// The join page (see docs/threads-and-dms.md). An invite link is /join/<label>#<T>
// (optionally #<T>~<name> for an add-device link). The fragment is never sent to
// the server. Joining sets up the user's keypair — generated fresh for a new
// person, or unwrapped from the link for an added device — registers the public
// key in the roster, claims a device token, and stores the session.
import {
  decrypt,
  decryptBytes,
  deriveBrandingKey,
  b64urlToBytes,
  generateUserKeypair,
  deriveInvite,
  bindMac,
  wrapThreadKey,
  bytesToB64url,
} from "/static/crypto.js";
import { parseInviteFragment } from "/static/invite.js";
import { appSchemeFrom } from "/static/ui.js";
import { PREJOIN_STASH_KEY, offerPrejoin, prejoinStash, readPrejoinReturn, homeSigninURL, autoEnrolOnClaim } from "/static/prejoin.js";
import { INVITER_HINT_KEY, inviterHintStash } from "/static/invitehint.js";
import { launchEnrol } from "/static/backup.js";

const SESSION_KEY = "lchat_session";
const card = document.getElementById("card");
const loader = document.getElementById("app-loading");

// Which app scheme "Open in the app" fires — ui.js's appSchemeFrom (the
// dev-alt override rides localStorage.lchat_app_scheme; see that helper).
function appScheme() {
  try {
    return appSchemeFrom(localStorage.getItem("lchat_app_scheme") || "");
  } catch {
    return "elevenmessenger"; // no storage — the shipped app
  }
}

// The ONE loading state: the same full-screen loader the app uses. It covers
// the page until a card has real content, and again while a claim is in
// flight — the card and the loader are never shown together.
function showLoader() {
  if (loader) loader.classList.remove("hidden");
  card.classList.add("hidden");
}
function showCard() {
  if (loader) loader.classList.add("hidden");
  card.classList.remove("hidden");
}
const isStandalone =
  window.matchMedia("(display-mode: standalone)").matches || window.navigator.standalone === true;

// The pre-join sign-in round trip returns here as /join/<label>?su=<nonce>
// with NO fragment — the invite secret parked in this origin's localStorage
// before leaving (it never travels to the home origin). Verify the nonce,
// recover the fragment (restoring it to the URL so "Open in the app" still
// hands over a complete link), and scrub the marker.
const prejoin = (() => {
  let stored = "";
  try { stored = localStorage.getItem(PREJOIN_STASH_KEY) || ""; } catch {}
  const r = readPrejoinReturn({ search: location.search, storedJSON: stored, now: Date.now() });
  if (r.signedUp) {
    try { localStorage.removeItem(PREJOIN_STASH_KEY); } catch {}
    try {
      if (!location.hash && r.frag) history.replaceState(null, "", location.pathname + "#" + r.frag);
    } catch {}
  }
  return r;
})();
const { T, name: fragName, b: fragB } = parseInviteFragment(location.hash.slice(1) || prejoin.frag);

// ?src=home marks a link opened from the person's Eleven sign-in page (the
// create-a-space flow). Two jobs, neither of them access: it stands the
// signup-first lead card down (they signed in one tap ago — offerPrejoin), and
// it's remembered on this origin so the setup conversation's key step can say
// "add to your account" instead of pitching a sign-in from scratch.
const fromHome = new URLSearchParams(location.search).get("src") === "home";
if (fromHome) {
  try { localStorage.setItem("lchat_from_home", "1"); } catch { /* storage denied: the generic copy shows */ }
}

// Single-fire guard for the claim: whatever path calls it (button, double tap,
// Enter), only the first attempt proceeds; the rest are ignored.
let claimStarted = false;
function onceOnly(fn) {
  return (...a) => {
    if (claimStarted) return;
    claimStarted = true;
    return fn(...a);
  };
}

init();

function init() {
  // Already installed? The link in this URL is likely spent — go to the app,
  // which signs in via paste-to-join.
  if (isStandalone && !window.__lchatEmbed) return location.replace("/");
  if (!T) return showError("This link is missing its secret.", { signin: true });
  start();
}

