @param array|null  $ref_map Pre-resolved upsell/cross-sell descriptors from
+         *                             build_product_ref_map(). Every multi-item caller MUST
+         *                             pass one — omitting it resolves this product's refs on
+         *                             its own, which inside a loop is an N+1. Null is for the
+         *                             genuine singleton (Operations_Service::create_product).
          * @return array
          */
         public static function format_product( \WC_Product $product ): array {
+        public static function format_product( \WC_Product $product, ?array $ref_map = null ): array {
                 $image_id = $product->get_image_id();
                 $thumbnail_url = $image_id
 …
                         : '';
+                // instanceof, not is_type('variable'): third-party variable subclasses
+                // (variable-subscription, …) carry countable variations too (#137). The
+                // count doubles as the frontend's expand/interleave signal.
                 $variation_count = 0;
                 if ( $product->is_type( 'variable' ) ) {
+                if ( $product instanceof \WC_Product_Variable ) {
                         $variation_count = count( $product->get_children() );
+                }
 …
                 $tags = self::resolve_term_names( $product->get_tag_ids(), 'product_tag' );
                 // Sale dates — not on variable parents.
+                // Sale dates — not on variable parents (incl. variable subclasses).
                 $date_on_sale_from = '';
                 $date_on_sale_to   = '';
                 if ( ! $product->is_type( 'variable' ) ) {
+                if ( ! $product instanceof \WC_Product_Variable ) {
                         $from = $product->get_date_on_sale_from();
                         $to   = $product->get_date_on_sale_to();
 …
                         $date_on_sale_to   = $to ? $to->date( 'Y-m-d' ) : '';
+                }
+                // Publish date (post_date) and last-modified (post_modified). Present on
+                // every product post regardless of type. Full date-time (Y-m-d H:i:s) in
+                // site timezone, matching WooCommerce's native date_created/date_modified
+                // (a WC_DateTime backed by the post_date DATETIME column).
+                $created  = $product->get_date_created();
+                $modified = $product->get_date_modified();
                 $gallery_ids  = $product->get_gallery_image_ids();
 …
                                 $gallery_urls[] = $url ?: '';
+                        }
+                }
+                // Linked products. 'edit' context — the view getters run through
+                // woocommerce_product_get_upsell_ids, and the grid writes this value straight
+                // back, so a third-party projection would overwrite the stored list.
+                $upsell_ids     = array_map( 'intval', $product->get_upsell_ids( 'edit' ) );
+                $cross_sell_ids = array_map( 'intval', $product->get_cross_sell_ids( 'edit' ) );
+                if ( null === $ref_map ) {
+                        $ref_map = self::resolve_product_ref_ids( array_merge( $upsell_ids, $cross_sell_ids ) );
+                }
 …
                         'categories'             => $categories,
                         'tags'                   => $tags,
+                        // Linked products (WooCommerce upsells / cross-sells). Ordered — WC renders
+                        // them in stored order — so never rebuild these from a set. Parent-only:
+                        // deliberately omitted from format_variation().
+                        'upsell_ids'             => self::project_product_refs( $upsell_ids, $ref_map ),
+                        'cross_sell_ids'         => self::project_product_refs( $cross_sell_ids, $ref_map ),
                         'description'            => $product->get_description(),
                         'short_description'      => $product->get_short_description(),
 …
                         'downloadable'           => $product->get_downloadable(),
                         'backorders'             => $product->get_backorders(),
+                        // Cost of Goods (WooCommerce native COGS). Getter only when the
+                        // feature is on — it emits wc_doing_it_wrong() otherwise. Key is
+                        // always present (null when off) so the TS type stays non-optional.
+                        'cogs_value'             => self::is_cogs_enabled() ? $product->get_cogs_value() : null,
+                        // Publish date (post_date) and last-modified (post_modified), full date-time
+                        // (Y-m-d H:i:s, site timezone). Editable "Published on" + read-only
+                        // "Modified on". Parent products only — deliberately omitted from
+                        // format_variation() (blank on variation rows).
+                        'date_created'           => $created ? $created->date( 'Y-m-d H:i:s' ) : '',
+                        'date_modified'          => $modified ? $modified->date( 'Y-m-d H:i:s' ) : '',
+                        // Featured image upload date (the attachment's post_date). Read-only
+                        // display + export + the "Image uploaded" filter. '' when the product
+                        // has no image, or _thumbnail_id is stale / not an attachment.
+                        // 'edit' context deliberately, unlike $image_id above: the SQL filter
+                        // reads raw _thumbnail_id, so a plugin hooking
+                        // woocommerce_product_get_image_id (placeholder images, multilingual
+                        // media mapping) must not make this date diverge from what the filter
+                        // matches. thumbnail_url stays view-context — it renders whatever WC
+                        // would display.
+                        'image_date'             => self::get_image_upload_date( (int) $product->get_image_id( 'edit' ) ),
+                        // Menu order (native wp_posts.menu_order). Signed integer, default 0.
+                        'menu_order'             => (int) $product->get_menu_order(),
+                        // Button text (External/Affiliate products' add-to-cart button label).
+                        // The getter only exists on WC_Product_External; every other type
+                        // emits '' so the key is always present (VariesRenderer shows a dash).
+                        'button_text'            => $product instanceof \WC_Product_External ? $product->get_button_text() : '',
+                        // Product URL (External/Affiliate products' destination link). Like
+                        // button_text, the getter only exists on WC_Product_External; every
+                        // other type emits '' so the key is always present.
+                        // 'edit' context deliberately: view context runs third-party
+                        // woocommerce_product_get_product_url filters, and the SQL filter
+                        // matches the raw stored _product_url meta — a filtered display value
+                        // would make the editable grid value diverge from what the filter
+                        // finds. (WC's getter wraps esc_url_raw() in both contexts.)
+                        'product_url'            => $product instanceof \WC_Product_External ? $product->get_product_url( 'edit' ) : '',
+                        // Shipping class slug ('' = none). Slug rather than term ID because
+                        // WooCommerce's own shipping_class query var matches on slug, so the
+                        // grid, the filter, the save payload and the CSV all speak one format.
+                        'shipping_class'         => self::get_shipping_class_slug( $product ),
                 ];
 …
         /**
          * Resolve term IDs to [ id, name ] arrays via a single get_terms query.
+         *
+         * Public so Pro's history reader can reuse the same resolution (including
+         * the empty-include and hide_empty=false guards) for its term-name display
+         * metadata.
+         *
          * @param int[]  $term_ids
 …
          * @return array Array of [ 'id' => int, 'name' => string ].
          */
         private static function resolve_term_names( array $term_ids, string $taxonomy ): array {
+        public static function resolve_term_names( array $term_ids, string $taxonomy ): array {
                 if ( empty( $term_ids ) ) {
                         return [];
 …
         /**
+         * Human-readable display name for a variation ("Parent – Blue, Large").
+         *
+         * WC stores just the parent title in post_title for variations, so we append
+         * attribute values ourselves. If a custom title has been set on the variation
+         * that differs from the parent, respect it.
+         *
+         * Deliberately NOT WC's get_formatted_name(): that returns HTML (it embeds a
+         * "#<id>" and a <span class="description"> block), which must never reach a
+         * JSON response. Shared by format_variation() and resolve_product_ref_ids()
+         * so a variation reads the same everywhere it is named.
+         *
+         * @param \WC_Product_Variation $variation
+         * @return string Plain text, not HTML. Not yet specialchars-decoded.
+         */
+        public static function variation_display_name( \WC_Product_Variation $variation ): string {
+                $parent_title    = get_the_title( $variation->get_parent_id() );
+                $variation_title = $variation->get_title();
+                if ( '' !== $variation_title && $variation_title !== $parent_title ) {
+                        return $variation_title;
+                }
+                $attrs = $variation->get_attributes();
+                ksort( $attrs );
+                $term_names = [];
+                foreach ( $attrs as $taxonomy => $slug ) {
+                        if ( '' === $slug ) {
+                                continue; // Skip "Any" attributes.
+                        }
+                        $term = get_term_by( 'slug', $slug, $taxonomy );
+                        if ( $term && ! is_wp_error( $term ) ) {
+                                $term_names[] = $term->name;
+                        } else {
+                                $term_names[] = $slug;
+                        }
+                }
+                $name = $parent_title;
+                if ( ! empty( $term_names ) ) {
+                        $name .= ' – ' . implode( ', ', $term_names );
+                }
+                return $name;
+        }
+        /**
+         * Normalise a list of product/variation IDs: positive ints only, deduped
+         * (FIRST occurrence wins), caller order preserved, optionally clamped.
+         *
+         * intval + "> 0", NOT absint: absint( -7 ) is 7, which would silently read the
+         * wrong product. The REST layer sanitises through this for the same reason.
+         *
+         * $limit clamps AFTER normalisation, deliberately. Clamping the raw input first
+         * would let duplicates or junk in the leading entries eat the budget —
+         * [5,5,5,7,9] with a limit of 3 must yield [5,7,9], not [5].
+         *
+         * @param int[]    $ids
+         * @param int|null $limit Optional cap, applied to the normalised list.
+         * @return int[]
+         */
+        public static function normalize_product_ids( array $ids, ?int $limit = null ): array {
+                $ids = array_values( array_unique( array_filter( array_map( 'intval', $ids ), static fn( $id ) => $id > 0 ) ) );
+                if ( null !== $limit ) {
+                        $ids = array_slice( $ids, 0, max( 0, $limit ) );
+                }
+                return $ids;
+        }
+        /**
+         * Drop WordPress's in-process object cache, if the active backend supports it.
+         *
+         * Long export loops prime post/meta/term caches on every page and nothing ever
+         * evicts them, so the runtime cache becomes the dominant memory consumer once
+         * row accumulation is gone. Each page re-primes what it needs, so dropping the
+         * in-process layer between chunks is safe — it costs a few re-priming queries
+         * per chunk and bounds memory in exchange.
+         *
+         * Three-tier guard. wp_cache_flush_runtime() exists as a compat shim from WP 6.0,
+         * but it emits _doing_it_wrong() and returns false when the active object-cache
+         * drop-in doesn't support it — and wp_cache_supports() itself only exists from
+         * WP 6.1. So: ask wp_cache_supports() when it is available; on 6.0 call the
+         * function only for the core default cache, which does support it; otherwise
+         * skip. This is an optimisation, never worth a _doing_it_wrong() notice.
+         */
+        public static function flush_runtime_cache(): void {
+                if ( function_exists( 'wp_cache_supports' ) ) {
+                        if ( wp_cache_supports( 'flush_runtime' ) ) {
+                                wp_cache_flush_runtime();
+                        }
+                        return;
+                }
+                if ( function_exists( 'wp_cache_flush_runtime' ) && ! wp_using_ext_object_cache() ) {
+                        wp_cache_flush_runtime();
+                }
+        }
+        /**
+         * Normalise a list of product/variation IDs and prime every cache a read of them needs.
+         *
+         * Two primes, not one. The first covers the ids themselves (posts + meta for _sku + terms
+         * for product_type). The second covers the PARENTS of any variation in the list: a
+         * variation is named from its parent's title, so without this each variation's
+         * get_the_title( parent ) is an individual query.
+         *
+         * Normalisation (positive-int filter, dedupe, clamp-after-dedupe) is delegated to
+         * normalize_product_ids() — see that method for why absint is wrong here and why
+         * $limit is applied last.
+         *
+         * @param int[]    $ids
+         * @param int|null $limit Optional cap, applied to the normalised list.
+         * @return int[] The normalised, deduped, positive ids, in first-occurrence order.
+         */
+        public static function prime_product_caches( array $ids, ?int $limit = null ): array {
+                $ids = self::normalize_product_ids( $ids, $limit );
+                if ( empty( $ids ) ) {
+                        return [];
+                }
+                _prime_post_caches( $ids, true, true );
+                $parent_ids = [];
+                foreach ( $ids as $id ) {
+                        $post = get_post( $id );
+                        if ( $post && 'product_variation' === $post->post_type && $post->post_parent ) {
+                                $parent_ids[] = (int) $post->post_parent;
+                        }
+                }
+                $parent_ids = array_values( array_diff( array_unique( $parent_ids ), $ids ) );
+                if ( ! empty( $parent_ids ) ) {
+                        _prime_post_caches( $parent_ids, true, true );
+                }
+                return $ids;
+        }
+        /**
+         * Resolve a flat list of product IDs into upsell/cross-sell ref descriptors.
+         *
+         * Deliberately does NOT construct a WC_Product per ID. wc_get_product() runs the
+         * full data-store read — and for variable parents that means get_children(), a DB
+         * query each. Measured on a 100-row page: wc_get_product()-per-ref costs ~227
+         * queries; reading the primed post cache instead costs 0 for product refs. Only
+         * variation refs fall back to wc_get_product(), because naming them needs their
+         * attribute terms; that cost saturates (WP's term cache amortizes a store's small
+         * attribute vocabulary), so it is bounded by vocabulary, not by ref count.
+         *
+         * post_type is checked explicitly: the write path stores any positive ID without an
+         * existence check (dead refs are preserved by design — see Product_Service::
+         * normalize_product_refs), so a list can legitimately hold a page or post ID from a
+         * bad import or a paste. Without this gate get_post() would return a valid WP_Post
+         * and we would render that page as a simple product.
+         *
+         * @param int[] $ids
+         * @return array<int, array> Map of id => [ id, name, sku, type, status, missing ].
+         */
+        public static function resolve_product_ref_ids( array $ids ): array {
+                $ids = self::prime_product_caches( $ids );
+                if ( empty( $ids ) ) {
+                        return [];
+                }
+                $map = [];
+                foreach ( $ids as $id ) {
+                        $post = get_post( $id );
+                        if ( ! $post || ! in_array( $post->post_type, [ 'product', 'product_variation' ], true ) ) {
+                                $map[ $id ] = self::missing_product_ref( $id );
+                                continue;
+                        }
+                        if ( 'product_variation' === $post->post_type ) {
+                                $variation = wc_get_product( $id );
+                                if ( ! $variation instanceof \WC_Product_Variation ) {
+                                        $map[ $id ] = self::missing_product_ref( $id );
+                                        continue;
+                                }
+                                $map[ $id ] = [
+                                        'id'      => $id,
+                                        'name'    => wp_specialchars_decode( self::variation_display_name( $variation ) ),
+                                        // 'edit' context: a SKU-less variation must resolve to its OWN (empty) SKU,
+                                        // never the parent's. WC_Product_Variation::get_sku() inherits the parent SKU
+                                        // in view context, so the default read would export the parent's SKU for the
+                                        // variation — and WC import maps that SKU back to the PARENT, silently
+                                        // retargeting the link from variation to parent. The inherited SKU also feeds
+                                        // the picker chips, so a chip search for the shown SKU would find the parent.
+                                        // Matches the plain-product arm below, which reads raw _sku meta for the same
+                                        // persistence-safety.
+                                        'sku'     => (string) $variation->get_sku( 'edit' ),
+                                        'type'    => 'variation',
+                                        'status'  => $post->post_status,
+                                        'missing' => false,
+                                ];
+                                continue;
+                        }
+                        // Plain product — read straight off the primed caches. No WC_Product.
+                        $terms = get_the_terms( $id, 'product_type' );
+                        $type  = ( $terms && ! is_wp_error( $terms ) ) ? $terms[0]->slug : 'simple';
+                        $map[ $id ] = [
+                                'id'      => $id,
+                                'name'    => wp_specialchars_decode( $post->post_title ),
+                                'sku'     => (string) get_post_meta( $id, '_sku', true ),
+                                'type'    => $type,
+                                'status'  => $post->post_status,
+                                'missing' => false,
+                        ];
+                }
+                return $map;
+        }
+        /**
+         * Gather the distinct upsell/cross-sell union OWNED BY these products, and resolve it.
+         *
+         * Note the direction: this takes OWNERS and returns descriptors for the products they
+         * point AT. Do not use it to resolve an arbitrary list of IDs (e.g. search results) —
+         * that is resolve_product_ref_ids(), and passing search hits here would hand back each
+         * hit's upsells instead of the hit itself.
+         *
+         * Reads 'edit' context: the default view getters run through
+         * woocommerce_product_get_upsell_ids, which third-party code can filter. The grid
+         * round-trips this value straight back into a write (open picker → add one → Apply),
+         * so a filtered projection would silently overwrite the stored list.
+         *
+         * @param \WC_Product[] $owners
+         * @return array<int, array> Map of id => ref descriptor.
+         */
+        public static function build_product_ref_map( array $owners ): array {
+                $ref_ids = [];
+                foreach ( $owners as $owner ) {
+                        if ( ! $owner instanceof \WC_Product || $owner->is_type( 'variation' ) ) {
+                                continue; // Variations do not own these fields.
+                        }
+                        foreach ( $owner->get_upsell_ids( 'edit' ) as $ref_id ) {
+                                $ref_ids[] = (int) $ref_id;
+                        }
+                        foreach ( $owner->get_cross_sell_ids( 'edit' ) as $ref_id ) {
+                                $ref_ids[] = (int) $ref_id;
+                        }
+                }
+                if ( empty( $ref_ids ) ) {
+                        return []; // Stores that don't use these fields pay nothing.
+                }
+                return self::resolve_product_ref_ids( $ref_ids );
+        }
+        /**
+         * Descriptor for a ref whose target no longer exists (or was never a product).
+         *
+         * @param int $id
+         * @return array
+         */
+        private static function missing_product_ref( int $id ): array {
+                return [
+                        'id'      => $id,
+                        'name'    => null,
+                        'sku'     => null,
+                        'type'    => null,
+                        'status'  => null,
+                        'missing' => true,
+                ];
+        }
+        /**
+         * Project an ordered ID list onto a ref map, preserving order.
+         *
+         * @param int[] $ids
+         * @param array $ref_map
+         * @return array[]
+         */
+        private static function project_product_refs( array $ids, array $ref_map ): array {
+                return array_values( array_map(
+                        static fn( int $id ) => $ref_map[ $id ] ?? self::missing_product_ref( $id ),
+                        $ids
+                ) );
+        }
+        /**
          * Format a WC_Product_Variation into a flat array for the grid.
+         *
 …
                 $to   = $variation->get_date_on_sale_to();
+                // Build variation display name.
+                // WC stores just the parent title in post_title for variations, so we
+                // append attribute values ourselves. If a custom title has been set on
+                // the variation that differs from the parent, respect it.
+                $parent_title    = get_the_title( $variation->get_parent_id() );
+                $variation_title = $variation->get_title();
+                if ( '' !== $variation_title && $variation_title !== $parent_title ) {
+                        $name = $variation_title;
+                } else {
+                        $attrs = $variation->get_attributes();
+                        ksort( $attrs );
+                        $term_names = [];
+                        foreach ( $attrs as $taxonomy => $slug ) {
+                                if ( '' === $slug ) {
+                                        continue; // Skip "Any" attributes.
+                                }
+                                $term = get_term_by( 'slug', $slug, $taxonomy );
+                                if ( $term && ! is_wp_error( $term ) ) {
+                                        $term_names[] = $term->name;
+                                } else {
+                                        $term_names[] = $slug;
+                                }
+                        }
+                        $name = $parent_title;
+                        if ( ! empty( $term_names ) ) {
+                                $name .= ' – ' . implode( ', ', $term_names );
+                        }
+                }
+                $name = self::variation_display_name( $variation );
                 $data = [
 …
                         'downloadable'           => $variation->get_downloadable(),
                         'backorders'             => $variation->get_backorders(),
+                        // Cost of Goods — variation's own defined value (null = inherit
+                        // parent). Getter only when the feature is on (see format_product).
+                        'cogs_value'             => self::is_cogs_enabled() ? $variation->get_cogs_value() : null,
+                        // Menu order (native wp_posts.menu_order) — the variation's sort
+                        // position within its parent. Signed integer, default 0.
+                        'menu_order'             => (int) $variation->get_menu_order(),
+                        // Featured image upload date. DELIBERATELY present on variations,
+                        // unlike date_created/date_modified which are parent-only: a variation
+                        // owns its own _thumbnail_id, and the "Image uploaded" filter narrows
+                        // variation rows by it. Do not "align" this with the other date fields.
+                        'image_date'             => self::get_image_upload_date( (int) $image_id ),
+                        // Shipping class — the variation's OWN class. '' means "Same as
+                        // parent", which is why get_shipping_class_slug() reads edit context:
+                        // WC's view-context getter would inherit the parent's class here and
+                        // make every inheriting variation look like it stores an override.
+                        'shipping_class'         => self::get_shipping_class_slug( $variation ),
                 ];

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Main.php

-              r3549389
+              r3663491
                 $admin = new Admin();
                 add_action( 'admin_menu', [ $admin, 'register_menu' ] );
+                add_action( 'admin_bar_menu', [ $admin, 'add_admin_bar_link' ], 99 );
                 add_action( 'rest_api_init', [ $this, 'register_rest_routes' ] );
 …
                 // Debug tracing — appends server metrics to REST responses when enabled.
                 new Handlers\Debug_Trace_Handler();
+                // WordPress save-hook compatibility — Free feature, controlled by plugin setting.
+                new Handlers\WP_Save_Hooks_Handler();
+        }

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/REST/Export_Controller.php

-              r3549389
+              r3663491
 use WCABE_G2\Helpers\Product_Helper;
 use WCABE_G2\Services\Export_Service;
+use WCABE_G2\Services\Filter_Service;
 use WCABE_G2\Services\Product_Service;
+use WCABE_G2\Services\View_Service;
 defined( 'ABSPATH' ) || exit;
 …
                                                 'default'           => [],
                                                 'items'             => [ 'type' => 'integer' ],
+                                                // NOT absint: absint( -7 ) is 7, which would export an unrelated
+                                                // product. Normalising here keeps the route consistent with the
+                                                // service contract (positive ints, deduped, first occurrence wins).
                                                 'sanitize_callback' => function ( $value ) {
                                                         if ( ! is_array( $value ) ) {
                                                                 return [];
+                                                        }
                                                         return array_filter( array_map( 'absint', $value ) );
+                                                        return Product_Helper::normalize_product_ids( $value );
                                                 },
                                         ],
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'search_name_mode'   => [
+                                                'description'       => __( 'Title match mode: all (every word, default), any (any word), or phrase (exact phrase).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'default'           => 'all',
+                                                'enum'              => Product_Service::TITLE_SEARCH_MODES,
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                         'search_sku'         => [
+                                                'description'       => __( 'Search by SKU. Comma-separated for exact match.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                /* translators: %d: maximum number of comma-separated SKU values. */
+                                                'description'       => sprintf( __( 'Search by SKU. Comma-separate multiple values to match any of them under the selected mode (capped at %d values).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ), Product_Service::SKU_SEARCH_MAX_TOKENS ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'search_sku_mode'    => [
+                                                'description'       => __( 'SKU match mode: contains, is_exactly, not_contains, starts_with, or ends_with. Comma-separated values match any of them (none of them for not_contains). Omit or send an empty string for the legacy behaviour: comma-separated = exact, single value = partial.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'default'           => '',
+                                                'enum'              => array_merge( [ '' ], Product_Service::SKU_SEARCH_MODES ),
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'product_url_operator' => [
+                                                'description'       => __( 'Product URL filter operator.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'default'           => 'contains',
+                                                'enum'              => Product_Service::PRODUCT_URL_OPERATORS,
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'product_url_value'  => [
+                                                'description'       => __( 'Product URL filter value (substring).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                // NOT sanitize_text_field: it strips percent-encoded octets.
+                                                'sanitize_callback' => [ View_Service::class, 'sanitize_url_filter_value' ],
                                         ],
                                         'category'           => [
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'tag'                => [
+                                                'description'       => __( 'Comma-separated tag term IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                         'type'               => [
                                                 'description'       => __( 'Comma-separated product types.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'shipping_class'     => [
+                                                // No sanitize_callback: sanitize_text_field() strips percent-encoded
+                                                // octets, which is exactly how WP stores non-ASCII term slugs
+                                                // (sanitize_title() -> utf8_uri_encode()). That would silently
+                                                // reduce e.g. a Cyrillic class's slug to '', match-noning every
+                                                // export for it. Filter_Service::apply_shipping_class_param() is
+                                                // the real sanitizer — sanitize_title() per comma-separated token.
+                                                'description' => __( 'Comma-separated shipping class slugs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'        => 'string',
+                                        ],
                                         'price_min'          => [
                                                 'description'       => __( 'Minimum price.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'menu_order_min'     => [
+                                                'description'       => __( 'Minimum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => function ( $value ) {
+                                                        if ( '' === $value ) {
+                                                                return true;
+                                                        }
+                                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                                'rest_invalid_param',
+                                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                                        );
+                                                },
+                                        ],
+                                        'menu_order_max'     => [
+                                                'description'       => __( 'Maximum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => function ( $value ) {
+                                                        if ( '' === $value ) {
+                                                                return true;
+                                                        }
+                                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                                'rest_invalid_param',
+                                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                                        );
+                                                },
+                                        ],
+                                        'cogs_min'           => [
+                                                'description'       => __( 'Minimum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'cogs_max'           => [
+                                                'description'       => __( 'Maximum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                         'manage_stock'       => [
                                                 'description'       => __( 'Comma-separated manage stock values (yes, no).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                         'date_modified_before' => [
                                                 'description'       => __( 'Filter products modified on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_start_after' => [
+                                                'description'       => __( 'Filter products whose sale starts on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_start_before' => [
+                                                'description'       => __( 'Filter products whose sale starts on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_end_after' => [
+                                                'description'       => __( 'Filter products whose sale ends on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_end_before' => [
+                                                'description'       => __( 'Filter products whose sale ends on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'image_date_after' => [
+                                                'description'       => __( 'Filter products whose featured image was uploaded on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'image_date_before' => [
+                                                'description'       => __( 'Filter products whose featured image was uploaded on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                                 'type'              => 'string',
                                                 'sanitize_callback' => 'sanitize_text_field',
 …
          * Export products as CSV.
+         *
+         * On success: outputs CSV directly via echo and terminates with wp_die().
+         * On success: streams the CSV and terminates with exit() — NOT wp_die(). That is why
+         * this method itself has no test coverage: rest_do_request() from PHPUnit would kill
+         * the process. Everything except the header/stream/exit tail lives in
+         * build_csv_stream(), which IS testable; keep new logic there (or in the service)
+         * rather than here.
          * On error: returns WP_REST_Response with JSON error body.
+         *
+         * Note the one thing this method cannot guarantee: once fpassthru() has started,
+         * a failure mid-transfer can no longer be converted into a JSON error. The
+         * fail-loud writes in Export_Service ensure the buffer is COMPLETE before any
+         * header is sent, which is the strongest guarantee available short of buffering
+         * to a real temp file and sending Content-Length.
+         *
+         * Catches \Throwable, not just \RuntimeException: build_csv_stream() also runs
+         * third-party format filters (Pro's ACF reads, for one), and a bug there must
+         * still surface as a JSON error the frontend can render — not an uncaught fatal
+         * that WP's REST fatal handler turns into a bodyless/HTML 500 with no message,
+         * which is the exact failure mode #177 is about. The original error is logged
+         * so the underlying bug stays visible to whoever reads the PHP error log.
+         *
          * @param \WP_REST_Request $request
 …
          */
         public function export( \WP_REST_Request $request ) {
+                $columns            = $request->get_param( 'columns' );
+                $product_ids        = $request->get_param( 'product_ids' );
+                $include_variations = (bool) $request->get_param( 'include_variations' );
+                $products = [];
+                if ( ! empty( $product_ids ) ) {
+                        // Export specific products by ID.
+                        foreach ( $product_ids as $id ) {
+                                $wc_product = wc_get_product( $id );
+                                if ( ! $wc_product ) {
+                                        continue;
+                                }
+                                if ( $wc_product->is_type( 'variation' ) ) {
+                                        $products[] = Product_Helper::format_variation( $wc_product );
+                                } else {
+                                        $products[] = Product_Helper::format_product( $wc_product );
+                                }
+                                if ( count( $products ) >= self::MAX_EXPORT_ROWS ) {
+                                        break;
+                                }
+                        }
+                } else {
+                        // Export all filtered products, paginating through.
+                        $filters = $this->extract_filters( $request );
+                        $service = new Product_Service();
+                        $page    = 1;
+                        do {
+                                $result     = $service->get_products( $page, 100, $include_variations, $filters );
+                                $products   = array_merge( $products, $result['products'] );
+                                $has_more   = $page < $result['total_pages'];
+                                $page++;
+                                if ( count( $products ) >= self::MAX_EXPORT_ROWS ) {
+                                        $products = array_slice( $products, 0, self::MAX_EXPORT_ROWS );
+                                        break;
+                                }
+                        } while ( $has_more );
+                }
+                if ( empty( $products ) ) {
+                $this->raise_resource_limits();
+                try {
+                        $stream = $this->build_csv_stream( $request );
+                } catch ( \Throwable $e ) {
+                        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- no logging abstraction exists in this codebase (grepped); this is the standard PHP fallback so the underlying cause isn't lost once it's converted to a generic JSON message below.
+                        error_log( sprintf( 'WCABE G2 export failed: %s', $e->getMessage() ) );
+                        return new \WP_REST_Response(
+                                [
+                                        'code'    => 'export_failed',
+                                        'message' => __( 'Export failed while generating the CSV file.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                ],
+                        );
+                }
+                $handle = $stream['handle'];
+                $count  = $stream['count'];
+                if ( 0 === $count ) {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream from build_csv_stream().
+                        fclose( $handle );
                         return new \WP_REST_Response(
+                                [
 …
+                }
+                $units = [
+                        'weight_unit'    => $request->get_param( 'weight_unit' ),
+                        'dimension_unit' => $request->get_param( 'dimension_unit' ),
+                ];
+                $export_service = new Export_Service();
+                $csv            = $export_service->generate_csv( $products, $columns, true, $units );
+                $count          = count( $products );
+                // Checked BEFORE any header is sent — this is the last point at which a
+                // failure can still become a JSON error rather than a truncated 200.
+                if ( ! rewind( $handle ) ) {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream from build_csv_stream().
+                        fclose( $handle );
+                        return new \WP_REST_Response(
+                                [
+                                        'code'    => 'export_failed',
+                                        'message' => __( 'Export failed while generating the CSV file.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                ],
+                        );
+                }
                 header( 'Content-Type: text/csv; charset=UTF-8' );
 …
                 header( 'Cache-Control: no-cache, no-store, must-revalidate' );
+                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $csv is a CSV-format response body produced by fputcsv() with proper RFC 4180 quoting; Content-Type is text/csv (set above), so HTML escaping is incorrect and would corrupt the output.
+                echo $csv;
+                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- streams a CSV-format response body produced by fputcsv() with proper RFC 4180 quoting; Content-Type is text/csv (set above), so HTML escaping is incorrect and would corrupt the output.
+                fpassthru( $handle );
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream from build_csv_stream().
+                fclose( $handle );
                 exit;
+        }
         /**
+         * Raise the request's memory and time limits before building the CSV.
+         *
+         * Belt and braces. Note wp_raise_memory_limit() only raises as far as
+         * WP_MAX_MEMORY_LIMIT (256M by default), so on a host already at 256M it is a
+         * no-op — the memory fix that actually matters is the streaming collection in
+         * Product_Service, not this call. wc_set_time_limit(300) — not 0 — because this
+         * is a synchronous web request and should not run unbounded.
+         *
+         * TEST SEAM: a fatal-failure test proxy overrides this to a no-op, so exercising
+         * the failure path doesn't call set_time_limit()/ini_set() on the shared
+         * PHPUnit process for every run.
+         */
+        protected function raise_resource_limits(): void {
+                wp_raise_memory_limit( 'admin' );
+                wc_set_time_limit( 300 );
+        }
+        /**
+         * Build the CSV into a temporary stream.
+         *
+         * TEST SEAM: this is export() minus the headers/stream/exit tail, so PHPUnit can
+         * drive the whole collection → CSV bridge through a proxy subclass.
+         *
+         * The stream is php://temp (spills to disk past 2MB) rather than php://output:
+         * an error must still be able to return JSON, and a mid-loop failure must never
+         * emit a truncated 200 CSV.
+         *
+         * @param \WP_REST_Request $request
+         * @return array{handle: resource, count: int} Caller owns the handle and must fclose() it.
+         * @throws \RuntimeException When the stream cannot be opened or written.
+         */
+        protected function build_csv_stream( \WP_REST_Request $request ): array {
+                $columns            = $request->get_param( 'columns' );
+                $product_ids        = $request->get_param( 'product_ids' );
+                $include_variations = (bool) $request->get_param( 'include_variations' );
+                $units = [
+                        'weight_unit'    => $request->get_param( 'weight_unit' ),
+                        'dimension_unit' => $request->get_param( 'dimension_unit' ),
+                ];
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- php://temp is an in-memory PHP stream (disk-backed past 2MB), not a filesystem operation; WP_Filesystem does not apply.
+                $handle = fopen( 'php://temp', 'r+' );
+                if ( false === $handle ) {
+                        throw new \RuntimeException( 'Unable to open a temporary stream for CSV export.' );
+                }
+                try {
+                        $export_service = new Export_Service();
+                        // begin_csv() once, write_rows() per chunk, all on the SAME instance — that
+                        // instance holds the resolved Pro column map every row write reads.
+                        $resolved = $export_service->begin_csv( $handle, $columns, true, $units );
+                        $sink = static function ( array $rows ) use ( $export_service, $handle, $resolved ): void {
+                                $export_service->write_rows( $handle, $rows, $resolved );
+                        };
+                        $service = new Product_Service();
+                        $count = ! empty( $product_ids )
+                                ? $service->stream_products_by_ids( (array) $product_ids, self::MAX_EXPORT_ROWS, $sink )
+                                : $service->stream_products(
+                                        $this->extract_filters( $request ),
+                                        $include_variations,
+                                        self::MAX_EXPORT_ROWS,
+                                        $sink
+                                );
+                } catch ( \Throwable $e ) {
+                        // Catch solely to release the handle — the caller never receives it, so
+                        // nothing else could close it. Rethrown unchanged.
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream opened above.
+                        fclose( $handle );
+                        throw $e;
+                }
+                return [
+                        'handle' => $handle,
+                        'count'  => $count,
+                ];
+        }
+        /**
          * Extract filter parameters from the request.
+         *
+         * Protected rather than private as a TEST SEAM: export() itself ends in
+         * exit(), so it cannot run under PHPUnit — a test subclass exposes this
+         * method instead, which is what keeps the filter→CSV bridge covered.
+         *
          * @param \WP_REST_Request $request
          * @return array
          */
         private function extract_filters( \WP_REST_Request $request ): array {
+        protected function extract_filters( \WP_REST_Request $request ): array {
                 $filters = [];
 …
                         $filters['search_name'] = sanitize_text_field( $search_name );
+                }
+                $search_sku = $request->get_param( 'search_sku' );
+                if ( ! empty( $search_sku ) ) {
+                        $filters['search_sku'] = sanitize_text_field( $search_sku );
+                }
+                $search_name_mode = $request->get_param( 'search_name_mode' );
+                if ( in_array( $search_name_mode, Product_Service::TITLE_SEARCH_MODES, true ) ) {
+                        $filters['search_name_mode'] = $search_name_mode;
+                }
+                // Strict '' test, not empty(): "0" is a valid SKU.
+                $search_sku = sanitize_text_field( (string) $request->get_param( 'search_sku' ) );
+                if ( '' !== $search_sku ) {
+                        $filters['search_sku'] = $search_sku;
+                }
+                $search_sku_mode = $request->get_param( 'search_sku_mode' );
+                if ( in_array( $search_sku_mode, Product_Service::SKU_SEARCH_MODES, true ) ) {
+                        $filters['search_sku_mode'] = $search_sku_mode;
+                }
+                // Product URL filter. Deliberately NOT gated on a non-empty value — the
+                // is_empty / is_not_empty operators are effective with none.
+                // Mirrors Products_Controller::get_items(); keep the two in step.
+                $product_url_operator = $request->get_param( 'product_url_operator' ) ?: 'contains';
+                $product_url_value    = View_Service::sanitize_url_filter_value( $request->get_param( 'product_url_value' ) ?? '' );
+                if ( Product_Service::product_url_filter_is_effective( $product_url_operator, $product_url_value ) ) {
+                        $filters['product_url_operator'] = $product_url_operator;
+                        $filters['product_url_value']    = $product_url_value;
+                }
+                // Term-ID filters. A param that is PRESENT but parses to zero valid IDs must match
+                // NOTHING (the [0] sentinel — no term has ID 0), not drop the filter: an export
+                // that silently widens back to the whole catalog is the worse failure. The presence
+                // test is deliberately `'' !==` rather than `! empty()` — empty('0') is true, so the
+                // single most likely corrupt value would otherwise slip through as "no filter".
+                // Mirrors Products_Controller::get_items(); keep the two in step.
                 $category = $request->get_param( 'category' );
+                if ( ! empty( $category ) ) {
+                        $filters['category'] = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                if ( null !== $category && '' !== $category ) {
+                        $category_ids        = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                        $filters['category'] = empty( $category_ids ) ? [ 0 ] : $category_ids;
+                }
+                $tag = $request->get_param( 'tag' );
+                if ( null !== $tag && '' !== $tag ) {
+                        $tag_ids        = array_filter( array_map( 'absint', explode( ',', $tag ) ) );
+                        $filters['tag'] = empty( $tag_ids ) ? [ 0 ] : $tag_ids;
+                }
 …
+                }
+                $filters = Filter_Service::apply_shipping_class_param(
+                        $request->get_param( 'shipping_class' ),
+                        $filters
+                );
                 $price_min = $request->get_param( 'price_min' );
                 if ( null !== $price_min && '' !== $price_min ) {
 …
+                }
+                // Cost of Goods range — gated so a stale param can't trigger the COGS query
+                // path when the feature is off (matches Products_Controller).
+                if ( Product_Helper::is_cogs_enabled() ) {
+                        $cogs_min = $request->get_param( 'cogs_min' );
+                        if ( null !== $cogs_min && '' !== $cogs_min ) {
+                                $filters['cogs_min'] = sanitize_text_field( $cogs_min );
+                        }
+                        $cogs_max = $request->get_param( 'cogs_max' );
+                        if ( null !== $cogs_max && '' !== $cogs_max ) {
+                                $filters['cogs_max'] = sanitize_text_field( $cogs_max );
+                        }
+                }
                 $stock_qty_min = $request->get_param( 'stock_qty_min' );
                 if ( null !== $stock_qty_min && '' !== $stock_qty_min ) {
 …
+                }
+                $menu_order_min = $request->get_param( 'menu_order_min' );
+                if ( null !== $menu_order_min && '' !== $menu_order_min ) {
+                        $filters['menu_order_min'] = sanitize_text_field( $menu_order_min );
+                }
+                $menu_order_max = $request->get_param( 'menu_order_max' );
+                if ( null !== $menu_order_max && '' !== $menu_order_max ) {
+                        $filters['menu_order_max'] = sanitize_text_field( $menu_order_max );
+                }
                 $manage_stock = $request->get_param( 'manage_stock' );
                 if ( ! empty( $manage_stock ) ) {
 …
+                }
+                $date_params = [ 'date_created_after', 'date_created_before', 'date_modified_after', 'date_modified_before' ];
+                $date_params = [
+                        'date_created_after',
+                        'date_created_before',
+                        'date_modified_after',
+                        'date_modified_before',
+                        'sale_start_after',
+                        'sale_start_before',
+                        'sale_end_after',
+                        'sale_end_before',
+                        'image_date_after',
+                        'image_date_before',
+                ];
                 foreach ( $date_params as $param ) {
                         $val = $request->get_param( $param );

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/REST/Products_Controller.php

-              r3549389
+              r3663491
 namespace WCABE_G2\REST;
+use WCABE_G2\Helpers\Page_Size_Helper;
 use WCABE_G2\Helpers\Permission_Helper;
+use WCABE_G2\Helpers\Product_Helper;
+use WCABE_G2\Services\Filter_Service;
 use WCABE_G2\Services\Product_Service;
+use WCABE_G2\Services\View_Service;
 defined( 'ABSPATH' ) || exit;
 …
                                 'permission_callback' => [ Permission_Helper::class, 'rest_permission_check' ],
                                 'args'                => $this->get_collection_params(),
+                        ],
+                ] );
+                register_rest_route( $this->namespace, '/' . $this->rest_base . '/search', [
+                        [
+                                'methods'             => \WP_REST_Server::READABLE,
+                                'callback'            => [ $this, 'search_items' ],
+                                'permission_callback' => [ Permission_Helper::class, 'rest_permission_check' ],
+                                'args'                => [
+                                        'term' => [
+                                                'description'       => __( 'Search term — matches product title, SKU, GTIN, or a bare product ID.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'required'          => true,
+                                                'type'              => 'string',
+                                                'minLength'         => 1,
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => static function ( $value ) {
+                                                        if ( '' === trim( (string) $value ) ) {
+                                                                return new \WP_Error(
+                                                                        'rest_invalid_param',
+                                                                        __( 'Search term cannot be empty.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                                        [ 'status' => 400 ]
+                                                                );
+                                                        }
+                                                        return true;
+                                                },
+                                        ],
+                                        'exclude' => [
+                                                'description'       => __( 'Product IDs to omit from results (e.g. the product being edited).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'array',
+                                                'default'           => [],
+                                                'items'             => [ 'type' => 'integer' ],
+                                                'sanitize_callback' => static function ( $value ) {
+                                                        if ( ! is_array( $value ) ) {
+                                                                return [];
+                                                        }
+                                                        // intval, NOT absint: absint( -7 ) is 7, so a negative would
+                                                        // silently exclude the wrong product.
+                                                        return array_values( array_filter(
+                                                                array_map( 'intval', $value ),
+                                                                static fn( $id ) => $id > 0
+                                                        ) );
+                                                },
+                                        ],
+                                        'limit' => [
+                                                'description'       => __( 'Maximum number of results.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'integer',
+                                                'default'           => 30,
+                                                'minimum'           => 1,
+                                                'maximum'           => 50,
+                                                'sanitize_callback' => 'absint',
+                                                'validate_callback' => 'rest_validate_request_arg',
+                                        ],
+                                ],
                         ],
                 ] );
 …
                                                 ],
                                         ],
+                                        'batch_id' => [
+                                                'required'          => false,
+                                                'type'              => 'string',
+                                                'description'       => __( 'Optional client-generated identifier correlating all chunks of one save.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'validate_callback' => 'rest_validate_request_arg',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                 ],
                         ],
                 ] );
+        }
+        /**
+         * Product lookup for the linked-product picker.
+         *
+         * Route parsing and response shaping only — the search itself lives in
+         * Product_Service::search_products(), where the business logic belongs.
+         *
+         * @param \WP_REST_Request $request
+         * @return \WP_REST_Response
+         */
+        public function search_items( $request ): \WP_REST_Response {
+                $service = new Product_Service();
+                $results = $service->search_products(
+                        (string) $request->get_param( 'term' ),
+                        (array) $request->get_param( 'exclude' ),
+                        (int) $request->get_param( 'limit' )
+                );
+                return new \WP_REST_Response( $results, 200 );
+        }
 …
         public function get_items( $request ): \WP_REST_Response {
                 $page     = absint( $request->get_param( 'page' ) ) ?: 1;
+                $per_page = absint( $request->get_param( 'per_page' ) ) ?: 100;
+                // Clamped again here (the schema's sanitize_callback already ran) because
+                // get_items() must hold the bound for any caller, including internal
+                // dispatches that build a request without the registered schema.
+                $per_page = Page_Size_Helper::clamp( $request->get_param( 'per_page' ) );
                 $include_variations = (bool) $request->get_param( 'include_variations' );
-                /**
-                 * Filters the maximum number of products returned per request.
+                 *
-                 * Default 100 is a universal performance safety cap to prevent memory
-                 * exhaustion on shared hosting when variations are expanded. Both Free
-                 * and Pro honor this default — Pro does not raise it. Site admins on
-                 * infrastructure that can handle larger page sizes may filter this.
+                 *
-                 * @param int $max_per_page Default 100.
-                 */
-                $max_per_page = (int) apply_filters( 'wcabe_g2_max_per_page', 100 );
-                $per_page     = min( $per_page, $max_per_page );
                 // Build filters array from request params.
 …
                         $filters['search_name'] = sanitize_text_field( $search_name );
+                }
+                $search_sku = $request->get_param( 'search_sku' );
+                if ( ! empty( $search_sku ) ) {
+                        $filters['search_sku'] = sanitize_text_field( $search_sku );
+                $search_name_mode = $request->get_param( 'search_name_mode' );
+                if ( in_array( $search_name_mode, Product_Service::TITLE_SEARCH_MODES, true ) ) {
+                        $filters['search_name_mode'] = $search_name_mode;
+                }
+                // Strict '' test, not empty(): "0" is a valid SKU.
+                $search_sku = sanitize_text_field( (string) $request->get_param( 'search_sku' ) );
+                if ( '' !== $search_sku ) {
+                        $filters['search_sku'] = $search_sku;
+                }
+                $search_sku_mode = $request->get_param( 'search_sku_mode' );
+                if ( in_array( $search_sku_mode, Product_Service::SKU_SEARCH_MODES, true ) ) {
+                        $filters['search_sku_mode'] = $search_sku_mode;
+                }
                 $search_description = $request->get_param( 'search_description' );
 …
+                }
+                // Product URL filter. Deliberately NOT gated on a non-empty value: the
+                // is_empty / is_not_empty operators are effective with none, so the usual
+                // `if ( ! empty( $value ) )` shape would silently drop them here.
+                $product_url_operator = $request->get_param( 'product_url_operator' ) ?: 'contains';
+                $product_url_value    = View_Service::sanitize_url_filter_value( $request->get_param( 'product_url_value' ) ?? '' );
+                if ( Product_Service::product_url_filter_is_effective( $product_url_operator, $product_url_value ) ) {
+                        $filters['product_url_operator'] = $product_url_operator;
+                        $filters['product_url_value']    = $product_url_value;
+                }
+                // Term-ID filters. A param that is PRESENT but parses to zero valid IDs must match
+                // NOTHING (the [0] sentinel — no term has ID 0), not drop the filter: silently
+                // widening a filtered request back to the whole catalog is the worse failure, and
+                // the same parse feeds CSV export. The presence test is deliberately `'' !==`
+                // rather than `! empty()` — empty('0') is true, so the single most likely corrupt
+                // value would otherwise slip through as "no filter".
                 $category = $request->get_param( 'category' );
+                if ( ! empty( $category ) ) {
+                        $filters['category'] = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                if ( null !== $category && '' !== $category ) {
+                        $category_ids        = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                        $filters['category'] = empty( $category_ids ) ? [ 0 ] : $category_ids;
+                }
+                $tag = $request->get_param( 'tag' );
+                if ( null !== $tag && '' !== $tag ) {
+                        $tag_ids        = array_filter( array_map( 'absint', explode( ',', $tag ) ) );
+                        $filters['tag'] = empty( $tag_ids ) ? [ 0 ] : $tag_ids;
+                }
 …
+                }
+                $filters = Filter_Service::apply_shipping_class_param(
+                        $request->get_param( 'shipping_class' ),
+                        $filters
+                );
                 $price_min = $request->get_param( 'price_min' );
                 if ( null !== $price_min && '' !== $price_min ) {
 …
+                }
+                // Cost of Goods range — only honored when the COGS feature is enabled, so a
+                // stale param can't trigger the COGS query path (or get_cogs_value()).
+                if ( Product_Helper::is_cogs_enabled() ) {
+                        $cogs_min = $request->get_param( 'cogs_min' );
+                        if ( null !== $cogs_min && '' !== $cogs_min ) {
+                                $filters['cogs_min'] = sanitize_text_field( $cogs_min );
+                        }
+                        $cogs_max = $request->get_param( 'cogs_max' );
+                        if ( null !== $cogs_max && '' !== $cogs_max ) {
+                                $filters['cogs_max'] = sanitize_text_field( $cogs_max );
+                        }
+                }
                 $stock_qty_min = $request->get_param( 'stock_qty_min' );
                 if ( null !== $stock_qty_min && '' !== $stock_qty_min ) {
 …
+                }
+                $menu_order_min = $request->get_param( 'menu_order_min' );
+                if ( null !== $menu_order_min && '' !== $menu_order_min ) {
+                        $filters['menu_order_min'] = sanitize_text_field( $menu_order_min );
+                }
+                $menu_order_max = $request->get_param( 'menu_order_max' );
+                if ( null !== $menu_order_max && '' !== $menu_order_max ) {
+                        $filters['menu_order_max'] = sanitize_text_field( $menu_order_max );
+                }
                 $manage_stock = $request->get_param( 'manage_stock' );
                 if ( ! empty( $manage_stock ) ) {
 …
+                }
+                $date_params = [ 'date_created_after', 'date_created_before', 'date_modified_after', 'date_modified_before' ];
+                $date_params = [
+                        'date_created_after',
+                        'date_created_before',
+                        'date_modified_after',
+                        'date_modified_before',
+                        'sale_start_after',
+                        'sale_start_before',
+                        'sale_end_after',
+                        'sale_end_before',
+                        'image_date_after',
+                        'image_date_before',
+                ];
                 foreach ( $date_params as $param ) {
                         $val = $request->get_param( $param );
 …
                 $filters = apply_filters( 'wcabe_g2_rest_request_filters', $filters, $request );
+                // Server-side sort. Whitelisted at the schema level (orderby: id|menu_order);
+                // the service maps these to WC/WP_Query orderby values.
+                $orderby = (string) $request->get_param( 'orderby' );
+                $order   = (string) $request->get_param( 'order' );
                 $service = new Product_Service();
                 $data = $service->get_products( $page, $per_page, $include_variations, $filters );
+                $data = $service->get_products( $page, $per_page, $include_variations, $filters, $orderby, $order );
                 $response = rest_ensure_response( $data );
 …
+                }
+                $batch_id = $request->get_param( 'batch_id' );
                 $service = new Product_Service();
+                $results = $service->batch_update( $products );
+                $results = $service->batch_update(
+                        $products,
+                        [ 'batch_id' => is_string( $batch_id ) ? $batch_id : null ]
+                );
                 return rest_ensure_response( [ 'results' => $results ] );
 …
                                 'description'       => __( 'Maximum number of items per page.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                 'type'              => 'integer',
+                                'default'           => 100,
+                                'minimum'           => 1,
+                                'maximum'           => 100,
+                                'sanitize_callback' => 'absint',
+                                'validate_callback' => 'rest_validate_request_arg',
+                                'default'           => Page_Size_Helper::DEFAULT_PAGE_SIZE,
+                                // Deliberately no 'minimum'/'maximum'/'validate_callback': an
+                                // out-of-range or malformed per_page must degrade to a clamped
+                                // value, never 400 the whole grid fetch. Page_Size_Helper::clamp
+                                // bounds every input (including non-scalars) without erroring, so
+                                // schema validation would only add a failure mode. The effective
+                                // maximum is filterable per site, which a static schema 'maximum'
+                                // could not express anyway.
+                                'sanitize_callback' => [ Page_Size_Helper::class, 'clamp' ],
                         ],
                         'include_variations' => [
 …
                                 'sanitize_callback' => 'rest_sanitize_boolean',
                         ],
+                        'orderby' => [
+                                'description'       => __( 'Server-side sort column.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'id',
+                                'enum'              => [ 'id', 'menu_order' ],
+                        ],
+                        'order' => [
+                                'description'       => __( 'Server-side sort direction.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'desc',
+                                'enum'              => [ 'asc', 'desc' ],
+                        ],
                         'search_name' => [
                                 'description'       => __( 'Search by product name.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
+                        'search_name_mode' => [
+                                'description'       => __( 'Title match mode: all (every word, default), any (any word), or phrase (exact phrase).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'all',
+                                'enum'              => Product_Service::TITLE_SEARCH_MODES,
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
                         'search_sku' => [
+                                'description'       => __( 'Search by SKU. Comma-separated for exact match.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                /* translators: %d: maximum number of comma-separated SKU values. */
+                                'description'       => sprintf( __( 'Search by SKU. Comma-separate multiple values to match any of them under the selected mode (capped at %d values).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ), Product_Service::SKU_SEARCH_MAX_TOKENS ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
+                        'search_sku_mode' => [
+                                'description'       => __( 'SKU match mode: contains, is_exactly, not_contains, starts_with, or ends_with. Comma-separated values match any of them (none of them for not_contains). Omit or send an empty string for the legacy behaviour: comma-separated = exact, single value = partial.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => '',
+                                'enum'              => array_merge( [ '' ], Product_Service::SKU_SEARCH_MODES ),
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
 …
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
+                        'product_url_operator' => [
+                                'description'       => __( 'Product URL filter operator.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'contains',
+                                'enum'              => Product_Service::PRODUCT_URL_OPERATORS,
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
+                        'product_url_value' => [
+                                'description'       => __( 'Product URL filter value (substring).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                // NOT sanitize_text_field: it strips percent-encoded octets (%20,
+                                // %2F), which are legitimate content in a URL substring search.
+                                'sanitize_callback' => [ View_Service::class, 'sanitize_url_filter_value' ],
+                        ],
                         'category' => [
                                 'description'       => __( 'Comma-separated category term IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
+                        'tag' => [
+                                'description'       => __( 'Comma-separated tag term IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
                         'type' => [
                                 'description'       => __( 'Comma-separated product types.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 'type'              => 'string',
                                 'sanitize_callback' => 'sanitize_text_field',
+                        ],
+                        'shipping_class' => [
+                                // No sanitize_callback: sanitize_text_field() strips percent-encoded
+                                // octets, which is exactly how WP stores non-ASCII term slugs
+                                // (sanitize_title() -> utf8_uri_encode()). That would silently reduce
+                                // e.g. a Cyrillic class's slug to '', match-noning every request for
+                                // it. Filter_Service::apply_shipping_class_param() is the real
+                                // sanitizer — sanitize_title() per comma-separated token.
+                                'description' => __( 'Comma-separated shipping class slugs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'        => 'string',
                         ],
                         'price_min' => [
 …
                                 },
                         ],
+                        'cogs_min' => [
+                                'description'       => __( 'Minimum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return is_numeric( $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Cost of Goods must be numeric.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
+                        'cogs_max' => [
+                                'description'       => __( 'Maximum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return is_numeric( $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Cost of Goods must be numeric.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
                         'stock_qty_min' => [
                                 'description'       => __( 'Minimum stock quantity filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 },
                         ],
+                        'menu_order_min' => [
+                                'description'       => __( 'Minimum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        // Integer-only (menu order is a whole number; may be negative) —
+                                        // deliberately stricter than the decimal-allowing stock_qty filter.
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
+                        'menu_order_max' => [
+                                'description'       => __( 'Maximum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
                         'manage_stock' => [
                                 'description'       => __( 'Comma-separated manage stock values (yes, no).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                         'date_modified_before' => [
                                 'description'       => __( 'Filter products modified on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_start_after' => [
+                                'description'       => __( 'Filter products whose sale starts on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_start_before' => [
+                                'description'       => __( 'Filter products whose sale starts on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_end_after' => [
+                                'description'       => __( 'Filter products whose sale ends on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_end_before' => [
+                                'description'       => __( 'Filter products whose sale ends on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'image_date_after' => [
+                                'description'       => __( 'Filter products whose featured image was uploaded on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'image_date_before' => [
+                                'description'       => __( 'Filter products whose featured image was uploaded on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                 'type'              => 'string',
                                 'sanitize_callback' => 'sanitize_text_field',

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/REST/Settings_Controller.php

-              r3549389
+              r3663491
                 ],
                 'debug_tracing' => [
+                        'type'    => 'boolean',
+                        'default' => false,
+                ],
+                'trigger_wp_save_hooks' => [
                         'type'    => 'boolean',
                         'default' => false,

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/REST/User_Settings_Controller.php

-              r3549389
+              r3663491
 namespace WCABE_G2\REST;
+use WCABE_G2\Helpers\Page_Size_Helper;
 use WCABE_G2\Helpers\Permission_Helper;
 use WCABE_G2\Services\View_Service;
 …
          */
         private const SCHEMA = [
                 'pageSize'            => [ 'type' => 'integer', 'default' => 100 ],
+                'pageSize'            => [ 'type' => 'integer', 'default' => Page_Size_Helper::DEFAULT_PAGE_SIZE ],
                 'includeVariations'   => [ 'type' => 'boolean', 'default' => false ],
                 'darkMode'            => [ 'type' => 'boolean', 'default' => false ],
 …
                 'imagePreviewEnabled' => [ 'type' => 'boolean', 'default' => true ],
                 'autoLoadProducts'    => [ 'type' => 'boolean', 'default' => true ],
+                'showAdminBarShortcut' => [ 'type' => 'boolean', 'default' => true ],
+                'refreshAfterSave'    => [ 'type' => 'boolean', 'default' => true ],
+                // Working-layout draft (views working-state redesign). filterDraft is the
+                // filter half (view `filters` shape); activeViewId is the baseline pointer
+                // and the load-precedence "has-draft" marker (nullable — never (string)-cast).
+                'filterDraft'         => [ 'type' => 'filters',         'default' => null ],
+                'activeViewId'        => [ 'type' => 'nullable_string', 'default' => null ],
+                // Opaque scope stamp recorded alongside filterDraft, identifying the context
+                // the draft's entity ids were resolved in. Tier-neutral: Free never
+                // interprets the value, it only round-trips it so the frontend can compare
+                // the stored stamp against the current one and discard a draft whose entity
+                // ids belong to a different scope (see stripScopedFilters / filterScopeKey
+                // registry slot). Null = no stamp recorded.
+                'filterScopeKey'      => [ 'type' => 'nullable_string', 'default' => null ],
         ];
 …
         public function update_settings( \WP_REST_Request $request ): \WP_REST_Response {
+                $body = $request->get_json_params();
+                // Order-safe write gate via a monotonic client _rev (R7.1/R8.1/R8.2). The
+                // settings sync is last-write-wins partial merge, so a stale in-flight request
+                // landing after the unload beacon could clobber individual keys. Stamping every
+                // write with a client _rev and applying-only-if-newer closes that race.
+                //
+                // Read the RAW stored meta for the prior _rev — get_all() is SCHEMA-only and
+                // would drop _rev, so the compare and write-back must use the raw array (R8.1).
+                $raw = get_user_meta( get_current_user_id(), self::META_KEY, true );
+                if ( ! is_array( $raw ) ) {
+                        $raw = [];
+                }
+                // Use the RAW numeric value — do NOT (int)-cast. The client seeds _rev from
+                // Date.now() (~1.75e12), which exceeds PHP_INT_MAX on 32-bit PHP where (int)
+                // saturates to 2147483647, collapsing stored and incoming to the same value so
+                // every write after the first is wrongly rejected as stale (review #8). On 32-bit
+                // JSON decodes such a value to a float; on 64-bit it stays an int. Comparing the
+                // raw numeric values is correct on both (PHP compares numerically) and preserves
+                // the stored int type on 64-bit. is_numeric() already validated them.
+                $stored_rev   = ( isset( $raw['_rev'] ) && is_numeric( $raw['_rev'] ) ) ? $raw['_rev'] : null;
+                $incoming_rev = ( isset( $body['_rev'] ) && is_numeric( $body['_rev'] ) ) ? $body['_rev'] : null;
+                if ( null !== $incoming_rev ) {
+                        // Drop exact-rev replays and older writes.
+                        if ( null !== $stored_rev && $incoming_rev <= $stored_rev ) {
+                                return rest_ensure_response( self::get_all() );
+                        }
+                } elseif ( null !== $stored_rev ) {
+                        // Absent _rev applies ONLY before any _rev is stored (pre-_rev install /
+                        // first write). Once a _rev exists, treat a missing _rev as stale — else a
+                        // no-rev write would reopen the race (R8.2).
+                        return rest_ensure_response( self::get_all() );
+                }
                 $current = self::get_all();
-                $body    = $request->get_json_params();
                 foreach ( self::SCHEMA as $key => $schema ) {
 …
                                 case 'integer':
                                         if ( 'pageSize' === $key ) {
+                                                /** This filter is documented in includes/REST/Products_Controller.php */
+                                                $max             = (int) apply_filters( 'wcabe_g2_max_per_page', 100 );
+                                                $current[ $key ] = max( 1, min( absint( $value ), $max ) );
+                                                $current[ $key ] = Page_Size_Helper::clamp( $value );
+                                        }
                                         // else: no other integer fields defined. Future integer fields
 …
+                                        }
                                         break;
+                                case 'filters':
+                                        if ( null === $value ) {
+                                                $current[ $key ] = null;
+                                        } elseif ( is_array( $value ) ) {
+                                                // Live frontend draft — already the current FilterValues shape,
+                                                // never a legacy bag shape, so no migration (mirrors columnState).
+                                                $current[ $key ] = View_Service::sanitize_filter_values( $value );
+                                        }
+                                        break;
+                                case 'nullable_string':
+                                        // Preserve null/'' as null (don't (string)-cast) so the load-precedence
+                                        // marker (activeViewId !== null) stays meaningful.
+                                        if ( null === $value || '' === $value ) {
+                                                $current[ $key ] = null;
+                                        } else {
+                                                $current[ $key ] = sanitize_text_field( (string) $value );
+                                        }
+                                        break;
+                        }
+                }
+                // Re-add the rev into the meta array so the $current = get_all() rebuild
+                // (SCHEMA-only) doesn't erase the stored _rev (R8.1). Newest rev wins.
+                if ( null !== $incoming_rev ) {
+                        $current['_rev'] = max( $incoming_rev, $stored_rev ?? 0 );
+                }
                 update_user_meta( get_current_user_id(), self::META_KEY, $current );
+                return rest_ensure_response( $current );
+                // Return SCHEMA-only settings (get_all strips _rev) so _rev never surfaces
+                // to the client as a setting (R8.1).
+                return rest_ensure_response( self::get_all() );
+        }
+        /**
+         * The stored monotonic sync cursor (_rev), or 0.0 when none has been written yet.
+         *
+         * Localized to the client (window.wcabeG2.userSettingsRev) so it can seed its rev
+         * counter ABOVE the last persisted value. Without this the client seeds from a bare
+         * Date.now(); a backward wall-clock step between sessions (NTP correction, VM resume,
+         * wrong RTC, manual change) then makes every new write's _rev look stale, silently
+         * halting all settings persistence until real time catches up (review #4). This is
+         * transport, deliberately kept out of get_all()/UserSettings so _rev never surfaces
+         * as a setting. Returned as float for 32-bit safety (see update_settings, #8).
+         */
+        public static function get_stored_rev(): float {
+                $raw = get_user_meta( get_current_user_id(), self::META_KEY, true );
+                return ( is_array( $raw ) && isset( $raw['_rev'] ) && is_numeric( $raw['_rev'] ) ) ? (float) $raw['_rev'] : 0.0;
+        }
 …
+                }
                 // Defensive clamp on read. The schema and update_settings() already
                 // enforce the bound on writes, but values written to user meta outside
                 // this controller (legacy installs, future schema changes, direct DB
                 // updates) could fall outside it. Same filter and bound as the write path.
+                // Defensive clamp on read. update_settings() already enforces the bound on
+                // writes, but values written to user meta outside this controller (legacy
+                // installs, future schema changes, direct DB updates) or a site that has
+                // since LOWERED wcabe_g2_max_per_page could fall outside it.
                 if ( isset( $result['pageSize'] ) ) {
+                        /** This filter is documented in includes/REST/Products_Controller.php */
+                        $max                = (int) apply_filters( 'wcabe_g2_max_per_page', 100 );
+                        $result['pageSize'] = min( max( 1, (int) $result['pageSize'] ), $max );
+                        $result['pageSize'] = Page_Size_Helper::clamp( $result['pageSize'] );
+                }

