← All changes | includes/seo/class-builder-content.php +1861 -47 1.27.0 → 2.14.1 View file →

		@@ -40,23 +40,157 @@
40	40
41	41	/**
42	42	* Post meta keys that hold builder data, in priority order.
43	43	*
44		- * Several generations of the same builder are listed on purpose: Oxygen 6
45		- * is Breakdance under the hood (`_breakdance_data`), while earlier Oxygen
46		- * releases used `_oxygen_data` or the shortcode-based
47		- * `ct_builder_shortcodes`. A site can only have one of them.
	44	+ * Several generations of the same builder are listed on purpose. Oxygen 6
	45	+ * is Breakdance under the hood and writes the same tree, under its own
	46	+ * prefix: Breakdance keeps it in `_breakdance_data`, Oxygen 6 in
	47	+ * `_oxygen_data` (the key is `__bdox('_meta_prefix') . 'data'`, and the
	48	+ * prefix is `_oxygen_` under Oxygen). Both store it inside a
	49	+ * `tree_json_string` envelope, see unwrap_tree_envelope(). Earlier Oxygen
	50	+ * releases used the shortcode-based `ct_builder_shortcodes` and its JSON
	51	+ * sibling. A site can only have one of them.
48	52	*
49	53	* @var string[]
50	54	*/
51	55	private const BUILDER_META_KEYS = [
52		- '_breakdance_data', // Oxygen 6+ / Breakdance
53		- '_oxygen_data', // Oxygen (earlier releases)
54		- 'ct_builder_shortcodes', // Oxygen classic
	56	+ '_breakdance_data', // Breakdance
	57	+ '_oxygen_data', // Oxygen 6+ (Breakdance engine, Oxygen prefix)
	58	+ // Oxygen classic. 4.x writes the tree as JSON to `ct_builder_json`
	59	+ // while still keeping `ct_builder_shortcodes`. A post carrying only
	60	+ // the JSON key used to match no key at all and fall through to an
	61	+ // empty `post_content`, which reads as a one-word page (#776).
	62	+ //
	63	+ // Oxygen 4.8.3 then renamed every `ct_*` post meta key to `_ct_*`
	64	+ // (`oxygen_vsb_update_4_8_3()` runs `oxy_prefix_meta_keys()` on
	65	+ // upgrade, and `oxy_get_post_meta()` only reads the prefixed name
	66	+ // from then on). A current Oxygen classic site therefore has only the
	67	+ // underscored keys, which nothing here listed, so every one of its
	68	+ // pages resolved as empty. The prefixed keys come first because they
	69	+ // are what Oxygen itself reads; the bare ones cover a site that has
	70	+ // not run the migration (or reverted it with `?unprefix_meta`).
	71	+ //
	72	+ // These four are not read in this loop: from_oxygen_classic() pairs
	73	+ // each JSON key with its shortcode sibling so the two forms can be
	74	+ // compared. They are listed here because this list is also what the
	75	+ // word-count index watches and what FAQ detection scans.
	76	+ '_ct_builder_json', // Oxygen classic 4.8.3+ (JSON tree)
	77	+ 'ct_builder_json', // Oxygen classic 4.0-4.8.2 (JSON tree)
	78	+ '_ct_builder_shortcodes', // Oxygen classic 4.8.3+ (shortcode tree)
	79	+ 'ct_builder_shortcodes', // Oxygen classic < 4.8.3 (shortcode tree)
55	80	'_elementor_data', // Elementor
	81	+ // Beaver Builder. Published layout first: `_fl_builder_draft` holds
	82	+ // unsaved changes and would score content the visitor cannot see.
	83	+ // Both are arrays of stdClass nodes, which is why the walker below
	84	+ // has to treat objects like arrays (#449).
	85	+ '_fl_builder_data', // Beaver Builder (published)
	86	+ '_fl_builder_draft', // Beaver Builder (unsaved changes)
56	87	];
57	88
58	89	/**
	90	+ * Bricks' content-area meta key, used when Bricks itself isn't loaded.
	91	+ *
	92	+ * Bricks exposes `BRICKS_DB_PAGE_CONTENT` and renames the underlying key
	93	+ * between generations (it gained the `_2` suffix in 1.7.3), so the
	94	+ * constant is authoritative and this literal is only the fallback for the
	95	+ * contexts where it is undefined — Bricks is a theme, so on an admin or
	96	+ * CLI request against a site that has since switched themes the constant
	97	+ * is simply not there while the post meta still is.
	98	+ *
	99	+ * Bricks stores three areas — header, content and footer. Only the content
	100	+ * area belongs to the post being scored; the header and footer areas live
	101	+ * on Bricks' own template posts and would double-count site chrome into
	102	+ * every page's word count, so they are deliberately not read here.
	103	+ *
	104	+ * @since 2.2.1
	105	+ * @var string
	106	+ */
	107	+ private const BRICKS_CONTENT_META_KEY = '_bricks_page_content_2';
	108	+
	109	+ /**
	110	+ * Bricks' per-post editor-mode meta key, used when Bricks isn't loaded.
	111	+ *
	112	+ * @since 2.2.1
	113	+ * @var string
	114	+ */
	115	+ private const BRICKS_EDITOR_MODE_META_KEY = '_bricks_editor_mode';
	116	+
	117	+ /**
	118	+ * Bricks' components option, used when Bricks itself isn't loaded.
	119	+ *
	120	+ * @since 2.2.1
	121	+ * @var string
	122	+ */
	123	+ private const BRICKS_COMPONENTS_OPTION = 'bricks_components';
	124	+
	125	+ /**
	126	+ * Bricks' element that renders the post's own `post_content`.
	127	+ *
	128	+ * A Bricks page normally discards `post_content` entirely, which is why
	129	+ * anything left there is invisible. Dropping this element onto the canvas
	130	+ * is the one way an author puts it back on the page, so its presence flips
	131	+ * `post_content` from stale leftovers to content the visitor reads.
	132	+ *
	133	+ * @since 2.3.1
	134	+ * @var string
	135	+ */
	136	+ private const BRICKS_POST_CONTENT_ELEMENT = 'post-content';
	137	+
	138	+ /**
	139	+ * Bricks' Heading element, and the tag it renders when none is stored.
	140	+ *
	141	+ * Bricks leaves a setting out of storage while it equals its default, so a
	142	+ * Heading left on its default tag is stored with no `tag` at all. Bricks
	143	+ * 2.4.1 renders it as `h3` (`Element_Heading::$tag`, overridable by the
	144	+ * active theme style's `tag`), and the walker, which only wraps text whose
	145	+ * node names a tag, read it as body copy (#908).
	146	+ *
	147	+ * @since 2.15.0
	148	+ * @var string
	149	+ */
	150	+ private const BRICKS_HEADING_ELEMENT = 'heading';
	151	+
	152	+ /**
	153	+ * Tag a Bricks Heading renders when neither it nor a theme style sets one.
	154	+ *
	155	+ * @since 2.15.0
	156	+ * @var string
	157	+ */
	158	+ private const BRICKS_HEADING_DEFAULT_TAG = 'h3';
	159	+
	160	+ /**
	161	+ * Tag an Elementor Heading widget renders when `header_size` is not stored.
	162	+ *
	163	+ * Elementor saves `settings.toJSON({ remove: ['default'] })`, so a heading
	164	+ * left on its default size has no `header_size` in `_elementor_data`, and
	165	+ * that default is `h2` (#908).
	166	+ *
	167	+ * @since 2.15.0
	168	+ * @var string
	169	+ */
	170	+ private const ELEMENTOR_HEADING_DEFAULT_TAG = 'h2';
	171	+
	172	+ /**
	173	+ * Resolved Bricks trees for this request, keyed by post ID.
	174	+ *
	175	+ * Rendering one page asks for the tree about twenty times — every
	176	+ * description, every schema node, the FAQ guard — and resolving it is not
	177	+ * free. `bricks_content_source()` clears `Bricks\Database::$active_templates`
	178	+ * before asking Bricks which content template applies, which defeats
	179	+ * Bricks' own early-return and re-runs its whole template-condition engine;
	180	+ * `expand_bricks_components()` then walks the tree again. Measured on a
	181	+ * Bricks page with no content of its own, that was ten full runs of the
	182	+ * rules engine per request.
	183	+ *
	184	+ * Per-request only, and only ever read back within one page render — a
	185	+ * request that writes Bricks content does not also render it.
	186	+ *
	187	+ * @since 2.3.1
	188	+ * @var array<int,array<int,mixed>>
	189	+ */
	190	+ private static array $bricks_trees = [];
	191	+
	192	+ /**
59	193	* JSON keys whose values are user-visible text.
60	194	*
61	195	* Builder trees mix content with configuration, so a blind string sweep
62	196	* would count CSS classes and option slugs as words. Matching on the key
		@@ -67,11 +201,162 @@
67	201	private const CONTENT_KEYS = [
68	202	'text', 'title', 'subtitle', 'heading', 'subheading', 'content',
69	203	'description', 'caption', 'excerpt', 'label', 'value', 'html',
70	204	'editor', 'quote', 'answer', 'question', 'body', 'button_text',
	205	+ // Oxygen classic keeps an element's copy in `options.ct_content`
	206	+ // (headline, text block, rich text, link and button labels). It is the
	207	+ // field Oxygen's own serializer moves between the tags when it writes
	208	+ // shortcodes (`parse_components_tree()`), and the one Relevanssi and
	209	+ // Oxygen's WPML integration read. Missing from this list, the walker
	210	+ // kept only copy that happened to contain markup: a page of plain
	211	+ // headings and paragraphs lost almost all of its words.
	212	+ 'ct_content',
	213	+ // Oxygen's composite elements keep their copy under `options.original`
	214	+ // instead, one key per field. Taken from the list Oxygen itself treats
	215	+ // as text when it serializes (`$options_to_encode`); the numeric price
	216	+ // fields and the progress bar's right-hand percentage are left out.
	217	+ 'testimonial_text', 'testimonial_author', 'testimonial_author_info',
	218	+ 'icon_box_heading', 'icon_box_text',
	219	+ 'pricing_box_package_title', 'pricing_box_package_subtitle', 'pricing_box_content',
	220	+ 'progress_bar_left_text',
71	221	];
72	222
73	223	/**
	224	+ * Oxygen classic's storage generations, as JSON key => shortcode key.
	225	+ *
	226	+ * @since 2.10.0
	227	+ * @var array<string,string>
	228	+ */
	229	+ private const OXYGEN_CLASSIC_KEYS = [
	230	+ '_ct_builder_json' => '_ct_builder_shortcodes',
	231	+ 'ct_builder_json' => 'ct_builder_shortcodes',
	232	+ ];
	233	+
	234	+ /**
	235	+ * JSON keys whose values hold a link destination.
	236	+ *
	237	+ * Builders store a link's destination in a structured field separate from
	238	+ * its label, either as a bare URL string or as a `{ url: … }` object.
	239	+ * Neither shape survives a text sweep — the key is not content and a bare
	240	+ * URL contains no `<` — so no `<a>` tag reached the link counters.
	241	+ *
	242	+ * @var string[]
	243	+ */
	244	+ private const URL_KEYS = [
	245	+ 'link', 'url', 'href', 'link_url', 'button_link', 'permalink', 'link_to',
	246	+ ];
	247	+
	248	+ /**
	249	+ * JSON keys whose values hold an embedded video's source.
	250	+ *
	251	+ * A builder's video widget keeps its destination in a provider-specific
	252	+ * field — Elementor picks `youtube_url`, `vimeo_url`, `dailymotion_url` or
	253	+ * `hosted_url` according to the chosen source type — none of which is a
	254	+ * link field or a content field, so a video on a builder page reached the
	255	+ * analyzers as nothing at all.