// The claim secret derived from T (proves knowledge of the invite secret when
// claiming/adopting). Set once in start(); read by finish()/adoptExisting().
let inviteClaimSecret = "";
// The key-transparency binding key derived from T (#573): the joiner MACs its
// published public key under it so the inviter (a T-holder) can verify the
// roster key wasn't substituted. Set in start(), read by finish().
let inviteBindKey = "";
// The inviter's display name from the sealed payload (#1436), stashed at claim
// time so the app labels them before the instance key arrives. Set in start().
let inviterFrom = "";

// Whether this instance has a branding photo. Fetched in start() and shown on
// the onboarding cards in place of the generic emoji. On a sealed instance
// (docs/no-plaintext.md) the photo is ciphertext: serverPhotoURL becomes a
// decrypted blob: URL when the link carries the branding key, else the photo
// (and the readable name/description) simply doesn't show — the link still
// claims fine. See docs/onboarding-and-home-server.md.
let serverHasAvatar = false;
let serverAvatarAlt = "";
let serverPhotoURL = "/api/server-avatar";
// The sealed branding name, when this link's fragment can open it — the lead
// card's h1 was server-baked with the generic fallback and needs the real name.
let brandingName = "";

async function start() {
  let id, wrapKey, info;
  try {
    const derived = await deriveInvite(T);
    id = derived.id;
    wrapKey = derived.wrapKey;
    inviteClaimSecret = derived.claimSecret;
    inviteBindKey = derived.bindKey;
    info = await (await fetch(`/api/key-invite/${encodeURIComponent(id)}`)).json();
  } catch {
    return showError("Couldn't reach the server. Try again.");
  }
  if (!info.ok) {
    // A dead link in an existing member's hands is just a stale bookmark —
    // they're already in, so go to the chat instead of an error card telling
    // them to ask for an invite they don't need. liveSession (not a raw
    // localStorage read) so a token from a reset instance still falls through
    // to the honest error. Embed keeps the error: the native add-chat webview
    // owns navigation, and its shell expects a join, not a redirect.
    const existing = window.__lchatEmbed ? null : await liveSession();
    if (existing) return location.replace("/");
    return showError("This invite has been used or is no longer valid. Ask for a new one.", { signin: true });
  }

  // The space's description rides on the invite lookup (holders of a valid link
  // only — it's never on the public read), so the welcome card can say what
  // this place is before the joiner holds any key.
  let spaceDesc = typeof info.description === "string" ? info.description : "";
  // A cohort invite names the access level the joiner lands in (plaintext by
  // design, like the description — served to link-holders only).
  cohortName = typeof info.tier_name === "string" ? info.tier_name : "";

  // Note whether this instance has a branding photo (a public flag), so the
  // onboarding cards below can show it instead of the placeholder emoji.
  let groupInfo = {};
  try {
    groupInfo = await (await fetch("/api/group")).json();
    serverHasAvatar = !!groupInfo.avatar;
    serverAvatarAlt = groupInfo.avatar_alt || "";
  } catch {}