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/REST/Views_Controller.php

-              r3549389
+              r3663491
 namespace WCABE_G2\REST;
+use WCABE_G2\Helpers\Page_Size_Helper;
 use WCABE_G2\Helpers\Permission_Helper;
 use WCABE_G2\Services\View_Service;
 …
                         );
+                }
+                // Validate the SANITIZED value too — WP core runs validate_callback on the
+                // raw param before sanitize_callback, so a raw value like '<b></b>' passes
+                // the non-empty check above but sanitizes to '' and would otherwise persist
+                // a blank-named view.
+                if ( '' === trim( sanitize_text_field( $trimmed ) ) ) {
+                        return new \WP_Error(
+                                'rest_invalid_param',
+                                __( 'View name cannot be empty.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                        );
+                }
                 return true;
+        }
 …
                                                 'type'     => 'array',
                                         ],
+                                        // No minimum/maximum/validate_callback: a malformed page_size
+                                        // must not fail the whole view save. clamp() bounds any input,
+                                        // including non-scalars, without erroring.
+                                        'page_size' => [
+                                                'required'          => false,
+                                                'type'              => 'integer',
+                                                'sanitize_callback' => [ Page_Size_Helper::class, 'clamp' ],
+                                        ],
                                         'is_default' => [
                                                 'required' => false,
 …
                                                 'type'     => 'array',
                                         ],
+                                        'page_size' => [
+                                                'required'          => false,
+                                                'type'              => 'integer',
+                                                'sanitize_callback' => [ Page_Size_Helper::class, 'clamp' ],
+                                        ],
                                         'is_default' => [
                                                 'required' => false,
 …
                         'filters'      => $request->get_param( 'filters' ),
                         'column_state' => $request->get_param( 'column_state' ),
+                        'page_size'    => $request->get_param( 'page_size' ),
                         'is_default'   => $request->get_param( 'is_default' ),
                 ];
 …
                         $data['column_state'] = $request->get_param( 'column_state' );
+                }
+                if ( null !== $request->get_param( 'page_size' ) ) {
+                        $data['page_size'] = $request->get_param( 'page_size' );
+                }
                 if ( null !== $request->get_param( 'is_default' ) ) {
                         $data['is_default'] = $request->get_param( 'is_default' );

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Services/Export_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Helpers\Product_Helper;
 defined( 'ABSPATH' ) || exit;
 …
          */
         protected array $pro_columns = [];
+        /**
+         * Lazily built slug => name map for the Shipping Class column. Null until the
+         * first shipping_class cell is formatted, so exports without that column
+         * never touch the taxonomy.
+         *
+         * @var array<string, string>|null
+         */
+        protected ?array $shipping_class_names = null;
         /**
 …
                 'regular_price'      => 'Regular Price',
                 'sale_price'         => 'Sale Price',
+                'cogs_value'         => 'Cost of Goods',
                 'stock_quantity'     => 'Stock Qty',
                 'stock_status'       => 'Stock Status',
 …
                 'date_on_sale_from'  => 'Sale From',
                 'date_on_sale_to'    => 'Sale To',
+                'date_created'       => 'Published on',
+                'date_modified'      => 'Modified on',
+                'image_date'         => 'Image uploaded',
                 'featured'           => 'Featured',
                 'virtual'            => 'Virtual',
                 'downloadable'       => 'Downloadable',
                 'backorders'         => 'Backorders',
+                'shipping_class'     => 'Shipping Class',
+                'menu_order'         => 'Menu Order',
+                'button_text'        => 'Button Text',
+                'product_url'        => 'Product URL',
+                'upsell_ids'         => 'Upsells',
+                'cross_sell_ids'     => 'Cross-sells',
         ];
         /**
          * Generate a CSV string from an array of formatted product data.
+         *
+         * One-shot entry point, kept for callers that already hold every row in memory.
+         * It is a thin composition over begin_csv() + write_rows() — the incremental
+         * primitives the export controller streams through — so both paths produce
+         * byte-identical output by construction.
+         *
          * @param array  $products    Array of formatted product arrays.
 …
          * @param array  $units       Optional [ 'weight_unit' => 'kg', 'dimension_unit' => 'cm' ].
          * @return string CSV content.
+         * @throws \RuntimeException When the temporary stream cannot be opened, written, rewound or read.
          */
         public function generate_csv( array $products, array $columns = [], bool $include_bom = true, array $units = [] ): string {
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- php://temp is an in-memory PHP stream, not a filesystem operation. Used as the standard fputcsv() handle pattern for building CSV in memory; WP_Filesystem does not apply to memory streams.
+                $handle = fopen( 'php://temp', 'r+' );
+                if ( false === $handle ) {
+                        throw new \RuntimeException( 'Unable to open a temporary stream for CSV generation.' );
+                }
+                try {
+                        $resolved = $this->begin_csv( $handle, $columns, $include_bom, $units );
+                        $this->write_rows( $handle, $products, $resolved );
+                        if ( ! rewind( $handle ) ) {
+                                throw new \RuntimeException( 'Unable to rewind the temporary CSV stream.' );
+                        }
+                        $csv = stream_get_contents( $handle );
+                        if ( false === $csv ) {
+                                throw new \RuntimeException( 'Unable to read the temporary CSV stream.' );
+                        }
+                        return $csv;
+                } finally {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream opened above. In finally so a write failure mid-document never leaks the handle.
+                        fclose( $handle );
+                }
+        }
+        /**
+         * Open a CSV document on a stream: resolve the column set, apply the Pro
+         * extra-columns filter, and write the BOM + header row.
+         *
+         * Call EXACTLY ONCE per export, before any write_rows() call, and on the SAME
+         * instance those write_rows() calls use — this is what initializes
+         * $this->pro_columns, which format_cell_value() reads for every
+         * Pro-contributed cell. Calling it per chunk would repeat the BOM and header
+         * row mid-file; calling write_rows() on a different instance would silently
+         * blank every Pro column.
+         *
+         * @param resource $handle      Open, writable stream.
+         * @param array    $columns     Columns to include (keys from EXPORTABLE_COLUMNS). Empty = all.
+         * @param bool     $include_bom Prepend UTF-8 BOM for Excel compatibility.
+         * @param array    $units       Optional [ 'weight_unit' => 'kg', 'dimension_unit' => 'cm' ].
+         * @return array Resolved column keys. Pass these to every write_rows() call.
+         * @throws \RuntimeException When a write fails (e.g. the temp stream's backing disk is full).
+         */
+        public function begin_csv( $handle, array $columns = [], bool $include_bom = true, array $units = [] ): array {
                 /**
                  * Allow extensions (Pro) to declare additional export columns.
 …
                 $this->pro_columns = apply_filters( 'wcabe_g2_export_extra_columns', [] );
+                // Filter to valid exportable columns only.
+                $columns = $this->resolve_columns( $columns );
+                if ( $include_bom ) {
+                        $bom = "\xEF\xBB\xBF";
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- writing to the caller's in-memory php://temp stream.
+                        $written = fwrite( $handle, $bom );
+                        // Compare the exact byte count, not just !== false: a full stream can
+                        // report a SHORT write, which would corrupt the BOM silently.
+                        if ( strlen( $bom ) !== $written ) {
+                                throw new \RuntimeException( 'Unable to write the CSV byte-order mark.' );
+                        }
+                }
+                $this->put_row( $handle, $this->build_headers( $columns, $units ) );
+                return $columns;
+        }
+        /**
+         * Append a chunk of formatted product rows to an open CSV document.
+         *
+         * Callable any number of times after begin_csv(), which is what lets the
+         * export stream page-by-page instead of holding every formatted row in memory.
+         *
+         * @param resource $handle   Open, writable stream previously passed to begin_csv().
+         * @param array    $products Formatted product arrays for this chunk.
+         * @param array    $columns  Resolved columns returned by begin_csv().
+         * @throws \RuntimeException When a write fails.
+         */
+        public function write_rows( $handle, array $products, array $columns ): void {
+                foreach ( $products as $product ) {
+                        $row = [];
+                        foreach ( $columns as $col ) {
+                                $row[] = $this->format_cell_value( $product, $col );
+                        }
+                        $this->put_row( $handle, $row );
+                }
+        }
+        /**
+         * Filter a requested column list down to the ones this export can emit.
+         *
+         * Depends on $this->pro_columns, so it must run after the extra-columns
+         * filter has been applied in begin_csv().
+         *
+         * @param array $columns Requested columns. Empty = all native exportable columns.
+         * @return array
+         */
+        private function resolve_columns( array $columns ): array {
                 if ( ! empty( $columns ) ) {
                         $pro_columns = $this->pro_columns;
 …
+                }
+                // Build header labels, adjusting for units.
+                return $columns;
+        }
+        /**
+         * Build the header labels for a resolved column list, adjusting for units.
+         *
+         * @param array $columns Resolved column keys.
+         * @param array $units   Optional [ 'weight_unit' => 'kg', 'dimension_unit' => 'cm' ].
+         * @return array
+         */
+        private function build_headers( array $columns, array $units ): array {
                 $weight_unit    = $units['weight_unit'] ?? '';
                 $dimension_unit = $units['dimension_unit'] ?? '';
 …
+                }
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- php://temp is an in-memory PHP stream, not a filesystem operation. Used as the standard fputcsv() handle pattern for building CSV in memory; WP_Filesystem does not apply to memory streams.
+                $handle = fopen( 'php://temp', 'r+' );
+                if ( $include_bom ) {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- writing to in-memory php://temp stream from line 135.
+                        fwrite( $handle, "\xEF\xBB\xBF" );
+                }
+                fputcsv( $handle, $headers );
+                foreach ( $products as $product ) {
+                        $row = [];
+                        foreach ( $columns as $col ) {
+                                $row[] = $this->format_cell_value( $product, $col );
+                        }
+                        fputcsv( $handle, $row );
+                }
+                rewind( $handle );
+                $csv = stream_get_contents( $handle );
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing in-memory php://temp stream from line 135.
+                fclose( $handle );
+                return $csv;
+                return $headers;
+        }
+        /**
+         * Write one CSV record, failing loudly.
+         *
+         * A silent truncation here would surface as a valid-looking CSV that is
+         * missing rows, so every write is checked and the controller converts the
+         * failure into a JSON error rather than a partial 200 response.
+         *
+         * The escape argument is explicit because the implicit default is deprecated
+         * from PHP 8.4. '\\' is the historical default and is kept deliberately —
+         * switching to RFC 4180's '' would change how existing exports escape.
+         *
+         * @param resource $handle Open, writable stream.
+         * @param array    $row    Field values.
+         * @throws \RuntimeException When the write fails.
+         */
+        private function put_row( $handle, array $row ): void {
+                if ( false === fputcsv( $handle, $row, ',', '"', '\\' ) ) {
+                        throw new \RuntimeException( 'Unable to write a CSV row.' );
+                }
+        }
 …
                                 return '';
+                        case 'upsell_ids':
+                        case 'cross_sell_ids':
+                                // Intentional: export is type-blind. The grid hides `cross_sell_ids` on
+                                // grouped/external products (WooCommerce doesn't render Cross-sells there, so it
+                                // isn't editable), but the stored meta still exists and CSV must reflect what's
+                                // persisted — this is also the only surface that reveals orphan cross-sells on
+                                // those types. Do not add a product-type guard here.
+                                // Matches WooCommerce's own product CSV exporter: comma-separated, SKU where
+                                // the product has one, `id:123` otherwise — so the output stays importable by
+                                // WC's native importer. An explicit case is required: the default arm would
+                                // (string)-cast the array to "Array" and emit a notice.
+                                if ( ! is_array( $value ) ) {
+                                        return '';
+                                }
+                                $refs = [];
+                                foreach ( $value as $ref ) {
+                                        if ( ! is_array( $ref ) || empty( $ref['id'] ) ) {
+                                                continue;
+                                        }
+                                        // Drop DEAD refs (target no longer a product). WC's own exporter does the
+                                        // same — array_filter( array_map( 'wc_get_product', … ) ) — and for good
+                                        // reason: `id:N` for a non-existent N makes WC's importer CREATE an "Import
+                                        // placeholder" product (status "importing") when update_existing is off, so a
+                                        // G2-export → WC-import round trip would manufacture one junk product per dead
+                                        // ref. Preserving dead refs in STORAGE stays correct (normalize_product_refs
+                                        // keeps them, so a chip the user never touches survives); resolving them into
+                                        // product creation via an interchange format is the bug. Live refs stranded on
+                                        // a type that hides the field (cross-sells on grouped/external) are NOT missing
+                                        // and still export — the type-blindness above is unaffected.
+                                        if ( ! empty( $ref['missing'] ) ) {
+                                                continue;
+                                        }
+                                        $sku    = isset( $ref['sku'] ) ? (string) $ref['sku'] : '';
+                                        $refs[] = '' !== $sku ? $sku : 'id:' . (int) $ref['id'];
+                                }
+                                return implode( ', ', $refs );
                         case 'manage_stock':
                         case 'featured':
 …
                                 return (string) $value;
+                        case 'menu_order':
+                                // Always an integer (default 0); 0 is a real position, so export it
+                                // rather than blanking like stock_quantity.
+                                return (string) (int) $value;
                         case 'description':
                         case 'short_description':
                                 return wp_strip_all_tags( (string) $value );
+                        case 'shipping_class':
+                                // The stored value is a slug; export the human-readable NAME, which
+                                // is what the grid shows and what a spreadsheet user recognises.
+                                // A slug whose term has since been deleted falls back to the slug
+                                // rather than blanking — losing the value silently would be worse.
+                                // '' stays '' (no class / same as parent).
+                                $slug = (string) $value;
+                                if ( '' === $slug ) {
+                                        return '';
+                                }
+                                if ( null === $this->shipping_class_names ) {
+                                        $this->shipping_class_names = [];
+                                        foreach ( Product_Helper::get_shipping_class_terms() as $term ) {
+                                                $this->shipping_class_names[ $term['slug'] ] = $term['name'];
+                                        }
+                                }
+                                return $this->shipping_class_names[ $slug ] ?? $slug;
                         default:
                                 return (string) $value;

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Services/Filter_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Helpers\Product_Helper;
 defined( 'ABSPATH' ) || exit;
 class Filter_Service {
+        /**
+         * Fold a raw `shipping_class` REST param into a filters array.
+         *
+         * Shared by Products_Controller and Export_Controller so the two request
+         * paths cannot drift — a filter honoured by the grid but dropped by export
+         * is the classic failure here.
+         *
+         * Junk semantics: sanitize_title() maps '!!!' to '', so a naive array_map
+         * would yield [''] — a filter that looks active and matches nothing in a way
+         * nobody can see. Empties are dropped; if the param was PRESENT but nothing
+         * valid survived, the match-none flag is raised instead of leaving the filter
+         * absent (which would silently return the entire catalog).
+         *
+         * The filter callback checks strict '' equality, not array_filter()'s default
+         * truthiness — sanitize_title() can legally produce the string '0' (WP will
+         * generate that slug for a term named e.g. "0" or "0 items"), and a bare
+         * array_filter() call treats '0' as falsy and drops it same as a real empty.
+         *
+         * @param mixed $raw     Raw request param (comma-separated slugs).
+         * @param array $filters Filters array to extend.
+         * @return array The filters array.
+         */
+        public static function apply_shipping_class_param( $raw, array $filters ): array {
+                if ( null === $raw || '' === $raw ) {
+                        return $filters;
+                }
+                $slugs = array_values(
+                        array_filter(
+                                array_map( 'sanitize_title', explode( ',', (string) $raw ) ),
+                                static fn( string $slug ): bool => '' !== $slug
+                        )
+                );
+                if ( empty( $slugs ) ) {
+                        $filters['shipping_class_match_none'] = true;
+                        return $filters;
+                }
+                $filters['shipping_class'] = $slugs;
+                return $filters;
+        }
         /**
 …
                         'categories'     => $this->get_category_tree(),
                         'tags'           => $this->get_tags(),
                         'types'          => [ 'simple', 'variable', 'grouped', 'external' ],
+                        'types'          => $this->get_product_type_options(),
                         'statuses'       => [ 'publish', 'draft', 'pending', 'private' ],
                         'stock_statuses' => [ 'instock', 'outofstock', 'onbackorder' ],
+                        // Same list the grid editor gets via window.wcabeG2, from one cached
+                        // source, so the filter and the column can never disagree on the
+                        // vocabulary. Deliberately no count — see get_shipping_class_terms().
+                        'shipping_classes' => Product_Helper::get_shipping_class_terms(),
                 ];
                 return apply_filters( 'wcabe_g2_filter_options', $options );
+        }
+        /**
+         * Product type filter options — the WooCommerce natives first, then every
+         * third-party registered type (e.g. 'bundle'), as value/label pairs (#137).
+         * Labels come from wc_get_product_types() so third-party types show their
+         * plugin-provided name; the frontend overrides the four native labels with
+         * its own short translations.
+         *
+         * @return array Array of [ 'value' => slug, 'label' => label ].
+         */
+        private function get_product_type_options(): array {
+                $registered = wc_get_product_types();
+                $options    = [];
+                foreach ( [ 'simple', 'variable', 'grouped', 'external' ] as $slug ) {
+                        $options[] = [
+                                'value' => $slug,
+                                'label' => (string) ( $registered[ $slug ] ?? ucfirst( $slug ) ),
+                        ];
+                        unset( $registered[ $slug ] );
+                }
+                foreach ( $registered as $slug => $label ) {
+                        $options[] = [
+                                'value' => (string) $slug,
+                                'label' => (string) $label,
+                        ];
+                }
+                return $options;
+        }

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Services/Operations_Service.php

-              r3549389
+              r3663491
          * Duplicate one or more products.
+         *
+         * `created_ids` is the authoritative record of what was written: every TOP-LEVEL duplicate
+         * that saved, in creation order (never the variations duplicate_variations() creates).
+         * `products` is the subset that could also be formatted for display, and may be SHORTER —
+         * see the phase-2 comment. Count creations off created_ids; render rows off products.
+         *
          * @param int[] $product_ids Source product IDs.
          * @param int   $count       Number of copies to create per source product.
          * @return array { success: true, products: [ ... ], failed: [ ... ] }
+         * @return array { success: true, created_ids: int[], products: [ ... ], failed: [ ... ], warnings?: string[] }
          */
         public function duplicate_products( array $product_ids, int $count = 1 ): array {
 …
                 $products           = [];
+                $fresh_products     = [];
                 $failed             = [];
                 $total_var_failures = 0;
 …
                 if ( empty( $product_ids ) ) {
                         return [
+                                'success'  => true,
+                                'products' => [],
+                                'failed'   => [],
+                                'success'     => true,
+                                'created_ids' => [],
+                                'products'    => [],
+                                'failed'      => [],
                         ];
+                }
 …
                                 $duplicate->set_tag_ids( $source->get_tag_ids() );
                                 $duplicate->set_attributes( $source->get_attributes() );
+                                $duplicate->set_upsell_ids( $source->get_upsell_ids() );
+                                $duplicate->set_cross_sell_ids( $source->get_cross_sell_ids() );
+                                // 'edit' context: the view getters run through
+                                // woocommerce_product_get_upsell_ids / _cross_sell_ids, which third-party
+                                // code can filter. Copying a filtered projection would bake that plugin's
+                                // display-time view permanently into the duplicate's stored data.
+                                $duplicate->set_upsell_ids( $source->get_upsell_ids( 'edit' ) );
+                                $duplicate->set_cross_sell_ids( $source->get_cross_sell_ids( 'edit' ) );
                                 if ( $source->is_type( 'variable' ) ) {
 …
+                                        }
+                                        // Re-read from DB to get full data (variation_count, etc.).
+                                        // Re-read from DB to get full data (variation_count, etc.). Formatting is
+                                        // deferred until every duplicate exists, so linked-product descriptors
+                                        // are resolved in one batch rather than per copy — a clone carries the
+                                        // source's upsells/cross-sells, so every duplicate has refs to resolve.
                                         $fresh = wc_get_product( $duplicate->get_id() );
                                         if ( $fresh ) {
                                                 $products[] = Product_Helper::format_product( $fresh );
+                                                $fresh_products[] = $fresh;
+                                        }
                                 } catch ( \Exception $e ) {
 …
+                }
+                // Every duplicate above is already IN THE DATABASE. Formatting is presentation, so
+                // nothing below may throw out of this method: an uncaught exception becomes a 500 (no
+                // REST caller wraps us), the client reports "Failed to duplicate products", and the user
+                // retries — creating a SECOND set of copies. \Throwable, not \Exception: third-party
+                // callbacks on wcabe_g2_format_product raise Error/TypeError as readily as Exception.
+                //
+                // created_ids is the truthful record of what was WRITTEN. $products is only what could
+                // also be RENDERED, and may be shorter. Never conflate them: the client counts creations
+                // off created_ids and prepends rows off products.
+                //
+                // TOP-LEVEL ONLY. $fresh_products holds parent duplicates; the variations that
+                // duplicate_variations() saves are deliberately never collected here. Including them
+                // would inflate the "Duplicated N products" count and auto-select variation rows.
+                $created_ids     = array_map( static fn( $p ) => $p->get_id(), $fresh_products );
+                $format_failures = 0;
+                if ( ! empty( $fresh_products ) ) {
+                        $ref_map = null;
+                        try {
+                                // The hook lets Free's attribute handler and Pro's taxonomy handler warm their
+                                // caches before the loop, matching the contract get_products() and batch_update()
+                                // follow.
+                                do_action( 'wcabe_g2_before_format_products', $created_ids );
+                                $ref_map = Product_Helper::build_product_ref_map( $fresh_products );
+                        } catch ( \Throwable $e ) {
+                                // null, NOT []. An empty map makes project_product_refs() mark every ref dead;
+                                // null makes format_product() self-resolve per product — slower, but correct.
+                                $ref_map = null;
+                        }
+                        foreach ( $fresh_products as $fresh ) {
+                                try {
+                                        $products[] = Product_Helper::format_product( $fresh, $ref_map );
+                                } catch ( \Throwable $e ) {
+                                        // SKIP the row — never push null. useProductOperations' toast reducer does
+                                        // `'variation_count' in p`, which TypeErrors on a null element. The duplicate
+                                        // exists; created_ids still counts it, and the warning below tells the user
+                                        // to reload to see it.
+                                        $format_failures++;
+                                }
+                        }
+                }
                 $result = [
+                        'success'  => true,
+                        'products' => $products,
+                        'failed'   => $failed,
+                        'success'     => true,
+                        'created_ids' => $created_ids,
+                        'products'    => $products,
+                        'failed'      => $failed,
                 ];
+                $warnings = [];
                 if ( $total_var_failures > 0 ) {
+                        $result['warnings'] = [
+                                sprintf(
+                                        /* translators: %d: number of failed variations */
+                                        __( '%d variation(s) failed to duplicate.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        $total_var_failures
+                                ),
+                        ];
+                        $warnings[] = sprintf(
+                                /* translators: %d: number of failed variations */
+                                __( '%d variation(s) failed to duplicate.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                $total_var_failures
+                        );
+                }
+                if ( $format_failures > 0 ) {
+                        // Appended, never replacing — a run can hit both a variation failure and a format
+                        // failure, and dropping either would misreport what happened.
+                        $warnings[] = sprintf(
+                                /* translators: %d: number of duplicates that were created but could not be displayed */
+                                __( '%d duplicate(s) were created but could not be displayed. Reload to see them.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                $format_failures
+                        );
+                }
+                if ( ! empty( $warnings ) ) {
+                        $result['warnings'] = $warnings;
+                }

