background.core.js

console.log('[ScriptVault] Service worker starting...');

// ============================================================================
// Debug Logger — conditional logging based on settings
// ============================================================================

/**
 * Log a debug message. Only outputs if debugMode is enabled in settings.
 * Falls back to no-op in production to avoid Chrome DevTools spam.
 * @param {...any} args - Arguments to log
 */
let _debugEnabled = false;
function debugLog(...args) {
  if (_debugEnabled) console.log('[ScriptVault]', ...args);
}
function debugWarn(...args) {
  if (_debugEnabled) console.warn('[ScriptVault]', ...args);
}

// Load debug setting on startup (async — logs before this completes go to console.log)
(async () => {
  try {
    const data = await chrome.storage.local.get('settings');
    _debugEnabled = data.settings?.debugMode === true;
  } catch {}
})();

// ============================================================================
// Userscript Parser
// ============================================================================

/**
 * Parse a userscript's metadata block and extract all supported directives.
 * @param {string} code - The full userscript source code
 * @returns {{ meta?: Object, code?: string, metaBlock?: string, error?: string }} Parsed result or error
 */
function parseUserscript(code) {
  const metaBlockMatch = code.match(/\/\/\s*==UserScript==([\s\S]*?)\/\/\s*==\/UserScript==/);
  if (!metaBlockMatch) {
    return { error: 'No metadata block found. Scripts must include ==UserScript== header.' };
  }

  const meta = {
    name: 'Unnamed Script',
    namespace: 'scriptvault',
    version: '1.0.0',
    description: '',
    author: '',
    match: [],
    include: [],
    exclude: [],
    excludeMatch: [],
    grant: [],
    require: [],
    resource: {},
    'run-at': 'document-idle',
    noframes: false,
    icon: '',
    icon64: '',
    homepage: '',
    homepageURL: '',
    website: '',
    source: '',
    updateURL: '',
    downloadURL: '',
    supportURL: '',
    connect: [],
    antifeature: [],
    unwrap: false,
    'inject-into': 'auto',
    sandbox: '',
    tag: [],
    'run-in': '',
    'top-level-await': false,
    license: '',
    copyright: '',
    contributionURL: '',
    compatible: [],
    incompatible: [],
    webRequest: null,
    priority: 0,
    crontab: ''
  };

  const metaBlock = metaBlockMatch[1];
  const lines = metaBlock.split('\n');

  for (const line of lines) {
    const match = line.match(/\/\/\s*@(\S+)(?:\s+(.*))?/);
    if (!match) continue;

    const key = match[1].trim();
    const value = (match[2] || '').trim();

    switch (key) {
      case 'name':
      case 'namespace':
      case 'version':
      case 'description':
      case 'author':
      case 'icon':
      case 'icon64':
      case 'homepage':
      case 'homepageURL':
      case 'website':
      case 'source':
      case 'updateURL':
      case 'downloadURL':
      case 'supportURL':
      case 'run-at':
      case 'inject-into':
      case 'sandbox':
      case 'run-in':
      case 'license':
      case 'copyright':
      case 'contributionURL':
      case 'crontab':
        meta[key] = value;
        break;
      case 'match':
      case 'include':
      case 'exclude':
      case 'exclude-match':
      case 'excludeMatch':
      case 'grant':
      case 'require':
      case 'connect':
      case 'antifeature':
      case 'tag':
      case 'compatible':
      case 'incompatible':
        const arrayKey = key === 'exclude-match' ? 'excludeMatch' : key;
        if (!meta[arrayKey]) meta[arrayKey] = [];
        if (value) meta[arrayKey].push(value);
        break;
      case 'resource':
        const resourceMatch = value.match(/^(\S+)\s+(.+)$/);
        if (resourceMatch) {
          meta.resource[resourceMatch[1]] = resourceMatch[2];
        }
        break;
      case 'noframes':
        meta.noframes = true;
        break;
      case 'unwrap':
        meta.unwrap = true;
        break;
      case 'nodownload':
        meta.nodownload = true;
        break;
      case 'delay':
        meta.delay = Math.max(0, parseInt(value, 10) || 0);
        break;
      case 'top-level-await':
        meta['top-level-await'] = true;
        break;
      case 'priority':
        meta.priority = parseInt(value, 10) || 0;
        break;
      case 'webRequest':
        try { meta.webRequest = JSON.parse(value); } catch (e) {}
        break;
      default:
        // Handle localized metadata like @name:ja or @name:zh-Hans
        if (key.includes(':')) {
          const colonIdx = key.indexOf(':');
          const baseKey = key.slice(0, colonIdx);
          const locale = key.slice(colonIdx + 1);
          if (baseKey && locale) {
            if (!meta.localized) meta.localized = {};
            if (!meta.localized[locale]) meta.localized[locale] = {};
            meta.localized[locale][baseKey] = value;
          }
        }
    }
  }

  // Default grant if none specified
  if (meta.grant.length === 0) {
    meta.grant = ['none'];
  }

  return { meta, code, metaBlock: metaBlockMatch[0] };
}

// ============================================================================
// URL Matching
// ============================================================================

// ============================================================================
// Update System
// ============================================================================

const UpdateSystem = {
  async checkForUpdates(scriptId = null) {
    const scripts = scriptId 
      ? [await ScriptStorage.get(scriptId)].filter(Boolean)
      : await ScriptStorage.getAll();
    
    const updates = [];
    
    for (const script of scripts) {
      if (script.meta.nodownload) continue; // @nodownload prevents auto-updates
      if (!script.meta.updateURL && !script.meta.downloadURL) continue;
      
      try {
        const updateUrl = script.meta.updateURL || script.meta.downloadURL;
        const headers = {};

        // Conditional request using stored etag/last-modified
        if (script._httpEtag) headers['If-None-Match'] = script._httpEtag;
        if (script._httpLastModified) headers['If-Modified-Since'] = script._httpLastModified;

        const response = await fetch(updateUrl, { headers });

        // 304 Not Modified - no update needed
        if (response.status === 304) continue;
        if (!response.ok) continue;

        // Store HTTP cache headers for next check
        const etag = response.headers.get('etag');
        const lastModified = response.headers.get('last-modified');
        if (etag || lastModified) {
          script._httpEtag = etag || '';
          script._httpLastModified = lastModified || '';
          await ScriptStorage.set(script.id, script);
        }

        const newCode = await response.text();
        const parsed = parseUserscript(newCode);
        if (parsed.error) continue;

        if (this.compareVersions(parsed.meta.version, script.meta.version) > 0) {
          updates.push({
            id: script.id,
            name: script.meta.name,
            currentVersion: script.meta.version,
            newVersion: parsed.meta.version,
            code: newCode
          });
        }
      } catch (e) {
        console.error('[ScriptVault] Update check failed for:', script.meta.name, e);
      }
    }
    
    return updates;
  },
  
  compareVersions(v1, v2) {
    // Strip pre-release suffix (e.g. "1.2.0-beta.1" → "1.2.0") before numeric comparison.
    // A version with a pre-release suffix is treated as less than the same version without one.
    const preRelease1 = v1.includes('-');
    const preRelease2 = v2.includes('-');
    const clean1 = (typeof v1 === 'string' ? v1 : String(v1)).replace(/-.*$/, '');
    const clean2 = (typeof v2 === 'string' ? v2 : String(v2)).replace(/-.*$/, '');
    const parts1 = clean1.split('.').map(n => parseInt(n, 10) || 0);
    const parts2 = clean2.split('.').map(n => parseInt(n, 10) || 0);

    for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
      const p1 = parts1[i] || 0;
      const p2 = parts2[i] || 0;
      if (p1 > p2) return 1;
      if (p1 < p2) return -1;
    }
    // Numeric parts are equal — a pre-release is less than a release of the same version
    if (preRelease1 && !preRelease2) return -1;
    if (!preRelease1 && preRelease2) return 1;
    return 0;
  },
  
  async applyUpdate(scriptId, newCode, { force = false } = {}) {
    const script = await ScriptStorage.get(scriptId);
    if (!script) return { error: 'Script not found' };
    // Don't auto-update scripts the user has locally edited (unless force=true from forceUpdate)
    if (!force && script.settings?.userModified) return { skipped: true, reason: 'user-modified' };

    const parsed = parseUserscript(newCode);
    if (parsed.error) return parsed;

    // Store previous version for rollback (keep last 3)
    if (!script.versionHistory) script.versionHistory = [];
    script.versionHistory.push({
      version: script.meta.version,
      code: script.code,
      updatedAt: script.updatedAt || Date.now()
    });
    // Trim to last 5 versions
    if (script.versionHistory.length > 5) {
      script.versionHistory = script.versionHistory.slice(-5);
    }

    script.code = newCode;
    script.meta = parsed.meta;
    script.updatedAt = Date.now();

    // Re-register FIRST so we can verify the new code works before persisting
    try {
      await unregisterScript(scriptId);
      if (script.enabled !== false) {
        await registerScript(script);
      }
    } catch (regError) {
      console.error(`[ScriptVault] Failed to re-register ${script.meta.name} after update:`, regError);
      // Registration failed — still save the updated code (user can manually fix)
      // but mark the failure so the UI can show it
      script.settings = script.settings || {};
      script.settings._registrationError = regError.message || 'Registration failed after update';
    }

    // Persist to storage after registration attempt
    await ScriptStorage.set(scriptId, script);

    const settings = await SettingsManager.get();
    if (settings.notifyOnUpdate) {
      chrome.notifications.create({
        type: 'basic',
        iconUrl: 'images/icon128.png',
        title: 'Script Updated',
        message: `${script.meta.name} updated to v${script.meta.version}`
      });
    }

    return { success: true, script };
  },
  
  async autoUpdate() {
    const settings = await SettingsManager.get();
    if (!settings.autoUpdate) return;

    const updates = await this.checkForUpdates();
    // Apply all pending updates in parallel — each applyUpdate is independent
    const results = await Promise.allSettled(updates.map(update => this.applyUpdate(update.id, update.code)));
    const failed = results.filter(r => r.status === 'rejected');
    if (failed.length > 0) {
      console.error('[ScriptVault] Auto-update failures:', failed.map(r => r.reason?.message || r.reason));
    }

    await SettingsManager.set('lastUpdateCheck', Date.now());
  }
};

// ============================================================================
// Cloud Sync
// ============================================================================

const CloudSync = {
  // Use providers from imported CloudSyncProviders module
  get providers() {
    return CloudSyncProviders;
  },

  _syncInProgress: false,

  async sync() {
    // Prevent concurrent syncs — second call defers until first completes
    if (this._syncInProgress) {
      debugLog('[CloudSync] Sync already in progress, skipping');
      return { skipped: true };
    }
    this._syncInProgress = true;

    let _timeoutId;
    try {
      const timeoutPromise = new Promise((_, reject) => {
        _timeoutId = setTimeout(() => reject(new Error('Sync timed out after 90s')), 90000);
      });
      return await Promise.race([this._performSync(), timeoutPromise]);
    } catch (e) {
      console.error('[ScriptVault] Sync failed:', e);
      return { error: e.message };
    } finally {
      clearTimeout(_timeoutId);
      this._syncInProgress = false;
    }
  },

  async _performSync() {
    const settings = await SettingsManager.get();
    if (!settings.syncEnabled || settings.syncProvider === 'none') return;

    const provider = this.providers[settings.syncProvider];
    if (!provider) return;

    // Load tombstones (IDs of locally-deleted scripts, to prevent sync re-importing them)
    const tombstoneData = await chrome.storage.local.get('syncTombstones');
    const tombstones = tombstoneData.syncTombstones || {};