  // Sealed branding: this link's fragment carries the branding key, so open
  // the blob and render the real name/description/photo in place of the
  // defaults. A link without the key (minted before sealing) still claims —
  // the card just stays generic. Decrypt failures are treated the same way.
  if (info.branding_blob && info.branding_salt && fragB) {
    try {
      const bKey = await deriveBrandingKey(fragB, info.branding_salt);
      const branding = await decrypt(bKey, info.branding_blob);
      if (branding.name) {
        brandingName = branding.name;
        document.title = branding.name;
        // The h1 was server-baked with the generic fallback (the server can't
        // read the sealed name); the standard join card never re-sets it, so
        // fill it here. The device/adopt/admin kinds overwrite it later.
        const h1 = document.querySelector("#welcome-title");
        if (h1) h1.textContent = `You're invited to ${branding.name}`;
      }
      if (branding.description) spaceDesc = branding.description;
      serverAvatarAlt = branding.avatar_alt || serverAvatarAlt;
      // Post-claim, the app bootstraps the branding key from here (it also
      // has the instance-key-sealed copy as a fallback). Stash it before the
      // photo work below: a failed photo decrypt must not cost the handoff.
      try { localStorage.setItem("lchat_branding_b", fragB); } catch {}
      if (serverHasAvatar && groupInfo.sealed) {
        try {
          const sealedBytes = await (await fetch("/api/server-avatar")).text();
          const photo = await decryptBytes(bKey, b64urlToBytes(sealedBytes));
          serverPhotoURL = URL.createObjectURL(new Blob([photo], { type: branding.avatar_mime || "image/jpeg" }));
        } catch {
          serverHasAvatar = false; // ciphertext isn't an image — show the placeholder
        }
      }
    } catch { /* stay generic */ }
  } else if (groupInfo.sealed && serverHasAvatar) {
    // Sealed photo but no key in this link: the ciphertext isn't an image.
    serverHasAvatar = false;
  }

  // Everything below only *decides* what continuing means for this link — the
  // claim itself waits for an explicit choice on the welcome card. Claiming on
  // page-load burned the one-time secret in whatever context rendered the link
  // first (a hidden webview, a second tab) — see docs/onboarding-and-home-server.md.
  let payload = null;
  if (info.wrapped) {
    try {
      payload = await decrypt(wrapKey, info.wrapped);
    } catch {
      return showError("Couldn't unlock this link (wrong or corrupt secret).", { signin: true });
    }
  }

  if (payload && payload.priv) {
    // Add-device link: it carries this user's keypair (and name) — signing in
    // is the only possible action, but it still waits for the click.
    return showWelcome("device", () => {
      showStatus("Signing you in…");
      finish(id, fragName || "Me", payload.pub, payload.priv);
    });
  }
  if (payload && payload.threadKey) {
    // The inviter's display name rides the sealed payload (#1436): remember it
    // so the app's first paint can label them before the instance key lands.
    inviterFrom = typeof payload.from === "string" ? payload.from.trim().slice(0, 64) : "";
    // User invite: it drops the joiner into a DM with the person who invited them.
    // In the native embed the shell owns identities (Keychain) — never adopt a
    // stray webview session; always run the fresh-person flow and hand back.
    const existing = window.__lchatEmbed ? null : await liveSession();
    if (existing && existing.token && existing.userPub && existing.userPriv) {
      // Already a member on this device → join that DM as your existing self.
      return showWelcome("adopt", () => {
        showStatus("Opening your chat…");
        adoptExisting(id, payload.threadKey, existing);
      });
    }
    // New person: chat-first — claim nameless and let Eleven's welcome
    // conversation ask the name in-chat (the inviter's suggestion rides along
    // in the pending marker). The native add-chat webview keeps the form: it
    // hands a NAMED identity straight back to the shell.
    if (window.__lchatEmbed) {
      return showWelcome(
        "join",
        () =>
          showForm(fragName, async (name) => {
            showStatus("Setting up…");
            const kp = await generateUserKeypair();
            const wrappedSelf = await wrapThreadKey(payload.threadKey, kp.publicKey);
            finish(id, name, kp.publicKey, kp.privateKey, wrappedSelf);
          }),
        spaceDesc,
      );
    }
    return showWelcome(
      "join",
      async () => {
        showStatus("Setting up…");
        const kp = await generateUserKeypair();
        const wrappedSelf = await wrapThreadKey(payload.threadKey, kp.publicKey);
        markWelcomePending(fragName);
        finish(id, "", kp.publicKey, kp.privateKey, wrappedSelf);
      },
      spaceDesc,
    );
  }