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Services/Product_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Handlers\WP_Save_Hooks_Handler;
 use WCABE_G2\Helpers\Product_Helper;
 …
 class Product_Service {
+        /** Allowed Title-search match modes. */
+        public const TITLE_SEARCH_MODES = [ 'phrase', 'all', 'any' ];
+        /** Allowed Product URL filter match modes (mirrors ProductUrlOperator in TS). */
+        public const PRODUCT_URL_OPERATORS = [ 'contains', 'not_contains', 'starts_with', 'ends_with', 'is_empty', 'is_not_empty' ];
+        /**
+         * Allowed SKU-search match modes (mirrors SkuSearchMode in TS).
+         *
+         * The empty string is deliberately NOT a member: it is the "auto" state,
+         * which routes to the legacy branch (comma-separated => exact IN, single
+         * term => substring LIKE). Keeping it out of the list means every
+         * `in_array( $mode, self::SKU_SEARCH_MODES, true )` gate treats auto and
+         * garbage identically — both fall back to legacy.
+         */
+        public const SKU_SEARCH_MODES = [ 'contains', 'is_exactly', 'not_contains', 'starts_with', 'ends_with' ];
+        /**
+         * Cap on the number of comma-separated tokens a SKU search term expands to.
+         *
+         * Unlike title search (10 words, a typo-tolerance affordance), pasting a
+         * large SKU list is a genuine bulk-edit workflow, so this is generous. It
+         * still exists because each token becomes its own LIKE/NOT LIKE clause,
+         * doubled again for the variation subquery when include_variations is on —
+         * an unbounded paste is a self-inflicted slow-query / DB-error risk on an
+         * otherwise `manage_woocommerce`-gated endpoint.
+         */
+        public const SKU_SEARCH_MAX_TOKENS = 200;
+        /**
+         * Whether a Product URL operator takes no value.
+         *
+         * These stay effective with an empty value, unlike every other text filter —
+         * callers must not gate them behind a truthiness check on the value.
+         *
+         * @param string $operator
+         * @return bool
+         */
+        public static function is_product_url_empty_check( string $operator ): bool {
+                return 'is_empty' === $operator || 'is_not_empty' === $operator;
+        }
+        /**
+         * Whether the Product URL filter is effective for a given operator/value pair.
+         *
+         * @param string $operator
+         * @param string $value
+         * @return bool
+         */
+        public static function product_url_filter_is_effective( string $operator, string $value ): bool {
+                return '' !== trim( $value ) || self::is_product_url_empty_check( $operator );
+        }
+        /**
+         * Normalise a raw search_sku_mode filter value to a known mode or '' (auto).
+         *
+         * Deliberately untyped: a direct service caller can put anything in the
+         * filter bag (an array from a malformed request shape, null, an int), and a
+         * `string` type hint would raise a TypeError before this could fall back.
+         * Every consumer — the SQL builder AND the per-variation matching mirrors —
+         * routes through here, so an invalid mode can never make the SQL take the
+         * legacy branch while variation narrowing takes a different one.
+         *
+         * @param mixed $mode Raw filter value.
+         * @return string One of self::SKU_SEARCH_MODES, or '' for auto/legacy.
+         */
+        public static function normalize_sku_mode( $mode ): string {
+                return is_string( $mode ) && in_array( $mode, self::SKU_SEARCH_MODES, true ) ? $mode : '';
+        }
+        /**
+         * Split a search_sku term into its comma-separated tokens.
+         *
+         * Filters on `'' !== $token` rather than array_filter()'s default
+         * truthiness: "0" is a valid WooCommerce SKU and must survive.
+         *
+         * Truncated to self::SKU_SEARCH_MAX_TOKENS. The cap lives HERE — not in the
+         * SQL builder alone — because this is the one function both the SQL builder
+         * and the PHP variation-narrowing mirror call to get their token list. A cap
+         * applied only on the SQL side would silently reopen the exact SQL/mirror
+         * divergence match modes were built to close: the query would ignore
+         * tokens past the limit while the mirror kept honouring all of them.
+         *
+         * @param string $term Raw (already sanitized) search_sku value.
+         * @return string[] Zero or more non-empty tokens, re-indexed, capped.
+         */
+        private static function split_sku_term( string $term ): array {
+                $tokens = array_map( 'sanitize_text_field', array_map( 'trim', explode( ',', $term ) ) );
+                $tokens = array_values(
+                        array_filter(
+                                $tokens,
+                                static fn( string $token ): bool => '' !== $token
+                        )
+                );
+                return array_slice( $tokens, 0, self::SKU_SEARCH_MAX_TOKENS );
+        }
+        /** Signed 32-bit bounds for wp_posts.menu_order (a MySQL signed INT). */
+        public const MENU_ORDER_MIN = -2147483648;
+        public const MENU_ORDER_MAX = 2147483647;
+        /**
+         * Private WP_Query marker scoping search_products()'s posts_join / posts_where callbacks
+         * to our own query. Without it those filters would apply to every WP_Query alive while
+         * they are registered — see the comment at the callbacks.
+         */
+        private const REF_SEARCH_QUERY_VAR = 'wcabe_ref_search';
+        /**
+         * Private WP_Query marker scoping get_products()'s Product URL posts_join / posts_where
+         * callbacks to our own query. Same rationale and shape as REF_SEARCH_QUERY_VAR above —
+         * see the comment at those callbacks.
+         */
+        private const PRODUCT_URL_QUERY_VAR = 'wcabe_product_url_filter';
         /**
 …
                 'simple'   => [
                         'name', 'sku', 'regular_price', 'sale_price', 'stock_quantity', 'stock_status', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'weight', 'length', 'width', 'height',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
                         'date_on_sale_from', 'date_on_sale_to',
                         'featured', 'virtual', 'downloadable',
                         'manage_stock', 'backorders',
                         'image_id', 'gallery_image_ids',
+                        'upsell_ids', 'cross_sell_ids',
+                        'menu_order',
                 ],
                 'variable' => [
                         'name', 'sku', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'weight', 'length', 'width', 'height',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
                         'featured',
                         'manage_stock', 'stock_quantity', 'stock_status', 'backorders',
                         'image_id', 'gallery_image_ids',
+                        'upsell_ids', 'cross_sell_ids',
+                        'menu_order',
                 ],
                 'variation' => [
                         'sku', 'regular_price', 'sale_price', 'stock_quantity', 'stock_status', 'status',
+                        'cogs_value',
                         'description',
                         'weight', 'length', 'width', 'height',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
                         'date_on_sale_from', 'date_on_sale_to',
                         'virtual', 'downloadable',
                         'manage_stock', 'backorders',
                         'image_id',
+                        'menu_order',
                 ],
                 'grouped'  => [
                         'name', 'sku', 'status', 'catalog_visibility',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'featured',
                         'image_id', 'gallery_image_ids',
+                        // Upsells only. WooCommerce hides Cross-sells on grouped and external products
+                        // (hide_if_grouped hide_if_external in its Linked Products metabox): cross-sells are
+                        // promoted in the CART, and neither type is ever added to the cart. Writing them
+                        // would persist meta that nothing ever renders. Upsells have no such restriction.
+                        'upsell_ids',
+                        'menu_order',
                 ],
                 'external' => [
                         'name', 'sku', 'regular_price', 'sale_price', 'stock_status', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'weight', 'length', 'width', 'height',
 …
                         'featured', 'virtual', 'downloadable',
                         'image_id', 'gallery_image_ids',
+                        // Upsells only — see the grouped note above.
+                        'upsell_ids',
+                        'menu_order',
+                        // External-only: the add-to-cart button label (WC_Product_External).
+                        'button_text',
+                        // External-only: the affiliate/destination link (WC_Product_External).
+                        'product_url',
                 ],
+                // WooCommerce Product Bundles (third-party type, #137). The 'simple' list
+                // minus virtual/downloadable — Bundles derives those from its own
+                // "assembled/unassembled" settings, so direct writes would fight the plugin.
+                // Prices and stock are valid: static-priced bundles store them natively.
+                'bundle'   => [
+                        'name', 'sku', 'regular_price', 'sale_price', 'stock_quantity', 'stock_status', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
+                        'categories', 'tags', 'description', 'short_description',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
+                        'date_on_sale_from', 'date_on_sale_to',
+                        'featured',
+                        'manage_stock', 'backorders',
+                        'image_id', 'gallery_image_ids',
+                        'upsell_ids', 'cross_sell_ids',
+                        'menu_order',
+                ],
+        ];
+        /**
+         * Conservative allowlist for product types with no curated ALLOWED_FIELDS
+         * entry (third-party types such as 'subscription', 'composite', 'booking').
+         * Type-agnostic post/taxonomy-level fields only — no prices, stock, or
+         * virtual/downloadable, because third-party types commonly derive those
+         * (e.g. Subscriptions syncs price from its own subscription fields).
+         * Cross-sells excluded for the same reason as grouped/external: we cannot
+         * know the type is cart-addable. Mirrored in the TS DEFAULT_EDITABLE_FIELDS
+         * (editable-fields.ts) — keep both in lockstep.
+         */
+        private const DEFAULT_ALLOWED_FIELDS = [
+                'name', 'sku', 'status', 'catalog_visibility',
+                'date_created',
+                'categories', 'tags', 'description', 'short_description',
+                'weight', 'length', 'width', 'height', 'shipping_class',
+                'featured',
+                'image_id', 'gallery_image_ids',
+                'upsell_ids',
+                'menu_order',
         ];
 …
         /**
+         * All queryable product types: the WooCommerce natives plus every type a
+         * third-party plugin has registered via the product-type selector (e.g.
+         * 'bundle', 'subscription', 'composite'). The natives are merged in
+         * explicitly so a plugin that filters its own type out of
+         * wc_get_product_types() cannot hide native products from the grid.
+         *
+         * @return string[] Product type slugs.
+         */
+        public static function get_known_product_types(): array {
+                return array_values( array_unique( array_merge(
+                        [ 'simple', 'variable', 'grouped', 'external' ],
+                        array_map( 'strval', array_keys( wc_get_product_types() ) )
+                ) ) );
+        }
+        /**
+         * Variable-capable product types: 'variable' plus every registered type
+         * whose product class extends WC_Product_Variable (e.g. WC Subscriptions'
+         * 'variable-subscription'). These are the types whose rows carry variations
+         * the grid can count, interleave, and expand (#137 follow-up).
+         *
+         * Object-context checks use `instanceof \WC_Product_Variable` directly;
+         * this list serves the query paths (tax_query terms, SQL clauses) that run
+         * before any product object exists. Both derive from the same truth — the
+         * registered product class.
+         *
+         * Deliberately uncached: wc_get_product_types() is a filter call and
+         * get_product_classname() is cheap, and callers outside per-row loops keep
+         * the call count small.
+         *
+         * @return string[] Product type slugs.
+         */
+        public static function get_variable_product_types(): array {
+                $types = [ 'variable' ];
+                foreach ( array_keys( wc_get_product_types() ) as $slug ) {
+                        $classname = \WC_Product_Factory::get_product_classname( 0, (string) $slug );
+                        if ( is_a( $classname, \WC_Product_Variable::class, true ) ) {
+                                $types[] = (string) $slug;
+                        }
+                }
+                return array_values( array_unique( $types ) );
+        }
+        /**
          * Get paginated products.
+         *
+         * @param int   $page
+         * @param int   $per_page
+         * @param bool  $include_variations
+         * @param array $filters Optional filter criteria.
+         * @param int    $page
+         * @param int    $per_page
+         * @param bool   $include_variations
+         * @param array  $filters Optional filter criteria.
+         * @param string $orderby Sort column: 'id' (default) or 'menu_order'.
+         * @param string $order   Sort direction: 'asc' or 'desc' (default).
          * @return array
          */
 …
                 int $per_page = 100,
                 bool $include_variations = false,
+                array $filters = []
+                array $filters = [],
+                string $orderby = 'id',
+                string $order = 'desc'
         ): array {
                 $query_result = $this->get_products_wc_crud( $page, $per_page, $filters, $include_variations );
+                $query_result = $this->get_products_wc_crud( $page, $per_page, $filters, $include_variations, false, $orderby, $order );
                 // Allow Pro to prime caches before per-product formatting.
 …
                 do_action( 'wcabe_g2_before_format_products', $product_ids );
+                // Prime the post cache for all gallery attachment IDs in a single query
+                // so that wp_get_attachment_image_url() inside format_product() hits the
+                // object cache instead of making individual DB queries (N+1 prevention).
+                $gallery_ids_to_prime = [];
+                // Prime the post cache for every attachment ID referenced on this page — the
+                // gallery IDs and each product's featured image — in a single query, so that
+                // wp_get_attachment_image_url() and get_image_upload_date() inside
+                // format_product() hit the object cache instead of making individual DB
+                // queries (N+1 prevention).
+                $attachment_ids_to_prime = [];
                 foreach ( $query_result['products'] as $product ) {
                         $gids = $product->get_gallery_image_ids();
                         if ( ! empty( $gids ) ) {
+                                array_push( $gallery_ids_to_prime, ...$gids );
+                        }
+                }
+                if ( ! empty( $gallery_ids_to_prime ) ) {
+                        _prime_post_caches( array_unique( $gallery_ids_to_prime ), false, false );
+                }
+                $formatted = array_map( [ Product_Helper::class, 'format_product' ], $query_result['products'] );
+                                array_push( $attachment_ids_to_prime, ...$gids );
+                        }
+                        // Both contexts: view feeds wp_get_attachment_image_url() (thumbnail_url),
+                        // edit/raw feeds get_image_upload_date() (image_date). They differ only
+                        // when a plugin hooks woocommerce_product_get_image_id; array_unique
+                        // below collapses them on every other site.
+                        $featured_id = (int) $product->get_image_id();
+                        if ( $featured_id > 0 ) {
+                                $attachment_ids_to_prime[] = $featured_id;
+                        }
+                        $raw_featured_id = (int) $product->get_image_id( 'edit' );
+                        if ( $raw_featured_id > 0 && $raw_featured_id !== $featured_id ) {
+                                $attachment_ids_to_prime[] = $raw_featured_id;
+                        }
+                }
+                if ( ! empty( $attachment_ids_to_prime ) ) {
+                        _prime_post_caches( array_unique( $attachment_ids_to_prime ), false, false );
+                }
+                // Batch-resolve every upsell/cross-sell ref on the page in one pass. Returns []
+                // (and primes nothing) when no product on the page has refs, so stores that don't
+                // use these fields pay nothing. Must be passed into format_product() explicitly —
+                // array_map() would only pass one arg, and the null fallback would resolve each
+                // product's refs individually, i.e. the N+1 this exists to prevent.
+                $ref_map = Product_Helper::build_product_ref_map( $query_result['products'] );
+                $formatted = array_map(
+                        static fn( $product ) => Product_Helper::format_product( $product, $ref_map ),
+                        $query_result['products']
+                );
                 // Interleave variations if requested.
 …
                         $variation_ids_to_prime = [];
                         foreach ( $query_result['products'] as $product ) {
+                                if ( $product->is_type( 'variable' ) ) {
+                                // instanceof, not is_type('variable'): third-party variable
+                                // subclasses (variable-subscription, …) carry variations too (#137).
+                                if ( $product instanceof \WC_Product_Variable ) {
                                         $children = $product->get_children();
                                         $children_map[ $product->get_id() ] = $children;
 …
+                }
+                if ( ! $product->is_type( 'variable' ) ) {
+                // instanceof, not is_type('variable'): accepts third-party variable
+                // subclasses (variable-subscription, …) whose children are real
+                // variations (#137).
+                if ( ! $product instanceof \WC_Product_Variable ) {
                         return new \WP_Error(
                                 'not_variable',
 …
         /**
+         * Default page size for stream_products() when the caller doesn't specify one.
+         *
+         * The variation-mode value is deliberately smaller. Page size bounds PARENTS,
+         * not emitted rows: get_products() primes and formats every variation of a
+         * page's parents before the stream can slice, so a variation-heavy page is the
+         * export's residual memory spike. 25 parents reduces the typical spike (a single
+         * parent with hundreds of variations can still exceed it).
+         */
+        private const STREAM_PAGE_SIZE            = 100;
+        private const STREAM_PAGE_SIZE_VARIATIONS = 25;
+        /**
+         * Page through filtered products, handing each formatted page to $consumer.
+         *
+         * The export path's collection seam. Nothing accumulates here — each page is
+         * released before the next query runs — which is what keeps a 10k-row export
+         * inside a modest memory_limit. Lives in the service (not the controller)
+         * because Export_Controller::export() terminates with exit() and so cannot be
+         * reached from PHPUnit; this method is the covered half.
+         *
+         * $consumer is called once per NON-EMPTY page. Cache releases run for every
+         * page regardless, including pages that yielded nothing and pages whose
+         * collection or consumption threw.
+         *
+         * @param array    $filters            Sanitized filters.
+         * @param bool     $include_variations Interleave variations under their parents.
+         * @param int      $max_rows           Hard cap on total rows emitted.
+         * @param callable $consumer           fn( array $formatted_rows ): void
+         * @param int|null $per_page           Page size. Null = STREAM_PAGE_SIZE(_VARIATIONS).
+         * @return int Total rows emitted (0..$max_rows).
+         */
+        public function stream_products(
+                array $filters,
+                bool $include_variations,
+                int $max_rows,
+                callable $consumer,
+                ?int $per_page = null
+        ): int {
+                if ( $max_rows <= 0 ) {
+                        return 0;
+                }
+                if ( null === $per_page ) {
+                        $per_page = $include_variations ? self::STREAM_PAGE_SIZE_VARIATIONS : self::STREAM_PAGE_SIZE;
+                }
+                // The export never reads total_with_variations, but get_products() would run
+                // an extra COUNT for it on EVERY page. Suppress it for the duration of the
+                // loop. A unique closure, not __return_false: removing the shared string
+                // callback could unhook a registration someone else made.
+                $suppress_variation_total = static fn() => false;
+                add_filter( 'wcabe_g2_compute_variation_total', $suppress_variation_total, 999 );
+                $count = 0;
+                $page  = 1;
+                try {
+                        do {
+                                // Collection lives INSIDE the try: get_products() primes caches and runs
+                                // third-party format filters (Pro's ACF reads, for one), so a throw
+                                // during collection must still release what it allocated.
+                                try {
+                                        $result      = $this->get_products( $page, $per_page, $include_variations, $filters );
+                                        $rows        = $result['products'];
+                                        $total_pages = (int) $result['total_pages'];
+                                        // Detach the page from $result before the next query, or two pages
+                                        // would be live at once.
+                                        unset( $result );
+                                        // Interleaved variations mean a page can overshoot the budget
+                                        // mid-page. Slicing per page is equivalent to the old
+                                        // accumulate-then-slice: slicing a concatenation at N is slicing the
+                                        // last contributing page.
+                                        $remaining = $max_rows - $count;
+                                        if ( count( $rows ) > $remaining ) {
+                                                $rows = array_slice( $rows, 0, $remaining );
+                                        }
+                                        $count += count( $rows );
+                                        if ( ! empty( $rows ) ) {
+                                                $consumer( $rows );
+                                        }
+                                } finally {
+                                        unset( $rows );
+                                        Product_Helper::flush_runtime_cache();
+                                        /**
+                                         * Fires after each export chunk has been consumed and released.
+                                         *
+                                         * Extensions (Pro) use this to drop their own request-local caches —
+                                         * ACF, for instance, retains every field value it reads for the whole
+                                         * request, which would otherwise grow with rows × fields.
+                                         */
+                                        do_action( 'wcabe_g2_export_after_chunk' );
+                                }
+                                $page++;
+                        } while ( $count < $max_rows && $page <= $total_pages );
+                } finally {
+                        remove_filter( 'wcabe_g2_compute_variation_total', $suppress_variation_total, 999 );
+                }
+                return $count;
+        }
+        /**
+         * Chunked variant of get_products_by_ids() — the "export selected rows" stream.
+         *
+         * Same contract as get_products_by_ids() (normalise, clamp BEFORE any read, drop
+         * non-products, prime once per batch), but only one chunk of WC_Product objects
+         * and formatted arrays is live at a time.
+         *
+         * One intentional difference: the shared ref map and the
+         * wcabe_g2_before_format_products batch span a chunk rather than the whole
+         * selection. Output is identical; selections over $chunk_size pay slightly more
+         * priming queries in exchange for bounded memory.
+         *
+         * @param int[]    $ids
+         * @param int      $max_rows   Hard cap on total rows emitted.
+         * @param callable $consumer   fn( array $formatted_rows ): void
+         * @param int      $chunk_size Ids per batch.
+         * @return int Total rows emitted (0..$max_rows).
+         */
+        public function stream_products_by_ids(
+                array $ids,
+                int $max_rows,
+                callable $consumer,
+                int $chunk_size = 100
+        ): int {
+                if ( $max_rows <= 0 ) {
+                        return 0;
+                }
+                // Clamp the NORMALISED list before any read, so a 50k-id request cannot fan out.
+                $ids = Product_Helper::normalize_product_ids( $ids, $max_rows );
+                if ( empty( $ids ) ) {
+                        return 0;
+                }
+                $count = 0;
+                foreach ( array_chunk( $ids, max( 1, $chunk_size ) ) as $chunk ) {
+                        // Collection inside the try for the same reason as stream_products():
+                        // it primes caches and runs format filters before it can return.
+                        try {
+                                $rows   = $this->get_products_by_ids( $chunk, count( $chunk ) );
+                                $count += count( $rows );
+                                // A chunk of only dead ids yields nothing — but it still primed post
+                                // caches, so the release in finally still has work to do.
+                                if ( ! empty( $rows ) ) {
+                                        $consumer( $rows );
+                                }
+                        } finally {
+                                unset( $rows );
+                                Product_Helper::flush_runtime_cache();
+                                /** This filter is documented in Product_Service::stream_products(). */
+                                do_action( 'wcabe_g2_export_after_chunk' );
+                        }
+                }
+                return $count;
+        }
+        /**
+         * Format an explicit list of product/variation IDs — the "export selected rows" path.
+         *
+         * Lives here, not in Export_Controller, for two reasons. It is product-collection logic,
+         * which is a service concern (the controller does route parsing and response shaping).
+         * And Export_Controller::export() terminates with exit(), so anything inlined there is
+         * unreachable from PHPUnit — this seam is what makes the selected-rows export testable.
+         *
+         * Contract, in order:
+         *   1. Normalise to positive ints, dedupe (FIRST occurrence wins), preserve caller order.
+         *      intval, not absint — absint( -7 ) is 7, which would export an unrelated product.
+         *   2. Clamp the NORMALISED list to $limit, before any read, so a 50k-id request cannot
+         *      fan out and so duplicates don't eat the budget.
+         *   3. Drop ids that are not a product or variation (deleted, or never one).
+         *   4. Prime once, then format once against ONE shared ref map — never per row.
+         *
+         * @param int[] $ids
+         * @param int   $limit Max rows to return.
+         * @return array[] Formatted product/variation arrays, in the caller's id order.
+         */
+        public function get_products_by_ids( array $ids, int $limit ): array {
+                if ( $limit <= 0 ) {
+                        return [];
+                }
+                $source_ids = Product_Helper::prime_product_caches( $ids, $limit );
+                if ( empty( $source_ids ) ) {
+                        return [];
+                }
+                $wc_products = [];
+                foreach ( $source_ids as $id ) {
+                        $wc_product = wc_get_product( $id );
+                        if ( $wc_product ) {
+                                $wc_products[] = $wc_product;
+                        }
+                }
+                if ( empty( $wc_products ) ) {
+                        return [];
+                }
+                // Same contract as get_products() and batch_update(): let Free's attribute handler and
+                // Pro's taxonomy handler warm their caches before the formatting loop.
+                do_action( 'wcabe_g2_before_format_products', array_map( static fn( $p ) => $p->get_id(), $wc_products ) );
+                // ONE ref map for the whole selection. Formatting per product with no map would resolve
+                // each row's refs individually — the N+1 this exists to prevent, up to $limit rows deep.
+                $ref_map = Product_Helper::build_product_ref_map( $wc_products );
+                $products = [];
+                foreach ( $wc_products as $wc_product ) {
+                        $products[] = $wc_product->is_type( 'variation' )
+                                ? Product_Helper::format_variation( $wc_product )
+                                : Product_Helper::format_product( $wc_product, $ref_map );
+                }
+                return $products;
+        }
+        /**
+         * Search products and variations for the linked-product picker.
+         *
+         * Deliberately NOT WC_Data_Store::search_products(). Core's query has three properties
+         * that are wrong for a picker:
+         *
+         *  1. It matches post_content and post_excerpt, and applies its LIMIT in SQL (ordered by
+         *     post_parent, post_title). A term appearing in a hundred product descriptions
+         *     therefore truncates the candidate set BEFORE any post-filter can run — the real
+         *     title/SKU match is never returned at all. Recall loss no downstream filter can fix.
+         *  2. It appends a numeric-ID hit AFTER its SQL exclusion and status filtering, with no
+         *     exclude check and no status check — so a numeric term defeats $exclude (a product
+         *     could offer itself as its own upsell) and resurrects drafts.
+         *  3. It surfaces the PARENTS of matching variations; a picker needs the variation itself.
+         *
+         * This searches exactly the three fields a picker should search — post_title, sku and
+         * global_unique_id (GTIN/EAN, which G1 never had) — so content-only matches cannot enter
+         * the candidate set by construction, and applies exclusion, post type and status
+         * uniformly, including to the numeric pin.
+         *
+         * Variations are included as selectable targets, matching WooCommerce core's own Linked
+         * Products metabox.
+         *
+         * @param string $term    Search term (title, SKU, GTIN, or a bare product ID).
+         * @param int[]  $exclude Product IDs to omit (e.g. the product being edited).
+         * @param int    $limit   Max results (clamped to 1..50).
+         * @return array[] Ordered ref descriptors: [ id, name, sku, type, status, missing ].
+         */
+        public function search_products( string $term, array $exclude = [], int $limit = 30 ): array {
+                global $wpdb;
+                $term = trim( $term );
+                if ( '' === $term ) {
+                        return [];
+                }
+                $exclude = array_values( array_filter( array_map( 'intval', $exclude ), static fn( $id ) => $id > 0 ) );
+                $limit   = max( 1, min( $limit, 50 ) );
+                // Same status vocabulary WooCommerce uses for its own product search: private
+                // products are visible only to users who may edit them.
+                $post_statuses = current_user_can( 'edit_private_products' )
+                        ? [ 'private', 'publish' ]
+                        : [ 'publish' ];
+                $like        = '%' . $wpdb->esc_like( $term ) . '%';
+                $name_clause = $this->build_name_search_clause( $wpdb, $term, 'phrase' );
+                // Both callbacks take the WP_Query and bail unless it carries our private marker.
+                // posts_join / posts_where fire on EVERY WP_Query for as long as they are registered —
+                // including any a third-party pre_get_posts listener spins up inside ours. Unscoped,
+                // those queries would inherit our WHERE; and because the JOIN is added only once (the
+                // strpos guard), a nested query could even receive the wcabe_ref_lookup WHERE WITHOUT
+                // the JOIN and hard-fail on an unknown column. Same guard shape as
+                // Pro_Revision_Filter_Handler::filter_post_mime_where().
+                $join_callback = static function ( string $join, \WP_Query $query ) use ( $wpdb ): string {
+                        if ( ! $query->get( self::REF_SEARCH_QUERY_VAR ) ) {
+                                return $join;
+                        }
+                        if ( false === strpos( $join, 'wcabe_ref_lookup' ) ) {
+                                $join .= " LEFT JOIN {$wpdb->prefix}wc_product_meta_lookup AS wcabe_ref_lookup ON {$wpdb->posts}.ID = wcabe_ref_lookup.product_id ";
+                        }
+                        return $join;
+                };
+                $where_callback = static function ( string $where, \WP_Query $query ) use ( $wpdb, $name_clause, $like ): string {
+                        if ( ! $query->get( self::REF_SEARCH_QUERY_VAR ) ) {
+                                return $where;
+                        }
+                        $sku_clause = $wpdb->prepare(
+                                '( wcabe_ref_lookup.sku LIKE %s OR wcabe_ref_lookup.global_unique_id LIKE %s )',
+                                $like,
+                                $like
+                        );
+                        // Title OR SKU OR GTIN. No post_content, no post_excerpt — that is the point.
+                        return $where . " AND ( {$name_clause} OR {$sku_clause} ) ";
+                };
+                add_filter( 'posts_join', $join_callback, 10, 2 );
+                add_filter( 'posts_where', $where_callback, 10, 2 );
+                try {
+                        $query = new \WP_Query( [
+                                'post_type'                 => [ 'product', 'product_variation' ],
+                                'post_status'               => $post_statuses,
+                                'post__not_in'              => $exclude,
+                                'posts_per_page'            => $limit,
+                                'fields'                    => 'ids',
+                                'orderby'                   => 'title',
+                                'order'                     => 'ASC',
+                                // No total is consumed, so skip SQL_CALC_FOUND_ROWS.
+                                'no_found_rows'             => true,
+                                'ignore_sticky_posts'       => true,
+                                // resolve_product_ref_ids() primes exactly the caches it needs.
+                                'update_post_meta_cache'    => false,
+                                'update_post_term_cache'    => false,
+                                // The marker the two callbacks above key off. Private to us.
+                                self::REF_SEARCH_QUERY_VAR  => true,
+                        ] );
+                        $ids = array_map( 'intval', (array) $query->posts );
+                } finally {
+                        remove_filter( 'posts_join', $join_callback, 10 );
+                        remove_filter( 'posts_where', $where_callback, 10 );
+                }
+                // Numeric ID pin — our ID search; core does not offer one.
+                //
+                // ctype_digit(), NOT is_numeric(). is_numeric() also accepts '1.5', '1e3', '+12' and
+                // '-7', every one of which is a legitimate SKU to search for — and absint('1e3') is
+                // 1000, so searching for a SKU literally named "1e3" would pin an unrelated product
+                // #1000 into the results. Core's search_products() has exactly this bug.
+                //
+                // Exclusion, post type and status are applied HERE, to the pin itself. Core appends
+                // its numeric hit after those filters, which is precisely how a numeric term ends up
+                // defeating $exclude and resurrecting drafts.
+                if ( ctype_digit( $term ) ) {
+                        $pin_id = absint( $term );
+                        if ( $pin_id > 0 && ! in_array( $pin_id, $exclude, true ) ) {
+                                $pin_post = get_post( $pin_id );
+                                if (
+                                        $pin_post
+                                        && in_array( $pin_post->post_type, [ 'product', 'product_variation' ], true )
+                                        && in_array( $pin_post->post_status, $post_statuses, true )
+                                ) {
+                                        array_unshift( $ids, $pin_id );
+                                        // array_unique keeps the FIRST occurrence, so the pin stays on top.
+                                        $ids = array_values( array_unique( $ids ) );
+                                }
+                        }
+                }
+                $ids = array_slice( $ids, 0, $limit );
+                if ( empty( $ids ) ) {
+                        return [];
+                }
+                // Resolve the search HITS themselves. resolve_product_ref_ids(), never
+                // build_product_ref_map() — the latter takes owners and would hand back each hit's
+                // upsells instead of the hit.
+                $map = Product_Helper::resolve_product_ref_ids( $ids );
+                return array_values( array_filter( array_map(
+                        static fn( int $id ) => $map[ $id ] ?? null,
+                        $ids
+                ) ) );
+        }
+        /**
          * Batch update products.
+         *
+         * @param array $items Array of [ 'id' => int, 'changes' => array ].
+         * @param array $items   Array of [ 'id' => int, 'changes' => array ].
+         * @param array $context Optional per-save context threaded through to the
+         *                       `wcabe_g2_before_product_save` hook. Shape: [ 'batch_id' => ?string ].
+         *                       Free reads nothing from it; extensions may.
          * @return array Array of per-item results.
+         */
+        public function batch_update( array $items ): array {
+         *
+         * Each item runs one "save cycle", identified by an opaque $save_token threaded
+         * through both the before- and after-save seams, so listeners can correlate the two
+         * halves of ONE cycle even when cycles nest — a save_post listener woken by the
+         * after-save seam can itself call batch_update() on the SAME product id, so post id
+         * alone does not identify a cycle. WP_Save_Hooks_Handler::finish_cycle() in the
+         * finally below is the guaranteed teardown for whatever the before-seam armed.
+         */
+        public function batch_update( array $items, array $context = [] ): array {
                 $results = [];
+                // Successful saves, keyed by their index in $results. Formatting is deferred to
+                // phase 2 (after the loop) so linked-product descriptors are built once, and built
+                // fresh — see the comment there.
+                $saved = [];
+                // Batch-prime post, term, and meta caches for every target id in one pass so the
+                // per-item wc_get_product() below — and any listener on wcabe_g2_before_product_save
+                // that re-reads the product (e.g. Operation History's pre/post-image capture, which
+                // formats each product twice) — hit warm caches instead of firing individual queries
+                // per product. Same N+1-prevention rule get_products() follows; a no-op behaviorally.
+                $prime_ids = [];
+                foreach ( $items as $item ) {
+                        $prime_id = absint( $item['id'] ?? 0 );
+                        if ( $prime_id ) {
+                                $prime_ids[] = $prime_id;
+                        }
+                }
+                if ( ! empty( $prime_ids ) && function_exists( '_prime_post_caches' ) ) {
+                        _prime_post_caches( array_unique( $prime_ids ), true, true );
+                }
                 foreach ( $items as $item ) {
 …
+                        }
+                        // Opaque, unique per save cycle. Generated before anything can fail so the
+                        // finally below always has a token to tear down with — even on paths that
+                        // never armed anything (finish_cycle() no-ops on an unknown token).
+                        $save_token = uniqid( 'wcabe_save_', true );
                         try {
                                 $product = wc_get_product( $id );
 …
                                 $type = $product->get_type();
-                                $allowed_fields = self::ALLOWED_FIELDS[ $type ] ?? [];
-                                $allowed_fields = apply_filters( 'wcabe_g2_allowed_fields', $allowed_fields, $product );
                                 // Validate all changes before applying any.
+                                $validation_errors = $this->validate_changes( $product, $changes, $allowed_fields );
+                                $validation_errors = apply_filters( 'wcabe_g2_validate_extra_fields', $validation_errors, $product, $changes );
+                                $validation        = $this->validate_item( $product, $changes );
+                                $allowed_fields    = $validation['allowed_fields'];
+                                $validation_errors = $validation['errors'];
                                 if ( ! empty( $validation_errors ) ) {
                                         $results[] = [
 …
+                                }
+                                do_action( 'wcabe_g2_before_product_save', $product, $changes, $allowed_fields );
+                                // Pre-save snapshot, read before any listener can mutate the post. Passed to
+                                // the after-seam so listeners get the same $post_before WordPress hands to
+                                // wp_after_insert_post(). Post caches were primed for the whole batch above,
+                                // so this is a cache read, not a query.
+                                $post_before = get_post( $id );
+                                do_action( 'wcabe_g2_before_product_save', $product, $changes, $allowed_fields, $context, $save_token );
                                 $product->save();
+                                $is_variation = $product->is_type( 'variation' );
+                                $data = $is_variation
+                                        ? Product_Helper::format_variation( $product )
+                                        : Product_Helper::format_product( $product );
+                                // THE WRITE HAS COMMITTED. Everything below is notification, and notification
+                                // must never be able to report a committed write as failed — the client would
+                                // surface it as an error and re-send rows that were in fact written.
+                                //
+                                // \Throwable, not \Exception: this seam wakes arbitrary third-party code (its
+                                // whole purpose is firing save_post for sync plugins), and the enclosing
+                                // catch below only takes \Exception — a listener raising Error/TypeError would
+                                // escape batch_update() entirely and 500 the request. Same rule, and the same
+                                // reasoning, as the formatting phase below.
+                                try {
+                                        do_action( 'wcabe_g2_after_product_save', $product, $changes, $context, $post_before, $save_token );
+                                } catch ( \Throwable $t ) {
+                                        $warnings[] = sprintf(
+                                                /* translators: %s: error message from the third-party callback */
+                                                __( 'The product was saved, but another plugin errored while being notified: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                $t->getMessage()
+                                        );
+                                }
                                 $result = [
                                         'id'      => $id,
                                         'success' => true,
                                         'data'    => $data,
+                                        'data'    => null, // Filled in phase 2 below.
                                 ];
 …
                                 $results[] = $result;
+                                // Retain the saved object AND its slot in $results, so phase 2 can write
+                                // each formatted row back in place and the response order is preserved.
+                                $saved[ array_key_last( $results ) ] = $product;
                         } catch ( \Exception $e ) {
 …
                                         ],
                                 ];
+                        } finally {
+                                // Unconditional teardown for this cycle — runs on every exit path, including
+                                // the `continue`s above (validation failure, product not found) and any
+                                // exception. Deliberately a direct static call and NOT a do_action: a public
+                                // teardown hook would let a third-party Throwable escape this finally and
+                                // override an already-successful result, re-opening the exact failure mode
+                                // the after-seam's Throwable isolation just closed. Teardown is an internal
+                                // lifecycle detail, not an extension point.
+                                WP_Save_Hooks_Handler::finish_cycle( $save_token );
+                        }
+                }
+                // --- Phase 2: format every successful save against ONE freshly-built ref map. ---
+                //
+                // Deliberately after ALL saves, never before. A single batch can (a) give a product
+                // new upsell IDs, and (b) rename or re-SKU a product that another row in the same
+                // batch points at. A map built before the loop would miss (a) entirely and carry
+                // stale descriptors for (b). save() invalidates each product's post cache, so the
+                // re-prime inside resolve_product_ref_ids() reads post-write values.
+                //
+                // EVERY WRITE ABOVE HAS ALREADY COMMITTED. Formatting is presentation, so nothing below
+                // may throw out of this method: an uncaught exception here becomes a 500 (no REST caller
+                // wraps us), the client marks the whole chunk failed, and the user re-saves rows that
+                // were in fact written. \Throwable, not \Exception — wcabe_g2_format_product is a public
+                // filter and third-party callbacks raise Error/TypeError as readily as Exception.
+                if ( ! empty( $saved ) ) {
+                        // Re-read every saved product before formatting. NOT an optimisation to be tidied away:
+                        //
+                        // WC_Data::apply_changes() (abstract-wc-data.php:907) merges with array_replace_recursive(),
+                        // and WC_Product does not override it. That merges ARRAY props by INDEX instead of
+                        // replacing them — so an array prop that SHRANK leaves the in-memory object corrupt after
+                        // save(). Upsells [A, B, C] → [B] persists [B] correctly, but the object is left holding
+                        // array_replace_recursive([A,B,C], [B]) === [B, B, C]. Formatting from that object hands
+                        // the grid a row contradicting the write that just succeeded, and the user watches the
+                        // link they removed come straight back. Same trap for gallery_image_ids, categories, tags
+                        // and attributes — every array prop, whenever the new value is shorter than the old.
+                        //
+                        // WooCommerce's own REST controller re-reads after save for exactly this reason
+                        // (WC_REST_CRUD_Controller::save_object). Priming first is what keeps it affordable: post
+                        // and meta for the whole batch come from one prime, so the per-product read stays off the
+                        // query path.
+                        $saved_ids = array_values( array_map( static fn( $p ) => $p->get_id(), $saved ) );
+                        Product_Helper::prime_product_caches( $saved_ids );
+                        foreach ( $saved as $index => $product ) {
+                                $reread = wc_get_product( $product->get_id() );
+                                if ( $reread ) {
+                                        $saved[ $index ] = $reread;
+                                }
+                        }
+                        $ref_map = null;
+                        try {
+                                // Same contract as get_products(): let Free's attribute handler and Pro's
+                                // taxonomy handler warm their caches before a batch formatting loop, or their
+                                // per-product term lookups become the N+1 we just removed from ours.
+                                do_action( 'wcabe_g2_before_format_products', $saved_ids );
+                                $ref_map = Product_Helper::build_product_ref_map( $saved );
+                        } catch ( \Throwable $e ) {
+                                // null, NOT []. project_product_refs() does `$ref_map[$id] ?? missing_product_ref($id)`,
+                                // so an empty map would mark every ref DEAD and tell the user their upsells are
+                                // all broken. null makes format_product() self-resolve per product — an N+1, but
+                                // correct, on a path that should never fire.
+                                $ref_map = null;
+                        }
+                        foreach ( $saved as $index => $product ) {
+                                try {
+                                        $results[ $index ]['data'] = $product->is_type( 'variation' )
+                                                ? Product_Helper::format_variation( $product )
+                                                : Product_Helper::format_product( $product, $ref_map );
+                                } catch ( \Throwable $e ) {
+                                        // The write committed, so `success` stays true — flipping it would strand the
+                                        // pending change client-side and invite a duplicate re-send. Drop the key
+                                        // rather than nulling it: BatchResult.data is declared OPTIONAL (absent), not
+                                        // nullable. The client tolerates a missing data (useSave gates on
+                                        // `item.success && item.data`, and clears the pending change either way), and
+                                        // the background refetch supplies the true row.
+                                        unset( $results[ $index ]['data'] );
+                                }
+                        }
+                }
                 return $results;
+        }
+        /**
+         * Resolve the effective field allowlist and validate a change set — WITHOUT
+         * applying anything.
+         *
+         * VALIDATION ONLY — zero side effects: no setters, no save, no hooks beyond
+         * the two established validation filters. Safe to call as a pure dry-run.
+         *
+         * Deliberate shared extension seam (the first since Phase A's $context arg
+         * on wcabe_g2_before_product_save): batch_update() runs its validation
+         * through this method, and Pro's Operation History pre-flight calls it
+         * directly so restorability is judged by the exact allowlist + validation
+         * pipeline that will perform the write — never by a reimplementation.
+         * Free functions identically without any caller besides batch_update().
+         *
+         * @param \WC_Product $product The product the changes target.
+         * @param array       $changes Field => value map (input vocabulary).
+         * @return array{allowed_fields: array, errors: array} allowed_fields is the
+         *                post-filter allowlist for the product's type; errors is an
+         *                array of [ 'field' => string, 'value' => mixed, 'message' => string ].
+         */
+        public function validate_item( \WC_Product $product, array $changes ): array {
+                $type           = $product->get_type();
+                $allowed_fields = self::ALLOWED_FIELDS[ $type ] ?? self::DEFAULT_ALLOWED_FIELDS;
+                $allowed_fields = apply_filters( 'wcabe_g2_allowed_fields', $allowed_fields, $product );
+                $errors = $this->validate_changes( $product, $changes, $allowed_fields );
+                $errors = apply_filters( 'wcabe_g2_validate_extra_fields', $errors, $product, $changes );
+                return [
+                        'allowed_fields' => $allowed_fields,
+                        'errors'         => $errors,
+                ];
+        }
 …
+                        }
                         // Price validation.
                         if ( in_array( $field, [ 'regular_price', 'sale_price' ], true ) ) {
+                        // Price validation (COGS is a monetary cost — same numeric ≥ 0 rule).
+                        if ( in_array( $field, [ 'regular_price', 'sale_price', 'cogs_value' ], true ) ) {
                                 $sanitized = trim( (string) $value );
                                 if ( '' !== $sanitized ) {
 …
                                                 'value'   => $value,
                                                 'message' => __( 'Stock quantity must be a valid number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                }
+                        } elseif ( 'menu_order' === $field ) {
+                                // Menu order is a signed 32-bit integer (default 0). Empty is allowed
+                                // (treated as 0 on save). Decimals/non-numeric are rejected; so are
+                                // values outside the signed-INT range — WordPress runs MySQL non-strict,
+                                // so an out-of-range value would clamp silently on save.
+                                if ( null !== $value && '' !== $value ) {
+                                        $str = (string) $value;
+                                        if ( ! preg_match( '/^-?\d+$/', $str ) ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                ];
+                                        } elseif ( ! self::menu_order_in_int32_range( $str ) ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => __( 'Menu order is out of range.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                ];
+                                        }
+                                }
+                        } elseif ( 'product_url' === $field ) {
+                                // External-product destination link. Policy (server authoritative):
+                                // - non-string (array/object) is rejected outright: esc_url_raw()
+                                //   would throw or a (string) cast would store the literal "Array";
+                                // - empty clears the field;
+                                // - otherwise valid iff esc_url_raw() keeps something, i.e. only
+                                //   disallowed protocols (javascript:, data:, ...) are rejected.
+                                //   Anything wp_allowed_protocols() permits (http, https, ftp,
+                                //   mailto, tel, ...) is accepted, matching WooCommerce's own
+                                //   product-data panel — being stricter would break bulk
+                                //   prepend/append over legitimately stored non-http values.
+                                //   Schemeless input ("example.com") is accepted and normalized to
+                                //   http:// on save.
+                                //
+                                // Validated against the TRIMMED value, matching what the write path
+                                // in apply_field_change() actually stores.
+                                if ( null !== $value && ! is_string( $value ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Product URL must be text.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } elseif ( null !== $value && '' !== trim( $value ) && '' === esc_url_raw( trim( $value ) ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Product URL is not a valid URL.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                         ];
+                                }
 …
+                                        }
+                                }
+                        } elseif ( 'date_created' === $field ) {
+                                // Publish date (post_date) — REQUIRED. Unlike sale dates it cannot be
+                                // emptied (every post has a post_date; an empty value would reset it to
+                                // "now" on save). Must be a valid Y-m-d or Y-m-d H:i:s (a bare date is
+                                // accepted for back-compat; WC pads it to 00:00:00). Future dates are allowed.
+                                $sanitized = sanitize_text_field( (string) $value );
+                                if ( '' === $sanitized ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Published date cannot be empty.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } elseif ( ! preg_match( '/^\d{4}-\d{2}-\d{2}( \d{2}:\d{2}:\d{2})?$/', $sanitized ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Invalid date format for Published on. Expected YYYY-MM-DD or YYYY-MM-DD HH:MM:SS.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } else {
+                                        $parts = explode( '-', substr( $sanitized, 0, 10 ) );
+                                        $valid = checkdate( (int) $parts[1], (int) $parts[2], (int) $parts[0] );
+                                        if ( $valid && strlen( $sanitized ) > 10 ) {
+                                                // Time part present: the regex guarantees an exact HH:MM:SS shape.
+                                                list( $h, $i, $s ) = array_map( 'intval', explode( ':', substr( $sanitized, 11 ) ) );
+                                                $valid = ( $h <= 23 && $i <= 59 && $s <= 59 );
+                                        }
+                                        if ( ! $valid ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => __( 'Invalid date for Published on.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                ];
+                                        }
+                                }
                         } elseif ( in_array( $field, [ 'date_on_sale_from', 'date_on_sale_to' ], true ) ) {
                                 // Date validation — must be empty or Y-m-d format.
 …
                                         // Empty array is valid — this is the "clear gallery" path.
                                         foreach ( $value as $gid ) {
                                                 if ( ! is_numeric( $gid ) || (int) $gid <= 0 ) {
+                                                if ( ! self::is_positive_int_id( $gid ) ) {
                                                         $errors[] = [
                                                                 'field'   => $field,
                                                                 'value'   => $value,
                                                                 'message' => __( 'Invalid gallery image ID.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                        ];
+                                                        break;
+                                                }
+                                        }
+                                }
+                        } elseif ( in_array( $field, [ 'upsell_ids', 'cross_sell_ids' ], true ) ) {
+                                // Accepts both wire shapes the normaliser accepts: int[] (Operation History
+                                // restore) and [{ id: int }] (the grid). Existence is deliberately NOT
+                                // checked — dead refs are preserved, see normalize_product_refs().
+                                if ( ! is_array( $value ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Linked products must be an array of product IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } else {
+                                        // Empty array is valid — this is the "clear" path.
+                                        foreach ( $value as $ref ) {
+                                                $ref_id = is_array( $ref ) ? ( $ref['id'] ?? null ) : $ref;
+                                                if ( ! self::is_positive_int_id( $ref_id ) ) {
+                                                        $errors[] = [
+                                                                'field'   => $field,
+                                                                'value'   => $value,
+                                                                'message' => __( 'Invalid linked product ID.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                                         ];
                                                         break;
 …
                                         ];
+                                }
+                        } elseif ( 'shipping_class' === $field ) {
+                                // Unlike the enums above the vocabulary is per-site, so validate
+                                // against the taxonomy itself. The wire value must be a STRING, and
+                                // only the exact empty string '' means "clear" (no class on a parent,
+                                // "same as parent" on a variation). A non-string (null, false, an
+                                // array) is invalid input, not an implicit clear — and so is a
+                                // non-empty string that sanitize_title() reduces to '' (junk like
+                                // '!!!'). Conflating either with the real empty-string clear would
+                                // silently wipe an existing shipping class instead of rejecting the
+                                // request.
+                                if ( ! is_string( $value ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Shipping class must be a string.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } else {
+                                        $sanitized = sanitize_title( $value );
+                                        if ( '' !== $value && '' === $sanitized ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => sprintf(
+                                                                /* translators: %s: shipping class slug */
+                                                                __( 'Unknown shipping class: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                                $value
+                                                        ),
+                                                ];
+                                        } elseif ( '' !== $sanitized && ! get_term_by( 'slug', $sanitized, 'product_shipping_class' ) ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => sprintf(
+                                                                /* translators: %s: shipping class slug */
+                                                                __( 'Unknown shipping class: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                                $sanitized
+                                                        ),
+                                                ];
+                                        }
+                                }
+                        }
+                }
 …
                         case 'sku':
                                 $product->set_sku( sanitize_text_field( (string) $value ) );
+                                break;
+                        case 'button_text':
+                                // External-only (allowlist-gated): set_button_text() exists only on
+                                // WC_Product_External. The instanceof guard turns a misconfigured
+                                // wcabe_g2_allowed_fields filter into a no-op instead of a fatal.
+                                if ( $product instanceof \WC_Product_External ) {
+                                        $product->set_button_text( sanitize_text_field( (string) $value ) );
+                                }
+                                break;
+                        case 'product_url':
+                                // External-only (allowlist-gated), same instanceof rationale as
+                                // button_text above.
+                                //
+                                // esc_url_raw() here is load-bearing: WooCommerce sanitizes in the
+                                // GETTER (WC_Product_External::get_product_url() wraps esc_url_raw),
+                                // not the setter — set_product_url() only runs
+                                // htmlspecialchars_decode(). WC's own admin sanitizes before calling
+                                // the setter for the same reason. Passing the raw value would store
+                                // "example.com" in _product_url while the getter and grid display
+                                // "http://example.com", and the SQL filter matches the raw stored
+                                // meta — so the column users see would silently diverge from what
+                                // the filter finds. Canonicalize here so meta, getter and filter agree.
+                                //
+                                // trim() BEFORE esc_url_raw() is load-bearing, not tidiness: esc_url()
+                                // only LTRIMS, then percent-encodes the spaces it kept, so a
+                                // copy-pasted "https://a.com " would be stored as "https://a.com%20"
+                                // — a silently broken affiliate link. Every other text field escapes
+                                // this via sanitize_text_field(), which trims; esc_url_raw() does not.
+                                if ( $product instanceof \WC_Product_External ) {
+                                        $product->set_product_url( esc_url_raw( trim( (string) $value ) ) );
+                                }
                                 break;
 …
                                 break;
+                        case 'cogs_value':
+                                // Native WooCommerce Cost of Goods Sold. Route through the CRUD
+                                // setter (not raw post meta) so $product->save() persists it
+                                // rather than clobbering it from the in-memory cogs_value prop.
+                                // No-op when the feature is off — set_cogs_value() would emit
+                                // wc_doing_it_wrong() otherwise.
+                                if ( Product_Helper::is_cogs_enabled() ) {
+                                        $sanitized = trim( (string) $value );
+                                        $product->set_cogs_value( '' === $sanitized ? null : (float) wc_format_decimal( $sanitized ) );
+                                }
+                                break;
                         case 'stock_quantity':
                                 if ( null === $value || '' === $value ) {
 …
                                         $product->set_stock_quantity( wc_stock_amount( $value ) );
+                                }
+                                break;
+                        case 'menu_order':
+                                // Native wp_posts.menu_order. No "unset" state — an empty value
+                                // resets to 0. set_menu_order() casts via intval() (validated as an
+                                // integer upstream in validate_changes()).
+                                $product->set_menu_order( ( '' === $value || null === $value ) ? 0 : (int) $value );
                                 break;
 …
                                 break;
+                        case 'date_created':
+                                // Publish date (post_date). Validation guarantees a non-empty, valid
+                                // Y-m-d or Y-m-d H:i:s; guard defensively so an empty value never resets
+                                // post_date to "now". set_date_created() interprets the string as
+                                // site-local and persists post_date at full date-time granularity (a bare
+                                // Y-m-d is padded to 00:00:00 site time).
+                                $sanitized = sanitize_text_field( (string) $value );
+                                if ( '' !== $sanitized ) {
+                                        $product->set_date_created( $sanitized );
+                                }
+                                break;
                         case 'date_on_sale_from':
                                 $sanitized = sanitize_text_field( (string) $value );
 …
                                 $product->set_gallery_image_ids( $ids );
                                 break;
+                }
+                        case 'upsell_ids':
+                                $product->set_upsell_ids( self::normalize_product_refs( $value, $product->get_id() ) );
+                                break;
+                        case 'cross_sell_ids':
+                                $product->set_cross_sell_ids( self::normalize_product_refs( $value, $product->get_id() ) );
+                                break;
+                        case 'shipping_class':
+                                $sanitized = sanitize_title( (string) $value );
+                                if ( '' === $sanitized ) {
+                                        // 0 makes WC write an empty term list: no class on a parent,
+                                        // "same as parent" on a variation. Both are the same clear.
+                                        $product->set_shipping_class_id( 0 );
+                                        break;
+                                }
+                                $term = get_term_by( 'slug', $sanitized, 'product_shipping_class' );
+                                if ( ! $term ) {
+                                        throw new \InvalidArgumentException(
+                                                sprintf(
+                                                        /* translators: %s: shipping class slug */
+                                                        esc_html__( 'Unknown shipping class: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                        esc_html( $sanitized )
+                                                )
+                                        );
+                                }
+                                $product->set_shipping_class_id( (int) $term->term_id );
+                                break;
+                }
+        }
+        /**
+         * Is $v a positive integer id — strictly?
+         *
+         * NOT is_numeric() followed by a cast. is_numeric() accepts '1.9', '1e3', '+12', ' 12' and
+         * '-7', and the (int)/absint() cast that follows SILENTLY REWRITES them: (int)'1e3' is 1000,
+         * (int)'1.9' is 1, absint('-7') is 7. A value that passed validation would then be written
+         * as a DIFFERENT id. This is the same trap search_products() documents at its ctype_digit()
+         * call, and the same one it notes WooCommerce core falls into.
+         *
+         * ctype_digit() alone is not enough either: it passes arbitrarily long digit strings, and
+         * (int)'999999999999999999999999' saturates to PHP_INT_MAX. The round-trip below pins the
+         * cast as lossless. It also rejects leading-zero forms like '012'.
+         *
+         * Shared by the linked-product and gallery_image_ids validators — both feed a cast.
+         *
+         * @param mixed $v
+         * @return bool
+         */
+        private static function is_positive_int_id( $v ): bool {
+                if ( is_int( $v ) ) {
+                        return $v > 0;
+                }
+                if ( is_string( $v ) ) {
+                        return ctype_digit( $v ) && (string) (int) $v === $v && (int) $v > 0;
+                }
+                // Floats, bools, null, arrays, objects. A JSON `12` decodes to a PHP int, and JS
+                // JSON.stringify(12.0) emits "12", so no legitimate client lands here.
+                return false;
+        }
+        /**
+         * Normalise a linked-product list to an ordered int[].
+         *
+         * Accepts BOTH wire shapes, deliberately:
+         *
+         *   [ { id: 12, name: …, sku: … }, … ]  — from the grid, which needs names to render
+         *   [ 12, 45, 900 ]                     — raw ints
+         *
+         * The raw-int path is not hypothetical. Operation History captures the canonical CRUD
+         * value (an int[]) and Pro_History_Input_Adapter::to_input() is an identity passthrough,
+         * so restore replays int[] straight back through here. Without dual-shape support,
+         * restore breaks. It also makes a future paste-from-spreadsheet path work for free.
+         *
+         * Rules, in order:
+         *   1. Coerce each entry to a positive int (from 'id' when it's an object/array).
+         *   2. Dedupe, preserving FIRST-occurrence order. Order is data — WooCommerce renders
+         *      upsells in stored order — so never rebuild this from a set.
+         *   3. Drop self-reference. (Also dropped client-side, per row, so the bulk preview
+         *      shows what actually lands; this is the server-side backstop.)
+         *   4. Do NOT check existence. WooCommerce core's set_upsell_ids() stores whatever it
+         *      is given, which is exactly why dead refs accumulate in real stores. We match it
+         *      and surface dead refs in the UI instead, so a user who never touches a dead chip
+         *      keeps it. Silently mutating data the user didn't touch is what erodes trust in a
+         *      tool that writes to a hundred products at once.
+         *   5. An empty array is valid — that is Clear.
+         *
+         * Note this runs AFTER validate_changes(), whose is_positive_int_id() gate has already
+         * rejected any entry whose (int) cast would be lossy — so the casts below are safe.
+         *
+         * @param mixed $value    int[] or array of { id: int }.
+         * @param int   $self_id  The product being written (excluded from its own list).
+         * @return int[]
+         */
+        private static function normalize_product_refs( $value, int $self_id ): array {
+                if ( ! is_array( $value ) ) {
+                        return [];
+                }
+                $ids = [];
+                foreach ( $value as $entry ) {
+                        if ( is_array( $entry ) ) {
+                                $id = isset( $entry['id'] ) ? (int) $entry['id'] : 0;
+                        } elseif ( is_object( $entry ) ) {
+                                $id = isset( $entry->id ) ? (int) $entry->id : 0;
+                        } else {
+                                $id = (int) $entry;
+                        }
+                        if ( $id <= 0 || $id === $self_id ) {
+                                continue;
+                        }
+                        // array_search-free dedupe that preserves first-occurrence order.
+                        if ( ! isset( $ids[ $id ] ) ) {
+                                $ids[ $id ] = true;
+                        }
+                }
+                return array_map( 'intval', array_keys( $ids ) );
+        }
 …
         /**
+         * Whether a menu_order string — already matching /^-?\d+$/ — fits the signed
+         * 32-bit range (self::MENU_ORDER_MIN..MAX).
+         *
+         * Compares as strings (magnitude length, then lexically) to stay
+         * platform-independent: a lossy (int) cast of an out-of-range value clamps to
+         * PHP_INT_MAX on 32-bit builds and would wrongly pass. Leading zeros are
+         * tolerated (mirrors the regex and the frontend): '0005' → 5, '0'/'-0' → 0.
+         *
+         * @param string $value Digit string, optionally sign-prefixed.
+         * @return bool
+         */
+        private static function menu_order_in_int32_range( string $value ): bool {
+                $negative  = ( '' !== $value && '-' === $value[0] );
+                $magnitude = ltrim( $negative ? substr( $value, 1 ) : $value, '0' );
+                if ( '' === $magnitude ) {
+                        return true; // All zeros → 0, always in range.
+                }
+                // Derive the bound magnitudes from the constants (string-safe, no abs()).
+                $limit = $negative ? ltrim( (string) self::MENU_ORDER_MIN, '-' ) : (string) self::MENU_ORDER_MAX;
+                if ( strlen( $magnitude ) !== strlen( $limit ) ) {
+                        return strlen( $magnitude ) < strlen( $limit );
+                }
+                return strcmp( $magnitude, $limit ) <= 0;
+        }
+        /**
          * Get products via WooCommerce CRUD API.
+         *
 …
          * @param array $filters Optional filter criteria.
          * @param bool  $include_variations Whether variations will be interleaved (affects meta_query behavior).
+         * @param bool  $ids_only_all_variable When true, override pagination/type to fetch ALL matching
+         *                                     variable parent IDs (unbounded, fields=ids). Used by the
+         *                                     variation-total helper; products array in this mode is int[].
+         * @param bool   $ids_only_all_variable When true, override pagination/type to fetch ALL matching
+         *                                      variable parent IDs (unbounded, fields=ids). Used by the
+         *                                      variation-total helper; products array in this mode is int[].
+         * @param string $orderby Sort column: 'id' (default) or 'menu_order'.
+         * @param string $order   Sort direction: 'asc' or 'desc' (default).
          * @return array{ products: \WC_Product[]|int[], total: int, total_pages: int }
          */
 …
                 array $filters = [],
                 bool $include_variations = false,
+                bool $ids_only_all_variable = false
+                bool $ids_only_all_variable = false,
+                string $orderby = 'id',
+                string $order = 'desc'
         ): array {
+                // Map the whitelisted orderby to a WC/WP_Query-supported value. 'menu_order'
+                // passes through to WP_Query natively; append ID as a stable tiebreaker so
+                // pagination is deterministic when rows share a menu_order (the default 0) —
+                // WP_Query parses the space-separated form into "menu_order <dir>, ID <dir>".
+                // Anything else falls back to ID.
+                $wc_orderby = ( 'menu_order' === $orderby ) ? 'menu_order ID' : 'ID';
+                $wc_order   = ( 'asc' === strtolower( $order ) ) ? 'ASC' : 'DESC';
+                // A shipping_class param that survived REST sanitisation as nothing at all
+                // (e.g. '!!!') must match NOTHING, never widen to the whole catalog. There
+                // is no "impossible slug" to encode this with — sanitize_title() output is
+                // exactly the legal slug vocabulary — so the REST layer sets this flag.
+                if ( ! empty( $filters['shipping_class_match_none'] ) ) {
+                        return [
+                                'products'    => [],
+                                'total'       => 0,
+                                'total_pages' => 1,
+                        ];
+                }
                 $args = [
                         'limit'    => $per_page,
                         'page'     => $page,
                         'orderby'  => 'ID',
                         'order'    => 'DESC',
+                        'orderby'  => $wc_orderby,
+                        'order'    => $wc_order,
                         'paginate' => true,
                 ];
 …
                         $args['return']   = 'ids';
+                        $variable_types = self::get_variable_product_types();
                         if ( ! empty( $filters['type'] ) ) {
                                 $intersection = array_values(
                                         array_intersect( (array) $filters['type'], [ 'variable' ] )
+                                        array_intersect( (array) $filters['type'], $variable_types )
                                 );
                                 if ( empty( $intersection ) ) {
 …
                                 $filters['type'] = $intersection;
                         } else {
                                 $filters['type'] = [ 'variable' ];
+                                $filters['type'] = $variable_types;
+                        }
+                }
 …
                 $args['status'] = ! empty( $filters['status'] )
                         ? (array) $filters['status']
+                        : [ 'publish', 'draft', 'private', 'pending' ];
+                // Type filter — use provided values or defaults.
+                        // 'future' (Scheduled) is included so products given a future publish
+                        // date — which WordPress auto-transitions publish -> future — stay
+                        // visible in the grid instead of silently disappearing.
+                        : [ 'publish', 'draft', 'private', 'pending', 'future' ];
+                // Type filter — use provided values, or default to every known type so
+                // third-party types (bundle, subscription, …) appear in the grid (#137).
                 $args['type'] = ! empty( $filters['type'] )
                         ? (array) $filters['type']
                         : [ 'simple', 'variable', 'grouped', 'external' ];
+                        : self::get_known_product_types();
                 // ID filter — simple comparison or expression (CSV + ranges).
 …
                 // Search filters — handled via posts_join/posts_where hooks below.
                 $search_name_term = ! empty( $filters['search_name'] ) ? sanitize_text_field( $filters['search_name'] ) : '';
+                $search_sku_term  = ! empty( $filters['search_sku'] )  ? sanitize_text_field( $filters['search_sku'] )  : '';
+                // Title match mode: 'all' (every word, AND, default), 'any' (any word, OR), 'phrase' (whole-term LIKE).
+                $search_name_mode = isset( $filters['search_name_mode'] ) && in_array( $filters['search_name_mode'], self::TITLE_SEARCH_MODES, true )
+                        ? $filters['search_name_mode']
+                        : 'all';
+                // Strict '' test, not empty(): "0" is a valid SKU and must not be dropped.
+                $search_sku_term = isset( $filters['search_sku'] ) ? sanitize_text_field( (string) $filters['search_sku'] ) : '';
+                $has_search_sku  = '' !== $search_sku_term;
+                // SKU match mode: '' (auto/legacy) or one of self::SKU_SEARCH_MODES.
+                $search_sku_mode = self::normalize_sku_mode( $filters['search_sku_mode'] ?? '' );
                 $search_description_term       = ! empty( $filters['search_description'] )       ? sanitize_text_field( $filters['search_description'] )       : '';
                 $search_short_description_term = ! empty( $filters['search_short_description'] ) ? sanitize_text_field( $filters['search_short_description'] ) : '';
+                // Product URL filter (external/affiliate link). "Effective" is NOT a
+                // non-empty-value test: is_empty / is_not_empty carry meaning with none.
+                $product_url_operator = isset( $filters['product_url_operator'] ) && in_array( $filters['product_url_operator'], self::PRODUCT_URL_OPERATORS, true )
+                        ? $filters['product_url_operator']
+                        : 'contains';
+                $product_url_value    = isset( $filters['product_url_value'] ) ? trim( (string) $filters['product_url_value'] ) : '';
+                $has_product_url_filter = self::product_url_filter_is_effective( $product_url_operator, $product_url_value );
                 // Category filter — exact matching (include_children => false).
 …
+                }
+                // Tag filter — WC's data store natively maps 'product_tag_id' (term IDs) to a
+                // product_tag tax_query. Flat taxonomy, so no include_children handling needed
+                // (unlike category). Note WC's 'tag' arg expects slugs — do not use it.
+                if ( ! empty( $filters['tag'] ) ) {
+                        $args['product_tag_id'] = array_map( 'absint', (array) $filters['tag'] );
+                }
                 // Stock status filter.
                 if ( ! empty( $filters['stock_status'] ) ) {
 …
+                }
+                // Shipping class filter. WooCommerce's own 'shipping_class' query var
+                // builds the tax_query, matching on SLUG (see WC_Product_Data_Store_CPT) —
+                // which is why the whole feature speaks slugs rather than term IDs.
+                // Parent-level by design: variations follow whichever parent matched, and
+                // a variation that overrides its parent's class is not independently
+                // surfaced. Narrowing per variation would instead HIDE every variation
+                // that inherits (its own stored class is empty), which is the wrong
+                // default for the common case.
+                if ( ! empty( $filters['shipping_class'] ) ) {
+                        $args['shipping_class'] = array_map( 'sanitize_title', (array) $filters['shipping_class'] );
+                }
                 // Price range filters — passed as custom args, handled in handle_custom_query_args.
                 if ( isset( $filters['price_min'] ) && '' !== $filters['price_min'] ) {
 …
                 if ( isset( $filters['price_max'] ) && '' !== $filters['price_max'] ) {
                         $args['wcabe_price_max'] = wc_format_decimal( $filters['price_max'] );
+                }
+                // Cost of Goods range filters — gated on the COGS feature so direct service
+                // calls carrying stale cogs_min/max can't reach the variation matcher or
+                // get_cogs_value() while the feature is disabled.
+                if ( Product_Helper::is_cogs_enabled() ) {
+                        if ( isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'] ) {
+                                $args['wcabe_cogs_min'] = (float) $filters['cogs_min'];
+                        }
+                        if ( isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'] ) {
+                                $args['wcabe_cogs_max'] = (float) $filters['cogs_max'];
+                        }
+                }
 …
                 if ( $modified_after || $modified_before ) {
                         $args['date_modified'] = $this->build_date_range( $modified_after, $modified_before );
+                }
+                // Sale-schedule date range filters. WC's native date_on_sale_from/date_on_sale_to
+                // query args are deliberately NOT used: for day precision WC compares the range
+                // end against the START of that day and derives both bounds through gmdate(), so
+                // sale-to timestamps stored at local 23:59:59 (WC admin's own convention) never
+                // match and non-UTC sites shift by a day. We compute site-local bounds here and
+                // expand them in the query callbacks below.
+                list( $sale_start_min, $sale_start_max ) = $this->sale_date_filter_bounds(
+                        $filters['sale_start_after'] ?? '',
+                        $filters['sale_start_before'] ?? ''
+                );
+                list( $sale_end_min, $sale_end_max ) = $this->sale_date_filter_bounds(
+                        $filters['sale_end_after'] ?? '',
+                        $filters['sale_end_before'] ?? ''
+                );
+                if ( null !== $sale_start_min ) {
+                        $args['wcabe_sale_start_min'] = $sale_start_min;
+                }
+                if ( null !== $sale_start_max ) {
+                        $args['wcabe_sale_start_max'] = $sale_start_max;
+                }
+                if ( null !== $sale_end_min ) {
+                        $args['wcabe_sale_end_min'] = $sale_end_min;
+                }
+                if ( null !== $sale_end_max ) {
+                        $args['wcabe_sale_end_max'] = $sale_end_max;
+                }
 …
                 $has_stock_qty_filter    = isset( $args['wcabe_stock_qty_min'] ) || isset( $args['wcabe_stock_qty_max'] );
+                $has_cogs_filter         = isset( $args['wcabe_cogs_min'] ) || isset( $args['wcabe_cogs_max'] );
                 $has_manage_stock_filter = ! empty( $args['wcabe_manage_stock'] );
                 $has_backorders_filter   = ! empty( $args['wcabe_backorders'] );
+                // Hook for exact category matching, multi-value stock_status, price, stock qty, manage stock, backorders, and attribute filtering.
+                $needs_custom_query = ! empty( $filters['category'] ) || ( ! empty( $filters['stock_status'] ) && count( (array) $filters['stock_status'] ) > 1 ) || $has_price_filter || $has_stock_qty_filter || $has_manage_stock_filter || $has_backorders_filter || ! empty( $attribute_tax_queries );
+                $has_sale_date_filter    = isset( $args['wcabe_sale_start_min'] ) || isset( $args['wcabe_sale_start_max'] )
+                        || isset( $args['wcabe_sale_end_min'] ) || isset( $args['wcabe_sale_end_max'] );
+                // Hook for exact category matching, multi-value stock_status, price, stock qty, COGS, manage stock, backorders, sale dates, and attribute filtering.
+                $needs_custom_query = ! empty( $filters['category'] ) || ( ! empty( $filters['stock_status'] ) && count( (array) $filters['stock_status'] ) > 1 ) || $has_price_filter || $has_stock_qty_filter || $has_cogs_filter || $has_manage_stock_filter || $has_backorders_filter || $has_sale_date_filter || ! empty( $attribute_tax_queries );
                 $filter_callback = function ( array $wp_query_args, array $query_vars ) use ( $include_variations ): array {
 …
+                        }
+                        // Cost of Goods range filtering via _cogs_total_value meta.
+                        // When include_variations is true, handled by the posts_where hook
+                        // below instead — variable parents carry a non-null default cost, so
+                        // the _stock-style "OR IS NULL" trick doesn't apply.
+                        $has_cogs_min = isset( $query_vars['wcabe_cogs_min'] );
+                        $has_cogs_max = isset( $query_vars['wcabe_cogs_max'] );
+                        if ( ( $has_cogs_min || $has_cogs_max ) && ! $include_variations ) {
+                                if ( ! isset( $wp_query_args['meta_query'] ) ) {
+                                        $wp_query_args['meta_query'] = [];
+                                }
+                                if ( $has_cogs_min && $has_cogs_max ) {
+                                        $cogs_range_clause = [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => [ (float) $query_vars['wcabe_cogs_min'], (float) $query_vars['wcabe_cogs_max'] ],
+                                                'compare' => 'BETWEEN',
+                                                'type'    => 'DECIMAL(10,2)',
+                                        ];
+                                } elseif ( $has_cogs_min ) {
+                                        $cogs_range_clause = [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => (float) $query_vars['wcabe_cogs_min'],
+                                                'compare' => '>=',
+                                                'type'    => 'DECIMAL(10,2)',
+                                        ];
+                                } else {
+                                        $cogs_range_clause = [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => (float) $query_vars['wcabe_cogs_max'],
+                                                'compare' => '<=',
+                                                'type'    => 'DECIMAL(10,2)',
+                                        ];
+                                }
+                                // Guard _cogs_total_value != '' (grouped AND with the range) so a
+                                // stray empty row can't CAST to 0 and match a 0-inclusive range.
+                                $wp_query_args['meta_query'][] = [
+                                        'relation' => 'AND',
+                                        [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => '',
+                                                'compare' => '!=',
+                                        ],
+                                        $cogs_range_clause,
+                                ];
+                        }
+                        // Sale-schedule date range filtering via _sale_price_dates_from/_to
+                        // (Unix timestamps). When include_variations is true this is handled by
+                        // the posts_where hook below instead, so a variable parent can surface
+                        // via a matching child variation.
+                        $sale_bounds = [
+                                '_sale_price_dates_from' => [
+                                        $query_vars['wcabe_sale_start_min'] ?? null,
+                                        $query_vars['wcabe_sale_start_max'] ?? null,
+                                ],
+                                '_sale_price_dates_to'   => [
+                                        $query_vars['wcabe_sale_end_min'] ?? null,
+                                        $query_vars['wcabe_sale_end_max'] ?? null,
+                                ],
+                        ];
+                        $has_sale_filter = false;
+                        foreach ( $sale_bounds as $bounds ) {
+                                if ( null !== $bounds[0] || null !== $bounds[1] ) {
+                                        $has_sale_filter = true;
+                                        break;
+                                }
+                        }
+                        if ( $has_sale_filter && ! $include_variations ) {
+                                if ( ! isset( $wp_query_args['meta_query'] ) ) {
+                                        $wp_query_args['meta_query'] = [];
+                                }
+                                foreach ( $sale_bounds as $meta_key => $bounds ) {
+                                        list( $min, $max ) = $bounds;
+                                        if ( null === $min && null === $max ) {
+                                                continue;
+                                        }
+                                        if ( null !== $min && null !== $max ) {
+                                                $sale_range_clause = [
+                                                        'key'     => $meta_key,
+                                                        'value'   => [ $min, $max ],
+                                                        'compare' => 'BETWEEN',
+                                                        'type'    => 'NUMERIC',
+                                                ];
+                                        } elseif ( null !== $min ) {
+                                                $sale_range_clause = [
+                                                        'key'     => $meta_key,
+                                                        'value'   => $min,
+                                                        'compare' => '>=',
+                                                        'type'    => 'NUMERIC',
+                                                ];
+                                        } else {
+                                                $sale_range_clause = [
+                                                        'key'     => $meta_key,
+                                                        'value'   => $max,
+                                                        'compare' => '<=',
+                                                        'type'    => 'NUMERIC',
+                                                ];
+                                        }
+                                        // Guard != '' (grouped AND with the range) so an empty row can't
+                                        // CAST to 0 and satisfy a <=-bounded range.
+                                        $wp_query_args['meta_query'][] = [
+                                                'relation' => 'AND',
+                                                [
+                                                        'key'     => $meta_key,
+                                                        'value'   => '',
+                                                        'compare' => '!=',
+                                                ],
+                                                $sale_range_clause,
+                                        ];
+                                }
+                                // A variable parent never legitimately carries a sale schedule (the
+                                // plugin treats sale dates as absent on them), and in this mode a child
+                                // never surfaces its parent — but stale _sale_price_dates_* rows can
+                                // survive a simple->variable type conversion, so exclude them outright.
+                                if ( ! isset( $wp_query_args['tax_query'] ) ) {
+                                        $wp_query_args['tax_query'] = [];
+                                }
+                                $wp_query_args['tax_query'][] = [
+                                        'taxonomy' => 'product_type',
+                                        'field'    => 'slug',
+                                        'terms'    => self::get_variable_product_types(),
+                                        'operator' => 'NOT IN',
+                                ];
+                        }
                         // Stock quantity range filtering via _stock meta.
                         // When include_variations is false, standard meta_query applies.
 …
                 $search_where_callback = null;
                 if ( $search_name_term || $search_sku_term ) {
+                if ( $search_name_term || $has_search_sku ) {
                         global $wpdb;
                         // JOIN is only needed when filtering by SKU.
                         if ( $search_sku_term ) {
+                        if ( $has_search_sku ) {
                                 $search_join_callback = function ( string $join ) use ( $wpdb ): string {
                                         if ( strpos( $join, 'wcabe_sku_lookup' ) === false ) {
 …
                         $name_clause = '';
                         if ( $search_name_term ) {
+                                $name_like   = '%' . $wpdb->esc_like( $search_name_term ) . '%';
+                                $name_clause = $wpdb->prepare( "( {$wpdb->posts}.post_title LIKE %s )", $name_like );
+                                $name_clause = $this->build_name_search_clause( $wpdb, $search_name_term, $search_name_mode );
+                        }
                         $sku_clause = '';
+                        if ( $search_sku_term ) {
+                                if ( strpos( $search_sku_term, ',' ) !== false ) {
+                                        // CSV mode: exact match against each SKU.
+                                        $skus = array_filter( array_map( 'trim', explode( ',', $search_sku_term ) ) );
+                                        $skus = array_map( 'sanitize_text_field', $skus );
+                                        if ( ! empty( $skus ) ) {
+                                                $placeholders = implode( ',', array_fill( 0, count( $skus ), '%s' ) );
+                                                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $placeholders is a comma-joined string of `%s` placeholders, one per element of $skus, all expanded by prepare() via spread.
+                                                $sku_clause   = $wpdb->prepare(
+                                                        "( wcabe_sku_lookup.sku IN ($placeholders) )",
+                                                        ...$skus
+                                                );
+                                                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+                                        }
+                                } else {
+                                        // Single term: LIKE search.
+                                        $sku_like   = '%' . $wpdb->esc_like( $search_sku_term ) . '%';
+                                        $sku_clause = $wpdb->prepare( '( wcabe_sku_lookup.sku LIKE %s )', $sku_like );
+                                }
+                        if ( $has_search_sku ) {
+                                $sku_clause = $this->build_sku_search_clause( $wpdb, $search_sku_term, $search_sku_mode, $include_variations );
+                        }
 …
                         $description_where_callback = function ( string $where ) use ( $wpdb, $desc_like, $include_variations ): string {
                                 if ( $include_variations ) {
+                                        $where .= $wpdb->prepare(
+                                                " AND ( {$wpdb->posts}.post_content LIKE %s OR {$wpdb->posts}.ID IN ("
+                                        // The child branch is gated on the parent being variable — a
+                                        // stale variation left behind by a variable->simple type
+                                        // conversion must not surface its now-simple parent.
+                                        $is_variable = $this->sql_is_variable_product();
+                                        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $is_variable is this class's own hardcoded SQL literal (sql_is_variable_product()); the search term is passed through prepare() via %s.
+                                        $where      .= $wpdb->prepare(
+                                                " AND ( {$wpdb->posts}.post_content LIKE %s OR ( {$is_variable} AND {$wpdb->posts}.ID IN ("
                                                 . " SELECT p.post_parent FROM {$wpdb->posts} p"
                                                 . " INNER JOIN {$wpdb->postmeta} pm ON p.ID = pm.post_id"
 …
                                                 . " AND pm.meta_key = '_variation_description'"
                                                 . " AND pm.meta_value LIKE %s"
                                                 . ' ) )',
+                                                . ' ) ) )',
                                                 $desc_like,
                                                 $desc_like
                                         );
+                                        // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
                                 } else {
                                         $where .= $wpdb->prepare( " AND {$wpdb->posts}.post_content LIKE %s", $desc_like );
 …
+                }
+                // Product URL filtering (external/affiliate link, _product_url meta).
+                // Raw SQL rather than meta_query for the same reason as stock qty above:
+                // WP's meta_query cannot express "meta row missing", which the is_empty
+                // operator needs. Every column is alias-qualified — an unqualified
+                // post_id/meta_key/meta_value becomes ambiguous the moment another meta
+                // join (e.g. stock qty) is active in the same query.
+                $product_url_join_callback   = null;
+                $product_url_where_callback  = null;
+                $product_url_marker_callback = null;
+                if ( $has_product_url_filter ) {
+                        global $wpdb;
+                        // posts_join / posts_where fire on EVERY WP_Query for as long as they are
+                        // registered — including any a third-party pre_get_posts listener spins up
+                        // inside ours. Unscoped, those queries would inherit our WHERE; and because
+                        // the JOIN is added only once (the strpos guard), a nested query could even
+                        // receive the WHERE WITHOUT the JOIN and hard-fail on an unknown column.
+                        // So both callbacks below bail unless the query carries our private marker,
+                        // which this callback stamps onto our own query only. Same guard shape as
+                        // search_products() / REF_SEARCH_QUERY_VAR.
+                        $product_url_marker_callback = static function ( array $wp_query_args ): array {
+                                $wp_query_args[ self::PRODUCT_URL_QUERY_VAR ] = true;
+                                return $wp_query_args;
+                        };
+                        $product_url_join_callback = function ( string $join, \WP_Query $query ) use ( $wpdb ): string {
+                                if ( ! $query->get( self::PRODUCT_URL_QUERY_VAR ) ) {
+                                        return $join;
+                                }
+                                if ( strpos( $join, 'wcabe_product_url_meta' ) === false ) {
+                                        $join .= " LEFT JOIN {$wpdb->postmeta} AS wcabe_product_url_meta ON ( {$wpdb->posts}.ID = wcabe_product_url_meta.post_id AND wcabe_product_url_meta.meta_key = '_product_url' ) ";
+                                }
+                                return $join;
+                        };
+                        $is_external_sql = $this->sql_is_external_product();
+                        $product_url_where_callback = function ( string $where, \WP_Query $query ) use ( $wpdb, $product_url_operator, $product_url_value, $is_external_sql ): string {
+                                if ( ! $query->get( self::PRODUCT_URL_QUERY_VAR ) ) {
+                                        return $where;
+                                }
+                                $col       = 'wcabe_product_url_meta.meta_value';
+                                $has_a_url = "( {$col} IS NOT NULL AND {$col} <> '' )";
+                                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $has_a_url and $col are this method's own hardcoded column expressions; the user-supplied URL value is passed through prepare() via %s in every branch.
+                                switch ( $product_url_operator ) {
+                                        case 'is_empty':
+                                                $clause = "( {$col} IS NULL OR {$col} = '' )";
+                                                break;
+                                        case 'is_not_empty':
+                                                $clause = $has_a_url;
+                                                break;
+                                        case 'not_contains':
+                                                // Scoped to rows that HAVE a URL, so this reads as "URLs that
+                                                // don't contain X" rather than "every external product without one".
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} NOT LIKE %s )",
+                                                        '%' . $wpdb->esc_like( $product_url_value ) . '%'
+                                                );
+                                                break;
+                                        case 'starts_with':
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} LIKE %s )",
+                                                        $wpdb->esc_like( $product_url_value ) . '%'
+                                                );
+                                                break;
+                                        case 'ends_with':
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} LIKE %s )",
+                                                        '%' . $wpdb->esc_like( $product_url_value )
+                                                );
+                                                break;
+                                        case 'contains':
+                                        default:
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} LIKE %s )",
+                                                        '%' . $wpdb->esc_like( $product_url_value ) . '%'
+                                                );
+                                                break;
+                                }
+                                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+                                // EVERY operator is scoped to external products, not just is_empty.
+                                // product_url is an external-only field: Product_Helper::format_product()
+                                // and the CSV exporter both emit '' for any other type, and the grid cell
+                                // is blank and read-only there. A non-external row carries _product_url
+                                // only as STALE meta (converted external → simple), so matching it would
+                                // surface a row whose Product URL is blank on every surface the user can
+                                // see, with no way to tell why it matched. Scoping the whole filter keeps
+                                // "what the filter finds" and "what the column shows" the same set.
+                                return $where . " AND ( {$clause} AND {$is_external_sql} ) ";
+                        };
+                }
+                // ── Combined variation-aware filtering: COGS, menu order, sale dates, image date ──
+                //
+                // ONE callback pair covers all four deliberately. Each of them can surface a
+                // variable parent either on its OWN value or through a child variation, and
+                // emitting them as separate `( own_i OR child_i )` clauses would let *different*
+                // siblings satisfy different filters — surfacing a parent whose children are
+                // then all rejected by variation_matches_filters(), i.e. an empty parent row.
+                // (The sale-date filter already solved this across its own two ranges; this
+                // generalises the same fix across filters.) The emitted shape is
+                //
+                //     ( own_A AND own_B AND … ) OR ( is_variable AND EXISTS ( … child_A AND child_B … ) )
+                //
+                // so a variable parent surfaces only when it matches entirely on its own
+                // values, or when ONE renderable child satisfies every active predicate —
+                // exactly what variation_matches_filters() accepts when it narrows the
+                // children. Distributing the child branch this way also emits the correlated
+                // subquery once instead of once per filter. With a single filter active the
+                // shape collapses to that filter's previous `( own OR child )` clause, so
+                // single-filter behaviour is unchanged.
+                //
+                // SCOPE: these four filters only. Price, stock status, stock quantity, manage
+                // stock, backorders, SKU search and description search surface parents through
+                // other mechanisms (meta_query, the OR-NULL stock posts_where above, IN
+                // subqueries below) and are NOT folded in — a filter from this group combined
+                // with one of those can still produce an empty parent row. Known and accepted;
+                // folding the rest in is tracked separately.
+                //
+                // The child status list matches WC get_children() (publish/private only) so a
+                // parent never surfaces via a variation that won't render. The child branch is
+                // gated on the parent being variable — a variable->simple type conversion can
+                // leave published variation posts behind, and a stale child must not surface
+                // its now-simple parent (interleaving only narrows children of variable
+                // parents, so such a false positive is uncorrectable downstream). COGS and
+                // sale dates participate only when include_variations is on; with it off they
+                // stay on their meta_query paths and never reach this callback, so with
+                // variations off only menu order and image date are emitted here.
+                $combined_join_callback  = null;
+                $combined_where_callback = null;
+                $cogs_min = isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'] ? (float) $filters['cogs_min'] : null;
+                $cogs_max = isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'] ? (float) $filters['cogs_max'] : null;
+                $menu_order_min = ( isset( $filters['menu_order_min'] ) && '' !== $filters['menu_order_min'] ) ? (int) $filters['menu_order_min'] : null;
+                $menu_order_max = ( isset( $filters['menu_order_max'] ) && '' !== $filters['menu_order_max'] ) ? (int) $filters['menu_order_max'] : null;
+                // Image-uploaded bounds. The signal is the featured image attachment's
+                // post_date — a site-local DATETIME, the same basis the grid renders — so
+                // day-precision Y-m-d bounds expand to literal day-start / day-end strings and
+                // compare directly. No timestamp arithmetic, hence no DST edge (contrast the
+                // sale-date bounds above, which are Unix timestamps stored in meta).
+                $image_date_after  = isset( $filters['image_date_after'] ) ? (string) $filters['image_date_after'] : '';
+                $image_date_before = isset( $filters['image_date_before'] ) ? (string) $filters['image_date_before'] : '';
+                $image_date_min    = '' !== $image_date_after ? $image_date_after . ' 00:00:00' : null;
+                $image_date_max    = '' !== $image_date_before ? $image_date_before . ' 23:59:59' : null;
+                $use_cogs  = $include_variations && $has_cogs_filter;
+                $use_sale  = $include_variations && $has_sale_date_filter;
+                $use_menu  = ( null !== $menu_order_min || null !== $menu_order_max );
+                $use_image = ( null !== $image_date_min || null !== $image_date_max );
+                if ( $use_cogs || $use_sale || $use_menu || $use_image ) {
+                        global $wpdb;
+                        // Active sale ranges (either or both of from/to may be filtered).
+                        $sale_predicates = ! $use_sale ? [] : array_values(
+                                array_filter(
+                                        [
+                                                [
+                                                        'meta_key'     => '_sale_price_dates_from',
+                                                        'parent_alias' => 'wcabe_sale_from_meta',
+                                                        'child_alias'  => 'wcabe_sale_from_child',
+                                                        'min'          => $sale_start_min,
+                                                        'max'          => $sale_start_max,
+                                                ],
+                                                [
+                                                        'meta_key'     => '_sale_price_dates_to',
+                                                        'parent_alias' => 'wcabe_sale_to_meta',
+                                                        'child_alias'  => 'wcabe_sale_to_child',
+                                                        'min'          => $sale_end_min,
+                                                        'max'          => $sale_end_max,
+                                                ],
+                                        ],
+                                        static function ( array $range ): bool {
+                                                return null !== $range['min'] || null !== $range['max'];
+                                        }
+                                )
+                        );
+                        // Only COGS, sale dates and image date need parent-side joins; menu_order
+                        // reads a native wp_posts column.
+                        if ( $use_cogs || $use_sale || $use_image ) {
+                                $combined_join_callback = function ( string $join ) use ( $wpdb, $use_cogs, $use_image, $sale_predicates ): string {
+                                        if ( $use_cogs && strpos( $join, 'wcabe_cogs_meta' ) === false ) {
+                                                $join .= " LEFT JOIN {$wpdb->postmeta} AS wcabe_cogs_meta ON ( {$wpdb->posts}.ID = wcabe_cogs_meta.post_id AND wcabe_cogs_meta.meta_key = '_cogs_total_value' ) ";
+                                        }
+                                        foreach ( $sale_predicates as $range ) {
+                                                if ( strpos( $join, $range['parent_alias'] ) === false ) {
+                                                        $join .= " LEFT JOIN {$wpdb->postmeta} AS {$range['parent_alias']} ON ( {$wpdb->posts}.ID = {$range['parent_alias']}.post_id AND {$range['parent_alias']}.meta_key = '{$range['meta_key']}' ) ";
+                                                }
+                                        }
+                                        if ( $use_image && strpos( $join, 'wcabe_img_meta' ) === false ) {
+                                                // No GROUP BY guard: a duplicate _thumbnail_id meta row would
+                                                // duplicate the product row. Same accepted exposure as
+                                                // wcabe_stock_meta / wcabe_cogs_meta — _thumbnail_id is written
+                                                // through update_post_meta (single-row) on every core/WC path.
+                                                // The post_type gate mirrors Product_Helper::get_image_upload_date(),
+                                                // so a _thumbnail_id pointing at a non-attachment is excluded here
+                                                // and renders blank there.
+                                                $join .= " LEFT JOIN {$wpdb->postmeta} AS wcabe_img_meta ON ( {$wpdb->posts}.ID = wcabe_img_meta.post_id AND wcabe_img_meta.meta_key = '_thumbnail_id' ) ";
+                                                $join .= " LEFT JOIN {$wpdb->posts} AS wcabe_img ON ( wcabe_img.ID = CAST( wcabe_img_meta.meta_value AS UNSIGNED ) AND wcabe_img.post_type = 'attachment' ) ";
+                                        }
+                                        return $join;
+                                };
+                        }
+                        $combined_where_callback = function ( string $where ) use (
+                                $wpdb,
+                                $include_variations,
+                                $use_cogs,
+                                $use_sale,
+                                $use_menu,
+                                $use_image,
+                                $sale_predicates,
+                                $cogs_min,
+                                $cogs_max,
+                                $menu_order_min,
+                                $menu_order_max,
+                                $image_date_min,
+                                $image_date_max
+                        ): string {
+                                // Bounded comparison in the three shapes prepare() needs. $expr and $ph
+                                // are always this method's own literals, never request data.
+                                $build_bound = function ( string $expr, $min, $max, string $ph ) use ( $wpdb ): string {
+                                        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $expr is a hardcoded column/CAST expression and $ph a hardcoded placeholder token (invisible to the sniff but expanded by prepare()); the bound values are passed through prepare().
+                                        if ( null !== $min && null !== $max ) {
+                                                return $wpdb->prepare( "( {$expr} BETWEEN {$ph} AND {$ph} )", $min, $max );
+                                        }
+                                        if ( null !== $min ) {
+                                                return $wpdb->prepare( "( {$expr} >= {$ph} )", $min );
+                                        }
+                                        return $wpdb->prepare( "( {$expr} <= {$ph} )", $max );
+                                        // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+                                };
+                                $is_variable = $this->sql_is_variable_product();
+                                $own_parts   = [];
+                                $child_parts = [];
+                                $child_joins = '';
+                                if ( $use_cogs ) {
+                                        $own_col       = 'wcabe_cogs_meta.meta_value';
+                                        $child_col     = 'wcabe_child_cogs.meta_value';
+                                        $child_joins  .= " INNER JOIN {$wpdb->postmeta} AS wcabe_child_cogs ON ( wcabe_child_cogs.post_id = c.ID AND wcabe_child_cogs.meta_key = '_cogs_total_value' ) ";
+                                        $own_parts[]   = "( {$own_col} <> '' AND " . $build_bound( "CAST( {$own_col} AS DECIMAL(10,2) )", $cogs_min, $cogs_max, '%f' ) . ' )';
+                                        $child_parts[] = "( {$child_col} <> '' AND " . $build_bound( "CAST( {$child_col} AS DECIMAL(10,2) )", $cogs_min, $cogs_max, '%f' ) . ' )';
+                                }
+                                if ( $use_menu ) {
+                                        $own_parts[]   = $build_bound( "{$wpdb->posts}.menu_order", $menu_order_min, $menu_order_max, '%d' );
+                                        $child_parts[] = $build_bound( 'c.menu_order', $menu_order_min, $menu_order_max, '%d' );
+                                }
+                                if ( $use_image ) {
+                                        $child_joins  .= " INNER JOIN {$wpdb->postmeta} AS wcabe_child_img_meta ON ( wcabe_child_img_meta.post_id = c.ID AND wcabe_child_img_meta.meta_key = '_thumbnail_id' ) ";
+                                        $child_joins  .= " INNER JOIN {$wpdb->posts} AS wcabe_child_img ON ( wcabe_child_img.ID = CAST( wcabe_child_img_meta.meta_value AS UNSIGNED ) AND wcabe_child_img.post_type = 'attachment' ) ";
+                                        // A product with no image, a stale _thumbnail_id, or one pointing at
+                                        // a non-attachment leaves post_date NULL through the LEFT JOIN, and
+                                        // NULL fails every comparison — excluded, as intended.
+                                        $own_parts[]   = $build_bound( 'wcabe_img.post_date', $image_date_min, $image_date_max, '%s' );
+                                        $child_parts[] = $build_bound( 'wcabe_child_img.post_date', $image_date_min, $image_date_max, '%s' );
+                                }
+                                foreach ( $sale_predicates as $range ) {
+                                        $parent_col    = "{$range['parent_alias']}.meta_value";
+                                        $child_col     = "{$range['child_alias']}.meta_value";
+                                        $child_joins  .= " INNER JOIN {$wpdb->postmeta} AS {$range['child_alias']} ON ( {$range['child_alias']}.post_id = c.ID AND {$range['child_alias']}.meta_key = '{$range['meta_key']}' ) ";
+                                        $own_parts[]   = "( {$parent_col} <> '' AND " . $build_bound( "CAST( {$parent_col} AS UNSIGNED )", $range['min'], $range['max'], '%d' ) . ' )';
+                                        $child_parts[] = "( {$child_col} <> '' AND " . $build_bound( "CAST( {$child_col} AS UNSIGNED )", $range['min'], $range['max'], '%d' ) . ' )';
+                                }
+                                if ( $use_sale ) {
+                                        // A variable parent's own sale meta is necessarily stale (the plugin
+                                        // treats sale dates as absent on variable parents and never writes
+                                        // them), so while a sale filter is active such a parent may only
+                                        // match through a child variation.
+                                        $own_parts[] = "NOT {$is_variable}";
+                                }
+                                $own = empty( $own_parts ) ? '' : '( ' . implode( ' AND ', $own_parts ) . ' )';
+                                $child = '';
+                                if ( $include_variations && ! empty( $child_parts ) ) {
+                                        $child = "( {$is_variable} AND EXISTS ( SELECT 1 FROM {$wpdb->posts} c{$child_joins}"
+                                                . " WHERE c.post_parent = {$wpdb->posts}.ID AND c.post_type = 'product_variation'"
+                                                . " AND c.post_status IN ( 'publish', 'private' ) AND " . implode( ' AND ', $child_parts ) . ' ) )';
+                                }
+                                // Parenthesize so the OR cannot escape the query's other predicates.
+                                if ( '' !== $own && '' !== $child ) {
+                                        $where .= " AND ( {$own} OR {$child} ) ";
+                                } elseif ( '' !== $own ) {
+                                        $where .= " AND {$own} ";
+                                } elseif ( '' !== $child ) {
+                                        $where .= " AND {$child} ";
+                                }
+                                return $where;
+                        };
+                }
                 if ( $needs_custom_query ) {
                         add_filter(
 …
                         add_filter( 'posts_join', $stock_qty_join_callback, 10, 1 );
                         add_filter( 'posts_where', $stock_qty_where_callback, 10, 1 );
+                }
+                if ( $product_url_join_callback ) {
+                        // Marker first — it must be on the query args before WP_Query is built.
+                        add_filter( 'woocommerce_product_data_store_cpt_get_products_query', $product_url_marker_callback, 10, 1 );
+                        add_filter( 'posts_join', $product_url_join_callback, 10, 2 );
+                        add_filter( 'posts_where', $product_url_where_callback, 10, 2 );
+                }
+                if ( $combined_join_callback ) {
+                        add_filter( 'posts_join', $combined_join_callback, 10, 1 );
+                }
+                if ( $combined_where_callback ) {
+                        add_filter( 'posts_where', $combined_where_callback, 10, 1 );
+                }
 …
                                 remove_filter( 'posts_where', $stock_qty_where_callback, 10 );
+                        }
+                        if ( $product_url_join_callback ) {
+                                remove_filter( 'woocommerce_product_data_store_cpt_get_products_query', $product_url_marker_callback, 10 );
+                                remove_filter( 'posts_join', $product_url_join_callback, 10 );
+                                remove_filter( 'posts_where', $product_url_where_callback, 10 );
+                        }
+                        if ( $combined_join_callback ) {
+                                remove_filter( 'posts_join', $combined_join_callback, 10 );
+                        }
+                        if ( $combined_where_callback ) {
+                                remove_filter( 'posts_where', $combined_where_callback, 10 );
+                        }
                         if ( $search_join_callback ) {
                                 remove_filter( 'posts_join', $search_join_callback, 10 );
 …
         /**
+         * Build the post_title search WHERE clause for the given match mode.
+         *
+         * - 'all' (default): every whitespace-separated word must appear (joined with AND).
+         * - 'any': at least one word must appear (joined with OR).
+         * - 'phrase' or a single-word term: the whole term as one LIKE
+         *   (matches the historical behavior — contiguous substring, order-sensitive).
+         *
+         * Multi-word matching splits on whitespace and caps at 10 words to bound the
+         * number of LIKE clauses. The fragment is parenthesized so the caller can
+         * safely AND it with the SKU clause.
+         *
+         * @param \wpdb  $wpdb WordPress database handle.
+         * @param string $term Sanitized search term.
+         * @param string $mode One of 'phrase', 'all', 'any'.
+         * @return string Prepared SQL fragment (already wrapped in parentheses).
+         */
+        private function build_name_search_clause( \wpdb $wpdb, string $term, string $mode ): string {
+                $words = [];
+                if ( 'phrase' !== $mode ) {
+                        $split = preg_split( '/\s+/', trim( $term ), -1, PREG_SPLIT_NO_EMPTY );
+                        $words = is_array( $split ) ? $split : [];
+                }
+                // Phrase mode, or fewer than two words: original whole-term LIKE.
+                if ( count( $words ) < 2 ) {
+                        $like = '%' . $wpdb->esc_like( $term ) . '%';
+                        return $wpdb->prepare( "( {$wpdb->posts}.post_title LIKE %s )", $like );
+                }
+                // Cap the word count to bound the LIKE chain length.
+                $words     = array_slice( $words, 0, 10 );
+                $connector = ( 'any' === $mode ) ? 'OR' : 'AND';
+                $likes  = [];
+                $values = [];
+                foreach ( $words as $word ) {
+                        $likes[]  = "{$wpdb->posts}.post_title LIKE %s";
+                        $values[] = '%' . $wpdb->esc_like( $word ) . '%';
+                }
+                $sql = '( ' . implode( " {$connector} ", $likes ) . ' )';
+                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $sql is a fixed chain of `%s` placeholders (one per word), each expanded by prepare() via the spread of $values below.
+                return $wpdb->prepare( $sql, ...$values );
+                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+        }
+        /**
+         * Build the SKU search WHERE clause for the given match mode.
+         *
+         * A comma-separated term is a LIST OF VALUES applied under the selected
+         * mode — the mode is authoritative, the comma only multiplies it. The four
+         * positive modes OR their values together (match ANY); not_contains ANDs
+         * them (match NONE).
+         *
+         * Mode '' is the legacy "auto" behaviour, preserved for requests and saved
+         * views written before match modes existed: a comma in the term means
+         * exact IN, otherwise a whole-term substring LIKE. It maps onto
+         * is_exactly / contains, which produce that same SQL — with two
+         * deliberate exceptions, not regressions: "0" is now treated as a real
+         * token (see split_sku_term()) instead of being dropped by truthiness
+         * filtering, and the token count is capped at self::SKU_SEARCH_MAX_TOKENS.
+         *
+         * not_contains reads the SKU through COALESCE so a product with no SKU (or
+         * no lookup row at all — the JOIN is a LEFT JOIN) counts as "does not
+         * contain". The positive modes deliberately keep the bare column: NULL LIKE
+         * is NULL, which correctly excludes, and the plain column stays
+         * index-eligible for the anchored LIKE of starts_with.
+         *
+         * The fragment is parenthesized so the caller can safely AND it with the
+         * name clause.
+         *
+         * @param \wpdb  $wpdb
+         * @param string $term               Raw (already sanitized) search_sku value.
+         * @param string $mode               One of self::SKU_SEARCH_MODES, or '' for auto/legacy.
+         * @param bool   $include_variations Whether to also surface parents via a matching child.
+         * @return string SQL fragment, or '' when the term holds no usable tokens.
+         */
+        private function build_sku_search_clause( \wpdb $wpdb, string $term, string $mode, bool $include_variations ): string {
+                $mode   = self::normalize_sku_mode( $mode );
+                $tokens = self::split_sku_term( $term );
+                if ( '' === $mode ) {
+                        // Legacy auto: the comma was the (implicit) mode selector.
+                        $mode = ( strpos( $term, ',' ) !== false ) ? 'is_exactly' : 'contains';
+                }
+                // Comma-only term ( ",,, " ) yields no tokens — no clause, as before.
+                if ( empty( $tokens ) ) {
+                        return '';
+                }
+                $negated = ( 'not_contains' === $mode );
+                /**
+                 * Build a parenthesized predicate over one column for every token.
+                 *
+                 * @param string $column SQL column expression.
+                 * @return array{0: string, 1: string[]} [ sql, prepare values ]
+                 */
+                $build_predicate = function ( string $column ) use ( $wpdb, $mode, $tokens, $negated ): array {
+                        if ( 'is_exactly' === $mode ) {
+                                $placeholders = implode( ',', array_fill( 0, count( $tokens ), '%s' ) );
+                                return [ "( {$column} IN ({$placeholders}) )", $tokens ];
+                        }
+                        $operator  = $negated ? 'NOT LIKE' : 'LIKE';
+                        $connector = $negated ? ' AND ' : ' OR ';
+                        $parts  = [];
+                        $values = [];
+                        foreach ( $tokens as $token ) {
+                                $escaped = $wpdb->esc_like( $token );
+                                switch ( $mode ) {
+                                        case 'starts_with':
+                                                $values[] = $escaped . '%';
+                                                break;
+                                        case 'ends_with':
+                                                $values[] = '%' . $escaped;
+                                                break;
+                                        default: // contains / not_contains.
+                                                $values[] = '%' . $escaped . '%';
+                                                break;
+                                }
+                                $parts[] = "{$column} {$operator} %s";
+                        }
+                        return [ '( ' . implode( $connector, $parts ) . ' )', $values ];
+                };
+                $parent_column = $negated ? "COALESCE( wcabe_sku_lookup.sku, '' )" : 'wcabe_sku_lookup.sku';
+                [ $parent_sql, $parent_values ] = $build_predicate( $parent_column );
+                if ( ! $include_variations ) {
+                        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $parent_sql is a fixed chain of `%s` placeholders (one per token), each expanded by prepare() via the spread below.
+                        return $wpdb->prepare( $parent_sql, ...$parent_values );
+                        // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+                }
+                // Also surface a parent whose child variation matches, so
+                // interleave_variations() can show that variation. Status predicate
+                // matches WC get_children(), which returns only publish/private
+                // variations. The child branch is gated on the parent being variable —
+                // a stale variation left behind by a variable->simple type conversion
+                // must not surface its now-simple parent.
+                //
+                // not_contains joins LEFT with meta_key in the ON clause so a variation
+                // with no _sku row still counts as "does not contain"; an INNER JOIN
+                // would make it invisible.
+                $child_column = $negated ? "COALESCE( pm.meta_value, '' )" : 'pm.meta_value';
+                [ $child_sql, $child_values ] = $build_predicate( $child_column );
+                $child_join = $negated
+                        ? "LEFT JOIN {$wpdb->postmeta} pm ON ( p.ID = pm.post_id AND pm.meta_key = '_sku' )"
+                        : "INNER JOIN {$wpdb->postmeta} pm ON p.ID = pm.post_id";
+                $meta_key_where = $negated ? '' : " AND pm.meta_key = '_sku'";
+                $is_variable = $this->sql_is_variable_product();
+                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $parent_sql/$child_sql are fixed chains of `%s` placeholders (one per token), all expanded by prepare() via the merged spread below.
+                return $wpdb->prepare(
+                        "( {$parent_sql}"
+                        . " OR ( {$is_variable} AND {$wpdb->posts}.ID IN ("
+                        . " SELECT p.post_parent FROM {$wpdb->posts} p"
+                        . " {$child_join}"
+                        . " WHERE p.post_type = 'product_variation'"
+                        . " AND p.post_status IN ('publish','private')"
+                        . $meta_key_where
+                        . " AND {$child_sql}"
+                        . ' ) ) )',
+                        ...array_merge( $parent_values, $child_values )
+                );
+                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+        }
+        /**
          * Build a WC date range string for date_created / date_modified args.
+         *
 …
+                }
                 return '<=' . $before;
+        }
+        /**
+         * Resolve a sale-date filter range to site-local Unix timestamp bounds.
+         *
+         * _sale_price_dates_from / _sale_price_dates_to are stored as Unix timestamps
+         * derived from site-local dates, and the grid renders them in site time — so
+         * bounds must be computed in site time too.
+         *
+         * The upper bound is derived from an explicit local 23:59:59, NOT from
+         * "local midnight + DAY_IN_SECONDS - 1": a local day is 23 or 25 hours long
+         * across a DST transition, so the arithmetic form would spill into the next
+         * day or drop the final hour.
+         *
+         * @param string $after  Start date (YYYY-MM-DD) or empty.
+         * @param string $before End date (YYYY-MM-DD) or empty.
+         * @return array{0: ?int, 1: ?int} [ min_timestamp, max_timestamp ], null when unbounded.
+         */
+        private function sale_date_filter_bounds( string $after, string $before ): array {
+                $min = '' !== $after ? wc_string_to_datetime( $after )->getTimestamp() : null;
+                $max = '' !== $before ? wc_string_to_datetime( $before . ' 23:59:59' )->getTimestamp() : null;
+                return [ $min, $max ];
+        }
+        /**
+         * SQL EXISTS expression testing whether the current wp_posts row is a
+         * variable product.
+         *
+         * Used by the posts_where filter callbacks to gate child-variation EXISTS
+         * branches on the parent actually being variable. A variable->simple type
+         * conversion can leave published variation posts behind, and without the
+         * gate a stale child's matching meta would surface its now-simple parent —
+         * a false-positive row interleave_variations() can neither narrow nor
+         * remove, since it only processes children of variable parents.
+         *
+         * @return string
+         */
+        private function sql_is_variable_product(): string {
+                global $wpdb;
+                // Covers third-party variable subclasses (variable-subscription, …), not
+                // just the native 'variable' slug (#137). Slugs come from registered
+                // product classes, not user input, but are escaped anyway.
+                $slugs_in = implode(
+                        ',',
+                        array_map(
+                                static fn( string $slug ): string => "'" . esc_sql( $slug ) . "'",
+                                self::get_variable_product_types()
+                        )
+                );
+                return "EXISTS ( SELECT 1 FROM {$wpdb->term_relationships} tr"
+                        . " INNER JOIN {$wpdb->term_taxonomy} tt ON tt.term_taxonomy_id = tr.term_taxonomy_id"
+                        . " INNER JOIN {$wpdb->terms} t ON t.term_id = tt.term_id"
+                        . " WHERE tr.object_id = {$wpdb->posts}.ID AND tt.taxonomy = 'product_type' AND t.slug IN ( {$slugs_in} ) )";
+        }
+        /**
+         * SQL predicate matching external (affiliate) products.
+         *
+         * Mirrors sql_is_variable_product(). Scopes EVERY Product URL filter operator
+         * to the only type that surfaces the field — see the note at the filter's
+         * where-callback.
+         *
+         * @return string
+         */
+        private function sql_is_external_product(): string {
+                global $wpdb;
+                return "EXISTS ( SELECT 1 FROM {$wpdb->term_relationships} tr"
+                        . " INNER JOIN {$wpdb->term_taxonomy} tt ON tt.term_taxonomy_id = tr.term_taxonomy_id"
+                        . " INNER JOIN {$wpdb->terms} t ON t.term_id = tt.term_id"
+                        . " WHERE tr.object_id = {$wpdb->posts}.ID AND tt.taxonomy = 'product_type' AND t.slug = 'external' )";
+        }
 …
                         $result[] = $product;
+                        if ( $product['type'] === 'variable' && $product['variation_count'] > 0 ) {
+                        // variation_count is only non-zero for variable-capable products
+                        // (format_product gates it on instanceof WC_Product_Variable), so it
+                        // doubles as the "has interleavable children" signal — covering
+                        // third-party variable subclasses, not just type === 'variable' (#137).
+                        if ( ! empty( $product['variation_count'] ) ) {
                                 // Use pre-collected children IDs when available, falling back to
                                 // loading the parent product (should only happen if called without
 …
+                                }
+                                // If the parent surfaced via its OWN SKU, show all its variations:
+                                // a SKU match on the product itself means "show this product", not
+                                // "filter its variants". Other meta filters still narrow children.
+                                //
+                                // NOT for not_contains: under a negative mode nearly every parent
+                                // matches on its own SKU, so honouring the rule there would switch
+                                // variation narrowing off wholesale and show children whose SKUs DO
+                                // contain the term. Accepted consequence: a parent that passes
+                                // not_contains while all of its children fail renders as an empty
+                                // parent row — the same class of edge as the limitation below.
+                                //
+                                // Inverse edge, positive modes: build_sku_search_clause() ORs the
+                                // parent's own SKU with "any child matches" — a parent whose OWN
+                                // SKU does NOT match still surfaces (and its non-matching own SKU
+                                // is what the grid displays) as long as at least one child does.
+                                // That parent row's visible SKU therefore will not itself contain
+                                // the searched term. Intentional: the parent row is a container for
+                                // the matching child, not a claim that the parent's own SKU matches.
+                                //
+                                // Known limitation: when search_sku and search_description match
+                                // DIFFERENT siblings, the SQL ORs surface the parent but the
+                                // per-child AND below can hide both → empty parent. Pre-existing
+                                // with search_description; not resolved here.
+                                $child_filters         = $filters;
+                                $child_has_meta_filter = $has_meta_filter;
+                                $sku_mode              = self::normalize_sku_mode( $filters['search_sku_mode'] ?? '' );
+                                if (
+                                        $has_meta_filter
+                                        && 'not_contains' !== $sku_mode
+                                        && true === $this->sku_term_matches( (string) ( $product['sku'] ?? '' ), (string) ( $filters['search_sku'] ?? '' ), $sku_mode )
+                                ) {
+                                        unset( $child_filters['search_sku'], $child_filters['search_sku_mode'] );
+                                        $child_has_meta_filter = $this->has_variation_meta_filters( $child_filters );
+                                }
                                 foreach ( $children as $child_id ) {
                                         $variation = wc_get_product( $child_id );
                                         if ( $variation && $variation->is_type( 'variation' ) ) {
                                                 if ( $has_meta_filter && ! $this->variation_matches_filters( $variation, $filters ) ) {
+                                                if ( $child_has_meta_filter && ! $this->variation_matches_filters( $variation, $child_filters ) ) {
                                                         continue;
+                                                }
 …
          * Returns an approximate flag because the raw COUNT(*) does not replicate
          * variation_matches_filters() — variation-level filters (price, stock_qty,
          * manage_stock, backorders, search_description) cause an over-count at
          * render time. Accepted as a safe upper bound.
+         * menu_order, manage_stock, backorders, search_description, search_sku) cause
+         * an over-count at render time. Accepted as a safe upper bound.
+         *
          * @param int   $total_parents Total parents matching filters (from main query).
 …
                 foreach ( array_chunk( $variable_parent_ids, 1000 ) as $chunk ) {
                         $placeholders = implode( ',', array_fill( 0, count( $chunk ), '%d' ) );
                         // post_status NOT IN ('trash', 'auto-draft') matches what the main
                         // rendering path surfaces: get_children() returns all non-trashed
                         // child IDs, and wc_get_product() returns any non-auto-draft
                         // variation. Earlier version used IN ('publish', 'private'), which
                         // under-counted drafts. See Product_Service::get_variations() for
                         // the matching path. Parent status filtering is already applied
                         // via the parent-ID query above; this clause is the independent
+                        // post_status IN ('publish', 'private') mirrors the render path:
+                        // WC_Product_Variable::get_children() queries variation children with
+                        // post_status => array( publish, private ) (verified in WC 10.8.1,
+                        // class-wc-product-variable-data-store-cpt.php), so the grid only ever
+                        // renders those. Counting draft/pending here would over-report rows
+                        // that never display. Parent status filtering is already applied via
+                        // the parent-ID query above; this clause is the independent
                         // VARIATION-status axis in WC's data model.
                         // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $placeholders is a comma-joined string of `%d` placeholders, one per element of $chunk, all expanded by prepare() via spread.
 …
                                 "SELECT COUNT(*) FROM {$wpdb->posts}
                                  WHERE post_type = 'product_variation'
                                    AND post_status NOT IN ('trash', 'auto-draft')
+                                   AND post_status IN ('publish', 'private')
                                    AND post_parent IN ($placeholders)",
                                 ...$chunk
 …
                         return true;
+                }
+                if ( isset( $filters['menu_order_min'] ) && '' !== $filters['menu_order_min'] ) {
+                        return true;
+                }
+                if ( isset( $filters['menu_order_max'] ) && '' !== $filters['menu_order_max'] ) {
+                        return true;
+                }
+                if (
+                        ( ( isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'] ) || ( isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'] ) )
+                        && Product_Helper::is_cogs_enabled()
+                ) {
+                        return true;
+                }
                 if ( ! empty( $filters['manage_stock'] ) ) {
                         return true;
 …
                         return true;
+                }
+                foreach ( [ 'sale_start_after', 'sale_start_before', 'sale_end_after', 'sale_end_before' ] as $sale_param ) {
+                        if ( isset( $filters[ $sale_param ] ) && '' !== $filters[ $sale_param ] ) {
+                                return true;
+                        }
+                }
+                foreach ( [ 'image_date_after', 'image_date_before' ] as $image_param ) {
+                        if ( isset( $filters[ $image_param ] ) && '' !== $filters[ $image_param ] ) {
+                                return true;
+                        }
+                }
                 if ( ! empty( $filters['search_description'] ) ) {
                         return true;
+                }
+                // Strict '' test, not empty(): "0" is a valid SKU.
+                if ( $this->sku_term_is_effective( (string) ( $filters['search_sku'] ?? '' ) ) ) {
+                        return true;
+                }
                 // search_short_description is not checked — variations don't have short
                 // descriptions; the parent-level post_excerpt filter is sufficient.
+                // product_url is not checked either — only external products carry one,
+                // and an external product is never variable, so the filter can never
+                // surface a parent through a child variation.
                 return false;
+        }
+        /**
+         * Whether a search_sku term would produce an actual SQL clause. False for an
+         * empty term or a comma-only term with no real tokens — the query builds no
+         * clause in those cases. Shared so per-variation narrowing and the
+         * approximate-count flag agree on what counts as an active SKU filter.
+         *
+         * Deliberately takes no mode: effectiveness is mode-invariant, because every
+         * mode (and the legacy auto branch) builds its clause from the same token
+         * list — see build_sku_search_clause(), which returns '' on an empty list
+         * regardless of mode.
+         *
+         * @param string $term Raw search_sku filter value.
+         * @return bool
+         */
+        private function sku_term_is_effective( string $term ): bool {
+                return [] !== self::split_sku_term( sanitize_text_field( $term ) );
+        }
+        /**
+         * Match a SKU against a search_sku term + mode, mirroring the SQL built by
+         * build_sku_search_clause() and its sanitization. Returns null when the term
+         * is not an effective filter, so callers neither surface nor narrow on it —
+         * callers compare against true/false strictly and rely on that third state.
+         * mb_* keeps case-folding parity with MySQL's default utf8mb4_*_ci collation
+         * for multibyte SKUs.
+         *
+         * The positive modes match ANY token; not_contains must miss EVERY token,
+         * and an empty SKU therefore matches it — mirroring the COALESCE in the SQL.
+         *
+         * @param string $sku  The SKU to test.
+         * @param string $term Raw search_sku filter value.
+         * @param mixed  $mode Raw search_sku_mode filter value (normalised here).
+         * @return bool|null
+         */
+        private function sku_term_matches( string $sku, string $term, $mode = '' ): ?bool {
+                if ( ! $this->sku_term_is_effective( $term ) ) {
+                        return null;
+                }
+                $term   = sanitize_text_field( $term );
+                $mode   = self::normalize_sku_mode( $mode );
+                $tokens = self::split_sku_term( $term );
+                if ( '' === $mode ) {
+                        // Legacy auto: the comma was the (implicit) mode selector.
+                        $mode = ( strpos( $term, ',' ) !== false ) ? 'is_exactly' : 'contains';
+                }
+                $sku_folded = mb_strtolower( $sku );
+                if ( 'is_exactly' === $mode ) {
+                        $folded = array_map(
+                                static fn( string $token ): string => mb_strtolower( $token ),
+                                $tokens
+                        );
+                        return in_array( $sku_folded, $folded, true );
+                }
+                foreach ( $tokens as $token ) {
+                        $token_folded = mb_strtolower( $token );
+                        switch ( $mode ) {
+                                case 'starts_with':
+                                        $hit = 0 === mb_strpos( $sku_folded, $token_folded );
+                                        break;
+                                case 'ends_with':
+                                        $token_length = mb_strlen( $token_folded );
+                                        $hit          = $token_length <= mb_strlen( $sku_folded )
+                                                && mb_substr( $sku_folded, -$token_length ) === $token_folded;
+                                        break;
+                                default: // contains / not_contains.
+                                        $hit = false !== mb_strpos( $sku_folded, $token_folded );
+                                        break;
+                        }
+                        if ( 'not_contains' === $mode ) {
+                                // Must miss every token — one hit disqualifies.
+                                if ( $hit ) {
+                                        return false;
+                                }
+                        } elseif ( $hit ) {
+                                // Positive modes match any token — one hit is enough.
+                                return true;
+                        }
+                }
+                return 'not_contains' === $mode;
+        }
 …
+                }
+                // Cost of Goods range — match on the variation's OWN defined value (null =
+                // inherits parent, treated as no-match, like stock qty). Gated on
+                // is_cogs_enabled() so get_cogs_value() never fires when the feature is off.
+                $has_cogs_min = isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'];
+                $has_cogs_max = isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'];
+                if ( ( $has_cogs_min || $has_cogs_max ) && Product_Helper::is_cogs_enabled() ) {
+                        $cogs = $variation->get_cogs_value();
+                        if ( null === $cogs ) {
+                                return false;
+                        }
+                        if ( $has_cogs_min && $cogs < (float) $filters['cogs_min'] ) {
+                                return false;
+                        }
+                        if ( $has_cogs_max && $cogs > (float) $filters['cogs_max'] ) {
+                                return false;
+                        }
+                }
+                // Menu order range — the variation's own value (get_menu_order() is always
+                // an int, default 0; no null-guard needed like stock qty / COGS).
+                $has_menu_min = isset( $filters['menu_order_min'] ) && '' !== $filters['menu_order_min'];
+                $has_menu_max = isset( $filters['menu_order_max'] ) && '' !== $filters['menu_order_max'];
+                if ( $has_menu_min || $has_menu_max ) {
+                        $order = $variation->get_menu_order();
+                        if ( $has_menu_min && $order < (int) $filters['menu_order_min'] ) {
+                                return false;
+                        }
+                        if ( $has_menu_max && $order > (int) $filters['menu_order_max'] ) {
+                                return false;
+                        }
+                }
+                // Sale-schedule date ranges — the variation's OWN schedule (null = no sale
+                // scheduled, treated as no-match, like stock qty / COGS). Y-m-d strings are
+                // zero-padded so lexical comparison is chronological, and WC_DateTime::date()
+                // renders in site time — the same basis as the SQL bounds.
+                $sale_date_ranges = [
+                        [ 'get_date_on_sale_from', 'sale_start_after', 'sale_start_before' ],
+                        [ 'get_date_on_sale_to', 'sale_end_after', 'sale_end_before' ],
+                ];
+                foreach ( $sale_date_ranges as list( $getter, $after_key, $before_key ) ) {
+                        $has_after  = isset( $filters[ $after_key ] ) && '' !== $filters[ $after_key ];
+                        $has_before = isset( $filters[ $before_key ] ) && '' !== $filters[ $before_key ];
+                        if ( ! $has_after && ! $has_before ) {
+                                continue;
+                        }
+                        $sale_date = $variation->{$getter}();
+                        if ( null === $sale_date ) {
+                                return false;
+                        }
+                        $value = $sale_date->date( 'Y-m-d' );
+                        if ( $has_after && $value < $filters[ $after_key ] ) {
+                                return false;
+                        }
+                        if ( $has_before && $value > $filters[ $before_key ] ) {
+                                return false;
+                        }
+                }
+                // Image-uploaded date range — the variation's OWN featured image ('edit'
+                // context bypasses the filter that inherits the parent image for imageless
+                // variations, matching format_variation()). No own image, a stale
+                // _thumbnail_id, or one pointing at a non-attachment = no match, like stock
+                // qty / COGS / sale dates. Y-m-d strings are zero-padded so lexical
+                // comparison is chronological, and the attachment post_date is site-local —
+                // the same basis as the SQL bounds.
+                $has_image_after  = isset( $filters['image_date_after'] ) && '' !== $filters['image_date_after'];
+                $has_image_before = isset( $filters['image_date_before'] ) && '' !== $filters['image_date_before'];
+                if ( $has_image_after || $has_image_before ) {
+                        $image_date = Product_Helper::get_image_upload_date( (int) $variation->get_image_id( 'edit' ) );
+                        if ( '' === $image_date ) {
+                                return false;
+                        }
+                        $value = substr( $image_date, 0, 10 );
+                        if ( $has_image_after && $value < $filters['image_date_after'] ) {
+                                return false;
+                        }
+                        if ( $has_image_before && $value > $filters['image_date_before'] ) {
+                                return false;
+                        }
+                }
                 // Manage stock.
                 if ( ! empty( $filters['manage_stock'] ) ) {
 …
+                }
+                // SKU (_sku meta). A null result means the term is not an effective
+                // filter (empty / comma-only) — the SQL builds no clause then, so don't
+                // narrow here either. See sku_term_matches() for per-mode parity.
+                //
+                // 'edit' context, deliberately: WC_Product_Variation::get_sku() falls back
+                // to the PARENT's SKU whenever the variation's own value is empty() — and
+                // PHP counts the perfectly valid SKU "0" as empty. The SQL matches on the
+                // variation's own _sku meta, so the mirror must read the own value or it
+                // narrows on a SKU the query never looked at.
+                if (
+                        false === $this->sku_term_matches(
+                                (string) $variation->get_sku( 'edit' ),
+                                (string) ( $filters['search_sku'] ?? '' ),
+                                $filters['search_sku_mode'] ?? ''
+                        )
+                ) {
+                        return false;
+                }
                 // Short description — variations don't have one (no postmeta equivalent),
                 // so skip this check; the parent-level post_excerpt filter already ran.