	256	+ *
	257	+ * These are deliberately kept out of URL_KEYS. A video is an embed, not an
	258	+ * outbound link: rendering one as `<a href>` would add a spurious external
	259	+ * link to every page carrying a video and skew the link counts. They are
	260	+ * reconstructed as `<iframe>`/`<video>` instead, which the video detector
	261	+ * recognises and the link and image counters ignore.
	262	+ *
	263	+ * @since 2.3.1
	264	+ * @var string[]
	265	+ */
	266	+ private const VIDEO_KEYS = [
	267	+ 'youtube_url', 'vimeo_url', 'dailymotion_url', 'videopress_url',
	268	+ 'hosted_url', 'video_url', 'video_src', 'video_link',
	269	+ ];
	270	+
	271	+ /**
	272	+ * File extensions that mean a video source is a file, not a provider page.
	273	+ *
	274	+ * @since 2.3.1
	275	+ * @var string[]
	276	+ */
	277	+ private const VIDEO_FILE_EXTENSIONS = ['mp4', 'webm', 'ogv', 'mov', 'm4v'];
	278	+
	279	+ /**
	280	+ * Source keys to trust for a declared video source type.
	281	+ *
	282	+ * A widget keeps one field per provider and does not clear the others when
	283	+ * the author switches source: an Elementor video moved from YouTube to Self
	284	+ * Hosted still carries the earlier `youtube_url`. Reading whichever key
	285	+ * turns up first then emits the video the author replaced. The widget says
	286	+ * which one it is actually playing, so that is read first and the flat key
	287	+ * sweep is only the fallback for a builder that declares nothing.
	288	+ *
	289	+ * @since 2.3.1
	290	+ * @var array<string,string[]>
	291	+ */
	292	+ private const VIDEO_KEYS_BY_TYPE = [
	293	+ 'youtube' => ['youtube_url'],
	294	+ 'vimeo' => ['vimeo_url'],
	295	+ 'dailymotion' => ['dailymotion_url'],
	296	+ 'videopress' => ['videopress_url'],
	297	+ 'hosted' => ['hosted_url', 'video_url', 'video_src', 'video_link'],
	298	+ 'media' => ['hosted_url', 'video_url', 'video_src', 'video_link'],
	299	+ 'file' => ['hosted_url', 'video_url', 'video_src', 'video_link'],
	300	+ 'self_hosted' => ['hosted_url', 'video_url', 'video_src', 'video_link'],
	301	+ ];
	302	+
	303	+ /**
	304	+ * Keys a builder uses to name which video source a widget is playing.
	305	+ *
	306	+ * @since 2.3.1
	307	+ * @var string[]
	308	+ */
	309	+ private const VIDEO_TYPE_KEYS = ['video_type', 'videotype', 'video_source', 'source_type'];
	310	+
	311	+ /**
	312	+ * JSON keys whose values hold an image, as a URL string or `{ url, alt }`.
	313	+ *
	314	+ * @var string[]
	315	+ */
	316	+ private const IMAGE_KEYS = [
	317	+ 'image', 'src', 'image_url', 'background_image', 'bg_image', 'photo',
	318	+ ];
	319	+
	320	+ /**
	321	+ * JSON keys that carry a heading level for the node's text.
	322	+ *
	323	+ * A builder heading's text is collected (its key is in CONTENT_KEYS) and so
	324	+ * counts toward the word count, but it arrives as bare text with no `<h2>`
	325	+ * wrapper — which is why heading-structure checks saw none.
	326	+ *
	327	+ * @var string[]
	328	+ */
	329	+ private const HEADING_TAG_KEYS = [
	330	+ // Lower-cased on both sides of the comparison, so `headingtag` is the
	331	+ // camelCase `headingTag` Bricks uses throughout its own controls and
	332	+ // which ThinkRank's Bricks elements declare. Without it their section
	333	+ // headings counted as body copy and never reached heading structure.
	334	+ 'header_size', 'heading_tag', 'headingtag', 'html_tag', 'title_tag', 'tag', 'level', 'size',
	335	+ ];
	336	+
	337	+ /**
	338	+ * Keys whose value is alternative text for a sibling image.
	339	+ *
	340	+ * @var string[]
	341	+ */
	342	+ private const ALT_KEYS = ['alt', 'alt_text', 'image_alt', 'title'];
	343	+
	344	+ /**
	345	+ * The global post and every global `setup_postdata()` writes.
	346	+ *
	347	+ * Rendering points them at the post being analyzed, then puts each one
	348	+ * back exactly as it was, unset included (#860).
	349	+ *
	350	+ * @since 2.12.0
	351	+ * @var string[]
	352	+ */
	353	+ private const POSTDATA_GLOBALS = [
	354	+ 'post', 'id', 'authordata', 'currentday', 'currentmonth',
	355	+ 'page', 'pages', 'multipage', 'more', 'numpages',
	356	+ ];
	357	+
	358	+ /**
74	359	* Resolve the content worth analyzing for a post.
75	360	*
76	361	* @param \WP_Post $post Post being analyzed.
77	362	* @return string HTML/text to analyze.
		@@ -76,12 +361,301 @@
76	361	* @param \WP_Post $post Post being analyzed.
77	362	* @return string HTML/text to analyze.
78	363	*/
79	364	public static function resolve(\WP_Post $post): string {
80		- return self::resolve_markup((string) $post->post_content, $post);
	365	+ $raw = (string) $post->post_content;
	366	+
	367	+ // A page built in Gutenberg and then switched to Bricks keeps its old
	368	+ // blocks in `post_content` forever — Bricks never clears them, and
	369	+ // never renders them either. Resolving that first meant the stale draft
	370	+ // beat the tree the visitor actually reads, and it did not stop at the
	371	+ // score: the same string becomes the meta description, og:description,
	372	+ // twitter:description and the schema description. Starting from nothing
	373	+ // sends the resolution straight to Bricks' storage, which is where this
	374	+ // page's words are (#651).
	375	+ //
	376	+ // Only for the stored path. `resolve_markup()` is also called with live
	377	+ // editor content, and the Bricks panel's resolver reads the canvas —
	378	+ // discarding that would replace what the author is typing with the last
	379	+ // save.
	380	+ if (self::bricks_supersedes_post_content((int) $post->ID)) {
	381	+ $raw = '';
	382	+ }
	383	+
	384	+ return self::resolve_markup($raw, $post);
81	385	}
82	386
83	387	/**
	388	+ * Whether Bricks renders this post and throws its `post_content` away.
	389	+ *
	390	+ * True means anything still stored in `post_content` is invisible: it is
	391	+ * not on the page, so it must not be scored, described or published as
	392	+ * structured data. False covers both a post Bricks does not own and a
	393	+ * Bricks page that puts `post_content` back with a Post Content element.
	394	+ *
	395	+ * @since 2.3.1
	396	+ *
	397	+ * @param int $post_id Post being resolved.
	398	+ * @return bool
	399	+ */
	400	+ public static function bricks_supersedes_post_content(int $post_id): bool {
	401	+ $tree = self::bricks_tree($post_id);
	402	+
	403	+ if (empty($tree)) {
	404	+ return false;
	405	+ }
	406	+
	407	+ foreach ($tree as $element) {
	408	+ if (is_array($element)
	409	+ && self::BRICKS_POST_CONTENT_ELEMENT === ($element['name'] ?? null)
	410	+ ) {
	411	+ return false;
	412	+ }
	413	+ }
	414	+
	415	+ return !self::bricks_tree_prints_post_content($tree);
	416	+ }
	417	+
	418	+ /**
	419	+ * Whether a Bricks tree prints the body through a dynamic-data tag.
	420	+ *
	421	+ * The Post Content element is not the only way back onto the page: Bricks'
	422	+ * `{post_content}` tag renders the same thing from inside an ordinary text
	423	+ * element, and a single-post template written that way is a common shape.
	424	+ * Missing it would mean the post's real body is discarded everywhere —
	425	+ * scoring, the meta/og/twitter descriptions, the schema description — for a
	426	+ * page that is displaying it.
	427	+ *
	428	+ * Matched over the encoded tree rather than per setting, because the tag can
	429	+ * sit in any string field of any element and Bricks allows modifiers after
	430	+ * the name (`{post_content:...}`).
	431	+ *
	432	+ * @since 2.3.1
	433	+ *
	434	+ * @param array $tree Bricks element tree.
	435	+ * @return bool
	436	+ */
	437	+ private static function bricks_tree_prints_post_content(array $tree): bool {
	438	+ $encoded = wp_json_encode($tree);
	439	+
	440	+ return is_string($encoded) && false !== stripos($encoded, '{post_content');
	441	+ }
	442	+
	443	+ /**
	444	+ * The post's content as the visitor actually receives it.
	445	+ *
	446	+ * `post_content` for everything except a Bricks page that discards it, and
	447	+ * there the Bricks tree's text. Descriptions are derived from a post's body
	448	+ * in half a dozen places; every one of them wants this rather than the raw
	449	+ * column (#651).
	450	+ *
	451	+ * @since 2.3.1
	452	+ *
	453	+ * @param \WP_Post $post Post being described.
	454	+ * @return string
	455	+ */
	456	+ public static function visible_content(\WP_Post $post): string {
	457	+ $superseding = self::superseding_content($post);
	458	+
	459	+ return '' !== $superseding ? $superseding : (string) $post->post_content;
	460	+ }
	461	+
	462	+ /**
	463	+ * Replacement body text for a post whose `post_content` does not render.
	464	+ *
	465	+ * Empty for every ordinary post, which is what makes this safe to call from
	466	+ * paths that already handle excerpts their own way: they keep that handling
	467	+ * and only a Bricks page is diverted.
	468	+ *
	469	+ * @since 2.3.1
	470	+ *
	471	+ * @param \WP_Post $post Post being described.
	472	+ * @return string Visible body text, or '' when `post_content` is fine.
	473	+ */
	474	+ public static function superseding_content(\WP_Post $post): string {
	475	+ if (!self::bricks_supersedes_post_content((int) $post->ID)) {
	476	+ return '';
	477	+ }
	478	+
	479	+ $bricks = self::from_bricks((int) $post->ID);
	480	+
	481	+ return self::is_blank($bricks) ? '' : $bricks;
	482	+ }
	483	+
	484	+ /**
	485	+ * Body text to derive a description from, when the usual source is wrong.
	486	+ *
	487	+ * A hand-written excerpt is the author's own summary and is correct however
	488	+ * the page is built, so it yields '' here and the caller's normal
	489	+ * `get_the_excerpt()` path keeps it. Only a Bricks page with no excerpt —
	490	+ * where core would derive one from discarded `post_content` — gets diverted.
	491	+ *
	492	+ * @since 2.3.1
	493	+ *
	494	+ * @param \WP_Post $post Post being described.
	495	+ * @return string Text to summarize, or '' to leave the caller's path alone.
	496	+ */
	497	+ public static function superseding_excerpt_source(\WP_Post $post): string {
	498	+ if ('' !== trim((string) $post->post_excerpt)) {
	499	+ return '';
	500	+ }
	501	+
	502	+ return self::superseding_content($post);
	503	+ }
	504	+
	505	+ /**
	506	+ * The Bricks element tree that renders for a post.
	507	+ *
	508	+ * Public because what Bricks puts on the page is not only a scoring
	509	+ * question: the schema graph has to know whether a Bricks element already
	510	+ * publishes the page's FAQ before adding one of its own (#649, #650).
	511	+ *
	512	+ * Flat, in Bricks' own storage shape — `expand_bricks_components()`
	513	+ * appends component definitions to the same list rather than nesting them,
	514	+ * so one `foreach` reaches every element.
	515	+ *
	516	+ * @since 2.3.1
	517	+ *
	518	+ * @param int $post_id Post being resolved.
	519	+ * @return array<int,mixed> Elements, or [] when Bricks renders nothing here.