  // Setup invite (admin-granting): if already logged in, promote the existing
  // account. Otherwise, create a new admin account.
  if (info.grants_admin) {
    const existing = window.__lchatEmbed ? null : await liveSession();
    if (existing && existing.token && existing.userPub && existing.userPriv) {
      // Already a member: promote to admin on existing account.
      return showWelcome("adopt-admin", () => {
        showStatus("Promoting to admin…");
        adoptAdminExisting(id, existing);
      });
    }
    // New person becoming admin: check if this instance's setup is already complete.
    // If so, skip the "setup" flow label and just proceed normally — the app won't
    // trigger setup conversation if setup_complete is true.
    let setupNeeded = true;
    try {
      const me = await (await fetch("/api/me")).json();
      setupNeeded = !me.setup_complete;
    } catch {}
    const setupLabel = setupNeeded ? "setup" : "join";
    return showWelcome(setupLabel, async () => {
      showStatus("Setting up…");
      const kp = await generateUserKeypair();
      finish(id, "", kp.publicKey, kp.privateKey);
    });
  }

  // New person (or unknown payload shape): if already logged in, adopt this
  // invite as your existing self. Otherwise, start a new account.
  const existing = window.__lchatEmbed ? null : await liveSession();
  if (existing && existing.token && existing.userPub && existing.userPriv) {
    // Already a member: adopt this invite as your existing self (no wrapped key needed).
    return showWelcome("adopt", () => {
      showStatus("Opening your chat…");
      adoptInviteExisting(id, existing);
    });
  }
  // New person: same chat-first dance — the name is Eleven's first question,
  // not a form (native add-chat keeps its form).
  if (window.__lchatEmbed) {
    return showWelcome(
      "join",
      () =>
        showForm(fragName, async (name) => {
          showStatus("Setting up…");
          const kp = await generateUserKeypair();
          finish(id, name, kp.publicKey, kp.privateKey);
        }),
      spaceDesc,
    );
  }
  showWelcome(
    "join",
    async () => {
      showStatus("Setting up…");
      const kp = await generateUserKeypair();
      markWelcomePending(fragName);
      finish(id, "", kp.publicKey, kp.privateKey);
    },
    spaceDesc,
  );
}

// The pending marker hands the joiner to Eleven's welcome conversation on the
// app's first load (shell.js maybeStartWelcome), carrying the inviter's
// suggested name. Local-only — the name suggestion never touches the server.
// A new invite pasted into an already-open join tab changes only the URL
// fragment — a same-document navigation, so nothing re-runs and the old
// card (or error) just sits there. Reload to process the new link.
addEventListener("hashchange", () => location.reload());

function markWelcomePending(suggested) {
  try {
    localStorage.setItem("lchat_welcome_pending", JSON.stringify({ suggested: suggested || "" }));
  } catch {}
}

// The welcome card: the invite is inspected (a non-consuming GET) but nothing is
// claimed until a button is pressed. In the native add-chat flow (__lchatEmbed)
// the person already chose explicitly in the app, so continue straight on.
let cohortName = ""; // cohort invite: the level the joiner will be part of

// `spaceDesc` is the space's admin-set description (from the invite lookup).
function showWelcome(kind, onContinue, spaceDesc = "", opts = {}) {
  if (window.__lchatEmbed) return onContinue();
  // Signup-first: a fresh joiner leads with the sign-in door, not the app/web
  // choice (skippable; established identities and native contexts never see it).
  if (!opts.skipPrejoin && offerPrejoin({
    kind,
    homeOrigin: window.__homeOrigin || "",
    embed: !!window.__lchatEmbed,
    native: document.documentElement.classList.contains("native"),
    signedUp: prejoin.signedUp,
    fromHome, // came straight from a signed-in home page — don't ask twice
  })) {
    return showPrejoin(kind, onContinue, spaceDesc);
  }
  card.classList.add("onboard");
  card.classList.remove("status");
  card.innerHTML = "";
  showCard();
  const tpl = document.getElementById("welcome-tpl");
  card.appendChild(tpl.content.cloneNode(true));
  applyServerPhoto(card);
  if (spaceDesc) {
    const d = card.querySelector("#welcome-desc");
    d.textContent = spaceDesc.slice(0, 600);
    d.classList.remove("hidden");
  }
  if (cohortName && kind !== "device") {
    // The cohort line sits under the subtitle: arriving somewhere and being
    // told which circle you're joining is half the welcome.
    const c = document.createElement("p");
    c.className = "sub";
    c.textContent = `You'll be part of ${cohortName}.`.slice(0, 120);
    const sub = card.querySelector("#welcome-sub");
    if (sub) sub.after(c);
  }
  // Back from the pre-join sign-in: the browser-only caveat is no longer true —
  // their access rides their account (finish() saves the session to it).
  if (prejoin.signedUp) {
    const cav = card.querySelector("#welcome-caveat");
    if (cav) cav.textContent =
      "Your access will be saved to your Eleven account — you can get back in from any device.";
  }
  if (kind === "device") {
    // document.title carries the substituted group name.
    card.querySelector("#welcome-title").textContent = `Sign in to ${document.title} on this device`;
    card.querySelector("#welcome-sub").textContent = "This link signs this device in as you.";
    card.querySelector("#welcome-caveat").remove();
    card.querySelector("#welcome-web").textContent = "Sign in here in the browser";
  } else if (kind === "adopt") {
    const groupName = document.title.replace("You're invited to ", "");
    card.querySelector("#welcome-title").textContent = `You're already in ${groupName}`;
    card.querySelector("#welcome-sub").textContent =
      "Continue to open the new conversation on this device.";
    card.querySelector("#welcome-caveat").remove();
    card.querySelector("#welcome-web").textContent = "Continue";
  } else if (kind === "adopt-admin") {
    card.querySelector("#welcome-title").textContent = "Become admin";
    card.querySelector("#welcome-sub").textContent =
      "You're already a member on this device. Continue to accept the admin role.";
    card.querySelector("#welcome-caveat").remove();
    card.querySelector("#welcome-web").textContent = "Accept";
  } else if (kind === "setup") {
    card.querySelector("#welcome-title").textContent = "Welcome to your new space";
    card.querySelector("#welcome-sub").textContent =
      "This one-time link makes you its administrator. Continue, and we'll set things up together.";
    card.querySelector("#welcome-caveat").remove();
    card.querySelector("#welcome-web").textContent = "Let's get started";
  }
  // "Open in the app" hands the full link — fragment included — to the installed
  // app via its scheme; the scheme URL never reaches any server. There's no way
  // to detect the app from here: if nothing claims the scheme this is a no-op
  // and the other buttons stand. Inside the Mac app's own webview it's noise.
  const appBtn = card.querySelector("#welcome-app");
  if (document.documentElement.classList.contains("native")) {
    appBtn.closest(".row").remove();
  } else {
    appBtn.onclick = () => {
      location.href = appScheme() + "://add?url=" + encodeURIComponent(location.href);
    };
  }
  // "Get the app" is per-instance config (LCHAT_APP_STORE_URL); hidden until set.
  const storeURL = tpl.dataset.storeUrl || "";
  const storeBtn = card.querySelector("#welcome-store");
  if (storeURL) storeBtn.onclick = () => window.open(storeURL, "_blank", "noopener");
  else storeBtn.closest(".row").remove();
  const webBtn = card.querySelector("#welcome-web");
  const go = onceOnly(onContinue);
  webBtn.onclick = () => {
    webBtn.disabled = true; // instant feedback — no dead-feeling first tap
    go();
  };
}

// The signup-first lead card: sign in with Eleven BEFORE anything is claimed.
// The tap parks the invite fragment (and a fresh nonce) on THIS origin and
// heads to the home server's doors; home returns to /join/<label>?su=<nonce>.
// Skipping falls through to the classic welcome card — zero-friction stays.
function showPrejoin(kind, onContinue, spaceDesc) {
  card.classList.add("onboard");
  card.classList.remove("status");
  card.innerHTML = "";
  showCard();
  card.appendChild(document.getElementById("prejoin-tpl").content.cloneNode(true));
  applyServerPhoto(card);
  // The h1 was server-baked with the generic fallback on sealed instances.
  if (brandingName) card.querySelector("#prejoin-title").textContent = `You're invited to ${brandingName}`;
  if (kind === "setup") {
    card.querySelector("#prejoin-title").textContent = "Welcome to your new space";
    card.querySelector("#prejoin-sub").textContent =
      "This one-time link makes you its administrator. Sign in first, and your access is saved from the start.";
  }
  if (spaceDesc) {
    const d = card.querySelector("#prejoin-desc");
    d.textContent = spaceDesc.slice(0, 600);
    d.classList.remove("hidden");
  }
  if (cohortName) {
    const c = document.createElement("p");
    c.className = "sub";
    c.textContent = `You'll be part of ${cohortName}.`.slice(0, 120);
    card.querySelector("#prejoin-sub").after(c);
  }
  card.querySelector("#prejoin-signin").onclick = () => {
    const b = new Uint8Array(16);
    crypto.getRandomValues(b);
    const nonce = bytesToB64url(b);
    try {
      localStorage.setItem(PREJOIN_STASH_KEY, prejoinStash({ frag: location.hash.slice(1), nonce, now: Date.now() }));
    } catch {
      // No storage: the fragment can't survive the round trip — fall through to
      // the classic card rather than strand the secret.
      return showWelcome(kind, onContinue, spaceDesc, { skipPrejoin: true });
    }
    location.assign(homeSigninURL(window.__homeOrigin, location.origin, location.pathname, nonce));
  };
  card.querySelector("#prejoin-skip").onclick = () =>
    showWelcome(kind, onContinue, spaceDesc, { skipPrejoin: true });
}

async function finish(id, name, pub, priv, wrappedSelf = "") {
  let claim;
  try {
    claim = await (
      await fetch(`/api/key-invite/${encodeURIComponent(id)}/claim`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        // The screen name is never sent to the server — it's published encrypted
        // (POST /api/label) once the app loads and has the instance key.
        body: JSON.stringify({ wrapped: wrappedSelf, claim_secret: inviteClaimSecret }),
      })
    ).json();
  } catch {
    localStorage.removeItem("lchat_welcome_pending"); // the claim didn't take — drop the marker
    return showError("Couldn't reach the server. Try again.");
  }
  if (!claim.ok || !claim.token) {
    localStorage.removeItem("lchat_welcome_pending");
    return showError("This invite was just used. Ask for a new one.");
  }
  // Key transparency (#573): MAC our public key under the T-derived bind key so
  // the inviter can verify it's the key WE published. Computed OUTSIDE the
  // publish try — a bind-MAC hiccup must never skip the load-bearing pubkey
  // registration (that would leave a claimed-but-keyless broken join).
  let bindMacVal = "";
  try {
    if (inviteBindKey) bindMacVal = await bindMac(inviteBindKey, pub);
  } catch {}
  try {
    await fetch("/api/pubkey", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ token: claim.token, public_key: pub, bind_mac: bindMacVal }),
    });
  } catch {}
  if (!window.__lchatEmbed) {
    localStorage.setItem(SESSION_KEY, JSON.stringify({ token: claim.token, name, userPub: pub, userPriv: priv }));
    // Land straight in the DM this invite created (the app opens it on boot).
    if (claim.thread_id) localStorage.setItem("lchat_open_thread", claim.thread_id);
    // First-paint label for the inviter (#1436) — provisional until their real
    // label decrypts; shell.js applies and clears it.
    if (claim.thread_id && inviterFrom) {
      try {
        localStorage.setItem(INVITER_HINT_KEY, inviterHintStash({ thread: claim.thread_id, name: inviterFrom, now: Date.now() }));
      } catch {}
    }
  }
  if (window.__lchatEmbed) {
    // Native add-instance flow: hand the resolved identity back to the shell, which
    // moves the private key into the Keychain. Don't navigate — the shell tears the
    // one-shot join webview down once it has this.
    try {
      window.webkit.messageHandlers.lchat.postMessage({
        joined: { token: claim.token, name, userPub: pub, userPriv: priv },
      });
    } catch {}
    return;
  }
  // Already signed in on the way here: save this brand-new session to the
  // account NOW, via the /enroll round trip. Two arrivals qualify — the
  // signup-first joiner (prejoin), and someone who created this space from
  // their Eleven page (?src=home). Either way the home-tab session from
  // minutes ago is still live, so enrolment completes hands-free
  // (payload.auto) and lands back at "/" with the standard nonce marker.
  //
  // Doing it HERE is what makes signing in a once-per-space act. The
  // from-home creator used to be asked again at the end of the setup
  // conversation (keys-home) — and, until it was answered, home's list held
  // only the address-only stub the create saved, with none of this space's
  // key. One automatic enrolment at claim time settles both: the key is in
  // the account before Eleven says hello, so the conversation's key step
  // sees bridge.enrolled and simply confirms it.
  //
  // If the session has gone stale, /enroll's own card stands (enroll.js
  // never runs a ceremony unprompted) — one honest ask, in one place.
  if (autoEnrolOnClaim({
    signedUp: prejoin.signedUp, fromHome,
    homeOrigin: window.__homeOrigin || "", embed: !!window.__lchatEmbed,
  })) {
    return launchEnrol({ token: claim.token, name, userPub: pub, userPriv: priv }, { auto: true });
  }
  await plugIn();
  location.href = "/"; // drop the fragment from the URL bar
}

// adoptExisting joins the invite's pending DM as the member already signed in on
// this device (rather than creating a new person). We wrap the DM key to our
// existing public key and let the server swap us in for the placeholder.
async function adoptExisting(id, threadKeyB64, existing) {
  try {
    const wrapped = await wrapThreadKey(threadKeyB64, existing.userPub);
    const r = await (
      await fetch(`/api/key-invite/${encodeURIComponent(id)}/adopt`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ token: existing.token, wrapped, claim_secret: inviteClaimSecret }),
      })
    ).json();
    if (!r.ok) {
      return showError("This invite has been used or is no longer valid. Ask for a new one.");
    }
    if (r.thread_id) localStorage.setItem("lchat_open_thread", r.thread_id);
    await plugIn();
    location.href = "/";
  } catch {
    showError("Couldn't reach the server. Try again.");
  }
}

// adoptAdminExisting claims an admin-granting invite on an existing account,
// promoting the existing member to admin without creating a new user account.
async function adoptAdminExisting(id, existing) {
  try {
    const r = await (
      await fetch(`/api/key-invite/${encodeURIComponent(id)}/adopt`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ token: existing.token, wrapped: "", claim_secret: inviteClaimSecret }),
      })
    ).json();
    if (!r.ok) {
      return showError("This invite has been used or is no longer valid. Ask for a new one.");
    }
    // Token stays the same (existing session is preserved). Just redirect back to app.
    await plugIn();
    location.href = "/";
  } catch {
    showError("Couldn't reach the server. Try again.");
  }
}

// adoptInviteExisting claims a generic invite (no wrapped payload) on an existing
// account, letting them adopt it as their existing self without creating a new user.
async function adoptInviteExisting(id, existing) {
  try {
    const r = await (
      await fetch(`/api/key-invite/${encodeURIComponent(id)}/adopt`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ token: existing.token, wrapped: "", claim_secret: inviteClaimSecret }),
      })
    ).json();
    if (!r.ok) {
      return showError("This invite has been used or is no longer valid. Ask for a new one.");
    }
    if (r.thread_id) localStorage.setItem("lchat_open_thread", r.thread_id);
    await plugIn();
    location.href = "/";
  } catch {
    showError("Couldn't reach the server. Try again.");
  }
}

// liveSession: loadSession, but verified against the server. A stored session
// can outlive its account — an instance reset (or this device's removal)
// leaves a token the server no longer knows, and trusting it routes a fresh
// invite down the "you're already in" adopt path, which then dies with a
// misleading "invite no longer valid". Drop the dead session and fall through
// to the fresh-person flow ONLY on a definitive 403 — a network failure keeps
// the session (dropping keys because wifi blipped would be catastrophic for a
// real member), and the adopt path then fails loudly as before.
async function liveSession() {
  const existing = loadSession();
  if (!existing || !existing.token || !existing.userPub || !existing.userPriv) return null;
  try {
    const r = await fetch(`/api/me?token=${encodeURIComponent(existing.token)}`);
    if (r.status === 403) {
      localStorage.removeItem(SESSION_KEY);
      return null;
    }
  } catch {}
  return existing;
}

function loadSession() {
  try {
    return JSON.parse(localStorage.getItem(SESSION_KEY) || "null");
  } catch {
    return null;
  }
}

// ---- views --------------------------------------------------------------

// Reveal the instance branding photo on a freshly-rendered onboarding card (and
// hide the placeholder emoji) when one is set. The <img> src is our own
// same-origin endpoint — never fragment or user input.
function applyServerPhoto(root) {
  if (!serverHasAvatar) return;
  const img = root.querySelector(".onboard-photo");
  if (!img) return;
  img.src = serverPhotoURL; // same-origin endpoint, or a decrypted blob: URL when sealed
  img.alt = serverAvatarAlt; // the admin's alt text travels with the photo
  img.classList.remove("hidden");
  const emoji = root.querySelector(".onboard-icon");
  if (emoji) emoji.classList.add("hidden");
}

function showForm(defaultName, onSubmit) {
  card.classList.remove("onboard", "status");
  card.innerHTML = "";
  card.appendChild(document.getElementById("form-tpl").content.cloneNode(true));
  showCard();
  applyServerPhoto(card);
  const input = card.querySelector("#name");
  if (defaultName) input.value = defaultName;
  input.focus();
  input.select();
  card.querySelector("#join-form").onsubmit = (e) => {
    e.preventDefault();
    const name = input.value.trim();
    if (name) onSubmit(name);
  };
}

// In-flight states ("Setting up…", "Signing you in…") all render as the one
// full-screen loader — the message argument is accepted for call-site clarity
// but the loader speaks for itself.
function showStatus(_msg) {
  showLoader();
}

// The beat between "claimed" and the app: flash "Plugging in…" under the
// spinner, fade it out, then navigate — the amp knob fades in on the far side.
async function plugIn() {
  if (!loader) return;
  const msg = document.createElement("div");
  msg.className = "plugging-in";
  msg.textContent = "Plugging in…";
  loader.appendChild(msg);
  requestAnimationFrame(() => msg.classList.add("show"));
  await new Promise((r) => setTimeout(r, 1000));
  msg.classList.remove("show");
  await new Promise((r) => setTimeout(r, 300));
}

function showError(msg, opts = {}) {
  card.classList.remove("onboard", "status");
  card.innerHTML = "";
  card.appendChild(document.getElementById("error-tpl").content.cloneNode(true));
  card.querySelector("#error-msg").textContent = msg;
  // A dead invite can be a returning member's stale bookmark on a device whose
  // session is gone — they don't need a new invite, they need the sign-in door
  // (their account restores their spaces from home). Opt-in per call site so
  // unrelated errors ("couldn't reach the server") don't grow a misleading CTA.
  // The startsWith guard also covers a dev page served without substitution.
  const home = window.__homeOrigin || "";
  if (opts.signin && !window.__lchatEmbed && home.startsWith("http")) {
    const btn = card.querySelector("#error-signin");
    btn.classList.remove("hidden");
    btn.onclick = () => { location.href = home; };
  }
  showCard();
}