background.core.js

console.log('[ScriptVault] Service worker starting...');

// ============================================================================
// Debug Logger — conditional logging based on settings
// ============================================================================

/**
 * Log a debug message. Only outputs if debugMode is enabled in settings.
 * Falls back to no-op in production to avoid Chrome DevTools spam.
 * @param {...any} args - Arguments to log
 */
let _debugEnabled = false;
function debugLog(...args) {
  if (_debugEnabled) console.log('[ScriptVault]', ...args);
}
function debugWarn(...args) {
  if (_debugEnabled) console.warn('[ScriptVault]', ...args);
}

// Load debug setting on startup (async — logs before this completes go to console.log)
(async () => {
  try {
    const data = await chrome.storage.local.get('settings');
    _debugEnabled = data.settings?.debugMode === true;
  } catch {}
})();

// ============================================================================
// Session State — persist GM_* runtime maps to chrome.storage.session so
// onclose / onclick / onclose callbacks survive MV3 service-worker termination.
// chrome.storage.session is in-memory but persists across SW restarts within
// the browser session, which is exactly the GM_openInTab / GM_notification
// callback lifetime.
// ============================================================================
const SessionState = {
  _NC_KEY: 'sessionNotifCallbacks',
  _OTT_KEY: 'sessionOpenTabTrackers',
  _AWT_KEY: 'sessionAudioWatchedTabs',
  _hydrated: false,
  async hydrate() {
    if (this._hydrated) return;
    this._hydrated = true;
    if (!chrome?.storage?.session) return;
    try {
      const data = await chrome.storage.session.get([this._NC_KEY, this._OTT_KEY, this._AWT_KEY]);
      const nc = data[this._NC_KEY];
      if (nc && typeof nc === 'object') {
        if (!self._notifCallbacks) self._notifCallbacks = new Map();
        for (const [k, v] of Object.entries(nc)) self._notifCallbacks.set(k, v);
      }
      const ott = data[this._OTT_KEY];
      if (ott && typeof ott === 'object') {
        if (!self._openTabTrackers) self._openTabTrackers = new Map();
        for (const [k, v] of Object.entries(ott)) self._openTabTrackers.set(Number(k), v);
      }
      const awt = data[this._AWT_KEY];
      if (Array.isArray(awt)) {
        if (!self._audioWatchedTabs) self._audioWatchedTabs = new Set();
        for (const id of awt) self._audioWatchedTabs.add(id);
      }
    } catch (_) { /* session storage unavailable */ }
  },
  _persist(key, source) {
    if (!chrome?.storage?.session) return;
    let value;
    if (source instanceof Map) value = Object.fromEntries(source);
    else if (source instanceof Set) value = [...source];
    else value = source ?? null;
    chrome.storage.session.set({ [key]: value }).catch(() => {});
  },
  persistNotifCallbacks() { this._persist(this._NC_KEY, self._notifCallbacks); },
  persistOpenTabTrackers() { this._persist(this._OTT_KEY, self._openTabTrackers); },
  persistAudioWatchedTabs() { this._persist(this._AWT_KEY, self._audioWatchedTabs); },
};
self.SessionState = SessionState;

// ============================================================================
// Userscript Parser
// ============================================================================

/**
 * Parse a userscript's metadata block and extract all supported directives.
 * @param {string} code - The full userscript source code
 * @returns {{ meta?: Object, code?: string, metaBlock?: string, error?: string }} Parsed result or error
 */
function parseUserscript(code) {
  const metaBlockMatch = code.match(/\/\/\s*==UserScript==([\s\S]*?)\/\/\s*==\/UserScript==/);
  if (!metaBlockMatch) {
    return { error: 'No metadata block found. Scripts must include ==UserScript== header.' };
  }

  const meta = {
    name: 'Unnamed Script',
    namespace: 'scriptvault',
    version: '1.0.0',
    description: '',
    author: '',
    match: [],
    include: [],
    exclude: [],
    excludeMatch: [],
    // Phase 39.11 — TM #2784 top-level origin gates.
    matchTop: [],
    excludeTop: [],
    grant: [],
    require: [],
    resource: {},
    'run-at': 'document-idle',
    noframes: false,
    icon: '',
    icon64: '',
    homepage: '',
    homepageURL: '',
    website: '',
    source: '',
    updateURL: '',
    downloadURL: '',
    supportURL: '',
    connect: [],
    antifeature: [],
    unwrap: false,
    'inject-into': 'auto',
    sandbox: '',
    tag: [],
    'run-in': '',
    'top-level-await': false,
    license: '',
    copyright: '',
    contributionURL: '',
    compatible: [],
    incompatible: [],
    webRequest: null,
    priority: 0,
    weight: 0,
    crontab: ''
  };

  const metaBlock = metaBlockMatch[1];
  const lines = metaBlock.split('\n');

  for (const line of lines) {
    const match = line.match(/\/\/\s*@(\S+)(?:\s+(.*))?/);
    if (!match) continue;

    const key = match[1].trim();
    const value = (match[2] || '').trim();

    switch (key) {
      case 'name':
      case 'namespace':
      case 'version':
      case 'description':
      case 'author':
      case 'icon':
      case 'icon64':
      case 'homepage':
      case 'homepageURL':
      case 'website':
      case 'source':
      case 'updateURL':
      case 'downloadURL':
      case 'supportURL':
      case 'run-at':
      case 'inject-into':
      case 'sandbox':
      case 'run-in':
      case 'license':
      case 'copyright':
      case 'contributionURL':
      case 'crontab':
        meta[key] = value;
        break;
      case 'match':
      case 'include':
      case 'exclude':
      case 'exclude-match':
      case 'excludeMatch':
      case 'grant':
      case 'require':
      case 'connect':
      case 'antifeature':
      case 'tag':
      case 'compatible':
      case 'incompatible':
      // Phase 39.11 — TM #2784 top-level-origin gates. Patterns are matched
      // against window.top.location.href at runtime (in the wrapper). Same
      // array-directive shape as @match/@exclude so the parser, dedup, and
      // splittable-comma conveniences carry over.
      case 'match-top':
      case 'matchTop':
      case 'exclude-top':
      case 'excludeTop':
        const arrayKey = key === 'exclude-match' ? 'excludeMatch'
          : key === 'match-top' ? 'matchTop'
          : key === 'exclude-top' ? 'excludeTop'
          : key;
        if (!meta[arrayKey]) meta[arrayKey] = [];
        if (value) {
          // Phase 36.6 — comma-separated convenience syntax for URL pattern
          // directives. Commas are not valid in match patterns per Chrome's
          // match syntax, so we can split safely. `tag` keeps raw values so
          // multi-word tags like `// @tag my util` stay intact.
          const splittable =
            arrayKey === 'match' ||
            arrayKey === 'include' ||
            arrayKey === 'exclude' ||
            arrayKey === 'excludeMatch' ||
            arrayKey === 'matchTop' ||
            arrayKey === 'excludeTop' ||
            arrayKey === 'connect';
          if (splittable && value.includes(',')) {
            for (const part of value.split(',')) {
              const trimmed = part.trim();
              if (trimmed) meta[arrayKey].push(trimmed);
            }
          } else {
            meta[arrayKey].push(value);
          }
        }
        break;
      case 'resource':
        const resourceMatch = value.match(/^(\S+)\s+(.+)$/);
        if (resourceMatch) {
          meta.resource[resourceMatch[1]] = resourceMatch[2];
        }
        break;
      case 'noframes':
        meta.noframes = true;
        break;
      case 'unwrap':
        meta.unwrap = true;
        break;
      case 'nodownload':
        meta.nodownload = true;
        break;
      case 'delay':
        meta.delay = Math.max(0, parseInt(value, 10) || 0);
        break;
      case 'top-level-await':
        meta['top-level-await'] = true;
        break;
      case 'priority':
        meta.priority = parseInt(value, 10) || 0;
        break;
      case 'weight': {
        // Phase 11.7 — Userscripts (Safari) `@weight 1..999`. Integer
        // injection priority where higher = earlier within the same
        // `@run-at`. Clamp to the documented range so an `@weight 99999`
        // typo can't dominate the sort.
        const w = parseInt(value, 10);
        if (Number.isFinite(w)) meta.weight = Math.max(1, Math.min(999, w));
        break;
      }
      case 'webRequest':
        try { meta.webRequest = JSON.parse(value); } catch (e) {}
        break;
      default:
        // Handle localized metadata like @name:ja or @name:zh-Hans
        if (key.includes(':')) {
          const colonIdx = key.indexOf(':');
          const baseKey = key.slice(0, colonIdx);
          const locale = key.slice(colonIdx + 1);
          // SECURITY: reject prototype-pollution keys. A malicious script
          // with `// @name:__proto__ EVIL` would otherwise reach
          // `meta.localized["__proto__"]["name"] = "EVIL"` — the bracket
          // accessor returns Object.prototype, and the subsequent
          // `.name = ...` mutates it directly. That contaminates every
          // object in the SW context (e.g. `{}.name === "EVIL"`),
          // corrupting all downstream code that reads `.name`/`.constructor`/
          // `.toString` etc. via inheritance.
          const POLLUTED = ['__proto__', 'constructor', 'prototype'];
          if (baseKey && locale
              && !POLLUTED.includes(baseKey)
              && !POLLUTED.includes(locale)) {
            if (!meta.localized) meta.localized = Object.create(null);
            if (!Object.hasOwn(meta.localized, locale)) {
              meta.localized[locale] = Object.create(null);
            }
            meta.localized[locale][baseKey] = value;
          }
        }
    }
  }

  // Default grant if none specified
  if (meta.grant.length === 0) {
    meta.grant = ['none'];
  }

  return { meta, code, metaBlock: metaBlockMatch[0] };
}

// ============================================================================
// URL Matching
// ============================================================================

// ============================================================================
// Update System
// ============================================================================

const UpdateSystem = {
  // Phase 6.1 — exponential backoff bookkeeping. Per-script failure count
  // doubles the wait between retries (1m, 2m, 4m, …) up to a 24h cap so a
  // dead update URL doesn't consume bandwidth on every periodic alarm.
  // Successful checks (200 or 304) clear the count.
  _BACKOFF_BASE_MS: 60 * 1000,         // 1 minute
  _BACKOFF_MAX_MS: 24 * 60 * 60 * 1000, // 24 hours
  _MAX_BACKOFF_EXP: 10,                 // 2^10 * 1m = ~17 hours; capped by _BACKOFF_MAX_MS
  _FETCH_TIMEOUT_MS: 15 * 1000,
  _MAX_UPDATE_BYTES: 5 * 1024 * 1024,

  /** Compute the next-check timestamp for a failure-count value. */
  _nextRetryAt(failures) {
    const exp = Math.min(this._MAX_BACKOFF_EXP, Math.max(0, failures - 1));
    const wait = Math.min(this._BACKOFF_MAX_MS, this._BACKOFF_BASE_MS * (2 ** exp));
    return Date.now() + wait;
  },

  async fetchUpdateCandidate(updateUrl, fetchOptions = {}) {
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), this._FETCH_TIMEOUT_MS);

    try {
      const response = await fetch(updateUrl, { ...fetchOptions, signal: controller.signal });

      if (response.status === 304 || !response.ok) {
        return { response, code: '' };
      }

      const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
      if (contentLength > this._MAX_UPDATE_BYTES) {
        throw new Error(`Update too large (${formatBytes(contentLength)}). Maximum is ${formatBytes(this._MAX_UPDATE_BYTES)}.`);
      }

      const code = await response.text();
      if (code.length > this._MAX_UPDATE_BYTES) {
        throw new Error(`Update too large (${formatBytes(code.length)}). Maximum is ${formatBytes(this._MAX_UPDATE_BYTES)}.`);
      }

      return { response, code };
    } catch (e) {
      if (e?.name === 'AbortError') {
        throw new Error(`Update fetch timed out after ${Math.round(this._FETCH_TIMEOUT_MS / 1000)} seconds`);
      }
      throw e;
    } finally {
      clearTimeout(timeoutId);
    }
  },

  async checkForUpdates(scriptId = null) {
    // A manual single-script check (caller passed scriptId) bypasses backoff —
    // user explicitly asked, so honor it and let them see fresh failure
    // surface immediately.
    const isManualSingle = !!scriptId;
    const scripts = scriptId
      ? [await ScriptStorage.get(scriptId)].filter(Boolean)
      : await ScriptStorage.getAll();

    const updates = [];
    const now = Date.now();

    for (const script of scripts) {
      if (script.meta.nodownload) continue; // @nodownload prevents auto-updates
      if (!script.meta.updateURL && !script.meta.downloadURL) continue;

      // Skip scripts in backoff cooldown (auto-update path only).
      if (!isManualSingle && script._updateNextCheck && script._updateNextCheck > now) {
        continue;
      }

      try {
        const updateUrl = script.meta.updateURL || script.meta.downloadURL;
        const headers = {};

        // Conditional request using stored etag/last-modified
        if (script._httpEtag) headers['If-None-Match'] = script._httpEtag;
        if (script._httpLastModified) headers['If-Modified-Since'] = script._httpLastModified;

        const { response, code: newCode } = await this.fetchUpdateCandidate(updateUrl, { headers });

        // 304 Not Modified — counts as success; clear any backoff state.
        if (response.status === 304) {
          if (script._updateFailureCount || script._updateNextCheck) {
            script._updateFailureCount = 0;
            script._updateNextCheck = 0;
            await ScriptStorage.set(script.id, script);
          }
          continue;
        }
        if (!response.ok) {
          // Non-2xx — record failure and bump the cooldown.
          script._updateFailureCount = (script._updateFailureCount || 0) + 1;
          script._updateNextCheck = this._nextRetryAt(script._updateFailureCount);
          await ScriptStorage.set(script.id, script);
          continue;
        }

        // Store HTTP cache headers for next check + clear backoff on success.
        const etag = response.headers.get('etag');
        const lastModified = response.headers.get('last-modified');
        const hadBackoff = script._updateFailureCount || script._updateNextCheck;
        if (etag || lastModified) {
          script._httpEtag = etag || '';
          script._httpLastModified = lastModified || '';
        }
        if (hadBackoff) {
          script._updateFailureCount = 0;
          script._updateNextCheck = 0;
        }
        if (etag || lastModified || hadBackoff) {
          await ScriptStorage.set(script.id, script);
        }

        const parsed = parseUserscript(newCode);
        if (parsed.error) continue;

        if (this.compareVersions(parsed.meta.version, script.meta.version) > 0) {
          updates.push({
            id: script.id,
            name: script.meta.name,
            currentVersion: script.meta.version,
            newVersion: parsed.meta.version,
            code: newCode
          });
        }
      } catch (e) {
        console.error('[ScriptVault] Update check failed for:', script.meta.name, e);
        // Network error counts as a failure too.
        script._updateFailureCount = (script._updateFailureCount || 0) + 1;
        script._updateNextCheck = this._nextRetryAt(script._updateFailureCount);
        try { await ScriptStorage.set(script.id, script); } catch (_) { /* best effort */ }
      }
    }

    return updates;
  },
  
  compareVersions(v1, v2) {
    // Strip pre-release suffix (e.g. "1.2.0-beta.1" → "1.2.0") before numeric comparison.
    // A version with a pre-release suffix is treated as less than the same version without one.
    const preRelease1 = v1.includes('-');
    const preRelease2 = v2.includes('-');
    const clean1 = (typeof v1 === 'string' ? v1 : String(v1)).replace(/-.*$/, '');
    const clean2 = (typeof v2 === 'string' ? v2 : String(v2)).replace(/-.*$/, '');
    const parts1 = clean1.split('.').map(n => parseInt(n, 10) || 0);
    const parts2 = clean2.split('.').map(n => parseInt(n, 10) || 0);

    for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
      const p1 = parts1[i] || 0;
      const p2 = parts2[i] || 0;
      if (p1 > p2) return 1;
      if (p1 < p2) return -1;
    }
    // Numeric parts are equal — a pre-release is less than a release of the same version
    if (preRelease1 && !preRelease2) return -1;
    if (!preRelease1 && preRelease2) return 1;
    return 0;
  },
  
  async applyUpdate(scriptId, newCode, { force = false } = {}) {
    const script = await ScriptStorage.get(scriptId);
    if (!script) return { error: 'Script not found' };
    // Don't auto-update scripts the user has locally edited (unless force=true from forceUpdate)
    if (!force && script.settings?.userModified) return { skipped: true, reason: 'user-modified' };

    const parsed = parseUserscript(newCode);
    if (parsed.error) return parsed;

    // Store previous version for rollback (keep last 3)
    if (!script.versionHistory) script.versionHistory = [];
    script.versionHistory.push({
      version: script.meta.version,
      code: script.code,
      updatedAt: script.updatedAt || Date.now()
    });
    // Trim to last 5 versions
    if (script.versionHistory.length > 5) {
      script.versionHistory = script.versionHistory.slice(-5);
    }

    script.code = newCode;
    script.meta = parsed.meta;
    script.updatedAt = Date.now();

    // Re-register FIRST so we can verify the new code works before persisting
    try {
      await unregisterScript(scriptId);
      if (script.enabled !== false) {
        await registerScript(script);
      }
    } catch (regError) {
      console.error(`[ScriptVault] Failed to re-register ${script.meta.name} after update:`, regError);
      // Registration failed — still save the updated code (user can manually fix)
      // but mark the failure so the UI can show it
      script.settings = script.settings || {};
      script.settings._registrationError = regError.message || 'Registration failed after update';
    }

    // Persist to storage after registration attempt
    await ScriptStorage.set(scriptId, script);

    // Phase 12.10 — applyUpdate no longer fires a per-script OS notification.
    // Instead, the autoUpdate caller aggregates successful updates into a
    // single summary notification (or none, when notifyOnUpdate is off), and
    // pushes them onto the recent-updates ring so the dashboard can surface
    // an in-app banner. Manual single-script updates (popup "Check for
    // Update", dashboard force-update) get their feedback inline via the
    // returned { success, script } payload.
    return { success: true, script };
  },

  // Phase 12.10 — recently-applied updates ring buffer surfaced to the
  // dashboard via the `getRecentUpdates` background message. Capped at 20.
  _recentUpdates: [],

  async autoUpdate() {
    const settings = await SettingsManager.get();
    if (!settings.autoUpdate) return;

    const updates = await this.checkForUpdates();
    // Apply all pending updates in parallel — each applyUpdate is independent
    const results = await Promise.allSettled(updates.map(update => this.applyUpdate(update.id, update.code)));
    const failed = results.filter(r => r.status === 'rejected');
    if (failed.length > 0) {
      console.error('[ScriptVault] Auto-update failures:', failed.map(r => r.reason?.message || r.reason));
    }

    // Aggregate successful updates for in-app surfacing + a single summary
    // OS notification (only fired when the user opted in via notifyOnUpdate).
    const successful = [];
    results.forEach((r, idx) => {
      if (r.status === 'fulfilled' && r.value?.success && updates[idx]) {
        successful.push({
          id: updates[idx].id,
          name: updates[idx].name,
          previousVersion: updates[idx].currentVersion,
          newVersion: updates[idx].newVersion,
          appliedAt: Date.now()
        });
      }
    });
    if (successful.length > 0) {
      // Push onto the ring (newest first), cap at 20.
      this._recentUpdates = [...successful, ...this._recentUpdates].slice(0, 20);

      if (settings.notifyOnUpdate) {
        const title = successful.length === 1
          ? 'Script Updated'
          : `${successful.length} scripts updated`;
        // Compact message body: list up to 3 names then "+N more".
        const names = successful.slice(0, 3).map(s => `${s.name} v${s.newVersion}`);
        const overflow = successful.length - names.length;
        const message = overflow > 0
          ? `${names.join(', ')} (+${overflow} more)`
          : names.join(', ');
        try {
          chrome.notifications.create({
            type: 'basic',
            iconUrl: 'images/icon128.png',
            title,
            message
          });
        } catch (_e) { /* notifications may be disabled; non-fatal */ }
      }
    }

    await SettingsManager.set('lastUpdateCheck', Date.now());
  },

  /** Return the most recent successful auto-updates (newest first). */
  getRecentUpdates() {
    return this._recentUpdates.slice();
  },

  /** Clear the recent-updates ring (called when the dashboard banner is dismissed). */
  clearRecentUpdates() {
    this._recentUpdates = [];
  }
};

// ============================================================================
// Cloud Sync
// ============================================================================

const CloudSync = {
  // Use providers from imported CloudSyncProviders module
  get providers() {
    return CloudSyncProviders;
  },

  _syncInProgress: false,
  // Phase 40.12 — Hoisted AbortController lets the 90s timeout actually cancel
  // the in-flight provider fetches (Promise.race alone does not cancel the
  // loser, leaving orphaned writes that can race a subsequent sync). Providers
  // that accept `opts.signal` short-circuit their fetches when the controller
  // aborts; providers that haven't been threaded yet still time out on their
  // own internal `fetch()` timeouts (slower fallback, but correct).
  _abortController: null,

  async sync() {
    // Prevent concurrent syncs — second call defers until first completes
    if (this._syncInProgress) {
      debugLog('[CloudSync] Sync already in progress, skipping');
      return { skipped: true };
    }
    this._syncInProgress = true;
    this._abortController = new AbortController();

    let _timeoutId;
    try {
      const timeoutPromise = new Promise((_, reject) => {
        _timeoutId = setTimeout(() => {
          // Cancel any in-flight provider fetches before the race rejects.
          try { this._abortController.abort(new Error('Sync timed out after 90s')); } catch {}
          reject(new Error('Sync timed out after 90s'));
        }, 90000);
      });
      return await Promise.race([this._performSync({ signal: this._abortController.signal }), timeoutPromise]);
    } catch (e) {
      console.error('[ScriptVault] Sync failed:', e);
      return { error: e.message };
    } finally {
      clearTimeout(_timeoutId);
      this._syncInProgress = false;
      this._abortController = null;
    }
  },

  async _performSync(opts = {}) {
    const { signal } = opts;
    const settings = await SettingsManager.get();
    if (!settings.syncEnabled || settings.syncProvider === 'none') return;
    if (signal?.aborted) throw new Error('Sync aborted');

    const provider = this.providers[settings.syncProvider];
    if (!provider) return;

    // Load tombstones (IDs of locally-deleted scripts, to prevent sync re-importing them)
    const tombstoneData = await chrome.storage.local.get('syncTombstones');
    const tombstones = tombstoneData.syncTombstones || {};

    // Get local data
    const scripts = await ScriptStorage.getAll();
    const localData = {
      version: 1,
      timestamp: Date.now(),
      scripts: scripts.map(s => ({
        id: s.id,
        code: s.code,
        enabled: s.enabled,
        position: s.position,
        settings: s.settings || {},
        updatedAt: s.updatedAt
      })),
      tombstones
    };

    // Get remote data
    const remoteData = await provider.download(settings, { signal });
    if (signal?.aborted) throw new Error('Sync aborted');

    if (remoteData) {
      // Merge tombstones from remote so deletions propagate across devices
      const mergedTombstones = { ...tombstones, ...(remoteData.tombstones || {}) };

      // Merge: prefer newer versions
      const merged = this.mergeData(localData, remoteData);

      // Apply merged data locally, skipping tombstoned (deleted) scripts
      // Uses 3-way text merge (via offscreen doc) when both sides have changed since sync base
      for (const script of merged.scripts) {
        if (mergedTombstones[script.id]) continue; // deleted on some device, don't re-import
        const existing = await ScriptStorage.get(script.id);
        // Skip scripts marked as locally modified — user edits take precedence over remote
        if (existing?.settings?.userModified) continue;

        const remoteScript = remoteData.scripts?.find(s => s.id === script.id);
        const localScript = localData.scripts?.find(s => s.id === script.id);

        let codeToSave = script.code;
        let mergeConflict = false;

        // 3-way merge: both sides changed since last known base
        if (existing && remoteScript && localScript &&
            existing.code !== remoteScript.code &&
            existing.code !== localScript.code) {
          const base = existing.syncBaseCode || existing.code;
          if (base && base !== localScript.code && base !== remoteScript.code) {
            try {
              await ScriptAnalyzer._ensureOffscreen();
              const mergeResult = await chrome.runtime.sendMessage({
                type: 'offscreen_merge',
                base,
                local: localScript.code,
                remote: remoteScript.code
              });
              if (mergeResult && !mergeResult.error) {
                codeToSave = mergeResult.merged;
                mergeConflict = mergeResult.conflicts || false;
                debugLog(`[CloudSync] 3-way merge for ${script.id}: conflicts=${mergeConflict}`);
              }
            } catch (e) {
              debugLog('[CloudSync] 3-way merge failed, using timestamp winner:', e.message);
              // Fall back to last-write-wins but flag as potential conflict
              mergeConflict = true;
            }
          }
        }

        if (!existing || script.updatedAt > existing.updatedAt || mergeConflict) {
          const parsed = parseUserscript(codeToSave);
          if (!parsed.error) {
            await ScriptStorage.set(script.id, {
              id: script.id,
              code: codeToSave,
              meta: parsed.meta,
              enabled: script.enabled,
              position: script.position,
              settings: {
                ...(existing?.settings || {}),
                ...(mergeConflict ? { mergeConflict: true } : {})
              },
              updatedAt: Math.max(script.updatedAt, existing?.updatedAt || 0),
              createdAt: existing?.createdAt || script.updatedAt,
              syncBaseCode: codeToSave // record merged result as new base for future syncs
            });
          }
        }
      }

      // Persist merged tombstones locally
      if (Object.keys(mergedTombstones).length > Object.keys(tombstones).length) {
        await chrome.storage.local.set({ syncTombstones: mergedTombstones });
      }

      // Upload merged data (includes tombstones)
      merged.timestamp = Date.now();
      merged.tombstones = mergedTombstones;
      if (signal?.aborted) throw new Error('Sync aborted');
      await provider.upload(merged, settings, { signal });
    } else {
      // First sync, just upload (include tombstones so remote gets deletion info)
      if (signal?.aborted) throw new Error('Sync aborted');
      await provider.upload(localData, settings, { signal });
    }

    await SettingsManager.set('lastSync', Date.now());
    return { success: true };
  },
  
  mergeData(local, remote) {
    const scriptsMap = new Map();
    const mergedTombstones = { ...(local.tombstones || {}), ...(remote.tombstones || {}) };

    // Add all local scripts
    for (const script of (local.scripts || [])) {
      scriptsMap.set(script.id, script);
    }

    // Merge remote scripts (prefer newer)
    for (const script of (remote.scripts || [])) {
      const existing = scriptsMap.get(script.id);
      if (!existing || script.updatedAt > existing.updatedAt) {
        scriptsMap.set(script.id, script);
      }
    }

    return {
      version: 1,
      timestamp: Date.now(),
      scripts: Array.from(scriptsMap.values()).filter(s => !mergedTombstones[s.id]),
      tombstones: mergedTombstones
    };
  }
};

// ============================================================================
// Import/Export
// ============================================================================

async function exportAllScripts(options = {}) {
  const {
    includeSettings = true,
    includeStorage = false
  } = options;
  const scripts = await ScriptStorage.getAll();
  const settings = includeSettings ? await SettingsManager.get() : null;

  const exportedScripts = await Promise.all(scripts.map(async s => {
    const entry = {
      id: s.id,
      code: s.code,
      enabled: s.enabled,
      position: s.position,
      createdAt: s.createdAt,
      updatedAt: s.updatedAt
    };
    if (includeSettings && s.settings && typeof s.settings === 'object') {
      entry.settings = { ...s.settings };
    }
    if (s.versionHistory && s.versionHistory.length > 0) {
      entry.versionHistory = s.versionHistory;
    }
    if (includeStorage) {
      const values = await ScriptValues.getAll(s.id);
      if (values && Object.keys(values).length > 0) {
        entry.storage = values;
      }
    }
    return entry;
  }));
  
  return {
    version: 2,
    exportedAt: new Date().toISOString(),
    ...(includeSettings ? { settings } : {}),
    scripts: exportedScripts
  };
}

// Phase 39.31 — WECG #935 pre-emptive string clamping. Chrome's
// chrome.notifications.create() silently truncates `title` past ~100 chars
// and `message` past ~300 chars; chrome.contextMenus.create() truncates
// `title` past ~75 chars with ellipsis. WECG #935 proposes formalizing
// these limits, after which silent truncation may become an explicit error.
// Clamp at the source so a future spec change can't break us.
const SV_NOTIF_TITLE_MAX = 96;     // Chrome notification title cap
const SV_NOTIF_MESSAGE_MAX = 280;  // Chrome notification message cap
const SV_CONTEXT_MENU_TITLE_MAX = 64; // visible context-menu label
function _clampString(s, max) {
  if (typeof s !== 'string') return s;
  if (s.length <= max) return s;
  // Use a single ellipsis char so we land exactly on `max`.
  return s.slice(0, max - 1) + '\u2026';
}

// Phase 39.22 — bound any await chain that could deadlock on a CSP-strict /
// hung remote target (VM #2513). Rejects with a labelled timeout error after
// `ms` milliseconds; the caller is responsible for treating the rejection as
// a soft failure (Promise.allSettled, .catch, etc.).
function _withTimeout(promise, ms, label) {
  let timer;
  const timeout = new Promise((_, reject) => {
    timer = setTimeout(() => reject(new Error(`Timeout after ${ms}ms: ${label}`)), ms);
  });
  return Promise.race([
    Promise.resolve(promise).finally(() => clearTimeout(timer)),
    timeout
  ]);
}

// chrome.cookies.* only accepts http(s) URLs. Front-validate to give scripts a
// clear error instead of leaking the raw Chrome exception, and to reject
// chrome-extension://, javascript:, data:, blob:, file: payloads up-front.
function isHttpCookieUrl(url) {
  if (typeof url !== 'string') return false;
  try {
    const u = new URL(url);
    return u.protocol === 'http:' || u.protocol === 'https:';
  } catch {
    return false;
  }
}

const RESERVED_IMPORT_SCRIPT_IDS = new Set(['__proto__', 'prototype', 'constructor']);
function isSafeImportedScriptId(id) {
  return (
    typeof id === 'string' &&
    /^script_[A-Za-z0-9._:-]{1,160}$/.test(id) &&
    !RESERVED_IMPORT_SCRIPT_IDS.has(id)
  );
}

function allocateImportedScriptId(preferredId, usedScriptIds) {
  if (isSafeImportedScriptId(preferredId) && !usedScriptIds.has(preferredId)) {
    return preferredId;
  }
  let nextId;
  do {
    nextId = generateId();
  } while (usedScriptIds.has(nextId));
  return nextId;
}

async function importScripts(data, options = {}) {
  const {
    overwrite = false,
    importSettings = false,
    importStorage = false
  } = options;
  const results = {
    imported: 0,
    skipped: 0,
    errors: [],
    settingsImported: false,
    storageImported: 0
  };

  if (!data.scripts || !Array.isArray(data.scripts)) {
    return { error: 'Invalid import format' };
  }

  // Cache existing count once to avoid O(n²) getAll() inside the loop
  const allExistingScripts = await ScriptStorage.getAll();
  const usedScriptIds = new Set(allExistingScripts.map(script => script.id));
  let _importPosition = allExistingScripts.length;

  for (const script of data.scripts) {
    const rawScriptId = script && typeof script === 'object' ? script.id : undefined;
    const requestedScriptId = isSafeImportedScriptId(rawScriptId) ? rawScriptId : '';
    const errorName = requestedScriptId || (typeof rawScriptId === 'string' ? rawScriptId : '<unknown>');
    try {
      if (!script || typeof script.code !== 'string') {
        results.errors.push({ name: errorName, error: 'Invalid script entry' });
        continue;
      }

      const parsed = parseUserscript(script.code);
      if (parsed.error) {
        results.errors.push({ name: errorName, error: parsed.error });
        continue;
      }

      const existing = requestedScriptId ? await ScriptStorage.get(requestedScriptId) : null;
      if (existing && !overwrite) {
        results.skipped++;
        continue;
      }

      const scriptId = existing?.id && isSafeImportedScriptId(existing.id)
        ? existing.id
        : allocateImportedScriptId(requestedScriptId, usedScriptIds);
      usedScriptIds.add(scriptId);

      const nextSettings = importSettings && script.settings && typeof script.settings === 'object'
        ? { ...script.settings }
        : { ...(existing?.settings || {}) };

      const importEntry = {
        id: scriptId,
        code: script.code,
        meta: parsed.meta,
        enabled: script.enabled !== false,
        settings: nextSettings,
        position: Number.isFinite(script.position) ? script.position : _importPosition++,
        createdAt: Number.isFinite(script.createdAt) ? script.createdAt : Date.now(),
        updatedAt: Number.isFinite(script.updatedAt) ? script.updatedAt : Date.now()
      };
      if (script.versionHistory && Array.isArray(script.versionHistory)) {
        importEntry.versionHistory = script.versionHistory;
      }
      await ScriptStorage.set(scriptId, importEntry);
      if (importStorage) {
        const storedValues = script.storage && typeof script.storage === 'object' ? script.storage : {};
        if (Object.keys(storedValues).length > 0) {
          await ScriptValues.deleteAll(scriptId);
          await ScriptValues.setAll(scriptId, storedValues);
          results.storageImported++;
        } else if (existing) {
          await ScriptValues.deleteAll(scriptId);
        }
      }
      results.imported++;
    } catch (e) {
      results.errors.push({ name: errorName, error: e.message });
    }
  }
  
  // Import settings if present
  if (data.settings && importSettings) {
    await SettingsManager.set(data.settings);
    results.settingsImported = true;
  }
  
  // Re-register all scripts after import
  await registerAllScripts(true);
  await updateBadge();

  return results;
}

// Export to ZIP (Tampermonkey-compatible format)
async function exportToZip(options = {}) {
  const { includeStorage = true } = options;
  const scripts = await ScriptStorage.getAll();
  const files = {}; // fflate uses { filename: Uint8Array } format
  const usedNames = new Set();

  for (const script of scripts) {
    // Create safe filename, deduplicating collisions
    let safeName = (script.meta.name || 'unnamed')
      .replace(/[<>:"/\\|?*]/g, '_')
      .replace(/\s+/g, ' ')
      .trim()
      .substring(0, 100);

    if (usedNames.has(safeName)) {
      let counter = 2;
      while (usedNames.has(`${safeName}_${counter}`)) counter++;
      safeName = `${safeName}_${counter}`;
    }
    usedNames.add(safeName);

    // Add the userscript file
    files[`${safeName}.user.js`] = fflate.strToU8(script.code);
    
    // Add options.json (Tampermonkey format)
    const scriptOptions = {
      scriptId: script.id,
      settings: {
        enabled: script.enabled,
        'run-at': script.meta['run-at'] || 'document-idle',
        override: {
          use_includes: [],
          use_matches: [],
          use_excludes: [],
          use_connects: [],
          merge_includes: true,
          merge_matches: true,
          merge_excludes: true,
          merge_connects: true
        }
      },
      meta: {
        name: script.meta.name,
        namespace: script.meta.namespace || '',
        version: script.meta.version || '1.0',
        description: script.meta.description || '',
        author: script.meta.author || '',
        match: script.meta.match || [],
        include: script.meta.include || [],
        exclude: script.meta.exclude || [],
        grant: script.meta.grant || [],
        require: script.meta.require || [],
        resource: script.meta.resource || {}
      }
    };
    files[`${safeName}.options.json`] = fflate.strToU8(JSON.stringify(scriptOptions, null, 2));
    
    // Add storage.json if script has stored values
    const values = includeStorage ? await ScriptValues.getAll(script.id) : null;
    if (values && Object.keys(values).length > 0) {
      const storage = { data: values };
      files[`${safeName}.storage.json`] = fflate.strToU8(JSON.stringify(storage, null, 2));
    }
  }
  
  // Generate zip as Uint8Array then convert to base64 in chunks (avoid stack overflow)
  const zipData = fflate.zipSync(files, { level: 6 });
  let binary = '';
  const chunkSize = 8192;
  for (let i = 0; i < zipData.length; i += chunkSize) {
    binary += String.fromCharCode.apply(null, zipData.subarray(i, i + chunkSize));
  }
  const base64 = btoa(binary);
  return { zipData: base64, filename: `scriptvault-archive-${new Date().toISOString().replace(/[:.]/g, '-')}.zip` };
}

// Import from ZIP (supports Tampermonkey and other formats)
async function importFromZip(zipData, options = {}) {
  const results = { imported: 0, skipped: 0, errors: [] };
  
  try {
    // Convert base64 to Uint8Array if needed
    let zipBytes;
    if (typeof zipData === 'string') {
      // Base64 string
      const binaryString = atob(zipData);
      zipBytes = new Uint8Array(binaryString.length);
      for (let i = 0; i < binaryString.length; i++) {
        zipBytes[i] = binaryString.charCodeAt(i);
      }
    } else if (zipData instanceof ArrayBuffer) {
      zipBytes = new Uint8Array(zipData);
    } else {
      zipBytes = zipData;
    }
    
    // Load the zip file using fflate
    const unzipped = fflate.unzipSync(zipBytes);
    const fileNames = Object.keys(unzipped);
    
    // Find all .user.js files
    const userScripts = fileNames.filter(name => name.endsWith('.user.js'));
    const allExistingScripts = await ScriptStorage.getAll();
    const usedScriptIds = new Set(allExistingScripts.map(script => script.id));
    // Starting position for newly-imported scripts (avoids O(n²) getAll() per script)
    let _importPosition = allExistingScripts.length;

    for (const filename of userScripts) {
      try {
        const code = fflate.strFromU8(unzipped[filename]);

        // Validate it's a userscript
        if (!code.includes('==UserScript==')) {
          results.errors.push({ name: filename, error: 'Not a valid userscript' });
          continue;
        }

        const parsed = parseUserscript(code);
        if (parsed.error) {
          results.errors.push({ name: filename, error: parsed.error });
          continue;
        }

        // Look for associated options and storage files
        const baseName = filename.replace('.user.js', '');
        const optionsFileData = unzipped[`${baseName}.options.json`];
        const storageFileData = unzipped[`${baseName}.storage.json`];
        
        let enabled = true;
        let storedValues = {};
        let preferredScriptId = '';
        