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/includes/Services/View_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Helpers\Page_Size_Helper;
 defined( 'ABSPATH' ) || exit;
 …
                                 $view['filters'] = $this->migrate_filters_shape( $view['filters'] );
+                        }
+                        // Bound a stored page size on read: a site that has since LOWERED
+                        // wcabe_g2_max_per_page must not hand the client a size the products
+                        // route would silently reduce. Views saved before page_size existed
+                        // are deliberately NOT backfilled — the frontend falls back to its
+                        // effective default, which keeps "absent" distinguishable from "100".
+                        if ( isset( $view['page_size'] ) ) {
+                                $view['page_size'] = Page_Size_Helper::clamp( $view['page_size'] );
+                        }
+                }
                 unset( $view );
 …
                         'filters'      => $this->sanitize_filters( $data['filters'] ?? [] ),
                         'column_state' => self::sanitize_column_state( $data['column_state'] ?? [] ),
+                        'page_size'    => Page_Size_Helper::clamp( $data['page_size'] ?? null ),
                         'is_default'   => ! empty( $data['is_default'] ),
                         'created_at'   => gmdate( 'Y-m-d\TH:i:s\Z' ),
 …
+                }
+                if ( isset( $data['page_size'] ) ) {
+                        $views[ $index ]['page_size'] = Page_Size_Helper::clamp( $data['page_size'] );
+                }
                 if ( isset( $data['is_default'] ) ) {
                         $views[ $index ]['is_default'] = (bool) $data['is_default'];
 …
          * Sanitize filters to match the expected FilterValues shape.
+         *
+         * Thin instance wrapper: migrate any legacy saved-view bag shape, then delegate
+         * to the public static sanitizer. Stays private/instance-bound only because the
+         * migration call (migrate_filters_shape) is instance-bound.
+         *
          * @param array $filters
          * @return array
          */
         private function sanitize_filters( array $filters ): array {
+                return self::sanitize_filter_values( $this->migrate_filters_shape( $filters ) );
+        }
+        /**
+         * Sanitize a URL-substring filter value.
+         *
+         * Deliberately NOT sanitize_text_field(): that strips percent-encoded octets
+         * (see wp-includes/formatting.php), so searching for "%20" or "%2F" — both
+         * common in real product URLs — would silently match nothing. Strips control
+         * characters and markup, preserves %XX. SQL safety is handled downstream by
+         * $wpdb->prepare() + esc_like(); this is only about control chars and tags.
+         *
+         * @param mixed $value Raw filter value.
+         * @return string
+         */
+        public static function sanitize_url_filter_value( $value ): string {
+                if ( ! is_scalar( $value ) ) {
+                        return '';
+                }
+                $value = wp_check_invalid_utf8( (string) $value );
+                $value = wp_strip_all_tags( $value );
+                // Null bytes and C0/C1 control characters (incl. newlines and tabs).
+                $value = preg_replace( '/[\x00-\x1F\x7F-\x9F]/u', '', $value );
+                return trim( (string) $value );
+        }
+        /**
+         * Sanitize a FilterValues blob (scalar fields + dynamic bags) into the canonical
+         * shape. Public + static so reusable outside view CRUD — the User_Settings
+         * controller calls it for the filterDraft field (mirrors sanitize_column_state).
+         *
+         * No migration here: callers that may receive a legacy bag shape (saved views)
+         * migrate first via the wrapper; live frontend draft data is already current.
+         * The migrate-then-sanitize order is behavior-preserving — migration only renames
+         * the dynamic bags (which the body re-reads), and never touches the scalar fields.
+         *
+         * @param array $filters
+         * @return array
+         */
+        public static function sanitize_filter_values( array $filters ): array {
                 $allowed_operators = [ '=', '>', '<', '>=', '<=', 'expression' ];
                 $id_operator       = $filters['id_operator'] ?? '=';
 …
+                }
+                $search_name_mode = $filters['search_name_mode'] ?? 'all';
+                if ( ! in_array( $search_name_mode, Product_Service::TITLE_SEARCH_MODES, true ) ) {
+                        $search_name_mode = 'all';
+                }
+                // SKU match mode. '' is the legacy "auto" state (comma = exact, single
+                // value = partial), so an unknown mode falls back to it rather than to a
+                // concrete mode. Sanitize the term FIRST — sanitize_text_field trims, so
+                // a whitespace-only term canonicalizes to '' here — and drop the mode
+                // with it: a mode left behind an empty term would make a freshly loaded
+                // view report a phantom "Modified" (same rationale as product URL below).
+                $search_sku      = sanitize_text_field( $filters['search_sku'] ?? '' );
+                $search_sku_mode = $filters['search_sku_mode'] ?? '';
+                if ( ! in_array( $search_sku_mode, Product_Service::SKU_SEARCH_MODES, true ) ) {
+                        $search_sku_mode = '';
+                }
+                if ( '' === $search_sku ) {
+                        $search_sku_mode = '';
+                }
+                // Product URL filter. Canonicalized here as well as in the client store,
+                // because a view can also be created/imported straight through the REST
+                // API: a stale value hidden behind an empty-check operator would persist
+                // and — since the dirty-state baseline compares against the STORED view —
+                // make a freshly loaded view report a phantom "Modified".
+                $product_url_operator = $filters['product_url_operator'] ?? 'contains';
+                if ( ! in_array( $product_url_operator, Product_Service::PRODUCT_URL_OPERATORS, true ) ) {
+                        $product_url_operator = 'contains';
+                }
+                $product_url_value = self::sanitize_url_filter_value( $filters['product_url_value'] ?? '' );
+                if ( Product_Service::is_product_url_empty_check( $product_url_operator ) ) {
+                        $product_url_value = '';
+                } elseif ( '' === $product_url_value ) {
+                        $product_url_operator = 'contains';
+                }
                 $sanitized = [
                         // Original fields.
                         'search_name'             => sanitize_text_field( $filters['search_name'] ?? '' ),
+                        'search_sku'              => sanitize_text_field( $filters['search_sku'] ?? '' ),
+                        'search_name_mode'        => $search_name_mode,
+                        'search_sku'              => $search_sku,
+                        'search_sku_mode'         => $search_sku_mode,
                         'category'                => array_map( 'absint', (array) ( $filters['category'] ?? [] ) ),
+                        'tag'                     => array_map( 'absint', (array) ( $filters['tag'] ?? [] ) ),
                         'type'                    => array_map( 'sanitize_text_field', (array) ( $filters['type'] ?? [] ) ),
                         'status'                  => array_map( 'sanitize_text_field', (array) ( $filters['status'] ?? [] ) ),
                         'stock_status'            => array_map( 'sanitize_text_field', (array) ( $filters['stock_status'] ?? [] ) ),
+                        // Slugs. The filter callback drops values that sanitize_title reduced to
+                        // '' (junk like '!!!'), and array_values re-indexes so the result is a
+                        // JSON array rather than an object — a stored [''] would otherwise read
+                        // back as an active filter that matches nothing visible. Strict ''
+                        // equality, not array_filter()'s default truthiness: sanitize_title()
+                        // can legally produce the string '0', which truthiness would drop too.
+                        'shipping_class'          => array_values(
+                                array_filter(
+                                        array_map( 'sanitize_title', (array) ( $filters['shipping_class'] ?? [] ) ),
+                                        static fn( string $slug ): bool => '' !== $slug
+                                )
+                        ),
                         'price_min'               => sanitize_text_field( $filters['price_min'] ?? '' ),
                         'price_max'               => sanitize_text_field( $filters['price_max'] ?? '' ),
+                        'cogs_min'                => sanitize_text_field( $filters['cogs_min'] ?? '' ),
+                        'cogs_max'                => sanitize_text_field( $filters['cogs_max'] ?? '' ),
                         'stock_qty_min'           => sanitize_text_field( $filters['stock_qty_min'] ?? '' ),
                         'stock_qty_max'           => sanitize_text_field( $filters['stock_qty_max'] ?? '' ),
+                        'menu_order_min'          => sanitize_text_field( $filters['menu_order_min'] ?? '' ),
+                        'menu_order_max'          => sanitize_text_field( $filters['menu_order_max'] ?? '' ),
                         'manage_stock'            => array_map( 'sanitize_text_field', (array) ( $filters['manage_stock'] ?? [] ) ),
                         'backorders'              => array_map( 'sanitize_text_field', (array) ( $filters['backorders'] ?? [] ) ),
 …
                         'id_operator' => $id_operator,
                         'id_value'    => sanitize_text_field( $filters['id_value'] ?? '' ),
+                        // Product URL filter. NOTE: the value uses sanitize_url_filter_value(),
+                        // not sanitize_text_field() — the latter strips percent-encoded octets
+                        // (%20, %2F), silently corrupting legitimate URL substring searches.
+                        'product_url_operator' => $product_url_operator,
+                        'product_url_value'    => $product_url_value,
                         // Date filters.
 …
                         'date_modified_from' => sanitize_text_field( $filters['date_modified_from'] ?? '' ),
                         'date_modified_to'   => sanitize_text_field( $filters['date_modified_to'] ?? '' ),
+                        'sale_start_from'    => sanitize_text_field( $filters['sale_start_from'] ?? '' ),
+                        'sale_start_to'      => sanitize_text_field( $filters['sale_start_to'] ?? '' ),
+                        'sale_end_from'      => sanitize_text_field( $filters['sale_end_from'] ?? '' ),
+                        'sale_end_to'        => sanitize_text_field( $filters['sale_end_to'] ?? '' ),
+                        'image_date_from'    => sanitize_text_field( $filters['image_date_from'] ?? '' ),
+                        'image_date_to'      => sanitize_text_field( $filters['image_date_to'] ?? '' ),
                         // Dynamic filter bags — sanitized below.
 …
                         'extension_filters' => [],
                 ];
-                // Normalize any pre-Phase-B saved-view shape (old acf_filters /
-                // custom_meta_filters / taxonomy_filters keys) into extension_filters
-                // before the dynamic-bag sanitization below reads it.
-                $filters = $this->migrate_filters_shape( $filters );
                 // Attribute filters: Record<string, number[]> — Free feature.

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/readme.txt

-              r3549389
+              r3663491
 Tags: bulk edit, product editor, product bulk edit, woocommerce products, inventory
 Requires at least: 6.0
 Tested up to: 7.0
+Tested up to: 7.1
 Requires PHP: 8.0
 Stable tag: 1.0.0
+Stable tag: 1.2.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 * **Fill handle** — drag a cell down (or up) to copy its value to neighboring cells, Excel-style
 * **Bulk operations** — apply percentage price adjustments, find-and-replace, text append and prepend, and bulk category and tag assignment across many products at once
+* **Saved views** — save filter sets and column layouts as named views for one-click recall
+* **Filters** — filter by category, product type, stock status, name, SKU (CSV SKU lists supported), description, date created or modified, and more
+* **Wide field coverage** — prices, stock, SKUs, statuses, categories, tags, shipping class, menu order, upsells and cross-sells, product URL and button text for external products, and more
+* **Saved views** — save filter sets and column layouts as named views for one-click recall, and share them between sites with view import/export
+* **Filters** — filter by category, tags, product type, stock status, name and SKU (with exact/contains match modes and CSV SKU lists), description, dates created, modified, on sale, or image uploaded, and more
 * **Column management** — show, hide, reorder, resize, and pin columns; each user's layout is saved separately
 * **Keyboard shortcuts** — navigate and edit without touching the mouse
 * **Product operations** — duplicate and change status right from the grid
 * **Image and gallery management** — set featured images and manage product galleries directly from the grid
 * **CSV export** — export the current filtered view to CSV in one click
+* **CSV export** — export the current filtered view to CSV in one click, including large catalogs
 * **Dark mode** — switch between light and dark themes
+* **Fast loading** — virtualized rendering handles thousands of products without the browser choking
+* **Fast loading** — virtualized rendering handles thousands of products without the browser choking, with a configurable page size
+* **Plays well with others** — products from third-party type plugins (such as bundles or subscriptions) appear in the grid with their common fields editable, and an optional setting re-fires WordPress save hooks so sync and cache plugins stay in step
 = Built on proper WooCommerce APIs =
 …
 = Pro version =
 If you need more — regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, fine-grained selection tools for the current grid page, and more — there is a paid Pro version available at [wpmelon.com](https://wpmelon.com/bulk-edit/).
+If you need more — paste from Excel/Google Sheets, Operation History with restore, regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, bulk variation creation, variation attribute editing, WPML support, fine-grained selection tools for the current grid page, and more — there is a paid Pro version available at [wpmelon.com](https://wpmelon.com/bulk-edit/).
 The free version is genuinely useful on its own. Pro is for stores that need more advanced bulk-editing workflows or fields the free version doesn’t touch.
 …
 = Can I undo changes? =
 Edits are staged as pending changes in the grid before you save, so you can undo them or discard them entirely while they're unsaved. Once saved, changes go to the database and cannot be undone by the plugin itself — keep a backup, as you would with any bulk operation. (A proper edit history with rollback is planned for the Pro version.)
+Edits are staged as pending changes in the grid before you save, so you can undo them or discard them entirely while they're unsaved. Once saved, the free version can't undo them — keep a backup, as you would with any bulk operation. The Pro version adds Operation History, which records each save so you can review and restore previous field values (see below).
 = Is there a Pro version? =
+Yes. Pro adds regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, fine-grained selection tools for the current grid page, and more. It's available at [wpmelon.com](https://wpmelon.com/bulk-edit/). The free version is a complete, standalone tool — Pro extends it, it doesn't gate it.
+Yes. Pro adds paste from Excel/Google Sheets, Operation History with restore, regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, bulk variation creation, variation attribute editing, WPML support, fine-grained selection tools for the current grid page, and more. It's available at [wpmelon.com](https://wpmelon.com/bulk-edit/). The free version is a complete, standalone tool — Pro extends it, it doesn't gate it.
+= What does Operation History store? (Pro) =
+Operation History is a Pro feature, currently in beta and off by default. When you turn it on, each bulk save is recorded locally so you can review it later and restore previous field values. Each record stores the before and after values of the fields that save changed, the product and variation IDs involved, the user who made the change, and timestamps. The data lives in custom database tables on your own site and is never sent off-site. Records are kept for 30 days by default (configurable) and pruned automatically. You can turn recording on or off, clear the history at any time, and optionally have all history data removed when you uninstall Pro. The free version records nothing and creates no history tables.
 = Does it support custom post types? =
 …
 == Changelog ==
+= 1.2.0 =
+* Added Cost of Goods (COGS) as an editable product column when WooCommerce's Cost of Goods Sold feature is enabled. Edit it inline or with the bulk-edit panel, filter products by a Cost of Goods range, and include it in CSV exports.
+* Added a Published on column — show it in the grid, edit its full date and time inline, and bulk-edit it — plus a read-only Modified on column. Both are available in CSV export.
+* Products with a future Published on date now appear in the grid as "Scheduled" (and can be filtered by that status) instead of being hidden from the default view.
+* The Title filter now matches all words by default, with a choice of how multi-word searches behave. When you type two or more words, a mode dropdown appears: "All words" (the default) finds titles containing every word in any order, "Any word" matches titles containing at least one word, and "Exact phrase" matches the words exactly as typed.
+* You can now include product attribute columns (such as Color or Size) in the CSV export. Open the Export dialog and tick the attribute columns you want — each cell lists the product's terms separated by " | ".
+* Your column layout and filters are now remembered automatically across page reloads and navigation — no need to save a view first. If you have a default view, it's still applied on load; otherwise your last working layout is restored.
+* Added a Default view at the top of the Views menu that resets your columns and filters to their defaults in one click. The old per-view "Set as default" star is retired — your working layout now persists on its own, and any existing default view is still applied on load.
+* Switching views (or to Default) with unsaved column or filter changes now asks whether to Save, Disregard, or Cancel, so a modified layout isn't lost by accident. On the Default view the prompt lets you name and save the changes as a new view before switching.
+* The Views button now shows "· Modified" when your columns or filters differ from the selected view (or the Default). Use Update to save the changes back to the view, or Revert to discard them; on the Default view, "Save as new view" lets you keep them as a brand-new view.
+* Added Menu order as a product column. View it in the grid, edit it inline or with the bulk-edit panel, filter products by a menu order range, sort the whole catalog by menu order, and include it in CSV exports.
+* Added Upsells and Cross-sells as editable product columns. Pick linked products from a searchable modal (by title, SKU, GTIN, or product ID), reorder them — WooCommerce shows them in the order you set — and bulk-edit them across a selection with Replace all, Add, or Remove. Both columns are available in CSV export. Links pointing at deleted products are shown as a warning rather than silently discarded, so you decide when to remove them, and a link to a draft or disabled product is flagged so you know it won't appear on your storefront. Cross-sells are editable on simple and variable products only, matching WooCommerce, which hides the field on grouped and external products because cross-sells are promoted in the cart.
+* More products-per-page choices (250, 500 and 1000), plus a "Custom…" option for any page size up to 10,000. Your page size is now saved as part of your views, so it comes back with a saved view and survives a reload.
+* Added Sale From and Sale To date-range filters. Variable products are included when one of their variations matches the sale schedule you filtered for, and only the matching variations are shown.
+* Added a Tags filter. Pick one or more product tags to narrow the grid to products carrying any of them; it combines with all other filters and applies to CSV exports too.
+* Added the Button text field for External/Affiliate products. View and edit the add-to-cart button label inline, change it with the bulk-edit panel (set, prepend, append, find & replace, clear), and include it in CSV exports.
+* Added an "Image uploaded" filter and grid/CSV column showing when each product's featured image was uploaded. Filter by a date range to find products whose images changed since a given date — useful when syncing images between sites. Variations are matched on their own images, and the column is available in the column picker and CSV exports.
+* Export any saved grid view as a JSON file or copyable text, and import a view exported from another account or site.
+* Added support for third-party product types. WooCommerce Product Bundles products now appear in the grid with full inline and bulk editing (prices, stock, categories, images, and more), and other plugin-registered types (subscriptions, composites, etc.) show up with a safe set of editable fields. The Type filter and the grid's type badges show every registered product type under its own plugin-provided name. Variable-style third-party products (such as variable subscriptions) expand to show their variations, just like native variable products.
+* Added a "Refresh list after saving" setting. Turn it off to keep edited products visible in the grid after saving — even when they no longer match the active filters — until you reload the list.
+* Added a Product URL column for External/Affiliate products — show it in the grid, edit it inline and in bulk (including find & replace for affiliate domain migrations), and export it to CSV. A new Product URL filter finds products by their link, with contains, does not contain, starts with, ends with, is empty and is not empty modes.
+* The SKU filter now has a match-mode dropdown: Contains, Is exactly, Does not contain, Starts with, and Ends with. Comma-separate several SKUs to match any of them under the chosen mode (or none of them, for "Does not contain"), up to 200 values. The dropdown starts on Auto, which keeps the original behavior — a single SKU is a partial match, comma-separated SKUs are exact matches — so existing saved views and searches are unchanged. Also fixed: searching for the SKU "0" now filters products correctly instead of being ignored.
+* Added a compatibility setting that triggers the standard WordPress save hooks after each save, so sync and integration plugins detect changes made in the editor. Find it under "Notify other plugins of changes" in Settings — it is off by default, and the info button beside it lists exactly which hooks are fired.
+* Added Shipping class as a product column. View it in the grid, edit it inline or with the bulk-edit panel — including a "Same as parent" option on variations — filter products by shipping class, and include it in CSV exports.
+* Renamed the Created product filter to Published on to align with WordPress/WooCommerce publishing terminology, and renamed Modified to Modified on for consistency.
+* The Published on, Modified on, Sale from, and Sale to filters now appear in the filter panel only when their columns are shown in the grid, like the other filters. A date filter that has a value set stays visible even when its column is hidden.
+* Updated the Pro upgrade dialog with the latest Pro features (undo & rollback, paste from Excel, WPML support) and current early-bird pricing for annual and lifetime licenses.
+* Fixed searching by a variation's SKU returning no results. When variations are shown in the grid, a SKU search now matches variation SKUs and displays the matching variation under its parent. Searching a product's own SKU keeps all of its variations visible.
+* Fixed bulk-edit searches and saves failing after the page was left open for a long time. The page now refreshes its security token automatically, and shows a clear "session expired or permissions changed — reload" message in the rare case it can't recover.
+* Fixed several Default-view and layout issues: selecting Default now restores columns you had hidden back to their factory visibility; deleting the view you're currently on returns you to Default and flags the layout as modified when it differs, instead of leaving a stale layout mislabeled as clean; and switching views no longer shows columns from your previous layout when "auto-load products" is turned off.
+* Fixed the Views "· Modified" indicator disappearing when you chose "Update with current state" on a view other than the one currently selected.
+* Fixed the Views "· Modified" indicator misbehaving: reverting a column change now clears it (previously it could stay stuck on), and re-selecting the same categories or filters in a different order no longer flags the layout as modified.
+* Fixed the selected view being lost after a page reload — the active view is now correctly remembered instead of quietly reverting to Default on the next load.
+* Fixed saving a new view before the product grid has loaded (with auto-load off) storing an empty column layout — a new view now captures your current columns in that case.
+* Fixed column layout changes being silently discarded when updating a view while product auto-loading is turned off — the view now saves your columns, and the layout no longer keeps showing as modified afterward.
+* Cancelling a bulk save (or restore) while a batch was mid-request no longer reports that in-progress batch as a failed save. For saves, the items in it are now shown as not attempted.
+* Deleting the plugin now removes its settings and per-user interface preferences from the database, instead of leaving them behind.
+* Clicking Stop during a save now cancels the in-progress request immediately, instead of only skipping the batches that hadn't started yet. Rows that still finished saving on the server are reconciled afterward, so they no longer linger as unsaved.
+* Pressing Stop during a save no longer hides a real login or permission failure. If your session expired or your permissions changed mid-save, you now get the reload prompt instead of a misleading "save stopped" message, so you know the remaining products weren't saved and why.
+* Save-stopped notifications are now translatable. The messages shown when you stop a save part-way through — including the counts of what was saved, what's still pending, and any per-product errors — now appear in your site's language.
+* When a save (or a Pro Operation History restore) is rejected because you are no longer authenticated and the site replies with an HTTP 401 error (e.g. Application Passwords or an authentication plugin), the session-expired warning now appears — including when Stop was pressed mid-operation — instead of the failure looking like a cancelled run. Rejected save/restore requests also now show the actual server error message instead of the generic "Unknown server error" text, which is now translatable.
+* Turning off "Manage stock" now discards any staged Stock quantity / Backorders edits for that product no matter how the change is made — inline edit, fill handle, bulk edit, or paste — so stale stock values can no longer be saved once stock management is switched off.
+* Fixed an error thrown when clicking "Clear all filters" on the "No products match your filters" screen.
+* Switching to another app or browser tab while editing a cell no longer closes the editor. When you come back, the cell is still in edit mode with the cursor where you left it — you can keep typing, or paste a copied value straight into the cell.
+* Enter-to-edit-the-next-row and the variation Select/Deselect buttons no longer stop working after a load error, an empty filter result, or when auto-loading is disabled.
+* Fixed a Cost of Goods filter issue where a product that had been converted from variable to simple could wrongly appear in the filtered results when a leftover hidden variation matched the filter.
+* Fixed the Menu order filter, SKU search, and Description search wrongly including a product that had been converted from variable to simple when a leftover hidden variation matched the filter.
+* Fixed date picker calendar popups following the operating system's light/dark theme instead of the plugin's selected theme.
+* Fixed toggling "Include Variations" reverting the grid's column layout (hidden columns, widths, pinning) to an older state and incorrectly marking the loaded view as "Modified". Also fixed Settings → "Reset layout" not restoring the default column visibility (previously hidden columns could stay hidden after a reset).
+* Fixed CSV exports failing on large product sets with many columns selected. The file is now built page by page and caches are released as it goes, so the export uses far less server memory. When an export does fail, the error now names the cause and status (for example "Export failed (500): …") instead of a generic "Export failed".
+= 1.0.1 =
+* Added a Bulk Edit shortcut to the WordPress admin bar for quick access to the editor from anywhere in wp-admin. It can be turned off per user from the Settings menu and is on by default.
+* Fixed tall popovers overflowing past the bottom of the screen on short browser windows; they now fit within the visible area and scroll internally.
+* Fixed the bulk edit page not scrolling on short browser windows, which left the toolbar, pagination, and lower admin menu items clipped and unreachable.
+* Fixed form fields rendering with light backgrounds in dark mode inside popover panels (filters, Selection Manager, dropdowns), and dark-mode styling for date and time inputs — native calendar/clock icons and picker popups now follow the dark theme too.
+* Fixed the horizontal scrollbar floating in the middle of the grid instead of staying at the bottom after collapsing or expanding the Filters or Bulk Edit panel.
 = 1.0.0 =
 * Initial release.
 …
 == Upgrade Notice ==
+= 1.2.0 =
+Major feature release: upsells/cross-sells, shipping class, product URL and button text editing, tags and sale-date filters, view import/export, SKU match modes, third-party product types, and many fixes.
 = 1.0.0 =
 Initial release.

wpmelon-advanced-bulk-edit-for-woocommerce/tags/1.2.0/wpmelon-advanced-bulk-edit-for-woocommerce.php

-              r3549389
+              r3663491
  * Plugin URI: https://wpmelon.com/bulk-edit/
  * Description: Excel-like bulk editing interface for WooCommerce products
  * Version: 1.0.0
+ * Version: 1.2.0
  * Author: WPMelon
  * Author URI: https://wpmelon.com/
 …
  * Domain Path: /languages
  * Requires at least: 6.0
  * Tested up to: 7.0
+ * Tested up to: 7.1
  * Requires PHP: 8.0
  * Requires Plugins: woocommerce
  * WC requires at least: 10.0
  * WC tested up to: 10.7
+ * WC tested up to: 11.0.1
  * License: GPLv2 or later
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 define( 'WCABE_G2_LOADED', true );
 define( 'WCABE_G2_VERSION', '1.0.0' );
+define( 'WCABE_G2_VERSION', '1.2.0' );
 define( 'WCABE_G2_PLUGIN_FILE', __FILE__ );
 define( 'WCABE_G2_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/assets/dist/.vite/manifest.json

-              r3549389
+              r3663491
   },
   "assets/src/main.tsx": {
     "file": "assets/main-CPlqEen8.js",
+    "file": "assets/main-V9rY9XMr.js",
     "name": "main",
     "src": "assets/src/main.tsx",
     "isEntry": true,
     "css": [
       "assets/main-DuaYQxSj.css"
+      "assets/main-D5Lgb2qa.css"
     ],
     "assets": [

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Admin.php

-              r3549389
+              r3663491
                         'wcabe-g2',
                         [ $this, 'render_page' ]
+                );
+        }
+        /**
+         * Add a shortcut to the Bulk Edit page in the WordPress admin bar.
+         *
+         * Gated by the per-user `showAdminBarShortcut` setting (default on) and the
+         * `manage_woocommerce` capability. Fires in both admin and front-end contexts
+         * wherever the admin bar renders for a capable user.
+         *
+         * @param \WP_Admin_Bar $admin_bar The admin bar instance.
+         */
+        public function add_admin_bar_link( \WP_Admin_Bar $admin_bar ): void {
+                if ( ! current_user_can( 'manage_woocommerce' ) ) {
+                        return;
+                }
+                $settings = REST\User_Settings_Controller::get_all();
+                if ( empty( $settings['showAdminBarShortcut'] ) ) {
+                        return;
+                }
+                $admin_bar->add_node(
+                        [
+                                'id'    => 'wcabe-g2-shortcut',
+                                'title' => '<span class="ab-icon dashicons dashicons-edit" aria-hidden="true"></span><span class="ab-label">'
+                                        . esc_html__( 'Bulk Edit Products', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        . '</span>',
+                                'href'  => admin_url( 'admin.php?page=wcabe-g2' ),
+                                'meta'  => [
+                                        'title' => __( 'WPMelon Advanced Bulk Edit for WooCommerce', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                ],
+                        ]
                 );
+        }
 …
                         'dimensionUnit'     => get_option( 'woocommerce_dimension_unit', 'cm' ),
                         'isPro'             => defined( 'WCABE_G2_PRO' ) && WCABE_G2_PRO,
+                        'cogsEnabled'       => Helpers\Product_Helper::is_cogs_enabled(),
+                        // URL protocols the server will accept for the Product URL field.
+                        // Localized rather than hardcoded client-side because
+                        // wp_allowed_protocols() is filterable — a site that adds a scheme must
+                        // not have the client reject it before the request reaches the
+                        // authoritative server-side check.
+                        'allowedProtocols'  => array_values( wp_allowed_protocols() ),
                         'operationsLimit'   => REST\Operations_Controller::OPERATIONS_LIMIT,
+                        // Server-authoritative page-size ceiling. The client clamps every page
+                        // size (picker, custom input, view apply, dirty baselines) to this, so a
+                        // site that LOWERS wcabe_g2_max_per_page never shows a size the products
+                        // route would silently reduce.
+                        'maxPageSize'       => Helpers\Page_Size_Helper::get_max(),
+                        // Variable-capable type slugs ('variable' + registered WC_Product_Variable
+                        // subclasses, e.g. 'variable-subscription') so the frontend's expand /
+                        // "Varies" / variation gates match the backend's (#137).
+                        'variableProductTypes' => Services\Product_Service::get_variable_product_types(),
                         'attributesSchema'  => Services\Attribute_Service::get_attribute_schema(),
+                        // Shipping classes as [ slug, name ]. Localized rather than fetched
+                        // because the grid cell editor, the bulk-edit field and the paste
+                        // resolver all need the vocabulary synchronously, before any request
+                        // resolves. The filter panel's copy arrives via GET /filters.
+                        'shippingClasses'   => Helpers\Product_Helper::get_shipping_class_terms(),
                         'pluginSettings'    => REST\Settings_Controller::get_all(),
                         'userSettings'      => REST\User_Settings_Controller::get_all(),
+                        // Sync cursor (transport, not a setting) so the client seeds its _rev counter
+                        // above the last persisted value — see get_stored_rev()/store/ui.ts (review #4).
+                        'userSettingsRev'   => REST\User_Settings_Controller::get_stored_rev(),
                 ];
 …
                         'wcabe-g2-admin',
                         $dist_url . $entry['file'],
                         [ 'wp-element', 'wp-i18n' ],
+                        [ 'wp-element', 'wp-i18n', 'wp-api-fetch' ],
                         WCABE_G2_VERSION,
                         true

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Handlers/Attribute_Handler.php

-              r3549389
+              r3663491
         /**
+         * Ensure term maps are populated. Lazy fallback for contexts
+         * where before_format_products doesn't fire (batch_update, get_variations).
+         * Ensure term maps are populated. Lazy fallback for contexts where
+         * before_format_products doesn't fire (get_variations).
+         *
+         * batch_update() DOES fire it now, from its phase-2 formatting block — do not "clean up"
+         * that do_action on the assumption this fallback covers it.
          */
         private function ensure_term_maps(): void {

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Handlers/Attribute_Save_Handler.php

-              r3549389
+              r3663491
          */
         public function validate_attribute_fields( array $errors, \WC_Product $product, array $changes ): array {
+                // Parent products only. Variation attribute selections are owned by Pro's
+                // variation handler (#131); guard here so this parent handler never processes
+                // a variation even once Pro adds attr_* to the variation allowlist (the
+                // handler builds WC_Product_Attribute objects, which is wrong for variations).
+                if ( $product instanceof \WC_Product_Variation ) {
+                        return $errors;
+                }
                 $lookup = self::get_field_lookup();
 …
          */
         public function save_attribute_fields( \WC_Product $product, array $changes, array $allowed_fields ): void {
+                // Parent products only — see validate_attribute_fields(). Pro's variation
+                // handler persists variation attribute selections (#131).
+                if ( $product instanceof \WC_Product_Variation ) {
+                        return;
+                }
                 $this->new_terms_created = false;
                 $lookup     = self::get_field_lookup();

