// sandbox-frame.js — the runtime INSIDE the member-app sandbox frame.
//
// This file is served inlined into GET /app-sandbox (memberapps.go), the page
// the chat shell embeds as <iframe sandbox="allow-scripts"> to run a
// member-built app. Everything in this document is untrusted-by-construction:
// the frame has an OPAQUE origin (no cookies, storage, or parent DOM) and a
// CSP with no network at all, so the only doorway in or out is the
// postMessage bridge to the host page — and the host validates every message
// (web/static/sandbox.js). This runtime is the trusted half *inside* the
// cage: it receives the app's source + manifest + folded state over the
// bridge, evals the app against a shim of the mini-app SDK, folds events,
// renders into this document, and reports state + emits back out.
//
// Kept importable by Node (guarded boot, pure helpers exported) so
// test/sandbox.test.mjs can pin the SDK copies against apps.js and exercise
// the module transform. IMPORTANT: this file must never contain the literal
// "<" + "/script" sequence — it is inlined into a script tag (see
// TestSandboxFrameInlinable).
//
// Bridge protocol (all messages are plain JSON-able objects):
//   parent → frame window: { type: "lchat-sandbox-init",
//       source, manifest, threadId, me: { uid, name },
//       theme: { vars, font, dark }, seed: { v, vUpTo, pend, chat } } + [port]
//   host → frame (port): { type: "events", batch: [{ e, meta }] }
//                        { type: "command", seq, cmd, args }
//                        { type: "ephemeral-in", event }
//                        { type: "theme", vars, font, dark }
//                        { type: "rpc-reply", seq, value }
//   frame → host (port): { type: "state", state, upTo, chat? }
//                        { type: "emit", event }
//                        { type: "schedule", seq, event, when }
//                        { type: "unschedule", seq, sid }
//                        { type: "ephemeral", event }
//                        { type: "command-reply", seq, spec }
//                        { type: "panel-open", seq, cmdSeq, spec }   (a command asking for a panel)
//                        { type: "panel-size", h }                    (panel frame → fit my content)
//                        { type: "panel-close" }                      (panel frame dismissing itself)
//                        { type: "panel-insert", text }               (panel frame → composer insert)
//                        { type: "error", message }
//
// PANEL frames: a member app's command can open a command panel (the
// transient surface above the composer — apps/README.md § Command panels).
// A render closure can't cross the bridge, so the sandbox form is
// declarative: the command calls ctx.panel({ title, data }) and the app
// declares a top-level panel(data, el, panelCtx) hook. The host mounts a
// FRESH sandboxed frame inside the real panel and initialises it with
// { panel: { data } } — this runtime then calls the hook instead of starting
// the render/fold loop. panelCtx = ctx + { close, insertText }.

// The pure text helpers from ../format.js — the SAME module the trusted apps
// use, so a member app's linkifying/formatting behaves identically. In Node
// (tests) this import resolves normally; in the browser the /app-sandbox
// handler BUNDLES format.js ahead of this file (stripping this line), so the
// names below resolve to format.js's own top-level definitions in the one
// inlined module. See memberapps.go serveAppSandbox + sandboxBundle.
import {
  tokenizeText,
  richTokens,
  blockTokens,
  firstLink,
  youtubeId,
  replySnippet,
  emojiOnlyCount,
  typingSummary,
  autoGroupTitle,
  formatBytes,
} from "./format.js";

// FMT is the exact ../format.js surface a member app may import (mirrors the
// "Allowed imports" table in docs/building-member-apps.md).
const FMT = {
  tokenizeText,
  richTokens,
  blockTokens,
  firstLink,
  youtubeId,
  replySnippet,
  emojiOnlyCount,
  typingSummary,
  autoGroupTitle,
  formatBytes,
};
export const ALLOWED_FMT = Object.keys(FMT);

// ---- SDK helper copies ----------------------------------------------------
// Verbatim copies of the collection helpers from apps.js: the sandbox SDK
// must behave identically to the in-page one so an app written against the
// guide runs the same in both worlds. Drift is pinned by test/sandbox.test.mjs
// — change these ONLY in lockstep with apps.js.