    // Get local data
    const scripts = await ScriptStorage.getAll();
    const localData = {
      version: 1,
      timestamp: Date.now(),
      scripts: scripts.map(s => ({
        id: s.id,
        code: s.code,
        enabled: s.enabled,
        position: s.position,
        settings: s.settings || {},
        updatedAt: s.updatedAt
      })),
      tombstones
    };

    // Get remote data
    const remoteData = await provider.download(settings);

    if (remoteData) {
      // Merge tombstones from remote so deletions propagate across devices
      const mergedTombstones = { ...tombstones, ...(remoteData.tombstones || {}) };

      // Merge: prefer newer versions
      const merged = this.mergeData(localData, remoteData);

      // Apply merged data locally, skipping tombstoned (deleted) scripts
      // Uses 3-way text merge (via offscreen doc) when both sides have changed since sync base
      for (const script of merged.scripts) {
        if (mergedTombstones[script.id]) continue; // deleted on some device, don't re-import
        const existing = await ScriptStorage.get(script.id);
        // Skip scripts marked as locally modified — user edits take precedence over remote
        if (existing?.settings?.userModified) continue;

        const remoteScript = remoteData.scripts?.find(s => s.id === script.id);
        const localScript = localData.scripts?.find(s => s.id === script.id);

        let codeToSave = script.code;
        let mergeConflict = false;

        // 3-way merge: both sides changed since last known base
        if (existing && remoteScript && localScript &&
            existing.code !== remoteScript.code &&
            existing.code !== localScript.code) {
          const base = existing.syncBaseCode || existing.code;
          if (base && base !== localScript.code && base !== remoteScript.code) {
            try {
              await ScriptAnalyzer._ensureOffscreen();
              const mergeResult = await chrome.runtime.sendMessage({
                type: 'offscreen_merge',
                base,
                local: localScript.code,
                remote: remoteScript.code
              });
              if (mergeResult && !mergeResult.error) {
                codeToSave = mergeResult.merged;
                mergeConflict = mergeResult.conflicts || false;
                debugLog(`[CloudSync] 3-way merge for ${script.id}: conflicts=${mergeConflict}`);
              }
            } catch (e) {
              debugLog('[CloudSync] 3-way merge failed, using timestamp winner:', e.message);
              // Fall back to last-write-wins but flag as potential conflict
              mergeConflict = true;
            }
          }
        }

        if (!existing || script.updatedAt > existing.updatedAt || mergeConflict) {
          const parsed = parseUserscript(codeToSave);
          if (!parsed.error) {
            await ScriptStorage.set(script.id, {
              id: script.id,
              code: codeToSave,
              meta: parsed.meta,
              enabled: script.enabled,
              position: script.position,
              settings: {
                ...(existing?.settings || {}),
                ...(mergeConflict ? { mergeConflict: true } : {})
              },
              updatedAt: Math.max(script.updatedAt, existing?.updatedAt || 0),
              createdAt: existing?.createdAt || script.updatedAt,
              syncBaseCode: codeToSave // record merged result as new base for future syncs
            });
          }
        }
      }

      // Persist merged tombstones locally
      if (Object.keys(mergedTombstones).length > Object.keys(tombstones).length) {
        await chrome.storage.local.set({ syncTombstones: mergedTombstones });
      }

      // Upload merged data (includes tombstones)
      merged.timestamp = Date.now();
      merged.tombstones = mergedTombstones;
      await provider.upload(merged, settings);
    } else {
      // First sync, just upload (include tombstones so remote gets deletion info)
      await provider.upload(localData, settings);
    }

    await SettingsManager.set('lastSync', Date.now());
    return { success: true };
  },
  
  mergeData(local, remote) {
    const scriptsMap = new Map();
    const mergedTombstones = { ...(local.tombstones || {}), ...(remote.tombstones || {}) };

    // Add all local scripts
    for (const script of (local.scripts || [])) {
      scriptsMap.set(script.id, script);
    }

    // Merge remote scripts (prefer newer)
    for (const script of (remote.scripts || [])) {
      const existing = scriptsMap.get(script.id);
      if (!existing || script.updatedAt > existing.updatedAt) {
        scriptsMap.set(script.id, script);
      }
    }

    return {
      version: 1,
      timestamp: Date.now(),
      scripts: Array.from(scriptsMap.values()).filter(s => !mergedTombstones[s.id]),
      tombstones: mergedTombstones
    };
  }
};

// ============================================================================
// Import/Export
// ============================================================================

async function exportAllScripts(options = {}) {
  const {
    includeSettings = true,
    includeStorage = false
  } = options;
  const scripts = await ScriptStorage.getAll();
  const settings = includeSettings ? await SettingsManager.get() : null;

  const exportedScripts = await Promise.all(scripts.map(async s => {
    const entry = {
      id: s.id,
      code: s.code,
      enabled: s.enabled,
      position: s.position,
      createdAt: s.createdAt,
      updatedAt: s.updatedAt
    };
    if (includeSettings && s.settings && typeof s.settings === 'object') {
      entry.settings = { ...s.settings };
    }
    if (s.versionHistory && s.versionHistory.length > 0) {
      entry.versionHistory = s.versionHistory;
    }
    if (includeStorage) {
      const values = await ScriptValues.getAll(s.id);
      if (values && Object.keys(values).length > 0) {
        entry.storage = values;
      }
    }
    return entry;
  }));
  
  return {
    version: 2,
    exportedAt: new Date().toISOString(),
    ...(includeSettings ? { settings } : {}),
    scripts: exportedScripts
  };
}

async function importScripts(data, options = {}) {
  const {
    overwrite = false,
    importSettings = false,
    importStorage = false
  } = options;
  const results = {
    imported: 0,
    skipped: 0,
    errors: [],
    settingsImported: false,
    storageImported: 0
  };

  if (!data.scripts || !Array.isArray(data.scripts)) {
    return { error: 'Invalid import format' };
  }

  // Cache existing count once to avoid O(n²) getAll() inside the loop
  let _importPosition = (await ScriptStorage.getAll()).length;

  for (const script of data.scripts) {
    try {
      const parsed = parseUserscript(script.code);
      if (parsed.error) {
        results.errors.push({ name: script.id, error: parsed.error });
        continue;
      }

      const existing = await ScriptStorage.get(script.id);
      if (existing && !overwrite) {
        results.skipped++;
        continue;
      }

      const nextSettings = importSettings && script.settings && typeof script.settings === 'object'
        ? { ...script.settings }
        : { ...(existing?.settings || {}) };

      const importEntry = {
        id: script.id,
        code: script.code,
        meta: parsed.meta,
        enabled: script.enabled ?? true,
        settings: nextSettings,
        position: script.position ?? _importPosition++,
        createdAt: script.createdAt || Date.now(),
        updatedAt: script.updatedAt || Date.now()
      };
      if (script.versionHistory && Array.isArray(script.versionHistory)) {
        importEntry.versionHistory = script.versionHistory;
      }
      await ScriptStorage.set(script.id, importEntry);
      if (importStorage) {
        const storedValues = script.storage && typeof script.storage === 'object' ? script.storage : {};
        if (Object.keys(storedValues).length > 0) {
          await ScriptValues.deleteAll(script.id);
          await ScriptValues.setAll(script.id, storedValues);
          results.storageImported++;
        } else if (existing) {
          await ScriptValues.deleteAll(script.id);
        }
      }
      results.imported++;
    } catch (e) {
      results.errors.push({ name: script.id, error: e.message });
    }
  }
  
  // Import settings if present
  if (data.settings && importSettings) {
    await SettingsManager.set(data.settings);
    results.settingsImported = true;
  }
  
  // Re-register all scripts after import
  await registerAllScripts(true);
  await updateBadge();

  return results;
}

// Export to ZIP (Tampermonkey-compatible format)
async function exportToZip(options = {}) {
  const { includeStorage = true } = options;
  const scripts = await ScriptStorage.getAll();
  const files = {}; // fflate uses { filename: Uint8Array } format
  const usedNames = new Set();

  for (const script of scripts) {
    // Create safe filename, deduplicating collisions
    let safeName = (script.meta.name || 'unnamed')
      .replace(/[<>:"/\\|?*]/g, '_')
      .replace(/\s+/g, ' ')
      .trim()
      .substring(0, 100);

    if (usedNames.has(safeName)) {
      let counter = 2;
      while (usedNames.has(`${safeName}_${counter}`)) counter++;
      safeName = `${safeName}_${counter}`;
    }
    usedNames.add(safeName);

    // Add the userscript file
    files[`${safeName}.user.js`] = fflate.strToU8(script.code);
    
    // Add options.json (Tampermonkey format)
    const scriptOptions = {
      settings: {
        enabled: script.enabled,
        'run-at': script.meta['run-at'] || 'document-idle',
        override: {
          use_includes: [],
          use_matches: [],
          use_excludes: [],
          use_connects: [],
          merge_includes: true,
          merge_matches: true,
          merge_excludes: true,
          merge_connects: true
        }
      },
      meta: {
        name: script.meta.name,
        namespace: script.meta.namespace || '',
        version: script.meta.version || '1.0',
        description: script.meta.description || '',
        author: script.meta.author || '',
        match: script.meta.match || [],
        include: script.meta.include || [],
        exclude: script.meta.exclude || [],
        grant: script.meta.grant || [],
        require: script.meta.require || [],
        resource: script.meta.resource || {}
      }
    };
    files[`${safeName}.options.json`] = fflate.strToU8(JSON.stringify(scriptOptions, null, 2));
    
    // Add storage.json if script has stored values
    const values = includeStorage ? await ScriptValues.getAll(script.id) : null;
    if (values && Object.keys(values).length > 0) {
      const storage = { data: values };
      files[`${safeName}.storage.json`] = fflate.strToU8(JSON.stringify(storage, null, 2));
    }
  }
  
  // Generate zip as Uint8Array then convert to base64 in chunks (avoid stack overflow)
  const zipData = fflate.zipSync(files, { level: 6 });
  let binary = '';
  const chunkSize = 8192;
  for (let i = 0; i < zipData.length; i += chunkSize) {
    binary += String.fromCharCode.apply(null, zipData.subarray(i, i + chunkSize));
  }
  const base64 = btoa(binary);
  return { zipData: base64, filename: `scriptvault-archive-${new Date().toISOString().replace(/[:.]/g, '-')}.zip` };
}

// Import from ZIP (supports Tampermonkey and other formats)
async function importFromZip(zipData, options = {}) {
  const results = { imported: 0, skipped: 0, errors: [] };
  
  try {
    // Convert base64 to Uint8Array if needed
    let zipBytes;
    if (typeof zipData === 'string') {
      // Base64 string
      const binaryString = atob(zipData);
      zipBytes = new Uint8Array(binaryString.length);
      for (let i = 0; i < binaryString.length; i++) {
        zipBytes[i] = binaryString.charCodeAt(i);
      }
    } else if (zipData instanceof ArrayBuffer) {
      zipBytes = new Uint8Array(zipData);
    } else {
      zipBytes = zipData;
    }
    
    // Load the zip file using fflate
    const unzipped = fflate.unzipSync(zipBytes);
    const fileNames = Object.keys(unzipped);
    
    // Find all .user.js files
    const userScripts = fileNames.filter(name => name.endsWith('.user.js'));
    const allExistingScripts = await ScriptStorage.getAll();
    // Starting position for newly-imported scripts (avoids O(n²) getAll() per script)
    let _importPosition = allExistingScripts.length;

    for (const filename of userScripts) {
      try {
        const code = fflate.strFromU8(unzipped[filename]);