	520	+ */
	521	+ /**
	522	+ * The builder meta keys, for callers that need to inspect the raw storage
	523	+ * rather than the text extracted from it.
	524	+ *
	525	+ * The SEO Analyzer reads these to answer "is there a ThinkRank FAQ element
	526	+ * on this post?", which is a question about the stored tree, not about the
	527	+ * words in it (#686).
	528	+ *
	529	+ * @since 2.7.0
	530	+ * @return string[]
	531	+ */
	532	+ public static function builder_meta_keys(): array {
	533	+ return self::BUILDER_META_KEYS;
	534	+ }
	535	+
	536	+ public static function bricks_tree(int $post_id): array {
	537	+ if (array_key_exists($post_id, self::$bricks_trees)) {
	538	+ return self::$bricks_trees[$post_id];
	539	+ }
	540	+
	541	+ self::$bricks_trees[$post_id] = self::resolve_bricks_tree($post_id);
	542	+
	543	+ return self::$bricks_trees[$post_id];
	544	+ }
	545	+
	546	+ /**
	547	+ * Discard the resolved-tree memo. Test seam.
	548	+ *
	549	+ * @since 2.3.1
	550	+ * @return void
	551	+ */
	552	+ public static function flush_bricks_cache(): void {
	553	+ self::$bricks_trees = [];
	554	+ }
	555	+
	556	+ /**
	557	+ * Read and resolve a post's Bricks tree, ignoring the memo.
	558	+ *
	559	+ * @since 2.3.1
	560	+ *
	561	+ * @param int $post_id Post being resolved.
	562	+ * @return array<int,mixed>
	563	+ */
	564	+ private static function resolve_bricks_tree(int $post_id): array {
	565	+ if (!self::bricks_owns_post($post_id)) {
	566	+ return [];
	567	+ }
	568	+
	569	+ $source = self::bricks_content_source($post_id);
	570	+ if (!$source) {
	571	+ return [];
	572	+ }
	573	+
	574	+ $stored = get_post_meta($source, self::bricks_meta_key(), true);
	575	+
	576	+ if (is_string($stored)) {
	577	+ $stored = '' === trim($stored) ? null : json_decode($stored, true);
	578	+ }
	579	+
	580	+ if (!is_array($stored) || empty($stored)) {
	581	+ return [];
	582	+ }
	583	+
	584	+ return self::expand_bricks_components(self::bricks_render_order($stored));
	585	+ }
	586	+
	587	+ /**
	588	+ * A flat Bricks element list, in the order Bricks renders it.
	589	+ *
	590	+ * Bricks stores one flat list and links it with `parent` and `children`
	591	+ * ids. `Frontend::render_data()` renders the root elements in list order
	592	+ * and each element's children in the order of its `children` array, so a
	593	+ * child's position in the list says nothing about where it appears on the
	594	+ * page. Walking the list as stored put a section's contents wherever they
	595	+ * happened to be saved (#907).
	596	+ *
	597	+ * Anything the walk does not reach (an orphan, a cycle) keeps its stored
	598	+ * position after the rest, so no copy is dropped.
	599	+ *
	600	+ * @since 2.15.0
	601	+ *
	602	+ * @param array $elements Flat Bricks element list.
	603	+ * @return array The same elements, in render order.
	604	+ */
	605	+ private static function bricks_render_order(array $elements): array {
	606	+ $by_id = [];
	607	+ foreach ($elements as $index => $element) {
	608	+ $id = is_array($element) ? ($element['id'] ?? null) : null;
	609	+ if (is_scalar($id) && '' !== (string) $id && !isset($by_id[(string) $id])) {
	610	+ $by_id[(string) $id] = $index;
	611	+ }
	612	+ }
	613	+
	614	+ if (empty($by_id)) {
	615	+ return $elements;
	616	+ }
	617	+
	618	+ $ordered = [];
	619	+ $placed = [];
	620	+
	621	+ $place = static function ($index) use (&$place, &$ordered, &$placed, $elements, $by_id): void {
	622	+ if (isset($placed[$index])) {
	623	+ return;
	624	+ }
	625	+
	626	+ $placed[$index] = true;
	627	+ $ordered[] = $elements[$index];
	628	+
	629	+ $children = is_array($elements[$index]) ? ($elements[$index]['children'] ?? []) : [];
	630	+ if (!is_array($children)) {
	631	+ return;
	632	+ }
	633	+
	634	+ foreach ($children as $child_id) {
	635	+ if (is_scalar($child_id) && isset($by_id[(string) $child_id])) {
	636	+ $place($by_id[(string) $child_id]);
	637	+ }
	638	+ }
	639	+ };
	640	+
	641	+ foreach ($elements as $index => $element) {
	642	+ $parent = is_array($element) ? ($element['parent'] ?? null) : null;
	643	+ if (empty($parent) || !is_scalar($parent) || !isset($by_id[(string) $parent])) {
	644	+ $place($index);
	645	+ }
	646	+ }
	647	+
	648	+ foreach ($elements as $index => $element) {
	649	+ if (!isset($placed[$index])) {
	650	+ $ordered[] = $element;
	651	+ }
	652	+ }
	653	+
	654	+ return $ordered;
	655	+ }
	656	+
	657	+ /**
84	658	* Resolve an arbitrary chunk of editor markup for the given post.
85	659	*
86	660	* The editor sends its live content to the scorer so an author sees their
87	661	* unsaved edits reflected. On a builder page that live string is the raw
		@@ -102,9 +676,9 @@
102	676	* @param \WP_Post $post Post the markup belongs to.
103	677	* @return string Content to analyze.
104	678	*/
105	679	public static function resolve_markup(string $raw, \WP_Post $post): string {
106		- $content = self::render_post_content($raw);
	680	+ $content = self::render_post_content($raw, $post);
107	681
108	682	// Block markup that renders to nothing usually means the builder that
109	683	// owns those blocks did not register them in this context — Divi 5
110	684	// loads its module library lazily per-request, so in CLI, REST, admin
		@@ -152,19 +726,45 @@
152	726	*
153	727	* Best-effort: a third-party block that fatals must not take the whole
154	728	* score down with it.
155	729	*
156		- * @param string $raw Raw post content.
	730	+ * Runs as the post's own context, as it would on the front end. Admin and
	731	+ * REST requests have no current post, so a shortcode reading
	732	+ * `get_the_ID()` got nothing, and one looping a related-posts query left
	733	+ * the global post on the last of them: its `wp_reset_postdata()` goes back
	734	+ * to the main query's post, and there is none. On the Classic Editor this
	735	+ * runs after the form prints its hidden `post_ID` and before the title and
	736	+ * editor, which then showed the related post, and Update saved it over the
	737	+ * original (#860).
	738	+ *
	739	+ * @param string $raw Raw post content.
	740	+ * @param \WP_Post $post Post the content belongs to.
157	741	* @return string Rendered content.
158	742	*/
159		- private static function render_post_content(string $raw): string {
	743	+ private static function render_post_content(string $raw, \WP_Post $post): string {
160	744	if ('' === trim($raw)) {
161	745	return '';
162	746	}
163	747
164		- $content = $raw;
	748	+ $content = $raw;
	749	+ $previous = self::snapshot_post_globals();
165	750
166	751	try {
	752	+ // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Made current for the render, restored in finally.
	753	+ $GLOBALS['post'] = $post;
	754	+
	755	+ // Fires `the_post`, which these paths never fired before: admin,
	756	+ // REST and cron analysis had no current post at all. That is the
	757	+ // same signal the front-end loop sends and it is what makes
	758	+ // `get_the_ID()` work inside a shortcode, but it is a new call on a
	759	+ // path that runs in bulk — the word-count index resolves every post
	760	+ // it visits — so a theme that counts views on `the_post` will count
	761	+ // them during indexing. Accepted deliberately: without it a
	762	+ // shortcode cannot resolve its own post, which is the bug (#860).
	763	+ if (function_exists('setup_postdata')) {
	764	+ setup_postdata($post);
	765	+ }
	766	+
167	767	if (function_exists('has_blocks') && function_exists('do_blocks') && has_blocks($raw)) {
168	768	$content = do_blocks($raw);
169	769	}
170	770
		@@ -173,8 +773,10 @@
173	773	$content = do_shortcode($content);
174	774	}
175	775	} catch (\Throwable $e) {
176	776	return $raw;
	777	+ } finally {
	778	+ self::restore_post_globals($previous);
177	779	}
178	780
179	781	return self::is_blank($content) ? $raw : $content;
180	782	}
		@@ -179,8 +781,49 @@
179	781	return self::is_blank($content) ? $raw : $content;
180	782	}
181	783
182	784	/**
	785	+ * The post globals as they are now; a global that is unset has no key.
	786	+ *
	787	+ * @since 2.12.0
	788	+ *
	789	+ * @return array<string,mixed>
	790	+ */
	791	+ private static function snapshot_post_globals(): array {
	792	+ $snapshot = [];
	793	+
	794	+ foreach (self::POSTDATA_GLOBALS as $name) {
	795	+ if (array_key_exists($name, $GLOBALS)) {
	796	+ $snapshot[$name] = $GLOBALS[$name];
	797	+ }
	798	+ }
	799	+
	800	+ return $snapshot;
	801	+ }
	802	+
	803	+ /**
	804	+ * Put the post globals back as snapshot_post_globals() found them.
	805	+ *
	806	+ * Assigned directly rather than through `setup_postdata()`: there may have
	807	+ * been no post to set up, and re-running it would fire `the_post` again.
	808	+ *
	809	+ * @since 2.12.0
	810	+ *
	811	+ * @param array<string,mixed> $snapshot From snapshot_post_globals().
	812	+ * @return void
	813	+ */
	814	+ private static function restore_post_globals(array $snapshot): void {
	815	+ foreach (self::POSTDATA_GLOBALS as $name) {
	816	+ if (array_key_exists($name, $snapshot)) {
	817	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Core's own globals, put back as they were.
	818	+ $GLOBALS[$name] = $snapshot[$name];
	819	+ } else {
	820	+ unset($GLOBALS[$name]);
	821	+ }
	822	+ }
	823	+ }
	824	+
	825	+ /**
183	826	* Extract text from the attributes of parsed blocks.
184	827	*
185	828	* @param string $raw Raw post content containing block markup.
186	829	* @return string Collected text, or '' when nothing was found.
		@@ -196,10 +839,10 @@
196	839	return '';
197	840	}
198	841
199	842	$attrs = [];
200		- $collect = static function (array $list) use (&$collect, &$attrs): void {
201		- foreach ($list as $block) {
	843	+ $collect = static function (array $items) use (&$collect, &$attrs): void {
	844	+ foreach ($items as $block) {
202	845	if (!empty($block['attrs']) && is_array($block['attrs'])) {
203	846	$attrs[] = $block['attrs'];
204	847	}
205	848	if (!empty($block['innerBlocks']) && is_array($block['innerBlocks'])) {
		@@ -212,8 +855,458 @@
212	855	return empty($attrs) ? '' : self::text_from_tree($attrs);
213	856	}
214	857
215	858	/**
	859	+ * Everything Bricks contributes to this post's analyzable content.
	860	+ *
	861	+ * Bricks is the only builder here that needs more than a meta key, on
	862	+ * three counts:
	863	+ *
	864	+ * - It leaves its stored tree behind when a post is switched back to the
	865	+ * block editor, so an editor-mode gate has to run first or ThinkRank
	866	+ * scores markup the visitor never sees — the same failure
	867	+ * `_fl_builder_draft` was ordered against in #449.
	868	+ * - A post's content can live on ANOTHER post. Bricks' Templates feature
	869	+ * assigns a content template by condition, and a page using one stores
	870	+ * nothing of its own; reading only the page's meta scores it blank
	871	+ * while the visitor reads a full page.
	872	+ * - Its stored text carries dynamic-data tags and internal element names
	873	+ * that never reach the rendered page.