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Helpers/Product_Helper.php

-              r3549389
+              r3663491
         /**
+         * Request-level cache of the shipping class term list.
+         *
+         * @var array|null
+         */
+        private static $shipping_classes_cache = null;
+        /**
+         * Every shipping class on the site, as [ 'slug' => ..., 'name' => ... ].
+         *
+         * Sorted by name, empty classes included — this is a picker list, not a
+         * report. No 'count': WooCommerce registers product_shipping_class for
+         * variations as well as products, so a term whose only users are variations
+         * carries count > 0 while the (deliberately parent-level) shipping class
+         * filter returns nothing for it. Shipping a number that contradicts the
+         * filter is worse than shipping no number.
+         *
+         * @return array<int, array{slug: string, name: string}>
+         */
+        public static function get_shipping_class_terms(): array {
+                self::register_shipping_class_hooks();
+                if ( null !== self::$shipping_classes_cache ) {
+                        return self::$shipping_classes_cache;
+                }
+                $terms = get_terms( [
+                        'taxonomy'   => 'product_shipping_class',
+                        'hide_empty' => false,
+                        'orderby'    => 'name',
+                ] );
+                if ( is_wp_error( $terms ) || empty( $terms ) ) {
+                        self::$shipping_classes_cache = [];
+                        return [];
+                }
+                $result = [];
+                foreach ( $terms as $term ) {
+                        $result[] = [
+                                'slug' => $term->slug,
+                                'name' => wp_specialchars_decode( $term->name ),
+                        ];
+                }
+                self::$shipping_classes_cache = $result;
+                return $result;
+        }
+        /**
+         * A product's OWN shipping class slug, or '' when it has none.
+         *
+         * 'edit' context is load-bearing, and get_shipping_class() must never be
+         * substituted here. That getter resolves through get_shipping_class_id() in
+         * default (view) context, and WC_Product_Variation::get_shipping_class_id()
+         * falls back to the PARENT's class in view context. A variation that
+         * inherits would then display the parent's class as though it were its own,
+         * the user would "change" a value that was never set, and the diff engine
+         * would compare against a value the variation does not store. '' here means
+         * exactly "this row stores no class of its own" — rendered as "Same as
+         * parent" on variations and "No shipping class" on parents.
+         *
+         * @param \WC_Product $product
+         * @return string Term slug, or '' when unset (or the term has been deleted).
+         */
+        public static function get_shipping_class_slug( \WC_Product $product ): string {
+                $term_id = (int) $product->get_shipping_class_id( 'edit' );
+                if ( $term_id <= 0 ) {
+                        return '';
+                }
+                $term = get_term( $term_id, 'product_shipping_class' );
+                if ( ! $term || is_wp_error( $term ) ) {
+                        return '';
+                }
+                return (string) $term->slug;
+        }
+        /**
+         * Clear the request-level shipping class cache.
+         *
+         * Also the callback registered on the term CRUD hooks below, so the cache
+         * self-invalidates whenever a shipping class is created, renamed, or
+         * deleted — a request that lists classes, creates one, then lists again
+         * (or a test suite that creates a term as a fixture) sees it immediately,
+         * with no manual clear to remember. Still exposed publicly for tests that
+         * insert terms directly via wp_insert_term() outside any of those hooks'
+         * normal request lifecycle (e.g. across PHPUnit test classes sharing one
+         * process, where fixtures roll back but this static would otherwise not).
+         */
+        public static function clear_shipping_class_cache(): void {
+                self::$shipping_classes_cache = null;
+        }
+        /**
+         * Wire up cache invalidation on shipping-class term CRUD.
+         *
+         * Called unconditionally on every get_shipping_class_terms() rather than
+         * behind an "already registered" flag: WP_UnitTestCase snapshots $wp_filter
+         * before the first test and restores that snapshot after EVERY test's
+         * tearDown, silently stripping any add_action() call made mid-test. A
+         * once-only static flag would go stale the moment that happens — it would
+         * report "registered" while the underlying hook was actually gone. Calling
+         * add_action() every time is cheap and safe: WP_Hook computes the same
+         * identity string for this array callback on every call, so re-adding it
+         * overwrites the same slot rather than creating a duplicate.
+         */
+        private static function register_shipping_class_hooks(): void {
+                add_action( 'create_product_shipping_class', [ self::class, 'clear_shipping_class_cache' ] );
+                add_action( 'edited_product_shipping_class', [ self::class, 'clear_shipping_class_cache' ] );
+                add_action( 'delete_product_shipping_class', [ self::class, 'clear_shipping_class_cache' ] );
+        }
+        /**
+         * Whether WooCommerce's Cost of Goods Sold feature is enabled.
+         *
+         * Intentionally NOT memoized: the underlying option already lives in WP's
+         * alloptions cache, so repeated calls are cheap, and a static cache would
+         * go stale when the option is toggled within a single request (e.g. tests).
+         * Callers must gate WC's get_cogs_value()/set_cogs_value() on this — those
+         * methods emit wc_doing_it_wrong() when the feature is disabled.
+         *
+         * @return bool
+         */
+        public static function is_cogs_enabled(): bool {
+                return class_exists( '\Automattic\WooCommerce\Utilities\FeaturesUtil' )
+                        && \Automattic\WooCommerce\Utilities\FeaturesUtil::feature_is_enabled( 'cost_of_goods_sold' );
+        }
+        /**
+         * Upload date of an image attachment, or '' when there is no usable image.
+         *
+         * The single source of truth for the "Image uploaded" value: the grid/CSV
+         * cell, the per-variation filter predicate, and the SQL filter must all agree
+         * on which _thumbnail_id values count. A stale ID (deleted attachment) or one
+         * pointing at a non-attachment post yields '' here, mirroring the query's
+         * post_type = 'attachment' join gate.
+         *
+         * @param int $image_id Attachment ID from _thumbnail_id.
+         * @return string 'Y-m-d H:i:s' in site time, or '' when unusable.
+         */
+        public static function get_image_upload_date( int $image_id ): string {
+                if ( $image_id <= 0 || 'attachment' !== get_post_type( $image_id ) ) {
+                        return '';
+                }
+                // 'raw' context — the SQL filter compares the raw post_date column, and
+                // display context would run the post_date filter, breaking that parity.
+                return (string) get_post_field( 'post_date', $image_id, 'raw' );
+        }
+        /**
          * Format a WC_Product into a flat array for the grid.
+         *
          * @param \WC_Product $product
+         * @param array|null  $ref_map Pre-resolved upsell/cross-sell descriptors from
+         *                             build_product_ref_map(). Every multi-item caller MUST
+         *                             pass one — omitting it resolves this product's refs on
+         *                             its own, which inside a loop is an N+1. Null is for the
+         *                             genuine singleton (Operations_Service::create_product).
          * @return array
          */
         public static function format_product( \WC_Product $product ): array {
+        public static function format_product( \WC_Product $product, ?array $ref_map = null ): array {
                 $image_id = $product->get_image_id();
                 $thumbnail_url = $image_id
 …
                         : '';
+                // instanceof, not is_type('variable'): third-party variable subclasses
+                // (variable-subscription, …) carry countable variations too (#137). The
+                // count doubles as the frontend's expand/interleave signal.
                 $variation_count = 0;
                 if ( $product->is_type( 'variable' ) ) {
+                if ( $product instanceof \WC_Product_Variable ) {
                         $variation_count = count( $product->get_children() );
+                }
 …
                 $tags = self::resolve_term_names( $product->get_tag_ids(), 'product_tag' );
                 // Sale dates — not on variable parents.
+                // Sale dates — not on variable parents (incl. variable subclasses).
                 $date_on_sale_from = '';
                 $date_on_sale_to   = '';
                 if ( ! $product->is_type( 'variable' ) ) {
+                if ( ! $product instanceof \WC_Product_Variable ) {
                         $from = $product->get_date_on_sale_from();
                         $to   = $product->get_date_on_sale_to();
 …
                         $date_on_sale_to   = $to ? $to->date( 'Y-m-d' ) : '';
+                }
+                // Publish date (post_date) and last-modified (post_modified). Present on
+                // every product post regardless of type. Full date-time (Y-m-d H:i:s) in
+                // site timezone, matching WooCommerce's native date_created/date_modified
+                // (a WC_DateTime backed by the post_date DATETIME column).
+                $created  = $product->get_date_created();
+                $modified = $product->get_date_modified();
                 $gallery_ids  = $product->get_gallery_image_ids();
 …
                                 $gallery_urls[] = $url ?: '';
+                        }
+                }
+                // Linked products. 'edit' context — the view getters run through
+                // woocommerce_product_get_upsell_ids, and the grid writes this value straight
+                // back, so a third-party projection would overwrite the stored list.
+                $upsell_ids     = array_map( 'intval', $product->get_upsell_ids( 'edit' ) );
+                $cross_sell_ids = array_map( 'intval', $product->get_cross_sell_ids( 'edit' ) );
+                if ( null === $ref_map ) {
+                        $ref_map = self::resolve_product_ref_ids( array_merge( $upsell_ids, $cross_sell_ids ) );
+                }
 …
                         'categories'             => $categories,
                         'tags'                   => $tags,
+                        // Linked products (WooCommerce upsells / cross-sells). Ordered — WC renders
+                        // them in stored order — so never rebuild these from a set. Parent-only:
+                        // deliberately omitted from format_variation().
+                        'upsell_ids'             => self::project_product_refs( $upsell_ids, $ref_map ),
+                        'cross_sell_ids'         => self::project_product_refs( $cross_sell_ids, $ref_map ),
                         'description'            => $product->get_description(),
                         'short_description'      => $product->get_short_description(),
 …
                         'downloadable'           => $product->get_downloadable(),
                         'backorders'             => $product->get_backorders(),
+                        // Cost of Goods (WooCommerce native COGS). Getter only when the
+                        // feature is on — it emits wc_doing_it_wrong() otherwise. Key is
+                        // always present (null when off) so the TS type stays non-optional.
+                        'cogs_value'             => self::is_cogs_enabled() ? $product->get_cogs_value() : null,
+                        // Publish date (post_date) and last-modified (post_modified), full date-time
+                        // (Y-m-d H:i:s, site timezone). Editable "Published on" + read-only
+                        // "Modified on". Parent products only — deliberately omitted from
+                        // format_variation() (blank on variation rows).
+                        'date_created'           => $created ? $created->date( 'Y-m-d H:i:s' ) : '',
+                        'date_modified'          => $modified ? $modified->date( 'Y-m-d H:i:s' ) : '',
+                        // Featured image upload date (the attachment's post_date). Read-only
+                        // display + export + the "Image uploaded" filter. '' when the product
+                        // has no image, or _thumbnail_id is stale / not an attachment.
+                        // 'edit' context deliberately, unlike $image_id above: the SQL filter
+                        // reads raw _thumbnail_id, so a plugin hooking
+                        // woocommerce_product_get_image_id (placeholder images, multilingual
+                        // media mapping) must not make this date diverge from what the filter
+                        // matches. thumbnail_url stays view-context — it renders whatever WC
+                        // would display.
+                        'image_date'             => self::get_image_upload_date( (int) $product->get_image_id( 'edit' ) ),
+                        // Menu order (native wp_posts.menu_order). Signed integer, default 0.
+                        'menu_order'             => (int) $product->get_menu_order(),
+                        // Button text (External/Affiliate products' add-to-cart button label).
+                        // The getter only exists on WC_Product_External; every other type
+                        // emits '' so the key is always present (VariesRenderer shows a dash).
+                        'button_text'            => $product instanceof \WC_Product_External ? $product->get_button_text() : '',
+                        // Product URL (External/Affiliate products' destination link). Like
+                        // button_text, the getter only exists on WC_Product_External; every
+                        // other type emits '' so the key is always present.
+                        // 'edit' context deliberately: view context runs third-party
+                        // woocommerce_product_get_product_url filters, and the SQL filter
+                        // matches the raw stored _product_url meta — a filtered display value
+                        // would make the editable grid value diverge from what the filter
+                        // finds. (WC's getter wraps esc_url_raw() in both contexts.)
+                        'product_url'            => $product instanceof \WC_Product_External ? $product->get_product_url( 'edit' ) : '',
+                        // Shipping class slug ('' = none). Slug rather than term ID because
+                        // WooCommerce's own shipping_class query var matches on slug, so the
+                        // grid, the filter, the save payload and the CSV all speak one format.
+                        'shipping_class'         => self::get_shipping_class_slug( $product ),
                 ];
 …
         /**
          * Resolve term IDs to [ id, name ] arrays via a single get_terms query.
+         *
+         * Public so Pro's history reader can reuse the same resolution (including
+         * the empty-include and hide_empty=false guards) for its term-name display
+         * metadata.
+         *
          * @param int[]  $term_ids
 …
          * @return array Array of [ 'id' => int, 'name' => string ].
          */
         private static function resolve_term_names( array $term_ids, string $taxonomy ): array {
+        public static function resolve_term_names( array $term_ids, string $taxonomy ): array {
                 if ( empty( $term_ids ) ) {
                         return [];
 …
         /**
+         * Human-readable display name for a variation ("Parent – Blue, Large").
+         *
+         * WC stores just the parent title in post_title for variations, so we append
+         * attribute values ourselves. If a custom title has been set on the variation
+         * that differs from the parent, respect it.
+         *
+         * Deliberately NOT WC's get_formatted_name(): that returns HTML (it embeds a
+         * "#<id>" and a <span class="description"> block), which must never reach a
+         * JSON response. Shared by format_variation() and resolve_product_ref_ids()
+         * so a variation reads the same everywhere it is named.
+         *
+         * @param \WC_Product_Variation $variation
+         * @return string Plain text, not HTML. Not yet specialchars-decoded.
+         */
+        public static function variation_display_name( \WC_Product_Variation $variation ): string {
+                $parent_title    = get_the_title( $variation->get_parent_id() );
+                $variation_title = $variation->get_title();
+                if ( '' !== $variation_title && $variation_title !== $parent_title ) {
+                        return $variation_title;
+                }
+                $attrs = $variation->get_attributes();
+                ksort( $attrs );
+                $term_names = [];
+                foreach ( $attrs as $taxonomy => $slug ) {
+                        if ( '' === $slug ) {
+                                continue; // Skip "Any" attributes.
+                        }
+                        $term = get_term_by( 'slug', $slug, $taxonomy );
+                        if ( $term && ! is_wp_error( $term ) ) {
+                                $term_names[] = $term->name;
+                        } else {
+                                $term_names[] = $slug;
+                        }
+                }
+                $name = $parent_title;
+                if ( ! empty( $term_names ) ) {
+                        $name .= ' – ' . implode( ', ', $term_names );
+                }
+                return $name;
+        }
+        /**
+         * Normalise a list of product/variation IDs: positive ints only, deduped
+         * (FIRST occurrence wins), caller order preserved, optionally clamped.
+         *
+         * intval + "> 0", NOT absint: absint( -7 ) is 7, which would silently read the
+         * wrong product. The REST layer sanitises through this for the same reason.
+         *
+         * $limit clamps AFTER normalisation, deliberately. Clamping the raw input first
+         * would let duplicates or junk in the leading entries eat the budget —
+         * [5,5,5,7,9] with a limit of 3 must yield [5,7,9], not [5].
+         *
+         * @param int[]    $ids
+         * @param int|null $limit Optional cap, applied to the normalised list.
+         * @return int[]
+         */
+        public static function normalize_product_ids( array $ids, ?int $limit = null ): array {
+                $ids = array_values( array_unique( array_filter( array_map( 'intval', $ids ), static fn( $id ) => $id > 0 ) ) );
+                if ( null !== $limit ) {
+                        $ids = array_slice( $ids, 0, max( 0, $limit ) );
+                }
+                return $ids;
+        }
+        /**
+         * Drop WordPress's in-process object cache, if the active backend supports it.
+         *
+         * Long export loops prime post/meta/term caches on every page and nothing ever
+         * evicts them, so the runtime cache becomes the dominant memory consumer once
+         * row accumulation is gone. Each page re-primes what it needs, so dropping the
+         * in-process layer between chunks is safe — it costs a few re-priming queries
+         * per chunk and bounds memory in exchange.
+         *
+         * Three-tier guard. wp_cache_flush_runtime() exists as a compat shim from WP 6.0,
+         * but it emits _doing_it_wrong() and returns false when the active object-cache
+         * drop-in doesn't support it — and wp_cache_supports() itself only exists from
+         * WP 6.1. So: ask wp_cache_supports() when it is available; on 6.0 call the
+         * function only for the core default cache, which does support it; otherwise
+         * skip. This is an optimisation, never worth a _doing_it_wrong() notice.
+         */
+        public static function flush_runtime_cache(): void {
+                if ( function_exists( 'wp_cache_supports' ) ) {
+                        if ( wp_cache_supports( 'flush_runtime' ) ) {
+                                wp_cache_flush_runtime();
+                        }
+                        return;
+                }
+                if ( function_exists( 'wp_cache_flush_runtime' ) && ! wp_using_ext_object_cache() ) {
+                        wp_cache_flush_runtime();
+                }
+        }
+        /**
+         * Normalise a list of product/variation IDs and prime every cache a read of them needs.
+         *
+         * Two primes, not one. The first covers the ids themselves (posts + meta for _sku + terms
+         * for product_type). The second covers the PARENTS of any variation in the list: a
+         * variation is named from its parent's title, so without this each variation's
+         * get_the_title( parent ) is an individual query.
+         *
+         * Normalisation (positive-int filter, dedupe, clamp-after-dedupe) is delegated to
+         * normalize_product_ids() — see that method for why absint is wrong here and why
+         * $limit is applied last.
+         *
+         * @param int[]    $ids
+         * @param int|null $limit Optional cap, applied to the normalised list.
+         * @return int[] The normalised, deduped, positive ids, in first-occurrence order.
+         */
+        public static function prime_product_caches( array $ids, ?int $limit = null ): array {
+                $ids = self::normalize_product_ids( $ids, $limit );
+                if ( empty( $ids ) ) {
+                        return [];
+                }
+                _prime_post_caches( $ids, true, true );
+                $parent_ids = [];
+                foreach ( $ids as $id ) {
+                        $post = get_post( $id );
+                        if ( $post && 'product_variation' === $post->post_type && $post->post_parent ) {
+                                $parent_ids[] = (int) $post->post_parent;
+                        }
+                }
+                $parent_ids = array_values( array_diff( array_unique( $parent_ids ), $ids ) );
+                if ( ! empty( $parent_ids ) ) {
+                        _prime_post_caches( $parent_ids, true, true );
+                }
+                return $ids;
+        }
+        /**
+         * Resolve a flat list of product IDs into upsell/cross-sell ref descriptors.
+         *
+         * Deliberately does NOT construct a WC_Product per ID. wc_get_product() runs the
+         * full data-store read — and for variable parents that means get_children(), a DB
+         * query each. Measured on a 100-row page: wc_get_product()-per-ref costs ~227
+         * queries; reading the primed post cache instead costs 0 for product refs. Only
+         * variation refs fall back to wc_get_product(), because naming them needs their
+         * attribute terms; that cost saturates (WP's term cache amortizes a store's small
+         * attribute vocabulary), so it is bounded by vocabulary, not by ref count.
+         *
+         * post_type is checked explicitly: the write path stores any positive ID without an
+         * existence check (dead refs are preserved by design — see Product_Service::
+         * normalize_product_refs), so a list can legitimately hold a page or post ID from a
+         * bad import or a paste. Without this gate get_post() would return a valid WP_Post
+         * and we would render that page as a simple product.
+         *
+         * @param int[] $ids
+         * @return array<int, array> Map of id => [ id, name, sku, type, status, missing ].
+         */
+        public static function resolve_product_ref_ids( array $ids ): array {
+                $ids = self::prime_product_caches( $ids );
+                if ( empty( $ids ) ) {
+                        return [];
+                }
+                $map = [];
+                foreach ( $ids as $id ) {
+                        $post = get_post( $id );
+                        if ( ! $post || ! in_array( $post->post_type, [ 'product', 'product_variation' ], true ) ) {
+                                $map[ $id ] = self::missing_product_ref( $id );
+                                continue;
+                        }
+                        if ( 'product_variation' === $post->post_type ) {
+                                $variation = wc_get_product( $id );
+                                if ( ! $variation instanceof \WC_Product_Variation ) {
+                                        $map[ $id ] = self::missing_product_ref( $id );
+                                        continue;
+                                }
+                                $map[ $id ] = [
+                                        'id'      => $id,
+                                        'name'    => wp_specialchars_decode( self::variation_display_name( $variation ) ),
+                                        // 'edit' context: a SKU-less variation must resolve to its OWN (empty) SKU,
+                                        // never the parent's. WC_Product_Variation::get_sku() inherits the parent SKU
+                                        // in view context, so the default read would export the parent's SKU for the
+                                        // variation — and WC import maps that SKU back to the PARENT, silently
+                                        // retargeting the link from variation to parent. The inherited SKU also feeds
+                                        // the picker chips, so a chip search for the shown SKU would find the parent.
+                                        // Matches the plain-product arm below, which reads raw _sku meta for the same
+                                        // persistence-safety.
+                                        'sku'     => (string) $variation->get_sku( 'edit' ),
+                                        'type'    => 'variation',
+                                        'status'  => $post->post_status,
+                                        'missing' => false,
+                                ];
+                                continue;
+                        }
+                        // Plain product — read straight off the primed caches. No WC_Product.
+                        $terms = get_the_terms( $id, 'product_type' );
+                        $type  = ( $terms && ! is_wp_error( $terms ) ) ? $terms[0]->slug : 'simple';
+                        $map[ $id ] = [
+                                'id'      => $id,
+                                'name'    => wp_specialchars_decode( $post->post_title ),
+                                'sku'     => (string) get_post_meta( $id, '_sku', true ),
+                                'type'    => $type,
+                                'status'  => $post->post_status,
+                                'missing' => false,
+                        ];
+                }
+                return $map;
+        }
+        /**
+         * Gather the distinct upsell/cross-sell union OWNED BY these products, and resolve it.
+         *
+         * Note the direction: this takes OWNERS and returns descriptors for the products they
+         * point AT. Do not use it to resolve an arbitrary list of IDs (e.g. search results) —
+         * that is resolve_product_ref_ids(), and passing search hits here would hand back each
+         * hit's upsells instead of the hit itself.
+         *
+         * Reads 'edit' context: the default view getters run through
+         * woocommerce_product_get_upsell_ids, which third-party code can filter. The grid
+         * round-trips this value straight back into a write (open picker → add one → Apply),
+         * so a filtered projection would silently overwrite the stored list.
+         *
+         * @param \WC_Product[] $owners
+         * @return array<int, array> Map of id => ref descriptor.
+         */
+        public static function build_product_ref_map( array $owners ): array {
+                $ref_ids = [];
+                foreach ( $owners as $owner ) {
+                        if ( ! $owner instanceof \WC_Product || $owner->is_type( 'variation' ) ) {
+                                continue; // Variations do not own these fields.
+                        }
+                        foreach ( $owner->get_upsell_ids( 'edit' ) as $ref_id ) {
+                                $ref_ids[] = (int) $ref_id;
+                        }
+                        foreach ( $owner->get_cross_sell_ids( 'edit' ) as $ref_id ) {
+                                $ref_ids[] = (int) $ref_id;
+                        }
+                }
+                if ( empty( $ref_ids ) ) {
+                        return []; // Stores that don't use these fields pay nothing.
+                }
+                return self::resolve_product_ref_ids( $ref_ids );
+        }
+        /**
+         * Descriptor for a ref whose target no longer exists (or was never a product).
+         *
+         * @param int $id
+         * @return array
+         */
+        private static function missing_product_ref( int $id ): array {
+                return [
+                        'id'      => $id,
+                        'name'    => null,
+                        'sku'     => null,
+                        'type'    => null,
+                        'status'  => null,
+                        'missing' => true,
+                ];
+        }
+        /**
+         * Project an ordered ID list onto a ref map, preserving order.
+         *
+         * @param int[] $ids
+         * @param array $ref_map
+         * @return array[]
+         */
+        private static function project_product_refs( array $ids, array $ref_map ): array {
+                return array_values( array_map(
+                        static fn( int $id ) => $ref_map[ $id ] ?? self::missing_product_ref( $id ),
+                        $ids
+                ) );
+        }
+        /**
          * Format a WC_Product_Variation into a flat array for the grid.
+         *
 …
                 $to   = $variation->get_date_on_sale_to();
+                // Build variation display name.
+                // WC stores just the parent title in post_title for variations, so we
+                // append attribute values ourselves. If a custom title has been set on
+                // the variation that differs from the parent, respect it.
+                $parent_title    = get_the_title( $variation->get_parent_id() );
+                $variation_title = $variation->get_title();
+                if ( '' !== $variation_title && $variation_title !== $parent_title ) {
+                        $name = $variation_title;
+                } else {
+                        $attrs = $variation->get_attributes();
+                        ksort( $attrs );
+                        $term_names = [];
+                        foreach ( $attrs as $taxonomy => $slug ) {
+                                if ( '' === $slug ) {
+                                        continue; // Skip "Any" attributes.
+                                }
+                                $term = get_term_by( 'slug', $slug, $taxonomy );
+                                if ( $term && ! is_wp_error( $term ) ) {
+                                        $term_names[] = $term->name;
+                                } else {
+                                        $term_names[] = $slug;
+                                }
+                        }
+                        $name = $parent_title;
+                        if ( ! empty( $term_names ) ) {
+                                $name .= ' – ' . implode( ', ', $term_names );
+                        }
+                }
+                $name = self::variation_display_name( $variation );
                 $data = [
 …
                         'downloadable'           => $variation->get_downloadable(),
                         'backorders'             => $variation->get_backorders(),
+                        // Cost of Goods — variation's own defined value (null = inherit
+                        // parent). Getter only when the feature is on (see format_product).
+                        'cogs_value'             => self::is_cogs_enabled() ? $variation->get_cogs_value() : null,
+                        // Menu order (native wp_posts.menu_order) — the variation's sort
+                        // position within its parent. Signed integer, default 0.
+                        'menu_order'             => (int) $variation->get_menu_order(),
+                        // Featured image upload date. DELIBERATELY present on variations,
+                        // unlike date_created/date_modified which are parent-only: a variation
+                        // owns its own _thumbnail_id, and the "Image uploaded" filter narrows
+                        // variation rows by it. Do not "align" this with the other date fields.
+                        'image_date'             => self::get_image_upload_date( (int) $image_id ),
+                        // Shipping class — the variation's OWN class. '' means "Same as
+                        // parent", which is why get_shipping_class_slug() reads edit context:
+                        // WC's view-context getter would inherit the parent's class here and
+                        // make every inheriting variation look like it stores an override.
+                        'shipping_class'         => self::get_shipping_class_slug( $variation ),
                 ];

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Main.php

-              r3549389
+              r3663491
                 $admin = new Admin();
                 add_action( 'admin_menu', [ $admin, 'register_menu' ] );
+                add_action( 'admin_bar_menu', [ $admin, 'add_admin_bar_link' ], 99 );
                 add_action( 'rest_api_init', [ $this, 'register_rest_routes' ] );
 …
                 // Debug tracing — appends server metrics to REST responses when enabled.
                 new Handlers\Debug_Trace_Handler();
+                // WordPress save-hook compatibility — Free feature, controlled by plugin setting.
+                new Handlers\WP_Save_Hooks_Handler();
+        }

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/REST/Export_Controller.php

-              r3549389
+              r3663491
 use WCABE_G2\Helpers\Product_Helper;
 use WCABE_G2\Services\Export_Service;
+use WCABE_G2\Services\Filter_Service;
 use WCABE_G2\Services\Product_Service;
+use WCABE_G2\Services\View_Service;
 defined( 'ABSPATH' ) || exit;
 …
                                                 'default'           => [],
                                                 'items'             => [ 'type' => 'integer' ],
+                                                // NOT absint: absint( -7 ) is 7, which would export an unrelated
+                                                // product. Normalising here keeps the route consistent with the
+                                                // service contract (positive ints, deduped, first occurrence wins).
                                                 'sanitize_callback' => function ( $value ) {
                                                         if ( ! is_array( $value ) ) {
                                                                 return [];
+                                                        }
                                                         return array_filter( array_map( 'absint', $value ) );
+                                                        return Product_Helper::normalize_product_ids( $value );
                                                 },
                                         ],
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'search_name_mode'   => [
+                                                'description'       => __( 'Title match mode: all (every word, default), any (any word), or phrase (exact phrase).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'default'           => 'all',
+                                                'enum'              => Product_Service::TITLE_SEARCH_MODES,
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                         'search_sku'         => [
+                                                'description'       => __( 'Search by SKU. Comma-separated for exact match.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                /* translators: %d: maximum number of comma-separated SKU values. */
+                                                'description'       => sprintf( __( 'Search by SKU. Comma-separate multiple values to match any of them under the selected mode (capped at %d values).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ), Product_Service::SKU_SEARCH_MAX_TOKENS ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'search_sku_mode'    => [
+                                                'description'       => __( 'SKU match mode: contains, is_exactly, not_contains, starts_with, or ends_with. Comma-separated values match any of them (none of them for not_contains). Omit or send an empty string for the legacy behaviour: comma-separated = exact, single value = partial.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'default'           => '',
+                                                'enum'              => array_merge( [ '' ], Product_Service::SKU_SEARCH_MODES ),
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'product_url_operator' => [
+                                                'description'       => __( 'Product URL filter operator.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'default'           => 'contains',
+                                                'enum'              => Product_Service::PRODUCT_URL_OPERATORS,
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'product_url_value'  => [
+                                                'description'       => __( 'Product URL filter value (substring).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                // NOT sanitize_text_field: it strips percent-encoded octets.
+                                                'sanitize_callback' => [ View_Service::class, 'sanitize_url_filter_value' ],
                                         ],
                                         'category'           => [
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'tag'                => [
+                                                'description'       => __( 'Comma-separated tag term IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                         'type'               => [
                                                 'description'       => __( 'Comma-separated product types.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'shipping_class'     => [
+                                                // No sanitize_callback: sanitize_text_field() strips percent-encoded
+                                                // octets, which is exactly how WP stores non-ASCII term slugs
+                                                // (sanitize_title() -> utf8_uri_encode()). That would silently
+                                                // reduce e.g. a Cyrillic class's slug to '', match-noning every
+                                                // export for it. Filter_Service::apply_shipping_class_param() is
+                                                // the real sanitizer — sanitize_title() per comma-separated token.
+                                                'description' => __( 'Comma-separated shipping class slugs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'        => 'string',
+                                        ],
                                         'price_min'          => [
                                                 'description'       => __( 'Minimum price.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                                 'sanitize_callback' => 'sanitize_text_field',
                                         ],
+                                        'menu_order_min'     => [
+                                                'description'       => __( 'Minimum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => function ( $value ) {
+                                                        if ( '' === $value ) {
+                                                                return true;
+                                                        }
+                                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                                'rest_invalid_param',
+                                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                                        );
+                                                },
+                                        ],
+                                        'menu_order_max'     => [
+                                                'description'       => __( 'Maximum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => function ( $value ) {
+                                                        if ( '' === $value ) {
+                                                                return true;
+                                                        }
+                                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                                'rest_invalid_param',
+                                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                                        );
+                                                },
+                                        ],
+                                        'cogs_min'           => [
+                                                'description'       => __( 'Minimum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
+                                        'cogs_max'           => [
+                                                'description'       => __( 'Maximum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                         'manage_stock'       => [
                                                 'description'       => __( 'Comma-separated manage stock values (yes, no).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                         'date_modified_before' => [
                                                 'description'       => __( 'Filter products modified on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_start_after' => [
+                                                'description'       => __( 'Filter products whose sale starts on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_start_before' => [
+                                                'description'       => __( 'Filter products whose sale starts on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_end_after' => [
+                                                'description'       => __( 'Filter products whose sale ends on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'sale_end_before' => [
+                                                'description'       => __( 'Filter products whose sale ends on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'image_date_after' => [
+                                                'description'       => __( 'Filter products whose featured image was uploaded on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'string',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => [ $this, 'validate_date_param' ],
+                                        ],
+                                        'image_date_before' => [
+                                                'description'       => __( 'Filter products whose featured image was uploaded on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                                 'type'              => 'string',
                                                 'sanitize_callback' => 'sanitize_text_field',
 …
          * Export products as CSV.
+         *
+         * On success: outputs CSV directly via echo and terminates with wp_die().
+         * On success: streams the CSV and terminates with exit() — NOT wp_die(). That is why
+         * this method itself has no test coverage: rest_do_request() from PHPUnit would kill
+         * the process. Everything except the header/stream/exit tail lives in
+         * build_csv_stream(), which IS testable; keep new logic there (or in the service)
+         * rather than here.
          * On error: returns WP_REST_Response with JSON error body.
+         *
+         * Note the one thing this method cannot guarantee: once fpassthru() has started,
+         * a failure mid-transfer can no longer be converted into a JSON error. The
+         * fail-loud writes in Export_Service ensure the buffer is COMPLETE before any
+         * header is sent, which is the strongest guarantee available short of buffering
+         * to a real temp file and sending Content-Length.
+         *
+         * Catches \Throwable, not just \RuntimeException: build_csv_stream() also runs
+         * third-party format filters (Pro's ACF reads, for one), and a bug there must
+         * still surface as a JSON error the frontend can render — not an uncaught fatal
+         * that WP's REST fatal handler turns into a bodyless/HTML 500 with no message,
+         * which is the exact failure mode #177 is about. The original error is logged
+         * so the underlying bug stays visible to whoever reads the PHP error log.
+         *
          * @param \WP_REST_Request $request
 …
          */
         public function export( \WP_REST_Request $request ) {
+                $columns            = $request->get_param( 'columns' );
+                $product_ids        = $request->get_param( 'product_ids' );
+                $include_variations = (bool) $request->get_param( 'include_variations' );
+                $products = [];
+                if ( ! empty( $product_ids ) ) {
+                        // Export specific products by ID.
+                        foreach ( $product_ids as $id ) {
+                                $wc_product = wc_get_product( $id );
+                                if ( ! $wc_product ) {
+                                        continue;
+                                }
+                                if ( $wc_product->is_type( 'variation' ) ) {
+                                        $products[] = Product_Helper::format_variation( $wc_product );
+                                } else {
+                                        $products[] = Product_Helper::format_product( $wc_product );
+                                }
+                                if ( count( $products ) >= self::MAX_EXPORT_ROWS ) {
+                                        break;
+                                }
+                        }
+                } else {
+                        // Export all filtered products, paginating through.
+                        $filters = $this->extract_filters( $request );
+                        $service = new Product_Service();
+                        $page    = 1;
+                        do {
+                                $result     = $service->get_products( $page, 100, $include_variations, $filters );
+                                $products   = array_merge( $products, $result['products'] );
+                                $has_more   = $page < $result['total_pages'];
+                                $page++;
+                                if ( count( $products ) >= self::MAX_EXPORT_ROWS ) {
+                                        $products = array_slice( $products, 0, self::MAX_EXPORT_ROWS );
+                                        break;
+                                }
+                        } while ( $has_more );
+                }
+                if ( empty( $products ) ) {
+                $this->raise_resource_limits();
+                try {
+                        $stream = $this->build_csv_stream( $request );
+                } catch ( \Throwable $e ) {
+                        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- no logging abstraction exists in this codebase (grepped); this is the standard PHP fallback so the underlying cause isn't lost once it's converted to a generic JSON message below.
+                        error_log( sprintf( 'WCABE G2 export failed: %s', $e->getMessage() ) );
+                        return new \WP_REST_Response(
+                                [
+                                        'code'    => 'export_failed',
+                                        'message' => __( 'Export failed while generating the CSV file.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                ],
+                        );
+                }
+                $handle = $stream['handle'];
+                $count  = $stream['count'];
+                if ( 0 === $count ) {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream from build_csv_stream().
+                        fclose( $handle );
                         return new \WP_REST_Response(
+                                [
 …
+                }
+                $units = [
+                        'weight_unit'    => $request->get_param( 'weight_unit' ),
+                        'dimension_unit' => $request->get_param( 'dimension_unit' ),
+                ];
+                $export_service = new Export_Service();
+                $csv            = $export_service->generate_csv( $products, $columns, true, $units );
+                $count          = count( $products );
+                // Checked BEFORE any header is sent — this is the last point at which a
+                // failure can still become a JSON error rather than a truncated 200.
+                if ( ! rewind( $handle ) ) {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream from build_csv_stream().
+                        fclose( $handle );
+                        return new \WP_REST_Response(
+                                [
+                                        'code'    => 'export_failed',
+                                        'message' => __( 'Export failed while generating the CSV file.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                ],
+                        );
+                }
                 header( 'Content-Type: text/csv; charset=UTF-8' );
 …
                 header( 'Cache-Control: no-cache, no-store, must-revalidate' );
+                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $csv is a CSV-format response body produced by fputcsv() with proper RFC 4180 quoting; Content-Type is text/csv (set above), so HTML escaping is incorrect and would corrupt the output.
+                echo $csv;
+                // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- streams a CSV-format response body produced by fputcsv() with proper RFC 4180 quoting; Content-Type is text/csv (set above), so HTML escaping is incorrect and would corrupt the output.
+                fpassthru( $handle );
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream from build_csv_stream().
+                fclose( $handle );
                 exit;
+        }
         /**
+         * Raise the request's memory and time limits before building the CSV.
+         *
+         * Belt and braces. Note wp_raise_memory_limit() only raises as far as
+         * WP_MAX_MEMORY_LIMIT (256M by default), so on a host already at 256M it is a
+         * no-op — the memory fix that actually matters is the streaming collection in
+         * Product_Service, not this call. wc_set_time_limit(300) — not 0 — because this
+         * is a synchronous web request and should not run unbounded.
+         *
+         * TEST SEAM: a fatal-failure test proxy overrides this to a no-op, so exercising
+         * the failure path doesn't call set_time_limit()/ini_set() on the shared
+         * PHPUnit process for every run.
+         */
+        protected function raise_resource_limits(): void {
+                wp_raise_memory_limit( 'admin' );
+                wc_set_time_limit( 300 );
+        }
+        /**
+         * Build the CSV into a temporary stream.
+         *
+         * TEST SEAM: this is export() minus the headers/stream/exit tail, so PHPUnit can
+         * drive the whole collection → CSV bridge through a proxy subclass.
+         *
+         * The stream is php://temp (spills to disk past 2MB) rather than php://output:
+         * an error must still be able to return JSON, and a mid-loop failure must never
+         * emit a truncated 200 CSV.
+         *
+         * @param \WP_REST_Request $request
+         * @return array{handle: resource, count: int} Caller owns the handle and must fclose() it.
+         * @throws \RuntimeException When the stream cannot be opened or written.
+         */
+        protected function build_csv_stream( \WP_REST_Request $request ): array {
+                $columns            = $request->get_param( 'columns' );
+                $product_ids        = $request->get_param( 'product_ids' );
+                $include_variations = (bool) $request->get_param( 'include_variations' );
+                $units = [
+                        'weight_unit'    => $request->get_param( 'weight_unit' ),
+                        'dimension_unit' => $request->get_param( 'dimension_unit' ),
+                ];
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- php://temp is an in-memory PHP stream (disk-backed past 2MB), not a filesystem operation; WP_Filesystem does not apply.
+                $handle = fopen( 'php://temp', 'r+' );
+                if ( false === $handle ) {
+                        throw new \RuntimeException( 'Unable to open a temporary stream for CSV export.' );
+                }
+                try {
+                        $export_service = new Export_Service();
+                        // begin_csv() once, write_rows() per chunk, all on the SAME instance — that
+                        // instance holds the resolved Pro column map every row write reads.
+                        $resolved = $export_service->begin_csv( $handle, $columns, true, $units );
+                        $sink = static function ( array $rows ) use ( $export_service, $handle, $resolved ): void {
+                                $export_service->write_rows( $handle, $rows, $resolved );
+                        };
+                        $service = new Product_Service();
+                        $count = ! empty( $product_ids )
+                                ? $service->stream_products_by_ids( (array) $product_ids, self::MAX_EXPORT_ROWS, $sink )
+                                : $service->stream_products(
+                                        $this->extract_filters( $request ),
+                                        $include_variations,
+                                        self::MAX_EXPORT_ROWS,
+                                        $sink
+                                );
+                } catch ( \Throwable $e ) {
+                        // Catch solely to release the handle — the caller never receives it, so
+                        // nothing else could close it. Rethrown unchanged.
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream opened above.
+                        fclose( $handle );
+                        throw $e;
+                }
+                return [
+                        'handle' => $handle,
+                        'count'  => $count,
+                ];
+        }
+        /**
          * Extract filter parameters from the request.
+         *
+         * Protected rather than private as a TEST SEAM: export() itself ends in
+         * exit(), so it cannot run under PHPUnit — a test subclass exposes this
+         * method instead, which is what keeps the filter→CSV bridge covered.
+         *
          * @param \WP_REST_Request $request
          * @return array
          */
         private function extract_filters( \WP_REST_Request $request ): array {
+        protected function extract_filters( \WP_REST_Request $request ): array {
                 $filters = [];
 …
                         $filters['search_name'] = sanitize_text_field( $search_name );
+                }
+                $search_sku = $request->get_param( 'search_sku' );
+                if ( ! empty( $search_sku ) ) {
+                        $filters['search_sku'] = sanitize_text_field( $search_sku );
+                }
+                $search_name_mode = $request->get_param( 'search_name_mode' );
+                if ( in_array( $search_name_mode, Product_Service::TITLE_SEARCH_MODES, true ) ) {
+                        $filters['search_name_mode'] = $search_name_mode;
+                }
+                // Strict '' test, not empty(): "0" is a valid SKU.
+                $search_sku = sanitize_text_field( (string) $request->get_param( 'search_sku' ) );
+                if ( '' !== $search_sku ) {
+                        $filters['search_sku'] = $search_sku;
+                }
+                $search_sku_mode = $request->get_param( 'search_sku_mode' );
+                if ( in_array( $search_sku_mode, Product_Service::SKU_SEARCH_MODES, true ) ) {
+                        $filters['search_sku_mode'] = $search_sku_mode;
+                }
+                // Product URL filter. Deliberately NOT gated on a non-empty value — the
+                // is_empty / is_not_empty operators are effective with none.
+                // Mirrors Products_Controller::get_items(); keep the two in step.
+                $product_url_operator = $request->get_param( 'product_url_operator' ) ?: 'contains';
+                $product_url_value    = View_Service::sanitize_url_filter_value( $request->get_param( 'product_url_value' ) ?? '' );
+                if ( Product_Service::product_url_filter_is_effective( $product_url_operator, $product_url_value ) ) {
+                        $filters['product_url_operator'] = $product_url_operator;
+                        $filters['product_url_value']    = $product_url_value;
+                }
+                // Term-ID filters. A param that is PRESENT but parses to zero valid IDs must match
+                // NOTHING (the [0] sentinel — no term has ID 0), not drop the filter: an export
+                // that silently widens back to the whole catalog is the worse failure. The presence
+                // test is deliberately `'' !==` rather than `! empty()` — empty('0') is true, so the
+                // single most likely corrupt value would otherwise slip through as "no filter".
+                // Mirrors Products_Controller::get_items(); keep the two in step.
                 $category = $request->get_param( 'category' );
+                if ( ! empty( $category ) ) {
+                        $filters['category'] = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                if ( null !== $category && '' !== $category ) {
+                        $category_ids        = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                        $filters['category'] = empty( $category_ids ) ? [ 0 ] : $category_ids;
+                }
+                $tag = $request->get_param( 'tag' );
+                if ( null !== $tag && '' !== $tag ) {
+                        $tag_ids        = array_filter( array_map( 'absint', explode( ',', $tag ) ) );
+                        $filters['tag'] = empty( $tag_ids ) ? [ 0 ] : $tag_ids;
+                }
 …
+                }
+                $filters = Filter_Service::apply_shipping_class_param(
+                        $request->get_param( 'shipping_class' ),
+                        $filters
+                );
                 $price_min = $request->get_param( 'price_min' );
                 if ( null !== $price_min && '' !== $price_min ) {
 …
+                }
+                // Cost of Goods range — gated so a stale param can't trigger the COGS query
+                // path when the feature is off (matches Products_Controller).
+                if ( Product_Helper::is_cogs_enabled() ) {
+                        $cogs_min = $request->get_param( 'cogs_min' );
+                        if ( null !== $cogs_min && '' !== $cogs_min ) {
+                                $filters['cogs_min'] = sanitize_text_field( $cogs_min );
+                        }
+                        $cogs_max = $request->get_param( 'cogs_max' );
+                        if ( null !== $cogs_max && '' !== $cogs_max ) {
+                                $filters['cogs_max'] = sanitize_text_field( $cogs_max );
+                        }
+                }
                 $stock_qty_min = $request->get_param( 'stock_qty_min' );
                 if ( null !== $stock_qty_min && '' !== $stock_qty_min ) {
 …
+                }
+                $menu_order_min = $request->get_param( 'menu_order_min' );
+                if ( null !== $menu_order_min && '' !== $menu_order_min ) {
+                        $filters['menu_order_min'] = sanitize_text_field( $menu_order_min );
+                }
+                $menu_order_max = $request->get_param( 'menu_order_max' );
+                if ( null !== $menu_order_max && '' !== $menu_order_max ) {
+                        $filters['menu_order_max'] = sanitize_text_field( $menu_order_max );
+                }
                 $manage_stock = $request->get_param( 'manage_stock' );
                 if ( ! empty( $manage_stock ) ) {
 …
+                }
+                $date_params = [ 'date_created_after', 'date_created_before', 'date_modified_after', 'date_modified_before' ];
+                $date_params = [
+                        'date_created_after',
+                        'date_created_before',
+                        'date_modified_after',
+                        'date_modified_before',
+                        'sale_start_after',
+                        'sale_start_before',
+                        'sale_end_after',
+                        'sale_end_before',
+                        'image_date_after',
+                        'image_date_before',
+                ];
                 foreach ( $date_params as $param ) {
                         $val = $request->get_param( $param );

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/REST/Products_Controller.php

-              r3549389
+              r3663491
 namespace WCABE_G2\REST;
+use WCABE_G2\Helpers\Page_Size_Helper;
 use WCABE_G2\Helpers\Permission_Helper;
+use WCABE_G2\Helpers\Product_Helper;
+use WCABE_G2\Services\Filter_Service;
 use WCABE_G2\Services\Product_Service;
+use WCABE_G2\Services\View_Service;
 defined( 'ABSPATH' ) || exit;
 …
                                 'permission_callback' => [ Permission_Helper::class, 'rest_permission_check' ],
                                 'args'                => $this->get_collection_params(),
+                        ],
+                ] );
+                register_rest_route( $this->namespace, '/' . $this->rest_base . '/search', [
+                        [
+                                'methods'             => \WP_REST_Server::READABLE,
+                                'callback'            => [ $this, 'search_items' ],
+                                'permission_callback' => [ Permission_Helper::class, 'rest_permission_check' ],
+                                'args'                => [
+                                        'term' => [
+                                                'description'       => __( 'Search term — matches product title, SKU, GTIN, or a bare product ID.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'required'          => true,
+                                                'type'              => 'string',
+                                                'minLength'         => 1,
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                                'validate_callback' => static function ( $value ) {
+                                                        if ( '' === trim( (string) $value ) ) {
+                                                                return new \WP_Error(
+                                                                        'rest_invalid_param',
+                                                                        __( 'Search term cannot be empty.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                                        [ 'status' => 400 ]
+                                                                );
+                                                        }
+                                                        return true;
+                                                },
+                                        ],
+                                        'exclude' => [
+                                                'description'       => __( 'Product IDs to omit from results (e.g. the product being edited).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'array',
+                                                'default'           => [],
+                                                'items'             => [ 'type' => 'integer' ],
+                                                'sanitize_callback' => static function ( $value ) {
+                                                        if ( ! is_array( $value ) ) {
+                                                                return [];
+                                                        }
+                                                        // intval, NOT absint: absint( -7 ) is 7, so a negative would
+                                                        // silently exclude the wrong product.
+                                                        return array_values( array_filter(
+                                                                array_map( 'intval', $value ),
+                                                                static fn( $id ) => $id > 0
+                                                        ) );
+                                                },
+                                        ],
+                                        'limit' => [
+                                                'description'       => __( 'Maximum number of results.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'type'              => 'integer',
+                                                'default'           => 30,
+                                                'minimum'           => 1,
+                                                'maximum'           => 50,
+                                                'sanitize_callback' => 'absint',
+                                                'validate_callback' => 'rest_validate_request_arg',
+                                        ],
+                                ],
                         ],
                 ] );
 …
                                                 ],
                                         ],
+                                        'batch_id' => [
+                                                'required'          => false,
+                                                'type'              => 'string',
+                                                'description'       => __( 'Optional client-generated identifier correlating all chunks of one save.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                'validate_callback' => 'rest_validate_request_arg',
+                                                'sanitize_callback' => 'sanitize_text_field',
+                                        ],
                                 ],
                         ],
                 ] );
+        }
+        /**
+         * Product lookup for the linked-product picker.
+         *
+         * Route parsing and response shaping only — the search itself lives in
+         * Product_Service::search_products(), where the business logic belongs.
+         *
+         * @param \WP_REST_Request $request
+         * @return \WP_REST_Response
+         */
+        public function search_items( $request ): \WP_REST_Response {
+                $service = new Product_Service();
+                $results = $service->search_products(
+                        (string) $request->get_param( 'term' ),
+                        (array) $request->get_param( 'exclude' ),
+                        (int) $request->get_param( 'limit' )
+                );
+                return new \WP_REST_Response( $results, 200 );
+        }
 …
         public function get_items( $request ): \WP_REST_Response {
                 $page     = absint( $request->get_param( 'page' ) ) ?: 1;
+                $per_page = absint( $request->get_param( 'per_page' ) ) ?: 100;
+                // Clamped again here (the schema's sanitize_callback already ran) because
+                // get_items() must hold the bound for any caller, including internal
+                // dispatches that build a request without the registered schema.
+                $per_page = Page_Size_Helper::clamp( $request->get_param( 'per_page' ) );
                 $include_variations = (bool) $request->get_param( 'include_variations' );
-                /**
-                 * Filters the maximum number of products returned per request.
+                 *
-                 * Default 100 is a universal performance safety cap to prevent memory
-                 * exhaustion on shared hosting when variations are expanded. Both Free
-                 * and Pro honor this default — Pro does not raise it. Site admins on
-                 * infrastructure that can handle larger page sizes may filter this.
+                 *
-                 * @param int $max_per_page Default 100.
-                 */
-                $max_per_page = (int) apply_filters( 'wcabe_g2_max_per_page', 100 );
-                $per_page     = min( $per_page, $max_per_page );
                 // Build filters array from request params.
 …
                         $filters['search_name'] = sanitize_text_field( $search_name );
+                }
+                $search_sku = $request->get_param( 'search_sku' );
+                if ( ! empty( $search_sku ) ) {
+                        $filters['search_sku'] = sanitize_text_field( $search_sku );
+                $search_name_mode = $request->get_param( 'search_name_mode' );
+                if ( in_array( $search_name_mode, Product_Service::TITLE_SEARCH_MODES, true ) ) {
+                        $filters['search_name_mode'] = $search_name_mode;
+                }
+                // Strict '' test, not empty(): "0" is a valid SKU.
+                $search_sku = sanitize_text_field( (string) $request->get_param( 'search_sku' ) );
+                if ( '' !== $search_sku ) {
+                        $filters['search_sku'] = $search_sku;
+                }
+                $search_sku_mode = $request->get_param( 'search_sku_mode' );
+                if ( in_array( $search_sku_mode, Product_Service::SKU_SEARCH_MODES, true ) ) {
+                        $filters['search_sku_mode'] = $search_sku_mode;
+                }
                 $search_description = $request->get_param( 'search_description' );
 …
+                }
+                // Product URL filter. Deliberately NOT gated on a non-empty value: the
+                // is_empty / is_not_empty operators are effective with none, so the usual
+                // `if ( ! empty( $value ) )` shape would silently drop them here.
+                $product_url_operator = $request->get_param( 'product_url_operator' ) ?: 'contains';
+                $product_url_value    = View_Service::sanitize_url_filter_value( $request->get_param( 'product_url_value' ) ?? '' );
+                if ( Product_Service::product_url_filter_is_effective( $product_url_operator, $product_url_value ) ) {
+                        $filters['product_url_operator'] = $product_url_operator;
+                        $filters['product_url_value']    = $product_url_value;
+                }
+                // Term-ID filters. A param that is PRESENT but parses to zero valid IDs must match
+                // NOTHING (the [0] sentinel — no term has ID 0), not drop the filter: silently
+                // widening a filtered request back to the whole catalog is the worse failure, and
+                // the same parse feeds CSV export. The presence test is deliberately `'' !==`
+                // rather than `! empty()` — empty('0') is true, so the single most likely corrupt
+                // value would otherwise slip through as "no filter".
                 $category = $request->get_param( 'category' );
+                if ( ! empty( $category ) ) {
+                        $filters['category'] = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                if ( null !== $category && '' !== $category ) {
+                        $category_ids        = array_filter( array_map( 'absint', explode( ',', $category ) ) );
+                        $filters['category'] = empty( $category_ids ) ? [ 0 ] : $category_ids;
+                }
+                $tag = $request->get_param( 'tag' );
+                if ( null !== $tag && '' !== $tag ) {
+                        $tag_ids        = array_filter( array_map( 'absint', explode( ',', $tag ) ) );
+                        $filters['tag'] = empty( $tag_ids ) ? [ 0 ] : $tag_ids;
+                }
 …
+                }
+                $filters = Filter_Service::apply_shipping_class_param(
+                        $request->get_param( 'shipping_class' ),
+                        $filters
+                );
                 $price_min = $request->get_param( 'price_min' );
                 if ( null !== $price_min && '' !== $price_min ) {
 …
+                }
+                // Cost of Goods range — only honored when the COGS feature is enabled, so a
+                // stale param can't trigger the COGS query path (or get_cogs_value()).
+                if ( Product_Helper::is_cogs_enabled() ) {
+                        $cogs_min = $request->get_param( 'cogs_min' );
+                        if ( null !== $cogs_min && '' !== $cogs_min ) {
+                                $filters['cogs_min'] = sanitize_text_field( $cogs_min );
+                        }
+                        $cogs_max = $request->get_param( 'cogs_max' );
+                        if ( null !== $cogs_max && '' !== $cogs_max ) {
+                                $filters['cogs_max'] = sanitize_text_field( $cogs_max );
+                        }
+                }
                 $stock_qty_min = $request->get_param( 'stock_qty_min' );
                 if ( null !== $stock_qty_min && '' !== $stock_qty_min ) {
 …
+                }
+                $menu_order_min = $request->get_param( 'menu_order_min' );
+                if ( null !== $menu_order_min && '' !== $menu_order_min ) {
+                        $filters['menu_order_min'] = sanitize_text_field( $menu_order_min );
+                }
+                $menu_order_max = $request->get_param( 'menu_order_max' );
+                if ( null !== $menu_order_max && '' !== $menu_order_max ) {
+                        $filters['menu_order_max'] = sanitize_text_field( $menu_order_max );
+                }
                 $manage_stock = $request->get_param( 'manage_stock' );
                 if ( ! empty( $manage_stock ) ) {
 …
+                }
+                $date_params = [ 'date_created_after', 'date_created_before', 'date_modified_after', 'date_modified_before' ];
+                $date_params = [
+                        'date_created_after',
+                        'date_created_before',
+                        'date_modified_after',
+                        'date_modified_before',
+                        'sale_start_after',
+                        'sale_start_before',
+                        'sale_end_after',
+                        'sale_end_before',
+                        'image_date_after',
+                        'image_date_before',
+                ];
                 foreach ( $date_params as $param ) {
                         $val = $request->get_param( $param );
 …
                 $filters = apply_filters( 'wcabe_g2_rest_request_filters', $filters, $request );
+                // Server-side sort. Whitelisted at the schema level (orderby: id|menu_order);
+                // the service maps these to WC/WP_Query orderby values.
+                $orderby = (string) $request->get_param( 'orderby' );
+                $order   = (string) $request->get_param( 'order' );
                 $service = new Product_Service();
                 $data = $service->get_products( $page, $per_page, $include_variations, $filters );
+                $data = $service->get_products( $page, $per_page, $include_variations, $filters, $orderby, $order );
                 $response = rest_ensure_response( $data );
 …
+                }
+                $batch_id = $request->get_param( 'batch_id' );
                 $service = new Product_Service();
+                $results = $service->batch_update( $products );
+                $results = $service->batch_update(
+                        $products,
+                        [ 'batch_id' => is_string( $batch_id ) ? $batch_id : null ]
+                );
                 return rest_ensure_response( [ 'results' => $results ] );
 …
                                 'description'       => __( 'Maximum number of items per page.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                 'type'              => 'integer',
+                                'default'           => 100,
+                                'minimum'           => 1,
+                                'maximum'           => 100,
+                                'sanitize_callback' => 'absint',
+                                'validate_callback' => 'rest_validate_request_arg',
+                                'default'           => Page_Size_Helper::DEFAULT_PAGE_SIZE,
+                                // Deliberately no 'minimum'/'maximum'/'validate_callback': an
+                                // out-of-range or malformed per_page must degrade to a clamped
+                                // value, never 400 the whole grid fetch. Page_Size_Helper::clamp
+                                // bounds every input (including non-scalars) without erroring, so
+                                // schema validation would only add a failure mode. The effective
+                                // maximum is filterable per site, which a static schema 'maximum'
+                                // could not express anyway.
+                                'sanitize_callback' => [ Page_Size_Helper::class, 'clamp' ],
                         ],
                         'include_variations' => [
 …
                                 'sanitize_callback' => 'rest_sanitize_boolean',
                         ],
+                        'orderby' => [
+                                'description'       => __( 'Server-side sort column.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'id',
+                                'enum'              => [ 'id', 'menu_order' ],
+                        ],
+                        'order' => [
+                                'description'       => __( 'Server-side sort direction.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'desc',
+                                'enum'              => [ 'asc', 'desc' ],
+                        ],
                         'search_name' => [
                                 'description'       => __( 'Search by product name.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
+                        'search_name_mode' => [
+                                'description'       => __( 'Title match mode: all (every word, default), any (any word), or phrase (exact phrase).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'all',
+                                'enum'              => Product_Service::TITLE_SEARCH_MODES,
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
                         'search_sku' => [
+                                'description'       => __( 'Search by SKU. Comma-separated for exact match.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                /* translators: %d: maximum number of comma-separated SKU values. */
+                                'description'       => sprintf( __( 'Search by SKU. Comma-separate multiple values to match any of them under the selected mode (capped at %d values).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ), Product_Service::SKU_SEARCH_MAX_TOKENS ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
+                        'search_sku_mode' => [
+                                'description'       => __( 'SKU match mode: contains, is_exactly, not_contains, starts_with, or ends_with. Comma-separated values match any of them (none of them for not_contains). Omit or send an empty string for the legacy behaviour: comma-separated = exact, single value = partial.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => '',
+                                'enum'              => array_merge( [ '' ], Product_Service::SKU_SEARCH_MODES ),
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
 …
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
+                        'product_url_operator' => [
+                                'description'       => __( 'Product URL filter operator.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'default'           => 'contains',
+                                'enum'              => Product_Service::PRODUCT_URL_OPERATORS,
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
+                        'product_url_value' => [
+                                'description'       => __( 'Product URL filter value (substring).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                // NOT sanitize_text_field: it strips percent-encoded octets (%20,
+                                // %2F), which are legitimate content in a URL substring search.
+                                'sanitize_callback' => [ View_Service::class, 'sanitize_url_filter_value' ],
+                        ],
                         'category' => [
                                 'description'       => __( 'Comma-separated category term IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 'sanitize_callback' => 'sanitize_text_field',
                         ],
+                        'tag' => [
+                                'description'       => __( 'Comma-separated tag term IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                        ],
                         'type' => [
                                 'description'       => __( 'Comma-separated product types.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 'type'              => 'string',
                                 'sanitize_callback' => 'sanitize_text_field',
+                        ],
+                        'shipping_class' => [
+                                // No sanitize_callback: sanitize_text_field() strips percent-encoded
+                                // octets, which is exactly how WP stores non-ASCII term slugs
+                                // (sanitize_title() -> utf8_uri_encode()). That would silently reduce
+                                // e.g. a Cyrillic class's slug to '', match-noning every request for
+                                // it. Filter_Service::apply_shipping_class_param() is the real
+                                // sanitizer — sanitize_title() per comma-separated token.
+                                'description' => __( 'Comma-separated shipping class slugs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'        => 'string',
                         ],
                         'price_min' => [
 …
                                 },
                         ],
+                        'cogs_min' => [
+                                'description'       => __( 'Minimum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return is_numeric( $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Cost of Goods must be numeric.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
+                        'cogs_max' => [
+                                'description'       => __( 'Maximum Cost of Goods filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return is_numeric( $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Cost of Goods must be numeric.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
                         'stock_qty_min' => [
                                 'description'       => __( 'Minimum stock quantity filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                                 },
                         ],
+                        'menu_order_min' => [
+                                'description'       => __( 'Minimum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        // Integer-only (menu order is a whole number; may be negative) —
+                                        // deliberately stricter than the decimal-allowing stock_qty filter.
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
+                        'menu_order_max' => [
+                                'description'       => __( 'Maximum menu order filter.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => function( $value ) {
+                                        if ( '' === $value ) {
+                                                return true;
+                                        }
+                                        return preg_match( '/^-?\d+$/', (string) $value ) ? true : new \WP_Error(
+                                                'rest_invalid_param',
+                                                __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                                        );
+                                },
+                        ],
                         'manage_stock' => [
                                 'description'       => __( 'Comma-separated manage stock values (yes, no).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
 …
                         'date_modified_before' => [
                                 'description'       => __( 'Filter products modified on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_start_after' => [
+                                'description'       => __( 'Filter products whose sale starts on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_start_before' => [
+                                'description'       => __( 'Filter products whose sale starts on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_end_after' => [
+                                'description'       => __( 'Filter products whose sale ends on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'sale_end_before' => [
+                                'description'       => __( 'Filter products whose sale ends on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'image_date_after' => [
+                                'description'       => __( 'Filter products whose featured image was uploaded on or after this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                'type'              => 'string',
+                                'sanitize_callback' => 'sanitize_text_field',
+                                'validate_callback' => [ $this, 'validate_date_param' ],
+                        ],
+                        'image_date_before' => [
+                                'description'       => __( 'Filter products whose featured image was uploaded on or before this date (YYYY-MM-DD).', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                 'type'              => 'string',
                                 'sanitize_callback' => 'sanitize_text_field',