        // Validate it's a userscript
        if (!code.includes('==UserScript==')) {
          results.errors.push({ name: filename, error: 'Not a valid userscript' });
          continue;
        }

        const parsed = parseUserscript(code);
        if (parsed.error) {
          results.errors.push({ name: filename, error: parsed.error });
          continue;
        }

        // Check for existing script with same name/namespace
        const existing = allExistingScripts.find(s =>
          s.meta.name === parsed.meta.name && 
          (s.meta.namespace === parsed.meta.namespace || (!s.meta.namespace && !parsed.meta.namespace))
        );
        
        if (existing && !options.overwrite) {
          results.skipped++;
          continue;
        }
        
        // Look for associated options and storage files
        const baseName = filename.replace('.user.js', '');
        const optionsFileData = unzipped[`${baseName}.options.json`];
        const storageFileData = unzipped[`${baseName}.storage.json`];
        
        let enabled = true;
        let storedValues = {};
        
        // Parse options file if exists
        if (optionsFileData) {
          try {
            const optionsData = JSON.parse(fflate.strFromU8(optionsFileData));
            enabled = optionsData.settings?.enabled !== false;
          } catch (e) {
            console.warn('Failed to parse options file:', e);
          }
        }
        
        // Parse storage file if exists
        if (storageFileData) {
          try {
            const storageData = JSON.parse(fflate.strFromU8(storageFileData));
            storedValues = storageData.data || storageData || {};
          } catch (e) {
            console.warn('Failed to parse storage file:', e);
          }
        }
        
        // Create or update script
        const scriptId = existing?.id || generateId();
        const script = {
          id: scriptId,
          code: code,
          meta: parsed.meta,
          enabled: enabled,
          position: existing?.position ?? _importPosition++,
          createdAt: existing?.createdAt || Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(scriptId, script);
        
        // Import stored values
        if (Object.keys(storedValues).length > 0) {
          await ScriptValues.setAll(scriptId, storedValues);
        }
        
        results.imported++;
      } catch (e) {
        results.errors.push({ name: filename, error: e.message });
      }
    }
    
    // If no .user.js files found, try importing raw JS files
    if (userScripts.length === 0) {
      const jsFiles = fileNames.filter(name => 
        name.endsWith('.js') && !name.includes('/')
      );
      
      for (const filename of jsFiles) {
        try {
          const code = fflate.strFromU8(unzipped[filename]);
          if (!code.includes('==UserScript==')) continue;
          
          const parsed = parseUserscript(code);
          if (parsed.error) continue;
          
          const scriptId = generateId();
          await ScriptStorage.set(scriptId, {
            id: scriptId,
            code: code,
            meta: parsed.meta,
            enabled: true,
            position: _importPosition++,
            createdAt: Date.now(),
            updatedAt: Date.now()
          });
          results.imported++;
        } catch (e) {
          results.errors.push({ name: filename, error: e.message });
        }
      }
    }
    
    await updateBadge();

    // Re-register all scripts after import
    await registerAllScripts(true);

    return results;
  } catch (e) {
    console.error('[ScriptVault] importFromZip error:', e);
    return { ...results, error: e.message };
  }
}

// ============================================================================
// Message Handlers
// ============================================================================

// Regular message listener (content scripts, popup, dashboard)
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  handleMessage(message, sender)
    .then(sendResponse)
    .catch(e => {
      console.error('[ScriptVault] Unhandled message error:', e);
      sendResponse({ error: e.message });
    });
  return true;
});

// USER_SCRIPT world message listener (for GM_* APIs)
// This is SEPARATE from onMessage and required for messaging: true to work
//
// Security: userscripts are semi-trusted code. Restrict this path to the
// action set the GM_* wrapper actually needs. Without this allowlist a
// malicious userscript could invoke privileged dashboard actions like
// factoryReset, deleteScript, importScripts, or setSettings.
const USER_SCRIPT_ALLOWED_EXTRAS = new Set([
  'netlog_record',
  'reportExecError',
  'reportExecTime'
]);
function isUserScriptAllowedAction(action) {
  if (typeof action !== 'string') return false;
  if (action.startsWith('GM_') || action.startsWith('GM.')) return true;
  return USER_SCRIPT_ALLOWED_EXTRAS.has(action);
}
if (chrome.runtime.onUserScriptMessage) {
  chrome.runtime.onUserScriptMessage.addListener((message, sender, sendResponse) => {
    if (!message || !isUserScriptAllowedAction(message.action)) {
      sendResponse({ error: 'Action not permitted from user script' });
      return false;
    }
    handleMessage(message, sender)
      .then(sendResponse)
      .catch(e => {
        console.error('[ScriptVault] Unhandled user script message error:', e);
        sendResponse({ error: e.message });
      });
    return true;
  });
  debugLog('User script message listener registered');
}

async function handleMessage(message, sender) {
  // Wait for SW init (SettingsManager/ScriptStorage) to finish before handling
  // any message. Without this, fast popup/dashboard opens after wake can hit
  // handlers with uninitialised state and return empty results or throw.
  if (self._initPromise) {
    try { await self._initPromise; } catch (e) { /* init failure is logged in init() */ }
  }
  const { action } = message;
  // Support both patterns: { action, data: { ... } } and { action, prop1, prop2, ... }
  const data = message.data || message;
  
  try {
    switch (action) {
      // Script Management
      case 'getScripts': {
        const scripts = await ScriptStorage.getAll();
        // Convert meta -> metadata for dashboard compatibility
        return { scripts: scripts.map(s => ({ ...s, metadata: s.meta })) };
      }
        
      case 'getScript': {
        const script = await ScriptStorage.get(data.id);
        if (script) {
          return { ...script, metadata: script.meta };
        }
        return null;
      }
        
      case 'saveScript': {
        if (data.code && data.code.length > MAX_SCRIPT_SIZE) {
          return { error: `Script too large (${formatBytes(data.code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.` };
        }
        const parsed = parseUserscript(data.code);
        if (parsed.error) return { error: parsed.error };
        
        const id = data.id || data.scriptId || generateId();
        const existing = await ScriptStorage.get(id);
        
        const scriptSettings = { ...(existing?.settings || {}) };
        delete scriptSettings.mergeConflict;
        // Mark as locally modified when saved from editor — prevents sync from overwriting
        if (data.markModified) scriptSettings.userModified = true;

        const script = {
          ...existing,
          id,
          code: data.code,
          meta: parsed.meta,
          enabled: data.enabled !== undefined ? data.enabled : (existing?.enabled ?? true),
          settings: scriptSettings,
          position: existing?.position ?? (await ScriptStorage.getAll()).length,
          createdAt: existing?.createdAt || Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(id, script);
        await updateBadge();

        // Re-register BEFORE reloading tabs so reloaded pages pick up the new script
        await unregisterScript(id);
        if (script.enabled !== false) {
          await registerScript(script);
        }

        // Live reload takes priority over debounced auto-reload (prevents double reload)
        try {
          const lrData = await chrome.storage.local.get('liveReloadScripts');
          if (lrData.liveReloadScripts?.[id]) {
            // Force reload all matching tabs immediately (new registration already active)
            const allTabs = await chrome.tabs.query({});
            for (const tab of allTabs) {
              if (tab.url && doesScriptMatchUrl(script, tab.url)) {
                try { chrome.tabs.reload(tab.id).catch(() => {}); } catch {}
              }
            }
          } else {
            // Debounced auto-reload for normal saves (gated by settings.autoReload)
            await autoReloadMatchingTabs(script);
          }
        } catch {
          // Fallback: attempt debounced auto-reload if live-reload check failed
          await autoReloadMatchingTabs(script);
        }

        const settings = await SettingsManager.get();
        if (!existing && settings.notifyOnInstall) {
          chrome.notifications.create({
            type: 'basic',
            iconUrl: 'images/icon128.png',
            title: 'Script Installed',
            message: `${script.meta.name} v${script.meta.version}`
          });
        }
        
        // Return with metadata property for dashboard compatibility
        return { success: true, scriptId: id, script: { ...script, metadata: script.meta } };
      }
      
      case 'createScript': {
        // Create a new script - similar to saveScript but always generates new ID
        const parsed = parseUserscript(data.code);
        if (parsed.error) return { error: parsed.error };
        
        const id = generateId();
        const script = {
          id,
          code: data.code,
          meta: parsed.meta,
          enabled: true,
          position: (await ScriptStorage.getAll()).length,
          createdAt: Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(id, script);
        await updateBadge();

        // Register the new script
        await registerScript(script);
        
        const settings = await SettingsManager.get();
        if (settings.notifyOnInstall) {
          chrome.notifications.create({
            type: 'basic',
            iconUrl: 'images/icon128.png',
            title: 'Script Created',
            message: `${script.meta.name} v${script.meta.version}`
          });
        }
        
        // Return scriptId for dashboard compatibility
        return { success: true, scriptId: id, script: { ...script, metadata: script.meta } };
      }
      
      case 'deleteScript': {
        const scriptId = data.id || data.scriptId;
        if (!scriptId) return { error: 'No script ID provided' };
        const script = await ScriptStorage.get(scriptId);
        if (!script) return { error: 'Script not found' };
        const settings = await SettingsManager.get();
        const trashMode = settings.trashMode || '30';

        if (trashMode !== 'disabled') {
          // Move to trash instead of permanent delete
          const trashData = await chrome.storage.local.get('trash');
          const trash = trashData.trash || [];
          trash.push({ ...script, trashedAt: Date.now() });
          await chrome.storage.local.set({ trash });
        }

        await unregisterScript(scriptId);
        await ScriptStorage.delete(scriptId);

        // Clean up menu commands for deleted script
        try {
          const cmdData = await chrome.storage.session.get('menuCommands');
          if (cmdData?.menuCommands?.[scriptId]) {
            delete cmdData.menuCommands[scriptId];
            await chrome.storage.session.set(cmdData);
          }
        } catch {}