export function addItem(list, item) {
  return list.some((i) => i.id === item.id) ? list.slice() : [...list, item];
}
export function updateItem(list, id, patch) {
  return list.map((i) => (i.id === id ? { ...i, ...patch } : i));
}
export function removeItem(list, id) {
  return list.filter((i) => i.id !== id);
}

export const DONE_GRACE_MS = 6000;

export function partitionByGrace(items, doneAtOf, now, graceMs = DONE_GRACE_MS) {
  const active = [];
  const grace = [];
  const archived = [];
  for (const it of items || []) {
    const d = doneAtOf(it) || 0;
    if (!d) active.push(it);
    else if (now - d < graceMs) grace.push(it);
    else archived.push(it);
  }
  return { active, grace, archived };
}

// namespace(ns) — verbatim copy of apps.js's helper (pinned by test/sandbox.test.mjs):
// N.ev("add") → "todo.add" (event type), N.cls("item") → "todo-item" (CSS class).
export function namespace(ns) {
  const base = String(ns || "");
  return {
    ns: base,
    ev: (name) => (name != null && String(name).includes(".") ? String(name) : base + "." + name),
    cls: (name) => base + "-" + name,
  };
}

export function keyedList(el, items, opts) {
  const { key, render, rev = () => "", srev = () => "", update } = opts;
  const existing = new Map();
  for (const child of [...el.children]) {
    if (child.dataset && child.dataset.k !== undefined) existing.set(child.dataset.k, child);
  }
  let cursor = null;
  for (const item of items) {
    const k = String(key(item));
    const r = String(rev(item));
    const sr = String(srev(item));
    let node = existing.get(k);
    existing.delete(k);
    if (node && node.dataset.rev !== r) {
      const fresh = render(item);
      fresh.dataset.k = k;
      fresh.dataset.rev = r;
      fresh.dataset.srev = sr;
      node.replaceWith(fresh);
      node = fresh;
    } else if (!node) {
      node = render(item);
      node.dataset.k = k;
      node.dataset.rev = r;
      node.dataset.srev = sr;
    } else if (update && node.dataset.srev !== sr) {
      update(node, item);
      node.dataset.srev = sr;
    }
    const want = cursor ? cursor.nextSibling : el.firstChild;
    if (node !== want) el.insertBefore(node, want);
    cursor = node;
  }
  for (const gone of existing.values()) gone.remove();
}

// The exact import surface a member app may use — the sandbox mirror of the
// "Allowed imports" table in docs/building-member-apps.md. (No format.js in
// the sandbox yet; the runtime must stay a single self-contained script.)
export const ALLOWED_IMPORTS = [
  "defineApp",
  "namespace",
  "addItem",
  "updateItem",
  "removeItem",
  "partitionByGrace",
  "DONE_GRACE_MS",
  "keyedList",
];

// ---- module transform -----------------------------------------------------
// A member app is written as a plain ES module (same shape as a trusted app),
// but the frame can't load modules from anywhere (CSP: no network, no blob:).
// So we rewrite the module's static surface into a Function body: the one
// legal import becomes a destructure of the injected SDK object, export
// keywords are stripped (registration happens via the defineApp call, not the
// export), and anything else import/export-shaped is rejected. The rewrite is
// reliable because the authoring contract pins the surface: named imports
// from "../apps.js" only (docs/building-member-apps.md, hard constraints).

// stripCode removes comments and string/template contents so token scans
// don't trip on prose ("never call import()"). Best-effort, scan-only — the
// output is never executed.
export function stripCode(code) {
  let out = "";
  let i = 0;
  const n = code.length;
  while (i < n) {
    const c = code[i];
    const c2 = code[i + 1];
    if (c === "/" && c2 === "/") {
      while (i < n && code[i] !== "\n") i++;
      continue;
    }
    if (c === "/" && c2 === "*") {
      i += 2;
      while (i < n && !(code[i] === "*" && code[i + 1] === "/")) i++;
      i += 2;
      continue;
    }
    if (c === '"' || c === "'" || c === "`") {
      const q = c;
      i++;
      while (i < n && code[i] !== q) {
        if (code[i] === "\\") i++;
        i++;
      }
      i++;
      out += q + q;
      continue;
    }
    out += c;
    i++;
  }
  return out;
}