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/REST/Settings_Controller.php

-              r3549389
+              r3663491
                 ],
                 'debug_tracing' => [
+                        'type'    => 'boolean',
+                        'default' => false,
+                ],
+                'trigger_wp_save_hooks' => [
                         'type'    => 'boolean',
                         'default' => false,

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/REST/User_Settings_Controller.php

-              r3549389
+              r3663491
 namespace WCABE_G2\REST;
+use WCABE_G2\Helpers\Page_Size_Helper;
 use WCABE_G2\Helpers\Permission_Helper;
 use WCABE_G2\Services\View_Service;
 …
          */
         private const SCHEMA = [
                 'pageSize'            => [ 'type' => 'integer', 'default' => 100 ],
+                'pageSize'            => [ 'type' => 'integer', 'default' => Page_Size_Helper::DEFAULT_PAGE_SIZE ],
                 'includeVariations'   => [ 'type' => 'boolean', 'default' => false ],
                 'darkMode'            => [ 'type' => 'boolean', 'default' => false ],
 …
                 'imagePreviewEnabled' => [ 'type' => 'boolean', 'default' => true ],
                 'autoLoadProducts'    => [ 'type' => 'boolean', 'default' => true ],
+                'showAdminBarShortcut' => [ 'type' => 'boolean', 'default' => true ],
+                'refreshAfterSave'    => [ 'type' => 'boolean', 'default' => true ],
+                // Working-layout draft (views working-state redesign). filterDraft is the
+                // filter half (view `filters` shape); activeViewId is the baseline pointer
+                // and the load-precedence "has-draft" marker (nullable — never (string)-cast).
+                'filterDraft'         => [ 'type' => 'filters',         'default' => null ],
+                'activeViewId'        => [ 'type' => 'nullable_string', 'default' => null ],
+                // Opaque scope stamp recorded alongside filterDraft, identifying the context
+                // the draft's entity ids were resolved in. Tier-neutral: Free never
+                // interprets the value, it only round-trips it so the frontend can compare
+                // the stored stamp against the current one and discard a draft whose entity
+                // ids belong to a different scope (see stripScopedFilters / filterScopeKey
+                // registry slot). Null = no stamp recorded.
+                'filterScopeKey'      => [ 'type' => 'nullable_string', 'default' => null ],
         ];
 …
         public function update_settings( \WP_REST_Request $request ): \WP_REST_Response {
+                $body = $request->get_json_params();
+                // Order-safe write gate via a monotonic client _rev (R7.1/R8.1/R8.2). The
+                // settings sync is last-write-wins partial merge, so a stale in-flight request
+                // landing after the unload beacon could clobber individual keys. Stamping every
+                // write with a client _rev and applying-only-if-newer closes that race.
+                //
+                // Read the RAW stored meta for the prior _rev — get_all() is SCHEMA-only and
+                // would drop _rev, so the compare and write-back must use the raw array (R8.1).
+                $raw = get_user_meta( get_current_user_id(), self::META_KEY, true );
+                if ( ! is_array( $raw ) ) {
+                        $raw = [];
+                }
+                // Use the RAW numeric value — do NOT (int)-cast. The client seeds _rev from
+                // Date.now() (~1.75e12), which exceeds PHP_INT_MAX on 32-bit PHP where (int)
+                // saturates to 2147483647, collapsing stored and incoming to the same value so
+                // every write after the first is wrongly rejected as stale (review #8). On 32-bit
+                // JSON decodes such a value to a float; on 64-bit it stays an int. Comparing the
+                // raw numeric values is correct on both (PHP compares numerically) and preserves
+                // the stored int type on 64-bit. is_numeric() already validated them.
+                $stored_rev   = ( isset( $raw['_rev'] ) && is_numeric( $raw['_rev'] ) ) ? $raw['_rev'] : null;
+                $incoming_rev = ( isset( $body['_rev'] ) && is_numeric( $body['_rev'] ) ) ? $body['_rev'] : null;
+                if ( null !== $incoming_rev ) {
+                        // Drop exact-rev replays and older writes.
+                        if ( null !== $stored_rev && $incoming_rev <= $stored_rev ) {
+                                return rest_ensure_response( self::get_all() );
+                        }
+                } elseif ( null !== $stored_rev ) {
+                        // Absent _rev applies ONLY before any _rev is stored (pre-_rev install /
+                        // first write). Once a _rev exists, treat a missing _rev as stale — else a
+                        // no-rev write would reopen the race (R8.2).
+                        return rest_ensure_response( self::get_all() );
+                }
                 $current = self::get_all();
-                $body    = $request->get_json_params();
                 foreach ( self::SCHEMA as $key => $schema ) {
 …
                                 case 'integer':
                                         if ( 'pageSize' === $key ) {
+                                                /** This filter is documented in includes/REST/Products_Controller.php */
+                                                $max             = (int) apply_filters( 'wcabe_g2_max_per_page', 100 );
+                                                $current[ $key ] = max( 1, min( absint( $value ), $max ) );
+                                                $current[ $key ] = Page_Size_Helper::clamp( $value );
+                                        }
                                         // else: no other integer fields defined. Future integer fields
 …
+                                        }
                                         break;
+                                case 'filters':
+                                        if ( null === $value ) {
+                                                $current[ $key ] = null;
+                                        } elseif ( is_array( $value ) ) {
+                                                // Live frontend draft — already the current FilterValues shape,
+                                                // never a legacy bag shape, so no migration (mirrors columnState).
+                                                $current[ $key ] = View_Service::sanitize_filter_values( $value );
+                                        }
+                                        break;
+                                case 'nullable_string':
+                                        // Preserve null/'' as null (don't (string)-cast) so the load-precedence
+                                        // marker (activeViewId !== null) stays meaningful.
+                                        if ( null === $value || '' === $value ) {
+                                                $current[ $key ] = null;
+                                        } else {
+                                                $current[ $key ] = sanitize_text_field( (string) $value );
+                                        }
+                                        break;
+                        }
+                }
+                // Re-add the rev into the meta array so the $current = get_all() rebuild
+                // (SCHEMA-only) doesn't erase the stored _rev (R8.1). Newest rev wins.
+                if ( null !== $incoming_rev ) {
+                        $current['_rev'] = max( $incoming_rev, $stored_rev ?? 0 );
+                }
                 update_user_meta( get_current_user_id(), self::META_KEY, $current );
+                return rest_ensure_response( $current );
+                // Return SCHEMA-only settings (get_all strips _rev) so _rev never surfaces
+                // to the client as a setting (R8.1).
+                return rest_ensure_response( self::get_all() );
+        }
+        /**
+         * The stored monotonic sync cursor (_rev), or 0.0 when none has been written yet.
+         *
+         * Localized to the client (window.wcabeG2.userSettingsRev) so it can seed its rev
+         * counter ABOVE the last persisted value. Without this the client seeds from a bare
+         * Date.now(); a backward wall-clock step between sessions (NTP correction, VM resume,
+         * wrong RTC, manual change) then makes every new write's _rev look stale, silently
+         * halting all settings persistence until real time catches up (review #4). This is
+         * transport, deliberately kept out of get_all()/UserSettings so _rev never surfaces
+         * as a setting. Returned as float for 32-bit safety (see update_settings, #8).
+         */
+        public static function get_stored_rev(): float {
+                $raw = get_user_meta( get_current_user_id(), self::META_KEY, true );
+                return ( is_array( $raw ) && isset( $raw['_rev'] ) && is_numeric( $raw['_rev'] ) ) ? (float) $raw['_rev'] : 0.0;
+        }
 …
+                }
                 // Defensive clamp on read. The schema and update_settings() already
                 // enforce the bound on writes, but values written to user meta outside
                 // this controller (legacy installs, future schema changes, direct DB
                 // updates) could fall outside it. Same filter and bound as the write path.
+                // Defensive clamp on read. update_settings() already enforces the bound on
+                // writes, but values written to user meta outside this controller (legacy
+                // installs, future schema changes, direct DB updates) or a site that has
+                // since LOWERED wcabe_g2_max_per_page could fall outside it.
                 if ( isset( $result['pageSize'] ) ) {
+                        /** This filter is documented in includes/REST/Products_Controller.php */
+                        $max                = (int) apply_filters( 'wcabe_g2_max_per_page', 100 );
+                        $result['pageSize'] = min( max( 1, (int) $result['pageSize'] ), $max );
+                        $result['pageSize'] = Page_Size_Helper::clamp( $result['pageSize'] );
+                }

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/REST/Views_Controller.php

-              r3549389
+              r3663491
 namespace WCABE_G2\REST;
+use WCABE_G2\Helpers\Page_Size_Helper;
 use WCABE_G2\Helpers\Permission_Helper;
 use WCABE_G2\Services\View_Service;
 …
                         );
+                }
+                // Validate the SANITIZED value too — WP core runs validate_callback on the
+                // raw param before sanitize_callback, so a raw value like '<b></b>' passes
+                // the non-empty check above but sanitizes to '' and would otherwise persist
+                // a blank-named view.
+                if ( '' === trim( sanitize_text_field( $trimmed ) ) ) {
+                        return new \WP_Error(
+                                'rest_invalid_param',
+                                __( 'View name cannot be empty.', 'wpmelon-advanced-bulk-edit-for-woocommerce' )
+                        );
+                }
                 return true;
+        }
 …
                                                 'type'     => 'array',
                                         ],
+                                        // No minimum/maximum/validate_callback: a malformed page_size
+                                        // must not fail the whole view save. clamp() bounds any input,
+                                        // including non-scalars, without erroring.
+                                        'page_size' => [
+                                                'required'          => false,
+                                                'type'              => 'integer',
+                                                'sanitize_callback' => [ Page_Size_Helper::class, 'clamp' ],
+                                        ],
                                         'is_default' => [
                                                 'required' => false,
 …
                                                 'type'     => 'array',
                                         ],
+                                        'page_size' => [
+                                                'required'          => false,
+                                                'type'              => 'integer',
+                                                'sanitize_callback' => [ Page_Size_Helper::class, 'clamp' ],
+                                        ],
                                         'is_default' => [
                                                 'required' => false,
 …
                         'filters'      => $request->get_param( 'filters' ),
                         'column_state' => $request->get_param( 'column_state' ),
+                        'page_size'    => $request->get_param( 'page_size' ),
                         'is_default'   => $request->get_param( 'is_default' ),
                 ];
 …
                         $data['column_state'] = $request->get_param( 'column_state' );
+                }
+                if ( null !== $request->get_param( 'page_size' ) ) {
+                        $data['page_size'] = $request->get_param( 'page_size' );
+                }
                 if ( null !== $request->get_param( 'is_default' ) ) {
                         $data['is_default'] = $request->get_param( 'is_default' );

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Services/Export_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Helpers\Product_Helper;
 defined( 'ABSPATH' ) || exit;
 …
          */
         protected array $pro_columns = [];
+        /**
+         * Lazily built slug => name map for the Shipping Class column. Null until the
+         * first shipping_class cell is formatted, so exports without that column
+         * never touch the taxonomy.
+         *
+         * @var array<string, string>|null
+         */
+        protected ?array $shipping_class_names = null;
         /**
 …
                 'regular_price'      => 'Regular Price',
                 'sale_price'         => 'Sale Price',
+                'cogs_value'         => 'Cost of Goods',
                 'stock_quantity'     => 'Stock Qty',
                 'stock_status'       => 'Stock Status',
 …
                 'date_on_sale_from'  => 'Sale From',
                 'date_on_sale_to'    => 'Sale To',
+                'date_created'       => 'Published on',
+                'date_modified'      => 'Modified on',
+                'image_date'         => 'Image uploaded',
                 'featured'           => 'Featured',
                 'virtual'            => 'Virtual',
                 'downloadable'       => 'Downloadable',
                 'backorders'         => 'Backorders',
+                'shipping_class'     => 'Shipping Class',
+                'menu_order'         => 'Menu Order',
+                'button_text'        => 'Button Text',
+                'product_url'        => 'Product URL',
+                'upsell_ids'         => 'Upsells',
+                'cross_sell_ids'     => 'Cross-sells',
         ];
         /**
          * Generate a CSV string from an array of formatted product data.
+         *
+         * One-shot entry point, kept for callers that already hold every row in memory.
+         * It is a thin composition over begin_csv() + write_rows() — the incremental
+         * primitives the export controller streams through — so both paths produce
+         * byte-identical output by construction.
+         *
          * @param array  $products    Array of formatted product arrays.
 …
          * @param array  $units       Optional [ 'weight_unit' => 'kg', 'dimension_unit' => 'cm' ].
          * @return string CSV content.
+         * @throws \RuntimeException When the temporary stream cannot be opened, written, rewound or read.
          */
         public function generate_csv( array $products, array $columns = [], bool $include_bom = true, array $units = [] ): string {
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- php://temp is an in-memory PHP stream, not a filesystem operation. Used as the standard fputcsv() handle pattern for building CSV in memory; WP_Filesystem does not apply to memory streams.
+                $handle = fopen( 'php://temp', 'r+' );
+                if ( false === $handle ) {
+                        throw new \RuntimeException( 'Unable to open a temporary stream for CSV generation.' );
+                }
+                try {
+                        $resolved = $this->begin_csv( $handle, $columns, $include_bom, $units );
+                        $this->write_rows( $handle, $products, $resolved );
+                        if ( ! rewind( $handle ) ) {
+                                throw new \RuntimeException( 'Unable to rewind the temporary CSV stream.' );
+                        }
+                        $csv = stream_get_contents( $handle );
+                        if ( false === $csv ) {
+                                throw new \RuntimeException( 'Unable to read the temporary CSV stream.' );
+                        }
+                        return $csv;
+                } finally {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing the in-memory php://temp stream opened above. In finally so a write failure mid-document never leaks the handle.
+                        fclose( $handle );
+                }
+        }
+        /**
+         * Open a CSV document on a stream: resolve the column set, apply the Pro
+         * extra-columns filter, and write the BOM + header row.
+         *
+         * Call EXACTLY ONCE per export, before any write_rows() call, and on the SAME
+         * instance those write_rows() calls use — this is what initializes
+         * $this->pro_columns, which format_cell_value() reads for every
+         * Pro-contributed cell. Calling it per chunk would repeat the BOM and header
+         * row mid-file; calling write_rows() on a different instance would silently
+         * blank every Pro column.
+         *
+         * @param resource $handle      Open, writable stream.
+         * @param array    $columns     Columns to include (keys from EXPORTABLE_COLUMNS). Empty = all.
+         * @param bool     $include_bom Prepend UTF-8 BOM for Excel compatibility.
+         * @param array    $units       Optional [ 'weight_unit' => 'kg', 'dimension_unit' => 'cm' ].
+         * @return array Resolved column keys. Pass these to every write_rows() call.
+         * @throws \RuntimeException When a write fails (e.g. the temp stream's backing disk is full).
+         */
+        public function begin_csv( $handle, array $columns = [], bool $include_bom = true, array $units = [] ): array {
                 /**
                  * Allow extensions (Pro) to declare additional export columns.
 …
                 $this->pro_columns = apply_filters( 'wcabe_g2_export_extra_columns', [] );
+                // Filter to valid exportable columns only.
+                $columns = $this->resolve_columns( $columns );
+                if ( $include_bom ) {
+                        $bom = "\xEF\xBB\xBF";
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- writing to the caller's in-memory php://temp stream.
+                        $written = fwrite( $handle, $bom );
+                        // Compare the exact byte count, not just !== false: a full stream can
+                        // report a SHORT write, which would corrupt the BOM silently.
+                        if ( strlen( $bom ) !== $written ) {
+                                throw new \RuntimeException( 'Unable to write the CSV byte-order mark.' );
+                        }
+                }
+                $this->put_row( $handle, $this->build_headers( $columns, $units ) );
+                return $columns;
+        }
+        /**
+         * Append a chunk of formatted product rows to an open CSV document.
+         *
+         * Callable any number of times after begin_csv(), which is what lets the
+         * export stream page-by-page instead of holding every formatted row in memory.
+         *
+         * @param resource $handle   Open, writable stream previously passed to begin_csv().
+         * @param array    $products Formatted product arrays for this chunk.
+         * @param array    $columns  Resolved columns returned by begin_csv().
+         * @throws \RuntimeException When a write fails.
+         */
+        public function write_rows( $handle, array $products, array $columns ): void {
+                foreach ( $products as $product ) {
+                        $row = [];
+                        foreach ( $columns as $col ) {
+                                $row[] = $this->format_cell_value( $product, $col );
+                        }
+                        $this->put_row( $handle, $row );
+                }
+        }
+        /**
+         * Filter a requested column list down to the ones this export can emit.
+         *
+         * Depends on $this->pro_columns, so it must run after the extra-columns
+         * filter has been applied in begin_csv().
+         *
+         * @param array $columns Requested columns. Empty = all native exportable columns.
+         * @return array
+         */
+        private function resolve_columns( array $columns ): array {
                 if ( ! empty( $columns ) ) {
                         $pro_columns = $this->pro_columns;
 …
+                }
+                // Build header labels, adjusting for units.
+                return $columns;
+        }
+        /**
+         * Build the header labels for a resolved column list, adjusting for units.
+         *
+         * @param array $columns Resolved column keys.
+         * @param array $units   Optional [ 'weight_unit' => 'kg', 'dimension_unit' => 'cm' ].
+         * @return array
+         */
+        private function build_headers( array $columns, array $units ): array {
                 $weight_unit    = $units['weight_unit'] ?? '';
                 $dimension_unit = $units['dimension_unit'] ?? '';
 …
+                }
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- php://temp is an in-memory PHP stream, not a filesystem operation. Used as the standard fputcsv() handle pattern for building CSV in memory; WP_Filesystem does not apply to memory streams.
+                $handle = fopen( 'php://temp', 'r+' );
+                if ( $include_bom ) {
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- writing to in-memory php://temp stream from line 135.
+                        fwrite( $handle, "\xEF\xBB\xBF" );
+                }
+                fputcsv( $handle, $headers );
+                foreach ( $products as $product ) {
+                        $row = [];
+                        foreach ( $columns as $col ) {
+                                $row[] = $this->format_cell_value( $product, $col );
+                        }
+                        fputcsv( $handle, $row );
+                }
+                rewind( $handle );
+                $csv = stream_get_contents( $handle );
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing in-memory php://temp stream from line 135.
+                fclose( $handle );
+                return $csv;
+                return $headers;
+        }
+        /**
+         * Write one CSV record, failing loudly.
+         *
+         * A silent truncation here would surface as a valid-looking CSV that is
+         * missing rows, so every write is checked and the controller converts the
+         * failure into a JSON error rather than a partial 200 response.
+         *
+         * The escape argument is explicit because the implicit default is deprecated
+         * from PHP 8.4. '\\' is the historical default and is kept deliberately —
+         * switching to RFC 4180's '' would change how existing exports escape.
+         *
+         * @param resource $handle Open, writable stream.
+         * @param array    $row    Field values.
+         * @throws \RuntimeException When the write fails.
+         */
+        private function put_row( $handle, array $row ): void {
+                if ( false === fputcsv( $handle, $row, ',', '"', '\\' ) ) {
+                        throw new \RuntimeException( 'Unable to write a CSV row.' );
+                }
+        }
 …
                                 return '';
+                        case 'upsell_ids':
+                        case 'cross_sell_ids':
+                                // Intentional: export is type-blind. The grid hides `cross_sell_ids` on
+                                // grouped/external products (WooCommerce doesn't render Cross-sells there, so it
+                                // isn't editable), but the stored meta still exists and CSV must reflect what's
+                                // persisted — this is also the only surface that reveals orphan cross-sells on
+                                // those types. Do not add a product-type guard here.
+                                // Matches WooCommerce's own product CSV exporter: comma-separated, SKU where
+                                // the product has one, `id:123` otherwise — so the output stays importable by
+                                // WC's native importer. An explicit case is required: the default arm would
+                                // (string)-cast the array to "Array" and emit a notice.
+                                if ( ! is_array( $value ) ) {
+                                        return '';
+                                }
+                                $refs = [];
+                                foreach ( $value as $ref ) {
+                                        if ( ! is_array( $ref ) || empty( $ref['id'] ) ) {
+                                                continue;
+                                        }
+                                        // Drop DEAD refs (target no longer a product). WC's own exporter does the
+                                        // same — array_filter( array_map( 'wc_get_product', … ) ) — and for good
+                                        // reason: `id:N` for a non-existent N makes WC's importer CREATE an "Import
+                                        // placeholder" product (status "importing") when update_existing is off, so a
+                                        // G2-export → WC-import round trip would manufacture one junk product per dead
+                                        // ref. Preserving dead refs in STORAGE stays correct (normalize_product_refs
+                                        // keeps them, so a chip the user never touches survives); resolving them into
+                                        // product creation via an interchange format is the bug. Live refs stranded on
+                                        // a type that hides the field (cross-sells on grouped/external) are NOT missing
+                                        // and still export — the type-blindness above is unaffected.
+                                        if ( ! empty( $ref['missing'] ) ) {
+                                                continue;
+                                        }
+                                        $sku    = isset( $ref['sku'] ) ? (string) $ref['sku'] : '';
+                                        $refs[] = '' !== $sku ? $sku : 'id:' . (int) $ref['id'];
+                                }
+                                return implode( ', ', $refs );
                         case 'manage_stock':
                         case 'featured':
 …
                                 return (string) $value;
+                        case 'menu_order':
+                                // Always an integer (default 0); 0 is a real position, so export it
+                                // rather than blanking like stock_quantity.
+                                return (string) (int) $value;
                         case 'description':
                         case 'short_description':
                                 return wp_strip_all_tags( (string) $value );
+                        case 'shipping_class':
+                                // The stored value is a slug; export the human-readable NAME, which
+                                // is what the grid shows and what a spreadsheet user recognises.
+                                // A slug whose term has since been deleted falls back to the slug
+                                // rather than blanking — losing the value silently would be worse.
+                                // '' stays '' (no class / same as parent).
+                                $slug = (string) $value;
+                                if ( '' === $slug ) {
+                                        return '';
+                                }
+                                if ( null === $this->shipping_class_names ) {
+                                        $this->shipping_class_names = [];
+                                        foreach ( Product_Helper::get_shipping_class_terms() as $term ) {
+                                                $this->shipping_class_names[ $term['slug'] ] = $term['name'];
+                                        }
+                                }
+                                return $this->shipping_class_names[ $slug ] ?? $slug;
                         default:
                                 return (string) $value;

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Services/Filter_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Helpers\Product_Helper;
 defined( 'ABSPATH' ) || exit;
 class Filter_Service {
+        /**
+         * Fold a raw `shipping_class` REST param into a filters array.
+         *
+         * Shared by Products_Controller and Export_Controller so the two request
+         * paths cannot drift — a filter honoured by the grid but dropped by export
+         * is the classic failure here.
+         *
+         * Junk semantics: sanitize_title() maps '!!!' to '', so a naive array_map
+         * would yield [''] — a filter that looks active and matches nothing in a way
+         * nobody can see. Empties are dropped; if the param was PRESENT but nothing
+         * valid survived, the match-none flag is raised instead of leaving the filter
+         * absent (which would silently return the entire catalog).
+         *
+         * The filter callback checks strict '' equality, not array_filter()'s default
+         * truthiness — sanitize_title() can legally produce the string '0' (WP will
+         * generate that slug for a term named e.g. "0" or "0 items"), and a bare
+         * array_filter() call treats '0' as falsy and drops it same as a real empty.
+         *
+         * @param mixed $raw     Raw request param (comma-separated slugs).
+         * @param array $filters Filters array to extend.
+         * @return array The filters array.
+         */
+        public static function apply_shipping_class_param( $raw, array $filters ): array {
+                if ( null === $raw || '' === $raw ) {
+                        return $filters;
+                }
+                $slugs = array_values(
+                        array_filter(
+                                array_map( 'sanitize_title', explode( ',', (string) $raw ) ),
+                                static fn( string $slug ): bool => '' !== $slug
+                        )
+                );
+                if ( empty( $slugs ) ) {
+                        $filters['shipping_class_match_none'] = true;
+                        return $filters;
+                }
+                $filters['shipping_class'] = $slugs;
+                return $filters;
+        }
         /**
 …
                         'categories'     => $this->get_category_tree(),
                         'tags'           => $this->get_tags(),
                         'types'          => [ 'simple', 'variable', 'grouped', 'external' ],
+                        'types'          => $this->get_product_type_options(),
                         'statuses'       => [ 'publish', 'draft', 'pending', 'private' ],
                         'stock_statuses' => [ 'instock', 'outofstock', 'onbackorder' ],
+                        // Same list the grid editor gets via window.wcabeG2, from one cached
+                        // source, so the filter and the column can never disagree on the
+                        // vocabulary. Deliberately no count — see get_shipping_class_terms().
+                        'shipping_classes' => Product_Helper::get_shipping_class_terms(),
                 ];
                 return apply_filters( 'wcabe_g2_filter_options', $options );
+        }
+        /**
+         * Product type filter options — the WooCommerce natives first, then every
+         * third-party registered type (e.g. 'bundle'), as value/label pairs (#137).
+         * Labels come from wc_get_product_types() so third-party types show their
+         * plugin-provided name; the frontend overrides the four native labels with
+         * its own short translations.
+         *
+         * @return array Array of [ 'value' => slug, 'label' => label ].
+         */
+        private function get_product_type_options(): array {
+                $registered = wc_get_product_types();
+                $options    = [];
+                foreach ( [ 'simple', 'variable', 'grouped', 'external' ] as $slug ) {
+                        $options[] = [
+                                'value' => $slug,
+                                'label' => (string) ( $registered[ $slug ] ?? ucfirst( $slug ) ),
+                        ];
+                        unset( $registered[ $slug ] );
+                }
+                foreach ( $registered as $slug => $label ) {
+                        $options[] = [
+                                'value' => (string) $slug,
+                                'label' => (string) $label,
+                        ];
+                }
+                return $options;
+        }

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Services/Operations_Service.php

-              r3549389
+              r3663491
          * Duplicate one or more products.
+         *
+         * `created_ids` is the authoritative record of what was written: every TOP-LEVEL duplicate
+         * that saved, in creation order (never the variations duplicate_variations() creates).
+         * `products` is the subset that could also be formatted for display, and may be SHORTER —
+         * see the phase-2 comment. Count creations off created_ids; render rows off products.
+         *
          * @param int[] $product_ids Source product IDs.
          * @param int   $count       Number of copies to create per source product.
          * @return array { success: true, products: [ ... ], failed: [ ... ] }
+         * @return array { success: true, created_ids: int[], products: [ ... ], failed: [ ... ], warnings?: string[] }
          */
         public function duplicate_products( array $product_ids, int $count = 1 ): array {
 …
                 $products           = [];
+                $fresh_products     = [];
                 $failed             = [];
                 $total_var_failures = 0;
 …
                 if ( empty( $product_ids ) ) {
                         return [
+                                'success'  => true,
+                                'products' => [],
+                                'failed'   => [],
+                                'success'     => true,
+                                'created_ids' => [],
+                                'products'    => [],
+                                'failed'      => [],
                         ];
+                }
 …
                                 $duplicate->set_tag_ids( $source->get_tag_ids() );
                                 $duplicate->set_attributes( $source->get_attributes() );
+                                $duplicate->set_upsell_ids( $source->get_upsell_ids() );
+                                $duplicate->set_cross_sell_ids( $source->get_cross_sell_ids() );
+                                // 'edit' context: the view getters run through
+                                // woocommerce_product_get_upsell_ids / _cross_sell_ids, which third-party
+                                // code can filter. Copying a filtered projection would bake that plugin's
+                                // display-time view permanently into the duplicate's stored data.
+                                $duplicate->set_upsell_ids( $source->get_upsell_ids( 'edit' ) );
+                                $duplicate->set_cross_sell_ids( $source->get_cross_sell_ids( 'edit' ) );
                                 if ( $source->is_type( 'variable' ) ) {
 …
+                                        }
+                                        // Re-read from DB to get full data (variation_count, etc.).
+                                        // Re-read from DB to get full data (variation_count, etc.). Formatting is
+                                        // deferred until every duplicate exists, so linked-product descriptors
+                                        // are resolved in one batch rather than per copy — a clone carries the
+                                        // source's upsells/cross-sells, so every duplicate has refs to resolve.
                                         $fresh = wc_get_product( $duplicate->get_id() );
                                         if ( $fresh ) {
                                                 $products[] = Product_Helper::format_product( $fresh );
+                                                $fresh_products[] = $fresh;
+                                        }
                                 } catch ( \Exception $e ) {
 …
+                }
+                // Every duplicate above is already IN THE DATABASE. Formatting is presentation, so
+                // nothing below may throw out of this method: an uncaught exception becomes a 500 (no
+                // REST caller wraps us), the client reports "Failed to duplicate products", and the user
+                // retries — creating a SECOND set of copies. \Throwable, not \Exception: third-party
+                // callbacks on wcabe_g2_format_product raise Error/TypeError as readily as Exception.
+                //
+                // created_ids is the truthful record of what was WRITTEN. $products is only what could
+                // also be RENDERED, and may be shorter. Never conflate them: the client counts creations
+                // off created_ids and prepends rows off products.
+                //
+                // TOP-LEVEL ONLY. $fresh_products holds parent duplicates; the variations that
+                // duplicate_variations() saves are deliberately never collected here. Including them
+                // would inflate the "Duplicated N products" count and auto-select variation rows.
+                $created_ids     = array_map( static fn( $p ) => $p->get_id(), $fresh_products );
+                $format_failures = 0;
+                if ( ! empty( $fresh_products ) ) {
+                        $ref_map = null;
+                        try {
+                                // The hook lets Free's attribute handler and Pro's taxonomy handler warm their
+                                // caches before the loop, matching the contract get_products() and batch_update()
+                                // follow.
+                                do_action( 'wcabe_g2_before_format_products', $created_ids );
+                                $ref_map = Product_Helper::build_product_ref_map( $fresh_products );
+                        } catch ( \Throwable $e ) {
+                                // null, NOT []. An empty map makes project_product_refs() mark every ref dead;
+                                // null makes format_product() self-resolve per product — slower, but correct.
+                                $ref_map = null;
+                        }
+                        foreach ( $fresh_products as $fresh ) {
+                                try {
+                                        $products[] = Product_Helper::format_product( $fresh, $ref_map );
+                                } catch ( \Throwable $e ) {
+                                        // SKIP the row — never push null. useProductOperations' toast reducer does
+                                        // `'variation_count' in p`, which TypeErrors on a null element. The duplicate
+                                        // exists; created_ids still counts it, and the warning below tells the user
+                                        // to reload to see it.
+                                        $format_failures++;
+                                }
+                        }
+                }
                 $result = [
+                        'success'  => true,
+                        'products' => $products,
+                        'failed'   => $failed,
+                        'success'     => true,
+                        'created_ids' => $created_ids,
+                        'products'    => $products,
+                        'failed'      => $failed,
                 ];
+                $warnings = [];
                 if ( $total_var_failures > 0 ) {
+                        $result['warnings'] = [
+                                sprintf(
+                                        /* translators: %d: number of failed variations */
+                                        __( '%d variation(s) failed to duplicate.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        $total_var_failures
+                                ),
+                        ];
+                        $warnings[] = sprintf(
+                                /* translators: %d: number of failed variations */
+                                __( '%d variation(s) failed to duplicate.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                $total_var_failures
+                        );
+                }
+                if ( $format_failures > 0 ) {
+                        // Appended, never replacing — a run can hit both a variation failure and a format
+                        // failure, and dropping either would misreport what happened.
+                        $warnings[] = sprintf(
+                                /* translators: %d: number of duplicates that were created but could not be displayed */
+                                __( '%d duplicate(s) were created but could not be displayed. Reload to see them.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                $format_failures
+                        );
+                }
+                if ( ! empty( $warnings ) ) {
+                        $result['warnings'] = $warnings;
+                }