        // Record tombstone so sync won't re-import this script from remote
        const tombstoneData = await chrome.storage.local.get('syncTombstones');
        const tombstones = tombstoneData.syncTombstones || {};
        tombstones[scriptId] = Date.now();
        await chrome.storage.local.set({ syncTombstones: tombstones });

        await updateBadge();
        return {
          success: true,
          scriptId,
          scriptName: script.meta?.name || scriptId
        };
      }

      case 'getTrash': {
        const trashData = await chrome.storage.local.get('trash');
        const trash = trashData.trash || [];
        // Clean expired entries
        const settings = await SettingsManager.get();
        const trashMode = settings.trashMode || '30';
        const maxAge = trashMode === '1' ? 86400000 : trashMode === '7' ? 604800000 : trashMode === '30' ? 2592000000 : 0;
        const now = Date.now();
        const valid = maxAge > 0 ? trash.filter(s => now - s.trashedAt < maxAge) : trash;
        if (valid.length !== trash.length) {
          await chrome.storage.local.set({ trash: valid });
        }
        return { trash: valid };
      }

      case 'restoreFromTrash': {
        const scriptId = data.scriptId;
        const trashData = await chrome.storage.local.get('trash');
        const trash = trashData.trash || [];
        const idx = trash.findIndex(s => s.id === scriptId);
        if (idx === -1) return { error: 'Not found in trash' };

        const script = trash[idx];
        delete script.trashedAt;
        trash.splice(idx, 1);
        await chrome.storage.local.set({ trash });
        await ScriptStorage.set(script.id, script);
        if (script.enabled !== false) await registerScript(script);
        await updateBadge();
        return { success: true };
      }

      case 'emptyTrash': {
        await chrome.storage.local.set({ trash: [] });
        return { success: true };
      }

      case 'restart': {
        chrome.runtime.reload();
        return { success: true };
      }

      case 'permanentlyDelete': {
        const scriptId = data.scriptId;
        const trashData = await chrome.storage.local.get('trash');
        const trash = trashData.trash || [];
        const filtered = trash.filter(s => s.id !== scriptId);
        await chrome.storage.local.set({ trash: filtered });
        return { success: true };
      }
        
      case 'toggleScript': {
        const scriptId = data.id || data.scriptId;
        // Per-script chained lock to prevent rapid toggle race conditions
        // Each toggle chains onto the previous one, ensuring serial execution
        if (!self._toggleLocks) self._toggleLocks = new Map();
        const prev = self._toggleLocks.get(scriptId) || Promise.resolve();
        const togglePromise = prev.then(async () => {
          const script = await ScriptStorage.get(scriptId);
          if (!script) {
            return { error: 'Script not found' };
          }

          script.enabled = data.enabled !== undefined ? !!data.enabled : !script.enabled;
          script.updatedAt = Date.now();
          await ScriptStorage.set(scriptId, script);

          await unregisterScript(scriptId);
          if (script.enabled) {
            await registerScript(script);
          }

          await updateBadge();

          try {
            const tabs = await chrome.tabs.query({});
            for (const tab of tabs) {
              if (tab.url && doesScriptMatchUrl(script, tab.url)) {
                chrome.tabs.reload(tab.id).catch(() => {});
              }
            }
          } catch (e) {
            debugLog('Toggle reload failed:', e.message);
          }

          return {
            success: true,
            script: {
              id: script.id,
              enabled: script.enabled
            }
          };
        }).catch(e => {
          debugLog('Toggle error:', e);
          return { error: e?.message || 'Failed to update script' };
        }).finally(() => {
          // Clean up if this is still the latest promise (not superseded by a newer toggle)
          if (self._toggleLocks.get(scriptId) === togglePromise) {
            self._toggleLocks.delete(scriptId);
          }
        });
        self._toggleLocks.set(scriptId, togglePromise);
        return await togglePromise;
      }

      case 'importScript': {
        const parsed = parseUserscript(data.code);
        if (parsed.error) return { error: parsed.error };
        
        const id = generateId();
        const script = {
          id,
          code: data.code,
          meta: parsed.meta,
          enabled: true,
          position: (await ScriptStorage.getAll()).length,
          createdAt: Date.now(),
          updatedAt: Date.now()
        };
        
        await ScriptStorage.set(id, script);
        await registerScript(script);
        await updateBadge();
        // Return with metadata property for dashboard compatibility
        return { success: true, script: { ...script, metadata: script.meta } };
      }

      case 'duplicateScript': {
        const newScript = await ScriptStorage.duplicate(data.id);
        if (newScript) {
          // Honor the duplicated script's `enabled` state — duplicating a disabled
          // script was silently re-enabling it because register was unconditional.
          if (newScript.enabled !== false) {
            await registerScript(newScript);
          }
          await updateBadge();
          // Return with metadata property for dashboard compatibility
          return { success: true, script: { ...newScript, metadata: newScript.meta } };
        }
        return { error: 'Script not found' };
      }
      
      case 'searchScripts': {
        const scripts = await ScriptStorage.search(data.query);
        return { scripts: scripts.map(s => ({ ...s, metadata: s.meta })) };
      }
        
      case 'reorderScripts':
        await ScriptStorage.reorder(data.orderedIds);
        return { success: true };
        
      // Script Values
      case 'GM_getValue':
        return await ScriptValues.get(data.scriptId, data.key, data.defaultValue);
        
      case 'GM_setValue':
        return await ScriptValues.set(data.scriptId, data.key, data.value, sender.tab?.id ?? null);
        
      case 'GM_deleteValue':
        await ScriptValues.delete(data.scriptId, data.key, sender.tab?.id ?? null);
        return { success: true };

      case 'deleteScriptValue':
        await ScriptValues.delete(data.scriptId, data.key);
        return { success: true };
        
      case 'GM_listValues':
        return await ScriptValues.list(data.scriptId);
        
      case 'GM_getValues':
        return await ScriptValues.getAll(data.scriptId);
        
      case 'GM_setValues':
        await ScriptValues.setAll(data.scriptId, data.values, sender.tab?.id ?? null);
        return { success: true };
        
      case 'GM_deleteValues':
        await ScriptValues.deleteMultiple(data.scriptId, data.keys, sender.tab?.id ?? null);
        return { success: true };
        
      case 'getScriptStorage':
      case 'getScriptValues': {
        const values = await ScriptValues.getAll(data.scriptId);
        return { values };
      }
        
      case 'setScriptStorage':
        await ScriptValues.setAll(data.scriptId, data.values);
        return { success: true };
        
      case 'getStorageSize':
        return await ScriptValues.getStorageSize(data.scriptId);
        
      // Tab Storage
      case 'GM_getTab':
        if (!sender.tab?.id) return {};
        return TabStorage.get(sender.tab.id);
        
      case 'GM_saveTab':
        if (!sender.tab?.id) return { error: 'GM_saveTab requires a tab context' };
        TabStorage.set(sender.tab.id, data.data);
        return { success: true };
        
      case 'GM_getTabs':
        return TabStorage.getAll();
        
      // Settings
      case 'prefetchResources': {
        await ResourceCache.prefetchResources(data.resources);
        return { success: true };
      }

      case 'getSettings': {
        const settings = await SettingsManager.get();
        return { settings };
      }

      case 'getExtensionStatus': {
        const ver = _getChromeVersion();
        // Live probe — the cached flag in settings can drift after the user
        // toggles "Allow User Scripts" in chrome://extensions because Chrome
        // doesn't always cycle the SW. Trust the runtime check, then refresh
        // the cache so other paths agree.
        let userScriptsAvailable = !!chrome.userScripts;
        if (userScriptsAvailable) {
          try {
            await chrome.userScripts.getScripts();
          } catch (e) {
            userScriptsAvailable = false;
          }
        }
        if (userScriptsAvailable) {
          await SettingsManager.set({ _userScriptsAvailable: true, _chromeVersion: ver });
          // The toggle may have flipped on while the SW was already running —
          // configure the world now so script registration works on next save.
          try { await configureUserScriptsWorld(); } catch (e) {}
        } else {
          await SettingsManager.set({ _userScriptsAvailable: false, _chromeVersion: ver });
        }
        let setupRequired = false;
        let setupMessage = '';
        if (!userScriptsAvailable) {
          setupRequired = true;
          if (ver >= 138) {
            setupMessage = 'Enable "Allow User Scripts" for ScriptVault in chrome://extensions';
          } else if (ver >= 120) {
            setupMessage = 'Enable Developer Mode in chrome://extensions to run userscripts';
          } else {
            setupMessage = 'Chrome 120 or newer is required';
          }
        }
        return { userScriptsAvailable, setupRequired, setupMessage, chromeVersion: ver };
      }

      case 'repairRuntimeState': {
        try {
          await configureUserScriptsWorld();
          await setupContextMenus();
          await registerAllScripts(true);
          await updateBadge();
          await setupAlarms();

          const settings = await SettingsManager.get();
          const ver = settings._chromeVersion || _getChromeVersion();
          const userScriptsAvailable = settings._userScriptsAvailable !== false && !!chrome.userScripts;
          let setupRequired = false;
          let setupMessage = '';
          if (!userScriptsAvailable) {
            setupRequired = true;
            if (ver >= 138) {
              setupMessage = 'Enable "Allow User Scripts" for ScriptVault in chrome://extensions';
            } else if (ver >= 120) {
              setupMessage = 'Enable Developer Mode in chrome://extensions to run userscripts';
            } else {
              setupMessage = 'Chrome 120 or newer is required';
            }
          }
          return { success: true, userScriptsAvailable, setupRequired, setupMessage, chromeVersion: ver };
        } catch (error) {
          return { success: false, error: error?.message || 'Runtime repair failed' };
        }
      }
        
      case 'getSetting':
        return await SettingsManager.get(data.key);
        
      case 'setSettings': {
        const oldSettings = await SettingsManager.get();
        const result = await SettingsManager.set(data.settings);
        const changed = data.settings;

        // If global enabled state changed, re-register all scripts
        if ('enabled' in changed && changed.enabled !== oldSettings.enabled) {
          await registerAllScripts(true);
        }

        // If update/sync intervals changed, reconfigure alarms
        if ('checkInterval' in changed || 'autoUpdate' in changed ||
            'syncEnabled' in changed || 'syncProvider' in changed || 'syncInterval' in changed) {
          await setupAlarms();
        }

        // If badge settings changed, refresh badge
        if ('badgeColor' in changed || 'badgeInfo' in changed || 'showBadge' in changed) {
          await updateBadge();
        }

        // If context menu setting changed, rebuild menus
        if ('enableContextMenu' in changed) {
          await setupContextMenus();
        }

        // If page filter settings changed, re-register scripts
        if ('pageFilterMode' in changed || 'whitelistedPages' in changed ||
            'blacklistedPages' in changed || 'deniedHosts' in changed) {
          await registerAllScripts(true);
        }

        return result;
      }
        
      case 'resetSettings':
        return await SettingsManager.reset();
        
      // Updates
      case 'checkUpdates':
        return await UpdateSystem.checkForUpdates(data?.scriptId);

      case 'forceUpdate': {
        // Force re-download bypassing HTTP cache
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (!script) return { error: 'Script not found' };
        const downloadUrl = script.meta.downloadURL || script.meta.updateURL;
        if (!downloadUrl) return { error: 'No download URL configured' };
        try {
          const response = await fetch(downloadUrl, {
            cache: 'no-store',
            headers: { 'Cache-Control': 'no-cache', 'Pragma': 'no-cache' }
          });
          if (!response.ok) return { error: `HTTP ${response.status}` };
          const newCode = await response.text();
          const parsed = parseUserscript(newCode);
          if (parsed.error) return parsed;
          // Apply as update (force=true bypasses userModified guard)
          return await UpdateSystem.applyUpdate(scriptId, newCode, { force: true });
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'applyUpdate':
        return await UpdateSystem.applyUpdate(data.scriptId, data.code);

      case 'getVersionHistory': {
        const script = await ScriptStorage.get(data.scriptId);
        return { history: script?.versionHistory || [] };
      }

      case 'rollbackScript': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };
        if (!script.versionHistory || script.versionHistory.length === 0) {
          return { error: 'No version history available' };
        }
        const targetIdx = data.index !== undefined ? data.index : script.versionHistory.length - 1;
        const target = script.versionHistory[targetIdx];
        if (!target) return { error: 'Version not found' };

        const parsed = parseUserscript(target.code);
        if (parsed.error) return parsed;

        // Save current version before rolling back (so user can undo the rollback)
        script.versionHistory.push({
          version: script.meta.version,
          code: script.code,
          updatedAt: script.updatedAt || Date.now()
        });
        // Remove the target entry we're rolling back to (prevents duplicates)
        script.versionHistory.splice(targetIdx, 1);
        // Trim to last 5 versions
        if (script.versionHistory.length > 5) {
          script.versionHistory = script.versionHistory.slice(-5);
        }

        script.code = target.code;
        script.meta = parsed.meta;
        script.updatedAt = Date.now();

        await ScriptStorage.set(data.scriptId, script);
        await unregisterScript(data.scriptId);
        if (script.enabled !== false) {
          await registerScript(script);
        }
        return { success: true, script: { ...script, metadata: script.meta } };
      }