        // Parse options file if exists
        if (optionsFileData) {
          try {
            const optionsData = JSON.parse(fflate.strFromU8(optionsFileData));
            enabled = optionsData.settings?.enabled !== false;
            preferredScriptId = isSafeImportedScriptId(optionsData.scriptId) ? optionsData.scriptId : '';
          } catch (e) {
            console.warn('Failed to parse options file:', e);
          }
        }
        
        // Parse storage file if exists
        if (storageFileData) {
          try {
            const storageData = JSON.parse(fflate.strFromU8(storageFileData));
            storedValues = storageData.data || storageData || {};
          } catch (e) {
            console.warn('Failed to parse storage file:', e);
          }
        }

        // Prefer ScriptVault's stable scriptId metadata when present. Name or
        // namespace can change over time, but backup restore should still
        // update the same script record.
        const existingById = preferredScriptId
          ? allExistingScripts.find(s => s.id === preferredScriptId)
          : null;
        const existing = existingById || allExistingScripts.find(s =>
          s.meta.name === parsed.meta.name &&
          (s.meta.namespace === parsed.meta.namespace || (!s.meta.namespace && !parsed.meta.namespace))
        );

        if (existing && !options.overwrite) {
          results.skipped++;
          continue;
        }
        
        // Create or update script
        let scriptId;
        if (existing?.id && isSafeImportedScriptId(existing.id)) {
          scriptId = existing.id;
        } else {
          scriptId = allocateImportedScriptId(preferredScriptId, usedScriptIds);
        }
        usedScriptIds.add(scriptId);
        const script = {
          id: scriptId,
          code: code,
          meta: parsed.meta,
          enabled: enabled,
          position: existing?.position ?? _importPosition++,
          createdAt: existing?.createdAt || Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(scriptId, script);
        
        // Import stored values
        if (Object.keys(storedValues).length > 0) {
          await ScriptValues.setAll(scriptId, storedValues);
        }
        
        results.imported++;
      } catch (e) {
        results.errors.push({ name: filename, error: e.message });
      }
    }
    
    // If no .user.js files found, try importing raw JS files
    if (userScripts.length === 0) {
      const jsFiles = fileNames.filter(name => 
        name.endsWith('.js') && !name.includes('/')
      );
      
      for (const filename of jsFiles) {
        try {
          const code = fflate.strFromU8(unzipped[filename]);
          if (!code.includes('==UserScript==')) continue;
          
          const parsed = parseUserscript(code);
          if (parsed.error) continue;
          
          const scriptId = generateId();
          await ScriptStorage.set(scriptId, {
            id: scriptId,
            code: code,
            meta: parsed.meta,
            enabled: true,
            position: _importPosition++,
            createdAt: Date.now(),
            updatedAt: Date.now()
          });
          results.imported++;
        } catch (e) {
          results.errors.push({ name: filename, error: e.message });
        }
      }
    }
    
    await updateBadge();

    // Re-register all scripts after import
    await registerAllScripts(true);

    return results;
  } catch (e) {
    console.error('[ScriptVault] importFromZip error:', e);
    return { ...results, error: e.message };
  }
}

// ============================================================================
// Message Handlers
// ============================================================================

// Regular message listener (content scripts, popup, dashboard)
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  handleMessage(message, sender)
    .then(sendResponse)
    .catch(e => {
      console.error('[ScriptVault] Unhandled message error:', e);
      sendResponse({ error: e.message });
    });
  return true;
});

// USER_SCRIPT world message listener (for GM_* APIs)
// This is SEPARATE from onMessage and required for messaging: true to work
//
// Security: userscripts are semi-trusted code. Restrict this path to the
// action set the GM_* wrapper actually needs. Without this allowlist a
// malicious userscript could invoke privileged dashboard actions like
// factoryReset, deleteScript, importScripts, or setSettings.
const USER_SCRIPT_ALLOWED_EXTRAS = new Set([
  'netlog_record',
  'reportExecError',
  'reportExecTime'
]);
function isUserScriptAllowedAction(action) {
  if (typeof action !== 'string') return false;
  if (action.startsWith('GM_') || action.startsWith('GM.')) return true;
  return USER_SCRIPT_ALLOWED_EXTRAS.has(action);
}

function normalizeConnectHost(value) {
  if (typeof value !== 'string') return '';
  let pattern = value.trim().toLowerCase();
  if (!pattern) return '';
  if (pattern === '*' || pattern === 'self' || pattern === 'localhost') return pattern;

  try {
    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(pattern)) {
      pattern = new URL(pattern.replace(/\*/g, 'x')).hostname.toLowerCase();
    }
  } catch (_) {
    // Fall through to best-effort host extraction below.
  }

  pattern = pattern.replace(/^\/\//, '').split('/')[0].split('?')[0].split('#')[0];
  if (pattern.startsWith('*.')) pattern = pattern.slice(2);
  if (pattern.startsWith('x.')) pattern = pattern.slice(2);
  if (pattern.startsWith('.')) pattern = pattern.slice(1);
  if (pattern.startsWith('[') && pattern.includes(']')) {
    pattern = pattern.slice(1, pattern.indexOf(']'));
  } else {
    pattern = pattern.split(':')[0];
  }
  return pattern;
}

function hostMatchesConnectPattern(hostname, pattern) {
  const host = normalizeConnectHost(hostname);
  const target = normalizeConnectHost(pattern);
  if (!host || !target) return false;
  if (target === 'localhost') return host === 'localhost' || host === '127.0.0.1' || host === '::1';
  return host === target || host.endsWith('.' + target);
}

function selfConnectDomains(script) {
  const patterns = [
    ...(script?.meta?.match || []),
    ...(script?.meta?.include || [])
  ];
  return patterns.map(pattern => {
    try {
      return normalizeConnectHost(new URL(String(pattern).replace(/\*/g, 'x')).hostname);
    } catch (_) {
      return '';
    }
  }).filter(Boolean);
}

function evaluateConnectPolicy(script, requestUrl) {
  let hostname;
  try {
    hostname = new URL(requestUrl).hostname;
  } catch (_) {
    return { allowed: false, error: 'Invalid URL', hostname: '' };
  }

  const connectList = Array.isArray(script?.meta?.connect) ? script.meta.connect : [];
  if (connectList.length === 0 || connectList.some(pattern => String(pattern).trim() === '*')) {
    return { allowed: true, hostname };
  }

  const selfDomains = selfConnectDomains(script);
  const allowed = connectList.some(pattern => {
    const normalized = normalizeConnectHost(pattern);
    if (normalized === 'self') {
      return selfDomains.some(domain => hostMatchesConnectPattern(hostname, domain));
    }
    return hostMatchesConnectPattern(hostname, normalized);
  });

  return {
    allowed,
    hostname,
    error: allowed ? '' : `Connection to ${hostname} blocked by @connect policy`
  };
}

if (chrome.runtime.onUserScriptMessage) {
  chrome.runtime.onUserScriptMessage.addListener((message, sender, sendResponse) => {
    if (!message || !isUserScriptAllowedAction(message.action)) {
      sendResponse({ error: 'Action not permitted from user script' });
      return false;
    }
    handleMessage(message, sender)
      .then(sendResponse)
      .catch(e => {
        console.error('[ScriptVault] Unhandled user script message error:', e);
        sendResponse({ error: e.message });
      });
    return true;
  });
  debugLog('User script message listener registered');
}

async function handleMessage(message, sender) {
  // Wait for SW init (SettingsManager/ScriptStorage) to finish before handling
  // any message. Without this, fast popup/dashboard opens after wake can hit
  // handlers with uninitialised state and return empty results or throw.
  try { await ensureInitialized(); } catch (e) { /* init failure is logged in init() */ }
  const { action } = message;
  // Support both patterns: { action, data: { ... } } and { action, prop1, prop2, ... }
  const data = message.data || message;
  
  try {
    switch (action) {
      // Script Management
      case 'getScripts': {
        const scripts = await ScriptStorage.getAll();
        // Convert meta -> metadata for dashboard compatibility
        return { scripts: scripts.map(s => ({ ...s, metadata: s.meta })) };
      }
        
      case 'getScript': {
        const script = await ScriptStorage.get(data.id);
        if (script) {
          return { ...script, metadata: script.meta };
        }
        return null;
      }
        
      case 'saveScript': {
        if (data.code && data.code.length > MAX_SCRIPT_SIZE) {
          return { error: `Script too large (${formatBytes(data.code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.` };
        }
        const parsed = parseUserscript(data.code);
        if (parsed.error) return { error: parsed.error };
        
        const id = data.id || data.scriptId || generateId();
        const existing = await ScriptStorage.get(id);
        
        const scriptSettings = { ...(existing?.settings || {}) };
        delete scriptSettings.mergeConflict;
        // Mark as locally modified when saved from editor — prevents sync from overwriting
        if (data.markModified) scriptSettings.userModified = true;

        const script = {
          ...existing,
          id,
          code: data.code,
          meta: parsed.meta,
          enabled: data.enabled !== undefined ? data.enabled : (existing?.enabled ?? true),
          settings: scriptSettings,
          position: existing?.position ?? (await ScriptStorage.getAll()).length,
          createdAt: existing?.createdAt || Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(id, script);
        await updateBadge();

        // Re-register BEFORE reloading tabs so reloaded pages pick up the new script
        await unregisterScript(id);
        if (script.enabled !== false) {
          await registerScript(script);
        }

        // Live reload takes priority over debounced auto-reload (prevents double reload)
        try {
          const lrData = await chrome.storage.local.get('liveReloadScripts');
          if (lrData.liveReloadScripts?.[id]) {
            // Force reload all matching tabs immediately (new registration already active)
            const allTabs = await chrome.tabs.query({});
            for (const tab of allTabs) {
              if (tab.url && doesScriptMatchUrl(script, tab.url)) {
                try { chrome.tabs.reload(tab.id).catch(() => {}); } catch {}
              }
            }
          } else {
            // Debounced auto-reload for normal saves (gated by settings.autoReload)
            await autoReloadMatchingTabs(script);
          }
        } catch {
          // Fallback: attempt debounced auto-reload if live-reload check failed
          await autoReloadMatchingTabs(script);
        }

        const settings = await SettingsManager.get();
        if (!existing && settings.notifyOnInstall) {
          chrome.notifications.create({
            type: 'basic',
            iconUrl: 'images/icon128.png',
            title: 'Script Installed',
            message: `${script.meta.name} v${script.meta.version}`
          });
        }
        
        // Return with metadata property for dashboard compatibility
        return { success: true, scriptId: id, script: { ...script, metadata: script.meta } };
      }
      
      case 'createScript': {
        // Create a new script - similar to saveScript but always generates new ID
        const parsed = parseUserscript(data.code);
        if (parsed.error) return { error: parsed.error };
        
        const id = generateId();
        const script = {
          id,
          code: data.code,
          meta: parsed.meta,
          enabled: true,
          position: (await ScriptStorage.getAll()).length,
          createdAt: Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(id, script);
        await updateBadge();

        // Register the new script
        await registerScript(script);
        
        const settings = await SettingsManager.get();
        if (settings.notifyOnInstall) {
          chrome.notifications.create({
            type: 'basic',
            iconUrl: 'images/icon128.png',
            title: 'Script Created',
            message: `${script.meta.name} v${script.meta.version}`
          });
        }
        
        // Return scriptId for dashboard compatibility
        return { success: true, scriptId: id, script: { ...script, metadata: script.meta } };
      }
      
      case 'deleteScript': {
        const scriptId = data.id || data.scriptId;
        if (!scriptId) return { error: 'No script ID provided' };
        const script = await ScriptStorage.get(scriptId);
        if (!script) return { error: 'Script not found' };
        const settings = await SettingsManager.get();
        const trashMode = settings.trashMode || '30';

        if (trashMode !== 'disabled') {
          // Move to trash instead of permanent delete
          const trashData = await chrome.storage.local.get('trash');
          const trash = trashData.trash || [];
          trash.push({ ...script, trashedAt: Date.now() });
          await chrome.storage.local.set({ trash });
        }

        await unregisterScript(scriptId);
        await ScriptStorage.delete(scriptId);

        // Clean up menu commands for deleted script
        try {
          const cmdData = await chrome.storage.session.get('menuCommands');
          if (cmdData?.menuCommands?.[scriptId]) {
            delete cmdData.menuCommands[scriptId];
            await chrome.storage.session.set(cmdData);
          }
        } catch {}

        // Record tombstone so sync won't re-import this script from remote
        const tombstoneData = await chrome.storage.local.get('syncTombstones');
        const tombstones = tombstoneData.syncTombstones || {};
        tombstones[scriptId] = Date.now();
        await chrome.storage.local.set({ syncTombstones: tombstones });

        await updateBadge();
        return {
          success: true,
          scriptId,
          scriptName: script.meta?.name || scriptId
        };
      }

      case 'getTrash': {
        const trashData = await chrome.storage.local.get('trash');
        const trash = trashData.trash || [];
        // Clean expired entries
        const settings = await SettingsManager.get();
        const trashMode = settings.trashMode || '30';
        const maxAge = trashMode === '1' ? 86400000 : trashMode === '7' ? 604800000 : trashMode === '30' ? 2592000000 : 0;
        const now = Date.now();
        const valid = maxAge > 0 ? trash.filter(s => now - s.trashedAt < maxAge) : trash;
        if (valid.length !== trash.length) {
          await chrome.storage.local.set({ trash: valid });
        }
        return { trash: valid };
      }

      case 'restoreFromTrash': {
        const scriptId = data.scriptId;
        const trashData = await chrome.storage.local.get('trash');
        const trash = trashData.trash || [];
        const idx = trash.findIndex(s => s.id === scriptId);
        if (idx === -1) return { error: 'Not found in trash' };

        const script = trash[idx];
        delete script.trashedAt;
        trash.splice(idx, 1);
        await chrome.storage.local.set({ trash });
        await ScriptStorage.set(script.id, script);
        if (script.enabled !== false) await registerScript(script);
        await updateBadge();
        return { success: true };
      }

      case 'emptyTrash': {
        await chrome.storage.local.set({ trash: [] });
        return { success: true };
      }

      case 'restart': {
        chrome.runtime.reload();
        return { success: true };
      }

      case 'permanentlyDelete': {
        const scriptId = data.scriptId;
        const trashData = await chrome.storage.local.get('trash');
        const trash = trashData.trash || [];
        const filtered = trash.filter(s => s.id !== scriptId);
        await chrome.storage.local.set({ trash: filtered });
        return { success: true };
      }
        
      case 'toggleScript': {
        const scriptId = data.id || data.scriptId;
        // Per-script chained lock to prevent rapid toggle race conditions
        // Each toggle chains onto the previous one, ensuring serial execution
        if (!self._toggleLocks) self._toggleLocks = new Map();
        const prev = self._toggleLocks.get(scriptId) || Promise.resolve();
        const togglePromise = prev.then(async () => {
          const script = await ScriptStorage.get(scriptId);
          if (!script) {
            return { error: 'Script not found' };
          }

          script.enabled = data.enabled !== undefined ? !!data.enabled : !script.enabled;
          script.updatedAt = Date.now();
          await ScriptStorage.set(scriptId, script);

          await unregisterScript(scriptId);
          if (script.enabled) {
            await registerScript(script);
          }

          await updateBadge();

          try {
            const tabs = await chrome.tabs.query({});
            for (const tab of tabs) {
              if (tab.url && doesScriptMatchUrl(script, tab.url)) {
                chrome.tabs.reload(tab.id).catch(() => {});
              }
            }
          } catch (e) {
            debugLog('Toggle reload failed:', e.message);
          }

          return {
            success: true,
            script: {
              id: script.id,
              enabled: script.enabled
            }
          };
        }).catch(e => {
          debugLog('Toggle error:', e);
          return { error: e?.message || 'Failed to update script' };
        }).finally(() => {
          // Clean up if this is still the latest promise (not superseded by a newer toggle)
          if (self._toggleLocks.get(scriptId) === togglePromise) {
            self._toggleLocks.delete(scriptId);
          }
        });
        self._toggleLocks.set(scriptId, togglePromise);
        return await togglePromise;
      }

      case 'importScript': {
        const parsed = parseUserscript(data.code);
        if (parsed.error) return { error: parsed.error };
        
        const id = generateId();
        const script = {
          id,
          code: data.code,
          meta: parsed.meta,
          enabled: true,
          position: (await ScriptStorage.getAll()).length,
          createdAt: Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(id, script);
        await registerScript(script);
        await updateBadge();
        // Return with metadata property for dashboard compatibility
        return { success: true, script: { ...script, metadata: script.meta } };
      }

      case 'duplicateScript': {
        const newScript = await ScriptStorage.duplicate(data.id);
        if (newScript) {
          // Honor the duplicated script's `enabled` state — duplicating a disabled
          // script was silently re-enabling it because register was unconditional.
          if (newScript.enabled !== false) {
            await registerScript(newScript);
          }
          await updateBadge();
          // Return with metadata property for dashboard compatibility
          return { success: true, script: { ...newScript, metadata: newScript.meta } };
        }
        return { error: 'Script not found' };
      }
      
      case 'searchScripts': {
        const scripts = await ScriptStorage.search(data.query);
        return { scripts: scripts.map(s => ({ ...s, metadata: s.meta })) };
      }
        
      case 'reorderScripts':
        await ScriptStorage.reorder(data.orderedIds);
        return { success: true };
        
      // Script Values
      case 'GM_getValue':
        return await ScriptValues.get(data.scriptId, data.key, data.defaultValue);
        
      case 'GM_setValue':
        return await ScriptValues.set(data.scriptId, data.key, data.value, sender.tab?.id ?? null);
        
      case 'GM_deleteValue':
        await ScriptValues.delete(data.scriptId, data.key, sender.tab?.id ?? null);
        return { success: true };

      case 'deleteScriptValue':
        await ScriptValues.delete(data.scriptId, data.key);
        return { success: true };
        
      case 'GM_listValues':
        return await ScriptValues.list(data.scriptId);
        
      case 'GM_getValues':
        return await ScriptValues.getAll(data.scriptId);
        
      case 'GM_setValues':
        await ScriptValues.setAll(data.scriptId, data.values, sender.tab?.id ?? null);
        return { success: true };
        
      case 'GM_deleteValues':
        await ScriptValues.deleteMultiple(data.scriptId, data.keys, sender.tab?.id ?? null);
        return { success: true };
        
      case 'getScriptStorage':
      case 'getScriptValues': {
        const values = await ScriptValues.getAll(data.scriptId);
        return { values };
      }
        
      case 'setScriptStorage':
        await ScriptValues.setAll(data.scriptId, data.values);
        return { success: true };
        
      case 'getStorageSize':
        return await ScriptValues.getStorageSize(data.scriptId);
        
      // Tab Storage
      case 'GM_getTab':
        if (!sender.tab?.id) return {};
        return TabStorage.get(sender.tab.id);
        
      case 'GM_saveTab':
        if (!sender.tab?.id) return { error: 'GM_saveTab requires a tab context' };
        TabStorage.set(sender.tab.id, data.data);
        return { success: true };
        
      case 'GM_getTabs':
        return TabStorage.getAll();
        
      // Settings
      case 'prefetchResources': {
        await ResourceCache.prefetchResources(data.resources);
        return { success: true };
      }

      case 'getSettings': {
        const settings = await SettingsManager.get();
        return { settings };
      }

      case 'getExtensionStatus': {
        const ver = _getChromeVersion();
        // Live probe — the cached flag in settings can drift after the user
        // toggles "Allow User Scripts" in chrome://extensions because Chrome
        // doesn't always cycle the SW. Trust the runtime check, then refresh
        // the cache so other paths agree.
        let userScriptsAvailable = !!chrome.userScripts;
        if (userScriptsAvailable) {
          try {
            await chrome.userScripts.getScripts();
          } catch (e) {
            userScriptsAvailable = false;
          }
        }
        if (userScriptsAvailable) {
          await SettingsManager.set({ _userScriptsAvailable: true, _chromeVersion: ver });
          // The toggle may have flipped on while the SW was already running —
          // configure the world now so script registration works on next save.
          try { await configureUserScriptsWorld(); } catch (e) {}
        } else {
          await SettingsManager.set({ _userScriptsAvailable: false, _chromeVersion: ver });
        }
        let setupRequired = false;
        let setupMessage = '';
        if (!userScriptsAvailable) {
          setupRequired = true;
          if (ver >= 138) {
            setupMessage = 'Enable "Allow User Scripts" for ScriptVault in chrome://extensions';
          } else if (ver >= 120) {
            setupMessage = 'Enable Developer Mode in chrome://extensions to run userscripts';
          } else {
            setupMessage = 'Chrome 120 or newer is required';
          }
        }
        return { userScriptsAvailable, setupRequired, setupMessage, chromeVersion: ver };
      }

      case 'repairRuntimeState': {
        try {
          await configureUserScriptsWorld();
          await setupContextMenus();
          await registerAllScripts(true);
          await updateBadge();
          await setupAlarms();

          const settings = await SettingsManager.get();
          const ver = settings._chromeVersion || _getChromeVersion();
          const userScriptsAvailable = settings._userScriptsAvailable !== false && !!chrome.userScripts;
          let setupRequired = false;
          let setupMessage = '';
          if (!userScriptsAvailable) {
            setupRequired = true;
            if (ver >= 138) {
              setupMessage = 'Enable "Allow User Scripts" for ScriptVault in chrome://extensions';
            } else if (ver >= 120) {
              setupMessage = 'Enable Developer Mode in chrome://extensions to run userscripts';
            } else {
              setupMessage = 'Chrome 120 or newer is required';
            }
          }
          return { success: true, userScriptsAvailable, setupRequired, setupMessage, chromeVersion: ver };
        } catch (error) {
          return { success: false, error: error?.message || 'Runtime repair failed' };
        }
      }
        
      case 'getSetting':
        return await SettingsManager.get(data.key);
        
      case 'setSettings': {
        const oldSettings = await SettingsManager.get();
        const result = await SettingsManager.set(data.settings);
        const changed = data.settings;

        // If global enabled state changed, re-register all scripts
        if ('enabled' in changed && changed.enabled !== oldSettings.enabled) {
          await registerAllScripts(true);
        }

        // If update/sync intervals changed, reconfigure alarms
        if ('checkInterval' in changed || 'autoUpdate' in changed ||
            'syncEnabled' in changed || 'syncProvider' in changed || 'syncInterval' in changed) {
          await setupAlarms();
        }

        // If badge settings changed, refresh badge
        if ('badgeColor' in changed || 'badgeInfo' in changed || 'showBadge' in changed) {
          await updateBadge();
        }

        // If context menu setting changed, rebuild menus
        if ('enableContextMenu' in changed) {
          await setupContextMenus();
        }

        // If page filter settings changed, re-register scripts
        if ('pageFilterMode' in changed || 'whitelistedPages' in changed ||
            'blacklistedPages' in changed || 'deniedHosts' in changed) {
          await registerAllScripts(true);
        }

        return result;
      }
        
      case 'resetSettings':
        return await SettingsManager.reset();
        
      // Updates
      case 'checkUpdates':
        return await UpdateSystem.checkForUpdates(data?.scriptId);

      // Phase 12.10 — recently-applied updates for the in-app dashboard banner.
      case 'getRecentUpdates':
        return UpdateSystem.getRecentUpdates();

      case 'clearRecentUpdates':
        UpdateSystem.clearRecentUpdates();
        return { success: true };

      case 'forceUpdate': {
        // Force re-download bypassing HTTP cache
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (!script) return { error: 'Script not found' };
        const downloadUrl = script.meta.downloadURL || script.meta.updateURL;
        if (!downloadUrl) return { error: 'No download URL configured' };
        try {
          const { response, code: newCode } = await UpdateSystem.fetchUpdateCandidate(downloadUrl, {
            cache: 'no-store',
            headers: { 'Cache-Control': 'no-cache', 'Pragma': 'no-cache' }
          });
          if (!response.ok) return { error: `HTTP ${response.status}` };
          const parsed = parseUserscript(newCode);
          if (parsed.error) return parsed;
          // Apply as update (force=true bypasses userModified guard)
          return await UpdateSystem.applyUpdate(scriptId, newCode, { force: true });
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'applyUpdate':
        return await UpdateSystem.applyUpdate(data.scriptId, data.code);

      case 'getVersionHistory': {
        const script = await ScriptStorage.get(data.scriptId);
        return { history: script?.versionHistory || [] };
      }

      case 'rollbackScript': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };
        if (!script.versionHistory || script.versionHistory.length === 0) {
          return { error: 'No version history available' };
        }
        const targetIdx = data.index !== undefined ? data.index : script.versionHistory.length - 1;
        const target = script.versionHistory[targetIdx];
        if (!target) return { error: 'Version not found' };

        const parsed = parseUserscript(target.code);
        if (parsed.error) return parsed;

        // Save current version before rolling back (so user can undo the rollback)
        script.versionHistory.push({
          version: script.meta.version,
          code: script.code,
          updatedAt: script.updatedAt || Date.now()
        });
        // Remove the target entry we're rolling back to (prevents duplicates)
        script.versionHistory.splice(targetIdx, 1);
        // Trim to last 5 versions
        if (script.versionHistory.length > 5) {
          script.versionHistory = script.versionHistory.slice(-5);
        }

        script.code = target.code;
        script.meta = parsed.meta;
        script.updatedAt = Date.now();

        await ScriptStorage.set(data.scriptId, script);
        await unregisterScript(data.scriptId);
        if (script.enabled !== false) {
          await registerScript(script);
        }
        return { success: true, script: { ...script, metadata: script.meta } };
      }

      // Sync
      case 'sync': {
        const result = await CloudSync.sync();
        // Phase 39.26 — persist last-sync outcome so the dashboard's sync chip
        // can render "Last sync: 5 min ago — OK" without requiring a separate
        // round-trip on every popup open.
        try {
          await chrome.storage.local.set({
            lastSyncResult: {
              timestamp: Date.now(),
              ok: !!(result?.success || result?.skipped),
              skipped: !!result?.skipped,
              error: result?.error || null
            }
          });
        } catch (_e) { /* non-critical */ }
        return result;
      }

      case 'testSync': {
        // Phase 39.26 — VM #2486: explicit Test Connection with structured
        // status. Accept an optional `data.provider` override so the dashboard
        // can test a provider not currently selected (e.g. "verify the new
        // WebDAV URL before saving").
        const settings = await SettingsManager.get();
        const providerName = data?.provider || settings.syncProvider;
        const provider = CloudSync.providers[providerName];
        if (!provider) {
          return { ok: false, error: `Unknown provider: ${providerName}` };
        }
        try {
          const raw = await provider.test(settings);
          // Providers vary in return shape — normalize to { ok, error?, hint? }.
          if (typeof raw === 'boolean') return { ok: raw };
          if (raw && typeof raw === 'object') {
            const ok = raw.success === true || raw.ok === true;
            const error = raw.error || raw.message || null;
            const hint = !ok ? (
              error?.toLowerCase().includes('401') ? 'Authentication failed — re-connect the account.' :
              error?.toLowerCase().includes('403') ? 'Server rejected the credentials — check the user has write access.' :
              error?.toLowerCase().includes('404') ? 'Endpoint not found — verify the URL.' :
              error?.toLowerCase().includes('network') ? 'Network error — check connectivity and CORS.' :
              null
            ) : null;
            return hint ? { ok, error, hint } : { ok, error };
          }
          return { ok: false, error: 'Provider returned no status' };
        } catch (e) {
          return { ok: false, error: e?.message || String(e) };
        }
      }

      case 'getLastSyncResult':
        return (await chrome.storage.local.get('lastSyncResult'))?.lastSyncResult || null;
      
      // Cloud Sync Provider Management
      case 'connectSyncProvider': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider' };
        
        try {
          const settings = await SettingsManager.get();
          const result = await provider.connect(settings);
          
          if (result.success) {
            const updates = {};
            if (providerName === 'googledrive') {
              updates.googleDriveConnected = true;
              updates.googleDriveUser = result.user;
            } else if (providerName === 'dropbox') {
              updates.dropboxToken = result.token;
              updates.dropboxRefreshToken = result.refreshToken || '';
              if (result.user) updates.dropboxUser = result.user;
              // Fetch user info after connecting
              const status = await provider.getStatus({ dropboxToken: result.token });
              if (status.user) updates.dropboxUser = status.user;
            }
            updates.syncProvider = providerName;
            await SettingsManager.set(updates);
          }
          return result;
        } catch (e) {
          return { success: false, error: e.message };
        }
      }
      
      case 'disconnectSyncProvider': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider' };
        
        try {
          const settings = await SettingsManager.get();
          await provider.disconnect(settings);
          
          const updates = { syncProvider: 'none' };
          if (providerName === 'googledrive') {
            updates.googleDriveConnected = false;
            updates.googleDriveUser = null;
          } else if (providerName === 'dropbox') {
            updates.dropboxToken = '';
            updates.dropboxRefreshToken = '';
            updates.dropboxUser = null;
          } else if (providerName === 'onedrive') {
            updates.onedriveToken = '';
            updates.onedriveRefreshToken = '';
            updates.onedriveConnected = false;
            updates.onedriveUser = null;
          }
          await SettingsManager.set(updates);
          return { success: true };
        } catch (e) {
          return { success: false, error: e.message };
        }
      }
      
      case 'getSyncProviderStatus': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { connected: false };
        
        const settings = await SettingsManager.get();
        if (provider.getStatus) {
          return await provider.getStatus(settings);
        }
        return { connected: false };
      }
      
      case 'syncNow': {
        return await CloudSync.sync();
      }

      case 'cloudExport': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider: ' + providerName };

        try {
          const includeSettings = data?.includeSettings !== false;
          const includeStorage = data?.includeStorage !== false;
          const exportData = await exportAllScripts({ includeSettings, includeStorage });
          const settings = await SettingsManager.get();
          await provider.upload(exportData, settings);
          return {
            success: true,
            exported: exportData.scripts?.length || 0,
            settingsIncluded: includeSettings,
            storageIncluded: includeStorage
          };
        } catch (e) {
          return { success: false, error: e.message };
        }
      }

      case 'cloudImport': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider: ' + providerName };

        try {
          const settings = await SettingsManager.get();
          const remoteData = await provider.download(settings);
          if (!remoteData) return { success: false, error: 'No backup found on ' + providerName };
          const result = await importScripts(remoteData, {
            overwrite: true,
            importSettings: data?.importSettings === true,
            importStorage: data?.importStorage !== false
          });
          return { success: !result.error, ...result };
        } catch (e) {
          return { success: false, error: e.message };
        }
      }

      case 'cloudStatus': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { connected: false };

        try {
          const settings = await SettingsManager.get();
          if (provider.getStatus) return await provider.getStatus(settings);
          return { connected: false };
        } catch (e) {
          return { connected: false, error: e.message };
        }
      }

      // Values Editor - Get all scripts' values
      case 'getAllScriptsValues': {
        const scripts = await ScriptStorage.getAll();
        const allValuesResults = await Promise.all(scripts.map(s => ScriptValues.getAll(s.id)));
        const allValues = {};
        scripts.forEach((script, i) => {
          const values = allValuesResults[i];
          if (values && Object.keys(values).length > 0) {
            allValues[script.id] = {
              scriptName: script.meta?.name || 'Unknown Script',
              values
            };
          }
        });
        return { allValues };
      }
      
      // Values Editor - Set a single value
      case 'setScriptValue': {
        await ScriptValues.set(data.scriptId, data.key, data.value);
        return { success: true };
      }
      
      // Values Editor - Clear all values for a script
      case 'clearScriptStorage': {
        await ScriptValues.deleteAll(data.scriptId);
        return { success: true };
      }

      // Values Editor - Rename a key
      case 'renameScriptValue': {
        const { scriptId, oldKey, newKey } = data;
        if (!scriptId || !oldKey || !newKey || oldKey === newKey) return { error: 'Invalid rename parameters' };
        const current = await ScriptValues.get(scriptId, oldKey);
        if (current === undefined) return { error: 'Key not found' };
        const existingNew = await ScriptValues.get(scriptId, newKey);
        if (existingNew !== undefined) return { error: `Key "${newKey}" already exists` };
        await ScriptValues.set(scriptId, newKey, current);
        await ScriptValues.delete(scriptId, oldKey);
        return { success: true };
      }
      
      // Per-Script Settings
      case 'getScriptSettings': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };
        return { settings: script.settings || {} };
      }
      
      case 'setScriptSettings': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };

        const oldSettings = script.settings || {};
        const oldEnabled = script.enabled;
        script.settings = { ...oldSettings, ...data.settings };
        script.updatedAt = Date.now();

        // Handle enabled change BEFORE saving (from sidepanel toggle)
        if ('enabled' in data.settings) {
          script.enabled = !!data.settings.enabled;
        }

        // Persist ALL changes including enabled state
        await ScriptStorage.set(data.scriptId, script);

        // If enabled state changed, re-register and reload tabs
        if ('enabled' in data.settings && script.enabled !== oldEnabled) {
          await unregisterScript(data.scriptId);
          if (script.enabled) {
            await registerScript(script);
          }
          await updateBadge();
          try {
            const tabs = await chrome.tabs.query({});
            for (const tab of tabs) {
              if (tab.url && doesScriptMatchUrl(script, tab.url)) {
                chrome.tabs.reload(tab.id).catch(() => {});
              }
            }
          } catch {}
          return { success: true };
        }

        // Only re-register if execution-affecting settings changed.
        // Guard with `k in data.settings` — otherwise comparing `oldSettings[k]`
        // against `undefined` (from an unrelated partial update) triggers a needless
        // re-register cycle every time any other setting is changed.
        const EXEC_KEYS = ['runAt', 'injectInto', 'useOriginalMatches', 'useOriginalIncludes',
                           'useOriginalExcludes', 'userMatches', 'userIncludes', 'userExcludes'];
        const needsReregister = EXEC_KEYS.some(k =>
          k in data.settings &&
          JSON.stringify(oldSettings[k]) !== JSON.stringify(data.settings[k])
        );
        if (needsReregister && script.enabled !== false) {
          await unregisterScript(data.scriptId);
          await registerScript(script);
        }

        return { success: true };
      }
      
      // Import/Export
      case 'exportAll':
        return await exportAllScripts(data?.options || {});
        
      case 'importAll':
        return await importScripts(data.data, data.options);

      case 'importTampermonkeyBackup': {
        // Parse Tampermonkey .txt backup format
        // Format: multiple scripts separated by blank lines, each with ==UserScript== blocks
        const text = data.text || '';
        const scriptBlocks = [];
        // Split on double newlines that precede ==UserScript== headers
        const parts = text.split(/\n\s*\n(?=\/\/\s*==UserScript==)/);
        for (const part of parts) {
          const trimmed = part.trim();
          if (trimmed.includes('==UserScript==') && trimmed.includes('==/UserScript==')) {
            scriptBlocks.push(trimmed);
          }
        }
        if (scriptBlocks.length === 0) {
          return { error: 'No valid userscripts found in backup file' };
        }
        const results = { imported: 0, skipped: 0, errors: [] };
        const allExisting = await ScriptStorage.getAll();
        let nextPosition = allExisting.length;
        for (const code of scriptBlocks) {
          try {
            const parsed = parseUserscript(code);
            if (parsed.error) { results.errors.push({ error: parsed.error }); continue; }
            const existing = allExisting.find(s =>
              s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
            );
            if (existing && !data.overwrite) { results.skipped++; continue; }
            const id = existing?.id || generateId();
            await ScriptStorage.set(id, {
              id, code, meta: parsed.meta,
              enabled: true,
              position: existing?.position ?? nextPosition++,
              createdAt: existing?.createdAt || Date.now(),
              updatedAt: Date.now()
            });
            results.imported++;
          } catch (e) {
            results.errors.push({ error: e.message });
          }
        }
        await registerAllScripts(true);
        await updateBadge();
        return results;
      }

      // v2.0: Storage Quota
      case 'getStorageUsage': {
        if (typeof QuotaManager !== 'undefined') return await QuotaManager.getUsage();
        return { bytesUsed: 0, quota: 10485760, percentage: 0, level: 'ok' };
      }
      case 'getStorageBreakdown': {
        if (typeof QuotaManager !== 'undefined') return await QuotaManager.getBreakdown();
        return {};
      }
      case 'cleanupStorage': {
        if (typeof QuotaManager !== 'undefined') return await QuotaManager.cleanup(data.options || {});
        return { freedBytes: 0, actions: [] };
      }

      // v2.0: Backup Scheduler
      case 'createBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.createBackup(data.reason || 'manual');
        return { error: 'BackupScheduler not available' };
      }
      case 'getBackups': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.getBackups();
        return { backups: [] };
      }
      case 'restoreBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.restoreBackup(data.backupId, data.options);
        return { error: 'BackupScheduler not available' };
      }
      case 'deleteBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.deleteBackup(data.backupId);
        return { error: 'BackupScheduler not available' };
      }
      case 'importBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.importBackup(data.zipData);
        return { error: 'BackupScheduler not available' };
      }
      case 'exportBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.exportBackup(data.backupId);
        return { error: 'BackupScheduler not available' };
      }
      case 'inspectBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.inspectBackup(data.backupId);
        return { error: 'BackupScheduler not available' };
      }
      case 'getBackupSettings': {
        if (typeof BackupScheduler !== 'undefined') return BackupScheduler.getSettings();
        return {};
      }
      case 'setBackupSettings': {
        if (typeof BackupScheduler !== 'undefined') {
          const settings = await BackupScheduler.setSettings(data.settings);
          return { success: true, settings };
        }
        return { error: 'BackupScheduler not available' };
      }