	874	+ *
	875	+ * @since 2.2.1
	876	+ *
	877	+ * @param int $post_id Post being resolved.
	878	+ * @return string Extracted text, or '' when Bricks has nothing for it.
	879	+ */
	880	+ private static function from_bricks(int $post_id): string {
	881	+ $tree = self::bricks_tree($post_id);
	882	+
	883	+ if (empty($tree)) {
	884	+ return '';
	885	+ }
	886	+
	887	+ return self::strip_bricks_dynamic_tags(
	888	+ self::text_from_tree(self::with_bricks_heading_tags(self::without_bricks_element_labels($tree)))
	889	+ );
	890	+ }
	891	+
	892	+ /**
	893	+ * Whether Bricks — not the block editor — renders this post.
	894	+ *
	895	+ * Bricks writes `bricks` or `wordpress` into its editor-mode meta as the
	896	+ * author toggles between the two, and never clears the content it stored
	897	+ * for the other mode. Only the `wordpress` value is disqualifying: an
	898	+ * absent value is the normal state for a post Bricks built and never
	899	+ * toggled. This follows Bricks' own `Helpers::render_with_bricks()`, which
	900	+ * bails on exactly that one value.
	901	+ *
	902	+ * It deliberately does not match it exactly: the comparison here is
	903	+ * case-insensitive, where Bricks' is strict. Bricks 2.3.12 only ever writes
	904	+ * the value lowercase, so the two agree on everything Bricks itself
	905	+ * stores; they part company only on a value some other integration wrote.
	906	+ * The two shipping today disagree about the casing — SureRank compares
	907	+ * against `'WordPress'`, AIOSEO against `'bricks'` — and of the two ways to
	908	+ * be wrong about `'WordPress'`, blocking costs a score on a page that has
	909	+ * one, while allowing scores stale content the visitor never sees, which is
	910	+ * the failure this gate exists to prevent.
	911	+ *
	912	+ * @since 2.2.1
	913	+ *
	914	+ * @param int $post_id Post being resolved.
	915	+ * @return bool
	916	+ */
	917	+ private static function bricks_owns_post(int $post_id): bool {
	918	+ $mode = get_post_meta($post_id, self::bricks_editor_mode_key(), true);
	919	+
	920	+ // phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText -- Bricks' own stored meta value, lower-cased for the comparison.
	921	+ return !(is_string($mode) && 'wordpress' === strtolower(trim($mode)));
	922	+ }
	923	+
	924	+ /**
	925	+ * The post whose Bricks tree actually renders for this post.
	926	+ *
	927	+ * Usually the post itself. When it stores nothing of its own, Bricks falls
	928	+ * back to whichever content template's conditions match, and that template
	929	+ * is a separate post carrying the words the visitor reads.
	930	+ *
	931	+ * Resolution is delegated to Bricks rather than reimplemented: template
	932	+ * conditions are a whole rules engine (post IDs, types, taxonomies,
	933	+ * archives), and a second implementation would drift from it. Bricks
	934	+ * answers through statics, so they are saved and restored around the call —
	935	+ * `set_active_templates()` returns early once populated, and on a
	936	+ * front-end request Bricks has already populated it for the page being
	937	+ * served. Clobbering that would corrupt the render in progress.
	938	+ *
	939	+ * Best-effort by design: any failure returns the post's own data, which is
	940	+ * exactly today's behaviour.
	941	+ *
	942	+ * @since 2.2.1
	943	+ *
	944	+ * @param int $post_id Post being resolved.
	945	+ * @return int Post ID holding the Bricks tree, or 0 when there is none.
	946	+ */
	947	+ private static function bricks_content_source(int $post_id): int {
	948	+ $own = get_post_meta($post_id, self::bricks_meta_key(), true);
	949	+ if ((is_array($own) && !empty($own)) || (is_string($own) && '' !== trim($own))) {
	950	+ return $post_id;
	951	+ }
	952	+
	953	+ if (!class_exists('\\Bricks\\Database')
	954	+ || !method_exists('\\Bricks\\Database', 'set_active_templates')
	955	+ ) {
	956	+ return 0;
	957	+ }
	958	+
	959	+ // `set_active_templates()` writes TWO statics — `$active_templates` and,
	960	+ // when a header template resolves, `$header_position`. Both are saved,
	961	+ // and both are restored in `finally` rather than on the happy path: a
	962	+ // throw part-way through (a third-party hook on
	963	+ // `bricks/database/content_type`, `bricks/builder/data_post_id` or
	964	+ // `bricks/active_templates` is enough) must not leave Bricks' render
	965	+ // state holding this lookup's values. Restoring only after a clean
	966	+ // return is what the `catch` below would otherwise skip.
	967	+ $has_header_position = property_exists('\\Bricks\\Database', 'header_position');
	968	+ $saved_templates = \Bricks\Database::$active_templates;
	969	+ $saved_header_position = $has_header_position ? \Bricks\Database::$header_position : null;
	970	+
	971	+ try {
	972	+ \Bricks\Database::$active_templates = [];
	973	+ \Bricks\Database::set_active_templates($post_id);
	974	+ $template = (int) (\Bricks\Database::$active_templates['content'] ?? 0);
	975	+ } catch (\Throwable $e) {
	976	+ return 0;
	977	+ } finally {
	978	+ \Bricks\Database::$active_templates = $saved_templates;
	979	+ if ($has_header_position) {
	980	+ \Bricks\Database::$header_position = $saved_header_position;
	981	+ }
	982	+ }
	983	+
	984	+ // A template that is the post itself adds nothing over the empty read
	985	+ // above, and would otherwise recurse conceptually.
	986	+ return $template === $post_id ? 0 : $template;
	987	+ }
	988	+
	989	+ /**
	990	+ * Splice component definitions into the tree.
	991	+ *
	992	+ * A Bricks component keeps its markup in the `bricks_components` option,
	993	+ * not on the page. The page stores only an instance: an element carrying
	994	+ * `cid` and, usually, empty `settings`. Walking the page alone therefore
	995	+ * found no words at all, and a page built entirely from components scored
	996	+ * blank — the same failure as a page built from a content template.
	997	+ *
	998	+ * Confirmed on Bricks 2.3.12: `Bricks\Frontend::render_data()` renders the
	999	+ * component's copy from an instance this walker extracted '' from.
	1000	+ *
	1001	+ * The definition is read straight from the option rather than through
	1002	+ * `Bricks\Helpers::get_component_instance()`. That helper resolves an
	1003	+ * instance's property overrides, which would be better, but it reads
	1004	+ * `Bricks\Database::$global_data['components']` — populated once per
	1005	+ * request, and empty in the admin and CLI contexts where bulk scoring
	1006	+ * runs. Refreshing it would mean writing to Bricks' live render state, the
	1007	+ * same hazard the template resolver is careful to avoid, and gating on it
	1008	+ * would make a page score differently in wp-admin than on the front end.
	1009	+ * Reading the stored definition is consistent everywhere.
	1010	+ *
	1011	+ * The trade-off: an instance that overrides a component property is scored
	1012	+ * with the component's authored copy rather than the override. That is the
	1013	+ * text the component renders by default, and it is much closer than the
	1014	+ * nothing this returned before.
	1015	+ *
	1016	+ * @since 2.2.1
	1017	+ *
	1018	+ * @param array $tree Bricks content area.
	1019	+ * @return array Tree with component elements spliced in after each instance.
	1020	+ */
	1021	+ private static function expand_bricks_components(array $tree): array {
	1022	+ $expanded = [];
	1023	+ $open = [];
	1024	+
	1025	+ $walk = static function (array $elements, int $depth) use (&$walk, &$expanded, &$open): void {
	1026	+ foreach ($elements as $element) {
	1027	+ $expanded[] = $element;
	1028	+
	1029	+ if (!is_array($element) || empty($element['cid']) || !is_string($element['cid'])) {
	1030	+ continue;
	1031	+ }
	1032	+
	1033	+ $cid = $element['cid'];
	1034	+
	1035	+ // A component nested inside its own definition would recurse
	1036	+ // forever; the depth cap covers deep but legitimate nesting.
	1037	+ if (isset($open[$cid]) || $depth > 4) {
	1038	+ continue;
	1039	+ }
	1040	+
	1041	+ $children = self::bricks_component_elements($cid);
	1042	+ if (empty($children)) {
	1043	+ continue;
	1044	+ }
	1045	+
	1046	+ // Re-entrant per branch, not per page: the guard is released
	1047	+ // after the walk so a second instance further along the page
	1048	+ // still expands, rather than being mistaken for recursion.
	1049	+ //
	1050	+ // That does NOT double the word count — `text_from_tree()`
	1051	+ // ends in `array_unique()`, which collapses a repeated
	1052	+ // component's copy the same way it collapses a value repeated
	1053	+ // across responsive breakpoints. Expanding both instances is
	1054	+ // about not silently dropping the second one's structure.
	1055	+ $open[$cid] = true;
	1056	+ $walk($children, $depth + 1);
	1057	+ unset($open[$cid]);
	1058	+ }
	1059	+ };
	1060	+
	1061	+ $walk($tree, 0);
	1062	+
	1063	+ return $expanded;
	1064	+ }
	1065	+
	1066	+ /**
	1067	+ * The stored elements of one Bricks component.
	1068	+ *
	1069	+ * @since 2.2.1
	1070	+ *
	1071	+ * @param string $cid Component id held by an instance element.
	1072	+ * @return array Component elements, or [] when it cannot be resolved.
	1073	+ */
	1074	+ private static function bricks_component_elements(string $cid): array {
	1075	+ $components = get_option(self::bricks_constant('BRICKS_DB_COMPONENTS', self::BRICKS_COMPONENTS_OPTION), []);
	1076	+
	1077	+ if (!is_array($components)) {
	1078	+ return [];
	1079	+ }
	1080	+
	1081	+ foreach ($components as $component) {
	1082	+ $component = self::as_children($component);
	1083	+ if (null === $component) {
	1084	+ continue;
	1085	+ }
	1086	+
	1087	+ if (isset($component['id']) && $component['id'] === $cid && !empty($component['elements'])) {
	1088	+ return is_array($component['elements']) ? self::bricks_render_order($component['elements']) : [];
	1089	+ }
	1090	+ }
	1091	+
	1092	+ return [];
	1093	+ }
	1094	+
	1095	+ /**
	1096	+ * Drop each Bricks element's internal name before the tree is walked.
	1097	+ *
	1098	+ * A Bricks element carries an optional top-level `label` — the nickname an
	1099	+ * author types in the Structure panel to find it again ("Hero headline",
	1100	+ * "CTA row"). It is builder chrome and is never rendered, but `label` is in
	1101	+ * CONTENT_KEYS because it is real content for other builders' form fields,
	1102	+ * so it was being counted as page copy.
	1103	+ *
	1104	+ * Only the element's own `label` is removed. A `label` inside `settings`
	1105	+ * is a rendered field label and stays.
	1106	+ *
	1107	+ * @since 2.2.1
	1108	+ *
	1109	+ * @param array $tree Bricks content area.
	1110	+ * @return array Tree with element nicknames removed.
	1111	+ */
	1112	+ private static function without_bricks_element_labels(array $tree): array {
	1113	+ foreach ($tree as $index => $element) {
	1114	+ if (is_array($element) && isset($element['id'], $element['label'])) {
	1115	+ unset($tree[$index]['label']);
	1116	+ }
	1117	+ }
	1118	+
	1119	+ return $tree;
	1120	+ }
	1121	+
	1122	+ /**
	1123	+ * Give each Bricks Heading the tag it renders with when none is stored.
	1124	+ *
	1125	+ * Applied on the Bricks path only. Most other builders' text nodes carry no
	1126	+ * tag because they are not headings, so a generic "text without a tag is a
	1127	+ * heading" rule in heading_tag_from() would turn every paragraph into one.
	1128	+ *
	1129	+ * A `tag` of `custom` is left alone: the element then renders its
	1130	+ * `customTag`, which is not necessarily a heading.
	1131	+ *
	1132	+ * @since 2.15.0
	1133	+ *
	1134	+ * @param array $tree Bricks content area.
	1135	+ * @return array Tree with each untagged Heading's default tag filled in.
	1136	+ */
	1137	+ private static function with_bricks_heading_tags(array $tree): array {
	1138	+ $default = null;
	1139	+
	1140	+ foreach ($tree as $index => $element) {
	1141	+ if (!is_array($element) || self::BRICKS_HEADING_ELEMENT !== ($element['name'] ?? null)) {
	1142	+ continue;
	1143	+ }
	1144	+
	1145	+ $settings = $element['settings'] ?? [];
	1146	+ if (!is_array($settings)) {
	1147	+ continue;
	1148	+ }
	1149	+
	1150	+ $tag = $settings['tag'] ?? '';
	1151	+ if (is_string($tag) && '' !== trim($tag)) {
	1152	+ continue;
	1153	+ }
	1154	+
	1155	+ if (null === $default) {
	1156	+ $default = self::bricks_default_heading_tag();
	1157	+ }
	1158	+
	1159	+ $settings['tag'] = $default;
	1160	+ $tree[$index]['settings'] = $settings;
	1161	+ }
	1162	+
	1163	+ return $tree;
	1164	+ }
	1165	+
	1166	+ /**
	1167	+ * The tag Bricks gives a Heading that does not set one.
	1168	+ *
	1169	+ * The active theme style can change it. Bricks only loads theme styles for
	1170	+ * a front-end render, so in admin, REST and CLI requests this is the
	1171	+ * element's own default.
	1172	+ *
	1173	+ * @since 2.15.0
	1174	+ *
	1175	+ * @return string Heading tag, h1 to h6.
	1176	+ */
	1177	+ private static function bricks_default_heading_tag(): string {
	1178	+ if (class_exists('\\Bricks\\Theme_Styles')
	1179	+ && method_exists('\\Bricks\\Theme_Styles', 'get_setting_by_key')
	1180	+ ) {
	1181	+ try {
	1182	+ $styled = \Bricks\Theme_Styles::get_setting_by_key(self::BRICKS_HEADING_ELEMENT, 'tag');
	1183	+ } catch (\Throwable $e) {
	1184	+ $styled = null;
	1185	+ }
	1186	+
	1187	+ if (is_string($styled) && preg_match('/^h[1-6]$/i', trim($styled))) {
	1188	+ return strtolower(trim($styled));
	1189	+ }
	1190	+ }
	1191	+
	1192	+ return self::BRICKS_HEADING_DEFAULT_TAG;
	1193	+ }
	1194	+
	1195	+ /**
	1196	+ * Give each Elementor Heading widget its default `header_size` if unstored.
	1197	+ *
	1198	+ * @since 2.15.0
	1199	+ *
	1200	+ * @param array $elements Decoded `_elementor_data`.
	1201	+ * @return array The same tree, with untagged Heading widgets tagged.
	1202	+ */
	1203	+ private static function with_elementor_heading_tags(array $elements): array {
	1204	+ foreach ($elements as $index => $element) {
	1205	+ if (!is_array($element)) {
	1206	+ continue;
	1207	+ }
	1208	+
	1209	+ if ('heading' === ($element['widgetType'] ?? null)) {
	1210	+ $settings = $element['settings'] ?? [];
	1211	+ if (is_array($settings)) {
	1212	+ $size = $settings['header_size'] ?? '';
	1213	+ if (!is_string($size) || '' === trim($size)) {
	1214	+ $settings['header_size'] = self::ELEMENTOR_HEADING_DEFAULT_TAG;
	1215	+ $element['settings'] = $settings;
	1216	+ }
	1217	+ }
	1218	+ }
	1219	+
	1220	+ if (!empty($element['elements']) && is_array($element['elements'])) {
	1221	+ $element['elements'] = self::with_elementor_heading_tags($element['elements']);
	1222	+ }
	1223	+
	1224	+ $elements[$index] = $element;
	1225	+ }
	1226	+
	1227	+ return $elements;
	1228	+ }
	1229	+
	1230	+ /**
	1231	+ * Remove Bricks dynamic-data tags from extracted text.
	1232	+ *
	1233	+ * Bricks stores `{post_title}`, `{post_meta:price}`, `{echo:my_fn}` and the
	1234	+ * like verbatim and resolves them when it renders. Extraction reads the
	1235	+ * stored tree, so without this the placeholders were counted as words, and
	1236	+ * a heading whose text is `{post_title}` reported the literal token as its
	1237	+ * heading text.
	1238	+ *
	1239	+ * The pattern is deliberately narrower than Bricks' own
	1240	+ * (`/{([\wÀ-ÖØ-öø-ÿ\-\s\.\/:\(\)...]+)}/u`), which also matches braces
	1241	+ * containing spaces. Bricks only substitutes tags that resolve to a
	1242	+ * registered provider and leaves anything else on the page as literal text,
	1243	+ * so the broad pattern would delete prose the visitor can actually read.
	1244	+ * Matching only tag-shaped tokens keeps every real sentence and still
	1245	+ * removes every placeholder — the same trade-off SureRank makes.
	1246	+ *
	1247	+ * @since 2.2.1
	1248	+ *
	1249	+ * @param string $text Extracted text.
	1250	+ * @return string Text with placeholders removed.
	1251	+ */
	1252	+ private static function strip_bricks_dynamic_tags(string $text): string {
	1253	+ $stripped = preg_replace('/\{[a-z0-9_][a-z0-9_:\-\.]*\}/i', '', $text);
	1254	+
	1255	+ if (null === $stripped) {
	1256	+ return $text;
	1257	+ }
	1258	+
	1259	+ // Collapse the runs of spaces a removed tag leaves mid-sentence,
	1260	+ // without touching the newlines that separate collected nodes.
	1261	+ $tidied = preg_replace('/[ \t]{2,}/', ' ', $stripped);
	1262	+
	1263	+ return null === $tidied ? $stripped : $tidied;
	1264	+ }
	1265	+
	1266	+ /**
	1267	+ * Bricks' content-area meta key, preferring Bricks' own constant.
	1268	+ *
	1269	+ * @since 2.2.1
	1270	+ *
	1271	+ * @return string
	1272	+ */
	1273	+ private static function bricks_meta_key(): string {
	1274	+ return self::bricks_constant('BRICKS_DB_PAGE_CONTENT', self::BRICKS_CONTENT_META_KEY);
	1275	+ }
	1276	+
	1277	+ /**
	1278	+ * Bricks' editor-mode meta key, preferring Bricks' own constant.
	1279	+ *
	1280	+ * @since 2.2.1
	1281	+ *
	1282	+ * @return string
	1283	+ */
	1284	+ private static function bricks_editor_mode_key(): string {
	1285	+ return self::bricks_constant('BRICKS_DB_EDITOR_MODE', self::BRICKS_EDITOR_MODE_META_KEY);
	1286	+ }
	1287	+
	1288	+ /**
	1289	+ * Read one of Bricks' key-name constants, falling back to the literal.
	1290	+ *
	1291	+ * @since 2.2.1
	1292	+ *
	1293	+ * @param string $name Constant name.
	1294	+ * @param string $fallback Key to use when the constant is unavailable.
	1295	+ * @return string
	1296	+ */
	1297	+ private static function bricks_constant(string $name, string $fallback): string {
	1298	+ if (defined($name)) {
	1299	+ $value = constant($name);
	1300	+ if (is_string($value) && '' !== trim($value)) {
	1301	+ return $value;
	1302	+ }
	1303	+ }
	1304	+
	1305	+ return $fallback;
	1306	+ }
	1307	+
	1308	+ /**
216	1309	* Pull text out of whichever builder stored this post.
217	1310	*
218	1311	* @param int $post_id Post ID.
219	1312	* @return string Extracted text, or '' when no builder data was found.
		@@ -218,17 +1311,40 @@
218	1311	* @param int $post_id Post ID.
219	1312	* @return string Extracted text, or '' when no builder data was found.
220	1313	*/
221	1314	private static function from_builder_meta(int $post_id): string {
	1315	+ // Bricks first: it is the only builder whose content can live on
	1316	+ // another post, and the only one gated on an editor mode.
	1317	+ $bricks = self::from_bricks($post_id);
	1318	+ if (!self::is_blank($bricks)) {
	1319	+ return $bricks;
	1320	+ }
	1321	+
222	1322	foreach (self::BUILDER_META_KEYS as $key) {
	1323	+ if (self::is_oxygen_classic_key($key)) {
	1324	+ // Resolved as a pair, once, at the first of its keys.
	1325	+ if ('_ct_builder_json' !== $key) {
	1326	+ continue;
	1327	+ }
	1328	+
	1329	+ $oxygen = self::from_oxygen_classic($post_id);
	1330	+ if (!self::is_blank($oxygen)) {
	1331	+ return $oxygen;
	1332	+ }
	1333	+ continue;
	1334	+ }
	1335	+
223	1336	$stored = get_post_meta($post_id, $key, true);
224	1337
225	1338	if (is_string($stored) && '' !== trim($stored)) {
226	1339	$decoded = json_decode($stored, true);
	1340	+ if ('_elementor_data' === $key && is_array($decoded)) {
	1341	+ $decoded = self::with_elementor_heading_tags($decoded);
	1342	+ }
227	1343
228	1344	// JSON node tree (Breakdance/Oxygen 6, Elementor).
229	1345	if (is_array($decoded)) {
230		- $text = self::text_from_tree($decoded);
	1346	+ $text = self::text_from_tree(self::unwrap_tree_envelope($decoded));
231	1347	if (!self::is_blank($text)) {
232	1348	return $text;
233	1349	}
234	1350	continue;
		@@ -233,26 +1349,17 @@
233	1349	}
234	1350	continue;
235	1351	}
236	1352
237		- // Shortcode tree (Oxygen classic).
238		- if (strpos($stored, '[') !== false && function_exists('do_shortcode')) {
239		- try {
240		- $rendered = do_shortcode($stored);
241		- } catch (\Throwable $e) {
242		- $rendered = $stored;
243		- }
244		- if (!self::is_blank($rendered)) {
245		- return $rendered;
246		- }
247		- }
248		-
249	1353	continue;
250	1354	}
251	1355
252		- // Some builders store an already-decoded array.
253		- if (is_array($stored)) {
254		- $text = self::text_from_tree($stored);
	1356	+ // Some builders store an already-decoded tree — an array for most,
	1357	+ // an array of objects for Beaver Builder (#449).
	1358	+ $tree = self::as_children($stored);
	1359	+ if (null !== $tree) {
	1360	+ $tree = self::unwrap_tree_envelope($tree);
	1361	+ $text = self::text_from_tree($tree);
255	1362	if (!self::is_blank($text)) {
256	1363	return $text;
257	1364	}
258	1365	}
		@@ -261,50 +1368,447 @@
261	1368	return '';
262	1369	}
263	1370
264	1371	/**
	1372	+ * The node tree inside a Breakdance / Oxygen 6 storage envelope.
	1373	+ *
	1374	+ * Neither builder stores its tree directly. The meta value is
	1375	+ * `{"tree_json_string": "<the tree, JSON-encoded again>"}`, so one
	1376	+ * json_decode() yields the envelope, not the tree. Walked as a tree, the
	1377	+ * envelope is a single string leaf: kept whole as "content" when any
	1378	+ * element held rich text (the encoded JSON then reached scoring, the
	1379	+ * get-post-content ability and Markdown for AI), dropped when none did,
	1380	+ * leaving the page empty (#905).
	1381	+ *
	1382	+ * An envelope whose inner string does not decode returns an empty tree,
	1383	+ * never the string: handing the raw JSON back to the walker would bring
	1384	+ * the JSON-as-content failure back on corrupt data. Anything that is not
	1385	+ * an envelope is returned unchanged, so a bare tree still resolves.
	1386	+ *
	1387	+ * @since 2.15.0
	1388	+ *
	1389	+ * @param array $decoded Decoded meta value.
	1390	+ * @return array The node tree.
	1391	+ */
	1392	+ private static function unwrap_tree_envelope(array $decoded): array {
	1393	+ if (!array_key_exists('tree_json_string', $decoded)) {
	1394	+ return $decoded;
	1395	+ }
	1396	+
	1397	+ $inner = is_string($decoded['tree_json_string'])
	1398	+ ? json_decode($decoded['tree_json_string'], true)
	1399	+ : $decoded['tree_json_string'];
	1400	+
	1401	+ if (is_array($inner)) {
	1402	+ return $inner;
	1403	+ }
	1404	+
	1405	+ // Re-serialised envelopes can carry the tree as an object.
	1406	+ $inner = self::as_children($inner);
	1407	+
	1408	+ return null !== $inner ? $inner : [];
	1409	+ }
	1410	+
	1411	+ /**
	1412	+ * Whether a meta key is one of Oxygen classic's storage keys.
	1413	+ *
	1414	+ * @since 2.10.0
	1415	+ *
	1416	+ * @param string $key Meta key.
	1417	+ * @return bool
	1418	+ */
	1419	+ private static function is_oxygen_classic_key(string $key): bool {
	1420	+ return isset(self::OXYGEN_CLASSIC_KEYS[$key]) || in_array($key, self::OXYGEN_CLASSIC_KEYS, true);
	1421	+ }
	1422	+
	1423	+ /**
	1424	+ * Text of an Oxygen classic page, from whichever stored form holds more.
	1425	+ *
	1426	+ * Oxygen 4.x keeps the same tree twice: as JSON, and as the shortcodes it
	1427	+ * used before 4.0. The JSON is preferred because it carries copy the
	1428	+ * shortcode form hides (a composite element's text is base64-encoded
	1429	+ * inside `ct_options`, which is configuration and stripped). It is not
	1430	+ * trusted blindly, though. Reading `ct_builder_json` first once meant a
	1431	+ * key missing from CONTENT_KEYS silently threw the page away while the
	1432	+ * shortcode copy sat unread next to it, because a non-empty JSON result
	1433	+ * stopped the search. Comparing the two means the next such gap costs
	1434	+ * nothing: the richer form wins.
	1435	+ *
	1436	+ * A generation is only read as a pair. The prefixed keys are what Oxygen
	1437	+ * 4.8.3+ reads, so an unprefixed leftover next to them is stale.
	1438	+ *
	1439	+ * @since 2.10.0
	1440	+ *
	1441	+ * @param int $post_id Post ID.
	1442	+ * @return string Extracted text, or '' when Oxygen classic stored nothing.
	1443	+ */
	1444	+ private static function from_oxygen_classic(int $post_id): string {
	1445	+ foreach (self::OXYGEN_CLASSIC_KEYS as $json_key => $shortcode_key) {
	1446	+ $json = get_post_meta($post_id, $json_key, true);
	1447	+ $shortcodes = get_post_meta($post_id, $shortcode_key, true);
	1448	+
	1449	+ $from_json = '';
	1450	+ if (is_string($json) && '' !== trim($json)) {
	1451	+ $decoded = json_decode($json, true);
	1452	+ if (is_array($decoded)) {
	1453	+ // `[oxygen data="..."]` is a dynamic-data placeholder
	1454	+ // Oxygen fills at render time. The shortcode path drops it
	1455	+ // with every other tag, so it goes here too or the two
	1456	+ // forms would disagree on the same page.
	1457	+ $from_json = (string) preg_replace(
	1458	+ '/\[oxygen\b[^\]]*\]/i',
	1459	+ ' ',
	1460	+ self::text_from_tree($decoded)
	1461	+ );
	1462	+ }
	1463	+ }
	1464	+
	1465	+ $from_shortcodes = '';
	1466	+ if (is_string($shortcodes) && strpos($shortcodes, '[') !== false) {
	1467	+ $from_shortcodes = self::text_from_shortcodes($shortcodes);
	1468	+ }
	1469	+
	1470	+ if (self::is_blank($from_json) && self::is_blank($from_shortcodes)) {
	1471	+ continue;
	1472	+ }
	1473	+
	1474	+ return self::visible_word_count($from_json) >= self::visible_word_count($from_shortcodes)
	1475	+ ? $from_json
	1476	+ : $from_shortcodes;
	1477	+ }
	1478	+
	1479	+ return '';
	1480	+ }
	1481	+
	1482	+ /**
	1483	+ * Rough count of the words a visitor would read in extracted text.
	1484	+ *
	1485	+ * Only used to compare two extractions of the same page, so it needs to
	1486	+ * be consistent rather than locale-exact.
	1487	+ *
	1488	+ * @since 2.10.0
	1489	+ *
	1490	+ * @param string $text Extracted text or markup.
	1491	+ * @return int
	1492	+ */
	1493	+ private static function visible_word_count(string $text): int {
	1494	+ $plain = trim((string) preg_replace('/\s+/u', ' ', wp_strip_all_tags($text)));
	1495	+
	1496	+ return '' === $plain ? 0 : count(explode(' ', $plain));
	1497	+ }
	1498	+
	1499	+ /**
	1500	+ * Shortcode attributes that carry copy a visitor reads.
	1501	+ *
	1502	+ * An allow-list, not a deny-list. Oxygen Classic tags carry far more
	1503	+ * attributes than they do copy — `id`, `class`, `selector`, `url`,
	1504	+ * `ct_options` and friends — and a deny-list silently admits every
	1505	+ * attribute a future builder release invents, which is how markup ends up
	1506	+ * being counted as prose.
	1507	+ *
	1508	+ * @var string[]
	1509	+ */
	1510	+ private const SHORTCODE_TEXT_ATTRIBUTES = [
	1511	+ 'text',
	1512	+ 'content',
	1513	+ 'heading',
	1514	+ 'title',
	1515	+ 'subtitle',
	1516	+ 'label',
	1517	+ 'caption',
	1518	+ 'description',
	1519	+ 'alt',
	1520	+ 'button_text',
	1521	+ 'link_text',
	1522	+ ];
	1523	+
	1524	+ /**
	1525	+ * Extract readable text from a shortcode tree, without rendering it.
	1526	+ *
	1527	+ * Oxygen Classic is the only builder whose storage is shortcodes rather
	1528	+ * than JSON, and the previous implementation handed the string to
	1529	+ * `do_shortcode()`. That silently depends on Oxygen having registered its
	1530	+ * `ct_*` handlers in the current request — which it has on a front-end
	1531	+ * view, and has not during bulk analysis, the post-list column, cron or
	1532	+ * REST/MCP. With no handlers registered `do_shortcode()` returns its input
	1533	+ * unchanged, so the raw shortcode source was scored as if it were the
	1534	+ * page's prose: `[ct_section`, `id="section-1"` and the rest counted toward
	1535	+ * the word count, while the actual copy sitting in `text="..."` attributes
	1536	+ * was never counted at all (#776).
	1537	+ *
	1538	+ * `strip_shortcodes()` is no help either — it also only knows registered
	1539	+ * shortcodes, so it leaves the same text untouched.
	1540	+ *
	1541	+ * Reading the stored tree directly is what every other builder here already
	1542	+ * does, and it matches the class's stated design: no render engine, no
	1543	+ * dependency on load order, safe during a bulk run.
	1544	+ *
	1545	+ * Parsing unconditionally, rather than rendering when Oxygen happens to be
	1546	+ * loaded and parsing otherwise, is deliberate. It makes the extracted text
	1547	+ * the same in every context, so the score in the editor matches the score
	1548	+ * from a bulk run or from MCP. The old code produced whichever of the two
	1549	+ * the request happened to allow, which is why the same post could report
	1550	+ * two different word counts depending on how it was asked.
	1551	+ *
	1552	+ * The trade-off is that rendered output (resolved images, links, anything
	1553	+ * Oxygen pulls in from a reusable part) is no longer reflected here. For
	1554	+ * what this text feeds — word count, content scoring, meta-description
	1555	+ * fallbacks and schema text — that markup was never the point, and counting
	1556	+ * it only when the builder happened to be booted was the bug.
	1557	+ *
	1558	+ * @since 2.10.0
	1559	+ *
	1560	+ * @param string $stored Raw shortcode source.
	1561	+ * @return string Extracted text.
	1562	+ */
	1563	+ private static function text_from_shortcodes(string $stored): string {
	1564	+ // Oxygen stores each element's settings as a JSON blob in `ct_options`.
	1565	+ // It is configuration, never copy, and it contains braces and brackets
	1566	+ // that would otherwise confuse the tag scan below, so it goes first.
	1567	+ //
	1568	+ // The blob is matched as a balanced JSON object, not as "up to the
	1569	+ // next quote". Oxygen wraps it in single quotes but does not escape
	1570	+ // an apostrophe inside it (`"nicename":"Bob's Plumbing"`), so the
	1571	+ // quote-to-quote match stopped mid-value and the rest of the blob,
	1572	+ // `s Plumbing"}'` and all, was left in the tag and leaked into the
	1573	+ // text. Strings inside the object are skipped whole, so neither a quote
	1574	+ // nor a brace inside a value can end the match early.
	1575	+ $source = (string) preg_replace(
	1576	+ '/\sct_options\s*=\s*\'(?<obj>\{(?:[^{}"]++|"(?:[^"\\\\]|\\\\.)*+"|(?&obj))*+\})\'/s',
	1577	+ '',
	1578	+ $stored
	1579	+ );
	1580	+
	1581	+ // Anything not shaped like Oxygen's JSON blob keeps the old,
	1582	+ // quote-delimited strip.
	1583	+ $source = (string) preg_replace(
	1584	+ '/\sct_options\s*=\s*(["\']).*?\1/s',
	1585	+ '',
	1586	+ $source
	1587	+ );
	1588	+
	1589	+ $attributes = implode('|', array_map(
	1590	+ static fn(string $name): string => preg_quote($name, '/'),
	1591	+ self::SHORTCODE_TEXT_ATTRIBUTES
	1592	+ ));
	1593	+
	1594	+ // Replace each shortcode tag with whatever readable copy its attributes
	1595	+ // carry. Text between tags is left exactly where it is, so the result
	1596	+ // keeps the page's reading order rather than hoisting all the headings
	1597	+ // to the front.
	1598	+ // The attribute blob is matched quote-aware rather than as "anything up
	1599	+ // to the first `]`". Oxygen copy contains brackets often enough to
	1600	+ // matter — "Best tools [2026]", "[Updated] our policy" — and a naive
	1601	+ // scan ends the tag inside the `text` attribute, dropping the copy
	1602	+ // before the bracket and leaking the stray `"]` after it into the
	1603	+ // prose. Which is this bug's own failure mode: the wrong text scored.
	1604	+ //
	1605	+ // A tag name must start with a letter or underscore. `[2026]` is not a
	1606	+ // shortcode anyone can register, and scanning it as one dropped the
	1607	+ // year out of "Best tools [2026]".
	1608	+ $text = (string) preg_replace_callback(
	1609	+ '/\[\/?[a-zA-Z_][a-zA-Z0-9_-]*((?:[^\]"\']|"[^"]*"|\'[^\']*\')*)\]/',
	1610	+ static function (array $matches) use ($attributes): string {
	1611	+ if ('' === trim($matches[1])) {
	1612	+ return ' ';
	1613	+ }
	1614	+
	1615	+ if (!preg_match_all(
	1616	+ '/\b(' . $attributes . ')\s*=\s*(["\'])(.*?)\2/s',
	1617	+ $matches[1],
	1618	+ $found,
	1619	+ PREG_SET_ORDER
	1620	+ )) {
	1621	+ return ' ';
	1622	+ }
	1623	+
	1624	+ $parts = [];
	1625	+ foreach ($found as $attribute) {
	1626	+ $value = trim($attribute[3]);
	1627	+
	1628	+ // An attribute holding markup or a JSON fragment is
	1629	+ // configuration that happens to share a name with a copy
	1630	+ // field, not something a visitor reads.
	1631	+ if ('' === $value || preg_match('/^[\[{<]/', $value)) {
	1632	+ continue;
	1633	+ }
	1634	+
	1635	+ $parts[] = $value;
	1636	+ }
	1637	+
	1638	+ return empty($parts) ? ' ' : ' ' . implode(' ', $parts) . ' ';
	1639	+ },
	1640	+ $source
	1641	+ );
	1642	+
	1643	+ // Oxygen escapes square brackets in an element's copy before writing
	1644	+ // it between the tags, so that "Best tools [2026]" cannot be mistaken
	1645	+ // for a shortcode (`oxygen_vsb_filter_shortcode_content_encode()`).
	1646	+ // Decoded only now, after the tag scan, for the same reason; left
	1647	+ // encoded, the placeholders were scored as words of their own.
	1648	+ $text = str_replace(
	1649	+ ['_OXY_OPENING_BRACKET_', '_OXY_CLOSING_BRACKET_'],
	1650	+ ['[', ']'],
	1651	+ $text
	1652	+ );
	1653	+
	1654	+ // Entities are stored encoded in attributes (&amp;, &#8217;), and would
	1655	+ // otherwise be counted as words.
	1656	+ $text = html_entity_decode($text, ENT_QUOTES | ENT_HTML5, 'UTF-8');
	1657	+
	1658	+ return trim((string) preg_replace('/\s+/u', ' ', $text));
	1659	+ }
	1660	+
	1661	+ /**
	1662	+ * A node's children, whether it stores them as an array or an object.
	1663	+ *
	1664	+ * The walker used to return immediately on `!is_array($node)`, so an
	1665	+ * object node was dropped along with its entire subtree — silently, as
	1666	+ * `''`, which the caller reads as "this builder stored nothing" rather
	1667	+ * than "this walker cannot read this shape".
	1668	+ *
	1669	+ * Beaver Builder stores `_fl_builder_data` as an array of stdClass nodes,
	1670	+ * each with a stdClass `settings` object, so every node would have been
	1671	+ * dropped and adding its meta key alone would have looked like it worked
	1672	+ * and changed nothing. Not BB-specific: any builder storing objects hits
	1673	+ * this, and that shape will come up again (#449).
	1674	+ *
	1675	+ * @since 2.1.0
	1676	+ *
	1677	+ * @param mixed $node Candidate node.
	1678	+ * @return array<string|int,mixed>|null Traversable children, or null.
	1679	+ */
	1680	+ private static function as_children($node): ?array {
	1681	+ if (is_array($node)) {
	1682	+ return $node;
	1683	+ }
	1684	+
	1685	+ // Deliberately not is_object(): a builder can store a value object
	1686	+ // (DateTime, a WP_Post) whose properties are not content, and
	1687	+ // get_object_vars() on those yields noise. stdClass is what the
	1688	+ // JSON/serialize round-trip produces, which is the shape we want.
	1689	+ if ($node instanceof \stdClass) {
	1690	+ return get_object_vars($node);
	1691	+ }
	1692	+
	1693	+ return null;
	1694	+ }
	1695	+
	1696	+ /**
265	1697	* Walk a builder node tree and collect the user-visible text.
266	1698	*
267	1699	* Values are joined with block-level markup so downstream heading, link and
268	1700	* image detection keeps working on the result.
269	1701	*
	1702	+ * One depth-first walk, so the output follows the tree's own order, which
	1703	+ * is the order the builders read here render in. This used to be two
	1704	+ * passes over the whole tree, one for the reconstructed headings, links and
	1705	+ * images and one for the remaining text, and the output followed pass
	1706	+ * order: every heading and button on the page first, every paragraph after
	1707	+ * them. That order became the meta description, og:description, the schema
	1708	+ * description and Pro's Markdown for AI document (#907).
	1709	+ *
270	1710	* @param array $tree Decoded builder tree.
271	1711	* @return string Collected HTML.
272	1712	*/
273	1713	private static function text_from_tree(array $tree): string {
274		- $collected = [];
	1714	+ // Each entry is [value, is_markup], in tree order.
	1715	+ $entries = [];
275	1716
276		- $walk = static function ($node, $key = null) use (&$walk, &$collected): void {
277		- if (is_array($node)) {
278		- foreach ($node as $child_key => $child) {
279		- $walk($child, is_string($child_key) ? $child_key : $key);
280		- }
	1717	+ // Strings already represented inside reconstructed markup, so the plain
	1718	+ // text doesn't emit a link label or heading a second time and double it
	1719	+ // in the word count. Applied after the walk, against the whole tree:
	1720	+ // a string folded into markup anywhere is dropped everywhere, exactly
	1721	+ // as it was when the markup pass ran over the whole tree first. Checking
	1722	+ // it during the walk instead would let a bare copy that appears before
	1723	+ // its heading through.
	1724	+ $consumed = [];
	1725	+
	1726	+ // Markup is content wherever it appears; bare strings only count when
	1727	+ // their key says they are content, so slugs and class names stay out of
	1728	+ // the word count.
	1729	+ $leaf = static function ($value, $key) use (&$entries): void {
	1730	+ if (!is_string($value) || '' === trim($value)) {
281	1731	return;
282	1732	}
283	1733
284		- if (!is_string($node) || '' === trim($node)) {
	1734	+ $is_content_key = is_string($key)
	1735	+ && in_array(strtolower($key), self::CONTENT_KEYS, true);
	1736	+
	1737	+ if ($is_content_key || strpos($value, '<') !== false) {
	1738	+ $entries[] = [$value, false];
	1739	+ }
	1740	+ };
	1741	+
	1742	+ // Text only, no reconstruction. Used for a `link` / `image` / video
	1743	+ // sub-object: a destination descriptor the parent has already folded
	1744	+ // into its markup. Rebuilding inside it would emit the same URL a second
	1745	+ // time as a bare link and turn an image's own `url` field into a
	1746	+ // spurious <a>, but any copy it carries still counts.
	1747	+ $sweep = static function ($node, $key) use (&$sweep, $leaf): void {
	1748	+ $children = self::as_children($node);
	1749	+ if (null === $children) {
	1750	+ $leaf($node, $key);
285	1751	return;
286	1752	}
287	1753
288		- $is_content_key = is_string($key)
289		- && in_array(strtolower($key), self::CONTENT_KEYS, true);
	1754	+ foreach ($children as $child_key => $child) {
	1755	+ $sweep($child, is_string($child_key) ? $child_key : $key);
	1756	+ }
	1757	+ };
290	1758
291		- // Markup is content wherever it appears; bare strings only count
292		- // when their key says they are content, so slugs and class names
293		- // stay out of the word count.
294		- if ($is_content_key || strpos($node, '<') !== false) {
295		- $collected[] = $node;
	1759	+ // Rebuild <a>, <img> and <hN> from node *shape*, then carry on through
	1760	+ // the node's own fields in order. This has to happen per node rather
	1761	+ // than per leaf: a link's label and its destination are separate
	1762	+ // sibling fields, so once the tree is flattened to leaves the pairing
	1763	+ // is gone.
	1764	+ $walk = static function ($node, $key = null) use (&$walk, $sweep, $leaf, &$entries, &$consumed): void {
	1765	+ $children = self::as_children($node);
	1766	+ if (null === $children) {
	1767	+ $leaf($node, $key);
	1768	+ return;
296	1769	}
	1770	+
	1771	+ $markup = self::markup_for_node($children, $consumed);
	1772	+ if ('' !== $markup) {
	1773	+ $entries[] = [$markup, true];
	1774	+ }
	1775	+
	1776	+ foreach ($children as $child_key => $child) {
	1777	+ $next_key = is_string($child_key) ? $child_key : $key;
	1778	+
	1779	+ if (is_string($child_key)
	1780	+ && (in_array(strtolower($child_key), self::URL_KEYS, true)
	1781	+ || in_array(strtolower($child_key), self::IMAGE_KEYS, true)
	1782	+ || in_array(strtolower($child_key), self::VIDEO_KEYS, true))
	1783	+ ) {
	1784	+ $sweep($child, $next_key);
	1785	+ continue;
	1786	+ }
	1787	+
	1788	+ $walk($child, $next_key);
	1789	+ }
297	1790	};
298	1791
299	1792	$walk($tree);
300	1793
	1794	+ $collected = [];
	1795	+ foreach ($entries as [$value, $is_markup]) {
	1796	+ // Already inside a reconstructed tag.
	1797	+ if (!$is_markup && in_array($value, $consumed, true)) {
	1798	+ continue;
	1799	+ }
	1800	+
	1801	+ $collected[] = $value;
	1802	+ }
	1803	+
301	1804	if (empty($collected)) {
302	1805	return '';
303	1806	}
304	1807
305	1808	// De-duplicate: builder trees often repeat a value across responsive
306		- // breakpoints, which would otherwise multiply the word count.
	1809	+ // breakpoints, which would otherwise multiply the word count. Keeps the
	1810	+ // first occurrence, so a repeat never moves a value later in the page.
307	1811	$collected = array_unique($collected);
308	1812
309	1813	return implode("\n", $collected);
310	1814	}
		@@ -309,13 +1813,323 @@
309	1813	return implode("\n", $collected);
310	1814	}
311	1815
312	1816	/**
313		- * Whether a value carries no readable text.
	1817	+ * The video source a node is actually playing, if any.
314	1818	*
	1819	+ * @since 2.3.1
	1820	+ *
	1821	+ * @param array $node Builder node.
	1822	+ * @return string Video source, or '' when the node carries none.
	1823	+ */
	1824	+ private static function video_from(array $node): string {
	1825	+ foreach ($node as $key => $value) {
	1826	+ if (!is_string($key) || !is_string($value)) {
	1827	+ continue;
	1828	+ }
	1829	+
	1830	+ if (!in_array(strtolower($key), self::VIDEO_TYPE_KEYS, true)) {
	1831	+ continue;
	1832	+ }
	1833	+
	1834	+ $keys = self::VIDEO_KEYS_BY_TYPE[strtolower(trim($value))] ?? null;
	1835	+ if (null === $keys) {
	1836	+ continue;
	1837	+ }
	1838	+
	1839	+ // A recognised video_type settles it, including when that
	1840	+ // provider's own field is empty. Falling through to the flat sweep
	1841	+ // there handed back whichever sibling key happened to come first in
	1842	+ // node order — the stale youtube_url left behind after switching
	1843	+ // the widget to a hosted file, which is exactly what keying on the
	1844	+ // declared type is meant to prevent.
	1845	+ $declared = self::url_from($node, $keys);
	1846	+
	1847	+ return self::is_video_source($declared) ? $declared : '';
	1848	+ }
	1849	+
	1850	+ $url = self::url_from($node, self::VIDEO_KEYS);
	1851	+
	1852	+ return self::is_video_source($url) ? $url : '';
	1853	+ }
	1854	+
	1855	+ /**
	1856	+ * Whether a value can be a video source.
	1857	+ *
	1858	+ * `looks_like_url()` also accepts `#anchor`, `mailto:` and `tel:`, which a
	1859	+ * link node may legitimately hold but a video cannot: `<iframe src="#top">`
	1860	+ * is not a video and would reach a video sitemap as one.
	1861	+ *
	1862	+ * @since 2.3.1
	1863	+ *
	1864	+ * @param string $url Candidate source.
	1865	+ * @return bool
	1866	+ */
	1867	+ private static function is_video_source(string $url): bool {
	1868	+ return '' !== $url
	1869	+ && (1 === preg_match('#^(https?:)?//#i', $url) || str_starts_with($url, '/'));
	1870	+ }
	1871	+
	1872	+ /**
	1873	+ * Whether a video source points at a file rather than a provider page.
	1874	+ *
	1875	+ * @since 2.3.1
	1876	+ *
	1877	+ * @param string $url Video source.
	1878	+ * @return bool
	1879	+ */
	1880	+ private static function is_video_file(string $url): bool {
	1881	+ $path = (string) wp_parse_url($url, PHP_URL_PATH);
	1882	+ $ext = strtolower((string) pathinfo($path, PATHINFO_EXTENSION));
	1883	+
	1884	+ return in_array($ext, self::VIDEO_FILE_EXTENSIONS, true);
	1885	+ }
	1886	+
	1887	+ /**
	1888	+ * Rebuild the HTML a single builder node represents, if any.
	1889	+ *
	1890	+ * Looks only at the node's own fields (plus one level of nesting, because
	1891	+ * builders commonly wrap a destination as `{ url: … }`). Returns an empty
	1892	+ * string for the vast majority of nodes, which are layout or configuration.
	1893	+ *
	1894	+ * Any leaf string folded into the returned markup is appended to $consumed
	1895	+ * so the plain-text sweep doesn't count it twice.
	1896	+ *
	1897	+ * @param array $node Builder node.
	1898	+ * @param array $consumed Collects strings represented in the returned markup.
	1899	+ * @return string Reconstructed HTML, or '' when the node carries none.
	1900	+ */
	1901	+ private static function markup_for_node(array $node, array &$consumed): string {
	1902	+ $text = self::first_value($node, self::CONTENT_KEYS);
	1903	+ $url = self::url_from($node, self::URL_KEYS);
	1904	+ $image = self::image_from($node);
	1905	+ $video = self::video_from($node);
	1906	+ $tag = self::heading_tag_from($node);
	1907	+
	1908	+ $parts = [];
	1909	+
	1910	+ // Video: an embed shape rather than a link, so the video detector can
	1911	+ // see it while the link counters do not mistake it for an outbound
	1912	+ // link. A file source becomes <video src>, anything else an <iframe>,
	1913	+ // matching how the builder itself renders the two cases.
	1914	+ if ('' !== $video) {
	1915	+ $parts[] = self::is_video_file($video)
	1916	+ ? sprintf('<video src="%s"></video>', esc_url_raw($video))
	1917	+ : sprintf('<iframe src="%s"></iframe>', esc_url_raw($video));
	1918	+ }
	1919	+
	1920	+ // Image: alt text matters as much as the tag, since alt checks run over
	1921	+ // whatever this returns.
	1922	+ if ('' !== $image['url']) {
	1923	+ $alt = '' !== $image['alt'] ? $image['alt'] : (string) self::first_value($node, self::ALT_KEYS);
	1924	+ if ('' !== $alt) {
	1925	+ $consumed[] = $alt;
	1926	+ }
	1927	+ $parts[] = sprintf(
	1928	+ '<img src="%s" alt="%s" />',
	1929	+ esc_url_raw($image['url']),
	1930	+ htmlspecialchars($alt, ENT_QUOTES)
	1931	+ );
	1932	+ }
	1933	+
	1934	+ if ('' !== $text) {
	1935	+ $inner = $text;
	1936	+
	1937	+ if ('' !== $url) {
	1938	+ $consumed[] = $text;
	1939	+ $inner = sprintf('<a href="%s">%s</a>', esc_url_raw($url), $text);
	1940	+ }
	1941	+
	1942	+ if ('' !== $tag) {
	1943	+ $consumed[] = $text;
	1944	+ $parts[] = sprintf('<%1$s>%2$s</%1$s>', $tag, $inner);
	1945	+ } elseif ('' !== $url) {
	1946	+ $parts[] = $inner;
	1947	+ }
	1948	+ } elseif ('' !== $url) {
	1949	+ // A destination with no label still counts as a link for link
	1950	+ // checks; the URL doubles as its anchor text.
	1951	+ $parts[] = sprintf('<a href="%1$s">%1$s</a>', esc_url_raw($url));
	1952	+ }
	1953	+
	1954	+ return implode("\n", $parts);
	1955	+ }
	1956	+
	1957	+ /**
	1958	+ * First non-empty scalar value under any of the given keys.
	1959	+ *
	1960	+ * @param array $node Builder node.
	1961	+ * @param string[] $keys Candidate keys.
	1962	+ * @return string Trimmed value, or '' when none match.
	1963	+ */
	1964	+ private static function first_value(array $node, array $keys): string {
	1965	+ foreach ($node as $key => $value) {
	1966	+ if (!is_string($key) || !is_string($value)) {
	1967	+ continue;
	1968	+ }
	1969	+ if (in_array(strtolower($key), $keys, true) && '' !== trim($value)) {
	1970	+ return trim($value);
	1971	+ }
	1972	+ }
	1973	+
	1974	+ return '';
	1975	+ }
	1976	+
	1977	+ /**
	1978	+ * Link destination held by a node, as a bare string or a `{ url: … }` object.
	1979	+ *
	1980	+ * @param array $node Builder node.
	1981	+ * @param string[] $keys Candidate keys.
	1982	+ * @return string URL, or '' when the node holds none.
	1983	+ */
	1984	+ private static function url_from(array $node, array $keys): string {
	1985	+ foreach ($node as $key => $value) {
	1986	+ if (!is_string($key) || !in_array(strtolower($key), $keys, true)) {
	1987	+ continue;
	1988	+ }
	1989	+
	1990	+ if (is_string($value) && self::looks_like_url($value)) {
	1991	+ return trim($value);
	1992	+ }
	1993	+
	1994	+ // Elementor and Breakdance both nest the destination one level down.
	1995	+ $nested_values = self::as_children($value);
	1996	+ if (null !== $nested_values) {
	1997	+ foreach ($nested_values as $nested_key => $nested) {
	1998	+ if (is_string($nested_key)
	1999	+ && in_array(strtolower($nested_key), ['url', 'href', 'permalink'], true)
	2000	+ && is_string($nested)
	2001	+ && self::looks_like_url($nested)
	2002	+ ) {
	2003	+ return trim($nested);
	2004	+ }
	2005	+ }
	2006	+ }
	2007	+ }
	2008	+
	2009	+ return '';
	2010	+ }
	2011	+
	2012	+ /**
	2013	+ * Image URL and alt text held by a node.
	2014	+ *
	2015	+ * @param array $node Builder node.
	2016	+ * @return array{url:string,alt:string}
	2017	+ */
	2018	+ private static function image_from(array $node): array {
	2019	+ foreach ($node as $key => $value) {
	2020	+ if (!is_string($key) || !in_array(strtolower($key), self::IMAGE_KEYS, true)) {
	2021	+ continue;
	2022	+ }
	2023	+
	2024	+ if (is_string($value) && self::looks_like_url($value)) {
	2025	+ return ['url' => trim($value), 'alt' => ''];
	2026	+ }
	2027	+
	2028	+ $nested_values = self::as_children($value);
	2029	+ if (null !== $nested_values) {
	2030	+ $url = '';
	2031	+ $alt = '';
	2032	+ foreach ($nested_values as $nested_key => $nested) {
	2033	+ if (!is_string($nested_key) || !is_string($nested)) {
	2034	+ continue;
	2035	+ }
	2036	+ $nested_key = strtolower($nested_key);
	2037	+ if ('' === $url && in_array($nested_key, ['url', 'src'], true) && self::looks_like_url($nested)) {
	2038	+ $url = trim($nested);
	2039	+ }
	2040	+ if ('' === $alt && in_array($nested_key, self::ALT_KEYS, true)) {
	2041	+ $alt = trim($nested);
	2042	+ }
	2043	+ }
	2044	+ if ('' !== $url) {
	2045	+ return ['url' => $url, 'alt' => $alt];
	2046	+ }
	2047	+ }
	2048	+ }
	2049	+
	2050	+ return ['url' => '', 'alt' => ''];
	2051	+ }
	2052	+
	2053	+ /**
	2054	+ * Heading tag a node asks for, normalised to h1–h6.
	2055	+ *
	2056	+ * Accepts both the `h2` form and a bare level like `2`.
	2057	+ *
	2058	+ * @param array $node Builder node.
	2059	+ * @return string Tag name, or '' when the node is not a heading.
	2060	+ */
	2061	+ private static function heading_tag_from(array $node): string {
	2062	+ foreach ($node as $key => $value) {
	2063	+ if (!is_string($key) || !in_array(strtolower($key), self::HEADING_TAG_KEYS, true)) {
	2064	+ continue;
	2065	+ }
	2066	+
	2067	+ if (is_string($value) && preg_match('/^h([1-6])$/i', trim($value), $m)) {
	2068	+ return 'h' . $m[1];
	2069	+ }
	2070	+
	2071	+ // A bare level only counts under a key that unambiguously means one;
	2072	+ // `size` and `tag` carry values like "large" or "div" far more often.
	2073	+ if (is_numeric($value)
	2074	+ && in_array(strtolower($key), ['level'], true)
	2075	+ && (int) $value >= 1 && (int) $value <= 6
	2076	+ ) {
	2077	+ return 'h' . (int) $value;
	2078	+ }
	2079	+ }
	2080	+
	2081	+ return '';
	2082	+ }
	2083	+
	2084	+ /**
	2085	+ * Whether a string is plausibly a link or asset destination.
	2086	+ *
	2087	+ * Deliberately permissive about relative paths — builders store internal
	2088	+ * links that way — but rejects the option slugs and CSS values that make up
	2089	+ * most of a builder tree.
	2090	+ *
	2091	+ * @param string $value Candidate.
	2092	+ * @return bool
	2093	+ */
	2094	+ private static function looks_like_url(string $value): bool {
	2095	+ $value = trim($value);
	2096	+
	2097	+ if ('' === $value || strlen($value) > 2048) {
	2098	+ return false;
	2099	+ }
	2100	+
	2101	+ if (preg_match('#^(https?:)?//#i', $value) || str_starts_with($value, '/')) {
	2102	+ return true;
	2103	+ }
	2104	+
	2105	+ // Protocol-ish destinations a link node can legitimately hold.
	2106	+ return (bool) preg_match('#^(mailto:|tel:|\#)#i', $value);
	2107	+ }
	2108	+
	2109	+ /**
	2110	+ * Whether a value carries nothing worth analyzing.
	2111	+ *
	2112	+ * Readable text is the usual signal, but not the only one: a page can be
	2113	+ * made entirely of media. A builder section holding just a gallery
	2114	+ * reconstructs to `<img>` tags and one holding just a video widget to a
	2115	+ * single `<iframe>` — both strip to an empty string, so a text-only test
	2116	+ * discarded them here and the page fell through to the next builder key,
	2117	+ * then to the raw markup, and finally reported as having no content at all.
	2118	+ *
	2119	+ * Comments are dropped before the tag test: the raw markup this class falls
	2120	+ * back to on a builder page is unrendered block comments, which must stay
	2121	+ * blank rather than be mistaken for reconstructed media.
	2122	+ *
315	2123	* @param string $value Candidate content.
316	2124	* @return bool
317	2125	*/
318	2126	private static function is_blank(string $value): bool {
319		- return '' === trim(wp_strip_all_tags($value));
	2127	+ if ('' !== trim(wp_strip_all_tags($value))) {
	2128	+ return false;
	2129	+ }
	2130	+
	2131	+ $without_comments = (string) preg_replace('~<!--.*?-->~s', '', $value);
	2132	+
	2133	+ return 1 !== preg_match('~<(?:a|img|iframe|video|source)\b~i', $without_comments);
320	2134	}
321	2135	}