      // Sync
      case 'sync':
        return await CloudSync.sync();
        
      case 'testSync': {
        const settings = await SettingsManager.get();
        const provider = CloudSync.providers[settings.syncProvider];
        if (provider) {
          return await provider.test(settings);
        }
        return false;
      }
      
      // Cloud Sync Provider Management
      case 'connectSyncProvider': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider' };
        
        try {
          const settings = await SettingsManager.get();
          const result = await provider.connect(settings);
          
          if (result.success) {
            const updates = {};
            if (providerName === 'googledrive') {
              updates.googleDriveConnected = true;
              updates.googleDriveUser = result.user;
            } else if (providerName === 'dropbox') {
              updates.dropboxToken = result.token;
              updates.dropboxRefreshToken = result.refreshToken || '';
              if (result.user) updates.dropboxUser = result.user;
              // Fetch user info after connecting
              const status = await provider.getStatus({ dropboxToken: result.token });
              if (status.user) updates.dropboxUser = status.user;
            }
            updates.syncProvider = providerName;
            await SettingsManager.set(updates);
          }
          return result;
        } catch (e) {
          return { success: false, error: e.message };
        }
      }
      
      case 'disconnectSyncProvider': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider' };
        
        try {
          const settings = await SettingsManager.get();
          await provider.disconnect(settings);
          
          const updates = { syncProvider: 'none' };
          if (providerName === 'googledrive') {
            updates.googleDriveConnected = false;
            updates.googleDriveUser = null;
          } else if (providerName === 'dropbox') {
            updates.dropboxToken = '';
            updates.dropboxRefreshToken = '';
            updates.dropboxUser = null;
          } else if (providerName === 'onedrive') {
            updates.onedriveToken = '';
            updates.onedriveRefreshToken = '';
            updates.onedriveConnected = false;
            updates.onedriveUser = null;
          }
          await SettingsManager.set(updates);
          return { success: true };
        } catch (e) {
          return { success: false, error: e.message };
        }
      }
      
      case 'getSyncProviderStatus': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { connected: false };
        
        const settings = await SettingsManager.get();
        if (provider.getStatus) {
          return await provider.getStatus(settings);
        }
        return { connected: false };
      }
      
      case 'syncNow': {
        return await CloudSync.sync();
      }

      case 'cloudExport': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider: ' + providerName };

        try {
          const includeSettings = data?.includeSettings !== false;
          const includeStorage = data?.includeStorage !== false;
          const exportData = await exportAllScripts({ includeSettings, includeStorage });
          const settings = await SettingsManager.get();
          await provider.upload(exportData, settings);
          return {
            success: true,
            exported: exportData.scripts?.length || 0,
            settingsIncluded: includeSettings,
            storageIncluded: includeStorage
          };
        } catch (e) {
          return { success: false, error: e.message };
        }
      }

      case 'cloudImport': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { success: false, error: 'Unknown provider: ' + providerName };

        try {
          const settings = await SettingsManager.get();
          const remoteData = await provider.download(settings);
          if (!remoteData) return { success: false, error: 'No backup found on ' + providerName };
          const result = await importScripts(remoteData, {
            overwrite: true,
            importSettings: data?.importSettings === true,
            importStorage: data?.importStorage !== false
          });
          return { success: !result.error, ...result };
        } catch (e) {
          return { success: false, error: e.message };
        }
      }

      case 'cloudStatus': {
        const providerName = data.provider;
        const provider = CloudSyncProviders[providerName];
        if (!provider) return { connected: false };

        try {
          const settings = await SettingsManager.get();
          if (provider.getStatus) return await provider.getStatus(settings);
          return { connected: false };
        } catch (e) {
          return { connected: false, error: e.message };
        }
      }

      // Values Editor - Get all scripts' values
      case 'getAllScriptsValues': {
        const scripts = await ScriptStorage.getAll();
        const allValuesResults = await Promise.all(scripts.map(s => ScriptValues.getAll(s.id)));
        const allValues = {};
        scripts.forEach((script, i) => {
          const values = allValuesResults[i];
          if (values && Object.keys(values).length > 0) {
            allValues[script.id] = {
              scriptName: script.meta?.name || 'Unknown Script',
              values
            };
          }
        });
        return { allValues };
      }
      
      // Values Editor - Set a single value
      case 'setScriptValue': {
        await ScriptValues.set(data.scriptId, data.key, data.value);
        return { success: true };
      }
      
      // Values Editor - Clear all values for a script
      case 'clearScriptStorage': {
        await ScriptValues.deleteAll(data.scriptId);
        return { success: true };
      }

      // Values Editor - Rename a key
      case 'renameScriptValue': {
        const { scriptId, oldKey, newKey } = data;
        if (!scriptId || !oldKey || !newKey || oldKey === newKey) return { error: 'Invalid rename parameters' };
        const current = await ScriptValues.get(scriptId, oldKey);
        if (current === undefined) return { error: 'Key not found' };
        const existingNew = await ScriptValues.get(scriptId, newKey);
        if (existingNew !== undefined) return { error: `Key "${newKey}" already exists` };
        await ScriptValues.set(scriptId, newKey, current);
        await ScriptValues.delete(scriptId, oldKey);
        return { success: true };
      }
      
      // Per-Script Settings
      case 'getScriptSettings': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };
        return { settings: script.settings || {} };
      }
      
      case 'setScriptSettings': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };

        const oldSettings = script.settings || {};
        const oldEnabled = script.enabled;
        script.settings = { ...oldSettings, ...data.settings };
        script.updatedAt = Date.now();

        // Handle enabled change BEFORE saving (from sidepanel toggle)
        if ('enabled' in data.settings) {
          script.enabled = !!data.settings.enabled;
        }

        // Persist ALL changes including enabled state
        await ScriptStorage.set(data.scriptId, script);

        // If enabled state changed, re-register and reload tabs
        if ('enabled' in data.settings && script.enabled !== oldEnabled) {
          await unregisterScript(data.scriptId);
          if (script.enabled) {
            await registerScript(script);
          }
          await updateBadge();
          try {
            const tabs = await chrome.tabs.query({});
            for (const tab of tabs) {
              if (tab.url && doesScriptMatchUrl(script, tab.url)) {
                chrome.tabs.reload(tab.id).catch(() => {});
              }
            }
          } catch {}
          return { success: true };
        }

        // Only re-register if execution-affecting settings changed.
        // Guard with `k in data.settings` — otherwise comparing `oldSettings[k]`
        // against `undefined` (from an unrelated partial update) triggers a needless
        // re-register cycle every time any other setting is changed.
        const EXEC_KEYS = ['runAt', 'injectInto', 'useOriginalMatches', 'useOriginalIncludes',
                           'useOriginalExcludes', 'userMatches', 'userIncludes', 'userExcludes'];
        const needsReregister = EXEC_KEYS.some(k =>
          k in data.settings &&
          JSON.stringify(oldSettings[k]) !== JSON.stringify(data.settings[k])
        );
        if (needsReregister && script.enabled !== false) {
          await unregisterScript(data.scriptId);
          await registerScript(script);
        }

        return { success: true };
      }
      
      // Import/Export
      case 'exportAll':
        return await exportAllScripts(data?.options || {});
        
      case 'importAll':
        return await importScripts(data.data, data.options);

      case 'importTampermonkeyBackup': {
        // Parse Tampermonkey .txt backup format
        // Format: multiple scripts separated by blank lines, each with ==UserScript== blocks
        const text = data.text || '';
        const scriptBlocks = [];
        // Split on double newlines that precede ==UserScript== headers
        const parts = text.split(/\n\s*\n(?=\/\/\s*==UserScript==)/);
        for (const part of parts) {
          const trimmed = part.trim();
          if (trimmed.includes('==UserScript==') && trimmed.includes('==/UserScript==')) {
            scriptBlocks.push(trimmed);
          }
        }
        if (scriptBlocks.length === 0) {
          return { error: 'No valid userscripts found in backup file' };
        }
        const results = { imported: 0, skipped: 0, errors: [] };
        const allExisting = await ScriptStorage.getAll();
        let nextPosition = allExisting.length;
        for (const code of scriptBlocks) {
          try {
            const parsed = parseUserscript(code);
            if (parsed.error) { results.errors.push({ error: parsed.error }); continue; }
            const existing = allExisting.find(s =>
              s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
            );
            if (existing && !data.overwrite) { results.skipped++; continue; }
            const id = existing?.id || generateId();
            await ScriptStorage.set(id, {
              id, code, meta: parsed.meta,
              enabled: true,
              position: existing?.position ?? nextPosition++,
              createdAt: existing?.createdAt || Date.now(),
              updatedAt: Date.now()
            });
            results.imported++;
          } catch (e) {
            results.errors.push({ error: e.message });
          }
        }
        await registerAllScripts(true);
        await updateBadge();
        return results;
      }

      // v2.0: Storage Quota
      case 'getStorageUsage': {
        if (typeof QuotaManager !== 'undefined') return await QuotaManager.getUsage();
        return { bytesUsed: 0, quota: 10485760, percentage: 0, level: 'ok' };
      }
      case 'getStorageBreakdown': {
        if (typeof QuotaManager !== 'undefined') return await QuotaManager.getBreakdown();
        return {};
      }
      case 'cleanupStorage': {
        if (typeof QuotaManager !== 'undefined') return await QuotaManager.cleanup(data.options || {});
        return { freedBytes: 0, actions: [] };
      }

      // v2.0: Backup Scheduler
      case 'createBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.createBackup(data.reason || 'manual');
        return { error: 'BackupScheduler not available' };
      }
      case 'getBackups': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.getBackups();
        return { backups: [] };
      }
      case 'restoreBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.restoreBackup(data.backupId, data.options);
        return { error: 'BackupScheduler not available' };
      }
      case 'deleteBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.deleteBackup(data.backupId);
        return { error: 'BackupScheduler not available' };
      }
      case 'importBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.importBackup(data.zipData);
        return { error: 'BackupScheduler not available' };
      }
      case 'exportBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.exportBackup(data.backupId);
        return { error: 'BackupScheduler not available' };
      }
      case 'inspectBackup': {
        if (typeof BackupScheduler !== 'undefined') return await BackupScheduler.inspectBackup(data.backupId);
        return { error: 'BackupScheduler not available' };
      }
      case 'getBackupSettings': {
        if (typeof BackupScheduler !== 'undefined') return BackupScheduler.getSettings();
        return {};
      }
      case 'setBackupSettings': {
        if (typeof BackupScheduler !== 'undefined') {
          const settings = await BackupScheduler.setSettings(data.settings);
          return { success: true, settings };
        }
        return { error: 'BackupScheduler not available' };
      }

      // v2.0: Script Analytics
      // v2.0: Profiles
      case 'getProfiles': {
        const pData = await chrome.storage.local.get(['profiles', 'activeProfileId']);
        return { profiles: pData.profiles || [], activeProfileId: pData.activeProfileId || null };
      }
      case 'switchProfile': {
        const pData2 = await chrome.storage.local.get('profiles');
        const profiles = pData2.profiles || [];
        const profile = profiles.find(p => p.id === data.profileId);
        if (!profile) return { error: 'Profile not found' };
        // Apply script states from profile (parallel writes)
        const scripts = await ScriptStorage.getAll();
        const updates = [];
        for (const script of scripts) {
          const newEnabled = profile.scriptStates?.[script.id] ?? script.enabled;
          if (script.enabled !== newEnabled) {
            script.enabled = newEnabled;
            updates.push(ScriptStorage.set(script.id, script));
          }
        }
        if (updates.length) await Promise.all(updates);
        await chrome.storage.local.set({ activeProfileId: data.profileId });
        await registerAllScripts(true);
        await updateBadge();
        return { success: true };
      }
      case 'saveProfile': {
        const pData3 = await chrome.storage.local.get('profiles');
        const profiles3 = pData3.profiles || [];
        const idx = profiles3.findIndex(p => p.id === data.profile.id);
        if (idx >= 0) profiles3[idx] = data.profile;
        else profiles3.push(data.profile);
        await chrome.storage.local.set({ profiles: profiles3 });
        return { success: true };
      }
      case 'deleteProfile': {
        const pData4 = await chrome.storage.local.get(['profiles', 'activeProfileId']);
        const profiles4 = (pData4.profiles || []).filter(p => p.id !== data.profileId);
        const updates = { profiles: profiles4 };
        if (pData4.activeProfileId === data.profileId) updates.activeProfileId = null;
        await chrome.storage.local.set(updates);
        return { success: true };
      }

      // v2.0: Collections
      case 'getCollections': {
        const cData = await chrome.storage.local.get('scriptCollections');
        return { collections: cData.scriptCollections || [] };
      }
      case 'saveCollection': {
        const cData2 = await chrome.storage.local.get('scriptCollections');
        const collections = cData2.scriptCollections || [];
        const cidx = collections.findIndex(c => c.id === data.collection.id);
        if (cidx >= 0) collections[cidx] = data.collection;
        else collections.push(data.collection);
        await chrome.storage.local.set({ scriptCollections: collections });
        return { success: true };
      }
      case 'deleteCollection': {
        const cData3 = await chrome.storage.local.get('scriptCollections');
        const collections3 = (cData3.scriptCollections || []).filter(c => c.id !== data.collectionId);
        await chrome.storage.local.set({ scriptCollections: collections3 });
        return { success: true };
      }

      // v2.0: CSP Reports
      case 'reportCSPFailure': {
        const cspData = await chrome.storage.local.get('cspReports');
        let reports = cspData.cspReports || [];
        reports.push({ url: data.url, scriptId: data.scriptId, directive: data.directive, timestamp: Date.now() });
        // Keep last 500 reports (slice is cheaper than splice-from-head)
        if (reports.length > 510) reports = reports.slice(-500);
        await chrome.storage.local.set({ cspReports: reports });
        return { success: true };
      }
      case 'getCSPReports': {
        const cspData2 = await chrome.storage.local.get('cspReports');
        return { reports: cspData2.cspReports || [] };
      }

      // v2.0: Gist Integration
      case 'getGistSettings': {
        const gData = await chrome.storage.local.get('gistSettings');
        return gData.gistSettings || {};
      }
      case 'saveGistSettings': {
        await chrome.storage.local.set({ gistSettings: data.settings });
        return { success: true };
      }

      // v2.0: Violentmonkey backup import
      case 'importViolentmonkeyBackup': {
        // VM exports as ZIP containing individual .user.js files + a violentmonkey JSON
        // Or as individual .user.js files pasted as text
        const text = data.text || '';
        const results = { imported: 0, skipped: 0, errors: [] };

        // Try JSON format first (VM settings export)
        try {
          const vmData = JSON.parse(text);
          if (vmData.scripts && Array.isArray(vmData.scripts)) {
            const allExistingVM = await ScriptStorage.getAll();
            let nextPosVM = allExistingVM.length;
            for (const vmScript of vmData.scripts) {
              try {
                const code = vmScript.code || vmScript.custom?.code || '';
                if (!code) { results.skipped++; continue; }
                const parsed = parseUserscript(code);
                if (parsed.error) { results.errors.push({ name: vmScript.props?.name, error: parsed.error }); continue; }
                const existing = allExistingVM.find(s =>
                  s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
                );
                if (existing && !data.overwrite) { results.skipped++; continue; }
                const id = existing?.id || generateId();
                await ScriptStorage.set(id, {
                  id, code, meta: parsed.meta,
                  enabled: vmScript.config?.enabled !== false,
                  position: existing?.position ?? nextPosVM++,
                  createdAt: existing?.createdAt || Date.now(),
                  updatedAt: Date.now()
                });
                results.imported++;
              } catch (e) {
                results.errors.push({ error: e.message });
              }
            }
            await registerAllScripts(true);
            await updateBadge();
            return results;
          }
        } catch { /* Not JSON — try text format */ }

        // Fallback: same as Tampermonkey text format
        const allExistingVMFB = await ScriptStorage.getAll();
        let nextPosVMFB = allExistingVMFB.length;
        const parts = text.split(/\n\s*\n(?=\/\/\s*==UserScript==)/);
        for (const part of parts) {
          const trimmed = part.trim();
          if (trimmed.includes('==UserScript==') && trimmed.includes('==/UserScript==')) {
            try {
              const parsed = parseUserscript(trimmed);
              if (parsed.error) { results.errors.push({ error: parsed.error }); continue; }
              const existing = allExistingVMFB.find(s =>
                s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
              );
              if (existing && !data.overwrite) { results.skipped++; continue; }
              const id = existing?.id || generateId();
              await ScriptStorage.set(id, {
                id, code: trimmed, meta: parsed.meta,
                enabled: true,
                position: existing?.position ?? nextPosVMFB++,
                createdAt: existing?.createdAt || Date.now(),
                updatedAt: Date.now()
              });
              results.imported++;
            } catch (e) {
              results.errors.push({ error: e.message });
            }
          }
        }
        await registerAllScripts(true);
        await updateBadge();
        return results;
      }

      // v2.0: Greasemonkey backup import (GM4 JSON format)
      case 'importGreasemonkeyBackup': {
        const text = data.text || '';
        const results = { imported: 0, skipped: 0, errors: [] };
        try {
          const gmData = JSON.parse(text);
          // GM4 exports as array of script objects
          const scripts = Array.isArray(gmData) ? gmData : (gmData.scripts || []);
          const allExistingGM = await ScriptStorage.getAll();
          let nextPosGM = allExistingGM.length;
          for (const gmScript of scripts) {
            try {
              const code = gmScript.source || gmScript.code || gmScript.content || '';
              if (!code) { results.skipped++; continue; }
              const parsed = parseUserscript(code);
              if (parsed.error) { results.errors.push({ name: gmScript.name, error: parsed.error }); continue; }
              const existing = allExistingGM.find(s =>
                s.meta.name === parsed.meta.name && s.meta.namespace === parsed.meta.namespace
              );
              if (existing && !data.overwrite) { results.skipped++; continue; }
              const id = existing?.id || generateId();
              await ScriptStorage.set(id, {
                id, code, meta: parsed.meta,
                enabled: gmScript.enabled !== false,
                position: existing?.position ?? nextPosGM++,
                createdAt: existing?.createdAt || Date.now(),
                updatedAt: Date.now()
              });
              results.imported++;
            } catch (e) {
              results.errors.push({ error: e.message });
            }
          }
        } catch (e) {
          return { error: 'Invalid Greasemonkey backup format: ' + e.message };
        }
        await registerAllScripts(true);
        await updateBadge();
        return results;
      }

      case 'exportZip':
        return await exportToZip(data?.options || {});

      // Folders
      // Workspaces
      case 'getWorkspaces':
        return await WorkspaceManager.getAll();

      case 'createWorkspace':
        return { workspace: await WorkspaceManager.create(data.name) };

      case 'saveWorkspace': {
        const workspace = await WorkspaceManager.save(data.id);
        return workspace
          ? { success: true, workspace }
          : { error: 'Workspace not found' };
      }

      case 'activateWorkspace':
        return await WorkspaceManager.activate(data.id);

      case 'updateWorkspace':
        return { workspace: await WorkspaceManager.update(data.id, data.updates) };

      case 'deleteWorkspace': {
        const workspace = await WorkspaceManager.delete(data.id);
        return workspace
          ? { success: true, workspace }
          : { error: 'Workspace not found' };
      }

      // Network Log — returns flat array (limit optional) + stats
      case 'getNetworkLog': {
        const filters = typeof data === 'object' && data ? data : {};
        const log = NetworkLog.getAll(filters);
        const stats = NetworkLog.getStats();
        // Support both flat-array callers (DevTools) and object callers (dashboard)
        return log; // stats available via getNetworkLogStats
      }

      case 'getNetworkLogStats':
        return NetworkLog.getStats();

      case 'clearNetworkLog':
        NetworkLog.clear(data?.scriptId);
        return { success: true };

      // Record a network request from the in-page proxy (fetch/XHR/WebSocket/sendBeacon)
      case 'netlog_record':
        NetworkLog.add({
          method: data.method || 'GET',
          url: data.url || '',
          status: data.status,
          statusText: data.statusText,
          duration: data.duration,
          responseSize: data.responseSize,
          responseHeaders: data.responseHeaders,
          scriptId: data.scriptId,
          scriptName: data.scriptName,
          error: data.error,
          type: data.type || 'fetch'
        });
        return { ok: true };

      // Static Analysis — routes through offscreen document for AST analysis
      case 'analyzeScript': {
        const code = data.code || '';
        return ScriptAnalyzer.analyzeAsync(code);
      }

      // ── Script Signing (Ed25519) ──────────────────────────────────────────
      case 'signing_getPublicKey':
        return { publicKey: await ScriptSigning.getPublicKeyJwk() };

      case 'signing_sign': {
        if (!data.code) return { error: 'No code provided' };
        return ScriptSigning.signAndEmbedInCode(data.code);
      }

      case 'signing_verify': {
        if (!data.code) return { error: 'No code provided' };
        return ScriptSigning.verifyCodeSignature(data.code);
      }

      case 'signing_verifyRaw': {
        if (!data.code || !data.signatureInfo) return { error: 'Missing inputs' };
        return ScriptSigning.verifyScript(data.code, data.signatureInfo);
      }

      case 'signing_trustKey': {
        if (!data.publicKey) return { error: 'No public key' };
        return ScriptSigning.trustKey(data.publicKey, data.name);
      }

      case 'signing_untrustKey': {
        if (!data.publicKey) return { error: 'No public key' };
        return ScriptSigning.untrustKey(data.publicKey);
      }

      case 'signing_getTrustedKeys':
        return { keys: await ScriptSigning.getTrustedKeys() };

      case 'publicApi_getTrustedOrigins':
        if (typeof PublicAPI === 'undefined') return { origins: [] };
        return { origins: PublicAPI.getTrustedOrigins() };

      case 'publicApi_setTrustedOrigins':
        if (typeof PublicAPI === 'undefined') return { error: 'Public API controls unavailable' };
        await PublicAPI.setTrustedOrigins(Array.isArray(data.origins) ? data.origins : []);
        return { success: true, origins: PublicAPI.getTrustedOrigins() };

      case 'publicApi_getPermissions':
        if (typeof PublicAPI === 'undefined') return { permissions: {} };
        return { permissions: PublicAPI.getPermissions() };

      case 'publicApi_getAuditLog':
        if (typeof PublicAPI === 'undefined') return { entries: [] };
        return { entries: PublicAPI.getAuditLog(data.limit || 50) };

      case 'publicApi_clearAuditLog':
        if (typeof PublicAPI === 'undefined') return { error: 'Public API controls unavailable' };
        await PublicAPI.clearAuditLog();
        return { success: true };

      case 'signing_generateNewKeypair':
        return ScriptSigning.generateAndStoreKeypair();

      case 'getFolders':
        return { folders: await FolderStorage.getAll() };

      case 'createFolder':
        return { folder: await FolderStorage.create(data.name, data.color) };

      case 'updateFolder':
        return { folder: await FolderStorage.update(data.id, data.updates) };

      case 'deleteFolder':
        await FolderStorage.delete(data.id);
        return { success: true };

      case 'addScriptToFolder':
        await FolderStorage.addScript(data.folderId, data.scriptId);
        return { success: true };

      case 'removeScriptFromFolder':
        await FolderStorage.removeScript(data.folderId, data.scriptId);
        return { success: true };

      case 'moveScriptToFolder':
        await FolderStorage.moveScript(data.scriptId, data.fromFolderId, data.toFolderId);
        return { success: true };

      case 'importFromZip':
        return await importFromZip(data.zipData, data.options || {});
      
      case 'installFromUrl':
        return await installFromUrl(data.url);
        
      // Resources
      case 'fetchResource':
        return await ResourceCache.fetchResource(data.url);

      case 'GM_getResourceText': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script || !script.meta.resource) return null;
        const url = script.meta.resource[data.name];
        if (!url) return null;
        try {
          return await ResourceCache.fetchResource(url);
        } catch (e) {
          return null;
        }
      }

      case 'GM_getResourceURL': {
        const script2 = await ScriptStorage.get(data.scriptId);
        if (!script2 || !script2.meta.resource) return null;
        const url2 = script2.meta.resource[data.name];
        if (!url2) return null;
        try {
          return await ResourceCache.getDataUri(url2);
        } catch (e) {
          return null;
        }
      }

      // GM_loadScript - Fetch a script URL and return its source code
      // Allows userscripts to dynamically load libraries at runtime
      case 'GM_loadScript': {
        try {
          if (!data.url) return { error: 'No URL provided' };
          // Enforce @connect for GM_loadScript (same rules as GM_xmlhttpRequest)
          if (data.scriptId) {
            const lsScript = await ScriptStorage.get(data.scriptId);
            if (lsScript && lsScript.meta.connect && lsScript.meta.connect.length > 0) {
              const lsConnectList = lsScript.meta.connect;
              if (!lsConnectList.includes('*')) {
                try {
                  const lsHostname = new URL(data.url).hostname;
                  const lsAllowed = lsConnectList.some(p => {
                    if (p === 'self') {
                      const mDomains = (lsScript.meta.match || []).map(m => {
                        try { return new URL(m.replace(/\*/g, 'x')).hostname.replace(/^x\./, ''); } catch { return null; }
                      }).filter(Boolean);
                      return mDomains.some(d => lsHostname === d || lsHostname.endsWith('.' + d));
                    }
                    if (p === 'localhost') return lsHostname === 'localhost' || lsHostname === '127.0.0.1' || lsHostname === '::1';
                    return lsHostname === p || lsHostname.endsWith('.' + p);
                  });
                  if (!lsAllowed) return { error: `Connection to ${lsHostname} blocked by @connect policy` };
                } catch (e) {}
              }
            }
          }
          const controller = new AbortController();
          const timeoutId = setTimeout(() => controller.abort(), data.timeout || 30000);
          const response = await fetch(data.url, { signal: controller.signal });
          clearTimeout(timeoutId);
          if (!response.ok) return { error: `HTTP ${response.status}` };
          const code = await response.text();
          if (!code || code.length === 0) return { error: 'Empty response' };
          return { code };
        } catch (e) {
          return { error: e.message || 'Fetch failed' };
        }
      }

      // XHR - Using fetch() since XMLHttpRequest is not available in Service Workers
      // Provides abort support via AbortController and simulates events
      case 'GM_xmlhttpRequest': {
        try {
          if (!data.url) {
            return { error: 'No URL provided', type: 'error' };
          }

          // @connect enforcement
          if (data.scriptId) {
            const xhrScript = await ScriptStorage.get(data.scriptId);
            if (xhrScript && xhrScript.meta.connect && xhrScript.meta.connect.length > 0) {
              const connectList = xhrScript.meta.connect;
              const hasWildcard = connectList.includes('*');
              if (!hasWildcard) {
                try {
                  const reqUrl = new URL(data.url);
                  const hostname = reqUrl.hostname;
                  const isAllowed = connectList.some(pattern => {
                    if (pattern === 'self') {
                      // @connect self - allow same origin as script match domains
                      const matchDomains = (xhrScript.meta.match || []).map(m => {
                        try { return new URL(m.replace(/\*/g, 'x')).hostname.replace(/^x\./, ''); } catch { return null; }
                      }).filter(Boolean);
                      return matchDomains.some(d => hostname === d || hostname.endsWith('.' + d));
                    }
                    if (pattern === 'localhost') {
                      return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
                    }
                    // Check exact match or subdomain match
                    return hostname === pattern || hostname.endsWith('.' + pattern);
                  });
                  if (!isAllowed) {
                    console.warn(`[ScriptVault] @connect blocked: ${hostname} not in allowed list for ${xhrScript.meta.name}`);
                    return { error: `Connection to ${hostname} blocked by @connect policy`, type: 'error' };
                  }
                } catch (e) {
                  return { error: 'Invalid URL', type: 'error' };
                }
              }
            }
          }

          const tabId = sender.tab?.id;
          const request = XhrManager.create(tabId, data.scriptId, data);
          const { id: requestId } = request;

          // Log to network log
          const _netLogStartTime = Date.now();
          const _netLogEntry = {
            scriptId: data.scriptId,
            scriptName: '',
            method: (data.method || 'GET').toUpperCase(),
            url: data.url,
            requestSize: data.data ? (typeof data.data === 'string' ? data.data.length : 0) : 0
          };
          // Resolve script name
          try {
            const _xhrScript = await ScriptStorage.get(data.scriptId);
            _netLogEntry.scriptName = _xhrScript?.meta?.name || data.scriptId;
          } catch {};
          
          // Create AbortController for this request
          const controller = new AbortController();
          request.controller = controller;
          
          // Function to send event to content script
          const sendEvent = (type, eventData = {}) => {
            if (request.aborted && type !== 'abort') return;
            
            try {
              chrome.tabs.sendMessage(tabId, {
                action: 'xhrEvent',
                data: {
                  requestId,
                  scriptId: data.scriptId,
                  type,
                  ...eventData
                }
              }).catch(() => {});
            } catch (e) {
              // Tab might be closed
            }
          };
          
          // Build fetch options
          // No 'mode' override — Chrome extensions with <all_urls> host permissions
          // bypass CORS automatically. Forcing mode:'cors' breaks requests to servers
          // that don't echo the extension origin (e.g. localhost with null CORS).
          const method = (data.method || 'GET').toUpperCase();
          const fetchOptions = {
            method,
            headers: data.headers || {},
            signal: controller.signal,
            credentials: data.anonymous ? 'omit' : 'include'
          };

          // Add body for non-GET/HEAD requests; deserialize tagged body objects
          if (data.data && method !== 'GET' && method !== 'HEAD') {
            const rawBody = data.data;
            if (rawBody && typeof rawBody === 'object' && !ArrayBuffer.isView(rawBody) && !(rawBody instanceof ArrayBuffer)) {
              if (rawBody.__sv_blob__) {
                const bytes = Uint8Array.from(atob(rawBody.b64), c => c.charCodeAt(0));
                fetchOptions.body = rawBody.name
                  ? new File([bytes], rawBody.name, { type: rawBody.type || '' })
                  : new Blob([bytes], { type: rawBody.type || '' });
              } else if (rawBody.__sv_formdata__) {
                const fd = new FormData();
                for (const entry of rawBody.entries) {
                  if (entry.b64 !== undefined) {
                    const bytes = Uint8Array.from(atob(entry.b64), c => c.charCodeAt(0));
                    fd.append(entry.name, new Blob([bytes], { type: entry.type || '' }), entry.filename || 'blob');
                  } else {
                    fd.append(entry.name, entry.value);
                  }
                }
                fetchOptions.body = fd;
              } else {
                fetchOptions.body = rawBody;
              }
            } else {
              fetchOptions.body = rawBody;
            }
          }
          
          // Set timeout
          const settings = await SettingsManager.get();
          const timeoutMs = data.timeout || settings.xhrTimeout || 30000;
          const timeoutId = setTimeout(() => {
            if (!request.aborted) {
              request.aborted = true;
              controller.abort();
              sendEvent('timeout', {
                readyState: 4,
                status: 0,
                statusText: '',
                error: 'Request timed out'
              });
              sendEvent('loadend', { readyState: 4 });
              XhrManager.remove(requestId);
            }
          }, timeoutMs);
          
          // Send loadstart event
          sendEvent('loadstart', {
            readyState: 1,
            status: 0,
            lengthComputable: false,
            loaded: 0,
            total: 0
          });
          
          // Execute the fetch
          (async () => {
            try {
              const response = await fetch(data.url, fetchOptions);
              clearTimeout(timeoutId);
              
              if (request.aborted) return;
              
              // Get response headers as string
              const responseHeaders = [...response.headers.entries()]
                .map(([k, v]) => `${k}: ${v}`)
                .join('\r\n');
              
              // Send readystatechange for headers received
              sendEvent('readystatechange', {
                readyState: 2,
                status: response.status,
                statusText: response.statusText,
                responseHeaders,
                finalUrl: response.url
              });
              
              // Get content length for progress
              const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
              
              // Read response based on responseType
              let responseData;
              let responseText = '';
              
              if (data.responseType === 'arraybuffer') {
                const buffer = await response.arrayBuffer();
                // Encode as base64 for efficient transfer (33% overhead vs 800%+ for number arrays)
                const bytes = new Uint8Array(buffer);
                let binary = '';
                // Process in 32KB chunks to avoid call stack overflow
                for (let offset = 0; offset < bytes.length; offset += 32768) {
                  binary += String.fromCharCode.apply(null, bytes.subarray(offset, offset + 32768));
                }
                responseData = { __sv_base64__: true, data: btoa(binary) };
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: buffer.byteLength,
                  total: contentLength || buffer.byteLength
                });
              } else if (data.responseType === 'blob') {
                const blob = await response.blob();
                // Convert blob to data URL for transfer
                responseData = await new Promise((resolve) => {
                  const reader = new FileReader();
                  reader.onload = () => resolve(reader.result);
                  reader.onerror = () => resolve(null);
                  reader.readAsDataURL(blob);
                });
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: blob.size,
                  total: contentLength || blob.size
                });
              } else if (data.responseType === 'json') {
                responseText = await response.text();
                try {
                  responseData = JSON.parse(responseText);
                } catch (e) {
                  responseData = responseText;
                }
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: responseText.length,
                  total: contentLength || responseText.length
                });
              } else if (data.responseType === 'stream') {
                // Stream response - send chunks as progress events
                const reader = response.body?.getReader();
                if (reader) {
                  let loaded = 0;
                  const chunks = [];
                  const decoder = new TextDecoder();
                  try {
                    while (true) {
                      const { done, value } = await reader.read();
                      if (done || request.aborted) break;
                      loaded += value.byteLength;
                      const chunkText = decoder.decode(value, { stream: true });
                      chunks.push(chunkText);
                      sendEvent('progress', {
                        readyState: 3,
                        lengthComputable: contentLength > 0,
                        loaded,
                        total: contentLength || 0,
                        responseText: chunkText,
                        streamChunk: true
                      });
                    }
                  } finally {
                    reader.releaseLock();
                  }
                  responseText = chunks.join('');
                  responseData = responseText;
                } else {
                  responseText = await response.text();
                  responseData = responseText;
                }
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: responseText.length,
                  total: contentLength || responseText.length
                });
              } else {
                // Default: text
                responseText = await response.text();
                responseData = responseText;
                sendEvent('progress', {
                  readyState: 3,
                  lengthComputable: contentLength > 0,
                  loaded: responseText.length,
                  total: contentLength || responseText.length
                });
              }
              
              if (request.aborted) return;
              