// rewriteImport turns `import { a, b as c } from "…"` into a destructure of
// the injected object `objName`, validating each name against `allowed`.
function rewriteImport(names, allowed, objName) {
  const bindings = [];
  for (const part of names.split(",")) {
    const p = part.trim();
    if (!p) continue;
    const m = /^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/.exec(p);
    if (!m) throw new Error(`unsupported import binding: "${p}"`);
    if (!allowed.includes(m[1])) {
      throw new Error(`"${m[1]}" is not an allowed import — allowed: ${allowed.join(", ")}`);
    }
    bindings.push(m[2] ? `${m[1]}: ${m[2]}` : m[1]);
  }
  return `const { ${bindings.join(", ")} } = ${objName};`;
}

// transformModuleSource rewrites a member-app ES module into a strict-mode
// Function body that takes the SDK as `__sdk` and the format helpers as
// `__fmt`. Throws with a human-readable message on anything outside the
// authoring contract.
export function transformModuleSource(src) {
  if (typeof src !== "string" || !src.trim()) throw new Error("empty app source");
  let out = src;

  // The two legal import sources: named bindings from "../apps.js" (the SDK)
  // and "../format.js" (the pure text helpers). Rename support:
  // `addItem as add` → `addItem: add`.
  out = out.replace(
    /import\s*\{([^}]*)\}\s*from\s*(["'])(?:\.\.\/|\/static\/)apps\.js\2\s*;?/g,
    (_, names) => rewriteImport(names, ALLOWED_IMPORTS, "__sdk"),
  );
  out = out.replace(
    /import\s*\{([^}]*)\}\s*from\s*(["'])(?:\.\.\/|\/static\/)format\.js\2\s*;?/g,
    (_, names) => rewriteImport(names, ALLOWED_FMT, "__fmt"),
  );

  // Exports: strip the keyword (declarations stay), neutralise `default`,
  // drop bare re-export lists of already-declared names.
  out = out.replace(/\bexport\s+default\s+/g, "const __defaultExport = ");
  out = out.replace(/\bexport\s+(?=(?:const|let|var|function|class|async)\b)/g, "");
  out = out.replace(/^\s*export\s*\{[^}]*\}\s*;?\s*$/gm, "");

  // Anything import/export-shaped that survived is outside the contract.
  const stripped = stripCode(out);
  if (/(^|[^.\w$])import\b/.test(stripped)) {
    throw new Error('imports are allowed only from "../apps.js" and "../format.js"');
  }
  if (/(^|[^.\w$])export\b/.test(stripped)) {
    throw new Error("unsupported export form");
  }
  return '"use strict";\n' + out;
}

// makeReducer — same contract as apps.js: seed initialState on first fold,
// dispatch by type, unknown types fall through unchanged.
export function makeSandboxReducer(events, initialState) {
  const seed = typeof initialState === "function" ? initialState : () => initialState || {};
  return (state, event, meta) => {
    const s = state === undefined ? seed() : state;
    const handler = events && events[event.type];
    return handler ? handler(s, event, meta || {}) : s;
  };
}

// evalMemberApp runs the transformed module against a defineApp-capturing SDK
// and returns the app spec. Pure of DOM (render isn't called), so Node tests
// can exercise real generated apps end-to-end.
export function evalMemberApp(source, expectedName) {
  let captured = null;
  const sdk = {
    namespace,
    addItem,
    updateItem,
    removeItem,
    partitionByGrace,
    DONE_GRACE_MS,
    keyedList,
    defineApp(spec) {
      if (captured) throw new Error("defineApp called more than once");
      if (!spec || typeof spec !== "object") throw new Error("defineApp needs a spec object");
      captured = { ...spec };
      // Mirror apps.js: namespace defaults to name, and app.ns is the resolver.
      captured.namespace = captured.namespace || captured.name;
      captured.ns = namespace(captured.namespace);
      captured.types = Object.keys(captured.events || {});
      captured.reduce = makeSandboxReducer(captured.events || {}, captured.initialState);
      return captured;
    },
  };
  const body = transformModuleSource(source);
  new Function("__sdk", "__fmt", body)(sdk, FMT);
  if (!captured) throw new Error("the app never called defineApp");
  if (expectedName && captured.name !== expectedName) {
    throw new Error(`app name "${captured.name}" does not match its manifest ("${expectedName}")`);
  }
  captured.commands = normalizeCommands(captured.commands);
  return captured;
}