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Services/Product_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Handlers\WP_Save_Hooks_Handler;
 use WCABE_G2\Helpers\Product_Helper;
 …
 class Product_Service {
+        /** Allowed Title-search match modes. */
+        public const TITLE_SEARCH_MODES = [ 'phrase', 'all', 'any' ];
+        /** Allowed Product URL filter match modes (mirrors ProductUrlOperator in TS). */
+        public const PRODUCT_URL_OPERATORS = [ 'contains', 'not_contains', 'starts_with', 'ends_with', 'is_empty', 'is_not_empty' ];
+        /**
+         * Allowed SKU-search match modes (mirrors SkuSearchMode in TS).
+         *
+         * The empty string is deliberately NOT a member: it is the "auto" state,
+         * which routes to the legacy branch (comma-separated => exact IN, single
+         * term => substring LIKE). Keeping it out of the list means every
+         * `in_array( $mode, self::SKU_SEARCH_MODES, true )` gate treats auto and
+         * garbage identically — both fall back to legacy.
+         */
+        public const SKU_SEARCH_MODES = [ 'contains', 'is_exactly', 'not_contains', 'starts_with', 'ends_with' ];
+        /**
+         * Cap on the number of comma-separated tokens a SKU search term expands to.
+         *
+         * Unlike title search (10 words, a typo-tolerance affordance), pasting a
+         * large SKU list is a genuine bulk-edit workflow, so this is generous. It
+         * still exists because each token becomes its own LIKE/NOT LIKE clause,
+         * doubled again for the variation subquery when include_variations is on —
+         * an unbounded paste is a self-inflicted slow-query / DB-error risk on an
+         * otherwise `manage_woocommerce`-gated endpoint.
+         */
+        public const SKU_SEARCH_MAX_TOKENS = 200;
+        /**
+         * Whether a Product URL operator takes no value.
+         *
+         * These stay effective with an empty value, unlike every other text filter —
+         * callers must not gate them behind a truthiness check on the value.
+         *
+         * @param string $operator
+         * @return bool
+         */
+        public static function is_product_url_empty_check( string $operator ): bool {
+                return 'is_empty' === $operator || 'is_not_empty' === $operator;
+        }
+        /**
+         * Whether the Product URL filter is effective for a given operator/value pair.
+         *
+         * @param string $operator
+         * @param string $value
+         * @return bool
+         */
+        public static function product_url_filter_is_effective( string $operator, string $value ): bool {
+                return '' !== trim( $value ) || self::is_product_url_empty_check( $operator );
+        }
+        /**
+         * Normalise a raw search_sku_mode filter value to a known mode or '' (auto).
+         *
+         * Deliberately untyped: a direct service caller can put anything in the
+         * filter bag (an array from a malformed request shape, null, an int), and a
+         * `string` type hint would raise a TypeError before this could fall back.
+         * Every consumer — the SQL builder AND the per-variation matching mirrors —
+         * routes through here, so an invalid mode can never make the SQL take the
+         * legacy branch while variation narrowing takes a different one.
+         *
+         * @param mixed $mode Raw filter value.
+         * @return string One of self::SKU_SEARCH_MODES, or '' for auto/legacy.
+         */
+        public static function normalize_sku_mode( $mode ): string {
+                return is_string( $mode ) && in_array( $mode, self::SKU_SEARCH_MODES, true ) ? $mode : '';
+        }
+        /**
+         * Split a search_sku term into its comma-separated tokens.
+         *
+         * Filters on `'' !== $token` rather than array_filter()'s default
+         * truthiness: "0" is a valid WooCommerce SKU and must survive.
+         *
+         * Truncated to self::SKU_SEARCH_MAX_TOKENS. The cap lives HERE — not in the
+         * SQL builder alone — because this is the one function both the SQL builder
+         * and the PHP variation-narrowing mirror call to get their token list. A cap
+         * applied only on the SQL side would silently reopen the exact SQL/mirror
+         * divergence match modes were built to close: the query would ignore
+         * tokens past the limit while the mirror kept honouring all of them.
+         *
+         * @param string $term Raw (already sanitized) search_sku value.
+         * @return string[] Zero or more non-empty tokens, re-indexed, capped.
+         */
+        private static function split_sku_term( string $term ): array {
+                $tokens = array_map( 'sanitize_text_field', array_map( 'trim', explode( ',', $term ) ) );
+                $tokens = array_values(
+                        array_filter(
+                                $tokens,
+                                static fn( string $token ): bool => '' !== $token
+                        )
+                );
+                return array_slice( $tokens, 0, self::SKU_SEARCH_MAX_TOKENS );
+        }
+        /** Signed 32-bit bounds for wp_posts.menu_order (a MySQL signed INT). */
+        public const MENU_ORDER_MIN = -2147483648;
+        public const MENU_ORDER_MAX = 2147483647;
+        /**
+         * Private WP_Query marker scoping search_products()'s posts_join / posts_where callbacks
+         * to our own query. Without it those filters would apply to every WP_Query alive while
+         * they are registered — see the comment at the callbacks.
+         */
+        private const REF_SEARCH_QUERY_VAR = 'wcabe_ref_search';
+        /**
+         * Private WP_Query marker scoping get_products()'s Product URL posts_join / posts_where
+         * callbacks to our own query. Same rationale and shape as REF_SEARCH_QUERY_VAR above —
+         * see the comment at those callbacks.
+         */
+        private const PRODUCT_URL_QUERY_VAR = 'wcabe_product_url_filter';
         /**
 …
                 'simple'   => [
                         'name', 'sku', 'regular_price', 'sale_price', 'stock_quantity', 'stock_status', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'weight', 'length', 'width', 'height',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
                         'date_on_sale_from', 'date_on_sale_to',
                         'featured', 'virtual', 'downloadable',
                         'manage_stock', 'backorders',
                         'image_id', 'gallery_image_ids',
+                        'upsell_ids', 'cross_sell_ids',
+                        'menu_order',
                 ],
                 'variable' => [
                         'name', 'sku', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'weight', 'length', 'width', 'height',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
                         'featured',
                         'manage_stock', 'stock_quantity', 'stock_status', 'backorders',
                         'image_id', 'gallery_image_ids',
+                        'upsell_ids', 'cross_sell_ids',
+                        'menu_order',
                 ],
                 'variation' => [
                         'sku', 'regular_price', 'sale_price', 'stock_quantity', 'stock_status', 'status',
+                        'cogs_value',
                         'description',
                         'weight', 'length', 'width', 'height',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
                         'date_on_sale_from', 'date_on_sale_to',
                         'virtual', 'downloadable',
                         'manage_stock', 'backorders',
                         'image_id',
+                        'menu_order',
                 ],
                 'grouped'  => [
                         'name', 'sku', 'status', 'catalog_visibility',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'featured',
                         'image_id', 'gallery_image_ids',
+                        // Upsells only. WooCommerce hides Cross-sells on grouped and external products
+                        // (hide_if_grouped hide_if_external in its Linked Products metabox): cross-sells are
+                        // promoted in the CART, and neither type is ever added to the cart. Writing them
+                        // would persist meta that nothing ever renders. Upsells have no such restriction.
+                        'upsell_ids',
+                        'menu_order',
                 ],
                 'external' => [
                         'name', 'sku', 'regular_price', 'sale_price', 'stock_status', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
                         'categories', 'tags', 'description', 'short_description',
                         'weight', 'length', 'width', 'height',
 …
                         'featured', 'virtual', 'downloadable',
                         'image_id', 'gallery_image_ids',
+                        // Upsells only — see the grouped note above.
+                        'upsell_ids',
+                        'menu_order',
+                        // External-only: the add-to-cart button label (WC_Product_External).
+                        'button_text',
+                        // External-only: the affiliate/destination link (WC_Product_External).
+                        'product_url',
                 ],
+                // WooCommerce Product Bundles (third-party type, #137). The 'simple' list
+                // minus virtual/downloadable — Bundles derives those from its own
+                // "assembled/unassembled" settings, so direct writes would fight the plugin.
+                // Prices and stock are valid: static-priced bundles store them natively.
+                'bundle'   => [
+                        'name', 'sku', 'regular_price', 'sale_price', 'stock_quantity', 'stock_status', 'status', 'catalog_visibility',
+                        'cogs_value',
+                        'date_created',
+                        'categories', 'tags', 'description', 'short_description',
+                        'weight', 'length', 'width', 'height', 'shipping_class',
+                        'date_on_sale_from', 'date_on_sale_to',
+                        'featured',
+                        'manage_stock', 'backorders',
+                        'image_id', 'gallery_image_ids',
+                        'upsell_ids', 'cross_sell_ids',
+                        'menu_order',
+                ],
+        ];
+        /**
+         * Conservative allowlist for product types with no curated ALLOWED_FIELDS
+         * entry (third-party types such as 'subscription', 'composite', 'booking').
+         * Type-agnostic post/taxonomy-level fields only — no prices, stock, or
+         * virtual/downloadable, because third-party types commonly derive those
+         * (e.g. Subscriptions syncs price from its own subscription fields).
+         * Cross-sells excluded for the same reason as grouped/external: we cannot
+         * know the type is cart-addable. Mirrored in the TS DEFAULT_EDITABLE_FIELDS
+         * (editable-fields.ts) — keep both in lockstep.
+         */
+        private const DEFAULT_ALLOWED_FIELDS = [
+                'name', 'sku', 'status', 'catalog_visibility',
+                'date_created',
+                'categories', 'tags', 'description', 'short_description',
+                'weight', 'length', 'width', 'height', 'shipping_class',
+                'featured',
+                'image_id', 'gallery_image_ids',
+                'upsell_ids',
+                'menu_order',
         ];
 …
         /**
+         * All queryable product types: the WooCommerce natives plus every type a
+         * third-party plugin has registered via the product-type selector (e.g.
+         * 'bundle', 'subscription', 'composite'). The natives are merged in
+         * explicitly so a plugin that filters its own type out of
+         * wc_get_product_types() cannot hide native products from the grid.
+         *
+         * @return string[] Product type slugs.
+         */
+        public static function get_known_product_types(): array {
+                return array_values( array_unique( array_merge(
+                        [ 'simple', 'variable', 'grouped', 'external' ],
+                        array_map( 'strval', array_keys( wc_get_product_types() ) )
+                ) ) );
+        }
+        /**
+         * Variable-capable product types: 'variable' plus every registered type
+         * whose product class extends WC_Product_Variable (e.g. WC Subscriptions'
+         * 'variable-subscription'). These are the types whose rows carry variations
+         * the grid can count, interleave, and expand (#137 follow-up).
+         *
+         * Object-context checks use `instanceof \WC_Product_Variable` directly;
+         * this list serves the query paths (tax_query terms, SQL clauses) that run
+         * before any product object exists. Both derive from the same truth — the
+         * registered product class.
+         *
+         * Deliberately uncached: wc_get_product_types() is a filter call and
+         * get_product_classname() is cheap, and callers outside per-row loops keep
+         * the call count small.
+         *
+         * @return string[] Product type slugs.
+         */
+        public static function get_variable_product_types(): array {
+                $types = [ 'variable' ];
+                foreach ( array_keys( wc_get_product_types() ) as $slug ) {
+                        $classname = \WC_Product_Factory::get_product_classname( 0, (string) $slug );
+                        if ( is_a( $classname, \WC_Product_Variable::class, true ) ) {
+                                $types[] = (string) $slug;
+                        }
+                }
+                return array_values( array_unique( $types ) );
+        }
+        /**
          * Get paginated products.
+         *
+         * @param int   $page
+         * @param int   $per_page
+         * @param bool  $include_variations
+         * @param array $filters Optional filter criteria.
+         * @param int    $page
+         * @param int    $per_page
+         * @param bool   $include_variations
+         * @param array  $filters Optional filter criteria.
+         * @param string $orderby Sort column: 'id' (default) or 'menu_order'.
+         * @param string $order   Sort direction: 'asc' or 'desc' (default).
          * @return array
          */
 …
                 int $per_page = 100,
                 bool $include_variations = false,
+                array $filters = []
+                array $filters = [],
+                string $orderby = 'id',
+                string $order = 'desc'
         ): array {
                 $query_result = $this->get_products_wc_crud( $page, $per_page, $filters, $include_variations );
+                $query_result = $this->get_products_wc_crud( $page, $per_page, $filters, $include_variations, false, $orderby, $order );
                 // Allow Pro to prime caches before per-product formatting.
 …
                 do_action( 'wcabe_g2_before_format_products', $product_ids );
+                // Prime the post cache for all gallery attachment IDs in a single query
+                // so that wp_get_attachment_image_url() inside format_product() hits the
+                // object cache instead of making individual DB queries (N+1 prevention).
+                $gallery_ids_to_prime = [];
+                // Prime the post cache for every attachment ID referenced on this page — the
+                // gallery IDs and each product's featured image — in a single query, so that
+                // wp_get_attachment_image_url() and get_image_upload_date() inside
+                // format_product() hit the object cache instead of making individual DB
+                // queries (N+1 prevention).
+                $attachment_ids_to_prime = [];
                 foreach ( $query_result['products'] as $product ) {
                         $gids = $product->get_gallery_image_ids();
                         if ( ! empty( $gids ) ) {
+                                array_push( $gallery_ids_to_prime, ...$gids );
+                        }
+                }
+                if ( ! empty( $gallery_ids_to_prime ) ) {
+                        _prime_post_caches( array_unique( $gallery_ids_to_prime ), false, false );
+                }
+                $formatted = array_map( [ Product_Helper::class, 'format_product' ], $query_result['products'] );
+                                array_push( $attachment_ids_to_prime, ...$gids );
+                        }
+                        // Both contexts: view feeds wp_get_attachment_image_url() (thumbnail_url),
+                        // edit/raw feeds get_image_upload_date() (image_date). They differ only
+                        // when a plugin hooks woocommerce_product_get_image_id; array_unique
+                        // below collapses them on every other site.
+                        $featured_id = (int) $product->get_image_id();
+                        if ( $featured_id > 0 ) {
+                                $attachment_ids_to_prime[] = $featured_id;
+                        }
+                        $raw_featured_id = (int) $product->get_image_id( 'edit' );
+                        if ( $raw_featured_id > 0 && $raw_featured_id !== $featured_id ) {
+                                $attachment_ids_to_prime[] = $raw_featured_id;
+                        }
+                }
+                if ( ! empty( $attachment_ids_to_prime ) ) {
+                        _prime_post_caches( array_unique( $attachment_ids_to_prime ), false, false );
+                }
+                // Batch-resolve every upsell/cross-sell ref on the page in one pass. Returns []
+                // (and primes nothing) when no product on the page has refs, so stores that don't
+                // use these fields pay nothing. Must be passed into format_product() explicitly —
+                // array_map() would only pass one arg, and the null fallback would resolve each
+                // product's refs individually, i.e. the N+1 this exists to prevent.
+                $ref_map = Product_Helper::build_product_ref_map( $query_result['products'] );
+                $formatted = array_map(
+                        static fn( $product ) => Product_Helper::format_product( $product, $ref_map ),
+                        $query_result['products']
+                );
                 // Interleave variations if requested.
 …
                         $variation_ids_to_prime = [];
                         foreach ( $query_result['products'] as $product ) {
+                                if ( $product->is_type( 'variable' ) ) {
+                                // instanceof, not is_type('variable'): third-party variable
+                                // subclasses (variable-subscription, …) carry variations too (#137).
+                                if ( $product instanceof \WC_Product_Variable ) {
                                         $children = $product->get_children();
                                         $children_map[ $product->get_id() ] = $children;
 …
+                }
+                if ( ! $product->is_type( 'variable' ) ) {
+                // instanceof, not is_type('variable'): accepts third-party variable
+                // subclasses (variable-subscription, …) whose children are real
+                // variations (#137).
+                if ( ! $product instanceof \WC_Product_Variable ) {
                         return new \WP_Error(
                                 'not_variable',
 …
         /**
+         * Default page size for stream_products() when the caller doesn't specify one.
+         *
+         * The variation-mode value is deliberately smaller. Page size bounds PARENTS,
+         * not emitted rows: get_products() primes and formats every variation of a
+         * page's parents before the stream can slice, so a variation-heavy page is the
+         * export's residual memory spike. 25 parents reduces the typical spike (a single
+         * parent with hundreds of variations can still exceed it).
+         */
+        private const STREAM_PAGE_SIZE            = 100;
+        private const STREAM_PAGE_SIZE_VARIATIONS = 25;
+        /**
+         * Page through filtered products, handing each formatted page to $consumer.
+         *
+         * The export path's collection seam. Nothing accumulates here — each page is
+         * released before the next query runs — which is what keeps a 10k-row export
+         * inside a modest memory_limit. Lives in the service (not the controller)
+         * because Export_Controller::export() terminates with exit() and so cannot be
+         * reached from PHPUnit; this method is the covered half.
+         *
+         * $consumer is called once per NON-EMPTY page. Cache releases run for every
+         * page regardless, including pages that yielded nothing and pages whose
+         * collection or consumption threw.
+         *
+         * @param array    $filters            Sanitized filters.
+         * @param bool     $include_variations Interleave variations under their parents.
+         * @param int      $max_rows           Hard cap on total rows emitted.
+         * @param callable $consumer           fn( array $formatted_rows ): void
+         * @param int|null $per_page           Page size. Null = STREAM_PAGE_SIZE(_VARIATIONS).
+         * @return int Total rows emitted (0..$max_rows).
+         */
+        public function stream_products(
+                array $filters,
+                bool $include_variations,
+                int $max_rows,
+                callable $consumer,
+                ?int $per_page = null
+        ): int {
+                if ( $max_rows <= 0 ) {
+                        return 0;
+                }
+                if ( null === $per_page ) {
+                        $per_page = $include_variations ? self::STREAM_PAGE_SIZE_VARIATIONS : self::STREAM_PAGE_SIZE;
+                }
+                // The export never reads total_with_variations, but get_products() would run
+                // an extra COUNT for it on EVERY page. Suppress it for the duration of the
+                // loop. A unique closure, not __return_false: removing the shared string
+                // callback could unhook a registration someone else made.
+                $suppress_variation_total = static fn() => false;
+                add_filter( 'wcabe_g2_compute_variation_total', $suppress_variation_total, 999 );
+                $count = 0;
+                $page  = 1;
+                try {
+                        do {
+                                // Collection lives INSIDE the try: get_products() primes caches and runs
+                                // third-party format filters (Pro's ACF reads, for one), so a throw
+                                // during collection must still release what it allocated.
+                                try {
+                                        $result      = $this->get_products( $page, $per_page, $include_variations, $filters );
+                                        $rows        = $result['products'];
+                                        $total_pages = (int) $result['total_pages'];
+                                        // Detach the page from $result before the next query, or two pages
+                                        // would be live at once.
+                                        unset( $result );
+                                        // Interleaved variations mean a page can overshoot the budget
+                                        // mid-page. Slicing per page is equivalent to the old
+                                        // accumulate-then-slice: slicing a concatenation at N is slicing the
+                                        // last contributing page.
+                                        $remaining = $max_rows - $count;
+                                        if ( count( $rows ) > $remaining ) {
+                                                $rows = array_slice( $rows, 0, $remaining );
+                                        }
+                                        $count += count( $rows );
+                                        if ( ! empty( $rows ) ) {
+                                                $consumer( $rows );
+                                        }
+                                } finally {
+                                        unset( $rows );
+                                        Product_Helper::flush_runtime_cache();
+                                        /**
+                                         * Fires after each export chunk has been consumed and released.
+                                         *
+                                         * Extensions (Pro) use this to drop their own request-local caches —
+                                         * ACF, for instance, retains every field value it reads for the whole
+                                         * request, which would otherwise grow with rows × fields.
+                                         */
+                                        do_action( 'wcabe_g2_export_after_chunk' );
+                                }
+                                $page++;
+                        } while ( $count < $max_rows && $page <= $total_pages );
+                } finally {
+                        remove_filter( 'wcabe_g2_compute_variation_total', $suppress_variation_total, 999 );
+                }
+                return $count;
+        }
+        /**
+         * Chunked variant of get_products_by_ids() — the "export selected rows" stream.
+         *
+         * Same contract as get_products_by_ids() (normalise, clamp BEFORE any read, drop
+         * non-products, prime once per batch), but only one chunk of WC_Product objects
+         * and formatted arrays is live at a time.
+         *
+         * One intentional difference: the shared ref map and the
+         * wcabe_g2_before_format_products batch span a chunk rather than the whole
+         * selection. Output is identical; selections over $chunk_size pay slightly more
+         * priming queries in exchange for bounded memory.
+         *
+         * @param int[]    $ids
+         * @param int      $max_rows   Hard cap on total rows emitted.
+         * @param callable $consumer   fn( array $formatted_rows ): void
+         * @param int      $chunk_size Ids per batch.
+         * @return int Total rows emitted (0..$max_rows).
+         */
+        public function stream_products_by_ids(
+                array $ids,
+                int $max_rows,
+                callable $consumer,
+                int $chunk_size = 100
+        ): int {
+                if ( $max_rows <= 0 ) {
+                        return 0;
+                }
+                // Clamp the NORMALISED list before any read, so a 50k-id request cannot fan out.
+                $ids = Product_Helper::normalize_product_ids( $ids, $max_rows );
+                if ( empty( $ids ) ) {
+                        return 0;
+                }
+                $count = 0;
+                foreach ( array_chunk( $ids, max( 1, $chunk_size ) ) as $chunk ) {
+                        // Collection inside the try for the same reason as stream_products():
+                        // it primes caches and runs format filters before it can return.
+                        try {
+                                $rows   = $this->get_products_by_ids( $chunk, count( $chunk ) );
+                                $count += count( $rows );
+                                // A chunk of only dead ids yields nothing — but it still primed post
+                                // caches, so the release in finally still has work to do.
+                                if ( ! empty( $rows ) ) {
+                                        $consumer( $rows );
+                                }
+                        } finally {
+                                unset( $rows );
+                                Product_Helper::flush_runtime_cache();
+                                /** This filter is documented in Product_Service::stream_products(). */
+                                do_action( 'wcabe_g2_export_after_chunk' );
+                        }
+                }
+                return $count;
+        }
+        /**
+         * Format an explicit list of product/variation IDs — the "export selected rows" path.
+         *
+         * Lives here, not in Export_Controller, for two reasons. It is product-collection logic,
+         * which is a service concern (the controller does route parsing and response shaping).
+         * And Export_Controller::export() terminates with exit(), so anything inlined there is
+         * unreachable from PHPUnit — this seam is what makes the selected-rows export testable.
+         *
+         * Contract, in order:
+         *   1. Normalise to positive ints, dedupe (FIRST occurrence wins), preserve caller order.
+         *      intval, not absint — absint( -7 ) is 7, which would export an unrelated product.
+         *   2. Clamp the NORMALISED list to $limit, before any read, so a 50k-id request cannot
+         *      fan out and so duplicates don't eat the budget.
+         *   3. Drop ids that are not a product or variation (deleted, or never one).
+         *   4. Prime once, then format once against ONE shared ref map — never per row.
+         *
+         * @param int[] $ids
+         * @param int   $limit Max rows to return.
+         * @return array[] Formatted product/variation arrays, in the caller's id order.
+         */
+        public function get_products_by_ids( array $ids, int $limit ): array {
+                if ( $limit <= 0 ) {
+                        return [];
+                }
+                $source_ids = Product_Helper::prime_product_caches( $ids, $limit );
+                if ( empty( $source_ids ) ) {
+                        return [];
+                }
+                $wc_products = [];
+                foreach ( $source_ids as $id ) {
+                        $wc_product = wc_get_product( $id );
+                        if ( $wc_product ) {
+                                $wc_products[] = $wc_product;
+                        }
+                }
+                if ( empty( $wc_products ) ) {
+                        return [];
+                }
+                // Same contract as get_products() and batch_update(): let Free's attribute handler and
+                // Pro's taxonomy handler warm their caches before the formatting loop.
+                do_action( 'wcabe_g2_before_format_products', array_map( static fn( $p ) => $p->get_id(), $wc_products ) );
+                // ONE ref map for the whole selection. Formatting per product with no map would resolve
+                // each row's refs individually — the N+1 this exists to prevent, up to $limit rows deep.
+                $ref_map = Product_Helper::build_product_ref_map( $wc_products );
+                $products = [];
+                foreach ( $wc_products as $wc_product ) {
+                        $products[] = $wc_product->is_type( 'variation' )
+                                ? Product_Helper::format_variation( $wc_product )
+                                : Product_Helper::format_product( $wc_product, $ref_map );
+                }
+                return $products;
+        }
+        /**
+         * Search products and variations for the linked-product picker.
+         *
+         * Deliberately NOT WC_Data_Store::search_products(). Core's query has three properties
+         * that are wrong for a picker:
+         *
+         *  1. It matches post_content and post_excerpt, and applies its LIMIT in SQL (ordered by
+         *     post_parent, post_title). A term appearing in a hundred product descriptions
+         *     therefore truncates the candidate set BEFORE any post-filter can run — the real
+         *     title/SKU match is never returned at all. Recall loss no downstream filter can fix.
+         *  2. It appends a numeric-ID hit AFTER its SQL exclusion and status filtering, with no
+         *     exclude check and no status check — so a numeric term defeats $exclude (a product
+         *     could offer itself as its own upsell) and resurrects drafts.
+         *  3. It surfaces the PARENTS of matching variations; a picker needs the variation itself.
+         *
+         * This searches exactly the three fields a picker should search — post_title, sku and
+         * global_unique_id (GTIN/EAN, which G1 never had) — so content-only matches cannot enter
+         * the candidate set by construction, and applies exclusion, post type and status
+         * uniformly, including to the numeric pin.
+         *
+         * Variations are included as selectable targets, matching WooCommerce core's own Linked
+         * Products metabox.
+         *
+         * @param string $term    Search term (title, SKU, GTIN, or a bare product ID).
+         * @param int[]  $exclude Product IDs to omit (e.g. the product being edited).
+         * @param int    $limit   Max results (clamped to 1..50).
+         * @return array[] Ordered ref descriptors: [ id, name, sku, type, status, missing ].
+         */
+        public function search_products( string $term, array $exclude = [], int $limit = 30 ): array {
+                global $wpdb;
+                $term = trim( $term );
+                if ( '' === $term ) {
+                        return [];
+                }
+                $exclude = array_values( array_filter( array_map( 'intval', $exclude ), static fn( $id ) => $id > 0 ) );
+                $limit   = max( 1, min( $limit, 50 ) );
+                // Same status vocabulary WooCommerce uses for its own product search: private
+                // products are visible only to users who may edit them.
+                $post_statuses = current_user_can( 'edit_private_products' )
+                        ? [ 'private', 'publish' ]
+                        : [ 'publish' ];
+                $like        = '%' . $wpdb->esc_like( $term ) . '%';
+                $name_clause = $this->build_name_search_clause( $wpdb, $term, 'phrase' );
+                // Both callbacks take the WP_Query and bail unless it carries our private marker.
+                // posts_join / posts_where fire on EVERY WP_Query for as long as they are registered —
+                // including any a third-party pre_get_posts listener spins up inside ours. Unscoped,
+                // those queries would inherit our WHERE; and because the JOIN is added only once (the
+                // strpos guard), a nested query could even receive the wcabe_ref_lookup WHERE WITHOUT
+                // the JOIN and hard-fail on an unknown column. Same guard shape as
+                // Pro_Revision_Filter_Handler::filter_post_mime_where().
+                $join_callback = static function ( string $join, \WP_Query $query ) use ( $wpdb ): string {
+                        if ( ! $query->get( self::REF_SEARCH_QUERY_VAR ) ) {
+                                return $join;
+                        }
+                        if ( false === strpos( $join, 'wcabe_ref_lookup' ) ) {
+                                $join .= " LEFT JOIN {$wpdb->prefix}wc_product_meta_lookup AS wcabe_ref_lookup ON {$wpdb->posts}.ID = wcabe_ref_lookup.product_id ";
+                        }
+                        return $join;
+                };
+                $where_callback = static function ( string $where, \WP_Query $query ) use ( $wpdb, $name_clause, $like ): string {
+                        if ( ! $query->get( self::REF_SEARCH_QUERY_VAR ) ) {
+                                return $where;
+                        }
+                        $sku_clause = $wpdb->prepare(
+                                '( wcabe_ref_lookup.sku LIKE %s OR wcabe_ref_lookup.global_unique_id LIKE %s )',
+                                $like,
+                                $like
+                        );
+                        // Title OR SKU OR GTIN. No post_content, no post_excerpt — that is the point.
+                        return $where . " AND ( {$name_clause} OR {$sku_clause} ) ";
+                };
+                add_filter( 'posts_join', $join_callback, 10, 2 );
+                add_filter( 'posts_where', $where_callback, 10, 2 );
+                try {
+                        $query = new \WP_Query( [
+                                'post_type'                 => [ 'product', 'product_variation' ],
+                                'post_status'               => $post_statuses,
+                                'post__not_in'              => $exclude,
+                                'posts_per_page'            => $limit,
+                                'fields'                    => 'ids',
+                                'orderby'                   => 'title',
+                                'order'                     => 'ASC',
+                                // No total is consumed, so skip SQL_CALC_FOUND_ROWS.
+                                'no_found_rows'             => true,
+                                'ignore_sticky_posts'       => true,
+                                // resolve_product_ref_ids() primes exactly the caches it needs.
+                                'update_post_meta_cache'    => false,
+                                'update_post_term_cache'    => false,
+                                // The marker the two callbacks above key off. Private to us.
+                                self::REF_SEARCH_QUERY_VAR  => true,
+                        ] );
+                        $ids = array_map( 'intval', (array) $query->posts );
+                } finally {
+                        remove_filter( 'posts_join', $join_callback, 10 );
+                        remove_filter( 'posts_where', $where_callback, 10 );
+                }
+                // Numeric ID pin — our ID search; core does not offer one.
+                //
+                // ctype_digit(), NOT is_numeric(). is_numeric() also accepts '1.5', '1e3', '+12' and
+                // '-7', every one of which is a legitimate SKU to search for — and absint('1e3') is
+                // 1000, so searching for a SKU literally named "1e3" would pin an unrelated product
+                // #1000 into the results. Core's search_products() has exactly this bug.
+                //
+                // Exclusion, post type and status are applied HERE, to the pin itself. Core appends
+                // its numeric hit after those filters, which is precisely how a numeric term ends up
+                // defeating $exclude and resurrecting drafts.
+                if ( ctype_digit( $term ) ) {
+                        $pin_id = absint( $term );
+                        if ( $pin_id > 0 && ! in_array( $pin_id, $exclude, true ) ) {
+                                $pin_post = get_post( $pin_id );
+                                if (
+                                        $pin_post
+                                        && in_array( $pin_post->post_type, [ 'product', 'product_variation' ], true )
+                                        && in_array( $pin_post->post_status, $post_statuses, true )
+                                ) {
+                                        array_unshift( $ids, $pin_id );
+                                        // array_unique keeps the FIRST occurrence, so the pin stays on top.
+                                        $ids = array_values( array_unique( $ids ) );
+                                }
+                        }
+                }
+                $ids = array_slice( $ids, 0, $limit );
+                if ( empty( $ids ) ) {
+                        return [];
+                }
+                // Resolve the search HITS themselves. resolve_product_ref_ids(), never
+                // build_product_ref_map() — the latter takes owners and would hand back each hit's
+                // upsells instead of the hit.
+                $map = Product_Helper::resolve_product_ref_ids( $ids );
+                return array_values( array_filter( array_map(
+                        static fn( int $id ) => $map[ $id ] ?? null,
+                        $ids
+                ) ) );
+        }
+        /**
          * Batch update products.
+         *
+         * @param array $items Array of [ 'id' => int, 'changes' => array ].
+         * @param array $items   Array of [ 'id' => int, 'changes' => array ].
+         * @param array $context Optional per-save context threaded through to the
+         *                       `wcabe_g2_before_product_save` hook. Shape: [ 'batch_id' => ?string ].
+         *                       Free reads nothing from it; extensions may.
          * @return array Array of per-item results.
+         */
+        public function batch_update( array $items ): array {
+         *
+         * Each item runs one "save cycle", identified by an opaque $save_token threaded
+         * through both the before- and after-save seams, so listeners can correlate the two
+         * halves of ONE cycle even when cycles nest — a save_post listener woken by the
+         * after-save seam can itself call batch_update() on the SAME product id, so post id
+         * alone does not identify a cycle. WP_Save_Hooks_Handler::finish_cycle() in the
+         * finally below is the guaranteed teardown for whatever the before-seam armed.
+         */
+        public function batch_update( array $items, array $context = [] ): array {
                 $results = [];
+                // Successful saves, keyed by their index in $results. Formatting is deferred to
+                // phase 2 (after the loop) so linked-product descriptors are built once, and built
+                // fresh — see the comment there.
+                $saved = [];
+                // Batch-prime post, term, and meta caches for every target id in one pass so the
+                // per-item wc_get_product() below — and any listener on wcabe_g2_before_product_save
+                // that re-reads the product (e.g. Operation History's pre/post-image capture, which
+                // formats each product twice) — hit warm caches instead of firing individual queries
+                // per product. Same N+1-prevention rule get_products() follows; a no-op behaviorally.
+                $prime_ids = [];
+                foreach ( $items as $item ) {
+                        $prime_id = absint( $item['id'] ?? 0 );
+                        if ( $prime_id ) {
+                                $prime_ids[] = $prime_id;
+                        }
+                }
+                if ( ! empty( $prime_ids ) && function_exists( '_prime_post_caches' ) ) {
+                        _prime_post_caches( array_unique( $prime_ids ), true, true );
+                }
                 foreach ( $items as $item ) {
 …
+                        }
+                        // Opaque, unique per save cycle. Generated before anything can fail so the
+                        // finally below always has a token to tear down with — even on paths that
+                        // never armed anything (finish_cycle() no-ops on an unknown token).
+                        $save_token = uniqid( 'wcabe_save_', true );
                         try {
                                 $product = wc_get_product( $id );
 …
                                 $type = $product->get_type();
-                                $allowed_fields = self::ALLOWED_FIELDS[ $type ] ?? [];
-                                $allowed_fields = apply_filters( 'wcabe_g2_allowed_fields', $allowed_fields, $product );
                                 // Validate all changes before applying any.
+                                $validation_errors = $this->validate_changes( $product, $changes, $allowed_fields );
+                                $validation_errors = apply_filters( 'wcabe_g2_validate_extra_fields', $validation_errors, $product, $changes );
+                                $validation        = $this->validate_item( $product, $changes );
+                                $allowed_fields    = $validation['allowed_fields'];
+                                $validation_errors = $validation['errors'];
                                 if ( ! empty( $validation_errors ) ) {
                                         $results[] = [
 …
+                                }
+                                do_action( 'wcabe_g2_before_product_save', $product, $changes, $allowed_fields );
+                                // Pre-save snapshot, read before any listener can mutate the post. Passed to
+                                // the after-seam so listeners get the same $post_before WordPress hands to
+                                // wp_after_insert_post(). Post caches were primed for the whole batch above,
+                                // so this is a cache read, not a query.
+                                $post_before = get_post( $id );
+                                do_action( 'wcabe_g2_before_product_save', $product, $changes, $allowed_fields, $context, $save_token );
                                 $product->save();
+                                $is_variation = $product->is_type( 'variation' );
+                                $data = $is_variation
+                                        ? Product_Helper::format_variation( $product )
+                                        : Product_Helper::format_product( $product );
+                                // THE WRITE HAS COMMITTED. Everything below is notification, and notification
+                                // must never be able to report a committed write as failed — the client would
+                                // surface it as an error and re-send rows that were in fact written.
+                                //
+                                // \Throwable, not \Exception: this seam wakes arbitrary third-party code (its
+                                // whole purpose is firing save_post for sync plugins), and the enclosing
+                                // catch below only takes \Exception — a listener raising Error/TypeError would
+                                // escape batch_update() entirely and 500 the request. Same rule, and the same
+                                // reasoning, as the formatting phase below.
+                                try {
+                                        do_action( 'wcabe_g2_after_product_save', $product, $changes, $context, $post_before, $save_token );
+                                } catch ( \Throwable $t ) {
+                                        $warnings[] = sprintf(
+                                                /* translators: %s: error message from the third-party callback */
+                                                __( 'The product was saved, but another plugin errored while being notified: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                $t->getMessage()
+                                        );
+                                }
                                 $result = [
                                         'id'      => $id,
                                         'success' => true,
                                         'data'    => $data,
+                                        'data'    => null, // Filled in phase 2 below.
                                 ];
 …
                                 $results[] = $result;
+                                // Retain the saved object AND its slot in $results, so phase 2 can write
+                                // each formatted row back in place and the response order is preserved.
+                                $saved[ array_key_last( $results ) ] = $product;
                         } catch ( \Exception $e ) {
 …
                                         ],
                                 ];
+                        } finally {
+                                // Unconditional teardown for this cycle — runs on every exit path, including
+                                // the `continue`s above (validation failure, product not found) and any
+                                // exception. Deliberately a direct static call and NOT a do_action: a public
+                                // teardown hook would let a third-party Throwable escape this finally and
+                                // override an already-successful result, re-opening the exact failure mode
+                                // the after-seam's Throwable isolation just closed. Teardown is an internal
+                                // lifecycle detail, not an extension point.
+                                WP_Save_Hooks_Handler::finish_cycle( $save_token );
+                        }
+                }
+                // --- Phase 2: format every successful save against ONE freshly-built ref map. ---
+                //
+                // Deliberately after ALL saves, never before. A single batch can (a) give a product
+                // new upsell IDs, and (b) rename or re-SKU a product that another row in the same
+                // batch points at. A map built before the loop would miss (a) entirely and carry
+                // stale descriptors for (b). save() invalidates each product's post cache, so the
+                // re-prime inside resolve_product_ref_ids() reads post-write values.
+                //
+                // EVERY WRITE ABOVE HAS ALREADY COMMITTED. Formatting is presentation, so nothing below
+                // may throw out of this method: an uncaught exception here becomes a 500 (no REST caller
+                // wraps us), the client marks the whole chunk failed, and the user re-saves rows that
+                // were in fact written. \Throwable, not \Exception — wcabe_g2_format_product is a public
+                // filter and third-party callbacks raise Error/TypeError as readily as Exception.
+                if ( ! empty( $saved ) ) {
+                        // Re-read every saved product before formatting. NOT an optimisation to be tidied away:
+                        //
+                        // WC_Data::apply_changes() (abstract-wc-data.php:907) merges with array_replace_recursive(),
+                        // and WC_Product does not override it. That merges ARRAY props by INDEX instead of
+                        // replacing them — so an array prop that SHRANK leaves the in-memory object corrupt after
+                        // save(). Upsells [A, B, C] → [B] persists [B] correctly, but the object is left holding
+                        // array_replace_recursive([A,B,C], [B]) === [B, B, C]. Formatting from that object hands
+                        // the grid a row contradicting the write that just succeeded, and the user watches the
+                        // link they removed come straight back. Same trap for gallery_image_ids, categories, tags
+                        // and attributes — every array prop, whenever the new value is shorter than the old.
+                        //
+                        // WooCommerce's own REST controller re-reads after save for exactly this reason
+                        // (WC_REST_CRUD_Controller::save_object). Priming first is what keeps it affordable: post
+                        // and meta for the whole batch come from one prime, so the per-product read stays off the
+                        // query path.
+                        $saved_ids = array_values( array_map( static fn( $p ) => $p->get_id(), $saved ) );
+                        Product_Helper::prime_product_caches( $saved_ids );
+                        foreach ( $saved as $index => $product ) {
+                                $reread = wc_get_product( $product->get_id() );
+                                if ( $reread ) {
+                                        $saved[ $index ] = $reread;
+                                }
+                        }
+                        $ref_map = null;
+                        try {
+                                // Same contract as get_products(): let Free's attribute handler and Pro's
+                                // taxonomy handler warm their caches before a batch formatting loop, or their
+                                // per-product term lookups become the N+1 we just removed from ours.
+                                do_action( 'wcabe_g2_before_format_products', $saved_ids );
+                                $ref_map = Product_Helper::build_product_ref_map( $saved );
+                        } catch ( \Throwable $e ) {
+                                // null, NOT []. project_product_refs() does `$ref_map[$id] ?? missing_product_ref($id)`,
+                                // so an empty map would mark every ref DEAD and tell the user their upsells are
+                                // all broken. null makes format_product() self-resolve per product — an N+1, but
+                                // correct, on a path that should never fire.
+                                $ref_map = null;
+                        }
+                        foreach ( $saved as $index => $product ) {
+                                try {
+                                        $results[ $index ]['data'] = $product->is_type( 'variation' )
+                                                ? Product_Helper::format_variation( $product )
+                                                : Product_Helper::format_product( $product, $ref_map );
+                                } catch ( \Throwable $e ) {
+                                        // The write committed, so `success` stays true — flipping it would strand the
+                                        // pending change client-side and invite a duplicate re-send. Drop the key
+                                        // rather than nulling it: BatchResult.data is declared OPTIONAL (absent), not
+                                        // nullable. The client tolerates a missing data (useSave gates on
+                                        // `item.success && item.data`, and clears the pending change either way), and
+                                        // the background refetch supplies the true row.
+                                        unset( $results[ $index ]['data'] );
+                                }
+                        }
+                }
                 return $results;
+        }
+        /**
+         * Resolve the effective field allowlist and validate a change set — WITHOUT
+         * applying anything.
+         *
+         * VALIDATION ONLY — zero side effects: no setters, no save, no hooks beyond
+         * the two established validation filters. Safe to call as a pure dry-run.
+         *
+         * Deliberate shared extension seam (the first since Phase A's $context arg
+         * on wcabe_g2_before_product_save): batch_update() runs its validation
+         * through this method, and Pro's Operation History pre-flight calls it
+         * directly so restorability is judged by the exact allowlist + validation
+         * pipeline that will perform the write — never by a reimplementation.
+         * Free functions identically without any caller besides batch_update().
+         *
+         * @param \WC_Product $product The product the changes target.
+         * @param array       $changes Field => value map (input vocabulary).
+         * @return array{allowed_fields: array, errors: array} allowed_fields is the
+         *                post-filter allowlist for the product's type; errors is an
+         *                array of [ 'field' => string, 'value' => mixed, 'message' => string ].
+         */
+        public function validate_item( \WC_Product $product, array $changes ): array {
+                $type           = $product->get_type();
+                $allowed_fields = self::ALLOWED_FIELDS[ $type ] ?? self::DEFAULT_ALLOWED_FIELDS;
+                $allowed_fields = apply_filters( 'wcabe_g2_allowed_fields', $allowed_fields, $product );
+                $errors = $this->validate_changes( $product, $changes, $allowed_fields );
+                $errors = apply_filters( 'wcabe_g2_validate_extra_fields', $errors, $product, $changes );
+                return [
+                        'allowed_fields' => $allowed_fields,
+                        'errors'         => $errors,
+                ];
+        }
 …
+                        }
                         // Price validation.
                         if ( in_array( $field, [ 'regular_price', 'sale_price' ], true ) ) {
+                        // Price validation (COGS is a monetary cost — same numeric ≥ 0 rule).
+                        if ( in_array( $field, [ 'regular_price', 'sale_price', 'cogs_value' ], true ) ) {
                                 $sanitized = trim( (string) $value );
                                 if ( '' !== $sanitized ) {
 …
                                                 'value'   => $value,
                                                 'message' => __( 'Stock quantity must be a valid number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                }
+                        } elseif ( 'menu_order' === $field ) {
+                                // Menu order is a signed 32-bit integer (default 0). Empty is allowed
+                                // (treated as 0 on save). Decimals/non-numeric are rejected; so are
+                                // values outside the signed-INT range — WordPress runs MySQL non-strict,
+                                // so an out-of-range value would clamp silently on save.
+                                if ( null !== $value && '' !== $value ) {
+                                        $str = (string) $value;
+                                        if ( ! preg_match( '/^-?\d+$/', $str ) ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => __( 'Menu order must be a whole number.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                ];
+                                        } elseif ( ! self::menu_order_in_int32_range( $str ) ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => __( 'Menu order is out of range.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                ];
+                                        }
+                                }
+                        } elseif ( 'product_url' === $field ) {
+                                // External-product destination link. Policy (server authoritative):
+                                // - non-string (array/object) is rejected outright: esc_url_raw()
+                                //   would throw or a (string) cast would store the literal "Array";
+                                // - empty clears the field;
+                                // - otherwise valid iff esc_url_raw() keeps something, i.e. only
+                                //   disallowed protocols (javascript:, data:, ...) are rejected.
+                                //   Anything wp_allowed_protocols() permits (http, https, ftp,
+                                //   mailto, tel, ...) is accepted, matching WooCommerce's own
+                                //   product-data panel — being stricter would break bulk
+                                //   prepend/append over legitimately stored non-http values.
+                                //   Schemeless input ("example.com") is accepted and normalized to
+                                //   http:// on save.
+                                //
+                                // Validated against the TRIMMED value, matching what the write path
+                                // in apply_field_change() actually stores.
+                                if ( null !== $value && ! is_string( $value ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Product URL must be text.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } elseif ( null !== $value && '' !== trim( $value ) && '' === esc_url_raw( trim( $value ) ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Product URL is not a valid URL.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                         ];
+                                }
 …
+                                        }
+                                }
+                        } elseif ( 'date_created' === $field ) {
+                                // Publish date (post_date) — REQUIRED. Unlike sale dates it cannot be
+                                // emptied (every post has a post_date; an empty value would reset it to
+                                // "now" on save). Must be a valid Y-m-d or Y-m-d H:i:s (a bare date is
+                                // accepted for back-compat; WC pads it to 00:00:00). Future dates are allowed.
+                                $sanitized = sanitize_text_field( (string) $value );
+                                if ( '' === $sanitized ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Published date cannot be empty.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } elseif ( ! preg_match( '/^\d{4}-\d{2}-\d{2}( \d{2}:\d{2}:\d{2})?$/', $sanitized ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Invalid date format for Published on. Expected YYYY-MM-DD or YYYY-MM-DD HH:MM:SS.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } else {
+                                        $parts = explode( '-', substr( $sanitized, 0, 10 ) );
+                                        $valid = checkdate( (int) $parts[1], (int) $parts[2], (int) $parts[0] );
+                                        if ( $valid && strlen( $sanitized ) > 10 ) {
+                                                // Time part present: the regex guarantees an exact HH:MM:SS shape.
+                                                list( $h, $i, $s ) = array_map( 'intval', explode( ':', substr( $sanitized, 11 ) ) );
+                                                $valid = ( $h <= 23 && $i <= 59 && $s <= 59 );
+                                        }
+                                        if ( ! $valid ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => __( 'Invalid date for Published on.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                ];
+                                        }
+                                }
                         } elseif ( in_array( $field, [ 'date_on_sale_from', 'date_on_sale_to' ], true ) ) {
                                 // Date validation — must be empty or Y-m-d format.
 …
                                         // Empty array is valid — this is the "clear gallery" path.
                                         foreach ( $value as $gid ) {
                                                 if ( ! is_numeric( $gid ) || (int) $gid <= 0 ) {
+                                                if ( ! self::is_positive_int_id( $gid ) ) {
                                                         $errors[] = [
                                                                 'field'   => $field,
                                                                 'value'   => $value,
                                                                 'message' => __( 'Invalid gallery image ID.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                        ];
+                                                        break;
+                                                }
+                                        }
+                                }
+                        } elseif ( in_array( $field, [ 'upsell_ids', 'cross_sell_ids' ], true ) ) {
+                                // Accepts both wire shapes the normaliser accepts: int[] (Operation History
+                                // restore) and [{ id: int }] (the grid). Existence is deliberately NOT
+                                // checked — dead refs are preserved, see normalize_product_refs().
+                                if ( ! is_array( $value ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Linked products must be an array of product IDs.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } else {
+                                        // Empty array is valid — this is the "clear" path.
+                                        foreach ( $value as $ref ) {
+                                                $ref_id = is_array( $ref ) ? ( $ref['id'] ?? null ) : $ref;
+                                                if ( ! self::is_positive_int_id( $ref_id ) ) {
+                                                        $errors[] = [
+                                                                'field'   => $field,
+                                                                'value'   => $value,
+                                                                'message' => __( 'Invalid linked product ID.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
                                                         ];
                                                         break;
 …
                                         ];
+                                }
+                        } elseif ( 'shipping_class' === $field ) {
+                                // Unlike the enums above the vocabulary is per-site, so validate
+                                // against the taxonomy itself. The wire value must be a STRING, and
+                                // only the exact empty string '' means "clear" (no class on a parent,
+                                // "same as parent" on a variation). A non-string (null, false, an
+                                // array) is invalid input, not an implicit clear — and so is a
+                                // non-empty string that sanitize_title() reduces to '' (junk like
+                                // '!!!'). Conflating either with the real empty-string clear would
+                                // silently wipe an existing shipping class instead of rejecting the
+                                // request.
+                                if ( ! is_string( $value ) ) {
+                                        $errors[] = [
+                                                'field'   => $field,
+                                                'value'   => $value,
+                                                'message' => __( 'Shipping class must be a string.', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                        ];
+                                } else {
+                                        $sanitized = sanitize_title( $value );
+                                        if ( '' !== $value && '' === $sanitized ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => sprintf(
+                                                                /* translators: %s: shipping class slug */
+                                                                __( 'Unknown shipping class: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                                $value
+                                                        ),
+                                                ];
+                                        } elseif ( '' !== $sanitized && ! get_term_by( 'slug', $sanitized, 'product_shipping_class' ) ) {
+                                                $errors[] = [
+                                                        'field'   => $field,
+                                                        'value'   => $value,
+                                                        'message' => sprintf(
+                                                                /* translators: %s: shipping class slug */
+                                                                __( 'Unknown shipping class: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                                $sanitized
+                                                        ),
+                                                ];
+                                        }
+                                }
+                        }
+                }
 …
                         case 'sku':
                                 $product->set_sku( sanitize_text_field( (string) $value ) );
+                                break;
+                        case 'button_text':
+                                // External-only (allowlist-gated): set_button_text() exists only on
+                                // WC_Product_External. The instanceof guard turns a misconfigured
+                                // wcabe_g2_allowed_fields filter into a no-op instead of a fatal.
+                                if ( $product instanceof \WC_Product_External ) {
+                                        $product->set_button_text( sanitize_text_field( (string) $value ) );
+                                }
+                                break;
+                        case 'product_url':
+                                // External-only (allowlist-gated), same instanceof rationale as
+                                // button_text above.
+                                //
+                                // esc_url_raw() here is load-bearing: WooCommerce sanitizes in the
+                                // GETTER (WC_Product_External::get_product_url() wraps esc_url_raw),
+                                // not the setter — set_product_url() only runs
+                                // htmlspecialchars_decode(). WC's own admin sanitizes before calling
+                                // the setter for the same reason. Passing the raw value would store
+                                // "example.com" in _product_url while the getter and grid display
+                                // "http://example.com", and the SQL filter matches the raw stored
+                                // meta — so the column users see would silently diverge from what
+                                // the filter finds. Canonicalize here so meta, getter and filter agree.
+                                //
+                                // trim() BEFORE esc_url_raw() is load-bearing, not tidiness: esc_url()
+                                // only LTRIMS, then percent-encodes the spaces it kept, so a
+                                // copy-pasted "https://a.com " would be stored as "https://a.com%20"
+                                // — a silently broken affiliate link. Every other text field escapes
+                                // this via sanitize_text_field(), which trims; esc_url_raw() does not.
+                                if ( $product instanceof \WC_Product_External ) {
+                                        $product->set_product_url( esc_url_raw( trim( (string) $value ) ) );
+                                }
                                 break;
 …
                                 break;
+                        case 'cogs_value':
+                                // Native WooCommerce Cost of Goods Sold. Route through the CRUD
+                                // setter (not raw post meta) so $product->save() persists it
+                                // rather than clobbering it from the in-memory cogs_value prop.
+                                // No-op when the feature is off — set_cogs_value() would emit
+                                // wc_doing_it_wrong() otherwise.
+                                if ( Product_Helper::is_cogs_enabled() ) {
+                                        $sanitized = trim( (string) $value );
+                                        $product->set_cogs_value( '' === $sanitized ? null : (float) wc_format_decimal( $sanitized ) );
+                                }
+                                break;
                         case 'stock_quantity':
                                 if ( null === $value || '' === $value ) {
 …
                                         $product->set_stock_quantity( wc_stock_amount( $value ) );
+                                }
+                                break;
+                        case 'menu_order':
+                                // Native wp_posts.menu_order. No "unset" state — an empty value
+                                // resets to 0. set_menu_order() casts via intval() (validated as an
+                                // integer upstream in validate_changes()).
+                                $product->set_menu_order( ( '' === $value || null === $value ) ? 0 : (int) $value );
                                 break;
 …
                                 break;
+                        case 'date_created':
+                                // Publish date (post_date). Validation guarantees a non-empty, valid
+                                // Y-m-d or Y-m-d H:i:s; guard defensively so an empty value never resets
+                                // post_date to "now". set_date_created() interprets the string as
+                                // site-local and persists post_date at full date-time granularity (a bare
+                                // Y-m-d is padded to 00:00:00 site time).
+                                $sanitized = sanitize_text_field( (string) $value );
+                                if ( '' !== $sanitized ) {
+                                        $product->set_date_created( $sanitized );
+                                }
+                                break;
                         case 'date_on_sale_from':
                                 $sanitized = sanitize_text_field( (string) $value );
 …
                                 $product->set_gallery_image_ids( $ids );
                                 break;
+                }
+                        case 'upsell_ids':
+                                $product->set_upsell_ids( self::normalize_product_refs( $value, $product->get_id() ) );
+                                break;
+                        case 'cross_sell_ids':
+                                $product->set_cross_sell_ids( self::normalize_product_refs( $value, $product->get_id() ) );
+                                break;
+                        case 'shipping_class':
+                                $sanitized = sanitize_title( (string) $value );
+                                if ( '' === $sanitized ) {
+                                        // 0 makes WC write an empty term list: no class on a parent,
+                                        // "same as parent" on a variation. Both are the same clear.
+                                        $product->set_shipping_class_id( 0 );
+                                        break;
+                                }
+                                $term = get_term_by( 'slug', $sanitized, 'product_shipping_class' );
+                                if ( ! $term ) {
+                                        throw new \InvalidArgumentException(
+                                                sprintf(
+                                                        /* translators: %s: shipping class slug */
+                                                        esc_html__( 'Unknown shipping class: %s', 'wpmelon-advanced-bulk-edit-for-woocommerce' ),
+                                                        esc_html( $sanitized )
+                                                )
+                                        );
+                                }
+                                $product->set_shipping_class_id( (int) $term->term_id );
+                                break;
+                }
+        }
+        /**
+         * Is $v a positive integer id — strictly?
+         *
+         * NOT is_numeric() followed by a cast. is_numeric() accepts '1.9', '1e3', '+12', ' 12' and
+         * '-7', and the (int)/absint() cast that follows SILENTLY REWRITES them: (int)'1e3' is 1000,
+         * (int)'1.9' is 1, absint('-7') is 7. A value that passed validation would then be written
+         * as a DIFFERENT id. This is the same trap search_products() documents at its ctype_digit()
+         * call, and the same one it notes WooCommerce core falls into.
+         *
+         * ctype_digit() alone is not enough either: it passes arbitrarily long digit strings, and
+         * (int)'999999999999999999999999' saturates to PHP_INT_MAX. The round-trip below pins the
+         * cast as lossless. It also rejects leading-zero forms like '012'.
+         *
+         * Shared by the linked-product and gallery_image_ids validators — both feed a cast.
+         *
+         * @param mixed $v
+         * @return bool
+         */
+        private static function is_positive_int_id( $v ): bool {
+                if ( is_int( $v ) ) {
+                        return $v > 0;
+                }
+                if ( is_string( $v ) ) {
+                        return ctype_digit( $v ) && (string) (int) $v === $v && (int) $v > 0;
+                }
+                // Floats, bools, null, arrays, objects. A JSON `12` decodes to a PHP int, and JS
+                // JSON.stringify(12.0) emits "12", so no legitimate client lands here.
+                return false;
+        }
+        /**
+         * Normalise a linked-product list to an ordered int[].
+         *
+         * Accepts BOTH wire shapes, deliberately:
+         *
+         *   [ { id: 12, name: …, sku: … }, … ]  — from the grid, which needs names to render
+         *   [ 12, 45, 900 ]                     — raw ints
+         *
+         * The raw-int path is not hypothetical. Operation History captures the canonical CRUD
+         * value (an int[]) and Pro_History_Input_Adapter::to_input() is an identity passthrough,
+         * so restore replays int[] straight back through here. Without dual-shape support,
+         * restore breaks. It also makes a future paste-from-spreadsheet path work for free.
+         *
+         * Rules, in order:
+         *   1. Coerce each entry to a positive int (from 'id' when it's an object/array).
+         *   2. Dedupe, preserving FIRST-occurrence order. Order is data — WooCommerce renders
+         *      upsells in stored order — so never rebuild this from a set.
+         *   3. Drop self-reference. (Also dropped client-side, per row, so the bulk preview
+         *      shows what actually lands; this is the server-side backstop.)
+         *   4. Do NOT check existence. WooCommerce core's set_upsell_ids() stores whatever it
+         *      is given, which is exactly why dead refs accumulate in real stores. We match it
+         *      and surface dead refs in the UI instead, so a user who never touches a dead chip
+         *      keeps it. Silently mutating data the user didn't touch is what erodes trust in a
+         *      tool that writes to a hundred products at once.
+         *   5. An empty array is valid — that is Clear.
+         *
+         * Note this runs AFTER validate_changes(), whose is_positive_int_id() gate has already
+         * rejected any entry whose (int) cast would be lossy — so the casts below are safe.
+         *
+         * @param mixed $value    int[] or array of { id: int }.
+         * @param int   $self_id  The product being written (excluded from its own list).
+         * @return int[]
+         */
+        private static function normalize_product_refs( $value, int $self_id ): array {
+                if ( ! is_array( $value ) ) {
+                        return [];
+                }
+                $ids = [];
+                foreach ( $value as $entry ) {
+                        if ( is_array( $entry ) ) {
+                                $id = isset( $entry['id'] ) ? (int) $entry['id'] : 0;
+                        } elseif ( is_object( $entry ) ) {
+                                $id = isset( $entry->id ) ? (int) $entry->id : 0;
+                        } else {
+                                $id = (int) $entry;
+                        }
+                        if ( $id <= 0 || $id === $self_id ) {
+                                continue;
+                        }
+                        // array_search-free dedupe that preserves first-occurrence order.
+                        if ( ! isset( $ids[ $id ] ) ) {
+                                $ids[ $id ] = true;
+                        }
+                }
+                return array_map( 'intval', array_keys( $ids ) );
+        }
 …
         /**
+         * Whether a menu_order string — already matching /^-?\d+$/ — fits the signed
+         * 32-bit range (self::MENU_ORDER_MIN..MAX).
+         *
+         * Compares as strings (magnitude length, then lexically) to stay
+         * platform-independent: a lossy (int) cast of an out-of-range value clamps to
+         * PHP_INT_MAX on 32-bit builds and would wrongly pass. Leading zeros are
+         * tolerated (mirrors the regex and the frontend): '0005' → 5, '0'/'-0' → 0.
+         *
+         * @param string $value Digit string, optionally sign-prefixed.
+         * @return bool
+         */
+        private static function menu_order_in_int32_range( string $value ): bool {
+                $negative  = ( '' !== $value && '-' === $value[0] );
+                $magnitude = ltrim( $negative ? substr( $value, 1 ) : $value, '0' );
+                if ( '' === $magnitude ) {
+                        return true; // All zeros → 0, always in range.
+                }
+                // Derive the bound magnitudes from the constants (string-safe, no abs()).
+                $limit = $negative ? ltrim( (string) self::MENU_ORDER_MIN, '-' ) : (string) self::MENU_ORDER_MAX;
+                if ( strlen( $magnitude ) !== strlen( $limit ) ) {
+                        return strlen( $magnitude ) < strlen( $limit );
+                }
+                return strcmp( $magnitude, $limit ) <= 0;
+        }
+        /**
          * Get products via WooCommerce CRUD API.
+         *
 …
          * @param array $filters Optional filter criteria.
          * @param bool  $include_variations Whether variations will be interleaved (affects meta_query behavior).
+         * @param bool  $ids_only_all_variable When true, override pagination/type to fetch ALL matching
+         *                                     variable parent IDs (unbounded, fields=ids). Used by the
+         *                                     variation-total helper; products array in this mode is int[].
+         * @param bool   $ids_only_all_variable When true, override pagination/type to fetch ALL matching
+         *                                      variable parent IDs (unbounded, fields=ids). Used by the
+         *                                      variation-total helper; products array in this mode is int[].
+         * @param string $orderby Sort column: 'id' (default) or 'menu_order'.
+         * @param string $order   Sort direction: 'asc' or 'desc' (default).
          * @return array{ products: \WC_Product[]|int[], total: int, total_pages: int }
          */
 …
                 array $filters = [],
                 bool $include_variations = false,
+                bool $ids_only_all_variable = false
+                bool $ids_only_all_variable = false,
+                string $orderby = 'id',
+                string $order = 'desc'
         ): array {
+                // Map the whitelisted orderby to a WC/WP_Query-supported value. 'menu_order'
+                // passes through to WP_Query natively; append ID as a stable tiebreaker so
+                // pagination is deterministic when rows share a menu_order (the default 0) —
+                // WP_Query parses the space-separated form into "menu_order <dir>, ID <dir>".
+                // Anything else falls back to ID.
+                $wc_orderby = ( 'menu_order' === $orderby ) ? 'menu_order ID' : 'ID';
+                $wc_order   = ( 'asc' === strtolower( $order ) ) ? 'ASC' : 'DESC';
+                // A shipping_class param that survived REST sanitisation as nothing at all
+                // (e.g. '!!!') must match NOTHING, never widen to the whole catalog. There
+                // is no "impossible slug" to encode this with — sanitize_title() output is
+                // exactly the legal slug vocabulary — so the REST layer sets this flag.
+                if ( ! empty( $filters['shipping_class_match_none'] ) ) {
+                        return [
+                                'products'    => [],
+                                'total'       => 0,
+                                'total_pages' => 1,
+                        ];
+                }
                 $args = [
                         'limit'    => $per_page,
                         'page'     => $page,
                         'orderby'  => 'ID',
                         'order'    => 'DESC',
+                        'orderby'  => $wc_orderby,
+                        'order'    => $wc_order,
                         'paginate' => true,
                 ];
 …
                         $args['return']   = 'ids';
+                        $variable_types = self::get_variable_product_types();
                         if ( ! empty( $filters['type'] ) ) {
                                 $intersection = array_values(
                                         array_intersect( (array) $filters['type'], [ 'variable' ] )
+                                        array_intersect( (array) $filters['type'], $variable_types )
                                 );
                                 if ( empty( $intersection ) ) {
 …
                                 $filters['type'] = $intersection;
                         } else {
                                 $filters['type'] = [ 'variable' ];
+                                $filters['type'] = $variable_types;
+                        }
+                }
 …
                 $args['status'] = ! empty( $filters['status'] )
                         ? (array) $filters['status']
+                        : [ 'publish', 'draft', 'private', 'pending' ];
+                // Type filter — use provided values or defaults.
+                        // 'future' (Scheduled) is included so products given a future publish
+                        // date — which WordPress auto-transitions publish -> future — stay
+                        // visible in the grid instead of silently disappearing.
+                        : [ 'publish', 'draft', 'private', 'pending', 'future' ];
+                // Type filter — use provided values, or default to every known type so
+                // third-party types (bundle, subscription, …) appear in the grid (#137).
                 $args['type'] = ! empty( $filters['type'] )
                         ? (array) $filters['type']
                         : [ 'simple', 'variable', 'grouped', 'external' ];
+                        : self::get_known_product_types();
                 // ID filter — simple comparison or expression (CSV + ranges).
 …
                 // Search filters — handled via posts_join/posts_where hooks below.
                 $search_name_term = ! empty( $filters['search_name'] ) ? sanitize_text_field( $filters['search_name'] ) : '';
+                $search_sku_term  = ! empty( $filters['search_sku'] )  ? sanitize_text_field( $filters['search_sku'] )  : '';
+                // Title match mode: 'all' (every word, AND, default), 'any' (any word, OR), 'phrase' (whole-term LIKE).
+                $search_name_mode = isset( $filters['search_name_mode'] ) && in_array( $filters['search_name_mode'], self::TITLE_SEARCH_MODES, true )
+                        ? $filters['search_name_mode']
+                        : 'all';
+                // Strict '' test, not empty(): "0" is a valid SKU and must not be dropped.
+                $search_sku_term = isset( $filters['search_sku'] ) ? sanitize_text_field( (string) $filters['search_sku'] ) : '';
+                $has_search_sku  = '' !== $search_sku_term;
+                // SKU match mode: '' (auto/legacy) or one of self::SKU_SEARCH_MODES.
+                $search_sku_mode = self::normalize_sku_mode( $filters['search_sku_mode'] ?? '' );
                 $search_description_term       = ! empty( $filters['search_description'] )       ? sanitize_text_field( $filters['search_description'] )       : '';
                 $search_short_description_term = ! empty( $filters['search_short_description'] ) ? sanitize_text_field( $filters['search_short_description'] ) : '';
+                // Product URL filter (external/affiliate link). "Effective" is NOT a
+                // non-empty-value test: is_empty / is_not_empty carry meaning with none.
+                $product_url_operator = isset( $filters['product_url_operator'] ) && in_array( $filters['product_url_operator'], self::PRODUCT_URL_OPERATORS, true )
+                        ? $filters['product_url_operator']
+                        : 'contains';
+                $product_url_value    = isset( $filters['product_url_value'] ) ? trim( (string) $filters['product_url_value'] ) : '';
+                $has_product_url_filter = self::product_url_filter_is_effective( $product_url_operator, $product_url_value );
                 // Category filter — exact matching (include_children => false).
 …
+                }
+                // Tag filter — WC's data store natively maps 'product_tag_id' (term IDs) to a
+                // product_tag tax_query. Flat taxonomy, so no include_children handling needed
+                // (unlike category). Note WC's 'tag' arg expects slugs — do not use it.
+                if ( ! empty( $filters['tag'] ) ) {
+                        $args['product_tag_id'] = array_map( 'absint', (array) $filters['tag'] );
+                }
                 // Stock status filter.
                 if ( ! empty( $filters['stock_status'] ) ) {
 …
+                }
+                // Shipping class filter. WooCommerce's own 'shipping_class' query var
+                // builds the tax_query, matching on SLUG (see WC_Product_Data_Store_CPT) —
+                // which is why the whole feature speaks slugs rather than term IDs.
+                // Parent-level by design: variations follow whichever parent matched, and
+                // a variation that overrides its parent's class is not independently
+                // surfaced. Narrowing per variation would instead HIDE every variation
+                // that inherits (its own stored class is empty), which is the wrong
+                // default for the common case.
+                if ( ! empty( $filters['shipping_class'] ) ) {
+                        $args['shipping_class'] = array_map( 'sanitize_title', (array) $filters['shipping_class'] );
+                }
                 // Price range filters — passed as custom args, handled in handle_custom_query_args.
                 if ( isset( $filters['price_min'] ) && '' !== $filters['price_min'] ) {
 …
                 if ( isset( $filters['price_max'] ) && '' !== $filters['price_max'] ) {
                         $args['wcabe_price_max'] = wc_format_decimal( $filters['price_max'] );
+                }
+                // Cost of Goods range filters — gated on the COGS feature so direct service
+                // calls carrying stale cogs_min/max can't reach the variation matcher or
+                // get_cogs_value() while the feature is disabled.
+                if ( Product_Helper::is_cogs_enabled() ) {
+                        if ( isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'] ) {
+                                $args['wcabe_cogs_min'] = (float) $filters['cogs_min'];
+                        }
+                        if ( isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'] ) {
+                                $args['wcabe_cogs_max'] = (float) $filters['cogs_max'];
+                        }
+                }
 …
                 if ( $modified_after || $modified_before ) {
                         $args['date_modified'] = $this->build_date_range( $modified_after, $modified_before );
+                }
+                // Sale-schedule date range filters. WC's native date_on_sale_from/date_on_sale_to
+                // query args are deliberately NOT used: for day precision WC compares the range
+                // end against the START of that day and derives both bounds through gmdate(), so
+                // sale-to timestamps stored at local 23:59:59 (WC admin's own convention) never
+                // match and non-UTC sites shift by a day. We compute site-local bounds here and
+                // expand them in the query callbacks below.
+                list( $sale_start_min, $sale_start_max ) = $this->sale_date_filter_bounds(
+                        $filters['sale_start_after'] ?? '',
+                        $filters['sale_start_before'] ?? ''
+                );
+                list( $sale_end_min, $sale_end_max ) = $this->sale_date_filter_bounds(
+                        $filters['sale_end_after'] ?? '',
+                        $filters['sale_end_before'] ?? ''
+                );
+                if ( null !== $sale_start_min ) {
+                        $args['wcabe_sale_start_min'] = $sale_start_min;
+                }
+                if ( null !== $sale_start_max ) {
+                        $args['wcabe_sale_start_max'] = $sale_start_max;
+                }
+                if ( null !== $sale_end_min ) {
+                        $args['wcabe_sale_end_min'] = $sale_end_min;
+                }
+                if ( null !== $sale_end_max ) {
+                        $args['wcabe_sale_end_max'] = $sale_end_max;
+                }
 …
                 $has_stock_qty_filter    = isset( $args['wcabe_stock_qty_min'] ) || isset( $args['wcabe_stock_qty_max'] );
+                $has_cogs_filter         = isset( $args['wcabe_cogs_min'] ) || isset( $args['wcabe_cogs_max'] );
                 $has_manage_stock_filter = ! empty( $args['wcabe_manage_stock'] );
                 $has_backorders_filter   = ! empty( $args['wcabe_backorders'] );
+                // Hook for exact category matching, multi-value stock_status, price, stock qty, manage stock, backorders, and attribute filtering.
+                $needs_custom_query = ! empty( $filters['category'] ) || ( ! empty( $filters['stock_status'] ) && count( (array) $filters['stock_status'] ) > 1 ) || $has_price_filter || $has_stock_qty_filter || $has_manage_stock_filter || $has_backorders_filter || ! empty( $attribute_tax_queries );
+                $has_sale_date_filter    = isset( $args['wcabe_sale_start_min'] ) || isset( $args['wcabe_sale_start_max'] )
+                        || isset( $args['wcabe_sale_end_min'] ) || isset( $args['wcabe_sale_end_max'] );
+                // Hook for exact category matching, multi-value stock_status, price, stock qty, COGS, manage stock, backorders, sale dates, and attribute filtering.
+                $needs_custom_query = ! empty( $filters['category'] ) || ( ! empty( $filters['stock_status'] ) && count( (array) $filters['stock_status'] ) > 1 ) || $has_price_filter || $has_stock_qty_filter || $has_cogs_filter || $has_manage_stock_filter || $has_backorders_filter || $has_sale_date_filter || ! empty( $attribute_tax_queries );
                 $filter_callback = function ( array $wp_query_args, array $query_vars ) use ( $include_variations ): array {
 …
+                        }
+                        // Cost of Goods range filtering via _cogs_total_value meta.
+                        // When include_variations is true, handled by the posts_where hook
+                        // below instead — variable parents carry a non-null default cost, so
+                        // the _stock-style "OR IS NULL" trick doesn't apply.
+                        $has_cogs_min = isset( $query_vars['wcabe_cogs_min'] );
+                        $has_cogs_max = isset( $query_vars['wcabe_cogs_max'] );
+                        if ( ( $has_cogs_min || $has_cogs_max ) && ! $include_variations ) {
+                                if ( ! isset( $wp_query_args['meta_query'] ) ) {
+                                        $wp_query_args['meta_query'] = [];
+                                }
+                                if ( $has_cogs_min && $has_cogs_max ) {
+                                        $cogs_range_clause = [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => [ (float) $query_vars['wcabe_cogs_min'], (float) $query_vars['wcabe_cogs_max'] ],
+                                                'compare' => 'BETWEEN',
+                                                'type'    => 'DECIMAL(10,2)',
+                                        ];
+                                } elseif ( $has_cogs_min ) {
+                                        $cogs_range_clause = [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => (float) $query_vars['wcabe_cogs_min'],
+                                                'compare' => '>=',
+                                                'type'    => 'DECIMAL(10,2)',
+                                        ];
+                                } else {
+                                        $cogs_range_clause = [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => (float) $query_vars['wcabe_cogs_max'],
+                                                'compare' => '<=',
+                                                'type'    => 'DECIMAL(10,2)',
+                                        ];
+                                }
+                                // Guard _cogs_total_value != '' (grouped AND with the range) so a
+                                // stray empty row can't CAST to 0 and match a 0-inclusive range.
+                                $wp_query_args['meta_query'][] = [
+                                        'relation' => 'AND',
+                                        [
+                                                'key'     => '_cogs_total_value',
+                                                'value'   => '',
+                                                'compare' => '!=',
+                                        ],
+                                        $cogs_range_clause,
+                                ];
+                        }
+                        // Sale-schedule date range filtering via _sale_price_dates_from/_to
+                        // (Unix timestamps). When include_variations is true this is handled by
+                        // the posts_where hook below instead, so a variable parent can surface
+                        // via a matching child variation.
+                        $sale_bounds = [
+                                '_sale_price_dates_from' => [
+                                        $query_vars['wcabe_sale_start_min'] ?? null,
+                                        $query_vars['wcabe_sale_start_max'] ?? null,
+                                ],
+                                '_sale_price_dates_to'   => [
+                                        $query_vars['wcabe_sale_end_min'] ?? null,
+                                        $query_vars['wcabe_sale_end_max'] ?? null,
+                                ],
+                        ];
+                        $has_sale_filter = false;
+                        foreach ( $sale_bounds as $bounds ) {
+                                if ( null !== $bounds[0] || null !== $bounds[1] ) {
+                                        $has_sale_filter = true;
+                                        break;
+                                }
+                        }
+                        if ( $has_sale_filter && ! $include_variations ) {
+                                if ( ! isset( $wp_query_args['meta_query'] ) ) {
+                                        $wp_query_args['meta_query'] = [];
+                                }
+                                foreach ( $sale_bounds as $meta_key => $bounds ) {
+                                        list( $min, $max ) = $bounds;
+                                        if ( null === $min && null === $max ) {
+                                                continue;
+                                        }
+                                        if ( null !== $min && null !== $max ) {
+                                                $sale_range_clause = [
+                                                        'key'     => $meta_key,
+                                                        'value'   => [ $min, $max ],
+                                                        'compare' => 'BETWEEN',
+                                                        'type'    => 'NUMERIC',
+                                                ];
+                                        } elseif ( null !== $min ) {
+                                                $sale_range_clause = [
+                                                        'key'     => $meta_key,
+                                                        'value'   => $min,
+                                                        'compare' => '>=',
+                                                        'type'    => 'NUMERIC',
+                                                ];
+                                        } else {
+                                                $sale_range_clause = [
+                                                        'key'     => $meta_key,
+                                                        'value'   => $max,
+                                                        'compare' => '<=',
+                                                        'type'    => 'NUMERIC',
+                                                ];
+                                        }
+                                        // Guard != '' (grouped AND with the range) so an empty row can't
+                                        // CAST to 0 and satisfy a <=-bounded range.
+                                        $wp_query_args['meta_query'][] = [
+                                                'relation' => 'AND',
+                                                [
+                                                        'key'     => $meta_key,
+                                                        'value'   => '',
+                                                        'compare' => '!=',
+                                                ],
+                                                $sale_range_clause,
+                                        ];
+                                }
+                                // A variable parent never legitimately carries a sale schedule (the
+                                // plugin treats sale dates as absent on them), and in this mode a child
+                                // never surfaces its parent — but stale _sale_price_dates_* rows can
+                                // survive a simple->variable type conversion, so exclude them outright.
+                                if ( ! isset( $wp_query_args['tax_query'] ) ) {
+                                        $wp_query_args['tax_query'] = [];
+                                }
+                                $wp_query_args['tax_query'][] = [
+                                        'taxonomy' => 'product_type',
+                                        'field'    => 'slug',
+                                        'terms'    => self::get_variable_product_types(),
+                                        'operator' => 'NOT IN',
+                                ];
+                        }
                         // Stock quantity range filtering via _stock meta.
                         // When include_variations is false, standard meta_query applies.
 …
                 $search_where_callback = null;
                 if ( $search_name_term || $search_sku_term ) {
+                if ( $search_name_term || $has_search_sku ) {
                         global $wpdb;
                         // JOIN is only needed when filtering by SKU.
                         if ( $search_sku_term ) {
+                        if ( $has_search_sku ) {
                                 $search_join_callback = function ( string $join ) use ( $wpdb ): string {
                                         if ( strpos( $join, 'wcabe_sku_lookup' ) === false ) {
 …
                         $name_clause = '';
                         if ( $search_name_term ) {
+                                $name_like   = '%' . $wpdb->esc_like( $search_name_term ) . '%';
+                                $name_clause = $wpdb->prepare( "( {$wpdb->posts}.post_title LIKE %s )", $name_like );
+                                $name_clause = $this->build_name_search_clause( $wpdb, $search_name_term, $search_name_mode );
+                        }
                         $sku_clause = '';
+                        if ( $search_sku_term ) {
+                                if ( strpos( $search_sku_term, ',' ) !== false ) {
+                                        // CSV mode: exact match against each SKU.
+                                        $skus = array_filter( array_map( 'trim', explode( ',', $search_sku_term ) ) );
+                                        $skus = array_map( 'sanitize_text_field', $skus );
+                                        if ( ! empty( $skus ) ) {
+                                                $placeholders = implode( ',', array_fill( 0, count( $skus ), '%s' ) );
+                                                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $placeholders is a comma-joined string of `%s` placeholders, one per element of $skus, all expanded by prepare() via spread.
+                                                $sku_clause   = $wpdb->prepare(
+                                                        "( wcabe_sku_lookup.sku IN ($placeholders) )",
+                                                        ...$skus
+                                                );
+                                                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+                                        }
+                                } else {
+                                        // Single term: LIKE search.
+                                        $sku_like   = '%' . $wpdb->esc_like( $search_sku_term ) . '%';
+                                        $sku_clause = $wpdb->prepare( '( wcabe_sku_lookup.sku LIKE %s )', $sku_like );
+                                }
+                        if ( $has_search_sku ) {
+                                $sku_clause = $this->build_sku_search_clause( $wpdb, $search_sku_term, $search_sku_mode, $include_variations );
+                        }
 …
                         $description_where_callback = function ( string $where ) use ( $wpdb, $desc_like, $include_variations ): string {
                                 if ( $include_variations ) {
+                                        $where .= $wpdb->prepare(
+                                                " AND ( {$wpdb->posts}.post_content LIKE %s OR {$wpdb->posts}.ID IN ("
+                                        // The child branch is gated on the parent being variable — a
+                                        // stale variation left behind by a variable->simple type
+                                        // conversion must not surface its now-simple parent.
+                                        $is_variable = $this->sql_is_variable_product();
+                                        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $is_variable is this class's own hardcoded SQL literal (sql_is_variable_product()); the search term is passed through prepare() via %s.
+                                        $where      .= $wpdb->prepare(
+                                                " AND ( {$wpdb->posts}.post_content LIKE %s OR ( {$is_variable} AND {$wpdb->posts}.ID IN ("
                                                 . " SELECT p.post_parent FROM {$wpdb->posts} p"
                                                 . " INNER JOIN {$wpdb->postmeta} pm ON p.ID = pm.post_id"
 …
                                                 . " AND pm.meta_key = '_variation_description'"
                                                 . " AND pm.meta_value LIKE %s"
                                                 . ' ) )',
+                                                . ' ) ) )',
                                                 $desc_like,
                                                 $desc_like
                                         );
+                                        // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
                                 } else {
                                         $where .= $wpdb->prepare( " AND {$wpdb->posts}.post_content LIKE %s", $desc_like );
 …
+                }
+                // Product URL filtering (external/affiliate link, _product_url meta).
+                // Raw SQL rather than meta_query for the same reason as stock qty above:
+                // WP's meta_query cannot express "meta row missing", which the is_empty
+                // operator needs. Every column is alias-qualified — an unqualified
+                // post_id/meta_key/meta_value becomes ambiguous the moment another meta
+                // join (e.g. stock qty) is active in the same query.
+                $product_url_join_callback   = null;
+                $product_url_where_callback  = null;
+                $product_url_marker_callback = null;
+                if ( $has_product_url_filter ) {
+                        global $wpdb;
+                        // posts_join / posts_where fire on EVERY WP_Query for as long as they are
+                        // registered — including any a third-party pre_get_posts listener spins up
+                        // inside ours. Unscoped, those queries would inherit our WHERE; and because
+                        // the JOIN is added only once (the strpos guard), a nested query could even
+                        // receive the WHERE WITHOUT the JOIN and hard-fail on an unknown column.
+                        // So both callbacks below bail unless the query carries our private marker,
+                        // which this callback stamps onto our own query only. Same guard shape as
+                        // search_products() / REF_SEARCH_QUERY_VAR.
+                        $product_url_marker_callback = static function ( array $wp_query_args ): array {
+                                $wp_query_args[ self::PRODUCT_URL_QUERY_VAR ] = true;
+                                return $wp_query_args;
+                        };
+                        $product_url_join_callback = function ( string $join, \WP_Query $query ) use ( $wpdb ): string {
+                                if ( ! $query->get( self::PRODUCT_URL_QUERY_VAR ) ) {
+                                        return $join;
+                                }
+                                if ( strpos( $join, 'wcabe_product_url_meta' ) === false ) {
+                                        $join .= " LEFT JOIN {$wpdb->postmeta} AS wcabe_product_url_meta ON ( {$wpdb->posts}.ID = wcabe_product_url_meta.post_id AND wcabe_product_url_meta.meta_key = '_product_url' ) ";
+                                }
+                                return $join;
+                        };
+                        $is_external_sql = $this->sql_is_external_product();
+                        $product_url_where_callback = function ( string $where, \WP_Query $query ) use ( $wpdb, $product_url_operator, $product_url_value, $is_external_sql ): string {
+                                if ( ! $query->get( self::PRODUCT_URL_QUERY_VAR ) ) {
+                                        return $where;
+                                }
+                                $col       = 'wcabe_product_url_meta.meta_value';
+                                $has_a_url = "( {$col} IS NOT NULL AND {$col} <> '' )";
+                                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $has_a_url and $col are this method's own hardcoded column expressions; the user-supplied URL value is passed through prepare() via %s in every branch.
+                                switch ( $product_url_operator ) {
+                                        case 'is_empty':
+                                                $clause = "( {$col} IS NULL OR {$col} = '' )";
+                                                break;
+                                        case 'is_not_empty':
+                                                $clause = $has_a_url;
+                                                break;
+                                        case 'not_contains':
+                                                // Scoped to rows that HAVE a URL, so this reads as "URLs that
+                                                // don't contain X" rather than "every external product without one".
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} NOT LIKE %s )",
+                                                        '%' . $wpdb->esc_like( $product_url_value ) . '%'
+                                                );
+                                                break;
+                                        case 'starts_with':
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} LIKE %s )",
+                                                        $wpdb->esc_like( $product_url_value ) . '%'
+                                                );
+                                                break;
+                                        case 'ends_with':
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} LIKE %s )",
+                                                        '%' . $wpdb->esc_like( $product_url_value )
+                                                );
+                                                break;
+                                        case 'contains':
+                                        default:
+                                                $clause = $wpdb->prepare(
+                                                        "( {$has_a_url} AND {$col} LIKE %s )",
+                                                        '%' . $wpdb->esc_like( $product_url_value ) . '%'
+                                                );
+                                                break;
+                                }
+                                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+                                // EVERY operator is scoped to external products, not just is_empty.
+                                // product_url is an external-only field: Product_Helper::format_product()
+                                // and the CSV exporter both emit '' for any other type, and the grid cell
+                                // is blank and read-only there. A non-external row carries _product_url
+                                // only as STALE meta (converted external → simple), so matching it would
+                                // surface a row whose Product URL is blank on every surface the user can
+                                // see, with no way to tell why it matched. Scoping the whole filter keeps
+                                // "what the filter finds" and "what the column shows" the same set.
+                                return $where . " AND ( {$clause} AND {$is_external_sql} ) ";
+                        };
+                }
+                // ── Combined variation-aware filtering: COGS, menu order, sale dates, image date ──
+                //
+                // ONE callback pair covers all four deliberately. Each of them can surface a
+                // variable parent either on its OWN value or through a child variation, and
+                // emitting them as separate `( own_i OR child_i )` clauses would let *different*
+                // siblings satisfy different filters — surfacing a parent whose children are
+                // then all rejected by variation_matches_filters(), i.e. an empty parent row.
+                // (The sale-date filter already solved this across its own two ranges; this
+                // generalises the same fix across filters.) The emitted shape is
+                //
+                //     ( own_A AND own_B AND … ) OR ( is_variable AND EXISTS ( … child_A AND child_B … ) )
+                //
+                // so a variable parent surfaces only when it matches entirely on its own
+                // values, or when ONE renderable child satisfies every active predicate —
+                // exactly what variation_matches_filters() accepts when it narrows the
+                // children. Distributing the child branch this way also emits the correlated
+                // subquery once instead of once per filter. With a single filter active the
+                // shape collapses to that filter's previous `( own OR child )` clause, so
+                // single-filter behaviour is unchanged.
+                //
+                // SCOPE: these four filters only. Price, stock status, stock quantity, manage
+                // stock, backorders, SKU search and description search surface parents through
+                // other mechanisms (meta_query, the OR-NULL stock posts_where above, IN
+                // subqueries below) and are NOT folded in — a filter from this group combined
+                // with one of those can still produce an empty parent row. Known and accepted;
+                // folding the rest in is tracked separately.
+                //
+                // The child status list matches WC get_children() (publish/private only) so a
+                // parent never surfaces via a variation that won't render. The child branch is
+                // gated on the parent being variable — a variable->simple type conversion can
+                // leave published variation posts behind, and a stale child must not surface
+                // its now-simple parent (interleaving only narrows children of variable
+                // parents, so such a false positive is uncorrectable downstream). COGS and
+                // sale dates participate only when include_variations is on; with it off they
+                // stay on their meta_query paths and never reach this callback, so with
+                // variations off only menu order and image date are emitted here.
+                $combined_join_callback  = null;
+                $combined_where_callback = null;
+                $cogs_min = isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'] ? (float) $filters['cogs_min'] : null;
+                $cogs_max = isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'] ? (float) $filters['cogs_max'] : null;
+                $menu_order_min = ( isset( $filters['menu_order_min'] ) && '' !== $filters['menu_order_min'] ) ? (int) $filters['menu_order_min'] : null;
+                $menu_order_max = ( isset( $filters['menu_order_max'] ) && '' !== $filters['menu_order_max'] ) ? (int) $filters['menu_order_max'] : null;
+                // Image-uploaded bounds. The signal is the featured image attachment's
+                // post_date — a site-local DATETIME, the same basis the grid renders — so
+                // day-precision Y-m-d bounds expand to literal day-start / day-end strings and
+                // compare directly. No timestamp arithmetic, hence no DST edge (contrast the
+                // sale-date bounds above, which are Unix timestamps stored in meta).
+                $image_date_after  = isset( $filters['image_date_after'] ) ? (string) $filters['image_date_after'] : '';
+                $image_date_before = isset( $filters['image_date_before'] ) ? (string) $filters['image_date_before'] : '';
+                $image_date_min    = '' !== $image_date_after ? $image_date_after . ' 00:00:00' : null;
+                $image_date_max    = '' !== $image_date_before ? $image_date_before . ' 23:59:59' : null;
+                $use_cogs  = $include_variations && $has_cogs_filter;
+                $use_sale  = $include_variations && $has_sale_date_filter;
+                $use_menu  = ( null !== $menu_order_min || null !== $menu_order_max );
+                $use_image = ( null !== $image_date_min || null !== $image_date_max );
+                if ( $use_cogs || $use_sale || $use_menu || $use_image ) {
+                        global $wpdb;
+                        // Active sale ranges (either or both of from/to may be filtered).
+                        $sale_predicates = ! $use_sale ? [] : array_values(
+                                array_filter(
+                                        [
+                                                [
+                                                        'meta_key'     => '_sale_price_dates_from',
+                                                        'parent_alias' => 'wcabe_sale_from_meta',
+                                                        'child_alias'  => 'wcabe_sale_from_child',
+                                                        'min'          => $sale_start_min,
+                                                        'max'          => $sale_start_max,
+                                                ],
+                                                [
+                                                        'meta_key'     => '_sale_price_dates_to',
+                                                        'parent_alias' => 'wcabe_sale_to_meta',
+                                                        'child_alias'  => 'wcabe_sale_to_child',
+                                                        'min'          => $sale_end_min,
+                                                        'max'          => $sale_end_max,
+                                                ],
+                                        ],
+                                        static function ( array $range ): bool {
+                                                return null !== $range['min'] || null !== $range['max'];
+                                        }
+                                )
+                        );
+                        // Only COGS, sale dates and image date need parent-side joins; menu_order
+                        // reads a native wp_posts column.
+                        if ( $use_cogs || $use_sale || $use_image ) {
+                                $combined_join_callback = function ( string $join ) use ( $wpdb, $use_cogs, $use_image, $sale_predicates ): string {
+                                        if ( $use_cogs && strpos( $join, 'wcabe_cogs_meta' ) === false ) {
+                                                $join .= " LEFT JOIN {$wpdb->postmeta} AS wcabe_cogs_meta ON ( {$wpdb->posts}.ID = wcabe_cogs_meta.post_id AND wcabe_cogs_meta.meta_key = '_cogs_total_value' ) ";
+                                        }
+                                        foreach ( $sale_predicates as $range ) {
+                                                if ( strpos( $join, $range['parent_alias'] ) === false ) {
+                                                        $join .= " LEFT JOIN {$wpdb->postmeta} AS {$range['parent_alias']} ON ( {$wpdb->posts}.ID = {$range['parent_alias']}.post_id AND {$range['parent_alias']}.meta_key = '{$range['meta_key']}' ) ";
+                                                }
+                                        }
+                                        if ( $use_image && strpos( $join, 'wcabe_img_meta' ) === false ) {
+                                                // No GROUP BY guard: a duplicate _thumbnail_id meta row would
+                                                // duplicate the product row. Same accepted exposure as
+                                                // wcabe_stock_meta / wcabe_cogs_meta — _thumbnail_id is written
+                                                // through update_post_meta (single-row) on every core/WC path.
+                                                // The post_type gate mirrors Product_Helper::get_image_upload_date(),
+                                                // so a _thumbnail_id pointing at a non-attachment is excluded here
+                                                // and renders blank there.
+                                                $join .= " LEFT JOIN {$wpdb->postmeta} AS wcabe_img_meta ON ( {$wpdb->posts}.ID = wcabe_img_meta.post_id AND wcabe_img_meta.meta_key = '_thumbnail_id' ) ";
+                                                $join .= " LEFT JOIN {$wpdb->posts} AS wcabe_img ON ( wcabe_img.ID = CAST( wcabe_img_meta.meta_value AS UNSIGNED ) AND wcabe_img.post_type = 'attachment' ) ";
+                                        }
+                                        return $join;
+                                };
+                        }
+                        $combined_where_callback = function ( string $where ) use (
+                                $wpdb,
+                                $include_variations,
+                                $use_cogs,
+                                $use_sale,
+                                $use_menu,
+                                $use_image,
+                                $sale_predicates,
+                                $cogs_min,
+                                $cogs_max,
+                                $menu_order_min,
+                                $menu_order_max,
+                                $image_date_min,
+                                $image_date_max
+                        ): string {
+                                // Bounded comparison in the three shapes prepare() needs. $expr and $ph
+                                // are always this method's own literals, never request data.
+                                $build_bound = function ( string $expr, $min, $max, string $ph ) use ( $wpdb ): string {
+                                        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $expr is a hardcoded column/CAST expression and $ph a hardcoded placeholder token (invisible to the sniff but expanded by prepare()); the bound values are passed through prepare().
+                                        if ( null !== $min && null !== $max ) {
+                                                return $wpdb->prepare( "( {$expr} BETWEEN {$ph} AND {$ph} )", $min, $max );
+                                        }
+                                        if ( null !== $min ) {
+                                                return $wpdb->prepare( "( {$expr} >= {$ph} )", $min );
+                                        }
+                                        return $wpdb->prepare( "( {$expr} <= {$ph} )", $max );
+                                        // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+                                };
+                                $is_variable = $this->sql_is_variable_product();
+                                $own_parts   = [];
+                                $child_parts = [];
+                                $child_joins = '';
+                                if ( $use_cogs ) {
+                                        $own_col       = 'wcabe_cogs_meta.meta_value';
+                                        $child_col     = 'wcabe_child_cogs.meta_value';
+                                        $child_joins  .= " INNER JOIN {$wpdb->postmeta} AS wcabe_child_cogs ON ( wcabe_child_cogs.post_id = c.ID AND wcabe_child_cogs.meta_key = '_cogs_total_value' ) ";
+                                        $own_parts[]   = "( {$own_col} <> '' AND " . $build_bound( "CAST( {$own_col} AS DECIMAL(10,2) )", $cogs_min, $cogs_max, '%f' ) . ' )';
+                                        $child_parts[] = "( {$child_col} <> '' AND " . $build_bound( "CAST( {$child_col} AS DECIMAL(10,2) )", $cogs_min, $cogs_max, '%f' ) . ' )';
+                                }
+                                if ( $use_menu ) {
+                                        $own_parts[]   = $build_bound( "{$wpdb->posts}.menu_order", $menu_order_min, $menu_order_max, '%d' );
+                                        $child_parts[] = $build_bound( 'c.menu_order', $menu_order_min, $menu_order_max, '%d' );
+                                }
+                                if ( $use_image ) {
+                                        $child_joins  .= " INNER JOIN {$wpdb->postmeta} AS wcabe_child_img_meta ON ( wcabe_child_img_meta.post_id = c.ID AND wcabe_child_img_meta.meta_key = '_thumbnail_id' ) ";
+                                        $child_joins  .= " INNER JOIN {$wpdb->posts} AS wcabe_child_img ON ( wcabe_child_img.ID = CAST( wcabe_child_img_meta.meta_value AS UNSIGNED ) AND wcabe_child_img.post_type = 'attachment' ) ";
+                                        // A product with no image, a stale _thumbnail_id, or one pointing at
+                                        // a non-attachment leaves post_date NULL through the LEFT JOIN, and
+                                        // NULL fails every comparison — excluded, as intended.
+                                        $own_parts[]   = $build_bound( 'wcabe_img.post_date', $image_date_min, $image_date_max, '%s' );
+                                        $child_parts[] = $build_bound( 'wcabe_child_img.post_date', $image_date_min, $image_date_max, '%s' );
+                                }
+                                foreach ( $sale_predicates as $range ) {
+                                        $parent_col    = "{$range['parent_alias']}.meta_value";
+                                        $child_col     = "{$range['child_alias']}.meta_value";
+                                        $child_joins  .= " INNER JOIN {$wpdb->postmeta} AS {$range['child_alias']} ON ( {$range['child_alias']}.post_id = c.ID AND {$range['child_alias']}.meta_key = '{$range['meta_key']}' ) ";
+                                        $own_parts[]   = "( {$parent_col} <> '' AND " . $build_bound( "CAST( {$parent_col} AS UNSIGNED )", $range['min'], $range['max'], '%d' ) . ' )';
+                                        $child_parts[] = "( {$child_col} <> '' AND " . $build_bound( "CAST( {$child_col} AS UNSIGNED )", $range['min'], $range['max'], '%d' ) . ' )';
+                                }
+                                if ( $use_sale ) {
+                                        // A variable parent's own sale meta is necessarily stale (the plugin
+                                        // treats sale dates as absent on variable parents and never writes
+                                        // them), so while a sale filter is active such a parent may only
+                                        // match through a child variation.
+                                        $own_parts[] = "NOT {$is_variable}";
+                                }
+                                $own = empty( $own_parts ) ? '' : '( ' . implode( ' AND ', $own_parts ) . ' )';
+                                $child = '';
+                                if ( $include_variations && ! empty( $child_parts ) ) {
+                                        $child = "( {$is_variable} AND EXISTS ( SELECT 1 FROM {$wpdb->posts} c{$child_joins}"
+                                                . " WHERE c.post_parent = {$wpdb->posts}.ID AND c.post_type = 'product_variation'"
+                                                . " AND c.post_status IN ( 'publish', 'private' ) AND " . implode( ' AND ', $child_parts ) . ' ) )';
+                                }
+                                // Parenthesize so the OR cannot escape the query's other predicates.
+                                if ( '' !== $own && '' !== $child ) {
+                                        $where .= " AND ( {$own} OR {$child} ) ";
+                                } elseif ( '' !== $own ) {
+                                        $where .= " AND {$own} ";
+                                } elseif ( '' !== $child ) {
+                                        $where .= " AND {$child} ";
+                                }
+                                return $where;
+                        };
+                }
                 if ( $needs_custom_query ) {
                         add_filter(
 …
                         add_filter( 'posts_join', $stock_qty_join_callback, 10, 1 );
                         add_filter( 'posts_where', $stock_qty_where_callback, 10, 1 );
+                }
+                if ( $product_url_join_callback ) {
+                        // Marker first — it must be on the query args before WP_Query is built.
+                        add_filter( 'woocommerce_product_data_store_cpt_get_products_query', $product_url_marker_callback, 10, 1 );
+                        add_filter( 'posts_join', $product_url_join_callback, 10, 2 );
+                        add_filter( 'posts_where', $product_url_where_callback, 10, 2 );
+                }
+                if ( $combined_join_callback ) {
+                        add_filter( 'posts_join', $combined_join_callback, 10, 1 );
+                }
+                if ( $combined_where_callback ) {
+                        add_filter( 'posts_where', $combined_where_callback, 10, 1 );
+                }
 …
                                 remove_filter( 'posts_where', $stock_qty_where_callback, 10 );
+                        }
+                        if ( $product_url_join_callback ) {
+                                remove_filter( 'woocommerce_product_data_store_cpt_get_products_query', $product_url_marker_callback, 10 );
+                                remove_filter( 'posts_join', $product_url_join_callback, 10 );
+                                remove_filter( 'posts_where', $product_url_where_callback, 10 );
+                        }
+                        if ( $combined_join_callback ) {
+                                remove_filter( 'posts_join', $combined_join_callback, 10 );
+                        }
+                        if ( $combined_where_callback ) {
+                                remove_filter( 'posts_where', $combined_where_callback, 10 );
+                        }
                         if ( $search_join_callback ) {
                                 remove_filter( 'posts_join', $search_join_callback, 10 );
 …
         /**
+         * Build the post_title search WHERE clause for the given match mode.
+         *
+         * - 'all' (default): every whitespace-separated word must appear (joined with AND).
+         * - 'any': at least one word must appear (joined with OR).
+         * - 'phrase' or a single-word term: the whole term as one LIKE
+         *   (matches the historical behavior — contiguous substring, order-sensitive).
+         *
+         * Multi-word matching splits on whitespace and caps at 10 words to bound the
+         * number of LIKE clauses. The fragment is parenthesized so the caller can
+         * safely AND it with the SKU clause.
+         *
+         * @param \wpdb  $wpdb WordPress database handle.
+         * @param string $term Sanitized search term.
+         * @param string $mode One of 'phrase', 'all', 'any'.
+         * @return string Prepared SQL fragment (already wrapped in parentheses).
+         */
+        private function build_name_search_clause( \wpdb $wpdb, string $term, string $mode ): string {
+                $words = [];
+                if ( 'phrase' !== $mode ) {
+                        $split = preg_split( '/\s+/', trim( $term ), -1, PREG_SPLIT_NO_EMPTY );
+                        $words = is_array( $split ) ? $split : [];
+                }
+                // Phrase mode, or fewer than two words: original whole-term LIKE.
+                if ( count( $words ) < 2 ) {
+                        $like = '%' . $wpdb->esc_like( $term ) . '%';
+                        return $wpdb->prepare( "( {$wpdb->posts}.post_title LIKE %s )", $like );
+                }
+                // Cap the word count to bound the LIKE chain length.
+                $words     = array_slice( $words, 0, 10 );
+                $connector = ( 'any' === $mode ) ? 'OR' : 'AND';
+                $likes  = [];
+                $values = [];
+                foreach ( $words as $word ) {
+                        $likes[]  = "{$wpdb->posts}.post_title LIKE %s";
+                        $values[] = '%' . $wpdb->esc_like( $word ) . '%';
+                }
+                $sql = '( ' . implode( " {$connector} ", $likes ) . ' )';
+                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $sql is a fixed chain of `%s` placeholders (one per word), each expanded by prepare() via the spread of $values below.
+                return $wpdb->prepare( $sql, ...$values );
+                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+        }
+        /**
+         * Build the SKU search WHERE clause for the given match mode.
+         *
+         * A comma-separated term is a LIST OF VALUES applied under the selected
+         * mode — the mode is authoritative, the comma only multiplies it. The four
+         * positive modes OR their values together (match ANY); not_contains ANDs
+         * them (match NONE).
+         *
+         * Mode '' is the legacy "auto" behaviour, preserved for requests and saved
+         * views written before match modes existed: a comma in the term means
+         * exact IN, otherwise a whole-term substring LIKE. It maps onto
+         * is_exactly / contains, which produce that same SQL — with two
+         * deliberate exceptions, not regressions: "0" is now treated as a real
+         * token (see split_sku_term()) instead of being dropped by truthiness
+         * filtering, and the token count is capped at self::SKU_SEARCH_MAX_TOKENS.
+         *
+         * not_contains reads the SKU through COALESCE so a product with no SKU (or
+         * no lookup row at all — the JOIN is a LEFT JOIN) counts as "does not
+         * contain". The positive modes deliberately keep the bare column: NULL LIKE
+         * is NULL, which correctly excludes, and the plain column stays
+         * index-eligible for the anchored LIKE of starts_with.
+         *
+         * The fragment is parenthesized so the caller can safely AND it with the
+         * name clause.
+         *
+         * @param \wpdb  $wpdb
+         * @param string $term               Raw (already sanitized) search_sku value.
+         * @param string $mode               One of self::SKU_SEARCH_MODES, or '' for auto/legacy.
+         * @param bool   $include_variations Whether to also surface parents via a matching child.
+         * @return string SQL fragment, or '' when the term holds no usable tokens.
+         */
+        private function build_sku_search_clause( \wpdb $wpdb, string $term, string $mode, bool $include_variations ): string {
+                $mode   = self::normalize_sku_mode( $mode );
+                $tokens = self::split_sku_term( $term );
+                if ( '' === $mode ) {
+                        // Legacy auto: the comma was the (implicit) mode selector.
+                        $mode = ( strpos( $term, ',' ) !== false ) ? 'is_exactly' : 'contains';
+                }
+                // Comma-only term ( ",,, " ) yields no tokens — no clause, as before.
+                if ( empty( $tokens ) ) {
+                        return '';
+                }
+                $negated = ( 'not_contains' === $mode );
+                /**
+                 * Build a parenthesized predicate over one column for every token.
+                 *
+                 * @param string $column SQL column expression.
+                 * @return array{0: string, 1: string[]} [ sql, prepare values ]
+                 */
+                $build_predicate = function ( string $column ) use ( $wpdb, $mode, $tokens, $negated ): array {
+                        if ( 'is_exactly' === $mode ) {
+                                $placeholders = implode( ',', array_fill( 0, count( $tokens ), '%s' ) );
+                                return [ "( {$column} IN ({$placeholders}) )", $tokens ];
+                        }
+                        $operator  = $negated ? 'NOT LIKE' : 'LIKE';
+                        $connector = $negated ? ' AND ' : ' OR ';
+                        $parts  = [];
+                        $values = [];
+                        foreach ( $tokens as $token ) {
+                                $escaped = $wpdb->esc_like( $token );
+                                switch ( $mode ) {
+                                        case 'starts_with':
+                                                $values[] = $escaped . '%';
+                                                break;
+                                        case 'ends_with':
+                                                $values[] = '%' . $escaped;
+                                                break;
+                                        default: // contains / not_contains.
+                                                $values[] = '%' . $escaped . '%';
+                                                break;
+                                }
+                                $parts[] = "{$column} {$operator} %s";
+                        }
+                        return [ '( ' . implode( $connector, $parts ) . ' )', $values ];
+                };
+                $parent_column = $negated ? "COALESCE( wcabe_sku_lookup.sku, '' )" : 'wcabe_sku_lookup.sku';
+                [ $parent_sql, $parent_values ] = $build_predicate( $parent_column );
+                if ( ! $include_variations ) {
+                        // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $parent_sql is a fixed chain of `%s` placeholders (one per token), each expanded by prepare() via the spread below.
+                        return $wpdb->prepare( $parent_sql, ...$parent_values );
+                        // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+                }
+                // Also surface a parent whose child variation matches, so
+                // interleave_variations() can show that variation. Status predicate
+                // matches WC get_children(), which returns only publish/private
+                // variations. The child branch is gated on the parent being variable —
+                // a stale variation left behind by a variable->simple type conversion
+                // must not surface its now-simple parent.
+                //
+                // not_contains joins LEFT with meta_key in the ON clause so a variation
+                // with no _sku row still counts as "does not contain"; an INNER JOIN
+                // would make it invisible.
+                $child_column = $negated ? "COALESCE( pm.meta_value, '' )" : 'pm.meta_value';
+                [ $child_sql, $child_values ] = $build_predicate( $child_column );
+                $child_join = $negated
+                        ? "LEFT JOIN {$wpdb->postmeta} pm ON ( p.ID = pm.post_id AND pm.meta_key = '_sku' )"
+                        : "INNER JOIN {$wpdb->postmeta} pm ON p.ID = pm.post_id";
+                $meta_key_where = $negated ? '' : " AND pm.meta_key = '_sku'";
+                $is_variable = $this->sql_is_variable_product();
+                // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $parent_sql/$child_sql are fixed chains of `%s` placeholders (one per token), all expanded by prepare() via the merged spread below.
+                return $wpdb->prepare(
+                        "( {$parent_sql}"
+                        . " OR ( {$is_variable} AND {$wpdb->posts}.ID IN ("
+                        . " SELECT p.post_parent FROM {$wpdb->posts} p"
+                        . " {$child_join}"
+                        . " WHERE p.post_type = 'product_variation'"
+                        . " AND p.post_status IN ('publish','private')"
+                        . $meta_key_where
+                        . " AND {$child_sql}"
+                        . ' ) ) )',
+                        ...array_merge( $parent_values, $child_values )
+                );
+                // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
+        }
+        /**
          * Build a WC date range string for date_created / date_modified args.
+         *
 …
+                }
                 return '<=' . $before;
+        }
+        /**
+         * Resolve a sale-date filter range to site-local Unix timestamp bounds.
+         *
+         * _sale_price_dates_from / _sale_price_dates_to are stored as Unix timestamps
+         * derived from site-local dates, and the grid renders them in site time — so
+         * bounds must be computed in site time too.
+         *
+         * The upper bound is derived from an explicit local 23:59:59, NOT from
+         * "local midnight + DAY_IN_SECONDS - 1": a local day is 23 or 25 hours long
+         * across a DST transition, so the arithmetic form would spill into the next
+         * day or drop the final hour.
+         *
+         * @param string $after  Start date (YYYY-MM-DD) or empty.
+         * @param string $before End date (YYYY-MM-DD) or empty.
+         * @return array{0: ?int, 1: ?int} [ min_timestamp, max_timestamp ], null when unbounded.
+         */
+        private function sale_date_filter_bounds( string $after, string $before ): array {
+                $min = '' !== $after ? wc_string_to_datetime( $after )->getTimestamp() : null;
+                $max = '' !== $before ? wc_string_to_datetime( $before . ' 23:59:59' )->getTimestamp() : null;
+                return [ $min, $max ];
+        }
+        /**
+         * SQL EXISTS expression testing whether the current wp_posts row is a
+         * variable product.
+         *
+         * Used by the posts_where filter callbacks to gate child-variation EXISTS
+         * branches on the parent actually being variable. A variable->simple type
+         * conversion can leave published variation posts behind, and without the
+         * gate a stale child's matching meta would surface its now-simple parent —
+         * a false-positive row interleave_variations() can neither narrow nor
+         * remove, since it only processes children of variable parents.
+         *
+         * @return string
+         */
+        private function sql_is_variable_product(): string {
+                global $wpdb;
+                // Covers third-party variable subclasses (variable-subscription, …), not
+                // just the native 'variable' slug (#137). Slugs come from registered
+                // product classes, not user input, but are escaped anyway.
+                $slugs_in = implode(
+                        ',',
+                        array_map(
+                                static fn( string $slug ): string => "'" . esc_sql( $slug ) . "'",
+                                self::get_variable_product_types()
+                        )
+                );
+                return "EXISTS ( SELECT 1 FROM {$wpdb->term_relationships} tr"
+                        . " INNER JOIN {$wpdb->term_taxonomy} tt ON tt.term_taxonomy_id = tr.term_taxonomy_id"
+                        . " INNER JOIN {$wpdb->terms} t ON t.term_id = tt.term_id"
+                        . " WHERE tr.object_id = {$wpdb->posts}.ID AND tt.taxonomy = 'product_type' AND t.slug IN ( {$slugs_in} ) )";
+        }
+        /**
+         * SQL predicate matching external (affiliate) products.
+         *
+         * Mirrors sql_is_variable_product(). Scopes EVERY Product URL filter operator
+         * to the only type that surfaces the field — see the note at the filter's
+         * where-callback.
+         *
+         * @return string
+         */
+        private function sql_is_external_product(): string {
+                global $wpdb;
+                return "EXISTS ( SELECT 1 FROM {$wpdb->term_relationships} tr"
+                        . " INNER JOIN {$wpdb->term_taxonomy} tt ON tt.term_taxonomy_id = tr.term_taxonomy_id"
+                        . " INNER JOIN {$wpdb->terms} t ON t.term_id = tt.term_id"
+                        . " WHERE tr.object_id = {$wpdb->posts}.ID AND tt.taxonomy = 'product_type' AND t.slug = 'external' )";
+        }
 …
                         $result[] = $product;
+                        if ( $product['type'] === 'variable' && $product['variation_count'] > 0 ) {
+                        // variation_count is only non-zero for variable-capable products
+                        // (format_product gates it on instanceof WC_Product_Variable), so it
+                        // doubles as the "has interleavable children" signal — covering
+                        // third-party variable subclasses, not just type === 'variable' (#137).
+                        if ( ! empty( $product['variation_count'] ) ) {
                                 // Use pre-collected children IDs when available, falling back to
                                 // loading the parent product (should only happen if called without
 …
+                                }
+                                // If the parent surfaced via its OWN SKU, show all its variations:
+                                // a SKU match on the product itself means "show this product", not
+                                // "filter its variants". Other meta filters still narrow children.
+                                //
+                                // NOT for not_contains: under a negative mode nearly every parent
+                                // matches on its own SKU, so honouring the rule there would switch
+                                // variation narrowing off wholesale and show children whose SKUs DO
+                                // contain the term. Accepted consequence: a parent that passes
+                                // not_contains while all of its children fail renders as an empty
+                                // parent row — the same class of edge as the limitation below.
+                                //
+                                // Inverse edge, positive modes: build_sku_search_clause() ORs the
+                                // parent's own SKU with "any child matches" — a parent whose OWN
+                                // SKU does NOT match still surfaces (and its non-matching own SKU
+                                // is what the grid displays) as long as at least one child does.
+                                // That parent row's visible SKU therefore will not itself contain
+                                // the searched term. Intentional: the parent row is a container for
+                                // the matching child, not a claim that the parent's own SKU matches.
+                                //
+                                // Known limitation: when search_sku and search_description match
+                                // DIFFERENT siblings, the SQL ORs surface the parent but the
+                                // per-child AND below can hide both → empty parent. Pre-existing
+                                // with search_description; not resolved here.
+                                $child_filters         = $filters;
+                                $child_has_meta_filter = $has_meta_filter;
+                                $sku_mode              = self::normalize_sku_mode( $filters['search_sku_mode'] ?? '' );
+                                if (
+                                        $has_meta_filter
+                                        && 'not_contains' !== $sku_mode
+                                        && true === $this->sku_term_matches( (string) ( $product['sku'] ?? '' ), (string) ( $filters['search_sku'] ?? '' ), $sku_mode )
+                                ) {
+                                        unset( $child_filters['search_sku'], $child_filters['search_sku_mode'] );
+                                        $child_has_meta_filter = $this->has_variation_meta_filters( $child_filters );
+                                }
                                 foreach ( $children as $child_id ) {
                                         $variation = wc_get_product( $child_id );
                                         if ( $variation && $variation->is_type( 'variation' ) ) {
                                                 if ( $has_meta_filter && ! $this->variation_matches_filters( $variation, $filters ) ) {
+                                                if ( $child_has_meta_filter && ! $this->variation_matches_filters( $variation, $child_filters ) ) {
                                                         continue;
+                                                }
 …
          * Returns an approximate flag because the raw COUNT(*) does not replicate
          * variation_matches_filters() — variation-level filters (price, stock_qty,
          * manage_stock, backorders, search_description) cause an over-count at
          * render time. Accepted as a safe upper bound.
+         * menu_order, manage_stock, backorders, search_description, search_sku) cause
+         * an over-count at render time. Accepted as a safe upper bound.
+         *
          * @param int   $total_parents Total parents matching filters (from main query).
 …
                 foreach ( array_chunk( $variable_parent_ids, 1000 ) as $chunk ) {
                         $placeholders = implode( ',', array_fill( 0, count( $chunk ), '%d' ) );
                         // post_status NOT IN ('trash', 'auto-draft') matches what the main
                         // rendering path surfaces: get_children() returns all non-trashed
                         // child IDs, and wc_get_product() returns any non-auto-draft
                         // variation. Earlier version used IN ('publish', 'private'), which
                         // under-counted drafts. See Product_Service::get_variations() for
                         // the matching path. Parent status filtering is already applied
                         // via the parent-ID query above; this clause is the independent
+                        // post_status IN ('publish', 'private') mirrors the render path:
+                        // WC_Product_Variable::get_children() queries variation children with
+                        // post_status => array( publish, private ) (verified in WC 10.8.1,
+                        // class-wc-product-variable-data-store-cpt.php), so the grid only ever
+                        // renders those. Counting draft/pending here would over-report rows
+                        // that never display. Parent status filtering is already applied via
+                        // the parent-ID query above; this clause is the independent
                         // VARIATION-status axis in WC's data model.
                         // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- $placeholders is a comma-joined string of `%d` placeholders, one per element of $chunk, all expanded by prepare() via spread.
 …
                                 "SELECT COUNT(*) FROM {$wpdb->posts}
                                  WHERE post_type = 'product_variation'
                                    AND post_status NOT IN ('trash', 'auto-draft')
+                                   AND post_status IN ('publish', 'private')
                                    AND post_parent IN ($placeholders)",
                                 ...$chunk
 …
                         return true;
+                }
+                if ( isset( $filters['menu_order_min'] ) && '' !== $filters['menu_order_min'] ) {
+                        return true;
+                }
+                if ( isset( $filters['menu_order_max'] ) && '' !== $filters['menu_order_max'] ) {
+                        return true;
+                }
+                if (
+                        ( ( isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'] ) || ( isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'] ) )
+                        && Product_Helper::is_cogs_enabled()
+                ) {
+                        return true;
+                }
                 if ( ! empty( $filters['manage_stock'] ) ) {
                         return true;
 …
                         return true;
+                }
+                foreach ( [ 'sale_start_after', 'sale_start_before', 'sale_end_after', 'sale_end_before' ] as $sale_param ) {
+                        if ( isset( $filters[ $sale_param ] ) && '' !== $filters[ $sale_param ] ) {
+                                return true;
+                        }
+                }
+                foreach ( [ 'image_date_after', 'image_date_before' ] as $image_param ) {
+                        if ( isset( $filters[ $image_param ] ) && '' !== $filters[ $image_param ] ) {
+                                return true;
+                        }
+                }
                 if ( ! empty( $filters['search_description'] ) ) {
                         return true;
+                }
+                // Strict '' test, not empty(): "0" is a valid SKU.
+                if ( $this->sku_term_is_effective( (string) ( $filters['search_sku'] ?? '' ) ) ) {
+                        return true;
+                }
                 // search_short_description is not checked — variations don't have short
                 // descriptions; the parent-level post_excerpt filter is sufficient.
+                // product_url is not checked either — only external products carry one,
+                // and an external product is never variable, so the filter can never
+                // surface a parent through a child variation.
                 return false;
+        }
+        /**
+         * Whether a search_sku term would produce an actual SQL clause. False for an
+         * empty term or a comma-only term with no real tokens — the query builds no
+         * clause in those cases. Shared so per-variation narrowing and the
+         * approximate-count flag agree on what counts as an active SKU filter.
+         *
+         * Deliberately takes no mode: effectiveness is mode-invariant, because every
+         * mode (and the legacy auto branch) builds its clause from the same token
+         * list — see build_sku_search_clause(), which returns '' on an empty list
+         * regardless of mode.
+         *
+         * @param string $term Raw search_sku filter value.
+         * @return bool
+         */
+        private function sku_term_is_effective( string $term ): bool {
+                return [] !== self::split_sku_term( sanitize_text_field( $term ) );
+        }
+        /**
+         * Match a SKU against a search_sku term + mode, mirroring the SQL built by
+         * build_sku_search_clause() and its sanitization. Returns null when the term
+         * is not an effective filter, so callers neither surface nor narrow on it —
+         * callers compare against true/false strictly and rely on that third state.
+         * mb_* keeps case-folding parity with MySQL's default utf8mb4_*_ci collation
+         * for multibyte SKUs.
+         *
+         * The positive modes match ANY token; not_contains must miss EVERY token,
+         * and an empty SKU therefore matches it — mirroring the COALESCE in the SQL.
+         *
+         * @param string $sku  The SKU to test.
+         * @param string $term Raw search_sku filter value.
+         * @param mixed  $mode Raw search_sku_mode filter value (normalised here).
+         * @return bool|null
+         */
+        private function sku_term_matches( string $sku, string $term, $mode = '' ): ?bool {
+                if ( ! $this->sku_term_is_effective( $term ) ) {
+                        return null;
+                }
+                $term   = sanitize_text_field( $term );
+                $mode   = self::normalize_sku_mode( $mode );
+                $tokens = self::split_sku_term( $term );
+                if ( '' === $mode ) {
+                        // Legacy auto: the comma was the (implicit) mode selector.
+                        $mode = ( strpos( $term, ',' ) !== false ) ? 'is_exactly' : 'contains';
+                }
+                $sku_folded = mb_strtolower( $sku );
+                if ( 'is_exactly' === $mode ) {
+                        $folded = array_map(
+                                static fn( string $token ): string => mb_strtolower( $token ),
+                                $tokens
+                        );
+                        return in_array( $sku_folded, $folded, true );
+                }
+                foreach ( $tokens as $token ) {
+                        $token_folded = mb_strtolower( $token );
+                        switch ( $mode ) {
+                                case 'starts_with':
+                                        $hit = 0 === mb_strpos( $sku_folded, $token_folded );
+                                        break;
+                                case 'ends_with':
+                                        $token_length = mb_strlen( $token_folded );
+                                        $hit          = $token_length <= mb_strlen( $sku_folded )
+                                                && mb_substr( $sku_folded, -$token_length ) === $token_folded;
+                                        break;
+                                default: // contains / not_contains.
+                                        $hit = false !== mb_strpos( $sku_folded, $token_folded );
+                                        break;
+                        }
+                        if ( 'not_contains' === $mode ) {
+                                // Must miss every token — one hit disqualifies.
+                                if ( $hit ) {
+                                        return false;
+                                }
+                        } elseif ( $hit ) {
+                                // Positive modes match any token — one hit is enough.
+                                return true;
+                        }
+                }
+                return 'not_contains' === $mode;
+        }
 …
+                }
+                // Cost of Goods range — match on the variation's OWN defined value (null =
+                // inherits parent, treated as no-match, like stock qty). Gated on
+                // is_cogs_enabled() so get_cogs_value() never fires when the feature is off.
+                $has_cogs_min = isset( $filters['cogs_min'] ) && '' !== $filters['cogs_min'];
+                $has_cogs_max = isset( $filters['cogs_max'] ) && '' !== $filters['cogs_max'];
+                if ( ( $has_cogs_min || $has_cogs_max ) && Product_Helper::is_cogs_enabled() ) {
+                        $cogs = $variation->get_cogs_value();
+                        if ( null === $cogs ) {
+                                return false;
+                        }
+                        if ( $has_cogs_min && $cogs < (float) $filters['cogs_min'] ) {
+                                return false;
+                        }
+                        if ( $has_cogs_max && $cogs > (float) $filters['cogs_max'] ) {
+                                return false;
+                        }
+                }
+                // Menu order range — the variation's own value (get_menu_order() is always
+                // an int, default 0; no null-guard needed like stock qty / COGS).
+                $has_menu_min = isset( $filters['menu_order_min'] ) && '' !== $filters['menu_order_min'];
+                $has_menu_max = isset( $filters['menu_order_max'] ) && '' !== $filters['menu_order_max'];
+                if ( $has_menu_min || $has_menu_max ) {
+                        $order = $variation->get_menu_order();
+                        if ( $has_menu_min && $order < (int) $filters['menu_order_min'] ) {
+                                return false;
+                        }
+                        if ( $has_menu_max && $order > (int) $filters['menu_order_max'] ) {
+                                return false;
+                        }
+                }
+                // Sale-schedule date ranges — the variation's OWN schedule (null = no sale
+                // scheduled, treated as no-match, like stock qty / COGS). Y-m-d strings are
+                // zero-padded so lexical comparison is chronological, and WC_DateTime::date()
+                // renders in site time — the same basis as the SQL bounds.
+                $sale_date_ranges = [
+                        [ 'get_date_on_sale_from', 'sale_start_after', 'sale_start_before' ],
+                        [ 'get_date_on_sale_to', 'sale_end_after', 'sale_end_before' ],
+                ];
+                foreach ( $sale_date_ranges as list( $getter, $after_key, $before_key ) ) {
+                        $has_after  = isset( $filters[ $after_key ] ) && '' !== $filters[ $after_key ];
+                        $has_before = isset( $filters[ $before_key ] ) && '' !== $filters[ $before_key ];
+                        if ( ! $has_after && ! $has_before ) {
+                                continue;
+                        }
+                        $sale_date = $variation->{$getter}();
+                        if ( null === $sale_date ) {
+                                return false;
+                        }
+                        $value = $sale_date->date( 'Y-m-d' );
+                        if ( $has_after && $value < $filters[ $after_key ] ) {
+                                return false;
+                        }
+                        if ( $has_before && $value > $filters[ $before_key ] ) {
+                                return false;
+                        }
+                }
+                // Image-uploaded date range — the variation's OWN featured image ('edit'
+                // context bypasses the filter that inherits the parent image for imageless
+                // variations, matching format_variation()). No own image, a stale
+                // _thumbnail_id, or one pointing at a non-attachment = no match, like stock
+                // qty / COGS / sale dates. Y-m-d strings are zero-padded so lexical
+                // comparison is chronological, and the attachment post_date is site-local —
+                // the same basis as the SQL bounds.
+                $has_image_after  = isset( $filters['image_date_after'] ) && '' !== $filters['image_date_after'];
+                $has_image_before = isset( $filters['image_date_before'] ) && '' !== $filters['image_date_before'];
+                if ( $has_image_after || $has_image_before ) {
+                        $image_date = Product_Helper::get_image_upload_date( (int) $variation->get_image_id( 'edit' ) );
+                        if ( '' === $image_date ) {
+                                return false;
+                        }
+                        $value = substr( $image_date, 0, 10 );
+                        if ( $has_image_after && $value < $filters['image_date_after'] ) {
+                                return false;
+                        }
+                        if ( $has_image_before && $value > $filters['image_date_before'] ) {
+                                return false;
+                        }
+                }
                 // Manage stock.
                 if ( ! empty( $filters['manage_stock'] ) ) {
 …
+                }
+                // SKU (_sku meta). A null result means the term is not an effective
+                // filter (empty / comma-only) — the SQL builds no clause then, so don't
+                // narrow here either. See sku_term_matches() for per-mode parity.
+                //
+                // 'edit' context, deliberately: WC_Product_Variation::get_sku() falls back
+                // to the PARENT's SKU whenever the variation's own value is empty() — and
+                // PHP counts the perfectly valid SKU "0" as empty. The SQL matches on the
+                // variation's own _sku meta, so the mirror must read the own value or it
+                // narrows on a SKU the query never looked at.
+                if (
+                        false === $this->sku_term_matches(
+                                (string) $variation->get_sku( 'edit' ),
+                                (string) ( $filters['search_sku'] ?? '' ),
+                                $filters['search_sku_mode'] ?? ''
+                        )
+                ) {
+                        return false;
+                }
                 // Short description — variations don't have one (no postmeta equivalent),
                 // so skip this check; the parent-level post_excerpt filter already ran.