      // v2.0: Script Analytics
      // v2.0: Profiles
      case 'getProfiles': {
        const pData = await chrome.storage.local.get(['profiles', 'activeProfileId']);
        return { profiles: pData.profiles || [], activeProfileId: pData.activeProfileId || null };
      }
      case 'switchProfile': {
        const pData2 = await chrome.storage.local.get('profiles');
        const profiles = pData2.profiles || [];
        const profile = profiles.find(p => p.id === data.profileId);
        if (!profile) return { error: 'Profile not found' };
        // Apply script states from profile (parallel writes)
        const scripts = await ScriptStorage.getAll();
        const updates = [];
        for (const script of scripts) {
          const newEnabled = profile.scriptStates?.[script.id] ?? script.enabled;
          if (script.enabled !== newEnabled) {
            script.enabled = newEnabled;
            updates.push(ScriptStorage.set(script.id, script));
          }
        }
        if (updates.length) await Promise.all(updates);
        await chrome.storage.local.set({ activeProfileId: data.profileId });
        await registerAllScripts(true);
        await updateBadge();
        return { success: true };
      }
      case 'saveProfile': {
        const pData3 = await chrome.storage.local.get('profiles');
        const profiles3 = pData3.profiles || [];
        const idx = profiles3.findIndex(p => p.id === data.profile.id);
        if (idx >= 0) profiles3[idx] = data.profile;
        else profiles3.push(data.profile);
        await chrome.storage.local.set({ profiles: profiles3 });
        return { success: true };
      }
      case 'deleteProfile': {
        const pData4 = await chrome.storage.local.get(['profiles', 'activeProfileId']);
        const profiles4 = (pData4.profiles || []).filter(p => p.id !== data.profileId);
        const updates = { profiles: profiles4 };
        if (pData4.activeProfileId === data.profileId) updates.activeProfileId = null;
        await chrome.storage.local.set(updates);
        return { success: true };
      }

      // v2.0: Collections
      case 'getCollections': {
        const cData = await chrome.storage.local.get('scriptCollections');
        return { collections: cData.scriptCollections || [] };
      }
      case 'saveCollection': {
        const cData2 = await chrome.storage.local.get('scriptCollections');
        const collections = cData2.scriptCollections || [];
        const cidx = collections.findIndex(c => c.id === data.collection.id);
        if (cidx >= 0) collections[cidx] = data.collection;
        else collections.push(data.collection);
        await chrome.storage.local.set({ scriptCollections: collections });
        return { success: true };
      }
      case 'deleteCollection': {
        const cData3 = await chrome.storage.local.get('scriptCollections');
        const collections3 = (cData3.scriptCollections || []).filter(c => c.id !== data.collectionId);
        await chrome.storage.local.set({ scriptCollections: collections3 });
        return { success: true };
      }

      // v2.0: CSP Reports
      case 'reportCSPFailure': {
        const cspData = await chrome.storage.local.get('cspReports');
        let reports = cspData.cspReports || [];
        reports.push({ url: data.url, scriptId: data.scriptId, directive: data.directive, timestamp: Date.now() });
        // Keep last 500 reports (slice is cheaper than splice-from-head)
        if (reports.length > 510) reports = reports.slice(-500);
        await chrome.storage.local.set({ cspReports: reports });
        return { success: true };
      }
      case 'getCSPReports': {
        const cspData2 = await chrome.storage.local.get('cspReports');
        return { reports: cspData2.cspReports || [] };
      }

      // v2.0: Gist Integration
      case 'getGistSettings': {
        const gData = await chrome.storage.local.get('gistSettings');
        return gData.gistSettings || {};
      }
      case 'saveGistSettings': {
        await chrome.storage.local.set({ gistSettings: data.settings });
        return { success: true };
      }

      // v2.0: Violentmonkey backup import
      case 'importViolentmonkeyBackup': {
        // VM exports as ZIP containing individual .user.js files + a violentmonkey JSON
        // Or as individual .user.js files pasted as text
        const text = data.text || '';
        const results = { imported: 0, skipped: 0, errors: [] };

        // Try JSON format first (VM settings export)
        try {
          const vmData = JSON.parse(text);
          if (vmData.scripts && Array.isArray(vmData.scripts)) {
            const allExistingVM = await ScriptStorage.getAll();
            let nextPosVM = allExistingVM.length;
            for (const vmScript of vmData.scripts) {
              try {
                const code = vmScript.code || vmScript.custom?.code || '';
                if (!code) { results.skipped++; continue; }
                const parsed = parseUserscript(code);
                if (parsed.error) { results.errors.push({ name: vmScript.props?.name, error: parsed.error }); continue; }
                const existing = allExistingVM.find(s =>
                  s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
                );
                if (existing && !data.overwrite) { results.skipped++; continue; }
                const id = existing?.id || generateId();
                await ScriptStorage.set(id, {
                  id, code, meta: parsed.meta,
                  enabled: vmScript.config?.enabled !== false,
                  position: existing?.position ?? nextPosVM++,
                  createdAt: existing?.createdAt || Date.now(),
                  updatedAt: Date.now()
                });
                results.imported++;
              } catch (e) {
                results.errors.push({ error: e.message });
              }
            }
            await registerAllScripts(true);
            await updateBadge();
            return results;
          }
        } catch { /* Not JSON — try text format */ }

        // Fallback: same as Tampermonkey text format
        const allExistingVMFB = await ScriptStorage.getAll();
        let nextPosVMFB = allExistingVMFB.length;
        const parts = text.split(/\n\s*\n(?=\/\/\s*==UserScript==)/);
        for (const part of parts) {
          const trimmed = part.trim();
          if (trimmed.includes('==UserScript==') && trimmed.includes('==/UserScript==')) {
            try {
              const parsed = parseUserscript(trimmed);
              if (parsed.error) { results.errors.push({ error: parsed.error }); continue; }
              const existing = allExistingVMFB.find(s =>
                s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
              );
              if (existing && !data.overwrite) { results.skipped++; continue; }
              const id = existing?.id || generateId();
              await ScriptStorage.set(id, {
                id, code: trimmed, meta: parsed.meta,
                enabled: true,
                position: existing?.position ?? nextPosVMFB++,
                createdAt: existing?.createdAt || Date.now(),
                updatedAt: Date.now()
              });
              results.imported++;
            } catch (e) {
              results.errors.push({ error: e.message });
            }
          }
        }
        await registerAllScripts(true);
        await updateBadge();
        return results;
      }

      // v2.0: Greasemonkey backup import (GM4 JSON format)
      case 'importGreasemonkeyBackup': {
        const text = data.text || '';
        const results = { imported: 0, skipped: 0, errors: [] };
        try {
          const gmData = JSON.parse(text);
          // GM4 exports as array of script objects
          const scripts = Array.isArray(gmData) ? gmData : (gmData.scripts || []);
          const allExistingGM = await ScriptStorage.getAll();
          let nextPosGM = allExistingGM.length;
          for (const gmScript of scripts) {
            try {
              const code = gmScript.source || gmScript.code || gmScript.content || '';
              if (!code) { results.skipped++; continue; }
              const parsed = parseUserscript(code);
              if (parsed.error) { results.errors.push({ name: gmScript.name, error: parsed.error }); continue; }
              const existing = allExistingGM.find(s =>
                s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
              );
              if (existing && !data.overwrite) { results.skipped++; continue; }
              const id = existing?.id || generateId();
              await ScriptStorage.set(id, {
                id, code, meta: parsed.meta,
                enabled: gmScript.enabled !== false,
                position: existing?.position ?? nextPosGM++,
                createdAt: existing?.createdAt || Date.now(),
                updatedAt: Date.now()
              });
              results.imported++;
            } catch (e) {
              results.errors.push({ error: e.message });
            }
          }
        } catch (e) {
          return { error: 'Invalid Greasemonkey backup format: ' + e.message };
        }
        await registerAllScripts(true);
        await updateBadge();
        return results;
      }

      case 'exportZip':
        return await exportToZip(data?.options || {});

      // Folders
      // Workspaces
      case 'getWorkspaces':
        return await WorkspaceManager.getAll();

      case 'createWorkspace':
        return { workspace: await WorkspaceManager.create(data.name) };

      case 'saveWorkspace': {
        const workspace = await WorkspaceManager.save(data.id);
        return workspace
          ? { success: true, workspace }
          : { error: 'Workspace not found' };
      }

      case 'activateWorkspace':
        return await WorkspaceManager.activate(data.id);

      case 'updateWorkspace':
        return { workspace: await WorkspaceManager.update(data.id, data.updates) };

      case 'deleteWorkspace': {
        const workspace = await WorkspaceManager.delete(data.id);
        return workspace
          ? { success: true, workspace }
          : { error: 'Workspace not found' };
      }

      // Network Log — returns flat array (limit optional) + stats
      case 'getNetworkLog': {
        const filters = typeof data === 'object' && data ? data : {};
        const log = NetworkLog.getAll(filters);
        const stats = NetworkLog.getStats();
        // Support both flat-array callers (DevTools) and object callers (dashboard)
        return log; // stats available via getNetworkLogStats
      }

      case 'getNetworkLogStats':
        return NetworkLog.getStats();

      case 'clearNetworkLog':
        NetworkLog.clear(data?.scriptId);
        return { success: true };

      // Record a network request from the in-page proxy (fetch/XHR/WebSocket/sendBeacon)
      case 'netlog_record':
        NetworkLog.add({
          method: data.method || 'GET',
          url: data.url || '',
          status: data.status,
          statusText: data.statusText,
          duration: data.duration,
          responseSize: data.responseSize,
          responseHeaders: data.responseHeaders,
          scriptId: data.scriptId,
          scriptName: data.scriptName,
          error: data.error,
          type: data.type || 'fetch'
        });
        return { ok: true };

      // Static Analysis — routes through offscreen document for AST analysis
      case 'analyzeScript': {
        const code = data.code || '';
        return ScriptAnalyzer.analyzeAsync(code);
      }

      // ── Script Signing (Ed25519) ──────────────────────────────────────────
      case 'signing_getPublicKey':
        return { publicKey: await ScriptSigning.getPublicKeyJwk() };

      case 'signing_sign': {
        if (!data.code) return { error: 'No code provided' };
        return ScriptSigning.signAndEmbedInCode(data.code);
      }

      case 'signing_verify': {
        if (!data.code) return { error: 'No code provided' };
        return ScriptSigning.verifyCodeSignature(data.code);
      }

      case 'signing_verifyRaw': {
        if (!data.code || !data.signatureInfo) return { error: 'Missing inputs' };
        return ScriptSigning.verifyScript(data.code, data.signatureInfo);
      }

      case 'signing_trustKey': {
        if (!data.publicKey) return { error: 'No public key' };
        return ScriptSigning.trustKey(data.publicKey, data.name);
      }

      case 'signing_untrustKey': {
        if (!data.publicKey) return { error: 'No public key' };
        return ScriptSigning.untrustKey(data.publicKey);
      }

      case 'signing_getTrustedKeys':
        return { keys: await ScriptSigning.getTrustedKeys() };

      case 'publicApi_getTrustedOrigins':
        if (typeof PublicAPI === 'undefined') return { origins: [] };
        return { origins: PublicAPI.getTrustedOrigins() };

      case 'publicApi_setTrustedOrigins':
        if (typeof PublicAPI === 'undefined') return { error: 'Public API controls unavailable' };
        await PublicAPI.setTrustedOrigins(Array.isArray(data.origins) ? data.origins : []);
        return { success: true, origins: PublicAPI.getTrustedOrigins() };

      case 'publicApi_getPermissions':
        if (typeof PublicAPI === 'undefined') return { permissions: {} };
        return { permissions: PublicAPI.getPermissions() };

      case 'publicApi_getAuditLog':
        if (typeof PublicAPI === 'undefined') return { entries: [] };
        return { entries: PublicAPI.getAuditLog(data.limit || 50) };

      case 'publicApi_clearAuditLog':
        if (typeof PublicAPI === 'undefined') return { error: 'Public API controls unavailable' };
        await PublicAPI.clearAuditLog();
        return { success: true };

      case 'signing_generateNewKeypair':
        return ScriptSigning.generateAndStoreKeypair();

      case 'getFolders':
        return { folders: await FolderStorage.getAll() };

      case 'createFolder':
        return { folder: await FolderStorage.create(data.name, data.color) };

      case 'updateFolder':
        return { folder: await FolderStorage.update(data.id, data.updates) };

      case 'deleteFolder':
        await FolderStorage.delete(data.id);
        return { success: true };

      case 'addScriptToFolder':
        await FolderStorage.addScript(data.folderId, data.scriptId);
        return { success: true };

      case 'removeScriptFromFolder':
        await FolderStorage.removeScript(data.folderId, data.scriptId);
        return { success: true };

      case 'moveScriptToFolder':
        await FolderStorage.moveScript(data.scriptId, data.fromFolderId, data.toFolderId);
        return { success: true };

      case 'importFromZip':
        return await importFromZip(data.zipData, data.options || {});
      
      case 'installFromUrl':
        return await installFromUrl(data.url);

      case 'installFromCode':
        return await installFromCode(data.code);
        
      // Resources
      case 'fetchResource':
        return await ResourceCache.fetchResource(data.url);

      case 'GM_getResourceText': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script || !script.meta.resource) return null;
        const url = script.meta.resource[data.name];
        if (!url) return null;
        try {
          return await ResourceCache.fetchResource(url);
        } catch (e) {
          return null;
        }
      }

      case 'GM_getResourceURL': {
        const script2 = await ScriptStorage.get(data.scriptId);
        if (!script2 || !script2.meta.resource) return null;
        const url2 = script2.meta.resource[data.name];
        if (!url2) return null;
        try {
          return await ResourceCache.getDataUri(url2);
        } catch (e) {
          return null;
        }
      }

      // GM_loadScript - Fetch a script URL and return its source code
      // Allows userscripts to dynamically load libraries at runtime
      case 'GM_loadScript': {
        try {
          if (!data.url) return { error: 'No URL provided' };
          if (!data.scriptId) return { error: 'Missing script context' };
          const lsScript = await ScriptStorage.get(data.scriptId);
          if (!lsScript) return { error: 'Script context not found' };

          // Enforce @connect for GM_loadScript (same rules as GM_xmlhttpRequest)
          const lsPolicy = evaluateConnectPolicy(lsScript, data.url);
          if (!lsPolicy.allowed) {
            return { error: lsPolicy.error };
          }

          const controller = new AbortController();
          const timeoutId = setTimeout(() => controller.abort(), data.timeout || 30000);
          let code;
          try {
            const response = await fetch(data.url, { signal: controller.signal });
            if (!response.ok) return { error: `HTTP ${response.status}` };
            const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
            if (contentLength > MAX_SCRIPT_SIZE) {
              return { error: `Script too large (${formatBytes(contentLength)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.` };
            }
            code = await response.text();
          } finally {
            clearTimeout(timeoutId);
          }
          if (!code || code.length === 0) return { error: 'Empty response' };
          if (code.length > MAX_SCRIPT_SIZE) {
            return { error: `Script too large (${formatBytes(code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.` };
          }
          return { code };
        } catch (e) {
          return { error: e.message || 'Fetch failed' };
        }
      }

      // XHR - Using fetch() since XMLHttpRequest is not available in Service Workers
      // Provides abort support via AbortController and simulates events
      case 'GM_xmlhttpRequest': {
        try {
          if (!data.url) {
            return { error: 'No URL provided', type: 'error' };
          }

          if (!data.scriptId) {
            return { error: 'Missing script context', type: 'error' };
          }
          const xhrScript = await ScriptStorage.get(data.scriptId);
          if (!xhrScript) {
            return { error: 'Script context not found', type: 'error' };
          }

          // @connect enforcement
          const connectPolicy = evaluateConnectPolicy(xhrScript, data.url);
          if (!connectPolicy.allowed) {
            if (connectPolicy.hostname) {
              console.warn(`[ScriptVault] @connect blocked: ${connectPolicy.hostname} not in allowed list for ${xhrScript.meta.name}`);
            }
            return { error: connectPolicy.error, type: 'error' };
          }

          const tabId = sender.tab?.id;
          const request = XhrManager.create(tabId, data.scriptId, data);
          const { id: requestId } = request;

          // Log to network log
          const _netLogStartTime = Date.now();
          const _netLogEntry = {
            scriptId: data.scriptId,
            scriptName: '',
            method: (data.method || 'GET').toUpperCase(),
            url: data.url,
            requestSize: data.data ? (typeof data.data === 'string' ? data.data.length : 0) : 0
          };
          // Resolve script name
          try {
            const _xhrScript = await ScriptStorage.get(data.scriptId);
            _netLogEntry.scriptName = _xhrScript?.meta?.name || data.scriptId;
          } catch {};
          
          // Create AbortController for this request
          const controller = new AbortController();
          request.controller = controller;
          
          // Function to send event to content script
          const sendEvent = (type, eventData = {}) => {
            if (request.aborted && type !== 'abort') return;
            
            try {
              chrome.tabs.sendMessage(tabId, {
                action: 'xhrEvent',
                data: {
                  requestId,
                  scriptId: data.scriptId,
                  type,
                  ...eventData
                }
              }).catch(() => {});
            } catch (e) {
              // Tab might be closed
            }
          };
          
          // Build fetch options via the shared helper so the noCache /
          // redirect / credentials translation rules stay unit-testable.
          // No 'mode' override — Chrome extensions with <all_urls> host
          // permissions bypass CORS automatically. Forcing mode:'cors'
          // breaks requests to servers that don't echo the extension origin
          // (e.g. localhost with null CORS).
          const method = String(data.method || 'GET').toUpperCase();
          const fetchOptions = XhrManager.buildFetchOptions(data);
          fetchOptions.signal = controller.signal;

          // Add body for non-GET/HEAD requests; deserialize tagged body objects
          if (data.data && method !== 'GET' && method !== 'HEAD') {
            const rawBody = data.data;
            if (rawBody && typeof rawBody === 'object' && !ArrayBuffer.isView(rawBody) && !(rawBody instanceof ArrayBuffer)) {
              if (rawBody.__sv_blob__) {
                const bytes = Uint8Array.from(atob(rawBody.b64), c => c.charCodeAt(0));
                fetchOptions.body = rawBody.name
                  ? new File([bytes], rawBody.name, { type: rawBody.type || '' })
                  : new Blob([bytes], { type: rawBody.type || '' });
              } else if (rawBody.__sv_formdata__) {
                const fd = new FormData();
                for (const entry of rawBody.entries) {
                  if (entry.b64 !== undefined) {
                    const bytes = Uint8Array.from(atob(entry.b64), c => c.charCodeAt(0));
                    fd.append(entry.name, new Blob([bytes], { type: entry.type || '' }), entry.filename || 'blob');
                  } else {
                    fd.append(entry.name, entry.value);
                  }
                }
                fetchOptions.body = fd;
              } else {
                fetchOptions.body = rawBody;
              }
            } else {
              fetchOptions.body = rawBody;
            }
          }
          
          // Set timeout
          const settings = await SettingsManager.get();
          const timeoutMs = data.timeout || settings.xhrTimeout || 30000;
          const timeoutId = setTimeout(() => {
            if (!request.aborted) {
              request.aborted = true;
              controller.abort();
              sendEvent('timeout', {
                readyState: 4,
                status: 0,
                statusText: '',
                error: 'Request timed out'
              });
              sendEvent('loadend', { readyState: 4 });
              XhrManager.remove(requestId);
            }
          }, timeoutMs);
          
          // Send loadstart event
          sendEvent('loadstart', {
            readyState: 1,
            status: 0,
            lengthComputable: false,
            loaded: 0,
            total: 0
          });
          
          // Execute the fetch
          (async () => {
            try {
              const response = await fetch(data.url, fetchOptions);
              
              if (request.aborted) return;
              
              // Get response headers as string
              const responseHeaders = [...response.headers.entries()]
                .map(([k, v]) => `${k}: ${v}`)
                .join('\r\n');
              
              // Send readystatechange for headers received
              sendEvent('readystatechange', {
                readyState: 2,
                status: response.status,
                statusText: response.statusText,
                responseHeaders,
                finalUrl: response.url
              });
              
              // Get content length for progress
              const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
              
              // Read response based on responseType
              let responseData;
              let responseText = '';
              
              if (data.responseType === 'arraybuffer') {
                const buffer = await response.arrayBuffer();
                // Encode as base64 for efficient transfer (33% overhead vs 800%+ for number arrays)
                const bytes = new Uint8Array(buffer);
                let binary = '';
                // Process in 32KB chunks to avoid call stack overflow
                for (let offset = 0; offset < bytes.length; offset += 32768) {
                  binary += String.fromCharCode.apply(null, bytes.subarray(offset, offset + 32768));
                }
                responseData = { __sv_base64__: true, data: btoa(binary) };
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: buffer.byteLength,
                  total: contentLength || buffer.byteLength
                });
              } else if (data.responseType === 'blob') {
                const blob = await response.blob();
                // Convert blob to data URL for transfer
                responseData = await new Promise((resolve) => {
                  const reader = new FileReader();
                  reader.onload = () => resolve(reader.result);
                  reader.onerror = () => resolve(null);
                  reader.readAsDataURL(blob);
                });
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: blob.size,
                  total: contentLength || blob.size
                });
              } else if (data.responseType === 'json') {
                responseText = await response.text();
                try {
                  responseData = JSON.parse(responseText);
                } catch (e) {
                  responseData = responseText;
                }
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: responseText.length,
                  total: contentLength || responseText.length
                });
              } else if (data.responseType === 'stream') {
                // Stream response - send chunks as progress events
                const reader = response.body?.getReader();
                if (reader) {
                  let loaded = 0;
                  const chunks = [];
                  const decoder = new TextDecoder();
                  try {
                    while (true) {
                      const { done, value } = await reader.read();
                      if (done || request.aborted) break;
                      loaded += value.byteLength;
                      const chunkText = decoder.decode(value, { stream: true });
                      chunks.push(chunkText);
                      sendEvent('progress', {
                        readyState: 3,
                        lengthComputable: contentLength > 0,
                        loaded,
                        total: contentLength || 0,
                        responseText: chunkText,
                        streamChunk: true
                      });
                    }
                  } finally {
                    reader.releaseLock();
                  }
                  responseText = chunks.join('');
                  responseData = responseText;
                } else {
                  responseText = await response.text();
                  responseData = responseText;
                }
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: responseText.length,
                  total: contentLength || responseText.length
                });
              } else {
                // Default: text
                responseText = await response.text();
                responseData = responseText;
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: responseText.length,
                  total: contentLength || responseText.length
                });
              }
              
              if (request.aborted) return;
              
              // Build final response object
              const finalResponse = {
                readyState: 4,
                status: response.status,
                statusText: response.statusText,
                responseHeaders,
                response: responseData,
                responseText: responseText || (typeof responseData === 'string' ? responseData : JSON.stringify(responseData)),
                finalUrl: response.url,
                lengthComputable: true,
                loaded: responseText?.length || 0,
                total: responseText?.length || 0
              };
              
              // Send load event
              sendEvent('load', finalResponse);

              // Log successful request
              NetworkLog.add({
                ..._netLogEntry,
                status: finalResponse.status,
                statusText: finalResponse.statusText,
                responseSize: responseText?.length || 0,
                duration: Date.now() - _netLogStartTime,
                finalUrl: finalResponse.finalUrl
              });

              // Send loadend event
              sendEvent('loadend', finalResponse);

              // Clean up
              XhrManager.remove(requestId);
              
            } catch (e) {
              if (request.aborted) {
                // Already handled by abort
                return;
              }
              
              const isAbort = e.name === 'AbortError';
              const errorType = isAbort ? 'abort' : 'error';
              const errorMsg = isAbort ? 'Request aborted' : (e.message || 'Network error');
              
              // Log failed request
              NetworkLog.add({ ..._netLogEntry, status: 0, error: errorMsg, duration: Date.now() - _netLogStartTime });

              sendEvent(errorType, {
                readyState: 4,
                status: 0,
                statusText: '',
                error: errorMsg
              });
              
              sendEvent('loadend', {
                readyState: 4,
                status: 0
              });
              
              XhrManager.remove(requestId);
            } finally {
              clearTimeout(timeoutId);
            }
          })().catch(e => {
            // Guard against any unexpected exception escaping the try/catch above
            console.error('[ScriptVault] Unexpected XHR handler error:', e);
            XhrManager.remove(requestId);
          });

          // Return request ID immediately so content script can track/abort
          return { requestId, started: true };
          
        } catch (e) {
          console.error('[ScriptVault] GM_xmlhttpRequest setup error:', e);
          return { error: e.message || 'Request setup failed', type: 'error' };
        }
      }
      
      // Abort an XHR request
      case 'GM_xmlhttpRequest_abort': {
        const request = XhrManager.get(data.requestId);
        if (request && !request.aborted) {
          request.aborted = true;
          if (request.controller) {
            request.controller.abort();
          }
          XhrManager.remove(data.requestId);
          return { success: true };
        }
        return { success: false };
      }
      
      // Download (with callbacks: onload, onerror, onprogress, ontimeout)
      case 'GM_download': {
        try {
          const downloadOpts = {
            url: data.url,
            filename: data.name,
            saveAs: data.saveAs || false,
            conflictAction: data.conflictAction || 'uniquify'
          };
          const downloadId = await chrome.downloads.download(downloadOpts);
          const tabId = sender.tab?.id;
          // Track download for event callbacks
          if (tabId && data.hasCallbacks) {
            const sendDlEvent = (type, eventData = {}) => {
              chrome.tabs.sendMessage(tabId, {
                action: 'downloadEvent',
                data: { downloadId, scriptId: data.scriptId, type, ...eventData }
              }).catch(() => {});
            };
            let dlTimeoutId = null;
            let dlSafetyId = null;
            // Remove listener and clear all associated timers
            const cleanupDlListener = () => {
              chrome.downloads.onChanged.removeListener(dlListener);
              if (dlTimeoutId) clearTimeout(dlTimeoutId);
              if (dlSafetyId) clearTimeout(dlSafetyId);
            };
            // Monitor download state changes
            const dlListener = (delta) => {
              if (delta.id !== downloadId) return;
              if (delta.state) {
                if (delta.state.current === 'complete') {
                  sendDlEvent('load', { url: data.url });
                  cleanupDlListener();
                } else if (delta.state.current === 'interrupted') {
                  sendDlEvent('error', { error: delta.error?.current || 'Download interrupted' });
                  cleanupDlListener();
                }
              }
              if (delta.bytesReceived) {
                sendDlEvent('progress', {
                  loaded: delta.bytesReceived.current,
                  total: delta.totalBytes?.current || 0
                });
              }
            };
            chrome.downloads.onChanged.addListener(dlListener);
            // Timeout
            if (data.timeout) {
              dlTimeoutId = setTimeout(() => {
                chrome.downloads.cancel(downloadId).catch(() => {});
                sendDlEvent('timeout');
                cleanupDlListener();
              }, data.timeout);
            }
            // Safety: remove listener after 5 minutes max to prevent leaks
            dlSafetyId = setTimeout(cleanupDlListener, 300000);
          }
          return { success: true, downloadId };
        } catch (e) {
          return { error: e.message };
        }
      }
      
      // Notifications (with callbacks: onclick, ondone, timeout, tag)
      case 'GM_notification': {
        // Phase 11.11 — progress + buttons (ScriptCat parity).
        // Chrome's chrome.notifications API supports both natively:
        //   - type: 'progress' + progress: 0..100 → progress bar
        //   - buttons: [{ title, iconUrl }] up to 2 → action buttons with
        //     chrome.notifications.onButtonClicked routing.
        const hasProgress = typeof data.progress === 'number';
        const notifOpts = {
          type: hasProgress ? 'progress' : 'basic',
          iconUrl: data.image || 'images/icon128.png',
          // Phase 39.31 — clamp to documented Chrome notification limits
          // so the future WECG #935 spec change can't break user scripts
          // that pass long titles/messages.
          title: _clampString(data.title || 'ScriptVault', SV_NOTIF_TITLE_MAX),
          message: _clampString(data.text || '', SV_NOTIF_MESSAGE_MAX),
          silent: data.silent || false
        };
        if (hasProgress) {
          notifOpts.progress = Math.max(0, Math.min(100, Math.floor(data.progress)));
        }
        // Buttons — Chrome caps at 2; we silently truncate to honour the
        // platform contract instead of failing the whole notification.
        if (Array.isArray(data.buttons) && data.buttons.length > 0) {
          notifOpts.buttons = data.buttons.slice(0, 2).map((b) => ({
            title: String(b?.title ?? '').slice(0, 200),
            ...(b?.iconUrl ? { iconUrl: b.iconUrl } : {})
          }));
        }
        // Use tag as notification ID for updates
        const notifId = data.tag
          ? await chrome.notifications.create(data.tag, notifOpts)
          : await chrome.notifications.create(notifOpts);
        const tabId = sender.tab?.id;
        // Track notification for callbacks
        if (tabId && (data.hasOnclick || data.hasOndone || data.hasOnbuttonclick)) {
          if (!self._notifCallbacks) self._notifCallbacks = new Map();
          // Evict oldest if map grows too large (prevents unbounded growth)
          if (self._notifCallbacks.size > 500) {
            const oldest = self._notifCallbacks.keys().next().value;
            self._notifCallbacks.delete(oldest);
          }
          self._notifCallbacks.set(notifId, {
            tabId, scriptId: data.scriptId,
            hasOnclick: data.hasOnclick,
            hasOndone: data.hasOndone,
            hasOnbuttonclick: data.hasOnbuttonclick
          });
          SessionState.persistNotifCallbacks();
        }
        // Auto-close after timeout
        if (data.timeout && data.timeout > 0) {
          if (data.timeout >= 30000) {
            // Long timeouts use chrome.alarms to survive service worker shutdown
            const alarmName = `notif_clear_${notifId}`;
            chrome.alarms.create(alarmName, { delayInMinutes: data.timeout / 60000 });
          } else {
            setTimeout(() => {
              chrome.notifications.clear(notifId).catch(() => {});
              if (self._notifCallbacks) {
                self._notifCallbacks.delete(notifId);
                SessionState.persistNotifCallbacks();
              }
            }, data.timeout);
          }
        }
        return { success: true, id: notifId };
      }

      // Phase 11.11 — Update an existing notification by id (tag).
      // Skips fields the caller didn't specify so partial updates don't blank
      // out the title/message. Mirrors chrome.notifications.update() behaviour.
      case 'GM_updateNotification': {
        if (!data.id) return { success: false, error: 'Missing notification id' };
        const updateOpts = {};
        if (typeof data.title === 'string') updateOpts.title = data.title;
        if (typeof data.text === 'string') updateOpts.message = data.text;
        if (typeof data.image === 'string') updateOpts.iconUrl = data.image;
        if (typeof data.progress === 'number') {
          updateOpts.type = 'progress';
          updateOpts.progress = Math.max(0, Math.min(100, Math.floor(data.progress)));
        }
        if (Array.isArray(data.buttons)) {
          updateOpts.buttons = data.buttons.slice(0, 2).map((b) => ({
            title: String(b?.title ?? '').slice(0, 200),
            ...(b?.iconUrl ? { iconUrl: b.iconUrl } : {})
          }));
        }
        if (typeof data.silent === 'boolean') updateOpts.silent = data.silent;
        try {
          const wasUpdated = await chrome.notifications.update(data.id, updateOpts);
          return { success: !!wasUpdated };
        } catch (e) {
          return { success: false, error: e?.message || 'Update failed' };
        }
      }

      // Phase 11.11 — Programmatically close a notification by id (tag).
      case 'GM_closeNotification': {
        if (!data.id) return { success: false, error: 'Missing notification id' };
        try {
          await chrome.notifications.clear(data.id);
          if (self._notifCallbacks) {
            self._notifCallbacks.delete(data.id);
            SessionState.persistNotifCallbacks();
          }
          return { success: true };
        } catch (e) {
          return { success: false, error: e?.message || 'Close failed' };
        }
      }
      
      // Open tab (with close tracking for onclose callback)
      case 'GM_openInTab': {
        const newTabOpts = {
          url: data.url,
          active: data.active !== undefined ? data.active : !data.background
        };
        // Insert next to current tab if requested
        if (data.insert && sender.tab?.index !== undefined) {
          newTabOpts.index = sender.tab.index + 1;
        }
        // Set opener tab
        if (data.setParent && sender.tab?.id) {
          newTabOpts.openerTabId = sender.tab.id;
        }
        const tab = await chrome.tabs.create(newTabOpts);
        // Track tab for onclose notification via shared listener
        const callerTabId = sender.tab?.id;
        if (callerTabId && data.trackClose) {
          if (!self._openTabTrackers) self._openTabTrackers = new Map();
          // Evict oldest if map grows too large (prevents unbounded growth from orphaned tabs)
          if (self._openTabTrackers.size > 1000) {
            const oldest = self._openTabTrackers.keys().next().value;
            self._openTabTrackers.delete(oldest);
          }
          self._openTabTrackers.set(tab.id, { callerTabId, scriptId: data.scriptId });
          SessionState.persistOpenTabTrackers();
        }
        return { success: true, tabId: tab.id };
      }
      
      // Focus tab
      case 'GM_focusTab':
        if (sender.tab?.id) {
          await chrome.tabs.update(sender.tab.id, { active: true });
        }
        return { success: true };

      // Close opened tab (from GM_openInTab handle.close())
      case 'GM_closeTab':
        if (data.tabId) {
          try { await chrome.tabs.remove(data.tabId); } catch (e) {}
        }
        return { success: true };

      // Get scripts for URL
      case 'getScriptsForUrl': {
        const settings = await SettingsManager.get();
        const url = data.url || data;

        if (isUrlBlockedByGlobalSettings(url, settings)) {
          return [];
        }

        // Filter scripts that match this URL (both enabled and disabled for popup display).
        // Use the cached MatchSet so we test only candidate scripts, not every script.
        const matchSet = await getMatchSet();
        const filtered = matchSet.getMatching(url)
          .sort((a, b) => (a.position || 0) - (b.position || 0));
        
        // Return with metadata property for popup compatibility (strip code to reduce message size)
        return filtered.map(({ code, ...rest }) => ({ ...rest, metadata: rest.meta }));
      }
      
      // Update badge for specific tab
      case 'updateBadgeForTab': {
        if (data.tabId && data.url) {
          await updateBadgeForTab(data.tabId, data.url);
        }
        return { success: true };
      }

      // Phase 11.4 — Run a script once on a specific tab without registering
      // it for future page loads. Uses chrome.userScripts.execute() (Chrome
      // 135+); falls back to chrome.scripting.executeScript so older Chrome
      // can still run the wrapper-less code body. The script doesn't need
      // to be enabled, and registration state is not modified.
      case 'runScriptNow': {
        const scriptId = data.scriptId || data.id;
        const tabId = data.tabId;
        if (!scriptId) return { success: false, error: 'Missing scriptId' };
        try {
          const script = await ScriptStorage.get(scriptId);
          if (!script) return { success: false, error: 'Script not found' };

          // Resolve the target tab — caller usually passes an explicit id;
          // fall back to the active tab so the popup's "Run on current tab"
          // affordance can omit it.
          let targetTabId = tabId;
          if (typeof targetTabId !== 'number') {
            const [activeTab] = await chrome.tabs.query({ active: true, currentWindow: true });
            targetTabId = activeTab?.id;
          }
          if (typeof targetTabId !== 'number') {
            return { success: false, error: 'No target tab' };
          }

          // Resolve @require dependencies the same way the context-menu
          // injector does, so the one-shot run sees the same library set as
          // a normal injection. Per-require failures are non-fatal — the
          // user-script body still runs.
          const reqList = Array.isArray(script.meta?.require)
            ? script.meta.require
            : (script.meta?.require ? [script.meta.require] : []);
          const requireScripts = [];
          for (const url of reqList) {
            try {
              const code = await fetchRequireScript(url);
              if (code) requireScripts.push({ url, code });
            } catch (_e) { /* require fetch failed — keep going */ }
          }

          let storedValues = {};
          try { storedValues = await ScriptValues.getAll(script.id) || {}; } catch (_e) {}

          const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, [], []);

          // Phase 39.28 — Chrome 149+ makes injectImmediately: true reliable
          // for document-start one-shots. Pass it when the script declares
          // @run-at document-start so the body runs before first paint
          // instead of after.
          const wantsDocumentStart = (script?.meta?.['run-at'] === 'document-start');

          // Prefer userScripts.execute() (Chrome 135+) — runs in the same
          // USER_SCRIPT world as a normal injection so unsafeWindow / GM_*
          // APIs behave identically.
          if (typeof chrome.userScripts?.execute === 'function') {
            try {
              await chrome.userScripts.execute({
                target: { tabId: targetTabId },
                js: [{ code: wrappedCode }],
                world: 'USER_SCRIPT',
                ...(wantsDocumentStart ? { injectImmediately: true } : {})
              });
              return { success: true, mode: 'userScripts.execute' };
            } catch (e) {
              // Fall through to chrome.scripting fallback below.
              debugLog('userScripts.execute failed, falling back:', e?.message);
            }
          }

          // Fallback: chrome.scripting.executeScript — runs in MAIN world,
          // GM_* APIs unavailable but the user-script body still executes.
          // Acceptable for "Run now" use because the user explicitly opted in.
          try {
            await chrome.scripting.executeScript({
              target: { tabId: targetTabId },
              world: 'MAIN',
              func: (code) => {
                try { (0, eval)(code); } catch (err) { console.error('[ScriptVault Run Now]', err); }
              },
              args: [wrappedCode],
              ...(wantsDocumentStart ? { injectImmediately: true } : {})
            });
            return { success: true, mode: 'scripting.executeScript' };
          } catch (e) {
            return { success: false, error: e?.message || 'Run failed' };
          }
        } catch (e) {
          console.error('[ScriptVault] runScriptNow error:', e);
          return { success: false, error: e?.message || 'Run failed' };
        }
      }
      
      // Get info
      case 'getExtensionInfo':
        return {
          name: 'ScriptVault',
          version: chrome.runtime.getManifest().version,
          scriptHandler: 'ScriptVault',
          scriptMetaStr: null
        };
        
      // Register menu command (with extended options: id, accessKey, autoClose, title)
      case 'registerMenuCommand':
      case 'GM_registerMenuCommand': {
        const commands = await chrome.storage.session.get('menuCommands') || {};
        if (!commands.menuCommands) commands.menuCommands = {};
        if (!commands.menuCommands[data.scriptId]) commands.menuCommands[data.scriptId] = [];

        // If command with same id exists, update it instead of adding duplicate
        const existing = commands.menuCommands[data.scriptId].findIndex(c => c.id === data.commandId);
        const cmdEntry = {
          id: data.commandId,
          caption: data.caption,
          accessKey: data.accessKey || '',
          autoClose: data.autoClose !== false,
          title: data.title || ''
        };
        if (existing >= 0) {
          commands.menuCommands[data.scriptId][existing] = cmdEntry;
        } else {
          commands.menuCommands[data.scriptId].push(cmdEntry);
        }

        await chrome.storage.session.set(commands);
        return { success: true };
      }
      
      case 'unregisterMenuCommand':
      case 'GM_unregisterMenuCommand': {
        const commands = await chrome.storage.session.get('menuCommands') || {};
        if (commands.menuCommands?.[data.scriptId]) {
          commands.menuCommands[data.scriptId] = commands.menuCommands[data.scriptId].filter(
            c => c.id !== data.commandId
          );
          if (commands.menuCommands[data.scriptId].length === 0) {
            delete commands.menuCommands[data.scriptId];
          }
          await chrome.storage.session.set(commands);
        }
        return { success: true };
      }

      // Get menu commands
      case 'getMenuCommands': {
        const result = await chrome.storage.session.get('menuCommands');
        const allCommands = result?.menuCommands || {};
        const commands = [];
        
        // Flatten commands and add script info
        const scripts = await ScriptStorage.getAll();
        for (const [scriptId, cmds] of Object.entries(allCommands)) {
          const script = scripts.find(s => s.id === scriptId);
          if (script && cmds) {
            cmds.forEach(cmd => {
              commands.push({
                ...cmd,
                scriptId,
                scriptName: script.meta?.name || 'Unknown Script'
              });
            });
          }
        }
        
        return { commands };
      }
      
      // Execute menu command
      case 'executeMenuCommand': {
        // Send to content script
        if (sender.tab?.id) {
          await chrome.tabs.sendMessage(sender.tab.id, {
            action: 'executeMenuCommand',
            data: { scriptId: data.scriptId, commandId: data.commandId }
          });
        }
        return { success: true };
      }
      
      // GM_cookie API
      // chrome.cookies.* only accepts http(s) URLs. Front-validate so blob:/
      // data:/javascript:/chrome-extension: URLs from a malicious script return
      // a clear error instead of leaking the raw Chrome error (and to make sure
      // we never pass an attacker-controlled URL into a future Chrome API that
      // is more permissive about schemes).
      case 'GM_cookie_list': {
        try {
          const details = {};
          if (data.url) {
            if (!isHttpCookieUrl(data.url)) return { error: 'url must be http(s)://' };
            details.url = data.url;
          }
          if (data.domain) details.domain = data.domain;
          if (data.name) details.name = data.name;
          if (data.path) details.path = data.path;
          const cookies = await chrome.cookies.getAll(details);
          return { success: true, cookies };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_cookie_set': {
        try {
          if (!data.url) return { error: 'url is required for cookie set' };
          if (!data.name) return { error: 'name is required for cookie set' };
          if (!isHttpCookieUrl(data.url)) return { error: 'url must be http(s)://' };
          const cookie = await chrome.cookies.set({
            url: data.url,
            name: data.name,
            value: data.value || '',
            domain: data.domain,
            path: data.path || '/',
            secure: data.secure || false,
            httpOnly: data.httpOnly || false,
            expirationDate: data.expirationDate,
            sameSite: data.sameSite || 'unspecified'
          });
          return { success: true, cookie };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_cookie_delete': {
        try {
          if (!data.url || !data.name) return { error: 'url and name are required for cookie delete' };
          if (!isHttpCookieUrl(data.url)) return { error: 'url must be http(s)://' };
          await chrome.cookies.remove({
            url: data.url,
            name: data.name
          });
          return { success: true };
        } catch (e) {
          return { error: e.message };
        }
      }

      // GM_webRequest — runtime rule update from script
      case 'GM_webRequest': {
        const scriptId = sender.userScriptId || data.scriptId;
        if (!scriptId) return { error: 'No script context' };
        // Verify the script has @grant GM_webRequest
        const script = await ScriptStorage.get(scriptId);
        if (!script?.meta?.grant?.includes('GM_webRequest')) return { error: 'Not granted' };
        const rules = Array.isArray(data.rules) ? data.rules : (data.rules ? [data.rules] : []);
        await applyWebRequestRules(scriptId, rules);
        return { success: true, count: rules.length };
      }

      // Execution profiling - get stats for dashboard
      case 'getScriptStats': {
        const scriptId = data.scriptId;
        if (scriptId) {
          const script = await ScriptStorage.get(scriptId);
          return { stats: script?.stats || null };
        }
        // Get stats for all scripts
        const scripts = await ScriptStorage.getAll();
        const allStats = {};
        for (const s of scripts) {
          if (s.stats) allStats[s.id] = s.stats;
        }
        return { allStats };
      }

      case 'resetScriptStats': {
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (script) {
          script.stats = { runs: 0, totalTime: 0, avgTime: 0, lastRun: 0, errors: 0 };
          await ScriptStorage.set(scriptId, script);
        }
        return { success: true };
      }

      case 'reportExecTime': {
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (script) {
          if (!script.stats) script.stats = { runs: 0, totalTime: 0, avgTime: 0, lastRun: 0, errors: 0 };
          script.stats.runs++;
          script.stats.totalTime += data.time;
          script.stats.avgTime = Math.round(script.stats.totalTime / script.stats.runs * 100) / 100;
          script.stats.lastRun = Date.now();
          script.stats.lastUrl = data.url;
          // Update cache only (debounced save to avoid excessive storage writes)
          _debouncedStatsSave();
        }
        return { success: true };
      }

      case 'reportExecError': {
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (script) {
          if (!script.stats) script.stats = { runs: 0, totalTime: 0, avgTime: 0, lastRun: 0, errors: 0 };
          script.stats.errors++;
          script.stats.lastError = data.error;
          script.stats.lastErrorTime = Date.now();
          // Update cache only (debounced save to avoid excessive storage writes)
          _debouncedStatsSave();
        }
        return { success: true };
      }

      // GM_audio API - Tab mute control (Tampermonkey-compatible)
      case 'GM_audio_setMute': {
        try {
          const tabId = sender.tab?.id;
          if (!tabId) return { error: 'No tab context' };
          const mute = typeof data.mute === 'object' ? data.mute.mute : !!data.mute;
          await chrome.tabs.update(tabId, { muted: mute });
          return { success: true };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_audio_getState': {
        try {
          const tabId = sender.tab?.id;
          if (!tabId) return { error: 'No tab context' };
          const tab = await chrome.tabs.get(tabId);
          return {
            muted: tab.mutedInfo?.muted || false,
            reason: tab.mutedInfo?.reason || 'user',
            audible: tab.audible || false
          };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_audio_watchState': {
        // Start watching tab audio state changes for the requesting tab
        const tabId = sender.tab?.id;
        if (!tabId) return { error: 'No tab context' };
        if (!self._audioWatchedTabs) self._audioWatchedTabs = new Set();
        self._audioWatchedTabs.add(tabId);
        SessionState.persistAudioWatchedTabs();
        return { success: true };
      }

      case 'GM_audio_unwatchState': {
        const tabId = sender.tab?.id;
        if (tabId && self._audioWatchedTabs?.delete(tabId)) {
          SessionState.persistAudioWatchedTabs();
        }
        return { success: true };
      }

      // ── v2.0 Module Handlers ──────────────────────────────────────────────

      // NPM Package Resolution
      case 'npmResolve': {
        if (typeof NpmResolver !== 'undefined') {
          return await NpmResolver.resolve(data.spec);
        }
        return { error: 'NpmResolver not available' };
      }

      case 'npmResolveAll': {
        if (typeof NpmResolver !== 'undefined') {
          return await NpmResolver.resolveAll(data.requires);
        }
        return { error: 'NpmResolver not available' };
      }

      // Error Log
      case 'logError': {
        if (typeof ErrorLog !== 'undefined') {
          await ErrorLog.log(data.entry || data);
          return { success: true };
        }
        return { error: 'ErrorLog not available' };
      }

      case 'getErrorLog': {
        if (typeof ErrorLog !== 'undefined') {
          return await ErrorLog.getAll(data.filters);
        }
        return { log: [] };
      }

      case 'getErrorLogGrouped': {
        if (typeof ErrorLog !== 'undefined') {
          return await ErrorLog.getGrouped();
        }
        return { groups: [] };
      }

      case 'exportErrorLog': {
        if (typeof ErrorLog !== 'undefined') {
          const format = data.format || 'json';
          if (format === 'csv') return { data: await ErrorLog.exportCSV() };
          if (format === 'text') return { data: await ErrorLog.exportText() };
          return { data: await ErrorLog.exportJSON() };
        }
        return { error: 'ErrorLog not available' };
      }

      case 'clearErrorLog': {
        if (typeof ErrorLog !== 'undefined') {
          await ErrorLog.clear();
          return { success: true };
        }
        return { error: 'ErrorLog not available' };
      }

      // Notification System
      case 'getNotificationPrefs': {
        if (typeof NotificationSystem !== 'undefined') {
          return await NotificationSystem.getPreferences();
        }
        return {};
      }

      case 'setNotificationPrefs': {
        if (typeof NotificationSystem !== 'undefined') {
          await NotificationSystem.setPreferences(data.prefs);
          return { success: true };
        }
        return { error: 'NotificationSystem not available' };
      }

      case 'generateDigest': {
        if (typeof NotificationSystem !== 'undefined') {
          return await NotificationSystem.generateDigest();
        }
        return { error: 'NotificationSystem not available' };
      }

      // Performance History
      // Easy Cloud Sync
      case 'easyCloudConnect': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.connect();
        }
        return { error: 'EasyCloudSync not available' };
      }

      case 'easyCloudDisconnect': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.disconnect();
        }
        return { error: 'EasyCloudSync not available' };
      }

      case 'easyCloudSync': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.sync();
        }
        return { error: 'EasyCloudSync not available' };
      }

      case 'easyCloudStatus': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.getStatus();
        }
        return { connected: false };
      }

      // Script Console Capture (for debugger)
      case 'scriptConsoleCapture': {
        // Append captured console entries to session storage
        const key = `console_${data.scriptId}`;
        const existing = await chrome.storage.session.get(key);
        const entries = existing[key] || [];
        const incoming = (data.entries || []).slice(-200);
        entries.push(...incoming);
        // Keep last 200 entries per script
        const trimmedEntries = entries.slice(-200);
        await chrome.storage.session.set({ [key]: trimmedEntries });
        return { success: true };
      }

      case 'getScriptConsole': {
        const consoleData = await chrome.storage.session.get(`console_${data.scriptId}`);
        return { entries: consoleData[`console_${data.scriptId}`] || [] };
      }

      case 'clearScriptConsole': {
        await chrome.storage.session.remove(`console_${data.scriptId}`);
        return { success: true };
      }

      // Live Reload toggle
      case 'setLiveReload': {
        const lrData = await chrome.storage.local.get('liveReloadScripts');
        const lrScripts = lrData.liveReloadScripts || {};
        if (data.enabled) {
          lrScripts[data.scriptId] = true;
        } else {
          delete lrScripts[data.scriptId];
        }
        await chrome.storage.local.set({ liveReloadScripts: lrScripts });
        return { success: true };
      }

      case 'getLiveReloadScripts': {
        const lrData2 = await chrome.storage.local.get('liveReloadScripts');
        return { scripts: lrData2.liveReloadScripts || {} };
      }

      case 'openDashboard': {
        const dashUrl = chrome.runtime.getURL('pages/dashboard.html');
        const scriptParam = data.scriptId ? `#script_${encodeURIComponent(data.scriptId)}` : '';
        const newParam = data.newScript ? '#new_script' : '';
        await chrome.tabs.create({ url: dashUrl + (scriptParam || newParam) });
        return { success: true };
      }

      case 'factoryReset': {
        // Clear all scripts through the storage abstraction so per-script
        // values, IDB rows, and in-memory caches stay consistent.
        const allScripts = await ScriptStorage.getAll();
        for (const s of allScripts) {
          await unregisterScript(s.id);
        }
        await ScriptStorage.clear();
        // Reset settings
        await SettingsManager.reset();
        await updateBadge();
        return { success: true };
      }

      case 'resetScriptSettings': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };
        script.settings = {};
        await ScriptStorage.set(data.scriptId, script);
        return { success: true };
      }

      default:
        return { error: 'Unknown action: ' + action };
    }
  } catch (e) {
    console.error('[ScriptVault] Message handler error:', e);
    // Log to error system if available
    if (typeof ErrorLog !== 'undefined') {
      try { ErrorLog.log({ timestamp: Date.now(), error: e.message, stack: e.stack, context: 'handleMessage', action: action }); } catch {}
    }
    return { error: e.message };
  }
}

// ============================================================================
// Auto-reload matching tabs
// ============================================================================

// Debounced auto-reload to prevent mass tab reloads on rapid saves
let _autoReloadTimer = null;
let _autoReloadScriptsMap = new Map(); // scriptId → script (deduplicates rapid saves)

async function autoReloadMatchingTabs(script) {
  const settings = await SettingsManager.get();
  if (!settings.autoReload) return;

  _autoReloadScriptsMap.set(script.id, script);
  if (_autoReloadTimer) clearTimeout(_autoReloadTimer);

  _autoReloadTimer = setTimeout(async () => {
    const scripts = [..._autoReloadScriptsMap.values()];
    _autoReloadScriptsMap.clear();
    _autoReloadTimer = null;

    try {
      const tabs = await chrome.tabs.query({});
      const reloaded = new Set();
      for (const tab of tabs) {
        if (reloaded.has(tab.id)) continue;
        if (tab.url && scripts.some(s => doesScriptMatchUrl(s, tab.url))) {
          chrome.tabs.reload(tab.id).catch(() => {});
          reloaded.add(tab.id);
        }
      }
    } catch (e) {
      console.error('[ScriptVault] Auto-reload failed:', e);
    }
  }, 500);
}

// ============================================================================
// Badge Management
// ============================================================================

async function updateBadge(tabId = null) {
  const settings = await SettingsManager.get();

  if (!settings.showBadge || settings.enabled === false) {
    chrome.action.setBadgeText({ text: '', tabId: tabId || undefined });
    return;
  }

  if (tabId) {
    // Update a specific tab
    try {
      const tab = await chrome.tabs.get(tabId);
      if (tab && tab.url) {
        await updateBadgeForTab(tabId, tab.url, settings);
      }
    } catch (e) {
      chrome.action.setBadgeText({ text: '', tabId });
    }
    return;
  }

  // No specific tab — update all tabs in parallel
  try {
    const [tabs, scripts] = await Promise.all([
      chrome.tabs.query({}),
      ScriptStorage.getAll()
    ]);
    await Promise.allSettled(
      tabs.filter(t => t.id && t.url).map(t => updateBadgeForTab(t.id, t.url, settings, scripts))
    );
  } catch (e) {
    chrome.action.setBadgeText({ text: '' });
  }
}

// Update badge for a specific tab based on its URL.
// Accepts optional pre-fetched settings/scripts to avoid redundant cache reads when
// called from updateBadge() in a loop over many tabs.
async function updateBadgeForTab(tabId, url, settings, scripts) {
  if (!settings) settings = await SettingsManager.get();

  if (!settings.showBadge || settings.enabled === false) {
    chrome.action.setBadgeText({ text: '', tabId });
    return;
  }

  if (!url || url.startsWith('chrome://') || url.startsWith('chrome-extension://') || url.startsWith('about:')) {
    chrome.action.setBadgeText({ text: '', tabId });
    return;
  }

  try {
    // Check global page filter
    if (isUrlBlockedByGlobalSettings(url, settings)) {
      chrome.action.setBadgeText({ text: '', tabId });
      return;
    }

    if (!scripts) scripts = await ScriptStorage.getAll();
    const matchingScripts = scripts.filter(script => script.enabled && doesScriptMatchUrl(script, url));

    const badgeInfo = settings.badgeInfo || 'running';
    let badgeText = '';
    if (badgeInfo === 'running') {
      badgeText = matchingScripts.length > 0 ? String(matchingScripts.length) : '';
    } else if (badgeInfo === 'total') {
      const allEnabled = scripts.filter(s => s.enabled).length;
      badgeText = allEnabled > 0 ? String(allEnabled) : '';
    }
    // badgeInfo === 'none' leaves badgeText empty
    chrome.action.setBadgeText({ text: badgeText, tabId });
    chrome.action.setBadgeBackgroundColor({ color: settings.badgeColor || '#22c55e', tabId });
  } catch (e) {
    console.error('[ScriptVault] Failed to update badge:', e);
  }
}

// Check if URL is blocked by global page filter or denied hosts
function isUrlBlockedByGlobalSettings(url, globalSettings) {
  if (!url) return false;
  try {
    const urlObj = new URL(url);
    // Denied hosts
    const denied = globalSettings.deniedHosts;
    if (denied && Array.isArray(denied)) {
      for (const host of denied) {
        if (host && (urlObj.hostname === host || urlObj.hostname.endsWith('.' + host))) {
          return true;
        }
      }
    }
    // Page filter mode
    const mode = globalSettings.pageFilterMode || 'blacklist';
    if (mode === 'whitelist') {
      const whitelist = (globalSettings.whitelistedPages || '').split('\n').map(s => s.trim()).filter(Boolean);
      if (whitelist.length > 0) {
        const matched = whitelist.some(p => matchIncludePattern(p, url, urlObj));
        if (!matched) return true;
      }
    } else if (mode === 'blacklist') {
      const blacklist = (globalSettings.blacklistedPages || '').split('\n').map(s => s.trim()).filter(Boolean);
      if (blacklist.length > 0) {
        const matched = blacklist.some(p => matchIncludePattern(p, url, urlObj));
        if (matched) return true;
      }
    }
  } catch (e) {}
  return false;
}

// Check if a script matches a URL (with URL override support)
function doesScriptMatchUrl(script, url) {
  const meta = script.meta || {};
  const settings = script.settings || {};

  try {
    const urlObj = new URL(url);

    // Build effective patterns based on settings
    let effectiveMatches = [];
    let effectiveIncludes = [];
    let effectiveExcludes = [];
    
    // Original @match patterns (if enabled)
    if (settings.useOriginalMatches !== false) {
      const origMatches = Array.isArray(meta.match) ? meta.match : (meta.match ? [meta.match] : []);
      effectiveMatches.push(...origMatches);
    }
    
    // User @match patterns
    if (settings.userMatches && settings.userMatches.length > 0) {
      effectiveMatches.push(...settings.userMatches);
    }
    
    // Original @include patterns (if enabled)
    if (settings.useOriginalIncludes !== false) {
      const origIncludes = Array.isArray(meta.include) ? meta.include : (meta.include ? [meta.include] : []);
      effectiveIncludes.push(...origIncludes);
    }
    
    // User @include patterns
    if (settings.userIncludes && settings.userIncludes.length > 0) {
      effectiveIncludes.push(...settings.userIncludes);
    }
    
    // Original @exclude patterns (if enabled)
    if (settings.useOriginalExcludes !== false) {
      const origExcludes = Array.isArray(meta.exclude) ? meta.exclude : (meta.exclude ? [meta.exclude] : []);
      effectiveExcludes.push(...origExcludes);
    }
    
    // User @exclude patterns
    if (settings.userExcludes && settings.userExcludes.length > 0) {
      effectiveExcludes.push(...settings.userExcludes);
    }
    
    // Also check @exclude-match (stored as excludeMatch by parser)
    const excludeMatchPatterns = Array.isArray(meta.excludeMatch) ? meta.excludeMatch :
                          (meta.excludeMatch ? [meta.excludeMatch] : []);
    
    // First check if URL matches any exclude pattern
    for (const pattern of effectiveExcludes) {
      if (matchIncludePattern(pattern, url, urlObj)) return false;
    }
    for (const pattern of excludeMatchPatterns) {
      if (matchPattern(pattern, url, urlObj)) return false;
    }
    
    // Then check if URL matches any include/match pattern
    for (const pattern of effectiveMatches) {
      if (matchPattern(pattern, url, urlObj)) return true;
    }
    for (const pattern of effectiveIncludes) {
      if (matchIncludePattern(pattern, url, urlObj)) return true;
    }
    
    return false;
  } catch (e) {
    return false;
  }
}

// Match a @match pattern against a URL
function matchPattern(pattern, url, urlObj) {
  if (!pattern) return false;
  if (pattern === '<all_urls>') return true;
  if (pattern === '*') return true;
  
  try {
    // Parse the pattern
    const patternMatch = pattern.match(/^(\*|https?|file|ftp):\/\/([^/]+)(\/.*)$/);
    if (!patternMatch) return false;
    
    const [, scheme, host, path] = patternMatch;
    
    // Check scheme
    if (scheme !== '*' && scheme !== urlObj.protocol.slice(0, -1)) {
      return false;
    }
    
    // Check host (use urlObj.host when pattern includes port, urlObj.hostname otherwise)
    if (host !== '*') {
      const hasPort = host.includes(':');
      const urlHost = hasPort ? urlObj.host : urlObj.hostname;
      if (host.startsWith('*.')) {
        const baseDomain = host.slice(2);
        if (hasPort) {
          // For *.example.com:8080, compare host (includes port) against baseDomain
          if (urlHost !== baseDomain && !urlHost.endsWith('.' + baseDomain)) {
            return false;
          }
        } else {
          // For *.example.com, compare hostname only
          if (urlObj.hostname !== baseDomain && !urlObj.hostname.endsWith('.' + baseDomain)) {
            return false;
          }
        }
      } else if (host !== urlHost) {
        return false;
      }
    }
    
    // Check path (convert glob to regex)
    const pathRegex = new RegExp('^' + path.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
    if (!pathRegex.test(urlObj.pathname + urlObj.search)) {
      return false;
    }
    
    return true;
  } catch (e) {
    return false;
  }
}

// Match an @include pattern (glob-style or regex)
function matchIncludePattern(pattern, url, urlObj) {
  if (!pattern) return false;
  if (pattern === '*') return true;

  try {
    // Handle regex patterns: /regex/ or /regex/flags
    if (isRegexPattern(pattern)) {
      const re = parseRegexPattern(pattern);
      return re ? re.test(url) : false;
    }

    // Convert glob to regex — collapse consecutive wildcards to prevent ReDoS
    let regex = pattern
      .replace(/\*{2,}/g, '*')                // Collapse consecutive * to single
      .replace(/[.+^${}()|[\]\\]/g, '\\$&')  // Escape special chars
      .replace(/\*/g, '.*')                   // * -> .*
      .replace(/\?/g, '.');                   // ? -> .

    // Handle scheme wildcards
    regex = regex.replace(/^(\\\*):\/\//, '(https?|file|ftp)://');

    const re = new RegExp('^' + regex + '$', 'i');
    return re.test(url);
  } catch (e) {
    return false;
  }
}

// ============================================================================
// MatchSet — precompiled host index (Phase 4.2)
//
// `getScriptsForUrl` and the badge/tab-reload paths previously walked every
// script and every pattern on every URL. With 200+ scripts that's hundreds
// of regex tests per popup open. MatchSet precomputes a hostname → script
// index so the candidate set drops to scripts whose patterns could possibly
// match before the slow per-pattern check runs.
//
// See `src/background/url-matcher.ts` for the typed mirror; logic must
// stay aligned.
// ============================================================================

function _extractHostHint(pattern, kind) {
  if (!pattern) return null;
  if (pattern === '*' || pattern === '<all_urls>') return null;
  if ((kind === 'include' || kind === 'exclude') && isRegexPattern(pattern)) return null;

  const m = pattern.match(/^(?:\*|https?|file|ftp):\/\/([^/]+)/);
  if (!m) return null;
  const host = m[1];
  if (!host || host === '*') return null;
  const noPort = host.replace(/:\d+$/, '');
  if (noPort.startsWith('*.')) return noPort.slice(2).toLowerCase();
  if (noPort.includes('*')) return null;
  return noPort.toLowerCase();
}

function _getEffectivePatterns(script) {
  const meta = script.meta || {};
  const settings = script.settings || {};
  const out = [];
  const pushAll = (arr, kind) => {
    if (!arr) return;
    const list = Array.isArray(arr) ? arr : [arr];
    for (const p of list) {
      if (typeof p === 'string' && p) out.push({ pattern: p, kind });
    }
  };
  if (settings.useOriginalMatches !== false) pushAll(meta.match, 'match');
  pushAll(settings.userMatches, 'match');
  if (settings.useOriginalIncludes !== false) pushAll(meta.include, 'include');
  pushAll(settings.userIncludes, 'include');
  pushAll(meta.excludeMatch, 'excludeMatch');
  return out;
}

class MatchSet {
  constructor(scripts) {
    this.universal = [];
    this.byHost = new Map();
    this.size = scripts.length;

    for (const script of scripts) {
      if (!script || !script.id) continue;
      const patterns = _getEffectivePatterns(script);
      const positive = patterns.filter(p => p.kind === 'match' || p.kind === 'include');
      if (positive.length === 0) continue;

      let allUniversal = false;
      const hosts = new Set();
      for (const p of positive) {
        if (p.pattern === '*' || p.pattern === '<all_urls>') {
          allUniversal = true;
          break;
        }
        const hint = _extractHostHint(p.pattern, p.kind);
        if (hint == null) {
          allUniversal = true;
          break;
        }
        hosts.add(hint);
      }

      if (allUniversal) {
        this.universal.push(script);
      } else {
        for (const host of hosts) {
          let bucket = this.byHost.get(host);
          if (!bucket) {
            bucket = [];
            this.byHost.set(host, bucket);
          }
          bucket.push(script);
        }
      }
    }
  }

  /**
   * Return scripts whose @match/@include patterns *could* match `url`.
   * The result is a superset — callers must run `doesScriptMatchUrl` for
   * the authoritative answer.
   */
  getCandidates(url) {
    let hostname;
    try {
      hostname = new URL(url).hostname.toLowerCase();
    } catch {
      return this.universal.slice();
    }

    const seen = new Set();
    const out = [];
    for (const s of this.universal) {
      if (!seen.has(s)) { seen.add(s); out.push(s); }
    }

    let cursor = hostname;
    while (cursor) {
      const bucket = this.byHost.get(cursor);
      if (bucket) {
        for (const s of bucket) {
          if (!seen.has(s)) { seen.add(s); out.push(s); }
        }
      }
      const dot = cursor.indexOf('.');
      if (dot < 0) break;
      cursor = cursor.slice(dot + 1);
    }
    return out;
  }

  /**
   * Return scripts that actually match `url` after running candidates
   * through `doesScriptMatchUrl`.
   */
  getMatching(url) {
    return this.getCandidates(url).filter(s => doesScriptMatchUrl(s, url));
  }
}

// Cached MatchSet — invalidated whenever the script set changes.
let _matchSetCache = null;
let _matchSetCacheVersion = 0;

function invalidateMatchSet() {
  _matchSetCache = null;
  _matchSetCacheVersion++;
}

async function getMatchSet() {
  if (_matchSetCache) return _matchSetCache;
  const scripts = await ScriptStorage.getAll();
  _matchSetCache = new MatchSet(scripts);
  return _matchSetCache;
}

// ============================================================================
// Context Menu
// ============================================================================

async function setupContextMenus() {
  await chrome.contextMenus.removeAll();
  const settings = await SettingsManager.get();
  if (settings.enableContextMenu === false) return;

  chrome.contextMenus.create({
    id: 'scriptvault-new',
    title: 'Create script for this site',
    contexts: ['page']
  });

  chrome.contextMenus.create({
    id: 'scriptvault-dashboard',
    title: 'Open ScriptVault Dashboard',
    contexts: ['page']
  });

  chrome.contextMenus.create({
    id: 'scriptvault-toggle',
    title: 'Toggle all scripts',
    contexts: ['page']
  });

  // v2.0: Install from link — right-click a .user.js link to install
  chrome.contextMenus.create({
    id: 'scriptvault-install-link',
    title: 'Install userscript from link',
    contexts: ['link'],
    targetUrlPatterns: ['*://*/*.user.js', '*://*/*.user.js?*']
  });

  // Add context menu entries for @run-at context-menu scripts
  const scripts = await ScriptStorage.getAll();
  const contextScripts = scripts.filter(s => s.enabled !== false && s.meta && s.meta['run-at'] === 'context-menu');
  if (contextScripts.length > 0) {
    chrome.contextMenus.create({
      id: 'scriptvault-separator',
      type: 'separator',
      contexts: ['page', 'selection', 'link', 'image']
    });
    for (const script of contextScripts) {
      chrome.contextMenus.create({
        id: `scriptvault-ctx-${script.id}`,
        // Phase 39.31 — pre-emptive clamp; Chrome visually ellipsises long
        // context-menu titles but the spec proposal may make oversize titles
        // an error in the future.
        title: _clampString(script.meta.name || script.id, SV_CONTEXT_MENU_TITLE_MAX),
        contexts: ['page', 'selection', 'link', 'image']
      });
    }
  }
}

chrome.runtime.onInstalled.addListener(async (details) => {
  setupContextMenus();

  // v2.0: Initialize backup scheduler (needs alarm registration on install)
  if (typeof BackupScheduler !== 'undefined') {
    try { await BackupScheduler.init(); } catch (e) { console.error('[ScriptVault] BackupScheduler init error:', e); }
  }

  // v2.0: Schedule notification digest (needs alarm registration on install)
  if (typeof NotificationSystem !== 'undefined') {
    try { await NotificationSystem.scheduleDigest(); } catch (e) { console.error('[ScriptVault] Digest schedule error:', e); }
  }

  // v2.0: Register public API listeners
  if (typeof PublicAPI !== 'undefined') {
    try { PublicAPI.init(); } catch (e) { console.error('[ScriptVault] PublicAPI init error:', e); }
  }

  // Note: Migration.run() is called in the main init() function, not here,
  // to avoid running it twice on install (onInstalled + init both fire).
});

chrome.contextMenus.onClicked.addListener(async (info, tab) => {
  switch (info.menuItemId) {
    case 'scriptvault-new': {
      if (!tab?.url) break;
      try {
        const url = new URL(tab.url);
        chrome.tabs.create({
          url: `pages/dashboard.html?new=1&host=${encodeURIComponent(url.hostname)}`
        });
      } catch { chrome.tabs.create({ url: 'pages/dashboard.html?new=1' }); }
      break;
    }
    case 'scriptvault-dashboard':
      chrome.tabs.create({ url: 'pages/dashboard.html' });
      break;
    case 'scriptvault-toggle': {
      const settings = await SettingsManager.get();
      await SettingsManager.set('enabled', !settings.enabled);
      await registerAllScripts(true);
      await updateBadge();
      break;
    }
    case 'scriptvault-install-link': {
      // v2.0: Install userscript from a right-clicked .user.js link
      const linkUrl = info.linkUrl;
      if (linkUrl) {
        try {
          const response = await fetch(linkUrl);
          if (!response.ok) throw new Error(`HTTP ${response.status}`);
          const code = await response.text();
          if (code.includes('==UserScript==')) {
            await chrome.storage.local.set({
              pendingInstall: { code, url: linkUrl, timestamp: Date.now() }
            });
            chrome.tabs.create({ url: chrome.runtime.getURL('pages/install.html') });
          } else {
            chrome.notifications.create({
              type: 'basic', iconUrl: 'images/icon128.png',
              title: 'Not a Userscript',
              message: 'The linked file does not contain a valid ==UserScript== block.'
            });
          }
        } catch (e) {
          chrome.notifications.create({
            type: 'basic', iconUrl: 'images/icon128.png',
            title: 'Install Failed',
            message: `Could not fetch script: ${e.message}`
          });
        }
      }
      break;
    }
    default: {
      // Handle @run-at context-menu script execution
      if (info.menuItemId && typeof info.menuItemId === 'string' && info.menuItemId.startsWith('scriptvault-ctx-')) {
        const scriptId = info.menuItemId.replace('scriptvault-ctx-', '');
        const script = await ScriptStorage.get(scriptId);
        if (script && tab?.id) {
          try {
            // Build wrapped script with GM API support (same as auto-registered scripts)
            const meta = script.meta;
            const requires = Array.isArray(meta.require) ? meta.require : (meta.require ? [meta.require] : []);
            const requireScripts = [];
            for (const url of requires) {
              try {
                const code = await fetchRequireScript(url);
                if (code) requireScripts.push({ url, code });
              } catch (e) {}
            }
            const storedValues = await ScriptValues.getAll(script.id) || {};
            const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, [], []);
            // Execute in ISOLATED world (content script context) which has chrome.runtime access
            // The wrapper's sendToBackground uses chrome.runtime.sendMessage directly
            await chrome.scripting.executeScript({
              target: { tabId: tab.id },
              func: (code) => { (0, eval)(code); },
              args: [wrappedCode]
            });
            // Feedback notification
            const settings = await SettingsManager.get();
            if (settings.notifyOnError !== false) {
              chrome.notifications.create({
                type: 'basic',
                iconUrl: 'images/icon128.png',
                title: 'Script Executed',
                message: `${script.meta.name} ran via context menu`
              });
            }
          } catch (e) {
            console.error(`[ScriptVault] Context-menu script execution failed:`, e);
            chrome.notifications.create({
              type: 'basic',
              iconUrl: 'images/icon128.png',
              title: 'Script Failed',
              message: `${script.meta.name}: ${e.message || 'Unknown error'}`
            });
          }
        }
      }
      break;
    }
  }
});

// ============================================================================
// Keyboard Shortcuts
// ============================================================================

chrome.commands.onCommand.addListener(async (command) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  switch (command) {
    case 'open_dashboard':
      chrome.tabs.create({ url: 'pages/dashboard.html' });
      break;
    case 'toggle_scripts': {
      const settings = await SettingsManager.get();
      await SettingsManager.set('enabled', !settings.enabled);
      await registerAllScripts(true);
      await updateBadge();

      chrome.notifications.create({
        type: 'basic',
        iconUrl: 'images/icon128.png',
        title: 'ScriptVault',
        message: settings.enabled ? 'Scripts disabled' : 'Scripts enabled'
      });
      break;
    }
  }
});

// ============================================================================
// Phase 39.29 — Omnibox keyword "sv"
// ============================================================================
// Type `sv ` in the address bar, then a fragment of any installed script's
// name or @tag. Suggestions surface inline; Enter opens the script in the
// dashboard editor. Chrome 149+ stabilized the Omnibox API for MV3 SW
// contexts (previously the listeners required a DOM-backed page).
//
// Suggestion budget: Chrome shows at most ~6 suggestions; we cap our matches
// at 8 to leave room for default-suggestion render slop. Matching is a simple
// case-insensitive substring across name + namespace + tags — Phase 12.2's
// fuzzy index isn't wired through to the SW yet.

if (chrome.omnibox?.onInputChanged) {
  chrome.omnibox.onInputChanged.addListener(async (text, suggest) => {
    try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
    const query = (text || '').trim().toLowerCase();
    if (!query) {
      suggest([]);
      return;
    }
    try {
      const scripts = await ScriptStorage.getAll();
      const matches = [];
      for (const s of scripts) {
        const name = (s.meta?.name || '').toLowerCase();
        const ns = (s.meta?.namespace || '').toLowerCase();
        const tags = Array.isArray(s.meta?.tag) ? s.meta.tag.map(t => String(t).toLowerCase()) : [];
        if (name.includes(query) || ns.includes(query) || tags.some(t => t.includes(query))) {
          matches.push(s);
          if (matches.length >= 8) break;
        }
      }
      suggest(matches.map(s => ({
        // `content` is the value that becomes the URL bar text on Enter; we
        // encode the script ID so onInputEntered can dispatch without a
        // second lookup.
        content: `id:${s.id}`,
        // `description` is HTML-allowed but limited — clamp the script name
        // through the same WECG #935 string-length guard used for context-
        // menu titles.
        description: `<match>${_clampString((s.meta?.name || s.id), SV_CONTEXT_MENU_TITLE_MAX)}</match>` +
          (s.meta?.version ? ` <dim>v${escapeOmnibox(s.meta.version)}</dim>` : '') +
          (s.enabled === false ? ' <dim>(disabled)</dim>' : '')
      })));
    } catch (e) {
      console.warn('[ScriptVault] Omnibox onInputChanged failed:', e?.message || e);
      suggest([]);
    }
  });

  chrome.omnibox.onInputEntered.addListener(async (text, _disposition) => {
    try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
    let scriptId = null;
    const m = (text || '').match(/^id:(.+)$/);
    if (m) {
      scriptId = m[1].trim();
    } else {
      // User typed a query and hit Enter without picking a suggestion — open
      // the dashboard with the search pre-filled.
      chrome.tabs.create({ url: `pages/dashboard.html?search=${encodeURIComponent(text || '')}` });
      return;
    }
    chrome.tabs.create({ url: `pages/dashboard.html#script/${encodeURIComponent(scriptId)}` });
  });
}

// Minimal HTML-entity escape for omnibox description strings. The omnibox
// renderer accepts a small XML subset (<match>, <dim>, <url>); content
// outside those tags must be escaped or Chrome silently drops the suggestion.
function escapeOmnibox(s) {
  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
}

// ============================================================================
// Alarms (Auto-update & Sync)
// ============================================================================

// Stats save coalescing — chrome.alarms instead of setTimeout so the debounce
// survives MV3 service-worker termination. Minimum delayInMinutes is 0.5 in
// production (Chrome enforces a 30s floor for non-development extensions); in
// dev builds the smaller value below applies.
const STATS_SAVE_ALARM = 'statsSave';
function _debouncedStatsSave() {
  // delayInMinutes 0.1 = 6s in unpacked dev; production extensions clamp to 30s.
  // ScriptStorage.save is idempotent, so creating the alarm repeatedly while
  // pending only resets the timer — that's the intended debounce.
  try {
    chrome.alarms.create(STATS_SAVE_ALARM, { delayInMinutes: 0.1 });
  } catch (_) { /* alarms unavailable (e.g. SW shutting down) — drop the write */ }
}

let _backgroundTaskRunning = false;
let _backgroundTaskToken = 0;
chrome.alarms.onAlarm.addListener(async (alarm) => {
  // Cold-start: an alarm can wake the SW before init() finishes. Wait for it
  // so handlers below see a fully-initialised ScriptStorage / SettingsManager.
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }

  // Stats save (coalesces rapid reportExecTime/Error writes)
  if (alarm.name === STATS_SAVE_ALARM) {
    try { await ScriptStorage.save(); } catch (_) { /* non-critical */ }
    return;
  }

  // Handle notification auto-close alarms
  if (alarm.name.startsWith('notif_clear_')) {
    const notifId = alarm.name.slice('notif_clear_'.length);
    chrome.notifications.clear(notifId).catch(() => {});
    if (self._notifCallbacks) {
      self._notifCallbacks.delete(notifId);
      SessionState.persistNotifCallbacks();
    }
    return;
  }

  // Handle notification context cleanup alarms
  if (alarm.name.startsWith('notifCtx_clean_')) {
    const notifId = alarm.name.slice('notifCtx_clean_'.length);
    chrome.storage.local.remove(`notifCtx_${notifId}`).catch(() => {});
    return;
  }

  // Handle @crontab script execution alarms (independent of the update/sync mutex)
  if (alarm.name.startsWith('crontab_')) {
    const scriptId = alarm.name.slice('crontab_'.length);
    handleCrontabAlarm(scriptId).catch(e => console.error('[ScriptVault] Crontab alarm error:', e));
    return;
  }

  // Delegate to NotificationSystem for weekly-digest + internal context alarms.
  // Without this dispatch the `scriptvault-weekly-digest` alarm would fire into
  // nothing (the branches below only handle autoUpdate/autoSync), so the digest
  // notification — which users explicitly opt into via prefs.digest — would
  // silently never generate.
  if (typeof NotificationSystem !== 'undefined' && typeof NotificationSystem.handleAlarm === 'function') {
    try {
      const handled = await NotificationSystem.handleAlarm(alarm);
      if (handled) return;
    } catch (e) {
      console.error('[ScriptVault] NotificationSystem alarm error:', e);
    }
  }

  // Mutual exclusion — don't run update and sync concurrently
  if (_backgroundTaskRunning) {
    debugLog('Skipping alarm', alarm.name, '- another task is running');
    return;
  }
  _backgroundTaskRunning = true;
  // Safety timeout: release mutex after 5 minutes even if the task hangs.
  // Each task gets a unique token so the late-finishing task can tell whether
  // the safety timer has already released the mutex for the next task — if so,
  // the stale finally block must NOT clobber the new task's `true` flag.
  const myToken = ++_backgroundTaskToken;
  const safetyTimer = setTimeout(() => {
    if (_backgroundTaskToken === myToken) _backgroundTaskRunning = false;
  }, 300000);
  try {
    if (alarm.name === 'autoUpdate') {
      await UpdateSystem.autoUpdate();
    } else if (alarm.name === 'autoSync') {
      await CloudSync.sync();
    }
  } catch (e) {
    console.error('[ScriptVault] Alarm handler error:', e);
  } finally {
    clearTimeout(safetyTimer);
    if (_backgroundTaskToken === myToken) _backgroundTaskRunning = false;
  }
});

// ============================================================================
// @crontab Support
// ============================================================================

// Convert a simplified cron expression to a period in minutes.
// Chrome alarms have a minimum of 1 minute.
// Supports: every-N-minutes, hourly, every-N-hours, daily.
// Falls back to 1 minute for complex expressions.
function parseCronToMinutes(expr) {
  if (!expr || typeof expr !== 'string') return 60;
  const parts = expr.trim().split(/\s+/);
  if (parts.length < 5) return 60;
  const [min, hour, dom, month, dow] = parts;
  if (min.startsWith('*/') && hour === '*' && dom === '*' && month === '*' && dow === '*') {
    const n = parseInt(min.slice(2), 10);
    return isNaN(n) || n < 1 ? 1 : Math.min(n, 1440);
  }
  if (min === '0' && hour.startsWith('*/') && dom === '*' && month === '*' && dow === '*') {
    const n = parseInt(hour.slice(2), 10);
    return isNaN(n) || n < 1 ? 60 : Math.min(n * 60, 1440);
  }
  if (min === '0' && hour === '*' && dom === '*' && month === '*' && dow === '*') {
    return 60;
  }
  if (min === '0' && hour === '0' && dom === '*' && month === '*' && dow === '*') {
    return 1440;
  }
  // Complex expression not supported by simplified parser — fall back to hourly
  debugLog(`[parseCronToMinutes] Unrecognized cron expression: "${expr}", defaulting to 60 min`);
  return 60;
}

/** Execute a @crontab script in all currently-open matching tabs. */
async function handleCrontabAlarm(scriptId) {
  const script = await ScriptStorage.get(scriptId);
  if (!script || !script.enabled || !script.meta?.crontab) {
    chrome.alarms.clear('crontab_' + scriptId).catch(() => {});
    return;
  }

  const meta = script.meta;
  const hasMatches = (meta.match && meta.match.length > 0) || (meta.include && meta.include.length > 0);
  if (!hasMatches) {
    debugLog(`@crontab script ${meta.name} has no @match patterns, skipping`);
    return;
  }

  // Fetch @require scripts
  const requireScripts = [];
  const requires = Array.isArray(meta.require) ? meta.require : (meta.require ? [meta.require] : []);
  for (const url of requires) {
    try {
      const code = await fetchRequireScript(url);
      if (code) requireScripts.push({ url, code });
    } catch (e) {}
  }

  const storedValues = await ScriptValues.getAll(script.id) || {};
  // Extract regex @include/@exclude patterns for runtime URL guard in wrapper
  const regexIncludes = [];
  const regexExcludes = [];
  for (const inc of (meta.include || [])) {
    if (/^\/.*\/$|^\/.*\/[gimsuy]+$/.test(inc)) regexIncludes.push(inc);
  }
  for (const exc of (meta.exclude || [])) {
    if (/^\/.*\/$|^\/.*\/[gimsuy]+$/.test(exc)) regexExcludes.push(exc);
  }
  const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, regexIncludes, regexExcludes);

  const tabs = await chrome.tabs.query({ status: 'complete' });
  for (const tab of tabs) {
    if (!tab.url || !tab.id) continue;
    if (!doesScriptMatchUrl(script, tab.url)) continue;
    try {
      await chrome.scripting.executeScript({
        target: { tabId: tab.id },
        func: (code) => { (new Function(code))(); },
        args: [wrappedCode],
        world: 'ISOLATED'
      });
      debugLog(`@crontab ${meta.name}: executed in tab ${tab.id}`);
    } catch (e) {
      debugLog(`@crontab ${meta.name}: failed in tab ${tab.id}: ${e.message}`);
    }
  }
}

/** Create/refresh chrome alarms for all enabled @crontab scripts. */
async function setupCrontabAlarms() {
  const scripts = await ScriptStorage.getAll();
  for (const script of scripts) {
    const alarmName = 'crontab_' + script.id;
    await chrome.alarms.clear(alarmName).catch(() => {});
    if (script.enabled && script.meta?.crontab) {
      const minutes = Math.max(1, parseCronToMinutes(script.meta.crontab));
      chrome.alarms.create(alarmName, { periodInMinutes: minutes });
    }
  }
}

async function setupAlarms() {
  const settings = await SettingsManager.get();
  
  // Clear only the alarms we manage here (preserve notification/backup alarms)
  await chrome.alarms.clear('autoUpdate').catch(() => {});
  await chrome.alarms.clear('autoSync').catch(() => {});
  
  // Setup auto-update alarm
  // checkInterval is hours from dashboard, updateInterval is ms legacy
  if (settings.autoUpdate) {
    const intervalMs = settings.checkInterval
      ? parseInt(settings.checkInterval) * 3600000
      : (settings.updateInterval || 86400000);
    chrome.alarms.create('autoUpdate', {
      periodInMinutes: Math.max(1, intervalMs / 60000)
    });
  }
  
  // Setup sync alarm
  if (settings.syncEnabled && settings.syncProvider !== 'none') {
    const syncMs = settings.syncInterval || 3600000; // Default 1 hour
    chrome.alarms.create('autoSync', {
      periodInMinutes: Math.max(1, syncMs / 60000)
    });
  }

  // Setup @crontab alarms for all enabled scripts
  await setupCrontabAlarms();
}

// ============================================================================
// Tab Listeners (for badge updates)
// ============================================================================

// Update badge when tab is activated
chrome.tabs.onActivated.addListener(async (activeInfo) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  try {
    const tab = await chrome.tabs.get(activeInfo.tabId);
    if (tab.url) {
      await updateBadgeForTab(activeInfo.tabId, tab.url);
    }
  } catch (e) {
    // Tab might not exist
  }
});

// Update badge when tab URL changes
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  if (changeInfo.url || changeInfo.status === 'complete') {
    if (tab.url) {
      await updateBadgeForTab(tabId, tab.url);
    }
  }

  // Forward audio state changes to watched tabs
  if (('audible' in changeInfo || 'mutedInfo' in changeInfo) && self._audioWatchedTabs?.has(tabId)) {
    try {
      await chrome.tabs.sendMessage(tabId, {
        action: 'audioStateChanged',
        data: {
          muted: tab.mutedInfo?.muted || false,
          reason: tab.mutedInfo?.reason || 'user',
          audible: tab.audible || false
        }
      });
    } catch (e) {
      // Tab may have been closed
      self._audioWatchedTabs.delete(tabId);
      SessionState.persistAudioWatchedTabs();
    }
  }
});

// GM_openInTab onclose: fire callback when tracked tab closes
chrome.tabs.onRemoved.addListener(async (tabId) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  const tracker = self._openTabTrackers?.get(tabId);
  if (tracker) {
    chrome.tabs.sendMessage(tracker.callerTabId, {
      action: 'openedTabClosed',
      data: { tabId, scriptId: tracker.scriptId }
    }).catch(() => {});
    self._openTabTrackers.delete(tabId);
    SessionState.persistOpenTabTrackers();
  }
  // Clean up audio watch tracking for closed tabs
  if (self._audioWatchedTabs?.delete(tabId)) {
    SessionState.persistAudioWatchedTabs();
  }
});

// GM_notification onclick/ondone: fire callbacks on notification interaction
chrome.notifications.onClicked.addListener(async (notifId) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  const cb = self._notifCallbacks?.get(notifId);
  if (cb && cb.hasOnclick) {
    chrome.tabs.sendMessage(cb.tabId, {
      action: 'notificationEvent',
      data: { notifId, scriptId: cb.scriptId, type: 'click' }
    }).catch(() => {});
  }
});

chrome.notifications.onClosed.addListener(async (notifId, byUser) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  const cb = self._notifCallbacks?.get(notifId);
  if (cb && cb.hasOndone) {
    chrome.tabs.sendMessage(cb.tabId, {
      action: 'notificationEvent',
      data: { notifId, scriptId: cb.scriptId, type: 'done', byUser }
    }).catch(() => {});
  }
  if (self._notifCallbacks) {
    self._notifCallbacks.delete(notifId);
    SessionState.persistNotifCallbacks();
  }
});

// Phase 11.11 — Notification button click routing.
// ScriptCat exposes `e.buttonClickIndex` on the onclick event when the user
// clicks an action button. Forward the index to the originating tab so the
// wrapper-side onbuttonclick callback can fire.
chrome.notifications.onButtonClicked.addListener(async (notifId, buttonIndex) => {
  try { await ensureInitialized(); } catch (_) { /* logged in init() */ }
  const cb = self._notifCallbacks?.get(notifId);
  if (cb && cb.hasOnbuttonclick) {
    chrome.tabs.sendMessage(cb.tabId, {
      action: 'notificationEvent',
      data: { notifId, scriptId: cb.scriptId, type: 'buttonClick', buttonIndex }
    }).catch(() => {});
  }
});

// Update badge when window focus changes
chrome.windows.onFocusChanged.addListener(async (windowId) => {
  if (windowId === chrome.windows.WINDOW_ID_NONE) return;
  
  try {
    const [tab] = await chrome.tabs.query({ active: true, windowId });
    if (tab?.id && tab.url) {
      await updateBadgeForTab(tab.id, tab.url);
    }
  } catch (e) {
    // Window might not exist
  }
});

// ============================================================================
// Userscript Installation Handler
// ============================================================================

// Intercept navigation to .user.js files
// Map<url, Promise<'install' | 'pass-through'>> dedups concurrent fetches for
// the same URL and lets later callers reuse the first fetch's result. Without
// this, opening the same .user.js in two tabs at once left the second tab on
// the raw script source (the dedup short-circuit returned before it could
// redirect to install.html).
const _pendingFetches = new Map();
const MAX_SCRIPT_SIZE = 5 * 1024 * 1024; // 5MB limit

async function _fetchPendingUserscript(url) {
  const controller = new AbortController();
  const timeoutId = setTimeout(() => controller.abort(), 30000);
  try {
    const response = await fetch(url, { signal: controller.signal });
    if (!response.ok) {
      throw new Error(`HTTP ${response.status}: ${response.statusText}`);
    }
    const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
    if (contentLength > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(contentLength)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }
    const code = await response.text();
    if (code.length > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }
    if (!code.includes('==UserScript==')) {
      return { action: 'pass-through' };
    }
    await chrome.storage.local.set({
      pendingInstall: { url, code, timestamp: Date.now() }
    });
    return { action: 'install' };
  } catch (error) {
    console.error('[ScriptVault] Failed to fetch script:', error);
    await chrome.storage.local.set({
      pendingInstall: { url, error: error.message, timestamp: Date.now() }
    });
    return { action: 'install' };
  } finally {
    clearTimeout(timeoutId);
  }
}

chrome.webNavigation.onBeforeNavigate.addListener(async (details) => {
  // Only handle main frame navigation
  if (details.frameId !== 0) return;

  const url = details.url;

  // Check if this is a .user.js URL
  if (!url.match(/\.user\.js(\?.*)?$/i)) return;

  // Don't intercept extension pages
  if (url.startsWith('chrome-extension://')) return;

  debugLog('Intercepting userscript URL:', url);

  let pending = _pendingFetches.get(url);
  if (!pending) {
    pending = _fetchPendingUserscript(url).finally(() => {
      _pendingFetches.delete(url);
    });
    _pendingFetches.set(url, pending);
  }

  try {
    const result = await pending;
    if (result.action === 'install') {
      chrome.tabs.update(details.tabId, {
        url: chrome.runtime.getURL('pages/install.html')
      });
    } else {
      // Not a userscript — let this tab's navigation continue and clear any
      // stale pendingInstall written by an earlier interception of the same URL.
      await chrome.storage.local.remove('pendingInstall');
    }
  } catch (e) {
    // _fetchPendingUserscript catches its own errors; any throw here means the
    // tab update or storage cleanup failed. Surface so it appears in logs.
    console.error('[ScriptVault] webNav handler error:', e);
  }
}, {
  url: [
    { urlMatches: '.*\\.user\\.js(\\?.*)?$' }
  ]
});

// Handle direct script installation from raw source code (file picker, drag/drop)
async function installFromCode(code) {
  try {
    if (typeof code !== 'string' || !code) {
      throw new Error('No script content provided');
    }

    if (code.length > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }

    if (!code.includes('==UserScript==')) {
      throw new Error('Not a valid userscript');
    }

    const parsed = parseUserscript(code);
    if (parsed.error) {
      throw new Error(parsed.error);
    }
    const meta = parsed.meta;
    const allScripts = await ScriptStorage.getAll();

    const existing = allScripts.find(s => s.meta.name === meta.name && s.meta.namespace === meta.namespace);
    const id = existing ? existing.id : generateId();

    const script = {
      id,
      code,
      meta,
      enabled: existing ? existing.enabled : true,
      position: existing ? existing.position : allScripts.length,
      createdAt: existing ? existing.createdAt : Date.now(),
      updatedAt: Date.now()
    };

    await ScriptStorage.set(id, script);
    await registerAllScripts(true);
    await updateBadge();
    await autoReloadMatchingTabs(script);

    return { success: true, script };
  } catch (error) {
    return { success: false, error: error.message };
  }
}

// Handle direct script installation from URL
async function installFromUrl(url) {
  try {
    // Reject non-http(s) schemes (file://, data:, blob:, chrome-extension://,
    // javascript:). The dashboard/popup are the only legitimate callers, but
    // defense-in-depth keeps a malformed install request from triggering a
    // fetch on an unexpected scheme.
    if (typeof url !== 'string' || !url) {
      throw new Error('No URL provided');
    }
    let parsedUrl;
    try {
      parsedUrl = new URL(url);
    } catch {
      throw new Error('Invalid URL');
    }
    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
      throw new Error('URL must be http(s)://');
    }
    // Timeout after 30 seconds
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), 30000);
    let code;
    try {
      const response = await fetch(url, { signal: controller.signal });

      if (!response.ok) {
        throw new Error(`HTTP ${response.status}`);
      }

      // Size limit: 5MB (same as webNavigation handler)
      const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
      if (contentLength > MAX_SCRIPT_SIZE) {
        throw new Error(`Script too large (${formatBytes(contentLength)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
      }

      code = await response.text();
    } finally {
      clearTimeout(timeoutId);
    }

    return await installFromCode(code);
  } catch (error) {
    return { success: false, error: error.message };
  }
}

// ============================================================================
// Initialization
// ============================================================================

async function init() {
  await SettingsManager.init();

  // Rehydrate ephemeral runtime maps (notification callbacks, opened-tab
  // trackers, audio-watched tabs) from chrome.storage.session so callbacks
  // registered before the SW was killed still fire after wake.
  await SessionState.hydrate();

  // v2.0: Run migration BEFORE ScriptStorage.init() so that any migration-driven
  // rewrites of `userscripts` storage are visible to the in-memory cache. Running
  // it after ScriptStorage.init() left the cache pinned to pre-migration data,
  // causing every subsequent cached read (dashboard, registration, badge) to see
  // the old shape until the next SW cold start.
  if (typeof Migration !== 'undefined') {
    try { await Migration.run(); } catch (e) { console.error('[ScriptVault] Migration error:', e); }
  }

  await ScriptStorage.init();

  // Apply language setting to I18n
  const settings = await SettingsManager.get();
  if (settings.language && settings.language !== 'default' && settings.language !== 'auto') {
    I18n.setLocale(settings.language);
  }

  // Configure userScripts world
  await configureUserScriptsWorld();

  // Setup context menus
  await setupContextMenus();

  // Register all enabled scripts — force re-registration on extension install/update
  // (new GM_* wrappers / match patterns require rewriting all registered scripts).
  // On plain SW wake within the same extension version, skip the destructive cycle.
  let needsForceReregister = false;
  try {
    const currentVersion = chrome.runtime.getManifest().version;
    const stored = await chrome.storage.local.get('_lastRegisteredVersion');
    if (stored._lastRegisteredVersion !== currentVersion) {
      needsForceReregister = true;
      await chrome.storage.local.set({ _lastRegisteredVersion: currentVersion });
    }
  } catch (e) {
    // Unable to read version — force re-register to be safe on update
    needsForceReregister = true;
  }
  await registerAllScripts(needsForceReregister);

  await updateBadge();
  await setupAlarms();

  // Clean up stale persistent caches (require_cache_, res_cache_)
  cleanupStaleCaches();

  // v2.0: Auto-cleanup storage if above threshold
  if (typeof QuotaManager !== 'undefined') {
    try { await QuotaManager.autoCleanup(); } catch (e) { console.error('[ScriptVault] Quota cleanup error:', e); }
  }

  // v2.0: Register global error handlers for ErrorLog
  if (typeof ErrorLog !== 'undefined' && typeof ErrorLog.registerGlobalHandlers === 'function') {
    ErrorLog.registerGlobalHandlers();
  }

  // v2.0 module initializers: these register alarm/message listeners and
  // load per-module state. Previously they were only called from
  // chrome.runtime.onInstalled, which only fires at install/update — after
  // the first SW shutdown (~30s idle) the listeners were gone and modules
  // were dormant until the next extension update. Each module is
  // `_initialized`-guarded so calling them every wake is cheap and safe.
  if (typeof BackupScheduler !== 'undefined') {
    try { await BackupScheduler.init(); } catch (e) { console.error('[ScriptVault] BackupScheduler init error:', e); }
  }
  if (typeof NotificationSystem !== 'undefined' && typeof NotificationSystem.init === 'function') {
    try { await NotificationSystem.init(); } catch (e) { console.error('[ScriptVault] NotificationSystem init error:', e); }
  }
  if (typeof PublicAPI !== 'undefined') {
    try { await PublicAPI.init(); } catch (e) { console.error('[ScriptVault] PublicAPI init error:', e); }
  }
  if (typeof EasyCloudSync !== 'undefined') {
    try { await EasyCloudSync.init(); } catch (e) { console.error('[ScriptVault] EasyCloudSync init error:', e); }
  }

  // Phase 39.8 — OS-policy script provisioning. Read chrome.storage.managed
  // for an array of admin-pushed userscripts; install/update each. The
  // managed-storage change listener (wired below) re-runs this on policy
  // updates so admins can roll out new scripts without re-shipping the
  // extension.
  applyManagedScripts().catch(e => {
    console.warn('[ScriptVault] Managed-script provisioning failed:', e?.message || e);
  });

  // Phase 40.10 — Reconcile DNR rule map against live DNR + ScriptStorage now
  // that both are hydrated. Catches orphan rules left behind when the SW was
  // killed mid-delete or mid-update. Fire-and-forget so a slow DNR query
  // doesn't block the rest of the wake path.
  reconcileWebRequestRuleMap().catch(e => {
    console.warn('[ScriptVault] DNR reconcile failed on init:', e?.message || e);
  });

  console.log('[ScriptVault] Service worker ready');
}

// Phase 39.8 — OS-policy script provisioning (TM 5.5.0 parity).
//
// Admins push userscripts via the standard Chrome enterprise policy mechanism
// (`ExtensionSettings` JSON → `chrome.storage.managed`). The expected shape is:
//
//   chrome.storage.managed.managedScripts = [
//     { url: "https://internal.corp/foo.user.js" },   // fetched + installed
//     { code: "// ==UserScript== ... " }              // installed inline
//   ]
//
// Each managed script is flagged `script.settings.managed = true`. A future
// dashboard pass surfaces this with a "Managed by your organization" pill
// (deferred — UI scope, dashboard.js). Managed scripts are NOT auto-deleted
// from local storage when removed from policy; admins can clear via an explicit
// `chrome.storage.managed.managedScriptsCleanup = true` toggle if needed.
async function applyManagedScripts() {
  if (!chrome.storage?.managed) return; // Not all browsers expose .managed
  let policy;
  try {
    policy = await chrome.storage.managed.get(['managedScripts', 'managedScriptsCleanup']);
  } catch (e) {
    // No managed policy attached or restricted-by-policy — silently skip.
    return;
  }
  const items = Array.isArray(policy?.managedScripts) ? policy.managedScripts : [];
  if (items.length === 0 && !policy?.managedScriptsCleanup) return;

  const allScripts = await ScriptStorage.getAll();
  const installedByOrigin = new Map();
  for (const s of allScripts) {
    if (s?.settings?.managed && s?.settings?.managedOriginKey) {
      installedByOrigin.set(s.settings.managedOriginKey, s);
    }
  }
  const policyOriginKeys = new Set();

  for (const item of items) {
    if (!item || typeof item !== 'object') continue;
    const originKey = typeof item.url === 'string' ? `url:${item.url}` :
                      typeof item.code === 'string' ? `code:${item.code.slice(0, 64)}` : null;
    if (!originKey) continue;
    policyOriginKeys.add(originKey);

    let code;
    if (typeof item.url === 'string') {
      try {
        const res = await installFromUrl(item.url);
        if (res?.error) {
          console.warn('[ScriptVault] Managed script install (URL) failed:', item.url, res.error);
          continue;
        }
      } catch (e) {
        console.warn('[ScriptVault] Managed script fetch failed:', item.url, e?.message || e);
        continue;
      }
    } else if (typeof item.code === 'string' && item.code) {
      code = item.code;
      try {
        const res = await installFromCode(code);
        if (res?.error) {
          console.warn('[ScriptVault] Managed script install (inline) failed:', res.error);
          continue;
        }
      } catch (e) {
        console.warn('[ScriptVault] Managed inline install failed:', e?.message || e);
        continue;
      }
    } else {
      continue;
    }

    // Tag the installed script as managed. installFromUrl/installFromCode
    // dedup by name+namespace so we have to look it up post-install.
    try {
      const fresh = await ScriptStorage.getAll();
      const lastInstalled = fresh.find(s =>
        !s?.settings?.managed && s.updatedAt && Date.now() - s.updatedAt < 30000
      );
      if (lastInstalled) {
        await ScriptStorage.set(lastInstalled.id, {
          ...lastInstalled,
          settings: {
            ...(lastInstalled.settings || {}),
            managed: true,
            managedOriginKey: originKey,
            managedAppliedAt: Date.now()
          }
        });
      }
    } catch (e) {
      console.warn('[ScriptVault] Managed-flag tagging failed:', e?.message || e);
    }
  }

  // Optional cleanup: remove managed scripts whose origin key is no longer in
  // the policy AND the admin opted into pruning. Without the explicit
  // `managedScriptsCleanup: true` flag, we leave orphans alone — better to keep
  // a script than silently delete one a sysadmin still wants users to have.
  if (policy?.managedScriptsCleanup === true) {
    for (const [originKey, script] of installedByOrigin.entries()) {
      if (!policyOriginKeys.has(originKey)) {
        try {
          await ScriptStorage.delete(script.id);
          debugLog(`[ManagedScripts] Pruned ${script.meta?.name} (no longer in policy)`);
        } catch (e) {
          console.warn('[ScriptVault] Managed prune failed:', script.id, e?.message || e);
        }
      }
    }
  }
}

// Re-run provisioning whenever the managed-storage area changes.
if (chrome.storage?.onChanged) {
  chrome.storage.onChanged.addListener((changes, areaName) => {
    if (areaName !== 'managed') return;
    if (!('managedScripts' in changes) && !('managedScriptsCleanup' in changes)) return;
    applyManagedScripts().catch(e => {
      console.warn('[ScriptVault] Managed-storage onChanged handler failed:', e?.message || e);
    });
  });
}

// Remove expired persistent cache entries and stale trash items to prevent storage bloat.
//
// Phase 39.25 — VM #2453 @require cache invalidation on dependency update.
// In addition to age-based TTL eviction, drop require_cache_* entries whose
// URL hash is no longer referenced by any installed script. A script that
// bumps its @require from `lib@1.0.0` to `lib@1.1.0` previously kept the old
// entry until the 7-day TTL fired; now the orphan is evicted on the next
// cleanup tick.
async function cleanupStaleCaches() {
  try {
    const all = await chrome.storage.local.get(null);
    const now = Date.now();
    const maxRequireAge = 7 * 24 * 60 * 60 * 1000; // 7 days
    const maxResourceAge = ResourceCache.maxAge; // 24 hours
    const keysToRemove = [];

    // Phase 39.25 — compute the live set of `require_cache_<sha256(url)>` keys
    // from every script's @require list. Anything in storage outside this set
    // is an orphan (no script references it).
    let liveRequireKeys = null;
    try {
      const scripts = await ScriptStorage.getAll();
      const urls = new Set();
      for (const s of scripts || []) {
        const reqs = Array.isArray(s?.meta?.require) ? s.meta.require : [];
        for (const u of reqs) if (typeof u === 'string' && u) urls.add(u);
      }
      // The cache key is sha256(full URL including any #sri fragment) — match
      // the same hashing the fetcher uses (line 5765 region).
      liveRequireKeys = new Set();
      for (const u of urls) {
        const buf = new TextEncoder().encode(u);
        const hash = await crypto.subtle.digest('SHA-256', buf);
        const hex = Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
        liveRequireKeys.add(`require_cache_${hex}`);
      }
    } catch (e) {
      // If we can't enumerate live keys, fall back to age-only eviction
      // (better than nothing). Logging only — non-critical.
      debugLog('[Cache cleanup] live-key enumeration failed, falling back to age-only:', e?.message || e);
      liveRequireKeys = null;
    }

    for (const [key, value] of Object.entries(all)) {
      if (key.startsWith('require_cache_') && value?.timestamp) {
        const expired = now - value.timestamp > maxRequireAge;
        const orphaned = liveRequireKeys !== null && !liveRequireKeys.has(key);
        if (expired || orphaned) keysToRemove.push(key);
      } else if (key.startsWith('res_cache_') && value?.timestamp) {
        if (now - value.timestamp > maxResourceAge) keysToRemove.push(key);
      }
    }

    if (keysToRemove.length > 0) {
      await chrome.storage.local.remove(keysToRemove);
      debugLog(`Cleaned up ${keysToRemove.length} stale cache entries`);
    }
  } catch (e) {
    // Non-critical, ignore errors
  }

  // Prune sync tombstones older than 30 days (they're only needed during the sync window)
  try {
    const tombstoneData = await chrome.storage.local.get('syncTombstones');
    const tombstones = tombstoneData.syncTombstones || {};
    const cutoff = Date.now() - 30 * 24 * 60 * 60 * 1000;
    const pruned = Object.fromEntries(Object.entries(tombstones).filter(([, ts]) => ts > cutoff));
    if (Object.keys(pruned).length !== Object.keys(tombstones).length) {
      await chrome.storage.local.set({ syncTombstones: pruned });
    }
  } catch (e) { /* non-critical */ }

  // Prune expired trash entries based on trashMode retention setting
  try {
    const settings = await SettingsManager.get();
    const trashMode = settings.trashMode || '30';
    if (trashMode === 'disabled') return;
    const maxAge = trashMode === '1' ? 86400000 : trashMode === '7' ? 604800000 : 2592000000; // 1/7/30 days
    const trashData = await chrome.storage.local.get('trash');
    const trash = trashData.trash || [];
    const now = Date.now();
    const valid = trash.filter(s => now - s.trashedAt < maxAge);
    if (valid.length !== trash.length) {
      await chrome.storage.local.set({ trash: valid });
      debugLog(`Pruned ${trash.length - valid.length} expired trash entries`);
    }
  } catch (e) {
    // Non-critical, ignore errors
  }
}

// Detect Chrome major version from user agent (available in service worker via self.navigator)
function _getChromeVersion() {
  try {
    const m = (self.navigator?.userAgent || '').match(/Chrome\/(\d+)/);
    return m ? parseInt(m[1], 10) : 0;
  } catch (e) {
    return 0;
  }
}

// Configure the userScripts execution world
async function configureUserScriptsWorld() {
  try {
    // Check if userScripts API is available
    if (!chrome.userScripts) {
      // Determine why: Chrome 120+ requires either Developer Mode (pre-138)
      // or the "Allow User Scripts" toggle (138+)
      const ver = _getChromeVersion();
      if (ver >= 138) {
        console.warn('[ScriptVault] userScripts API not available — enable the "Allow User Scripts" toggle in chrome://extensions for ScriptVault');
      } else if (ver >= 120) {
        console.warn('[ScriptVault] userScripts API not available — enable Developer Mode in chrome://extensions');
      } else {
        console.warn('[ScriptVault] userScripts API not available — Chrome 120+ required');
      }
      await SettingsManager.set({ _userScriptsAvailable: false, _chromeVersion: ver });
      return;
    }

    await SettingsManager.set({ _userScriptsAvailable: true, _chromeVersion: _getChromeVersion() });

    // Configure the default USER_SCRIPT world
    await chrome.userScripts.configureWorld({
      csp: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *",
      messaging: true
    });

    debugLog('userScripts world configured (Chrome', _getChromeVersion(), ')');
  } catch (e) {
    console.error('[ScriptVault] Failed to configure userScripts world:', e);
  }
}

// Register all enabled scripts with the userScripts API
async function registerAllScripts(forceReregister = false) {
  try {
    if (!chrome.userScripts) {
      console.warn('[ScriptVault] userScripts API not available');
      return;
    }

    // On normal SW wake, check if scripts are already registered to avoid
    // the destructive unregister→register cycle that creates a gap where
    // scripts aren't active on page navigations.
    //
    // Round 11: Compute a diff between enabled-in-storage and currently-registered.
    // If a previous `Promise.allSettled` registration partially failed, the registered
    // set may be missing some scripts indefinitely — register just the missing subset
    // rather than short-circuiting the whole call.
    if (!forceReregister) {
      try {
        const existing = await chrome.userScripts.getScripts();
        if (existing && existing.length > 0) {
          const settings = await SettingsManager.get();
          if (!settings.enabled) {
            debugLog(`Skipping re-registration: scripts globally disabled`);
            return;
          }
          const scripts = await ScriptStorage.getAll();
          const enabledScripts = scripts.filter(s => s.enabled !== false);
          const registeredIds = new Set(existing.map(s => s.id));
          const enabledIds = new Set(enabledScripts.map(s => s.id));
          const missing = enabledScripts.filter(s => !registeredIds.has(s.id));
          // Stale = registered but no longer in storage OR now disabled.
          // Unregister so wake doesn't leave dead injections active until the
          // next forceReregister cycle.
          const stale = existing
            .map(s => s.id)
            .filter(id => !enabledIds.has(id));

          if (missing.length === 0 && stale.length === 0) {
            debugLog(`Skipping re-registration: ${existing.length} scripts already registered, no diff`);
            return;
          }

          if (stale.length > 0) {
            debugLog(`Unregistering ${stale.length} stale script(s) on wake`);
            try {
              await chrome.userScripts.unregister({ ids: stale });
            } catch (e) {
              console.warn('[ScriptVault] Failed to unregister stale scripts:', e?.message || e);
            }
          }

          if (missing.length === 0) return;

          // Preload @require deps for the missing subset in parallel
          const missingRequires = new Set();
          for (const script of missing) {
            for (const req of (script.meta?.require || [])) {
              missingRequires.add(req);
            }
          }
          if (missingRequires.size > 0) {
            debugLog(`Preloading ${missingRequires.size} @require deps for ${missing.length} missing scripts`);
            // Phase 39.22 — bound each fetch so a CSP-strict / slow server can't
            // deadlock the whole wake path.
            await Promise.allSettled([...missingRequires].map(url => _withTimeout(fetchRequireScript(url), 15000, `fetchRequire:${url}`)));
          }

          debugLog(`Registering ${missing.length} missing script(s) (diff from ${existing.length} already registered)`);
          // Phase 39.22 — per-script registration timeout (VM #2513). Without
          // this, one chrome.userScripts.register() hang blocks the rest.
          const diffResults = await Promise.allSettled(missing.map(script => _withTimeout(registerScript(script), 5000, `registerScript:${script.id}`)));
          const diffFailures = diffResults.filter(r => r.status === 'rejected');
          if (diffFailures.length > 0) {
            console.warn(`[ScriptVault] ${diffFailures.length} missing script(s) failed to register:`, diffFailures.map(r => r.reason?.message || r.reason));
          }
          return;
        }
      } catch (e) {
        // getScripts not available or failed — fall through to full registration
      }
    }

    // Full re-registration: unregister all, then register fresh
    await chrome.userScripts.unregister().catch(() => {});
    
    const scripts = await ScriptStorage.getAll();
    const settings = await SettingsManager.get();
    
    if (!settings.enabled) {
      debugLog('Scripts globally disabled');
      return;
    }
    
    const enabledScripts = scripts.filter(s => s.enabled !== false);

    // Sort by combined @priority + @weight (higher = first), then position.
    // @priority is the legacy ScriptVault directive; @weight is the Userscripts
    // (Safari) standard (1..999). Either bumps a script earlier within the same
    // @run-at — we take the max so authors who set both don't get surprised by
    // the lower one winning.
    enabledScripts.sort((a, b) => {
      const pa = Math.max(a.meta?.priority || 0, a.meta?.weight || 0);
      const pb = Math.max(b.meta?.priority || 0, b.meta?.weight || 0);
      if (pb !== pa) return pb - pa;
      return (a.position || 0) - (b.position || 0);
    });

    debugLog(`Registering ${enabledScripts.length} scripts`);

    // v2.0: Preload all @require dependencies in parallel before registration
    // This prevents N sequential fetches during registration
    const allRequires = new Set();
    for (const script of enabledScripts) {
      for (const req of (script.meta?.require || [])) {
        allRequires.add(req);
      }
    }
    if (allRequires.size > 0) {
      debugLog(`Preloading ${allRequires.size} @require dependencies`);
      const preloadStart = Date.now();
      // Phase 39.22 — see diff-path comment above.
      await Promise.allSettled([...allRequires].map(url => _withTimeout(fetchRequireScript(url), 15000, `fetchRequire:${url}`)));
      debugLog(`Preloaded in ${Date.now() - preloadStart}ms`);
    }

    // Register all scripts in parallel — significantly faster on large script collections
    // Phase 39.22 — per-script timeout (VM #2513).
    const results = await Promise.allSettled(enabledScripts.map(script => _withTimeout(registerScript(script), 5000, `registerScript:${script.id}`)));
    const failures = results.filter(r => r.status === 'rejected');
    if (failures.length > 0) {
      console.warn(`[ScriptVault] ${failures.length} script(s) failed to register:`, failures.map(r => r.reason?.message || r.reason));
    }
  } catch (e) {
    console.error('[ScriptVault] Failed to register scripts:', e);
  }
}

// Register a single script
async function registerScript(script) {
  try {
    const meta = script.meta;
    const settings = script.settings || {};

    // @crontab scripts execute on a schedule rather than on page load.
    // Register a chrome alarm instead of a chrome.userScripts entry.
    if (meta.crontab) {
      const alarmName = 'crontab_' + script.id;
      await chrome.alarms.clear(alarmName).catch(() => {});
      const minutes = Math.max(1, parseCronToMinutes(meta.crontab));
      chrome.alarms.create(alarmName, { periodInMinutes: minutes });
      debugLog(`Registered @crontab: ${meta.name} (every ${minutes} min)`);
      return;
    }

    if (!chrome.userScripts) return;
    
    // Build match patterns with URL override support
    const matches = [];
    const excludeMatches = [];
    
    // Process @match (if enabled in settings)
    if (settings.useOriginalMatches !== false && meta.match && Array.isArray(meta.match)) {
      for (const m of meta.match) {
        if (isValidMatchPattern(m)) {
          matches.push(m);
        }
      }
    }
    
    // Process user @match patterns
    if (settings.userMatches && Array.isArray(settings.userMatches)) {
      for (const m of settings.userMatches) {
        if (isValidMatchPattern(m)) {
          matches.push(m);
        } else {
          // Try to convert glob-style to match pattern
          const converted = convertIncludeToMatch(m);
          if (converted && isValidMatchPattern(converted)) {
            matches.push(converted);
          }
        }
      }
    }
    
    // Collect regex @include/@exclude patterns for runtime filtering
    const regexIncludes = [];
    const regexExcludes = [];

    // Process @include (if enabled in settings)
    if (settings.useOriginalIncludes !== false && meta.include && Array.isArray(meta.include)) {
      for (const inc of meta.include) {
        if (isRegexPattern(inc)) {
          // Regex pattern - extract broad match patterns for registration, filter at runtime
          regexIncludes.push(inc);
          const broad = extractMatchPatternsFromRegex(inc);
          if (broad.length > 0) {
            matches.push(...broad);
          }
        } else {
          const converted = convertIncludeToMatch(inc);
          if (converted && isValidMatchPattern(converted)) {
            matches.push(converted);
          } else if (inc === '*') {
            matches.push('<all_urls>');
          }
        }
      }
    }
    
    // Process user @include patterns
    if (settings.userIncludes && Array.isArray(settings.userIncludes)) {
      for (const inc of settings.userIncludes) {
        const converted = convertIncludeToMatch(inc);
        if (converted && isValidMatchPattern(converted)) {
          matches.push(converted);
        } else if (inc === '*') {
          matches.push('<all_urls>');
        }
      }
    }
    
    // Process @exclude-match (stored as excludeMatch by parser)
    if (meta.excludeMatch && Array.isArray(meta.excludeMatch)) {
      for (const m of meta.excludeMatch) {
        if (isValidMatchPattern(m)) {
          excludeMatches.push(m);
        }
      }
    }
    
    // Process @exclude (if enabled) - convert to exclude matches where possible
    if (settings.useOriginalExcludes !== false && meta.exclude && Array.isArray(meta.exclude)) {
      for (const exc of meta.exclude) {
        if (isRegexPattern(exc)) {
          regexExcludes.push(exc);
          continue;
        }
        const converted = convertIncludeToMatch(exc);
        if (converted && isValidMatchPattern(converted)) {
          excludeMatches.push(converted);
        }
      }
    }
    
    // Process user @exclude patterns
    if (settings.userExcludes && Array.isArray(settings.userExcludes)) {
      for (const exc of settings.userExcludes) {
        const converted = convertIncludeToMatch(exc);
        if (converted && isValidMatchPattern(converted)) {
          excludeMatches.push(converted);
        }
      }
    }
    
    // Add denied hosts as exclude patterns
    const globalSettings = await SettingsManager.get();
    const deniedHosts = globalSettings.deniedHosts;
    if (deniedHosts && Array.isArray(deniedHosts)) {
      for (const host of deniedHosts) {
        if (host) excludeMatches.push(`*://${host}/*`, `*://*.${host}/*`);
      }
    }
    // Add blacklisted pages as exclude patterns
    if (globalSettings.pageFilterMode === 'blacklist' && globalSettings.blacklistedPages) {
      const blacklist = globalSettings.blacklistedPages.split('\n').map(s => s.trim()).filter(Boolean);
      for (const p of blacklist) {
        const converted = convertIncludeToMatch(p);
        if (converted && isValidMatchPattern(converted)) {
          excludeMatches.push(converted);
        }
      }
    }

    // If no matches, use <all_urls> (some scripts use @include *)
    if (matches.length === 0) {
      matches.push('<all_urls>');
    }
    
    // Map run-at values (with per-script setting override)
    const runAtMap = {
      'document-start': 'document_start',
      'document-end': 'document_end',
      'document-idle': 'document_idle',
      'document-body': 'document_end',
      'context-menu': 'document_idle' // context-menu scripts register idle, triggered via context menu
    };

    // @run-in: filter by tab type (normal-tabs, incognito-tabs)
    const runIn = meta['run-in'] || '';
    if (runIn === 'incognito-tabs') {
      // Only run in incognito — skip registration for normal context
      // (chrome.userScripts doesn't support incognito filtering natively,
      // so we inject a runtime guard into the wrapper)
    } else if (runIn === 'normal-tabs') {
      // Only run in normal tabs — runtime guard injected
    }

    // Check for per-script runAt override
    let effectiveRunAt = meta['run-at'];
    if (settings.runAt && settings.runAt !== 'default') {
      effectiveRunAt = settings.runAt;
    }
    const isContextMenu = effectiveRunAt === 'context-menu';
    if (isContextMenu) {
      // Context-menu scripts are not auto-registered; they run on-demand via context menu click
      debugLog(`Skipping auto-register for context-menu script: ${meta.name}`);
      return;
    }
    const runAt = runAtMap[effectiveRunAt] || 'document_idle';

    // Determine execution world based on @inject-into and @sandbox
    // chrome.userScripts API only supports 'USER_SCRIPT' world, not 'MAIN'
    // For @inject-into page / @sandbox raw, we still register in USER_SCRIPT world
    // but pass a flag so the wrapper injects the user's code into the page context via <script>
    const world = 'USER_SCRIPT';
    const injectInto = meta['inject-into'] || 'auto';
    const sandbox = meta.sandbox || '';
    const injectIntoPage = (injectInto === 'page' || sandbox === 'raw');
    
    // Fetch @require dependencies
    const requireScripts = [];
    const requires = Array.isArray(meta.require) ? meta.require : (meta.require ? [meta.require] : []);
    
    const failedRequires = [];
    for (const url of requires) {
      try {
        const code = await fetchRequireScript(url);
        if (code) {
          requireScripts.push({ url, code });
        } else {
          failedRequires.push(url);
        }
      } catch (e) {
        console.warn(`[ScriptVault] Failed to fetch @require ${url}:`, e.message);
        failedRequires.push(url);
      }
    }

    // Track failed @require dependencies on the script for UI notification
    if (failedRequires.length > 0) {
      script.settings = script.settings || {};
      script.settings._failedRequires = failedRequires;
      await ScriptStorage.set(script.id, script);
      debugWarn(`${meta.name}: ${failedRequires.length} @require dependency(s) failed to load`);
    } else if (script.settings?._failedRequires) {
      // Clear previous failures
      delete script.settings._failedRequires;
      await ScriptStorage.set(script.id, script);
    }
    
    // Pre-fetch @resource dependencies
    await ResourceCache.prefetchResources(meta.resource);

    // Pre-fetch storage values for this script
    const storedValues = await ScriptValues.getAll(script.id) || {};
    
    // Build the script code with GM API wrapper, @require scripts, and pre-loaded storage
    if (injectIntoPage) {
      debugLog(`Note: @inject-into page / @sandbox raw not fully supported in MV3, running in USER_SCRIPT world: ${meta.name}`);
    }
    const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, regexIncludes, regexExcludes);
    
    // Register the script
    const registration = {
      id: script.id,
      matches: matches,
      excludeMatches: excludeMatches.length > 0 ? excludeMatches : undefined,
      js: [{ code: wrappedCode }],
      runAt: runAt,
      allFrames: !meta.noframes,
      world: world
    };

    // Chrome 133+: configure and use a per-script worldId for isolation.
    // Each script gets its own USER_SCRIPT world so globals don't bleed across scripts.
    let worldConfigured = false;
    try {
      await chrome.userScripts.configureWorld({
        worldId: script.id,
        csp: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *",
        messaging: true
      });
      worldConfigured = true;
    } catch (e) {
      // Chrome <133 doesn't support worldId on configureWorld — fall through to default world
    }

    if (worldConfigured) {
      registration.worldId = script.id;
    }

    try {
      // Chrome 131+ supports messaging in USER_SCRIPT world
      await chrome.userScripts.register([{ ...registration, messaging: world === 'USER_SCRIPT' }]);
    } catch (e) {
      if (e.message?.includes('messaging')) {
        // Fallback for older Chrome versions that don't support the messaging property
        await chrome.userScripts.register([registration]);
      } else {
        throw e;
      }
    }
    
    debugLog(`Registered: ${meta.name} (${requires.length} @require, ${Object.keys(storedValues).length} stored values)`);

    // Apply @webRequest declarativeNetRequest rules if defined
    if (meta.webRequest) {
      const rules = Array.isArray(meta.webRequest) ? meta.webRequest : [meta.webRequest];
      await applyWebRequestRules(script.id, rules);
    }
  } catch (e) {
    console.error(`[ScriptVault] Failed to register ${script.meta?.name || script.id}:`, e);
    // Mark script with registration failure for UI display
    try {
      script.settings = script.settings || {};
      script.settings._registrationError = e.message || 'Registration failed';
      await ScriptStorage.set(script.id, script);
    } catch {}
  }
}

// Cache for @require scripts (in-memory for current session)
// Capped at 500 entries to prevent unbounded memory growth; evicts oldest entry on overflow.
const requireCache = new Map();
const REQUIRE_CACHE_MAX = 500;

function requireCacheSet(key, value) {
  if (!requireCache.has(key) && requireCache.size >= REQUIRE_CACHE_MAX) {
    requireCache.delete(requireCache.keys().next().value);
  }
  requireCache.set(key, value);
}

// Common library fallback URLs
const LIBRARY_FALLBACKS = {
  'jquery': [
    'https://code.jquery.com/jquery-3.7.1.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js',
    'https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js'
  ],
  'jquery@3': [
    'https://code.jquery.com/jquery-3.7.1.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js'
  ],
  'jquery@2': [
    'https://code.jquery.com/jquery-2.2.4.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js'
  ],
  'gm_config': [
    'https://cdn.jsdelivr.net/npm/gm_config@2024.12.1/gm_config.min.js',
    'https://cdn.jsdelivr.net/gh/sizzlemctwizzle/GM_config@master/gm_config.js',
    'https://raw.githubusercontent.com/sizzlemctwizzle/GM_config/master/gm_config.js',
    'https://greasyfork.org/scripts/1884-gm-config/code/gm_config.js',
    'https://openuserjs.org/src/libs/sizzle/GM_config.js'
  ],
  'mutation-summary': [
    'https://cdn.jsdelivr.net/npm/mutation-summary@1.0.1/dist/mutation-summary.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/mutation-summary/1.0.1/mutation-summary.min.js',
    'https://unpkg.com/mutation-summary@1.0.1/dist/mutation-summary.min.js'
  ]
};

// Find fallback URLs for a library
function getFallbackUrls(url) {
  const lowerUrl = url.toLowerCase();
  
  // Check for known libraries
  if (lowerUrl.includes('gm_config') || lowerUrl.includes('gm-config') || 
      lowerUrl.includes('gm4_config') || lowerUrl.includes('sizzle/gm_config') ||
      lowerUrl.includes('1884-gm-config')) {
    return LIBRARY_FALLBACKS['gm_config'];
  }
  if (lowerUrl.includes('mutation-summary') || lowerUrl.includes('mutationsummary')) {
    return LIBRARY_FALLBACKS['mutation-summary'];
  }
  if (lowerUrl.includes('jquery')) {
    if (lowerUrl.includes('@2') || lowerUrl.includes('2.')) {
      return LIBRARY_FALLBACKS['jquery@2'];
    }
    return LIBRARY_FALLBACKS['jquery'];
  }
  
  // For unpkg URLs, try jsdelivr as fallback
  if (lowerUrl.includes('unpkg.com')) {
    const jsdelivrUrl = url.replace('unpkg.com', 'cdn.jsdelivr.net/npm');
    return [jsdelivrUrl];
  }
  
  // For rawgit/raw.githubusercontent, try jsdelivr gh
  if (lowerUrl.includes('raw.githubusercontent.com')) {
    // Convert: https://raw.githubusercontent.com/user/repo/branch/path
    // To: https://cdn.jsdelivr.net/gh/user/repo@branch/path
    const match = url.match(/raw\.githubusercontent\.com\/([^/]+)\/([^/]+)\/([^/]+)\/(.+)/);
    if (match) {
      const [, user, repo, branch, path] = match;
      return [`https://cdn.jsdelivr.net/gh/${user}/${repo}@${branch}/${path}`];
    }
  }
  
  return [];
}

// Check if a URL is known to be unfetchable (requires auth, blocked by CORS, etc.)
function isUnfetchableUrl(url) {
  const lowerUrl = url.toLowerCase();
  
  // Font Awesome kit URLs require authentication
  if (lowerUrl.includes('kit.fontawesome.com')) {
    return true;
  }
  
  // Google Fonts CSS (not JS, but sometimes used)
  if (lowerUrl.includes('fonts.googleapis.com')) {
    return true;
  }
  
  // URLs with authentication tokens that will fail
  if (lowerUrl.includes('?token=') || lowerUrl.includes('&token=')) {
    return true;
  }
  
  return false;
}

// Fetch a @require script with caching and fallbacks
// Verify SRI hash for fetched content
async function verifySRI(code, hashStr) {
  if (!hashStr) return true;
  // Support formats: sha256-<base64>, md5-<hex>, or just <hex>
  const match = hashStr.match(/^(sha256|sha384|sha512|md5)[-=](.+)$/i);
  if (!match) return true; // Unknown format, skip verification
  const [, algo, expected] = match;
  if (algo.toLowerCase() === 'md5') {
    console.warn('[ScriptVault] SRI: MD5 hash cannot be verified with SubtleCrypto; skipping integrity check for', hashStr);
    return true; // Can't verify MD5 with SubtleCrypto
  }
  const algoMap = { sha256: 'SHA-256', sha384: 'SHA-384', sha512: 'SHA-512' };
  try {
    const digest = await crypto.subtle.digest(algoMap[algo.toLowerCase()], new TextEncoder().encode(code));
    const actual = btoa(String.fromCharCode(...new Uint8Array(digest)));
    return actual === expected;
  } catch (e) {
    console.warn('[ScriptVault] SRI verification error for hash', hashStr, '—', e.message, '; allowing require');
    return true; // Verification not possible, allow
  }
}

async function fetchRequireScript(url) {
  // Extract SRI hash from URL fragment (e.g., url#sha256=abc123 or url#md5=abc123)
  let sriHash = null;
  let fetchUrl = url;
  const hashIdx = url.indexOf('#');
  if (hashIdx > 0) {
    const fragment = url.slice(hashIdx + 1);
    if (/^(sha256|sha384|sha512|md5)[-=]/i.test(fragment)) {
      sriHash = fragment;
      fetchUrl = url.slice(0, hashIdx);
    }
  }

  debugLog('Fetching @require:', fetchUrl);

  // Skip URLs that are known to be unfetchable
  if (isUnfetchableUrl(fetchUrl)) {
    console.warn(`[ScriptVault] Skipping unfetchable @require: ${url}`);
    return null;
  }

  // Check in-memory cache first
  if (requireCache.has(fetchUrl)) {
    debugLog('Using cached @require:', fetchUrl);
    return requireCache.get(fetchUrl);
  }
  
  // Check persistent cache in chrome.storage.local
  // Hash the URL to create a fixed-length collision-resistant cache key
  const cacheKey = await (async () => {
    const data = new TextEncoder().encode(url);
    const hash = await crypto.subtle.digest('SHA-256', data);
    const hex = Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
    return `require_cache_${hex}`;
  })();
  try {
    const cached = await chrome.storage.local.get(cacheKey);
    if (cached[cacheKey]?.code) {
      // Check if cache is less than 7 days old
      const age = Date.now() - (cached[cacheKey].timestamp || 0);
      if (age < 7 * 24 * 60 * 60 * 1000) {
        debugLog('Using persistent cached @require:', url);
        requireCacheSet(fetchUrl, cached[cacheKey].code);
        return cached[cacheKey].code;
      }
    }
  } catch (e) {
    // Ignore cache errors
  }
  
  // Build list of URLs to try (original + fallbacks)
  const fallbacks = getFallbackUrls(fetchUrl);
  const urlsToTry = [fetchUrl, ...fallbacks];
  debugLog(`Will try ${urlsToTry.length} URLs for:`, fetchUrl);

  for (const tryUrl of urlsToTry) {
    try {
      debugLog('Trying:', tryUrl);
      const code = await fetchWithRetry(tryUrl);
      if (code) {
        // Verify SRI hash if provided
        if (sriHash) {
          const valid = await verifySRI(code, sriHash);
          if (!valid) {
            console.warn(`[ScriptVault] SRI hash mismatch for ${tryUrl}, skipping`);
            continue;
          }
        }
        // Store in both caches
        requireCacheSet(fetchUrl, code);
        
        // Store in persistent cache
        try {
          await chrome.storage.local.set({
            [cacheKey]: { code, timestamp: Date.now(), url: tryUrl }
          });
        } catch (e) {
          // Ignore storage errors
        }
        
        if (tryUrl !== url) {
          debugLog(`Successfully fetched ${url} from fallback:`, tryUrl);
        } else {
          debugLog('Successfully fetched:', url);
        }
        return code;
      }
    } catch (e) {
      console.warn(`[ScriptVault] Failed to fetch ${tryUrl}: ${e.message}`);
      // Try next URL
      continue;
    }
  }
  
  console.error(`[ScriptVault] Failed to fetch ${url} (tried ${urlsToTry.length} URLs)`);
  return null;
}

// Fetch with retry and proper options
async function fetchWithRetry(url, retries = 2) {
  for (let i = 0; i <= retries; i++) {
    try {
      const controller = new AbortController();
      const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 second timeout

      let code;
      try {
        const response = await fetch(url, {
          method: 'GET',
          headers: {
            'Accept': 'text/javascript, application/javascript, text/plain, */*',
            'Cache-Control': 'no-cache'
          },
          mode: 'cors',
          credentials: 'omit',
          signal: controller.signal
        });

        if (!response.ok) {
          throw new Error(`HTTP ${response.status}`);
        }

        // Reject excessively large @require scripts (>5MB) to prevent memory issues
        const MAX_REQUIRE_BYTES = 5 * 1024 * 1024;
        const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
        if (contentLength > MAX_REQUIRE_BYTES) {
          throw new Error(`Response too large (${Math.round(contentLength / 1024)}KB, max 5MB)`);
        }

        code = await response.text();

        if (code.length > MAX_REQUIRE_BYTES) {
          throw new Error(`Response too large (${Math.round(code.length / 1024)}KB, max 5MB)`);
        }
      } finally {
        clearTimeout(timeoutId);
      }

      // Basic validation - should look like JavaScript
      if (code && code.length > 0) {
        return code;
      }

      throw new Error('Empty response');
    } catch (e) {
      if (i === retries) {
        throw e;
      }
      // Wait before retry
      await new Promise(r => setTimeout(r, 500 * (i + 1)));
    }
  }
  return null;
}

// Unregister a single script
// ============================================================================
// GM_webRequest — declarativeNetRequest rule management
// ============================================================================

// Maps scriptId -> array of rule IDs applied via @webRequest / GM_webRequest
// Round 11: Persisted to chrome.storage.local under `_webRequestRuleMap` so the
// map survives SW shutdown. Without persistence, once the SW is killed,
// `removeWebRequestRules` can no longer clean up rules inserted by prior SW
// generations — script deletion would leak DNR rules permanently.
const _webRequestRuleMap = new Map();
let _webRequestRuleMapHydrated = false;
let _webRequestRuleMapHydratingPromise = null;

async function _hydrateWebRequestRuleMap() {
  if (_webRequestRuleMapHydrated) return;
  if (_webRequestRuleMapHydratingPromise) return _webRequestRuleMapHydratingPromise;
  _webRequestRuleMapHydratingPromise = (async () => {
    try {
      const result = await chrome.storage.local.get('_webRequestRuleMap');
      const stored = result?._webRequestRuleMap;
      if (stored && typeof stored === 'object') {
        for (const [scriptId, ruleIds] of Object.entries(stored)) {
          if (Array.isArray(ruleIds) && ruleIds.length > 0) {
            _webRequestRuleMap.set(scriptId, ruleIds);
          }
        }
      }
    } catch (e) {
      console.warn('[ScriptVault] Failed to hydrate _webRequestRuleMap:', e?.message || e);
    } finally {
      _webRequestRuleMapHydrated = true;
      _webRequestRuleMapHydratingPromise = null;
    }
  })();
  return _webRequestRuleMapHydratingPromise;
}

async function _persistWebRequestRuleMap() {
  try {
    const obj = {};
    for (const [scriptId, ruleIds] of _webRequestRuleMap.entries()) {
      obj[scriptId] = ruleIds;
    }
    await chrome.storage.local.set({ _webRequestRuleMap: obj });
  } catch (e) {
    console.warn('[ScriptVault] Failed to persist _webRequestRuleMap:', e?.message || e);
  }
}

// Stable numeric rule ID from a string (scriptId + rule index)
function _makeRuleId(scriptId, index) {
  // Use a hash-like approach: sum char codes * position, full 31-bit range
  // Reserve low bits for rule index (up to 1000 rules per script)
  let h = 0;
  for (let i = 0; i < scriptId.length; i++) h = (h * 31 + scriptId.charCodeAt(i)) & 0x7fffffff;
  // Use upper 21 bits for script hash (2M buckets) + lower 10 bits for index (1024 rules)
  return (((h & 0x1fffff) << 10) | (index & 0x3ff)) + 1;
}

// Translate GM_webRequest rule selector/action to declarativeNetRequest format
function _translateWebRequestRule(rule, ruleId) {
  const dnr = { id: ruleId, priority: rule.priority || 1, condition: {}, action: {} };

  // Selector -> condition
  const sel = rule.selector || {};
  if (sel.url) {
    const urlFilter = sel.url;
    if (Array.isArray(urlFilter)) {
      // Multiple URL patterns: pick first include (DNR only supports one urlFilter per rule)
      const incl = urlFilter.find(u => u.include);
      if (incl) dnr.condition.urlFilter = incl.include;
      const excl = urlFilter.find(u => u.exclude);
      if (excl) dnr.condition.excludedInitiatorDomains = [excl.exclude.replace(/\*/g, '')].filter(Boolean);
    } else if (typeof urlFilter === 'string') {
      dnr.condition.urlFilter = urlFilter;
    }
  }
  if (sel.tab) dnr.condition.tabIds = Array.isArray(sel.tab) ? sel.tab : [sel.tab];
  if (sel.type) dnr.condition.resourceTypes = Array.isArray(sel.type) ? sel.type : [sel.type];

  // Action
  const act = rule.action || {};
  if (act.cancel) {
    dnr.action.type = 'block';
  } else if (act.redirect) {
    dnr.action.type = 'redirect';
    dnr.action.redirect = typeof act.redirect === 'string'
      ? { url: act.redirect }
      : { url: act.redirect.url || act.redirect.regexSubstitution || '' };
  } else if (act.setRequestHeaders) {
    dnr.action.type = 'modifyHeaders';
    dnr.action.requestHeaders = Object.entries(act.setRequestHeaders).map(([name, value]) =>
      value === null ? { header: name, operation: 'remove' } : { header: name, operation: 'set', value }
    );
  } else if (act.setResponseHeaders) {
    dnr.action.type = 'modifyHeaders';
    dnr.action.responseHeaders = Object.entries(act.setResponseHeaders).map(([name, value]) =>
      value === null ? { header: name, operation: 'remove' } : { header: name, operation: 'set', value }
    );
  } else {
    return null; // unsupported action
  }

  return dnr;
}

async function applyWebRequestRules(scriptId, rules) {
  if (!chrome.declarativeNetRequest || !Array.isArray(rules) || rules.length === 0) return;
  try {
    // Round 11: Ensure map is rehydrated from storage before mutating (SW may have restarted)
    await _hydrateWebRequestRuleMap();
    // Remove any existing rules for this script first
    await removeWebRequestRules(scriptId);

    const dnrRules = [];
    const ruleIds = [];
    rules.forEach((rule, idx) => {
      const ruleId = _makeRuleId(scriptId, idx);
      const dnr = _translateWebRequestRule(rule, ruleId);
      if (dnr) {
        dnrRules.push(dnr);
        ruleIds.push(ruleId);
      }
    });

    if (dnrRules.length > 0) {
      // Check dynamic rule quota (Chrome limit: 30,000)
      const existing = await chrome.declarativeNetRequest.getDynamicRules();
      if (existing.length + dnrRules.length > 30000) {
        console.warn(`[ScriptVault] DNR rule limit would be exceeded: ${existing.length} + ${dnrRules.length} > 30000`);
        return;
      }
      await chrome.declarativeNetRequest.updateDynamicRules({ addRules: dnrRules });
      _webRequestRuleMap.set(scriptId, ruleIds);
      await _persistWebRequestRuleMap();
      debugLog(`[GM_webRequest] Applied ${dnrRules.length} rules for script ${scriptId}`);
    }
  } catch (e) {
    console.warn('[ScriptVault] GM_webRequest rule apply failed:', e.message);
  }
}

async function removeWebRequestRules(scriptId) {
  if (!chrome.declarativeNetRequest) return;
  // Round 11: Rehydrate from storage before reading — the SW may have restarted
  // since the rules were originally inserted, and without this the in-memory Map
  // would be empty and we'd silently leak the DNR rules.
  await _hydrateWebRequestRuleMap();
  const existing = _webRequestRuleMap.get(scriptId);
  if (existing && existing.length > 0) {
    try {
      await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existing });
    } catch (e) {}
    _webRequestRuleMap.delete(scriptId);
    await _persistWebRequestRuleMap();
  }
}

// Phase 40.10 — Reconcile persisted DNR rule map against the live DNR state
// and the current ScriptStorage on SW wake. Without this, three drift modes
// silently accumulate orphans:
//   (a) A script was deleted while a previous SW was alive: its DNR rules were
//       removed correctly but the map entry might have lagged if `_persist`
//       failed mid-delete.
//   (b) The SW was killed mid-delete: the script record is gone from
//       ScriptStorage but the DNR rules and the map entry both survive.
//   (c) `updateDynamicRules` was applied by a prior SW generation but the
//       persist write failed: rules exist in DNR with no map entry to clean
//       them up later.
//
// Reconciliation is best-effort and lossy in the (c) direction: if a rule
// exists in DNR with no map entry pointing at any script, we leave it alone
// rather than risk removing a rule another extension might have inserted.
async function reconcileWebRequestRuleMap() {
  if (!chrome.declarativeNetRequest) return;
  await _hydrateWebRequestRuleMap();

  let mutated = false;
  let scripts;
  try {
    scripts = await ScriptStorage.getAll();
  } catch (e) {
    console.warn('[ScriptVault] DNR reconcile: ScriptStorage.getAll failed:', e?.message || e);
    return;
  }
  const scriptIds = new Set((scripts || []).map(s => s.id));

  // Pass 1: drop map entries whose script no longer exists; queue the DNR
  // rule IDs for removal so the live engine catches up.
  const toRemoveRuleIds = [];
  for (const [scriptId, ruleIds] of _webRequestRuleMap.entries()) {
    if (!scriptIds.has(scriptId)) {
      if (Array.isArray(ruleIds)) toRemoveRuleIds.push(...ruleIds);
      _webRequestRuleMap.delete(scriptId);
      mutated = true;
    }
  }

  // Pass 2: drop map rule IDs that no longer exist in DNR (stale entries).
  let liveRuleIds;
  try {
    const liveRules = await chrome.declarativeNetRequest.getDynamicRules();
    liveRuleIds = new Set(liveRules.map(r => r.id));
  } catch (e) {
    console.warn('[ScriptVault] DNR reconcile: getDynamicRules failed:', e?.message || e);
    liveRuleIds = null;
  }
  if (liveRuleIds) {
    for (const [scriptId, ruleIds] of _webRequestRuleMap.entries()) {
      const filtered = (ruleIds || []).filter(id => liveRuleIds.has(id));
      if (filtered.length !== (ruleIds || []).length) {
        if (filtered.length === 0) _webRequestRuleMap.delete(scriptId);
        else _webRequestRuleMap.set(scriptId, filtered);
        mutated = true;
      }
    }
  }

  // Apply the queued DNR removal in one batched call.
  if (toRemoveRuleIds.length > 0) {
    try {
      await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: toRemoveRuleIds });
      debugLog(`[GM_webRequest] Reconcile removed ${toRemoveRuleIds.length} orphan DNR rule(s)`);
    } catch (e) {
      console.warn('[ScriptVault] DNR reconcile: updateDynamicRules removal failed:', e?.message || e);
    }
  }

  if (mutated) {
    await _persistWebRequestRuleMap();
  }
}

async function unregisterScript(scriptId) {
  // Clear @crontab alarm if present
  chrome.alarms.clear('crontab_' + scriptId).catch(() => {});
  // Remove any @webRequest declarativeNetRequest rules
  await removeWebRequestRules(scriptId);
  try {
    if (!chrome.userScripts) return;
    await chrome.userScripts.unregister({ ids: [scriptId] });
    // Chrome 133+: reset the per-script world configuration to free resources
    try {
      await chrome.userScripts.resetWorldConfiguration({ worldId: scriptId });
    } catch (e) {
      // Chrome <133 doesn't support resetWorldConfiguration — ignore
    }
  } catch (e) {
    // Script might not be registered
  }
}

// Build wrapped script code with GM API
function buildWrappedScript(script, requireScripts = [], preloadedStorage = {}, regexIncludes = [], regexExcludes = []) {
  const meta = script.meta;
  const grants = meta.grant || ['none'];
  
  // Build @require scripts section
  // Code runs INSIDE the main IIFE after GM APIs are available
  // No try/catch wrapper because let/const are block-scoped and wouldn't escape
  let requireCode = '';
  for (const req of requireScripts) {
    const safeUrl = req.url.replace(/\*\//g, '* /');
    requireCode += `
// @require ${safeUrl}
${req.code}
`;
  }
  
  // After @require code, expose common libraries to window for cross-script access
  const libraryExports = requireCode ? `
  // Expose common @require libraries to window
  if (typeof GM_config !== 'undefined' && typeof window.GM_config === 'undefined') window.GM_config = GM_config;
  if (typeof GM_configStruct !== 'undefined' && typeof window.GM_configStruct === 'undefined') window.GM_configStruct = GM_configStruct;
  if (typeof $ !== 'undefined' && typeof window.$ === 'undefined') window.$ = $;
  if (typeof jQuery !== 'undefined' && typeof window.jQuery === 'undefined') window.jQuery = jQuery;
  if (typeof Fuse !== 'undefined' && typeof window.Fuse === 'undefined') window.Fuse = Fuse;
  if (typeof JSZip !== 'undefined' && typeof window.JSZip === 'undefined') window.JSZip = JSZip;
` : '';
  
  // Build the GM API initialization with pre-loaded storage
  // Get the extension ID at build time so it's available in the wrapper
  const extId = chrome.runtime.id;
  
  const apiInit = `
(function() {
  'use strict';
  
  // ============ Console Capture (v2.0) ============
  // Intercept console.log/warn/error for per-script debugging
  {
    const _origConsole = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
    const _scriptId = ${JSON.stringify(script.id)};
    const _captureLimit = 200;
    let _captureBuffer = [];
    function _captureConsole(level, args) {
      try {
        _captureBuffer.push({ level, args: Array.from(args).map(a => { try { return typeof a === 'object' ? JSON.stringify(a).slice(0, 500) : String(a); } catch { return String(a); } }), timestamp: Date.now() });
        if (_captureBuffer.length > _captureLimit) _captureBuffer.shift();
        // Batch-send every 2 seconds
        if (!_captureConsole._timer) {
          _captureConsole._timer = setTimeout(() => {
            try { chrome.runtime.sendMessage({ action: 'scriptConsoleCapture', scriptId: _scriptId, entries: _captureBuffer.splice(0) }); } catch {}
            _captureConsole._timer = null;
          }, 2000);
        }
      } catch {}
    }
    console.log = function() { _captureConsole('log', arguments); return _origConsole.log.apply(console, arguments); };
    console.warn = function() { _captureConsole('warn', arguments); return _origConsole.warn.apply(console, arguments); };
    console.error = function() { _captureConsole('error', arguments); return _origConsole.error.apply(console, arguments); };
    console.info = function() { _captureConsole('info', arguments); return _origConsole.info.apply(console, arguments); };
    console.debug = function() { _captureConsole('debug', arguments); return _origConsole.debug.apply(console, arguments); };
  }
  // ============ End Console Capture ============

  // ============ Error Suppression ============
  // Suppress uncaught errors and unhandled rejections from userscripts
  // to prevent them from appearing on chrome://extensions error page.
  // Chrome captures any error/warn/log from USER_SCRIPT world, so we
  // must silently swallow these without any console output.
  window.addEventListener('error', function(event) {
    event.stopImmediatePropagation();
    event.preventDefault();
    // Report to error log
    try { chrome.runtime.sendMessage({ action: 'logError', entry: { scriptId: ${JSON.stringify(script.id)}, scriptName: ${JSON.stringify(meta.name)}, error: event.message || 'Unknown error', url: location.href, line: event.lineno, col: event.colno, timestamp: Date.now() } }); } catch {}
    return true;
  }, true);
  window.addEventListener('unhandledrejection', function(event) {
    event.stopImmediatePropagation();
    event.preventDefault();
    try { chrome.runtime.sendMessage({ action: 'logError', entry: { scriptId: ${JSON.stringify(script.id)}, scriptName: ${JSON.stringify(meta.name)}, error: event.reason?.message || String(event.reason) || 'Unhandled rejection', url: location.href, timestamp: Date.now() } }); } catch {}
  }, true);
  // ============ End Error Suppression ============

  ${meta['run-in'] === 'incognito-tabs' ? `
  // ============ @run-in incognito-tabs Guard ============
  if (!chrome?.extension?.inIncognitoContext) return;
  // ============ End @run-in Guard ============
` : meta['run-in'] === 'normal-tabs' ? `
  // ============ @run-in normal-tabs Guard ============
  if (chrome?.extension?.inIncognitoContext) return;
  // ============ End @run-in Guard ============
` : ''}
  ${(() => {
    const validIncludes = regexIncludes.map(p => {
      const m = p.match(/^\/(.+)\/([gimsuy]*)$/);
      return m ? `new RegExp(${JSON.stringify(m[1])}, ${JSON.stringify(m[2])})` : null;
    }).filter(Boolean);
    const validExcludes = regexExcludes.map(p => {
      const m = p.match(/^\/(.+)\/([gimsuy]*)$/);
      return m ? `new RegExp(${JSON.stringify(m[1])}, ${JSON.stringify(m[2])})` : null;
    }).filter(Boolean);
    if (validIncludes.length === 0 && validExcludes.length === 0) return '';
    return `
  // ============ Regex @include/@exclude URL Guard ============
  {
    const __url = location.href;
    ${validIncludes.length > 0 ? `const __regexIncludes = [${validIncludes.join(', ')}];
    const __includeMatch = __regexIncludes.some(re => re.test(__url));
    if (!__includeMatch) return;` : ''}
    ${validExcludes.length > 0 ? `const __regexExcludes = [${validExcludes.join(', ')}];
    const __excludeMatch = __regexExcludes.some(re => re.test(__url));
    if (__excludeMatch) return;` : ''}
  }
  // ============ End URL Guard ============
`;
  })()}
  ${(() => {
    // Phase 39.11 — @match-top / @exclude-top runtime gates.
    // Patterns are matched against window.top.location.href. Cross-origin
    // top frames throw on access, so we treat opaque top as "no match" for
    // @match-top (do not run — author asked for a specific top origin we
    // can't verify) and "match" for @exclude-top (do not run — author asked
    // to keep the script away from frames whose top we can't audit).
    const matchTop = Array.isArray(meta.matchTop) ? meta.matchTop : [];
    const excludeTop = Array.isArray(meta.excludeTop) ? meta.excludeTop : [];
    if (matchTop.length === 0 && excludeTop.length === 0) return '';

    // Build a runtime matcher that handles both glob (@match-style) and
    // regex (`/.../flags`) patterns. Keep the matcher inside the wrapper
    // so it doesn't depend on the background's matchPattern helper.
    const patternsToLiteral = (arr) => arr.map(p => {
      const m = p.match(/^\/(.+)\/([gimsuy]*)$/);
      if (m) return `{re: new RegExp(${JSON.stringify(m[1])}, ${JSON.stringify(m[2])})}`;
      return `{glob: ${JSON.stringify(p)}}`;
    }).join(', ');

    return `
  // ============ @match-top / @exclude-top Guard (Phase 39.11) ============
  {
    let __topUrl;
    try { __topUrl = window.top && window.top.location && window.top.location.href; } catch (_e) { __topUrl = null; }
    const __testTop = (pattern) => {
      if (pattern.re) return pattern.re.test(__topUrl);
      // Glob: convert @match-style to RegExp on-demand. Handles * / scheme / host / path
      // wildcards conservatively — anchored ^...$ with `.*` substituted for `*`.
      const escaped = pattern.glob.replace(/[.+^$()|[\\]{}]/g, '\\\\$&').replace(/\\*/g, '.*').replace(/\\?/g, '.');
      try { return new RegExp('^' + escaped + '$').test(__topUrl); } catch { return false; }
    };
    ${matchTop.length > 0 ? `
    const __matchTopPatterns = [${patternsToLiteral(matchTop)}];
    if (!__topUrl) return; // Cross-origin top → cannot verify match-top → bail.
    if (!__matchTopPatterns.some(__testTop)) return;` : ''}
    ${excludeTop.length > 0 ? `
    const __excludeTopPatterns = [${patternsToLiteral(excludeTop)}];
    if (!__topUrl) return; // Cross-origin top → conservatively bail.
    if (__excludeTopPatterns.some(__testTop)) return;` : ''}
  }
  // ============ End @match-top / @exclude-top Guard ============
`;
  })()}
  const scriptId = ${JSON.stringify(script.id)};
  const meta = ${JSON.stringify(meta)};
  const grants = ${JSON.stringify(grants)};
  const grantSet = new Set(grants);
  
  // Channel ID for communication with content script bridge
  // Extension ID is injected at build time since chrome.runtime isn't available in USER_SCRIPT world
  const CHANNEL_ID = ${JSON.stringify('ScriptVault_' + extId)};
  
  // console.log('[ScriptVault] Script initializing:', meta.name, 'Channel:', CHANNEL_ID);
  
  // Grant checking - @grant none or empty grants means NO APIs except GM_info
  const hasNone = grantSet.has('none');
  const hasGrant = (n) => {
    if (hasNone || grants.length === 0) return false;
    return grantSet.has(n) || grantSet.has('*');
  };
  
  // GM_info - always available
  const GM_info = {
    script: {
      name: meta.name || 'Unknown',
      namespace: meta.namespace || '',
      description: meta.description || '',
      version: meta.version || '1.0',
      author: meta.author || '',
      homepage: meta.homepage || meta.homepageURL || '',
      icon: meta.icon || '',
      icon64: meta.icon64 || '',
      matches: meta.match || [],
      includes: meta.include || [],
      excludes: meta.exclude || [],
      excludeMatches: meta.excludeMatch || [],
      grants: grants,
      resources: meta.resource || {},
      requires: meta.require || [],
      runAt: meta['run-at'] || 'document-idle',
      connect: meta.connect || [],
      noframes: meta.noframes || false,
      unwrap: meta.unwrap || false,
      antifeatures: meta.antifeature || [],
      tags: meta.tag || [],
      license: meta.license || '',
      updateURL: meta.updateURL || '',
      downloadURL: meta.downloadURL || '',
      supportURL: meta.supportURL || '',
      // Phase 11.7 — Userscripts (Safari) injection priority.
      weight: meta.weight || 0,
      priority: meta.priority || 0,
      // Phase 38.12 — VM v2.37.0 renamed `tag` → `tags`. Older scripts written
      // against pre-2026 Violentmonkey read the singular form; expose a getter
      // that returns the first tag for back-compat. Non-enumerable so it does
      // not pollute structured clones / JSON serialization of GM_info.script.
      get tag() { return Array.isArray(this.tags) ? this.tags[0] : undefined; }
    },
    scriptMetaStr: ${JSON.stringify(script.code.match(/\/\/\s*==UserScript==([\s\S]*?)\/\/\s*==\/UserScript==/)?.[0] || '')},
    scriptHandler: 'ScriptVault',
    scriptSource: 'ScriptVault',
    version: ${JSON.stringify(chrome.runtime.getManifest().version)},
    scriptWillUpdate: !!(meta.updateURL || meta.downloadURL),
    isIncognito: typeof chrome !== 'undefined' && chrome.extension ? chrome.extension.inIncognitoContext : false,
    injectInto: ${JSON.stringify(meta['inject-into'] || 'auto')},
    downloadMode: 'browser',
    platform: {
      os: navigator.userAgentData?.platform || navigator.platform || 'unknown',
      arch: navigator.userAgentData?.architecture || 'unknown',
      browserName: navigator.userAgentData?.brands?.find(b => /chrome|chromium|edge/i.test(b.brand))?.brand || 'Chrome',
      browserVersion: navigator.userAgentData?.brands?.[0]?.version || (navigator.userAgent?.match(/Chrome\\/([\\d.]+)/)?.[1]) || 'unknown',
      // Phase 11.1 — fullVersionList + mobile parity with Violentmonkey.
      fullVersionList: navigator.userAgentData?.brands?.map(b => ({ brand: b.brand, version: b.version })) || [],
      mobile: navigator.userAgentData?.mobile === true
    },
    // Phase 11.1 — Tampermonkey-compatible userAgent strings sourced from
    // the page context. Exposed so scripts have a consistent reference even
    // when tests mock navigator.userAgent.
    userAgent: typeof navigator !== 'undefined' ? navigator.userAgent : '',
    userAgentData: typeof navigator !== 'undefined' && navigator.userAgentData
      ? {
          platform: navigator.userAgentData.platform,
          mobile: navigator.userAgentData.mobile,
          brands: (navigator.userAgentData.brands || []).map(b => ({ brand: b.brand, version: b.version }))
        }
      : null,
    uuid: ${JSON.stringify(script.id)}
  };
  
  // Storage cache - mutable so we can refresh it with fresh values from background
  // Pre-loaded values serve as fallback if background fetch fails
  let _cache = ${JSON.stringify(preloadedStorage)};
  let _cacheReady = false; // Track if we've fetched fresh values
  let _cacheReadyPromise = null;
  let _cacheReadyResolve = null;
  
  // XHR request tracking (like Violentmonkey's idMap)
  const _xhrRequests = new Map(); // requestId -> { details, aborted }
  let _xhrSeqId = 0;
  
  // Value change listeners (like Tampermonkey)
  const _valueChangeListeners = new Map(); // listenerId -> { key, callback }
  let _valueChangeListenerId = 0;
  
  // Listen for messages from content script (for menu commands, value changes, and XHR events)
  window.addEventListener('message', (event) => {
    if (event.source !== window) return;
    const msg = event.data;
    if (!msg || msg.channel !== CHANNEL_ID || msg.direction !== 'to-userscript') return;
    
    // Handle menu command execution
    if (msg.type === 'menuCommand' && msg.scriptId === scriptId) {
      const cmd = _menuCmds.get(msg.commandId);
      if (cmd?.callback) try { cmd.callback(); } catch(err) { /* silently ignore menu command errors */ }
    }
    
    // Handle value change notifications (cross-tab sync)
    if (msg.type === 'valueChanged' && msg.scriptId === scriptId) {
      const oldValue = _cache[msg.key];
      if (msg.newValue === undefined) {
        delete _cache[msg.key];
      } else {
        _cache[msg.key] = msg.newValue;
      }
      // Notify value change listeners
      _valueChangeListeners.forEach((listener) => {
        if (listener.key === msg.key || listener.key === null) {
          try {
            listener.callback(msg.key, oldValue, msg.newValue, msg.remote !== false);
          } catch (e) {
            /* silently ignore value change listener errors */
          }
        }
      });
    }
    
    // Handle XHR events
    if (msg.type === 'xhrEvent' && msg.scriptId === scriptId) {
      const request = _xhrRequests.get(msg.requestId);
      if (!request || request.aborted) return;
      
      const { details } = request;
      const eventType = msg.eventType;
      const eventData = msg.data || {};
      
      // Decode binary responses transferred as base64/dataURL
      let responseValue = eventData.response;
      if (responseValue && typeof responseValue === 'object' && responseValue.__sv_base64__) {
        // arraybuffer: base64 -> ArrayBuffer
        const binary = atob(responseValue.data);
        const bytes = new Uint8Array(binary.length);
        for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
        responseValue = bytes.buffer;
      } else if (details.responseType === 'blob' && typeof responseValue === 'string' && responseValue.startsWith('data:')) {
        // blob: data URL -> Blob
        try {
          const [header, b64] = responseValue.split(',');
          const mime = header.match(/:(.*?);/)?.[1] || 'application/octet-stream';
          const binary = atob(b64);
          const bytes = new Uint8Array(binary.length);
          for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
          responseValue = new Blob([bytes], { type: mime });
        } catch (e) {
          // Fall through with data URL string if conversion fails
        }
      }

      // Build response object matching GM_xmlhttpRequest spec
      const response = {
        readyState: eventData.readyState || 0,
        status: eventData.status || 0,
        statusText: eventData.statusText || '',
        responseHeaders: eventData.responseHeaders || '',
        response: responseValue,
        responseText: eventData.responseText || '',
        responseXML: eventData.responseXML,
        finalUrl: eventData.finalUrl || details.url,
        context: details.context,
        lengthComputable: eventData.lengthComputable,
        loaded: eventData.loaded,
        total: eventData.total
      };
      
      // Call appropriate callback
      const callbackName = 'on' + eventType;
      if (eventType.startsWith('upload.')) {
        const uploadEvent = eventType.replace('upload.', '');
        if (details.upload && details.upload['on' + uploadEvent]) {
          try {
            details.upload['on' + uploadEvent](response);
          } catch (e) {
            /* silently ignore XHR upload callback errors */
          }
        }
      } else if (details[callbackName]) {
        try {
          details[callbackName](response);
        } catch (e) {
          /* silently ignore XHR callback errors */
        }
      }
      
      // Clean up on loadend
      if (eventType === 'loadend') {
        _xhrRequests.delete(msg.requestId);
      }
    }
  });
  
  // Bridge ready state tracking
  let _bridgeReady = false;
  let _bridgeReadyPromise = null;
  let _bridgeReadyResolve = null;
  
  // Wait for bridge to be ready
  function waitForBridge() {
    // Check if already ready (content script sets this global)
    if (window.__ScriptVault_BridgeReady__ || _bridgeReady) {
      _bridgeReady = true;
      return Promise.resolve();
    }
    
    // Return existing promise if already waiting
    if (_bridgeReadyPromise) return _bridgeReadyPromise;
    
    // Create promise to wait for bridge ready message
    _bridgeReadyPromise = new Promise((resolve) => {
      _bridgeReadyResolve = resolve;
      
      // Listen for bridgeReady message from content script
      function bridgeReadyHandler(event) {
        if (event.source !== window) return;
        const msg = event.data;
        if (!msg || msg.channel !== CHANNEL_ID || msg.direction !== 'to-userscript') return;
        if (msg.type === 'bridgeReady') {
          window.removeEventListener('message', bridgeReadyHandler);
          _bridgeReady = true;
          resolve();
        }
      }
      window.addEventListener('message', bridgeReadyHandler);
      
      // Also check global flag periodically (fallback)
      const checkInterval = setInterval(() => {
        if (window.__ScriptVault_BridgeReady__) {
          clearInterval(checkInterval);
          window.removeEventListener('message', bridgeReadyHandler);
          _bridgeReady = true;
          resolve();
        }
      }, 10);
      
      // Timeout after 1 second - bridge should be ready much faster
      setTimeout(() => {
        clearInterval(checkInterval);
        window.removeEventListener('message', bridgeReadyHandler);
        if (!_bridgeReady) {
          // This is normal in some contexts, proceed without warning spam
          _bridgeReady = true;
          resolve();
        }
      }, 1000);
    });
    
    return _bridgeReadyPromise;
  }
  
  function canUsePostMessageBridge(action) {
    return action === 'netlog_record' || action === 'reportExecError' || action === 'reportExecTime';
  }

  // Send message to background script.
  // Prefers chrome.runtime.sendMessage (direct, no bridge needed) when available via messaging: true.
  // The postMessage bridge is telemetry-only because page scripts can forge window messages.
  async function sendToBackground(action, data) {
    // Try direct messaging first (available when userScripts world has messaging: true)
    if (typeof chrome !== 'undefined' && chrome.runtime && chrome.runtime.sendMessage) {
      try {
        return await chrome.runtime.sendMessage({ action, data });
      } catch (e) {
        // Extension context invalidated or messaging not available, fall through to bridge
      }
    }

    if (!canUsePostMessageBridge(action)) {
      return { error: 'ScriptVault requires Chrome userScripts messaging for GM API calls.' };
    }

    // Fallback: use the telemetry-only content script bridge via postMessage.
    await waitForBridge();

    return new Promise((resolve, reject) => {
      const id = Math.random().toString(36).substring(2) + Date.now().toString(36);

      // Set timeout for response
      const timeout = setTimeout(() => {
        window.removeEventListener('message', handler);
        resolve(undefined);
      }, 10000);

      // Listen for response
      function handler(event) {
        if (event.source !== window) return;
        const msg = event.data;
        if (!msg || msg.channel !== CHANNEL_ID || msg.direction !== 'to-userscript') return;
        if (msg.id !== id) return;

        window.removeEventListener('message', handler);
        clearTimeout(timeout);

        if (msg.success) {
          resolve(msg.result);
        } else {
          resolve(undefined);
        }
      }

      window.addEventListener('message', handler);

      // Send to content script bridge
      window.postMessage({
        channel: CHANNEL_ID,
        direction: 'to-background',
        id: id,
        action: action,
        data: data
      }, '*');
    });
  }

  // Refresh storage cache from background
  // This ensures we have the latest values, not stale values from registration time
  async function _refreshStorageCache() {
    if (_cacheReady) return;
    
    try {
      const freshValues = await sendToBackground('GM_getValues', { scriptId });
      if (freshValues && typeof freshValues === 'object') {
        // Merge fresh values with any local changes made before refresh completed
        _cache = { ..._cache, ...freshValues };
      }
      _cacheReady = true;
      if (_cacheReadyResolve) _cacheReadyResolve();
    } catch (e) {
      // If refresh fails, continue with pre-loaded values
      _cacheReady = true;
      if (_cacheReadyResolve) _cacheReadyResolve();
    }
  }
  
  // Start refreshing cache immediately (don't await - let script start running)
  // Scripts can use GM_getValue immediately with pre-loaded values
  // Fresh values will be available after the async refresh completes
  _refreshStorageCache();
  
  // Synchronous GM_getValue - returns from cache (pre-loaded or refreshed)
  function GM_getValue(key, defaultValue) {
    if (!hasGrant('GM_getValue') && !hasGrant('GM.getValue')) return defaultValue;
    if (key in _cache) return _cache[key];
    return defaultValue;
  }
  
  // GM_setValue - updates cache IMMEDIATELY, persists async (like Tampermonkey/Violentmonkey)
  function GM_setValue(key, value) {
    if (!hasGrant('GM_setValue') && !hasGrant('GM.setValue')) {
      return;
    }
    // Update local cache IMMEDIATELY - this makes subsequent GM_getValue instant
    _cache[key] = value;
    // Persist async (fire and forget) - background handles debouncing
    sendToBackground('GM_setValue', { scriptId, key, value }).catch(() => {});
    return value;
  }
  
  // GM_deleteValue
  function GM_deleteValue(key) {
    if (!hasGrant('GM_deleteValue') && !hasGrant('GM.deleteValue')) return;
    delete _cache[key];
    sendToBackground('GM_deleteValue', { scriptId, key }).catch(() => {});
  }
  
  // GM_listValues - returns cached keys synchronously
  function GM_listValues() {
    if (!hasGrant('GM_listValues') && !hasGrant('GM.listValues')) return [];
    return Object.keys(_cache);
  }
  
  // GM_getValues - Get multiple values at once (like Violentmonkey)
  // Accepts array of keys or object with default values
  function GM_getValues(keysOrDefaults) {
    if (!hasGrant('GM_getValue') && !hasGrant('GM.getValue') && 
        !hasGrant('GM_getValues') && !hasGrant('GM.getValues')) {
      return Array.isArray(keysOrDefaults) ? {} : keysOrDefaults;
    }
    const result = {};
    if (Array.isArray(keysOrDefaults)) {
      // Array of keys - return values or undefined
      for (const key of keysOrDefaults) {
        if (key in _cache) {
          result[key] = _cache[key];
        }
      }
    } else if (typeof keysOrDefaults === 'object' && keysOrDefaults !== null) {
      // Object with defaults - return values or defaults
      for (const key of Object.keys(keysOrDefaults)) {
        result[key] = key in _cache ? _cache[key] : keysOrDefaults[key];
      }
    }
    return result;
  }
  
  // GM_setValues - Set multiple values at once (like Violentmonkey)
  function GM_setValues(values) {
    if (!hasGrant('GM_setValue') && !hasGrant('GM.setValue') &&
        !hasGrant('GM_setValues') && !hasGrant('GM.setValues')) {
      return;
    }
    if (typeof values !== 'object' || values === null) return;
    
    // Update local cache immediately for all values
    for (const [key, value] of Object.entries(values)) {
      _cache[key] = value;
    }
    // Persist all values to background in one call
    sendToBackground('GM_setValues', { scriptId, values }).catch(() => {});
  }
  
  // GM_deleteValues - Delete multiple values at once (like Violentmonkey)
  function GM_deleteValues(keys) {
    if (!hasGrant('GM_deleteValue') && !hasGrant('GM.deleteValue') &&
        !hasGrant('GM_deleteValues') && !hasGrant('GM.deleteValues')) {
      return;
    }
    if (!Array.isArray(keys)) return;
    
    // Delete from local cache immediately
    for (const key of keys) {
      delete _cache[key];
    }
    // Persist deletions to background in one call
    sendToBackground('GM_deleteValues', { scriptId, keys }).catch(() => {});
  }
  
  // GM_addStyle - inject CSS with robust DOM handling
  function GM_addStyle(css) {
    const style = document.createElement('style');
    style.textContent = css;
    style.setAttribute('data-scriptvault', scriptId);
    
    // Try to inject immediately
    function inject() {
      const target = document.head || document.documentElement || document.body;
      if (target && target.appendChild) {
        try {
          target.appendChild(style);
          return true;
        } catch (e) {
          // appendChild failed, will retry
        }
      }
      return false;
    }
    
    if (!inject()) {
      // DOM not ready - wait for it
      if (document.readyState === 'loading') {
        // Document still loading, wait for DOMContentLoaded
        document.addEventListener('DOMContentLoaded', () => inject(), { once: true });
      } else {
        // Document loaded but no valid target - use MutationObserver
        const observer = new MutationObserver(() => {
          if (inject()) {
            observer.disconnect();
          }
        });
        
        // Observe whatever root we can find
        const root = document.documentElement || document;
        if (root && root.nodeType === Node.ELEMENT_NODE) {
          observer.observe(root, { childList: true, subtree: true });
        }
        
        // Fallback timeout - try one more time after a delay
        setTimeout(() => {
          observer.disconnect();
          if (!style.parentNode) {
            inject();
          }
        }, 1000);
      }
    }
    
    return style;
  }
  
  // GM_xmlhttpRequest - Full implementation with all events (like Violentmonkey)
  function GM_xmlhttpRequest(details) {
    if (!hasGrant('GM_xmlhttpRequest') && !hasGrant('GM.xmlHttpRequest')) {
      if (details.onerror) details.onerror({ error: 'Permission denied', status: 0 });
      return { abort: () => {} };
    }
    
    // Generate unique request ID
    const localId = 'xhr_' + (++_xhrSeqId) + '_' + Date.now().toString(36);
    let requestId = null;
    let aborted = false;
    let currentMapKey = localId;

    // Store request details for event handling
    const requestEntry = { details, aborted: false };
    _xhrRequests.set(localId, requestEntry);

    // Control object returned to the script
    const control = {
      abort: () => {
        aborted = true;
        requestEntry.aborted = true;
        // Send abort using server ID if available, clean up both keys
        if (requestId) {
          sendToBackground('GM_xmlhttpRequest_abort', { requestId }).catch(() => {});
        }
        // Call onabort callback
        if (details.onabort) {
          try {
            details.onabort({ error: 'Aborted', status: 0 });
          } catch (e) {}
        }
        // Clean up both possible keys to avoid orphans
        _xhrRequests.delete(localId);
        if (requestId) _xhrRequests.delete(requestId);
      }
    };

    // Serialize request body to a structured-clone-safe format.
    // Blob/File/FormData cannot cross the extension messaging boundary natively.
    async function _serializeBody(d) {
      if (!d || typeof d === 'string' || d instanceof ArrayBuffer || ArrayBuffer.isView(d)) return d;
      if (d instanceof URLSearchParams) return d.toString();
      function _ab2b64(buf) {
        const bytes = new Uint8Array(buf), chunk = 8192;
        let s = '';
        for (let i = 0; i < bytes.length; i += chunk) s += String.fromCharCode(...bytes.subarray(i, i + chunk));
        return btoa(s);
      }
      if (d instanceof Blob || d instanceof File) {
        const buf = await d.arrayBuffer();
        return { __sv_blob__: true, b64: _ab2b64(buf), type: d.type, name: d instanceof File ? d.name : undefined };
      }
      if (d instanceof FormData) {
        const entries = [];
        for (const [name, val] of d.entries()) {
          if (val instanceof Blob || val instanceof File) {
            const buf = await val.arrayBuffer();
            entries.push({ name, b64: _ab2b64(buf), type: val.type, filename: val instanceof File ? val.name : 'blob' });
          } else {
            entries.push({ name, value: val });
          }
        }
        return { __sv_formdata__: true, entries };
      }
      return d;
    }

    // Start the request (async to allow body serialization)
    (async () => {
      const serializedData = await _serializeBody(details.data);
      const response = await sendToBackground('GM_xmlhttpRequest', {
        scriptId,
        method: details.method || 'GET',
        url: details.url,
        headers: details.headers,
        data: serializedData,
        timeout: details.timeout,
        responseType: details.responseType,
        overrideMimeType: details.overrideMimeType,
        user: details.user,
        password: details.password,
        context: details.context,
        anonymous: details.anonymous,
        // VM #2168 / TM noCache: bypass intermediate caches.
        // Accept both `noCache` (VM camelCase) and `nocache` (TM lowercase).
        noCache: details.noCache === true || details.nocache === true,
        // VM #2359: expose RequestInit.redirect so scripts can detect/block redirects.
        redirect: details.redirect,
        // Track which callbacks are registered so background knows what to send
        hasCallbacks: {
          onload: !!details.onload,
          onerror: !!details.onerror,
          onprogress: !!details.onprogress,
          onreadystatechange: !!details.onreadystatechange,
          ontimeout: !!details.ontimeout,
          onabort: !!details.onabort,
          onloadstart: !!details.onloadstart,
          onloadend: !!details.onloadend,
          upload: !!(details.upload && (
            details.upload.onprogress || 
            details.upload.onloadstart || 
            details.upload.onload || 
            details.upload.onerror
          ))
        }
      });
      if (aborted) return;

      if (!response) {
        // No response (bridge failure)
        if (details.onerror) details.onerror({ error: 'Request failed - no response', status: 0 });
        _xhrRequests.delete(currentMapKey);
      } else if (response.error) {
        // Immediate error
        if (details.onerror) details.onerror({ error: response.error, status: 0 });
        _xhrRequests.delete(currentMapKey);
      } else if (response.requestId) {
        // Re-key: add server ID entry, then remove local ID
        requestId = response.requestId;
        _xhrRequests.set(requestId, requestEntry);
        _xhrRequests.delete(localId);
        currentMapKey = requestId;
      }
    })().catch(err => {
      if (aborted) return;
      if (details.onerror) details.onerror({ error: err.message || 'Request failed', status: 0 });
      _xhrRequests.delete(currentMapKey);
    });
    
    return control;
  }
  
  // GM_addValueChangeListener - Watch for value changes (like Tampermonkey)
  function GM_addValueChangeListener(key, callback) {
    if (!hasGrant('GM_addValueChangeListener') && !hasGrant('GM.addValueChangeListener')) return null;
    if (typeof callback !== 'function') return null;
    
    const listenerId = ++_valueChangeListenerId;
    _valueChangeListeners.set(listenerId, { key, callback });
    return listenerId;
  }
  
  // GM_removeValueChangeListener - Stop watching for value changes
  function GM_removeValueChangeListener(listenerId) {
    if (!hasGrant('GM_removeValueChangeListener') && !hasGrant('GM.removeValueChangeListener')) return false;
    return _valueChangeListeners.delete(listenerId);
  }
  
  // GM_setClipboard
  function GM_setClipboard(text, type) {
    if (!hasGrant('GM_setClipboard') && !hasGrant('GM.setClipboard')) return;
    if (navigator.clipboard && navigator.clipboard.writeText) {
      navigator.clipboard.writeText(text).catch(() => fallbackCopyText(text));
    } else {
      fallbackCopyText(text);
    }
  }
  
  function fallbackCopyText(text) {
    const target = document.body || document.documentElement;
    if (!target) return;
    const ta = document.createElement('textarea');
    ta.value = text;
    ta.style.cssText = 'position:fixed;left:-9999px;top:-9999px';
    target.appendChild(ta);
    ta.select();
    try { document.execCommand('copy'); } catch(e) {}
    ta.remove();
  }
  
  // GM_head — convenience wrapper for HEAD requests
  function GM_head(url, callback) {
    if (!hasGrant('GM_xmlhttpRequest') && !hasGrant('GM.xmlHttpRequest')) {
      if (typeof callback === 'function') callback({ error: 'Missing @grant GM_xmlhttpRequest' });
      return;
    }
    GM_xmlhttpRequest({ method: 'HEAD', url, onload: callback, onerror: callback });
  }

  // GM_notification (with onclick, ondone, onbuttonclick, timeout, tag, silent,
  // highlight, url, plus Phase 11.11 progress + buttons + update + close).
  // Returns a control object with { close(), update(details) } so script
  // authors don't have to keep notification IDs around manually.
  // Wrapper-side LRU cap mirrors the 500-entry cap on the background side at
  // self._notifCallbacks — without this, a misbehaving script that spams
  // GM_notification and never receives click/done events can grow the Map
  // unbounded for the lifetime of the host tab.
  //
  // Phase 40.14 — Eviction counter surfaces leaks via the existing console
  // capture pipe (the wrapper already pipes console.* into the per-script
  // DevTools panel via _captureConsole). A non-zero count for any script is
  // a smell — the script is missing an ondone/onload/onclose handler.
  const _notifCallbacks = new Map();
  const _NOTIF_CALLBACKS_CAP = 500;
  let _notifCallbacksEvicted = 0;
  function GM_notification(details, ondone) {
    if (!hasGrant('GM_notification') && !hasGrant('GM.notification')) {
      return { close: () => {}, update: () => {} };
    }
    let opts;
    if (typeof details === 'string') {
      // GM_notification(text, title, image, onclick)
      opts = { text: details, title: ondone, image: arguments[2] };
      const onclickArg = arguments[3];
      if (typeof onclickArg === 'function') opts.onclick = onclickArg;
      ondone = undefined;
    } else {
      opts = details;
    }
    if (typeof ondone === 'function') opts.ondone = ondone;
    const notifTag = opts.tag || ('notif_' + Math.random().toString(36).substring(2));
    // Store callbacks; evict oldest when capped to avoid memory growth.
    if (_notifCallbacks.size >= _NOTIF_CALLBACKS_CAP) {
      const oldest = _notifCallbacks.keys().next().value;
      if (oldest !== undefined) _notifCallbacks.delete(oldest);
      _notifCallbacksEvicted += 1;
      if (_notifCallbacksEvicted === 1 || _notifCallbacksEvicted % 100 === 0) {
        console.warn('[ScriptVault] GM_notification callback cap evict — script may be missing ondone/onclick handler. Evicted so far:', _notifCallbacksEvicted);
      }
    }
    _notifCallbacks.set(notifTag, {
      onclick: opts.onclick,
      ondone: opts.ondone,
      onbuttonclick: opts.onbuttonclick
    });
    // Highlight tab instead of notification
    if (opts.highlight) {
      sendToBackground('GM_focusTab', {}).catch(() => {});
      if (opts.ondone) { try { opts.ondone(); } catch(e) {} }
      _notifCallbacks.delete(notifTag); // Clean up — no notification created
      return { close: () => {}, update: () => {} };
    }
    // Sanitize buttons[] so the background's truncate-to-2 contract stays
    // explicit at the wrapper boundary.
    const wireButtons = Array.isArray(opts.buttons)
      ? opts.buttons.slice(0, 2).map((b) => ({
          title: String(b?.title ?? ''),
          ...(typeof b?.iconUrl === 'string' ? { iconUrl: b.iconUrl } : {})
        }))
      : undefined;
    sendToBackground('GM_notification', {
      scriptId,
      title: opts.title || GM_info.script.name,
      text: opts.text || opts.body || '',
      image: opts.image,
      timeout: opts.timeout || 0,
      tag: notifTag,
      silent: opts.silent || false,
      progress: typeof opts.progress === 'number' ? opts.progress : undefined,
      buttons: wireButtons,
      hasOnclick: !!opts.onclick,
      hasOndone: !!opts.ondone,
      hasOnbuttonclick: typeof opts.onbuttonclick === 'function'
    }).catch(() => { _notifCallbacks.delete(notifTag); });

    return {
      close: () => {
        _notifCallbacks.delete(notifTag);
        sendToBackground('GM_closeNotification', { id: notifTag }).catch(() => {});
      },
      update: (patch) => {
        if (!patch || typeof patch !== 'object') return;
        sendToBackground('GM_updateNotification', {
          id: notifTag,
          title: typeof patch.title === 'string' ? patch.title : undefined,
          text: typeof patch.text === 'string' ? patch.text
              : typeof patch.body === 'string' ? patch.body : undefined,
          image: typeof patch.image === 'string' ? patch.image : undefined,
          progress: typeof patch.progress === 'number' ? patch.progress : undefined,
          buttons: Array.isArray(patch.buttons)
            ? patch.buttons.slice(0, 2).map((b) => ({
                title: String(b?.title ?? ''),
                ...(typeof b?.iconUrl === 'string' ? { iconUrl: b.iconUrl } : {})
              }))
            : undefined,
          silent: typeof patch.silent === 'boolean' ? patch.silent : undefined
        }).catch(() => {});
      }
    };
  }

  // Phase 11.11 — Standalone GM_updateNotification / GM_closeNotification
  // for callers that hold onto the tag from a prior GM_notification(tag: ...).
  function GM_updateNotification(notificationId, details) {
    if (!hasGrant('GM_notification') && !hasGrant('GM.notification')) return;
    if (!notificationId || !details || typeof details !== 'object') return;
    sendToBackground('GM_updateNotification', {
      id: notificationId,
      title: typeof details.title === 'string' ? details.title : undefined,
      text: typeof details.text === 'string' ? details.text
          : typeof details.body === 'string' ? details.body : undefined,
      image: typeof details.image === 'string' ? details.image : undefined,
      progress: typeof details.progress === 'number' ? details.progress : undefined,
      buttons: Array.isArray(details.buttons)
        ? details.buttons.slice(0, 2).map((b) => ({
            title: String(b?.title ?? ''),
            ...(typeof b?.iconUrl === 'string' ? { iconUrl: b.iconUrl } : {})
          }))
        : undefined,
      silent: typeof details.silent === 'boolean' ? details.silent : undefined
    }).catch(() => {});
  }
  function GM_closeNotification(notificationId) {
    if (!hasGrant('GM_notification') && !hasGrant('GM.notification')) return;
    if (!notificationId) return;
    _notifCallbacks.delete(notificationId);
    sendToBackground('GM_closeNotification', { id: notificationId }).catch(() => {});
  }
  
  // GM_openInTab (with close(), onclose, insert, setParent, incognito)
  // Cap the handle map so a misbehaving script that never receives the
  // openedTabClosed event (background crashed, content bridge missed the
  // signal, tab killed before bridge attached) can't leak unbounded handles
  // in the USER_SCRIPT world for the lifetime of the host tab.
  // Phase 40.14 — Eviction counter (see _notifCallbacks for rationale).
  const _openedTabs = new Map();
  const _OPENED_TABS_CAP = 200;
  let _openedTabsEvicted = 0;
  function GM_openInTab(url, options) {
    if (!hasGrant('GM_openInTab') && !hasGrant('GM.openInTab')) return null;
    const opts = typeof options === 'boolean' ? { active: !options } : (options || {});
    const tabHandle = { closed: false, onclose: null, close: () => {} };

    // Phase 39.13 — TM #2669: blob: URLs are bound to the creating context's
    // blob registry. chrome.tabs.create() in the background SW cannot resolve
    // a blob URL minted by a USER_SCRIPT world. Route blob: through window.open()
    // in-context instead; that preserves the registry binding. data: and
    // about:blank also resolve here without a background round-trip.
    const isLocalOnly = typeof url === 'string' && /^(blob|data|about):/i.test(url);
    if (isLocalOnly) {
      try {
        const target = opts.active === false || opts.background ? '_blank' : '_blank';
        const features = opts.active === false ? 'noopener=yes' : '';
        const win = window.open(url, target, features);
        if (!win) {
          // Pop-up blocker engaged. Surface a clear log so the script author
          // knows GM_openInTab requires a user-gesture for blob: URLs.
          console.warn('[ScriptVault] GM_openInTab(blob:) blocked by pop-up settings — call within a user-gesture handler');
        }
      } catch (e) {
        console.warn('[ScriptVault] GM_openInTab(blob:) failed:', e?.message || e);
      }
      // window.open returns a Window we can't message-pass with; tabHandle
      // gets a no-op close() and no onclose tracking (Chrome doesn't expose
      // the new tab's id to the page).
      return tabHandle;
    }

    sendToBackground('GM_openInTab', {
      url, scriptId, trackClose: true,
      active: opts.active, insert: opts.insert,
      setParent: opts.setParent, background: opts.background
    }).then(result => {
      if (result && result.tabId) {
        if (_openedTabs.size >= _OPENED_TABS_CAP) {
          const oldest = _openedTabs.keys().next().value;
          if (oldest !== undefined) _openedTabs.delete(oldest);
          _openedTabsEvicted += 1;
          if (_openedTabsEvicted === 1 || _openedTabsEvicted % 100 === 0) {
            console.warn('[ScriptVault] GM_openInTab cap evict — script may be opening tabs without listening for openedTabClosed. Evicted so far:', _openedTabsEvicted);
          }
        }
        _openedTabs.set(result.tabId, tabHandle);
        tabHandle.close = () => {
          sendToBackground('GM_closeTab', { tabId: result.tabId }).catch(() => {});
          tabHandle.closed = true;
        };
      }
    }).catch(() => {});
    return tabHandle;
  }

  // GM_download (with onload, onerror, onprogress, ontimeout callbacks)
  // Same LRU eviction as _openedTabs — protects a long-lived tab from a script
  // that fires GM_download in a loop where the load/error/timeout event never
  // arrives (download removed from history, SW restart between request and
  // response, etc.).
  // Phase 40.14 — Eviction counter (see _notifCallbacks for rationale).
  const _downloadCallbacks = new Map();
  const _DOWNLOAD_CALLBACKS_CAP = 200;
  let _downloadCallbacksEvicted = 0;
  function GM_download(details) {
    if (!hasGrant('GM_download') && !hasGrant('GM.download')) return;
    let opts;
    if (typeof details === 'string') {
      opts = { url: details, name: arguments[1] || details.split('/').pop() };
    } else {
      opts = { ...details };
    }
    const callbacks = {
      onload: opts.onload, onerror: opts.onerror,
      onprogress: opts.onprogress, ontimeout: opts.ontimeout
    };
    delete opts.onload; delete opts.onerror;
    delete opts.onprogress; delete opts.ontimeout;
    opts.scriptId = scriptId;
    opts.hasCallbacks = !!(callbacks.onload || callbacks.onerror || callbacks.onprogress || callbacks.ontimeout);
    sendToBackground('GM_download', opts).then(result => {
      if (result && result.downloadId) {
        if (_downloadCallbacks.size >= _DOWNLOAD_CALLBACKS_CAP) {
          const oldest = _downloadCallbacks.keys().next().value;
          if (oldest !== undefined) _downloadCallbacks.delete(oldest);
          _downloadCallbacksEvicted += 1;
          if (_downloadCallbacksEvicted === 1 || _downloadCallbacksEvicted % 100 === 0) {
            console.warn('[ScriptVault] GM_download cap evict — script may be missing onload/onerror handlers. Evicted so far:', _downloadCallbacksEvicted);
          }
        }
        _downloadCallbacks.set(result.downloadId, callbacks);
      }
      if (result && result.error) {
        if (callbacks.onerror) try { callbacks.onerror({ error: result.error }); } catch(e) {}
        if (result.downloadId) _downloadCallbacks.delete(result.downloadId);
      }
    }).catch(e => {
      if (callbacks.onerror) try { callbacks.onerror({ error: e.message || 'Download failed' }); } catch(ex) {}
    });
  }
  
  // GM_log
  function GM_log(...args) {
    console.log('[' + GM_info.script.name + ']', ...args);
  }
  
  // GM_registerMenuCommand (with extended options: id, accessKey, autoClose, title)
  const _menuCmds = new Map();
  function GM_registerMenuCommand(caption, callback, accessKeyOrOptions) {
    if (!hasGrant('GM_registerMenuCommand') && !hasGrant('GM.registerMenuCommand')) return null;
    let opts = {};
    if (typeof accessKeyOrOptions === 'string') {
      opts.accessKey = accessKeyOrOptions;
    } else if (accessKeyOrOptions && typeof accessKeyOrOptions === 'object') {
      opts = accessKeyOrOptions;
    }
    const id = opts.id || Math.random().toString(36).substring(2);
    _menuCmds.set(id, { callback, caption });
    sendToBackground('GM_registerMenuCommand', {
      scriptId, commandId: id, caption,
      accessKey: opts.accessKey || '',
      autoClose: opts.autoClose !== false,
      title: opts.title || ''
    }).catch(() => {});
    return id;
  }

  function GM_unregisterMenuCommand(id) {
    if (!hasGrant('GM_registerMenuCommand') && !hasGrant('GM.registerMenuCommand') &&
        !hasGrant('GM_unregisterMenuCommand') && !hasGrant('GM.unregisterMenuCommand')) return;
    _menuCmds.delete(id);
    sendToBackground('GM_unregisterMenuCommand', { scriptId, commandId: id }).catch(() => {});
  }

  function GM_getMenuCommands() {
    if (!hasGrant('GM_registerMenuCommand') && !hasGrant('GM.registerMenuCommand')) return [];
    return Array.from(_menuCmds.entries()).map(([id, entry]) => ({ id, name: entry.caption || id, caption: entry.caption || id }));
  }
  
  // GM_getResourceText / GM_getResourceURL
  async function GM_getResourceText(name) {
    if (!hasGrant('GM_getResourceText') && !hasGrant('GM.getResourceText')) return null;
    return await sendToBackground('GM_getResourceText', { scriptId, name });
  }
  
  async function GM_getResourceURL(name, isBlobUrl) {
    if (!hasGrant('GM_getResourceURL') && !hasGrant('GM.getResourceUrl')) return null;
    const dataUri = await sendToBackground('GM_getResourceURL', { scriptId, name });
    if (!dataUri) return null;
    // Return data URI by default, or convert to blob URL if requested
    if (isBlobUrl !== true) return dataUri;
    try {
      const resp = await fetch(dataUri);
      const blob = await resp.blob();
      return URL.createObjectURL(blob);
    } catch (e) {
      return dataUri;
    }
  }
  
  // GM_addElement
  const _urlAttrs = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'background', 'xlink:href', 'data']);
  function _isUnsafeElementAttribute(name, value) {
    const lowerName = String(name || '').trim().toLowerCase();
    if (!lowerName || lowerName.startsWith('on')) return true;
    if (!_urlAttrs.has(lowerName)) return false;
    const normalizedValue = String(value ?? '').replace(/[\\u0000-\\u0020\\u007f\\ufffd]+/g, '').toLowerCase();
    return /^(javascript|vbscript|data|blob|file):/.test(normalizedValue);
  }

  function GM_addElement(parentOrTag, tagOrAttrs, attrsOrUndefined) {
    if (!hasGrant('GM_addElement') && !hasGrant('GM.addElement')) return null;
    // Phase 38.1 — VM v2.37.0 + TM 5.5.6237 contract: return null on any
    // failure (missing tag, createElement throws, missing/detached parent,
    // appendChild throws). Never throw out of GM_addElement.
    let parent, tag, attrs;
    if (typeof parentOrTag === 'string') {
      tag = parentOrTag;
      attrs = tagOrAttrs;
      parent = document.head || document.documentElement;
    } else {
      parent = parentOrTag;
      tag = tagOrAttrs;
      attrs = attrsOrUndefined;
    }
    if (typeof tag !== 'string' || !tag) return null;
    let el;
    try { el = document.createElement(tag); } catch { return null; }
    if (!el) return null;
    // Reject arrays — Object.entries(array) returns numeric-index pairs that
    // would silently create attributes like 0="value". TM/VM contract says
    // attrs is an object map, never an array.
    if (attrs && typeof attrs === 'object' && !Array.isArray(attrs)) {
      try {
        Object.entries(attrs).forEach(([k, v]) => {
          if (k === 'textContent') el.textContent = v;
          else if (k === 'innerHTML') {
            const temp = document.createElement('template');
            temp.innerHTML = v;
            temp.content.querySelectorAll('script').forEach(s => s.remove());
            temp.content.querySelectorAll('*').forEach(node => {
              for (const attr of [...node.attributes]) {
                if (_isUnsafeElementAttribute(attr.name, attr.value)) {
                  node.removeAttribute(attr.name);
                }
              }
            });
            el.innerHTML = temp.innerHTML;
          }
          else {
            if (_isUnsafeElementAttribute(k, v)) return;
            try { el.setAttribute(k, v); } catch { /* ignore invalid attribute names */ }
          }
        });
      } catch { /* attribute-application errors do not abort, but a missing
                   parent below will. */ }
    }
    if (!parent || typeof parent.appendChild !== 'function') return null;
    try { parent.appendChild(el); } catch { return null; }
    return el;
  }
  
  // GM_loadScript - Dynamically fetch and eval a script URL at runtime
  // Fetches via background service worker (bypasses CORS/CSP), evals in userscript scope
  // Masks module/define/exports to force UMD libraries to set globals on window
  const _loadedScripts = new Set();
  async function GM_loadScript(url, options = {}) {
    if (!hasGrant('GM_xmlhttpRequest') && !hasGrant('GM.xmlHttpRequest')) {
      throw new Error('GM_loadScript requires @grant GM_xmlhttpRequest');
    }
    if (!url) throw new Error('GM_loadScript: No URL provided');
    if (!options.force && _loadedScripts.has(url)) return;
    const result = await sendToBackground('GM_loadScript', { scriptId, url, timeout: options.timeout });
    if (!result || result.error) throw new Error('GM_loadScript: ' + (result?.error || 'request timed out'));
    // Temporarily mask module systems so UMD scripts create window globals
    const _savedModule = window.module;
    const _savedExports = window.exports;
    const _savedDefine = window.define;
    try {
      window.module = undefined;
      window.exports = undefined;
      window.define = undefined;
      const fn = new Function(result.code);
      fn.call(window);
    } finally {
      window.module = _savedModule;
      window.exports = _savedExports;
      window.define = _savedDefine;
    }
    _loadedScripts.add(url);
  }

  // GM_getTab / GM_saveTab / GM_getTabs (real implementations via background)
  let _tabData = {};
  function GM_getTab(callback) {
    if (!hasGrant('GM_getTab') && !hasGrant('GM.getTab')) { if (callback) callback(_tabData); return _tabData; }
    sendToBackground('GM_getTab', { scriptId }).then(data => {
      _tabData = data || {};
      if (callback) callback(_tabData);
    }).catch(() => { if (callback) callback(_tabData); });
    return _tabData;
  }
  function GM_saveTab(tab) {
    if (!hasGrant('GM_saveTab') && !hasGrant('GM.saveTab')) return;
    _tabData = tab || {};
    sendToBackground('GM_saveTab', { scriptId, data: _tabData }).catch(() => {});
  }
  function GM_getTabs(callback) {
    if (!hasGrant('GM_getTabs') && !hasGrant('GM.getTabs')) { if (callback) callback({}); return; }
    sendToBackground('GM_getTabs', { scriptId }).then(data => {
      if (callback) callback(data || {});
    }).catch(() => { if (callback) callback({}); });
  }

  function GM_focusTab() {
    if (!hasGrant('GM_focusTab') && !hasGrant('GM.focusTab') &&
        !hasGrant('GM_openInTab') && !hasGrant('GM.openInTab')) return;
    sendToBackground('GM_focusTab', {}).catch(() => {});
  }

  // unsafeWindow
  const unsafeWindow = window;
  
  // Helper to wait for cache to be ready (used by async GM.* API)
  function _waitForCache() {
    if (_cacheReady) return Promise.resolve();
    if (!_cacheReadyPromise) {
      _cacheReadyPromise = new Promise(resolve => {
        _cacheReadyResolve = resolve;
      });
    }
    return _cacheReadyPromise;
  }
  
  // GM.* Promise-based API
  // These wait for storage to be refreshed before returning, ensuring fresh values
  // GM_cookie (list, set, delete)
  const GM_cookie = {
    list: (details, callback) => {
      if (!hasGrant('GM_cookie') && !hasGrant('GM.cookie')) {
        if (callback) callback([], new Error('Permission denied'));
        return;
      }
      sendToBackground('GM_cookie_list', details || {}).then(r => {
        if (callback) callback(r?.cookies || [], r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback([], e); });
    },
    set: (details, callback) => {
      if (!hasGrant('GM_cookie') && !hasGrant('GM.cookie')) {
        if (callback) callback(new Error('Permission denied'));
        return;
      }
      sendToBackground('GM_cookie_set', details || {}).then(r => {
        if (callback) callback(r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(e); });
    },
    delete: (details, callback) => {
      if (!hasGrant('GM_cookie') && !hasGrant('GM.cookie')) {
        if (callback) callback(new Error('Permission denied'));
        return;
      }
      sendToBackground('GM_cookie_delete', details || {}).then(r => {
        if (callback) callback(r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(e); });
    }
  };

  // Event listener for notification/download/tab close events from background
  // Content.js forwards these with 'type' field (not 'action') and flat structure (not nested 'data')
  window.addEventListener('message', function __svEventHandler(event) {
    if (!event.data || event.data.channel !== CHANNEL_ID || event.data.direction !== 'to-userscript') return;

    // Notification events (content.js sends: type, scriptId, notifTag, eventType)
    if (event.data.type === 'notificationEvent' && event.data.scriptId === scriptId) {
      const tag = event.data.notifTag;
      const cbs = _notifCallbacks.get(tag);
      if (!cbs) return;
      if (event.data.eventType === 'click' && cbs.onclick) { try { cbs.onclick(); } catch(e) {} }
      // Phase 11.11 — buttonClick fires onbuttonclick({buttonClickIndex}).
      if (event.data.eventType === 'buttonClick' && cbs.onbuttonclick) {
        try { cbs.onbuttonclick({ buttonClickIndex: event.data.buttonIndex | 0 }); } catch(e) {}
      }
      if (event.data.eventType === 'done') {
        if (cbs.ondone) { try { cbs.ondone(); } catch(e) {} }
        _notifCallbacks.delete(tag);
      }
    }

    // Download events (content.js sends: type, scriptId, downloadId, eventType, data)
    if (event.data.type === 'downloadEvent' && event.data.scriptId === scriptId) {
      const d = event.data.data || {};
      const cbs = _downloadCallbacks.get(event.data.downloadId);
      if (!cbs) return;
      const evType = event.data.eventType;
      if (evType === 'load' && cbs.onload) { try { cbs.onload({ url: d.url }); } catch(e) {} _downloadCallbacks.delete(event.data.downloadId); }
      if (evType === 'error' && cbs.onerror) { try { cbs.onerror({ error: d.error }); } catch(e) {} _downloadCallbacks.delete(event.data.downloadId); }
      if (evType === 'progress' && cbs.onprogress) { try { cbs.onprogress({ loaded: d.loaded, total: d.total }); } catch(e) {} }
      if (evType === 'timeout' && cbs.ontimeout) { try { cbs.ontimeout(); } catch(e) {} _downloadCallbacks.delete(event.data.downloadId); }
    }

    // Tab close events (content.js sends: type, scriptId, closedTabId)
    if (event.data.type === 'openedTabClosed' && event.data.scriptId === scriptId) {
      const tabId = event.data.closedTabId;
      const handle = _openedTabs.get(tabId);
      if (handle) {
        handle.closed = true;
        if (typeof handle.onclose === 'function') { try { handle.onclose(); } catch(e) {} }
        _openedTabs.delete(tabId);
      }
    }
  });

  // GM.* Promise-based API
  const GM = {
    info: GM_info,
    getValue: async (k, d) => {
      await _waitForCache();
      return GM_getValue(k, d);
    },
    setValue: (k, v) => Promise.resolve(GM_setValue(k, v)),
    deleteValue: (k) => Promise.resolve(GM_deleteValue(k)),
    listValues: async () => {
      await _waitForCache();
      return GM_listValues();
    },
    getValues: async (keys) => {
      await _waitForCache();
      return GM_getValues(keys);
    },
    setValues: (vals) => Promise.resolve(GM_setValues(vals)),
    deleteValues: (keys) => Promise.resolve(GM_deleteValues(keys)),
    addStyle: (css) => Promise.resolve(GM_addStyle(css)),
    xmlHttpRequest: (d) => {
      let control;
      const promise = new Promise((res, rej) => {
        control = GM_xmlhttpRequest({
          ...d,
          onload: (r) => { if (d.onload) d.onload(r); res(r); },
          onerror: (e) => { if (d.onerror) d.onerror(e); rej(e.error || e); },
          ontimeout: (e) => { if (d.ontimeout) d.ontimeout(e); rej(new Error('timeout')); },
          onabort: (e) => { if (d.onabort) d.onabort(e); rej(new Error('aborted')); }
        });
      });
      promise.abort = () => control.abort();
      return promise;
    },
    notification: (d, ondone) => Promise.resolve(GM_notification(d, ondone)),
    setClipboard: (t, type) => Promise.resolve(GM_setClipboard(t, type)),
    openInTab: (u, o) => Promise.resolve(GM_openInTab(u, o)),
    download: (d) => Promise.resolve(GM_download(d)),
    getResourceText: (n) => GM_getResourceText(n),
    getResourceUrl: (n) => GM_getResourceURL(n),
    registerMenuCommand: (c, cb, o) => Promise.resolve(GM_registerMenuCommand(c, cb, o)),
    unregisterMenuCommand: (id) => Promise.resolve(GM_unregisterMenuCommand(id)),
    addValueChangeListener: (k, cb) => Promise.resolve(GM_addValueChangeListener(k, cb)),
    removeValueChangeListener: (id) => Promise.resolve(GM_removeValueChangeListener(id)),
    getTab: () => new Promise(r => GM_getTab(r)),
    saveTab: (t) => Promise.resolve(GM_saveTab(t)),
    getTabs: () => new Promise(r => GM_getTabs(r)),
    loadScript: (url, opts) => GM_loadScript(url, opts),
    cookies: {
      list: (d) => new Promise((res, rej) => GM_cookie.list(d, (cookies, err) => err ? rej(err) : res(cookies))),
      set: (d) => new Promise((res, rej) => GM_cookie.set(d, (err) => err ? rej(err) : res())),
      delete: (d) => new Promise((res, rej) => GM_cookie.delete(d, (err) => err ? rej(err) : res()))
    }
  };

  // CRITICAL: Expose all GM_* functions to window for Tampermonkey/Violentmonkey compatibility
  window.GM_info = GM_info;
  window.GM_getValue = GM_getValue;
  window.GM_setValue = GM_setValue;
  window.GM_deleteValue = GM_deleteValue;
  window.GM_listValues = GM_listValues;
  window.GM_getValues = GM_getValues;
  window.GM_setValues = GM_setValues;
  window.GM_deleteValues = GM_deleteValues;
  window.GM_addStyle = GM_addStyle;
  window.GM_xmlhttpRequest = GM_xmlhttpRequest;
  window.GM_head = GM_head;
  window.GM_setClipboard = GM_setClipboard;
  window.GM_notification = GM_notification;
  window.GM_updateNotification = GM_updateNotification;
  window.GM_closeNotification = GM_closeNotification;
  window.GM_openInTab = GM_openInTab;
  window.GM_download = GM_download;
  window.GM_log = GM_log;
  window.GM_registerMenuCommand = GM_registerMenuCommand;
  window.GM_unregisterMenuCommand = GM_unregisterMenuCommand;
  window.GM_getMenuCommands = GM_getMenuCommands;
  window.GM_getResourceText = GM_getResourceText;
  window.GM_getResourceURL = GM_getResourceURL;
  window.GM_addElement = GM_addElement;
  window.GM_loadScript = GM_loadScript;
  window.GM_getTab = GM_getTab;
  window.GM_saveTab = GM_saveTab;
  window.GM_getTabs = GM_getTabs;
  window.GM_addValueChangeListener = GM_addValueChangeListener;
  window.GM_removeValueChangeListener = GM_removeValueChangeListener;
  window.GM_cookie = GM_cookie;
  window.GM_focusTab = GM_focusTab;

  // ========== GM_webRequest (Tampermonkey-compatible, declarativeNetRequest-backed) ==========
  function GM_webRequest(rules, listener) {
    if (!hasGrant('GM_webRequest')) {
      console.warn('[ScriptVault] GM_webRequest requires @grant GM_webRequest');
      return;
    }
    const ruleArray = Array.isArray(rules) ? rules : [rules];
    sendToBackground('GM_webRequest', { rules: ruleArray }).catch(e =>
      console.warn('[ScriptVault] GM_webRequest failed:', e.message)
    );
    // listener is called with (info, message, details) when a rule matches;
    // declarativeNetRequest doesn't support runtime callbacks, so we no-op this.
    if (typeof listener === 'function') {
      console.info('[ScriptVault] GM_webRequest: runtime listener not supported in MV3 — use @webRequest metadata for static rules');
    }
  }
  window.GM_webRequest = GM_webRequest;

  window.unsafeWindow = unsafeWindow;
  window.GM = GM;

  // ========== window.onurlchange (SPA navigation detection) ==========
  // Tampermonkey-compatible: fires when URL changes via pushState/replaceState/popstate.
  //
  // Phase 40.11 — Page-scoped monkey-patch + shared dispatcher.
  //
  // Previously every wrapper registration patched history.pushState / replaceState,
  // added popstate / hashchange listeners, and Proxied window.addEventListener /
  // removeEventListener on its own. Re-injection (script update applied while the
  // host tab is open) stacked new patches on top of the old ones; old wrap's
  // _urlChangeHandlers closures stayed reachable in the proxy chain forever.
  //
  // Now the page-level monkey-patch runs at most once per host tab, gated by
  // window.__svUrlChangeBound__ (non-enumerable, non-writable). The patch fires
  // a CustomEvent('__sv_urlchange__') on every URL change; each script's wrapper
  // attaches its own per-script listener to that event, scoped to its own
  // _urlChangeHandlers array. On the next re-injection, the page-level guard
  // short-circuits — only the per-script listener is re-attached, and the old
  // one is implicitly orphaned with the previous wrapper's closure.
  if (hasGrant('window.onurlchange')) {
    const _urlChangeHandlers = [];

    function __dispatchUrlChangeToHandlers(detail) {
      _urlChangeHandlers.forEach(fn => { try { fn(detail); } catch (e) {} });
      if (typeof window.onurlchange === 'function') {
        try { window.onurlchange(detail); } catch (e) {}
      }
    }

    // One-time page-level setup. The defineProperty guard survives the
    // wrapper-closure swap on re-injection.
    if (!window.__svUrlChangeBound__) {
      try {
        Object.defineProperty(window, '__svUrlChangeBound__', {
          value: true, writable: false, configurable: false, enumerable: false
        });
      } catch (_e) {
        // Property already locked by an earlier ScriptVault wrapper; treat as bound.
      }

      let _lastUrl = location.href;
      function __checkUrlChange() {
        const newUrl = location.href;
        if (newUrl !== _lastUrl) {
          const oldUrl = _lastUrl;
          _lastUrl = newUrl;
          const detail = { url: newUrl, oldUrl };
          // Fan out to every wrapper that subscribed.
          window.dispatchEvent(new CustomEvent('__sv_urlchange__', { detail }));
        }
      }

      // Phase 38.6 — Native Navigation API (Chrome 102+, our min-Chrome is
      // 130 so always present in supported Chromium builds; missing on
      // Safari and older Firefox where the polling shim below still wins).
      // The 'navigate' event fires for every SPA navigation including
      // direct location assignment, which the pushState/replaceState patch
      // misses, and runs in microtask order so the dispatch lands before
      // the next page paint. Falls through to the polling shim if the API
      // is missing (Firefox port path).
      const _nav = (typeof window !== 'undefined') ? window.navigation : undefined;
      if (_nav && typeof _nav.addEventListener === 'function') {
        try {
          _nav.addEventListener('navigate', (event) => {
            // Schedule on a microtask so location.href reflects the new URL
            // by the time __checkUrlChange reads it. The navigate event
            // fires BEFORE the document URL updates for traverse-style
            // navigations, but always before render.
            Promise.resolve().then(__checkUrlChange);
          });
        } catch (_e) { /* fall through to polling shim */ }
      }

      const _origPushState = history.pushState;
      const _origReplaceState = history.replaceState;
      history.pushState = function () {
        _origPushState.apply(this, arguments);
        __checkUrlChange();
      };
      history.replaceState = function () {
        _origReplaceState.apply(this, arguments);
        __checkUrlChange();
      };
      window.addEventListener('popstate', __checkUrlChange);
      window.addEventListener('hashchange', __checkUrlChange);
    }

    // Per-script subscription to the page-level event. Detaches itself if the
    // wrapper IIFE returns or throws (the closure becomes unreachable; the
    // function reference passed to addEventListener is its only liveness root).
    const __svUrlChangeListener = (event) => __dispatchUrlChangeToHandlers(event.detail);
    window.addEventListener('__sv_urlchange__', __svUrlChangeListener);

    // Allow adding multiple per-script handlers via the addEventListener pattern.
    // The Proxy is per-wrapper; re-injection installs a new proxy on the prior
    // (possibly-still-proxied) addEventListener. Each layer only intercepts
    // 'urlchange' and forwards everything else, so the chain stays correct.
    window.addEventListener = new Proxy(window.addEventListener, {
      apply(target, thisArg, args) {
        if (args[0] === 'urlchange') {
          if (!_urlChangeHandlers.includes(args[1])) {
            _urlChangeHandlers.push(args[1]);
          }
          return;
        }
        return Reflect.apply(target, thisArg, args);
      }
    });
    window.removeEventListener = new Proxy(window.removeEventListener, {
      apply(target, thisArg, args) {
        if (args[0] === 'urlchange') {
          const idx = _urlChangeHandlers.indexOf(args[1]);
          if (idx >= 0) _urlChangeHandlers.splice(idx, 1);
          return;
        }
        return Reflect.apply(target, thisArg, args);
      }
    });
    if (typeof window.onurlchange === 'undefined') window.onurlchange = null;
  }

  // ========== window.close / window.focus grants ==========
  if (hasGrant('window.close')) {
    // Already available in USER_SCRIPT world, but explicitly expose
    window.close = window.close.bind(window);
  }
  if (hasGrant('window.focus')) {
    window.focus = window.focus.bind(window);
  }

  // ========== GM_audio API (Tampermonkey-compatible tab mute control) ==========
  const GM_audio = {
    setMute: (details, callback) => {
      if (!hasGrant('GM_audio')) { if (callback) callback(new Error('Permission denied')); return; }
      sendToBackground('GM_audio_setMute', { mute: details?.mute ?? details }).then(r => {
        if (callback) callback(r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(e); });
    },
    getState: (callback) => {
      if (!hasGrant('GM_audio')) { if (callback) callback(null, new Error('Permission denied')); return; }
      sendToBackground('GM_audio_getState', {}).then(r => {
        if (callback) callback(r, r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(null, e); });
    },
    _listeners: [],
    _watching: false,
    _msgHandler: null,
    addStateChangeListener: (listener, callback) => {
      if (!hasGrant('GM_audio')) { if (callback) callback(new Error('Permission denied')); return; }
      GM_audio._listeners.push(listener);
      if (!GM_audio._watching) {
        GM_audio._watching = true;
        sendToBackground('GM_audio_watchState', {});
        // Listen for audio state change events from content script bridge
        GM_audio._msgHandler = (e) => {
          if (e.source !== window || !e.data || e.data.channel !== CHANNEL_ID) return;
          if (e.data.type === 'audioStateChanged') {
            const state = e.data.data;
            for (const fn of GM_audio._listeners) {
              try { fn(state); } catch (err) { console.error('[GM_audio listener]', err); }
            }
          }
        };
        window.addEventListener('message', GM_audio._msgHandler);
      }
      if (callback) callback();
    },
    removeStateChangeListener: (listener, callback) => {
      const idx = GM_audio._listeners.indexOf(listener);
      if (idx >= 0) GM_audio._listeners.splice(idx, 1);
      if (GM_audio._listeners.length === 0 && GM_audio._watching) {
        GM_audio._watching = false;
        if (GM_audio._msgHandler) {
          window.removeEventListener('message', GM_audio._msgHandler);
          GM_audio._msgHandler = null;
        }
        sendToBackground('GM_audio_unwatchState', {});
      }
      if (callback) callback();
    }
  };
  window.GM_audio = GM_audio;

  // ========== DOM HELPER FUNCTIONS ==========
  // These help userscripts handle DOM timing issues gracefully
  // Use these when document.body/head might not exist yet
  
  // Wait for any element matching selector to appear in DOM
  function __waitForElement(selector, timeout = 10000) {
    return new Promise((resolve, reject) => {
      // Check if already exists
      const existing = document.querySelector(selector);
      if (existing) return resolve(existing);
      
      let resolved = false;
      const observer = new MutationObserver((mutations, obs) => {
        if (resolved) return;
        const el = document.querySelector(selector);
        if (el) {
          resolved = true;
          obs.disconnect();
          resolve(el);
        }
      });
      
      // Start observing - handle case where documentElement might not exist yet
      const root = document.documentElement || document;
      if (root && typeof root.nodeType !== 'undefined') {
        observer.observe(root, { childList: true, subtree: true });
      }
      
      // Timeout with final check
      setTimeout(() => {
        if (resolved) return;
        observer.disconnect();
        const el = document.querySelector(selector);
        if (el) {
          resolve(el);
        } else {
          reject(new Error('[ScriptVault] Timeout waiting for element: ' + selector));
        }
      }, timeout);
    });
  }
  
  // Wait for document.body to be available
  function __waitForBody(timeout = 10000) {
    if (document.body) return Promise.resolve(document.body);
    return __waitForElement('body', timeout);
  }
  
  // Wait for document.head to be available
  function __waitForHead(timeout = 10000) {
    if (document.head) return Promise.resolve(document.head);
    return __waitForElement('head', timeout);
  }
  
  // Safe MutationObserver that waits for target element to exist
  // Prevents "parameter 1 is not of type 'Node'" errors
  function __safeObserve(target, options, callback) {
    // Handle selector string or element
    const element = typeof target === 'string' ? document.querySelector(target) : target;
    
    // If element exists and is valid, observe immediately
    if (element && element.nodeType === Node.ELEMENT_NODE) {
      const observer = new MutationObserver(callback);
      observer.observe(element, options);
      return { observer, promise: Promise.resolve(observer) };
    }
    
    // Element doesn't exist yet - wait for it
    const selectorToWait = typeof target === 'string' ? target : 'body';
    const promise = __waitForElement(selectorToWait)
      .then(el => {
        const observer = new MutationObserver(callback);
        observer.observe(el, options);
        return observer;
      })
      .catch(() => null);
    
    return { observer: null, promise };
  }
  
  // Expose DOM helpers to window for userscripts to use
  window.__ScriptVault_waitForElement = __waitForElement;
  window.__ScriptVault_waitForBody = __waitForBody;
  window.__ScriptVault_waitForHead = __waitForHead;
  window.__ScriptVault_safeObserve = __safeObserve;

  // Also expose as shorter aliases
  window.waitForElement = __waitForElement;
  window.waitForBody = __waitForBody;
  window.waitForHead = __waitForHead;
  window.safeObserve = __safeObserve;

  // ========== Network Proxy (full capture: fetch, XHR, WebSocket, sendBeacon) ==========
  // Intercepts all network calls made by this script and logs them to the network log.
  // Logs are viewable in the DevTools panel and the dashboard Network Log.
  (function __svNetProxy() {
    const _scriptName = ${JSON.stringify(meta.name || script.id)};
    const _scriptId = ${JSON.stringify(script.id)};

    function _log(entry) {
      sendToBackground('netlog_record', { scriptId: _scriptId, scriptName: _scriptName, ...entry }).catch(() => {});
    }

    function _safeSet(target, prop, value) {
      try {
        Object.defineProperty(target, prop, { configurable: true, writable: true, value });
        return true;
      } catch (e) {
        try {
          target[prop] = value;
          return target[prop] === value;
        } catch (e2) {
          return false;
        }
      }
    }

    // ── fetch ──────────────────────────────────────────────────────────────
    const _origFetch = window.fetch;
    if (typeof _origFetch === 'function') {
      _safeSet(window, 'fetch', function __svFetch(input, init) {
        const method = (init?.method || 'GET').toUpperCase();
        const url = typeof input === 'string' ? input : input?.url || String(input);
        const t0 = performance.now();
        return _origFetch.apply(this, arguments).then(resp => {
          const duration = Math.round(performance.now() - t0);
          const cl = parseInt(resp.headers.get('content-length') || '0') || 0;
          _log({ type: 'fetch', method, url, status: resp.status, statusText: resp.statusText, duration, responseSize: cl, responseHeaders: Object.fromEntries(resp.headers.entries()) });
          return resp;
        }, err => {
          const duration = Math.round(performance.now() - t0);
          _log({ type: 'fetch', method, url, error: err?.message || String(err), duration });
          throw err;
        });
      });
    }

    // ── XMLHttpRequest ─────────────────────────────────────────────────────
    const _OrigXHR = window.XMLHttpRequest;
    if (typeof _OrigXHR === 'function') {
      const _WrappedXHR = function __svXHR() {
        const xhr = new _OrigXHR();
        let _method = 'GET', _url = '', _t0 = 0;
        const _origOpen = xhr.open.bind(xhr);
        xhr.open = function(method, url) {
          _method = (method || 'GET').toUpperCase();
          _url = String(url);
          return _origOpen.apply(this, arguments);
        };
        const _origSend = xhr.send.bind(xhr);
        xhr.send = function() {
          _t0 = performance.now();
          xhr.addEventListener('loadend', () => {
            const duration = Math.round(performance.now() - _t0);
            if (xhr.status) {
              _log({ type: 'xhr', method: _method, url: _url, status: xhr.status, statusText: xhr.statusText, duration, responseSize: (xhr.responseText || '').length });
            } else {
              _log({ type: 'xhr', method: _method, url: _url, error: 'Request failed', duration });
            }
          }, { once: true });
          return _origSend.apply(this, arguments);
        };
        return xhr;
      };
      _WrappedXHR.prototype = _OrigXHR.prototype;
      _safeSet(window, 'XMLHttpRequest', _WrappedXHR);
    }

    // ── WebSocket ──────────────────────────────────────────────────────────
    const _OrigWS = window.WebSocket;
    if (typeof _OrigWS === 'function') {
      const _WrappedWS = function __svWebSocket(url, protocols) {
        const ws = protocols ? new _OrigWS(url, protocols) : new _OrigWS(url);
        const t0 = performance.now();
        let bytesSent = 0, bytesRecv = 0;
        ws.addEventListener('open', () => {
          _log({ type: 'websocket', method: 'WS', url: String(url), status: 101, statusText: 'Switching Protocols', duration: Math.round(performance.now() - t0) });
        });
        ws.addEventListener('message', e => { bytesRecv += (e.data?.length || 0); });
        ws.addEventListener('close', e => {
          _log({ type: 'websocket', method: 'WS_CLOSE', url: String(url), status: e.code, duration: Math.round(performance.now() - t0), responseSize: bytesRecv });
        });
        const _origSendWS = ws.send.bind(ws);
        ws.send = function(data) { bytesSent += (data?.length || 0); return _origSendWS(data); };
        return ws;
      };
      _WrappedWS.prototype = _OrigWS.prototype;
      Object.assign(_WrappedWS, {
        CONNECTING: _OrigWS.CONNECTING ?? 0,
        OPEN: _OrigWS.OPEN ?? 1,
        CLOSING: _OrigWS.CLOSING ?? 2,
        CLOSED: _OrigWS.CLOSED ?? 3
      });
      _safeSet(window, 'WebSocket', _WrappedWS);
    }

    // ── sendBeacon ─────────────────────────────────────────────────────────
    if (typeof navigator !== 'undefined' && typeof navigator.sendBeacon === 'function') {
      const _origBeacon = navigator.sendBeacon.bind(navigator);
      _safeSet(navigator, 'sendBeacon', function __svBeacon(url, data) {
        const result = _origBeacon(url, data);
        const size = data ? (typeof data === 'string' ? data.length : (data?.byteLength || data?.size || 0)) : 0;
        _log({ type: 'beacon', method: 'POST', url: String(url), status: result ? 200 : 0, duration: 0, responseSize: size });
        return result;
      });
    }
  })();
  // ========== End Network Proxy ==========

  // GM APIs exposed log disabled for performance
  // console.log('[ScriptVault] GM APIs exposed to window for:', meta.name);

  // ============ @require Scripts ============
  // These run after GM APIs are available on window
${requireCode}
${libraryExports}
  // ============ End @require Scripts ============

  // Wait for storage to be refreshed, then execute the userscript
  // This ensures scripts see fresh values when using GM_getValue
  (async function __scriptMonkeyRunner() {
    await _waitForCache();
    const __startTime = performance.now();
    try {
`;

  const apiClose = `
    } catch (e) {
      // Report error to background for profiling
      sendToBackground('reportExecError', { scriptId, error: (e?.message || String(e)).slice(0, 200) }).catch(() => {});
    } finally {
      // Report execution time to background for profiling
      const __elapsed = Math.round((performance.now() - __startTime) * 100) / 100;
      sendToBackground('reportExecTime', { scriptId, time: __elapsed, url: location.href }).catch(() => {});
    }
  })();
})();
`;

  // @top-level-await: wrap user code in async IIFE so top-level await works
  let userCode = meta['top-level-await']
    ? `(async () => {\n${script.code}\n})();`
    : script.code;

  // @delay: postpone script execution by N milliseconds
  if (meta.delay > 0) {
    userCode = `setTimeout(() => {\n${userCode}\n}, ${meta.delay});`;
  }

  // Phase 11.2 — `// @unwrap` (Violentmonkey parity).
  // When set, emit the script body verbatim without the GM API IIFE wrapper.
  // Useful for ESM-style top-level imports/exports and scripts that
  // intentionally modify the top-level scope. GM_* APIs are NOT available
  // in this mode (no apiInit/apiClose); we log a one-line console.warn so
  // authors who set @unwrap by mistake can spot it. Console-capture and
  // error suppression are also disabled in this mode.
  if (meta.unwrap === true) {
    // JSON.stringify produces a properly-escaped double-quoted JS string.
    // Don't slice off the quotes — a name like "John's Script" contains a
    // single quote, which the previous slice-based interpolation surfaced
    // verbatim into a single-quoted host string and broke the wrapper's
    // syntax. The full JSON-quoted form is a valid JS string literal.
    const nameLit = JSON.stringify(meta.name || 'Unnamed');
    const banner = `console.warn('[ScriptVault] ' + ${nameLit} + ': @unwrap is set — GM_* APIs are unavailable.');`;
    return banner + '\n' + userCode;
  }

  return apiInit + userCode + apiClose;
}

// Helper: Check if a pattern is a valid match pattern
function isValidMatchPattern(pattern) {
  if (!pattern) return false;
  if (pattern === '<all_urls>') return true;

  // Match pattern validation (allows ports: http://localhost:3000/*)
  const matchRegex = /^(\*|https?|file|ftp):\/\/(\*|\*\.[^/*]+|[^/*:]+(?::\d+)?)\/.*$/;
  return matchRegex.test(pattern);
}

// Check if a pattern is a regex @include (wrapped in /regex/)
function isRegexPattern(pattern) {
  if (!pattern || !pattern.startsWith('/') || pattern.length <= 2) return false;
  const match = pattern.match(/^\/(.+?)\/([gimsuy]*)$/);
  if (!match) return false;
  // Require at least one regex metacharacter to distinguish from plain URL paths like /path/to/file/
  return /[\\^$\[(+?{|]/.test(match[1]);
}

// Parse a regex @include pattern string into a RegExp object
function parseRegexPattern(pattern) {
  const match = pattern.match(/^\/(.+)\/([gimsuy]*)$/);
  if (!match) return null;
  try {
    return new RegExp(match[1], match[2]);
  } catch (e) {
    return null;
  }
}

// Extract broad match patterns from a regex to use for Chrome registration
// The actual fine-grained filtering happens at runtime in the injected wrapper
function extractMatchPatternsFromRegex(regexStr) {
  // Remove the /.../ wrapper and flags
  const inner = regexStr.replace(/^\//, '').replace(/\/[gimsuy]*$/, '');
  const patterns = [];

  // Strategy 1: Find domain patterns like "name\.(tld1|tld2|tld3)" or "name\.tld"
  // Handles: 1337x\.(to|st|ws|eu|se|is|gd|unblocked\.dk)
  const domainWithAlts = /([a-z0-9][-a-z0-9]*)\\\.\(([^)]+)\)/gi;
  let match;
  while ((match = domainWithAlts.exec(inner)) !== null) {
    const base = match[1];
    const altsRaw = match[2];
    // Split alternatives, handling escaped dots within them (e.g. unblocked\.dk)
    const alts = altsRaw.split('|').map(a => a.replace(/\\\./g, '.'));
    for (const alt of alts) {
      // Only use clean TLD/domain alternatives (no regex metacharacters)
      if (/^[a-z0-9][-a-z0-9.]*$/i.test(alt) && alt.length >= 2 && alt.length <= 30) {
        patterns.push(`*://*.${base}.${alt}/*`);
        patterns.push(`*://${base}.${alt}/*`);
      }
    }
  }

  // Strategy 2: Find simple "domain\.tld" patterns not inside groups
  const simpleDomain = /(?:^|\/\/)(?:\([^)]*\))?([a-z0-9][-a-z0-9]*(?:\\\.)[a-z]{2,10})(?:[\\\/\$\)]|$)/gi;
  while ((match = simpleDomain.exec(inner)) !== null) {
    const domain = match[1].replace(/\\\./g, '.');
    if (/^[a-z0-9][-a-z0-9]*\.[a-z]{2,10}$/i.test(domain)) {
      patterns.push(`*://*.${domain}/*`);
      patterns.push(`*://${domain}/*`);
    }
  }

  // Deduplicate
  return [...new Set(patterns)];
}

// Helper: Convert @include glob to @match pattern
function convertIncludeToMatch(include) {
  if (!include) return null;
  
  // If it's already a valid match pattern, return it
  if (isValidMatchPattern(include)) return include;
  
  // Handle common patterns
  if (include === '*') return '<all_urls>';
  
  // Try to convert glob to match pattern
  // Replace ** with * and handle http/https
  let pattern = include;
  
  // Handle patterns like *://example.com/*
  if (pattern.startsWith('*://')) {
    const afterScheme = pattern.slice(4);
    if (!afterScheme.includes('/')) pattern += '/*';
    return isValidMatchPattern(pattern) ? pattern : null;
  }

  // Handle patterns like http://example.com/*
  if (pattern.match(/^https?:\/\//)) {
    if (!pattern.includes('/*') && !pattern.endsWith('/')) pattern += '/*';
    return isValidMatchPattern(pattern) ? pattern : null;
  }

  // Handle patterns like *.example.com
  if (pattern.startsWith('*.')) {
    const result = '*://' + pattern + '/*';
    return isValidMatchPattern(result) ? result : null;
  }

  // Handle patterns like example.com
  if (!pattern.includes('://') && !pattern.startsWith('/')) {
    const result = '*://' + pattern + '/*';
    return isValidMatchPattern(result) ? result : null;
  }

  return null;
}

// MV3 cold-start guard: store the init promise on self so all event listeners
// (onMessage, onAlarm, onCommand, onTab*) can await it before touching state.
// Without this, an event firing during the SW wake races init() and hits
// handlers before ScriptStorage / SettingsManager are ready.
self._initPromise = init();
function ensureInitialized() {
  if (!self._initPromise) self._initPromise = init();
  return self._initPromise;
}
self.ensureInitialized = ensureInitialized;