// manifestOf derives the deploy manifest from an evaluated app spec — the
// authoritative extractor App Studio uses (it runs the real defineApp in the
// cage, so name/title/glyph/types/commands/chat/places are exactly what the
// app declares). Mirrors the shape validateManifest (sandbox.js) checks.
export function manifestOf(spec) {
  const m = {
    v: 1,
    name: spec.name,
    title: spec.title,
    glyph: spec.glyph,
    // Optional native chrome: an SF Symbols name iOS/Mac render for the app
    // (docs/icons.md) — declared beside the emoji glyph, exactly like a
    // built-in. The emoji stays the universal identity; a bad name just
    // falls back to it. (Brand `mark`s are NOT a member-app field: naming a
    // vendored asset would wear another product's logo.)
    ...(typeof spec.symbol === "string" ? { symbol: spec.symbol } : {}),
    types: spec.types || [],
    commands: Object.entries(spec.commands || {}).map(([name, c]) => ({
      name,
      desc: (c && c.desc) || "",
      args: (c && c.args) || "",
    })),
    chat: typeof spec.chatMessage === "function",
    // places: WHERE copies of the app can live — unlike `chat` it can't be
    // derived from code shape; it's a trust decision the author declares
    // explicitly in the source's defineApp. A places-first source passes
    // through verbatim (the deploy validator holds it to the member-app
    // rules, "you" included); a source written in the legacy vocabulary
    // (groupCapable/spaceCapable booleans) normalizes into it — so a minted
    // manifest always speaks the current vocabulary, whichever generation
    // the source was written in.
    places: Array.isArray(spec.places) ? spec.places : ["you", ...(spec.groupCapable ? ["chat"] : []), ...(spec.spaceCapable ? ["space"] : [])],
    // listed: false — the implicitly-placed shape (declared, like places):
    // the app stays out of the catalogues; with places ["space"] its one
    // copy is the space's, used on first command with no add gesture (the
    // /gif shape — docs/space-apps.md).
    ...(spec.listed === false ? { listed: false } : {}),
    ...(spec.placeNote ? { placeNote: String(spec.placeNote).slice(0, 120) } : {}),
    // quiet: same idea — a behavior decision the author declares explicitly
    // (defineApp({ quiet: true, ... })), not derivable from code shape.
    quiet: !!spec.quiet,
  };
  // defaultCommand: the command plain (non-slash) text runs in the app's Chat
  // view (like To-do's /add). Host-side routing hint — validateManifest checks it
  // names a real command.
  if (typeof spec.defaultCommand === "string" && spec.defaultCommand) {
    m.defaultCommand = spec.defaultCommand;
  }
  return m;
}

// normalizeCommands mirrors apps.js: a bare handler function and the richer
// { run, desc, args } form both become { run, desc, args }.
export function normalizeCommands(cmds) {
  const out = {};
  for (const [name, v] of Object.entries(cmds || {})) {
    if (typeof v === "function") out[name] = { run: v, desc: "", args: "" };
    else if (v && typeof v.run === "function") out[name] = { run: v.run, desc: v.desc || "", args: v.args || "" };
  }
  return out;
}

// ---- frame boot -----------------------------------------------------------

// How many companion chat lines the frame keeps + reports, and the max length
// of each. Bounds the snapshot (like the ~100-message chat window) so a large
// or hostile projection can't blow the server's thread_state cap; older lines
// drop off. Kept in step with sanitizeChat's caps in sandbox.js.
const CHAT_CAP = 200;
const CHAT_TEXT_CAP = 400;

// isSubmitTrigger — would activating this element START native form submission?
// True for a submit button, an image input, or a TYPELESS <button> (which
// defaults to type="submit"), when it belongs to a form. Pure + exported so
// it's unit-tested; bootFrame's click handler uses it to catch the trigger
// BEFORE the browser runs the sandbox-blocked, error-logging submission
// algorithm (see the shim in bootFrame for why the trigger, not the submit
// event, is what must be cancelled).
export function isSubmitTrigger(tagName, typeAttr, hasForm) {
  if (!hasForm) return false;
  const tag = String(tagName || "").toUpperCase();
  const t = String(typeAttr || "").toLowerCase();
  if (tag === "INPUT") return t === "submit" || t === "image";
  if (tag === "BUTTON") return t === "" || t === "submit"; // typeless button = submit
  return false;
}