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/includes/Services/View_Service.php

-              r3549389
+              r3663491
 namespace WCABE_G2\Services;
+use WCABE_G2\Helpers\Page_Size_Helper;
 defined( 'ABSPATH' ) || exit;
 …
                                 $view['filters'] = $this->migrate_filters_shape( $view['filters'] );
+                        }
+                        // Bound a stored page size on read: a site that has since LOWERED
+                        // wcabe_g2_max_per_page must not hand the client a size the products
+                        // route would silently reduce. Views saved before page_size existed
+                        // are deliberately NOT backfilled — the frontend falls back to its
+                        // effective default, which keeps "absent" distinguishable from "100".
+                        if ( isset( $view['page_size'] ) ) {
+                                $view['page_size'] = Page_Size_Helper::clamp( $view['page_size'] );
+                        }
+                }
                 unset( $view );
 …
                         'filters'      => $this->sanitize_filters( $data['filters'] ?? [] ),
                         'column_state' => self::sanitize_column_state( $data['column_state'] ?? [] ),
+                        'page_size'    => Page_Size_Helper::clamp( $data['page_size'] ?? null ),
                         'is_default'   => ! empty( $data['is_default'] ),
                         'created_at'   => gmdate( 'Y-m-d\TH:i:s\Z' ),
 …
+                }
+                if ( isset( $data['page_size'] ) ) {
+                        $views[ $index ]['page_size'] = Page_Size_Helper::clamp( $data['page_size'] );
+                }
                 if ( isset( $data['is_default'] ) ) {
                         $views[ $index ]['is_default'] = (bool) $data['is_default'];
 …
          * Sanitize filters to match the expected FilterValues shape.
+         *
+         * Thin instance wrapper: migrate any legacy saved-view bag shape, then delegate
+         * to the public static sanitizer. Stays private/instance-bound only because the
+         * migration call (migrate_filters_shape) is instance-bound.
+         *
          * @param array $filters
          * @return array
          */
         private function sanitize_filters( array $filters ): array {
+                return self::sanitize_filter_values( $this->migrate_filters_shape( $filters ) );
+        }
+        /**
+         * Sanitize a URL-substring filter value.
+         *
+         * Deliberately NOT sanitize_text_field(): that strips percent-encoded octets
+         * (see wp-includes/formatting.php), so searching for "%20" or "%2F" — both
+         * common in real product URLs — would silently match nothing. Strips control
+         * characters and markup, preserves %XX. SQL safety is handled downstream by
+         * $wpdb->prepare() + esc_like(); this is only about control chars and tags.
+         *
+         * @param mixed $value Raw filter value.
+         * @return string
+         */
+        public static function sanitize_url_filter_value( $value ): string {
+                if ( ! is_scalar( $value ) ) {
+                        return '';
+                }
+                $value = wp_check_invalid_utf8( (string) $value );
+                $value = wp_strip_all_tags( $value );
+                // Null bytes and C0/C1 control characters (incl. newlines and tabs).
+                $value = preg_replace( '/[\x00-\x1F\x7F-\x9F]/u', '', $value );
+                return trim( (string) $value );
+        }
+        /**
+         * Sanitize a FilterValues blob (scalar fields + dynamic bags) into the canonical
+         * shape. Public + static so reusable outside view CRUD — the User_Settings
+         * controller calls it for the filterDraft field (mirrors sanitize_column_state).
+         *
+         * No migration here: callers that may receive a legacy bag shape (saved views)
+         * migrate first via the wrapper; live frontend draft data is already current.
+         * The migrate-then-sanitize order is behavior-preserving — migration only renames
+         * the dynamic bags (which the body re-reads), and never touches the scalar fields.
+         *
+         * @param array $filters
+         * @return array
+         */
+        public static function sanitize_filter_values( array $filters ): array {
                 $allowed_operators = [ '=', '>', '<', '>=', '<=', 'expression' ];
                 $id_operator       = $filters['id_operator'] ?? '=';
 …
+                }
+                $search_name_mode = $filters['search_name_mode'] ?? 'all';
+                if ( ! in_array( $search_name_mode, Product_Service::TITLE_SEARCH_MODES, true ) ) {
+                        $search_name_mode = 'all';
+                }
+                // SKU match mode. '' is the legacy "auto" state (comma = exact, single
+                // value = partial), so an unknown mode falls back to it rather than to a
+                // concrete mode. Sanitize the term FIRST — sanitize_text_field trims, so
+                // a whitespace-only term canonicalizes to '' here — and drop the mode
+                // with it: a mode left behind an empty term would make a freshly loaded
+                // view report a phantom "Modified" (same rationale as product URL below).
+                $search_sku      = sanitize_text_field( $filters['search_sku'] ?? '' );
+                $search_sku_mode = $filters['search_sku_mode'] ?? '';
+                if ( ! in_array( $search_sku_mode, Product_Service::SKU_SEARCH_MODES, true ) ) {
+                        $search_sku_mode = '';
+                }
+                if ( '' === $search_sku ) {
+                        $search_sku_mode = '';
+                }
+                // Product URL filter. Canonicalized here as well as in the client store,
+                // because a view can also be created/imported straight through the REST
+                // API: a stale value hidden behind an empty-check operator would persist
+                // and — since the dirty-state baseline compares against the STORED view —
+                // make a freshly loaded view report a phantom "Modified".
+                $product_url_operator = $filters['product_url_operator'] ?? 'contains';
+                if ( ! in_array( $product_url_operator, Product_Service::PRODUCT_URL_OPERATORS, true ) ) {
+                        $product_url_operator = 'contains';
+                }
+                $product_url_value = self::sanitize_url_filter_value( $filters['product_url_value'] ?? '' );
+                if ( Product_Service::is_product_url_empty_check( $product_url_operator ) ) {
+                        $product_url_value = '';
+                } elseif ( '' === $product_url_value ) {
+                        $product_url_operator = 'contains';
+                }
                 $sanitized = [
                         // Original fields.
                         'search_name'             => sanitize_text_field( $filters['search_name'] ?? '' ),
+                        'search_sku'              => sanitize_text_field( $filters['search_sku'] ?? '' ),
+                        'search_name_mode'        => $search_name_mode,
+                        'search_sku'              => $search_sku,
+                        'search_sku_mode'         => $search_sku_mode,
                         'category'                => array_map( 'absint', (array) ( $filters['category'] ?? [] ) ),
+                        'tag'                     => array_map( 'absint', (array) ( $filters['tag'] ?? [] ) ),
                         'type'                    => array_map( 'sanitize_text_field', (array) ( $filters['type'] ?? [] ) ),
                         'status'                  => array_map( 'sanitize_text_field', (array) ( $filters['status'] ?? [] ) ),
                         'stock_status'            => array_map( 'sanitize_text_field', (array) ( $filters['stock_status'] ?? [] ) ),
+                        // Slugs. The filter callback drops values that sanitize_title reduced to
+                        // '' (junk like '!!!'), and array_values re-indexes so the result is a
+                        // JSON array rather than an object — a stored [''] would otherwise read
+                        // back as an active filter that matches nothing visible. Strict ''
+                        // equality, not array_filter()'s default truthiness: sanitize_title()
+                        // can legally produce the string '0', which truthiness would drop too.
+                        'shipping_class'          => array_values(
+                                array_filter(
+                                        array_map( 'sanitize_title', (array) ( $filters['shipping_class'] ?? [] ) ),
+                                        static fn( string $slug ): bool => '' !== $slug
+                                )
+                        ),
                         'price_min'               => sanitize_text_field( $filters['price_min'] ?? '' ),
                         'price_max'               => sanitize_text_field( $filters['price_max'] ?? '' ),
+                        'cogs_min'                => sanitize_text_field( $filters['cogs_min'] ?? '' ),
+                        'cogs_max'                => sanitize_text_field( $filters['cogs_max'] ?? '' ),
                         'stock_qty_min'           => sanitize_text_field( $filters['stock_qty_min'] ?? '' ),
                         'stock_qty_max'           => sanitize_text_field( $filters['stock_qty_max'] ?? '' ),
+                        'menu_order_min'          => sanitize_text_field( $filters['menu_order_min'] ?? '' ),
+                        'menu_order_max'          => sanitize_text_field( $filters['menu_order_max'] ?? '' ),
                         'manage_stock'            => array_map( 'sanitize_text_field', (array) ( $filters['manage_stock'] ?? [] ) ),
                         'backorders'              => array_map( 'sanitize_text_field', (array) ( $filters['backorders'] ?? [] ) ),
 …
                         'id_operator' => $id_operator,
                         'id_value'    => sanitize_text_field( $filters['id_value'] ?? '' ),
+                        // Product URL filter. NOTE: the value uses sanitize_url_filter_value(),
+                        // not sanitize_text_field() — the latter strips percent-encoded octets
+                        // (%20, %2F), silently corrupting legitimate URL substring searches.
+                        'product_url_operator' => $product_url_operator,
+                        'product_url_value'    => $product_url_value,
                         // Date filters.
 …
                         'date_modified_from' => sanitize_text_field( $filters['date_modified_from'] ?? '' ),
                         'date_modified_to'   => sanitize_text_field( $filters['date_modified_to'] ?? '' ),
+                        'sale_start_from'    => sanitize_text_field( $filters['sale_start_from'] ?? '' ),
+                        'sale_start_to'      => sanitize_text_field( $filters['sale_start_to'] ?? '' ),
+                        'sale_end_from'      => sanitize_text_field( $filters['sale_end_from'] ?? '' ),
+                        'sale_end_to'        => sanitize_text_field( $filters['sale_end_to'] ?? '' ),
+                        'image_date_from'    => sanitize_text_field( $filters['image_date_from'] ?? '' ),
+                        'image_date_to'      => sanitize_text_field( $filters['image_date_to'] ?? '' ),
                         // Dynamic filter bags — sanitized below.
 …
                         'extension_filters' => [],
                 ];
-                // Normalize any pre-Phase-B saved-view shape (old acf_filters /
-                // custom_meta_filters / taxonomy_filters keys) into extension_filters
-                // before the dynamic-bag sanitization below reads it.
-                $filters = $this->migrate_filters_shape( $filters );
                 // Attribute filters: Record<string, number[]> — Free feature.

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/readme.txt

-              r3549389
+              r3663491
 Tags: bulk edit, product editor, product bulk edit, woocommerce products, inventory
 Requires at least: 6.0
 Tested up to: 7.0
+Tested up to: 7.1
 Requires PHP: 8.0
 Stable tag: 1.0.0
+Stable tag: 1.2.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 * **Fill handle** — drag a cell down (or up) to copy its value to neighboring cells, Excel-style
 * **Bulk operations** — apply percentage price adjustments, find-and-replace, text append and prepend, and bulk category and tag assignment across many products at once
+* **Saved views** — save filter sets and column layouts as named views for one-click recall
+* **Filters** — filter by category, product type, stock status, name, SKU (CSV SKU lists supported), description, date created or modified, and more
+* **Wide field coverage** — prices, stock, SKUs, statuses, categories, tags, shipping class, menu order, upsells and cross-sells, product URL and button text for external products, and more
+* **Saved views** — save filter sets and column layouts as named views for one-click recall, and share them between sites with view import/export
+* **Filters** — filter by category, tags, product type, stock status, name and SKU (with exact/contains match modes and CSV SKU lists), description, dates created, modified, on sale, or image uploaded, and more
 * **Column management** — show, hide, reorder, resize, and pin columns; each user's layout is saved separately
 * **Keyboard shortcuts** — navigate and edit without touching the mouse
 * **Product operations** — duplicate and change status right from the grid
 * **Image and gallery management** — set featured images and manage product galleries directly from the grid
 * **CSV export** — export the current filtered view to CSV in one click
+* **CSV export** — export the current filtered view to CSV in one click, including large catalogs
 * **Dark mode** — switch between light and dark themes
+* **Fast loading** — virtualized rendering handles thousands of products without the browser choking
+* **Fast loading** — virtualized rendering handles thousands of products without the browser choking, with a configurable page size
+* **Plays well with others** — products from third-party type plugins (such as bundles or subscriptions) appear in the grid with their common fields editable, and an optional setting re-fires WordPress save hooks so sync and cache plugins stay in step
 = Built on proper WooCommerce APIs =
 …
 = Pro version =
 If you need more — regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, fine-grained selection tools for the current grid page, and more — there is a paid Pro version available at [wpmelon.com](https://wpmelon.com/bulk-edit/).
+If you need more — paste from Excel/Google Sheets, Operation History with restore, regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, bulk variation creation, variation attribute editing, WPML support, fine-grained selection tools for the current grid page, and more — there is a paid Pro version available at [wpmelon.com](https://wpmelon.com/bulk-edit/).
 The free version is genuinely useful on its own. Pro is for stores that need more advanced bulk-editing workflows or fields the free version doesn’t touch.
 …
 = Can I undo changes? =
 Edits are staged as pending changes in the grid before you save, so you can undo them or discard them entirely while they're unsaved. Once saved, changes go to the database and cannot be undone by the plugin itself — keep a backup, as you would with any bulk operation. (A proper edit history with rollback is planned for the Pro version.)
+Edits are staged as pending changes in the grid before you save, so you can undo them or discard them entirely while they're unsaved. Once saved, the free version can't undo them — keep a backup, as you would with any bulk operation. The Pro version adds Operation History, which records each save so you can review and restore previous field values (see below).
 = Is there a Pro version? =
+Yes. Pro adds regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, fine-grained selection tools for the current grid page, and more. It's available at [wpmelon.com](https://wpmelon.com/bulk-edit/). The free version is a complete, standalone tool — Pro extends it, it doesn't gate it.
+Yes. Pro adds paste from Excel/Google Sheets, Operation History with restore, regex find-and-replace, price rounding, custom and ACF meta field editing, custom taxonomies, bulk variation creation, variation attribute editing, WPML support, fine-grained selection tools for the current grid page, and more. It's available at [wpmelon.com](https://wpmelon.com/bulk-edit/). The free version is a complete, standalone tool — Pro extends it, it doesn't gate it.
+= What does Operation History store? (Pro) =
+Operation History is a Pro feature, currently in beta and off by default. When you turn it on, each bulk save is recorded locally so you can review it later and restore previous field values. Each record stores the before and after values of the fields that save changed, the product and variation IDs involved, the user who made the change, and timestamps. The data lives in custom database tables on your own site and is never sent off-site. Records are kept for 30 days by default (configurable) and pruned automatically. You can turn recording on or off, clear the history at any time, and optionally have all history data removed when you uninstall Pro. The free version records nothing and creates no history tables.
 = Does it support custom post types? =
 …
 == Changelog ==
+= 1.2.0 =
+* Added Cost of Goods (COGS) as an editable product column when WooCommerce's Cost of Goods Sold feature is enabled. Edit it inline or with the bulk-edit panel, filter products by a Cost of Goods range, and include it in CSV exports.
+* Added a Published on column — show it in the grid, edit its full date and time inline, and bulk-edit it — plus a read-only Modified on column. Both are available in CSV export.
+* Products with a future Published on date now appear in the grid as "Scheduled" (and can be filtered by that status) instead of being hidden from the default view.
+* The Title filter now matches all words by default, with a choice of how multi-word searches behave. When you type two or more words, a mode dropdown appears: "All words" (the default) finds titles containing every word in any order, "Any word" matches titles containing at least one word, and "Exact phrase" matches the words exactly as typed.
+* You can now include product attribute columns (such as Color or Size) in the CSV export. Open the Export dialog and tick the attribute columns you want — each cell lists the product's terms separated by " | ".
+* Your column layout and filters are now remembered automatically across page reloads and navigation — no need to save a view first. If you have a default view, it's still applied on load; otherwise your last working layout is restored.
+* Added a Default view at the top of the Views menu that resets your columns and filters to their defaults in one click. The old per-view "Set as default" star is retired — your working layout now persists on its own, and any existing default view is still applied on load.
+* Switching views (or to Default) with unsaved column or filter changes now asks whether to Save, Disregard, or Cancel, so a modified layout isn't lost by accident. On the Default view the prompt lets you name and save the changes as a new view before switching.
+* The Views button now shows "· Modified" when your columns or filters differ from the selected view (or the Default). Use Update to save the changes back to the view, or Revert to discard them; on the Default view, "Save as new view" lets you keep them as a brand-new view.
+* Added Menu order as a product column. View it in the grid, edit it inline or with the bulk-edit panel, filter products by a menu order range, sort the whole catalog by menu order, and include it in CSV exports.
+* Added Upsells and Cross-sells as editable product columns. Pick linked products from a searchable modal (by title, SKU, GTIN, or product ID), reorder them — WooCommerce shows them in the order you set — and bulk-edit them across a selection with Replace all, Add, or Remove. Both columns are available in CSV export. Links pointing at deleted products are shown as a warning rather than silently discarded, so you decide when to remove them, and a link to a draft or disabled product is flagged so you know it won't appear on your storefront. Cross-sells are editable on simple and variable products only, matching WooCommerce, which hides the field on grouped and external products because cross-sells are promoted in the cart.
+* More products-per-page choices (250, 500 and 1000), plus a "Custom…" option for any page size up to 10,000. Your page size is now saved as part of your views, so it comes back with a saved view and survives a reload.
+* Added Sale From and Sale To date-range filters. Variable products are included when one of their variations matches the sale schedule you filtered for, and only the matching variations are shown.
+* Added a Tags filter. Pick one or more product tags to narrow the grid to products carrying any of them; it combines with all other filters and applies to CSV exports too.
+* Added the Button text field for External/Affiliate products. View and edit the add-to-cart button label inline, change it with the bulk-edit panel (set, prepend, append, find & replace, clear), and include it in CSV exports.
+* Added an "Image uploaded" filter and grid/CSV column showing when each product's featured image was uploaded. Filter by a date range to find products whose images changed since a given date — useful when syncing images between sites. Variations are matched on their own images, and the column is available in the column picker and CSV exports.
+* Export any saved grid view as a JSON file or copyable text, and import a view exported from another account or site.
+* Added support for third-party product types. WooCommerce Product Bundles products now appear in the grid with full inline and bulk editing (prices, stock, categories, images, and more), and other plugin-registered types (subscriptions, composites, etc.) show up with a safe set of editable fields. The Type filter and the grid's type badges show every registered product type under its own plugin-provided name. Variable-style third-party products (such as variable subscriptions) expand to show their variations, just like native variable products.
+* Added a "Refresh list after saving" setting. Turn it off to keep edited products visible in the grid after saving — even when they no longer match the active filters — until you reload the list.
+* Added a Product URL column for External/Affiliate products — show it in the grid, edit it inline and in bulk (including find & replace for affiliate domain migrations), and export it to CSV. A new Product URL filter finds products by their link, with contains, does not contain, starts with, ends with, is empty and is not empty modes.
+* The SKU filter now has a match-mode dropdown: Contains, Is exactly, Does not contain, Starts with, and Ends with. Comma-separate several SKUs to match any of them under the chosen mode (or none of them, for "Does not contain"), up to 200 values. The dropdown starts on Auto, which keeps the original behavior — a single SKU is a partial match, comma-separated SKUs are exact matches — so existing saved views and searches are unchanged. Also fixed: searching for the SKU "0" now filters products correctly instead of being ignored.
+* Added a compatibility setting that triggers the standard WordPress save hooks after each save, so sync and integration plugins detect changes made in the editor. Find it under "Notify other plugins of changes" in Settings — it is off by default, and the info button beside it lists exactly which hooks are fired.
+* Added Shipping class as a product column. View it in the grid, edit it inline or with the bulk-edit panel — including a "Same as parent" option on variations — filter products by shipping class, and include it in CSV exports.
+* Renamed the Created product filter to Published on to align with WordPress/WooCommerce publishing terminology, and renamed Modified to Modified on for consistency.
+* The Published on, Modified on, Sale from, and Sale to filters now appear in the filter panel only when their columns are shown in the grid, like the other filters. A date filter that has a value set stays visible even when its column is hidden.
+* Updated the Pro upgrade dialog with the latest Pro features (undo & rollback, paste from Excel, WPML support) and current early-bird pricing for annual and lifetime licenses.
+* Fixed searching by a variation's SKU returning no results. When variations are shown in the grid, a SKU search now matches variation SKUs and displays the matching variation under its parent. Searching a product's own SKU keeps all of its variations visible.
+* Fixed bulk-edit searches and saves failing after the page was left open for a long time. The page now refreshes its security token automatically, and shows a clear "session expired or permissions changed — reload" message in the rare case it can't recover.
+* Fixed several Default-view and layout issues: selecting Default now restores columns you had hidden back to their factory visibility; deleting the view you're currently on returns you to Default and flags the layout as modified when it differs, instead of leaving a stale layout mislabeled as clean; and switching views no longer shows columns from your previous layout when "auto-load products" is turned off.
+* Fixed the Views "· Modified" indicator disappearing when you chose "Update with current state" on a view other than the one currently selected.
+* Fixed the Views "· Modified" indicator misbehaving: reverting a column change now clears it (previously it could stay stuck on), and re-selecting the same categories or filters in a different order no longer flags the layout as modified.
+* Fixed the selected view being lost after a page reload — the active view is now correctly remembered instead of quietly reverting to Default on the next load.
+* Fixed saving a new view before the product grid has loaded (with auto-load off) storing an empty column layout — a new view now captures your current columns in that case.
+* Fixed column layout changes being silently discarded when updating a view while product auto-loading is turned off — the view now saves your columns, and the layout no longer keeps showing as modified afterward.
+* Cancelling a bulk save (or restore) while a batch was mid-request no longer reports that in-progress batch as a failed save. For saves, the items in it are now shown as not attempted.
+* Deleting the plugin now removes its settings and per-user interface preferences from the database, instead of leaving them behind.
+* Clicking Stop during a save now cancels the in-progress request immediately, instead of only skipping the batches that hadn't started yet. Rows that still finished saving on the server are reconciled afterward, so they no longer linger as unsaved.
+* Pressing Stop during a save no longer hides a real login or permission failure. If your session expired or your permissions changed mid-save, you now get the reload prompt instead of a misleading "save stopped" message, so you know the remaining products weren't saved and why.
+* Save-stopped notifications are now translatable. The messages shown when you stop a save part-way through — including the counts of what was saved, what's still pending, and any per-product errors — now appear in your site's language.
+* When a save (or a Pro Operation History restore) is rejected because you are no longer authenticated and the site replies with an HTTP 401 error (e.g. Application Passwords or an authentication plugin), the session-expired warning now appears — including when Stop was pressed mid-operation — instead of the failure looking like a cancelled run. Rejected save/restore requests also now show the actual server error message instead of the generic "Unknown server error" text, which is now translatable.
+* Turning off "Manage stock" now discards any staged Stock quantity / Backorders edits for that product no matter how the change is made — inline edit, fill handle, bulk edit, or paste — so stale stock values can no longer be saved once stock management is switched off.
+* Fixed an error thrown when clicking "Clear all filters" on the "No products match your filters" screen.
+* Switching to another app or browser tab while editing a cell no longer closes the editor. When you come back, the cell is still in edit mode with the cursor where you left it — you can keep typing, or paste a copied value straight into the cell.
+* Enter-to-edit-the-next-row and the variation Select/Deselect buttons no longer stop working after a load error, an empty filter result, or when auto-loading is disabled.
+* Fixed a Cost of Goods filter issue where a product that had been converted from variable to simple could wrongly appear in the filtered results when a leftover hidden variation matched the filter.
+* Fixed the Menu order filter, SKU search, and Description search wrongly including a product that had been converted from variable to simple when a leftover hidden variation matched the filter.
+* Fixed date picker calendar popups following the operating system's light/dark theme instead of the plugin's selected theme.
+* Fixed toggling "Include Variations" reverting the grid's column layout (hidden columns, widths, pinning) to an older state and incorrectly marking the loaded view as "Modified". Also fixed Settings → "Reset layout" not restoring the default column visibility (previously hidden columns could stay hidden after a reset).
+* Fixed CSV exports failing on large product sets with many columns selected. The file is now built page by page and caches are released as it goes, so the export uses far less server memory. When an export does fail, the error now names the cause and status (for example "Export failed (500): …") instead of a generic "Export failed".
+= 1.0.1 =
+* Added a Bulk Edit shortcut to the WordPress admin bar for quick access to the editor from anywhere in wp-admin. It can be turned off per user from the Settings menu and is on by default.
+* Fixed tall popovers overflowing past the bottom of the screen on short browser windows; they now fit within the visible area and scroll internally.
+* Fixed the bulk edit page not scrolling on short browser windows, which left the toolbar, pagination, and lower admin menu items clipped and unreachable.
+* Fixed form fields rendering with light backgrounds in dark mode inside popover panels (filters, Selection Manager, dropdowns), and dark-mode styling for date and time inputs — native calendar/clock icons and picker popups now follow the dark theme too.
+* Fixed the horizontal scrollbar floating in the middle of the grid instead of staying at the bottom after collapsing or expanding the Filters or Bulk Edit panel.
 = 1.0.0 =
 * Initial release.
 …
 == Upgrade Notice ==
+= 1.2.0 =
+Major feature release: upsells/cross-sells, shipping class, product URL and button text editing, tags and sale-date filters, view import/export, SKU match modes, third-party product types, and many fixes.
 = 1.0.0 =
 Initial release.

wpmelon-advanced-bulk-edit-for-woocommerce/trunk/wpmelon-advanced-bulk-edit-for-woocommerce.php

-              r3549389
+              r3663491
  * Plugin URI: https://wpmelon.com/bulk-edit/
  * Description: Excel-like bulk editing interface for WooCommerce products
  * Version: 1.0.0
+ * Version: 1.2.0
  * Author: WPMelon
  * Author URI: https://wpmelon.com/
 …
  * Domain Path: /languages
  * Requires at least: 6.0
  * Tested up to: 7.0
+ * Tested up to: 7.1
  * Requires PHP: 8.0
  * Requires Plugins: woocommerce
  * WC requires at least: 10.0
  * WC tested up to: 10.7
+ * WC tested up to: 11.0.1
  * License: GPLv2 or later
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 define( 'WCABE_G2_LOADED', true );
 define( 'WCABE_G2_VERSION', '1.0.0' );
+define( 'WCABE_G2_VERSION', '1.2.0' );
 define( 'WCABE_G2_PLUGIN_FILE', __FILE__ );
 define( 'WCABE_G2_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

Context Navigation

Legend:

Download in other formats: