<?php
/**
 * What the block prints on the public site (decisions 0002, 0003, 0005, 0006, 0007).
 *
 * With a cached start: the module's start markup and its start script where the block stands, page.js and sr7.css
 * once per page before the first module, and the loader (`embed.js?pjs=0`), which takes the printed module over by id.
 * Without one: the plain embed line where the block stands. Nothing for blocked, paused or unpublished modules, and
 * nothing in feeds.
 *
 * @package SRAnywhere
 */

namespace SRAnywhere;

defined( 'ABSPATH' ) || exit;

/**
 * Renders the block.
 */
final class Output {

	const PAGE_HANDLE = 'sranywhere-page';
	const CSS_HANDLE  = 'sranywhere-sr7';

	/**
	 * JSON inside inline scripts: `<`, `>` and `&` as \u escapes, so no remote value can open or close a tag or comment.
	 */
	const JSON_FLAGS = JSON_HEX_TAG | JSON_HEX_AMP | JSON_UNESCAPED_SLASHES;

	/**
	 * The first line of our inline start scripts, for consent tools that look at a script's code (Real Cookie Banner).
	 */
	const MARK = '/*sranywhere*/';

	/**
	 * Whether page.js and sr7.css are already on this page.
	 *
	 * @var bool
	 */
	private static $head_done = false;

	/**
	 * Whether the page's first module has been seen for the picture preload (one per page, the first module only).
	 *
	 * @var bool
	 */
	private static $lcp_done = false;

	/**
	 * The block's render callback.
	 *
	 * @param array $attributes The block's attributes.
	 * @return string
	 */
	public static function render_block( $attributes ) {
		return self::render_module( (array) $attributes, true );
	}

	/**
	 * Registers the shortcode `[sr_anywhere key="ek_…" align="full" offset="header"]` for the classic editor and page
	 * builders without a widget (plan §6.10). Same output as the block, same checks (decision 0006).
	 */
	public static function register_shortcode() {
		add_shortcode( 'sr_anywhere', array( self::class, 'shortcode' ) );
	}

	/**
	 * The shortcode's output.
	 *
	 * @param array|string $atts The shortcode's attributes.
	 * @return string
	 */
	public static function shortcode( $atts ) {
		$atts = shortcode_atts(
			array(
				'key'    => '',
				'align'  => '',
				'offset' => '',
			),
			$atts,
			'sr_anywhere'
		);
		return self::render_module(
			array(
				'embedKey' => trim( (string) $atts['key'] ),
				'align'    => in_array( $atts['align'], array( 'full', 'wide' ), true ) ? $atts['align'] : '',
				'fsOffset' => (string) $atts['offset'],
			),
			false
		);
	}

	/**
	 * A module where the block or the shortcode stands.
	 *
	 * @param array $attributes `embedKey`, and optionally `align` and `fsOffset`.
	 * @param bool  $is_block   Whether WordPress renders it as a block (its wrapper then carries the block supports).
	 * @return string
	 */
	private static function render_module( array $attributes, $is_block ) {
		$key = isset( $attributes['embedKey'] ) ? (string) $attributes['embedKey'] : '';
		if ( ! Keys::is_embed_key( $key ) || is_feed() || ! Placeable::allows( $key ) ) {
			return '';
		}

		if ( Keys::is_group_key( $key ) ) {
			return self::wrap( self::plain_line( 'g', $key ), $attributes, false, $is_block );
		}

		$start = Start::get( $key );
		if ( Start::GONE === $start ) {
			return '';
		}
		if ( ! is_array( $start ) ) { // no start known, or a module that plays from its embed line (Start::LINE)
			return self::wrap( self::plain_line( 'i', $key ), $attributes, false, $is_block );
		}

		$html  = self::head_inline( $start );
		$html .= self::preload( $start );
		$html .= self::markup( $start );
		$html .= wp_get_inline_script_tag( self::start_script( $start ), array( 'id' => 'sranywhere-start-' . $key ) );
		wp_enqueue_script( 'sranywhere-loader-' . $key, $start['embed'], array(), null, array( 'strategy' => 'async', 'in_footer' => true ) ); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion -- the delivery versions its loader itself.

		return self::wrap( $html, $attributes, ! empty( $start['fullHeight'] ), $is_block );
	}

	/**
	 * On pages whose content holds a module, puts page.js and sr7.css into the head before the content renders
	 * (classic themes print the head first). Block themes render the content before the head anyway.
	 */
	public static function enqueue_early() {
		if ( ! is_singular() ) {
			return;
		}
		$post = get_queried_object();
		if ( ! $post instanceof \WP_Post ) {
			return;
		}
		foreach ( Start::keys_in_content( $post->post_content ) as $key ) {
			$start = Start::get( $key );
			if ( is_array( $start ) ) {
				self::enqueue_head( $start );
				self::preload( $start, true );
				return;
			}
		}
	}

	/**
	 * The picture the page's first module opens with, preloaded (plan §6.2): `<link rel="preload" as="image"
	 * fetchpriority="high">`, in the head when the head is still to come, else right before the module. A preload only
	 * fetches the picture early; it paints nothing, so the slide still opens with its own animation. Only the first
	 * module on the page, the one most likely seen first, and only a picture on the delivery (Start::lcp()).
	 *
	 * @param array $start   A parsed start.
	 * @param bool  $in_head Whether the head is being printed now (enqueue_early(), which runs before
	 *                       wp_preload_resources() in `wp_head`).
	 * @return string What to print before the module ('' when it went into the head, or when there is nothing).
	 */
	private static function preload( array $start, $in_head = false ) {
		if ( self::$lcp_done ) {
			return '';
		}
		self::$lcp_done = true;
		if ( empty( $start['lcp']['src'] ) ) {
			return '';
		}
		$src = $start['lcp']['src'];
		if ( $in_head || ! did_action( 'wp_head' ) ) {
			add_filter(
				'wp_preload_resources',
				static function ( $resources ) use ( $src ) {
					$resources[] = array(
						'href'          => $src,
						'as'            => 'image',
						'fetchpriority' => 'high',
					);
					return $resources;
				}
			);
			return '';
		}
		return '<link rel="preload" as="image" href="' . esc_url( $src ) . '" fetchpriority="high">';
	}

	/**
	 * Adds the optimizer marks and the consent-tool marks to our own scripts (decisions 0007, 0023): the delivery works
	 * like a CDN for the page's own content, sets no cookies, and since 2026-10-07 sends nothing to Google (0023's
	 * condition, confirmed by sr-anywhere). The same marks the classic plugin uses: Cookiebot, CookieYes, Borlabs.
	 *
	 * @param array $attributes A script tag's attributes.
	 * @return array
	 */
	public static function script_attributes( $attributes ) {
		if ( isset( $attributes['id'] ) && 0 === strpos( (string) $attributes['id'], 'sranywhere-' ) ) {
			$attributes['data-no-optimize']   = '1';
			$attributes['data-no-defer']      = '1';
			$attributes['data-cfasync']       = 'false';
			$attributes['data-jetpack-boost'] = 'ignore';
			$attributes['data-cookieconsent'] = 'ignore';
			$attributes['data-wcc']           = 'necessary';
			$attributes['data-borlabs-cookie-script-blocker-ignore'] = true;
		}
		return $attributes;
	}

	/**
	 * Keeps sr7.css out of combined stylesheets (decision 0007; the matrix of 2026-10-08): LiteSpeed Cache fetches an
	 * external stylesheet to combine it and leaves it out when that fetch fails, so the printed start has no styles and
	 * the page jumps until the cache is purged.
	 *
	 * @param string $tag    The stylesheet's link tag.
	 * @param string $handle The style's handle.
	 * @return string
	 */
	public static function style_tag( $tag, $handle ) {
		if ( self::CSS_HANDLE === $handle && false === strpos( $tag, 'data-no-optimize' ) ) {
			$tag = (string) preg_replace( '/<link\b/', '<link data-no-optimize="1"', $tag, 1 );
		}
		return $tag;
	}

	/**
	 * Complianz: our scripts are functional, so it does not hold them back until consent (decision 0023).
	 *
	 * @param string $category    The category Complianz chose.
	 * @param string $total_match The whole script tag.
	 * @param bool   $found       Whether Complianz took it for a third-party script.
	 * @return string
	 */
	public static function complianz_category( $category, $total_match = '', $found = false ) {
		return $found && 1 === preg_match( '/\sid=["\']sranywhere-/', (string) $total_match ) ? 'functional' : $category;
	}

	/**
	 * Real Cookie Banner: lets our inline start scripts run without consent (decision 0023).
	 *
	 * @param object $is_blocked The blocker's verdict.
	 * @param string $script     The inline script's code.
	 * @return object
	 */
	public static function real_cookie_banner( $is_blocked, $script = '' ) {
		if ( ! is_object( $is_blocked ) || 0 !== strpos( ltrim( (string) $script ), self::MARK ) ) {
			return $is_blocked;
		}
		if ( method_exists( $is_blocked, 'disableBlocking' ) ) {
			$is_blocked->disableBlocking();
		}
		return $is_blocked;
	}

	/**
	 * SiteGround Speed Optimizer ignores the marks: its JavaScript combine pulled page.js, the start scripts and the
	 * loader into its own deferred file (the matrix on the shared site, 2026-10-08), so the module had no height while
	 * the page was parsed and a stale copy of the loader. Its own filters keep them out: the delivery's scripts by path,
	 * our inline scripts by their mark.
	 *
	 * @param array $paths Parts of external script URLs SiteGround leaves alone.
	 * @return array
	 */
	public static function sgo_external_paths( $paths ) {
		$paths   = (array) $paths;
		$paths[] = (string) wp_parse_url( Config::delivery_url(), PHP_URL_HOST );
		return $paths;
	}

	/**
	 * SiteGround Speed Optimizer: our inline scripts (the env and the starts) stay where they are, by their mark.
	 *
	 * @param array $content Parts of inline scripts SiteGround leaves alone.
	 * @return array
	 */
	public static function sgo_inline_content( $content ) {
		$content   = (array) $content;
		$content[] = self::MARK;
		return $content;
	}

	/**
	 * SiteGround Speed Optimizer: our script handles are neither deferred nor minified by it.
	 *
	 * @param array $handles The handles SiteGround leaves alone.
	 * @return array
	 */
	public static function sgo_handles( $handles ) {
		$ours = array_filter(
			array_keys( wp_scripts()->registered ),
			static function ( $handle ) {
				return 0 === strpos( $handle, 'sranywhere-' );
			}
		);
		return array_merge( (array) $handles, array_values( $ours ) );
	}

	/**
	 * WP Rocket (decision 0007): it ignores the marks on our tags. Seen on the shared site on 2026-10-13: it delayed the
	 * env, the start and the loader until the visitor moves or scrolls (so the module had no height and no engine until
	 * then), deferred page.js, and kept copies of page.js, the loader and sr7.css in its own cache, which go stale when the
	 * delivery changes. These filters keep our scripts and sr7.css out of all of that.
	 *
	 * Delay JS: its patterns are matched against the whole script tag, so our ids (`sranywhere-…`) and the delivery's host
	 * catch every one of ours.
	 *
	 * @param array $patterns Patterns WP Rocket does not delay.
	 * @return array
	 */
	public static function rocket_delay_exclusions( $patterns ) {
		$patterns   = (array) $patterns;
		$patterns[] = 'sranywhere-';
		$patterns[] = self::delivery_host();
		return $patterns;
	}

	/**
	 * WP Rocket: the delivery's scripts are neither minified nor combined into WP Rocket's own files (matched against the
	 * script's address), and not deferred (page.js has to run before the start scripts).
	 *
	 * @param array $hosts Addresses or patterns WP Rocket leaves alone.
	 * @return array
	 */
	public static function rocket_external( $hosts ) {
		$hosts   = (array) $hosts;
		$hosts[] = self::delivery_host();
		return $hosts;
	}

	/**
	 * WP Rocket: our inline scripts (the env and the starts) are not combined, by their mark.
	 *
	 * @param array $content Parts of inline scripts WP Rocket leaves alone.
	 * @return array
	 */
	public static function rocket_inline( $content ) {
		$content   = (array) $content;
		$content[] = 'sranywhere';
		return $content;
	}

	/**
	 * WP Rocket: sr7.css is neither minified, nor combined, nor cut down by "Remove Unused CSS" (the engine uses its rules
	 * for elements it builds later, which that feature would drop). WP Rocket matches these against the stylesheet's host.
	 *
	 * @param array $patterns Stylesheets WP Rocket leaves alone.
	 * @return array
	 */
	public static function rocket_css( $patterns ) {
		$patterns   = (array) $patterns;
		$patterns[] = self::delivery_host();
		return $patterns;
	}

	/**
	 * The delivery's host, for the optimizers' lists.
	 *
	 * @return string
	 */
	private static function delivery_host() {
		return (string) wp_parse_url( Config::delivery_url(), PHP_URL_HOST );
	}

	/**
	 * The elements and attributes a start's markup may contain.
	 *
	 * @return array
	 */
	public static function allowed_html() {
		$common = array(
			'id'    => true,
			'class' => true,
		);
		return array(
			'div'          => $common,
			'sr7-module'   => $common + array(
				'data-alias'     => true,
				'data-id'        => true,
				'data-version'   => true,
				'data-title'     => true,
				'data-modal'     => true,
				'data-sra-start' => true,
			),
			'sr7-adjuster' => $common,
			'sr7-content'  => $common,
			'sr7-carousel' => $common,
			'sr7-slide'    => $common + array( 'data-key' => true ),
			'sr7-bg'       => $common,
			'sr7-txt'      => $common + array(
				'href'  => true,
				'rel'   => true,
				'title' => true,
			),
			'noscript'     => array(),
			'img'          => $common + array(
				'src'           => true,
				'alt'           => true,
				'title'         => true,
				'width'         => true,
				'height'        => true,
				'loading'       => true,
				'decoding'      => true,
				'fetchpriority' => true,
			),
			'a'            => $common + array(
				'href'   => true,
				'rel'    => true,
				'title'  => true,
				'target' => true,
			),
			'span'         => $common,
			'p'            => $common,
			'h1'           => $common,
			'h2'           => $common,
			'h3'           => $common,
			'h4'           => $common,
		);
	}

	/**
	 * The start's markup through the allow-list, and the module's scene from the checked value only.
	 *
	 * @param array $start A parsed start.
	 * @return string
	 */
	private static function markup( array $start ) {
		$markup = $start['markup'];
		$lists  = '';
		if ( preg_match( '#<image_lists\b[^>]*>(.*?)</image_lists>#s', $markup, $found ) ) {
			$markup = str_replace( $found[0], '', $markup );
			$lists  = self::image_lists( $found[1] );
		}
		$html = wp_kses( $markup, self::allowed_html() );
		if ( ! empty( $start['scene'] ) ) {
			$html = (string) preg_replace( '/<sr7-module\b/', '<sr7-module data-scene="' . esc_attr( $start['scene'] ) . '"', $html, 1 );
		}
		if ( '' !== $lists ) {
			$html = (string) preg_replace( '#</sr7-module>#', $lists . '</sr7-module>', $html, 1 );
		}
		if ( ! empty( $start['seo'] ) ) {
			$slide = self::seo_html( $start['seo'] );
			$html  = (string) preg_replace_callback(
				'#<sr7-content([^>]*)>\s*</sr7-content>#',
				static function ( $m ) use ( $slide ) {
					return '<sr7-content' . $m[1] . '>' . $slide . '</sr7-content>';
				},
				$html,
				1
			);
		}
		return $html;
	}

	/**
	 * The first slide as SR7's Output.php prints it for search engines and pages read without scripts (the contract's
	 * `seo`): `<sr7-slide>`, its background only inside `<noscript>`, its words as layers. The engine takes these
	 * elements by their ids as its own. sr7.css keeps the slide and every layer hidden until the engine shows them, so
	 * nothing appears before the slide's own animation; the background is neither shown nor loaded while scripts run.
	 *
	 * @param array $seo The checked `seo` (Start::seo()).
	 * @return string
	 */
	private static function seo_html( array $seo ) {
		$inner = '';
		if ( ! empty( $seo['bg'] ) ) {
			$bg     = $seo['bg'];
			$inner .= '<sr7-bg id="' . esc_attr( $bg['id'] ) . '" class="sr7-layer"><noscript><img src="' . esc_url( $bg['src'] ) . '" alt="' . esc_attr( $bg['alt'] ) . '" title="' . esc_attr( $bg['title'] ) . '"></noscript></sr7-bg>';
		}
		foreach ( $seo['layers'] as $layer ) {
			if ( ! in_array( $layer['tag'], Start::SEO_TAGS, true ) ) {
				continue;
			}
			$attributes = ' id="' . esc_attr( $layer['id'] ) . '" class="sr7-layer"';
			foreach ( array( 'href', 'target', 'rel' ) as $name ) {
				if ( 'a' === $layer['tag'] && ! empty( $layer[ $name ] ) ) {
					$attributes .= ' ' . $name . '="' . ( 'href' === $name ? esc_url( $layer[ $name ] ) : esc_attr( $layer[ $name ] ) ) . '"';
				}
			}
			$inner .= '<' . $layer['tag'] . $attributes . '>' . esc_html( $layer['text'] ) . '</' . $layer['tag'] . '>';
		}
		return '<sr7-slide id="' . esc_attr( $seo['slide']['id'] ) . '" data-key="' . esc_attr( $seo['slide']['key'] ) . '">' . $inner . '</sr7-slide>';
	}

	/**
	 * The module's `<image_lists>`, rebuilt: each image's WebP copy on the delivery (`data-src`) and its original
	 * (`data-dbsrc`, base64). The engine swaps the original for the copy from here; the delivery leaves the copies out
	 * of the scene. Built by hand, as `wp_kses` allows no element name with an underscore.
	 *
	 * @param string $inner What the delivery printed inside `<image_lists>`.
	 * @return string The element, or '' without a usable image.
	 */
	private static function image_lists( $inner ) {
		$images = '';
		preg_match_all( '#<img\b[^>]*>#', $inner, $tags );
		foreach ( $tags[0] as $tag ) {
			$copy     = preg_match( '/\sdata-src="([^"]*)"/', $tag, $m ) ? html_entity_decode( $m[1], ENT_QUOTES ) : '';
			$original = preg_match( '/\sdata-dbsrc="([^"]*)"/', $tag, $m ) ? $m[1] : '';
			if ( Config::is_delivery_url( $copy ) && 1 === preg_match( '#^[A-Za-z0-9+/]{1,4096}={0,2}$#', $original ) ) {
				$images .= '<img data-src="' . esc_url( $copy ) . '" width="0" height="0" data-dbsrc="' . esc_attr( $original ) . '">';
			}
		}
		return '' === $images ? '' : '<image_lists style="display:none">' . $images . '</image_lists>';
	}

	/**
	 * The start script, rebuilt from the start's values: the module's scene for an engine already on the page, then the
	 * same retry the delivery and Output.php use until page.js has defined `prepareModuleHeight`.
	 *
	 * @param array $start A parsed start.
	 * @return string
	 */
	private static function start_script( array $start ) {
		$id    = wp_json_encode( $start['id'], self::JSON_FLAGS );
		$data  = wp_json_encode( $start['start'], self::JSON_FLAGS );
		$scene = empty( $start['scene'] ) ? '' : "SR7.JSON??={};SR7.JSON[{$id}]??=" . wp_json_encode( $start['scene'], self::JSON_FLAGS ) . ';';
		return self::MARK . 'window.SR7??={};' . $scene . 'SR7.PMH??={};'
			. "SR7.PMH[{$id}]={cn:100,state:false,fn:function(){var p=SR7.PMH[{$id}];"
			. "if(window._tpt!==undefined&&_tpt.prepareModuleHeight!==undefined){var S={$data};" . self::room_script( $id ) . '_tpt.prepareModuleHeight(S);p.state=true;}'
			. "else if(p.cn-->0)setTimeout(p.fn,19);}};SR7.PMH[{$id}].fn();";
	}

	/**
	 * For a full-screen module, the room its placement leaves above it (`data-sra-fho` on the wrapper, decision 0005),
	 * added to the module's own offset in the start `S`, as the delivery's loader adds it when it runs. Measured here,
	 * before the loader, so the start has its height from the first paint and does not jump. A selector named twice
	 * counts once, one the page does not have counts 0; what stands after the module in the page is not there yet.
	 *
	 * @param string $id The module's id, JSON-encoded.
	 * @return string
	 */
	private static function room_script( $id ) {
		return "var w=document.getElementById({$id}),a=w&&w.closest&&w.closest('[data-sra-fho]');"
			. "if(a&&S.size&&S.size.fullHeight){var px=0,n={};"
			. "String(S.fho||'').split(',').concat(String(a.getAttribute('data-sra-fho')).split(',')).forEach(function(q){"
			. 'q=q.trim();if(!q||n[q])return;n[q]=1;'
			. 'if(/^-?[0-9.]+(px)?$/.test(q))px+=parseFloat(q);'
			. 'else if(/^-?[0-9.]+%$/.test(q))px+=innerHeight*parseFloat(q)/100;'
			. 'else try{[].forEach.call(document.querySelectorAll(q),function(e){if(!w.contains(e))px+=e.offsetHeight;});}catch(e){}'
			. '});S.fho=String(Math.round(px));}';
	}

	/**
	 * The env values the delivery's head script sets, rebuilt from data.
	 *
	 * @param array $start A parsed start.
	 * @return string
	 */
	private static function env_script( array $start ) {
		$env = $start['env'];
		return self::MARK . 'window._tpt??={};window.SR7??={};SR7.F??={};SR7.G??={};SR7.E??={};'
			. 'SR7.E.plugin_url??=' . wp_json_encode( $env['plugin_url'], self::JSON_FLAGS ) . ';'
			. 'SR7.G.breakPoints??=' . wp_json_encode( $env['breakPoints'], self::JSON_FLAGS ) . ';'
			. 'SR7.G.fSUVW??=' . ( $env['fSUVW'] ? 'true' : 'false' ) . ';';
	}

	/**
	 * Registers and enqueues page.js (with the env before it) and sr7.css, once.
	 *
	 * @param array $start A parsed start.
	 */
	private static function enqueue_head( array $start ) {
		if ( wp_script_is( self::PAGE_HANDLE, 'registered' ) ) {
			return;
		}
		wp_register_script( self::PAGE_HANDLE, $start['pageJs'], array(), null, false ); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion, WordPress.WP.EnqueuedResourceParameters.NotInFooter -- versioned by the delivery; it must run before the module's start script.
		wp_add_inline_script( self::PAGE_HANDLE, self::env_script( $start ), 'before' );
		wp_register_style( self::CSS_HANDLE, $start['sr7Css'], array(), null ); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.MissingVersion -- versioned by the delivery.
		wp_enqueue_script( self::PAGE_HANDLE );
		wp_enqueue_style( self::CSS_HANDLE );
	}

	/**
	 * page.js and sr7.css for this module: enqueued while the head is still to come, printed here when it has gone.
	 *
	 * @param array $start A parsed start.
	 * @return string What to print before the module.
	 */
	private static function head_inline( array $start ) {
		if ( self::$head_done ) {
			return '';
		}
		self::enqueue_head( $start );
		if ( ! did_action( 'wp_head' ) || wp_script_is( self::PAGE_HANDLE, 'done' ) ) {
			self::$head_done = wp_script_is( self::PAGE_HANDLE, 'done' );
			return '';
		}
		ob_start();
		wp_print_styles( array( self::CSS_HANDLE ) );
		wp_print_scripts( array( self::PAGE_HANDLE ) );
		self::$head_done = true;
		return (string) ob_get_clean();
	}

	/**
	 * The plain embed line, where there is no start (decision 0003, point 6).
	 *
	 * @param string $route `i` for a module, `g` for a page.
	 * @param string $key   The key.
	 * @return string
	 */
	private static function plain_line( $route, $key ) {
		return wp_get_script_tag(
			array(
				'src'   => Config::delivery_url() . '/' . $route . '/' . rawurlencode( $key ) . '/embed.js',
				'async' => true,
				'id'    => 'sranywhere-line-' . $key,
			)
		);
	}

	/**
	 * The wrapper, with the alignment, the anchor and the full-screen offset (decision 0005).
	 *
	 * @param string $inner       The inner html.
	 * @param array  $attributes  The block's or the shortcode's attributes.
	 * @param bool   $full_screen Whether the module fills the window's height.
	 * @param bool   $is_block    Whether WordPress renders it as a block.
	 * @return string
	 */
	private static function wrap( $inner, array $attributes, $full_screen, $is_block ) {
		$extra = array( 'class' => 'sr-anywhere-module' );
		if ( $full_screen ) {
			$offset = array();
			$header = isset( $attributes['fsOffset'] ) ? self::selector( (string) $attributes['fsOffset'] ) : '';
			if ( '' !== $header ) {
				$offset[] = $header;
			}
			if ( is_admin_bar_showing() ) {
				$offset[] = '#wpadminbar';
			}
			if ( $offset ) {
				$extra['data-sra-fho'] = implode( ',', $offset );
			}
		}
		if ( $is_block ) {
			return '<div ' . get_block_wrapper_attributes( $extra ) . '>' . $inner . '</div>';
		}
		// The shortcode: the same classes a block would have, so themes treat both alike.
		$class = 'wp-block-sr-anywhere-module sr-anywhere-module';
		if ( ! empty( $attributes['align'] ) && in_array( $attributes['align'], array( 'full', 'wide' ), true ) ) {
			$class .= ' align' . $attributes['align'];
		}
		$html = '<div class="' . esc_attr( $class ) . '"';
		if ( isset( $extra['data-sra-fho'] ) ) {
			$html .= ' data-sra-fho="' . esc_attr( $extra['data-sra-fho'] ) . '"';
		}
		return $html . '>' . $inner . '</div>';
	}

	/**
	 * A CSS selector from the block's "Leave room for" setting, or nothing.
	 *
	 * @param string $selector What the person typed.
	 * @return string
	 */
	private static function selector( $selector ) {
		$selector = trim( $selector );
		return 1 === preg_match( '/^[A-Za-z0-9 .#_\-\[\]="\':>,()*]{1,200}$/', $selector ) ? $selector : '';
	}
}