// isEnterSubmit — would this keydown IMPLICITLY submit a form? Enter, without
// Shift, not mid-IME-composition, in a single-line <input> that belongs to a
// form. (Textareas keep Enter for newlines; buttons/other targets are ignored.)
export function isEnterSubmit(key, shiftKey, isComposing, tagName, hasForm) {
  return key === "Enter" && !shiftKey && !isComposing && !!hasForm
    && String(tagName || "").toUpperCase() === "INPUT";
}

function bootFrame() {
  let port = null;
  let spec = null;
  let state; // undefined until first fold / non-null seed
  let maxFolded = 0;
  const foldedIds = new Set();
  let cleanups = [];
  let rpcSeq = 0;
  const rpcWaiters = new Map();
  let root = null;
  // Companion: each event projected via the app's chatMessage into a chat line
  // { mid, ts, text, action }. Seeded from the snapshot, appended on fold.
  let chatLines = [];

  const uuid = () =>
    crypto.randomUUID
      ? crypto.randomUUID()
      : "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
          const r = (Math.random() * 16) | 0;
          return (c === "x" ? r : (r & 0x3) | 0x8).toString(16);
        });

  const send = (msg) => {
    if (!port) return;
    try {
      port.postMessage(msg);
    } catch {
      // Not structured-cloneable — report rather than die silently.
      try {
        port.postMessage({ type: "error", message: "app produced a non-serializable message" });
      } catch {}
    }
  };

  const rpc = (type, fields) => {
    const seq = ++rpcSeq;
    return new Promise((resolve) => {
      rpcWaiters.set(seq, resolve);
      send({ type, seq, ...fields });
      // The host answers quickly or not at all (e.g. it was torn down);
      // resolve null so an app awaiting a schedule can degrade gracefully.
      setTimeout(() => {
        if (rpcWaiters.delete(seq)) resolve(null);
      }, 15000);
    });
  };

  const showFatal = (msg) => {
    document.body.textContent = "";
    const p = document.createElement("p");
    p.style.cssText = "padding:16px;font:13px/1.5 system-ui,sans-serif;color:var(--muted,#888)";
    p.textContent = `This app hit an error: ${msg}`;
    document.body.appendChild(p);
    send({ type: "error", message: String(msg) });
  };

  const applyTheme = (theme) => {
    if (!theme) return;
    const de = document.documentElement;
    for (const [k, v] of Object.entries(theme.vars || {})) {
      if (/^--[\w-]+$/.test(k) && typeof v === "string") de.style.setProperty(k, v);
    }
    // color-scheme on <html> (like the shell) so the light-dark() in the vars
    // resolves to the right side. Background + text colour come from the base
    // `html, body { background: var(--panel); color: var(--ink) }` rule the frame
    // is served with (--panel = the chat panel it's embedded in), so forwarding
    // the vars above is all that's needed to match the surrounding surface.
    de.style.colorScheme = theme.dark ? "dark" : "light";
    if (typeof theme.font === "string" && theme.font) document.body.style.font = theme.font;
  };

  const ctx = {
    threadId: null,
    me: null,
    meName: null,
    id: uuid,
    // Namespace resolvers bound to this app (see apps.js makeCtx). `spec` is
    // assigned during init, so read it lazily; before then a bare name is
    // returned so an early call never throws.
    ev: (name) => (spec && spec.ns ? spec.ns.ev(name) : String(name)),
    cls: (name) => (spec && spec.ns ? spec.ns.cls(name) : String(name)),
    getState: () => state,
    emit(event) {
      send({ type: "emit", event });
      return Promise.resolve(true);
    },
    schedule(event, when) {
      return rpc("schedule", { event, when });
    },
    unschedule(sid) {
      return rpc("unschedule", { sid: String(sid || "") });
    },
    emitEphemeral(event) {
      send({ type: "ephemeral", event });
    },
    interval(fn, ms) {
      const t = setInterval(fn, ms);
      cleanups.push(() => clearInterval(t));
      return t;
    },
    onCleanup(fn) {
      cleanups.push(fn);
    },
    open() {}, // navigation is the host's business; a sandboxed app can't move you
  };

  const runCleanups = () => {
    const fns = cleanups;
    cleanups = [];
    for (const fn of fns) {
      try {
        fn();
      } catch {}
    }
  };

  const draw = () => {
    if (!spec || !root) return;
    runCleanups();
    if (!spec.incremental) root.textContent = "";
    if (!spec.render) return;
    try {
      spec.render(state, root, ctx);
    } catch (e) {
      console.error("member app render failed:", e);
      root.textContent = "";
      const p = document.createElement("p");
      p.style.cssText = "padding:16px;font:13px/1.5 system-ui,sans-serif;color:var(--muted,#888)";
      p.textContent = `This app's view hit an error (${(e && e.message) || e}).`;
      root.appendChild(p);
    }
  };

  // Project one event into a companion chat line via the app's chatMessage,
  // if it opted in. Pure of state; a throw is swallowed (a bad projection must
  // not break the fold).
  const project = (e, id, meta) => {
    if (id == null || !spec || typeof spec.chatMessage !== "function") return;
    let line = null;
    try {
      line = spec.chatMessage(e);
    } catch {}
    const text = typeof line === "string" ? line : line && line.text;
    if (!text) return;
    chatLines.push({
      mid: id,
      ts: (e && e.ts) || (meta && meta.ts) || 0,
      text: String(text).slice(0, CHAT_TEXT_CAP),
      action: typeof line === "object" && !!line.action,
    });
    if (chatLines.length > CHAT_CAP) chatLines = chatLines.slice(chatLines.length - CHAT_CAP);
  };

  // Fold one wire event. Reducer throws must never take the frame down — a
  // hostile/malformed event is a legal input that folds to a no-op.
  const fold = (e, meta) => {
    const id = meta && meta.id;
    if (id != null) {
      if (foldedIds.has(id)) return;
      foldedIds.add(id);
      if (id > maxFolded) maxFolded = id;
    }
    try {
      state = spec.reduce(state, e, meta || {});
    } catch (err) {
      console.error("member app reducer failed:", err);
    }
    project(e, id, meta);
  };

  const reportState = () => {
    // JSON-normalize: snapshots are JSON on the host side too, so anything
    // non-JSON in state would diverge between live and reloaded sessions.
    let snap = null;
    try {
      snap = JSON.parse(JSON.stringify(state === undefined ? null : state));
    } catch {
      send({ type: "error", message: "app state is not serializable" });
      return;
    }
    const msg = { type: "state", state: snap, upTo: maxFolded };
    // A companion app also reports its projected chat lines; the host folds
    // them into the thread's Chat view (idempotent by mid).
    if (spec && typeof spec.chatMessage === "function") msg.chat = chatLines;
    send(msg);
  };

  // Run a slash command's handler (untrusted) in here, where it belongs. Its
  // ctx.emit/schedule bridge out exactly like the surface's; ctx.reply is
  // captured and returned to the host, which shows it as the private "only
  // visible to you" confirmation where the user typed. Emits happen through the
  // normal path, so a command that fires before we reply is still ordered.
  const runCommand = async (m) => {
    const handler = spec && spec.commands && spec.commands[m.cmd];
    let replySpec = null;
    if (handler && typeof handler.run === "function") {
      const cctx = Object.assign({}, ctx, {
        reply: (r) => {
          if (r && typeof r === "object") {
            replySpec = { text: String(r.text || ""), short: r.short != null ? String(r.short) : undefined };
          }
        },
        // Open a command panel (declarative — see the header). The host mounts
        // a fresh panel frame that runs the app's panel(data, el, panelCtx)
        // hook; everything crossing the bridge is plain JSON. Resolves whether
        // a panel actually opened (false: no hook, no chat surface, rejected).
        panel: (p) => {
          if (!spec || typeof spec.panel !== "function") {
            console.warn("ctx.panel needs a top-level panel(data, el, panelCtx) hook in the sandbox");
            return Promise.resolve(false);
          }
          const c = p && typeof p === "object" ? p : {};
          // Unset fields are OMITTED (an `undefined` property would trip the
          // host's whole-object JSON validation).
          const out = { data: c.data === undefined ? null : c.data };
          if (c.title !== undefined) out.title = c.title;
          if (c.position !== undefined) out.position = c.position;
          if (c.animate !== undefined) out.animate = c.animate;
          return rpc("panel-open", { cmdSeq: m.seq, spec: out }).then((v) => !!v);
        },
      });
      try {
        await handler.run(String(m.args || ""), cctx);
      } catch (e) {
        console.error("member command failed:", e);
      }
    }
    send({ type: "command-reply", seq: m.seq, spec: replySpec });
  };

  const onPortMessage = (ev) => {
    const m = ev.data;
    if (!m || typeof m !== "object") return;
    if (m.type === "events" && Array.isArray(m.batch)) {
      for (const it of m.batch) if (it && it.e) fold(it.e, it.meta);
      reportState();
      draw();
    } else if (m.type === "command") {
      runCommand(m);
    } else if (m.type === "ephemeral-in") {
      if (spec && typeof spec.ephemeral === "function") {
        try {
          spec.ephemeral(m.event, ctx);
        } catch {}
      }
    } else if (m.type === "theme") {
      applyTheme(m);
    } else if (m.type === "rpc-reply") {
      const w = rpcWaiters.get(m.seq);
      if (w) {
        rpcWaiters.delete(m.seq);
        w(m.value === undefined ? null : m.value);
      }
    }
  };

  const onInit = (ev) => {
    // Only the embedding page may initialise us. Its origin is the real
    // instance origin — a sibling sandbox frame (opaque origin, "null") that
    // grabbed a window reference can't pass this check.
    if (ev.source !== window.parent || ev.origin === "null" || ev.origin === "") return;
    const m = ev.data;
    if (!m || m.type !== "lchat-sandbox-init" || port) return;
    if (!ev.ports || !ev.ports[0]) return;
    window.removeEventListener("message", onInit);
    port = ev.ports[0];
    port.onmessage = onPortMessage;

    // Extract mode: eval the source only to report its manifest (App Studio's
    // "Check" — deriving name/title/glyph/types/commands/chat from the real
    // defineApp call, in the cage). No render, no seed, no fold.
    if (m.extract) {
      try {
        const s = evalMemberApp(m.source);
        port.postMessage({ type: "extracted", manifest: manifestOf(s) });
      } catch (e) {
        port.postMessage({ type: "extracted", error: (e && e.message) || String(e) });
      }
      return;
    }

    ctx.threadId = m.threadId || null;
    ctx.me = (m.me && m.me.uid) || null;
    ctx.meName = (m.me && m.me.name) || "";
    applyTheme(m.theme);

    root = document.createElement("div");
    root.id = "app-root";
    root.style.cssText = "height:100%;overflow:auto;box-sizing:border-box";
    document.body.appendChild(root);

    try {
      spec = evalMemberApp(m.source, m.manifest && m.manifest.name);
    } catch (e) {
      showFatal((e && e.message) || String(e));
      return;
    }
    if (spec.styles) {
      const st = document.createElement("style");
      st.textContent = String(spec.styles);
      document.head.appendChild(st);
    }
    // Hooks that still don't work in the sandbox — say so where the author can
    // see it. (commands, chatMessage, and ../format.js imports ARE supported.)
    for (const k of ["messageAction", "renderEvent", "notify", "preview", "unread", "hostEvents"]) {
      if (spec[k]) console.warn(`member app "${spec.name}": "${k}" is not available in the sandbox — ignored`);
    }

    // Seed: the host's snapshot of our own last report, plus the queued
    // events it accumulated while no frame was alive, plus the companion chat
    // lines projected before the last compaction.
    const seed = m.seed || {};
    if (seed.v !== null && seed.v !== undefined) {
      state = seed.v;
      maxFolded = seed.vUpTo || 0;
    }
    chatLines = Array.isArray(seed.chat) ? seed.chat.slice(-CHAT_CAP) : [];
    for (const it of seed.pend || []) if (it && it.e) fold(it.e, it.meta);

    // PANEL mode: this frame IS a command panel's body. Run the app's panel
    // hook against the seeded state and keep the host sized to the content —
    // no render/fold loop and no state reports (the app-thread's own frame
    // owns those; the host ignores a panel frame's "state" anyway).
    if (m.panel) {
      if (state === undefined) {
        try {
          state = spec.reduce(undefined, { type: "@@lchat/init" }, {});
        } catch {
          state = null;
        }
      }
      if (typeof spec.panel !== "function") {
        showFatal("this app has no panel(data, el, panelCtx) hook");
        return;
      }
      const pctx = Object.assign({}, ctx, {
        close: () => send({ type: "panel-close" }),
        insertText: (t) => send({ type: "panel-insert", text: String(t == null ? "" : t).slice(0, 2000) }),
      });
      try {
        spec.panel(m.panel.data === undefined ? null : m.panel.data, root, pctx);
      } catch (e) {
        showFatal((e && e.message) || String(e));
        return;
      }
      const postSize = () => {
        const h = Math.max(document.body.scrollHeight, root.scrollHeight || 0);
        send({ type: "panel-size", h: Math.min(600, Math.max(24, h)) });
      };
      if (typeof ResizeObserver !== "undefined") new ResizeObserver(postSize).observe(document.body);
      postSize();
      return;
    }
    // Materialise initialState even with zero events to fold: the reducer only
    // seeds on the first fold, so a freshly-deployed app opened before any event
    // would otherwise render with state === undefined — and a render that reads
    // a state field (e.g. `state.count`, as the App Studio starter does) throws.
    // Folding a benign, unhandled event returns the seeded initialState untouched.
    if (state === undefined) {
      try {
        state = spec.reduce(undefined, { type: "@@lchat/init" }, {});
      } catch (err) {
        console.error("member app initialState failed:", err);
        state = null;
      }
    }
    reportState();
    draw();
  };

  // Make a plain <form onsubmit> work in this sandbox WITHOUT loosening it.
  // Native submission has nowhere to go (no allow-forms, and the CSP forbids
  // it), so the browser blocks it AND logs a scary "Blocked form submission …
  // 'allow-forms' is not set". Crucially, that message is emitted while the
  // submission ALGORITHM runs, and canceling the `submit` event does NOT
  // suppress it (verified) — only preventing the algorithm from STARTING does.
  // So intercept the triggers (a submit button's click, an Enter implicit
  // submit) in capture, cancel them, and re-dispatch a SCRIPTED `submit` event:
  // a scripted dispatch runs the app's onsubmit but performs no native
  // submission — so no navigation and no console error, and the sandbox stays
  // exactly as tight. Apps may use <form onsubmit> or a <button onclick>; both
  // just work.
  const fireSubmit = (form, submitter) => {
    const ev = typeof SubmitEvent === "function"
      ? new SubmitEvent("submit", { bubbles: true, cancelable: true, submitter: submitter || null })
      : new Event("submit", { bubbles: true, cancelable: true });
    form.dispatchEvent(ev);
  };
  document.addEventListener("click", (e) => {
    const b = e.target && e.target.closest && e.target.closest("button, input[type=submit], input[type=image]");
    if (!b || !isSubmitTrigger(b.tagName, b.getAttribute("type"), !!b.form)) return;
    e.preventDefault(); // stop the native submission → no console error
    // If the button handles its OWN click, don't also synthesize a submit — its
    // onclick covers it (avoids a double-fire); otherwise re-dispatch so a pure
    // submit button's form.onsubmit still runs.
    if (typeof b.onclick !== "function") fireSubmit(b.form, b);
  }, true);
  document.addEventListener("keydown", (e) => {
    if (!isEnterSubmit(e.key, e.shiftKey, e.isComposing, e.target && e.target.tagName, !!(e.target && e.target.form))) return;
    e.preventDefault();
    fireSubmit(e.target.form, null);
  }, true);
  // Backstop: cancel the navigation on any real submit that slips past the
  // triggers above (e.g. a programmatic form.requestSubmit()). This does NOT
  // suppress the console error for that path — only the trigger intercept does —
  // so it's defense in depth, not the fix.
  document.addEventListener("submit", (e) => e.preventDefault(), true);

  // The host initialises us off our iframe's `load` event (see initMount in
  // sandbox.js) — an unforgeable signal — rather than a postMessage from here,
  // so hostile app code can't fake readiness to hijack the bridge. Module
  // scripts run before the frame's load event fires, so this listener is
  // installed in time to receive that init.
  window.addEventListener("message", onInit);
}

// Boot only inside a real embedded frame — never under Node (tests import
// this module for the pure helpers above).
if (typeof window !== "undefined" && window.parent !== window) {
  bootFrame();
}