              // Build final response object
              const finalResponse = {
                readyState: 4,
                status: response.status,
                statusText: response.statusText,
                responseHeaders,
                response: responseData,
                responseText: responseText || (typeof responseData === 'string' ? responseData : JSON.stringify(responseData)),
                finalUrl: response.url,
                lengthComputable: true,
                loaded: responseText?.length || 0,
                total: responseText?.length || 0
              };
              
              // Send load event
              sendEvent('load', finalResponse);

              // Log successful request
              NetworkLog.add({
                ..._netLogEntry,
                status: finalResponse.status,
                statusText: finalResponse.statusText,
                responseSize: responseText?.length || 0,
                duration: Date.now() - _netLogStartTime,
                finalUrl: finalResponse.finalUrl
              });

              // Send loadend event
              sendEvent('loadend', finalResponse);

              // Clean up
              XhrManager.remove(requestId);
              
            } catch (e) {
              clearTimeout(timeoutId);
              
              if (request.aborted) {
                // Already handled by abort
                return;
              }
              
              const isAbort = e.name === 'AbortError';
              const errorType = isAbort ? 'abort' : 'error';
              const errorMsg = isAbort ? 'Request aborted' : (e.message || 'Network error');
              
              // Log failed request
              NetworkLog.add({ ..._netLogEntry, status: 0, error: errorMsg, duration: Date.now() - _netLogStartTime });

              sendEvent(errorType, {
                readyState: 4,
                status: 0,
                statusText: '',
                error: errorMsg
              });
              
              sendEvent('loadend', {
                readyState: 4,
                status: 0
              });
              
              XhrManager.remove(requestId);
            }
          })().catch(e => {
            // Guard against any unexpected exception escaping the try/catch above
            console.error('[ScriptVault] Unexpected XHR handler error:', e);
            XhrManager.remove(requestId);
          });

          // Return request ID immediately so content script can track/abort
          return { requestId, started: true };
          
        } catch (e) {
          console.error('[ScriptVault] GM_xmlhttpRequest setup error:', e);
          return { error: e.message || 'Request setup failed', type: 'error' };
        }
      }
      
      // Abort an XHR request
      case 'GM_xmlhttpRequest_abort': {
        const request = XhrManager.get(data.requestId);
        if (request && !request.aborted) {
          request.aborted = true;
          if (request.controller) {
            request.controller.abort();
          }
          XhrManager.remove(data.requestId);
          return { success: true };
        }
        return { success: false };
      }
      
      // Download (with callbacks: onload, onerror, onprogress, ontimeout)
      case 'GM_download': {
        try {
          const downloadOpts = {
            url: data.url,
            filename: data.name,
            saveAs: data.saveAs || false,
            conflictAction: data.conflictAction || 'uniquify'
          };
          const downloadId = await chrome.downloads.download(downloadOpts);
          const tabId = sender.tab?.id;
          // Track download for event callbacks
          if (tabId && data.hasCallbacks) {
            const sendDlEvent = (type, eventData = {}) => {
              chrome.tabs.sendMessage(tabId, {
                action: 'downloadEvent',
                data: { downloadId, scriptId: data.scriptId, type, ...eventData }
              }).catch(() => {});
            };
            let dlTimeoutId = null;
            let dlSafetyId = null;
            // Remove listener and clear all associated timers
            const cleanupDlListener = () => {
              chrome.downloads.onChanged.removeListener(dlListener);
              if (dlTimeoutId) clearTimeout(dlTimeoutId);
              if (dlSafetyId) clearTimeout(dlSafetyId);
            };
            // Monitor download state changes
            const dlListener = (delta) => {
              if (delta.id !== downloadId) return;
              if (delta.state) {
                if (delta.state.current === 'complete') {
                  sendDlEvent('load', { url: data.url });
                  cleanupDlListener();
                } else if (delta.state.current === 'interrupted') {
                  sendDlEvent('error', { error: delta.error?.current || 'Download interrupted' });
                  cleanupDlListener();
                }
              }
              if (delta.bytesReceived) {
                sendDlEvent('progress', {
                  loaded: delta.bytesReceived.current,
                  total: delta.totalBytes?.current || 0
                });
              }
            };
            chrome.downloads.onChanged.addListener(dlListener);
            // Timeout
            if (data.timeout) {
              dlTimeoutId = setTimeout(() => {
                chrome.downloads.cancel(downloadId).catch(() => {});
                sendDlEvent('timeout');
                cleanupDlListener();
              }, data.timeout);
            }
            // Safety: remove listener after 5 minutes max to prevent leaks
            dlSafetyId = setTimeout(cleanupDlListener, 300000);
          }
          return { success: true, downloadId };
        } catch (e) {
          return { error: e.message };
        }
      }
      
      // Notifications (with callbacks: onclick, ondone, timeout, tag)
      case 'GM_notification': {
        const notifOpts = {
          type: 'basic',
          iconUrl: data.image || 'images/icon128.png',
          title: data.title || 'ScriptVault',
          message: data.text || '',
          silent: data.silent || false
        };
        // Use tag as notification ID for updates
        const notifId = data.tag
          ? await chrome.notifications.create(data.tag, notifOpts)
          : await chrome.notifications.create(notifOpts);
        const tabId = sender.tab?.id;
        // Track notification for callbacks
        if (tabId && (data.hasOnclick || data.hasOndone)) {
          if (!self._notifCallbacks) self._notifCallbacks = new Map();
          // Evict oldest if map grows too large (prevents unbounded growth)
          if (self._notifCallbacks.size > 500) {
            const oldest = self._notifCallbacks.keys().next().value;
            self._notifCallbacks.delete(oldest);
          }
          self._notifCallbacks.set(notifId, {
            tabId, scriptId: data.scriptId,
            hasOnclick: data.hasOnclick, hasOndone: data.hasOndone
          });
        }
        // Auto-close after timeout
        if (data.timeout && data.timeout > 0) {
          if (data.timeout >= 30000) {
            // Long timeouts use chrome.alarms to survive service worker shutdown
            const alarmName = `notif_clear_${notifId}`;
            chrome.alarms.create(alarmName, { delayInMinutes: data.timeout / 60000 });
          } else {
            setTimeout(() => {
              chrome.notifications.clear(notifId).catch(() => {});
              if (self._notifCallbacks) self._notifCallbacks.delete(notifId);
            }, data.timeout);
          }
        }
        return { success: true, id: notifId };
      }
      
      // Open tab (with close tracking for onclose callback)
      case 'GM_openInTab': {
        const newTabOpts = {
          url: data.url,
          active: data.active !== undefined ? data.active : !data.background
        };
        // Insert next to current tab if requested
        if (data.insert && sender.tab?.index !== undefined) {
          newTabOpts.index = sender.tab.index + 1;
        }
        // Set opener tab
        if (data.setParent && sender.tab?.id) {
          newTabOpts.openerTabId = sender.tab.id;
        }
        const tab = await chrome.tabs.create(newTabOpts);
        // Track tab for onclose notification via shared listener
        const callerTabId = sender.tab?.id;
        if (callerTabId && data.trackClose) {
          if (!self._openTabTrackers) self._openTabTrackers = new Map();
          // Evict oldest if map grows too large (prevents unbounded growth from orphaned tabs)
          if (self._openTabTrackers.size > 1000) {
            const oldest = self._openTabTrackers.keys().next().value;
            self._openTabTrackers.delete(oldest);
          }
          self._openTabTrackers.set(tab.id, { callerTabId, scriptId: data.scriptId });
        }
        return { success: true, tabId: tab.id };
      }
      
      // Focus tab
      case 'GM_focusTab':
        if (sender.tab?.id) {
          await chrome.tabs.update(sender.tab.id, { active: true });
        }
        return { success: true };

      // Close opened tab (from GM_openInTab handle.close())
      case 'GM_closeTab':
        if (data.tabId) {
          try { await chrome.tabs.remove(data.tabId); } catch (e) {}
        }
        return { success: true };

      // Get scripts for URL
      case 'getScriptsForUrl': {
        const allScripts = await ScriptStorage.getAll();
        const settings = await SettingsManager.get();
        const url = data.url || data;

        if (isUrlBlockedByGlobalSettings(url, settings)) {
          return [];
        }
        
        // Filter scripts that match this URL (both enabled and disabled for popup display)
        const filtered = allScripts.filter(script => 
          doesScriptMatchUrl(script, url)
        ).sort((a, b) => (a.position || 0) - (b.position || 0));
        
        // Return with metadata property for popup compatibility (strip code to reduce message size)
        return filtered.map(({ code, ...rest }) => ({ ...rest, metadata: rest.meta }));
      }
      
      // Update badge for specific tab
      case 'updateBadgeForTab': {
        if (data.tabId && data.url) {
          await updateBadgeForTab(data.tabId, data.url);
        }
        return { success: true };
      }
      
      // Get info
      case 'getExtensionInfo':
        return {
          name: 'ScriptVault',
          version: chrome.runtime.getManifest().version,
          scriptHandler: 'ScriptVault',
          scriptMetaStr: null
        };
        
      // Register menu command (with extended options: id, accessKey, autoClose, title)
      case 'registerMenuCommand':
      case 'GM_registerMenuCommand': {
        const commands = await chrome.storage.session.get('menuCommands') || {};
        if (!commands.menuCommands) commands.menuCommands = {};
        if (!commands.menuCommands[data.scriptId]) commands.menuCommands[data.scriptId] = [];

        // If command with same id exists, update it instead of adding duplicate
        const existing = commands.menuCommands[data.scriptId].findIndex(c => c.id === data.commandId);
        const cmdEntry = {
          id: data.commandId,
          caption: data.caption,
          accessKey: data.accessKey || '',
          autoClose: data.autoClose !== false,
          title: data.title || ''
        };
        if (existing >= 0) {
          commands.menuCommands[data.scriptId][existing] = cmdEntry;
        } else {
          commands.menuCommands[data.scriptId].push(cmdEntry);
        }

        await chrome.storage.session.set(commands);
        return { success: true };
      }
      
      case 'unregisterMenuCommand':
      case 'GM_unregisterMenuCommand': {
        const commands = await chrome.storage.session.get('menuCommands') || {};
        if (commands.menuCommands?.[data.scriptId]) {
          commands.menuCommands[data.scriptId] = commands.menuCommands[data.scriptId].filter(
            c => c.id !== data.commandId
          );
          if (commands.menuCommands[data.scriptId].length === 0) {
            delete commands.menuCommands[data.scriptId];
          }
          await chrome.storage.session.set(commands);
        }
        return { success: true };
      }

      // Get menu commands
      case 'getMenuCommands': {
        const result = await chrome.storage.session.get('menuCommands');
        const allCommands = result?.menuCommands || {};
        const commands = [];
        
        // Flatten commands and add script info
        const scripts = await ScriptStorage.getAll();
        for (const [scriptId, cmds] of Object.entries(allCommands)) {
          const script = scripts.find(s => s.id === scriptId);
          if (script && cmds) {
            cmds.forEach(cmd => {
              commands.push({
                ...cmd,
                scriptId,
                scriptName: script.meta?.name || 'Unknown Script'
              });
            });
          }
        }
        
        return { commands };
      }
      
      // Execute menu command
      case 'executeMenuCommand': {
        // Send to content script
        if (sender.tab?.id) {
          await chrome.tabs.sendMessage(sender.tab.id, {
            action: 'executeMenuCommand',
            data: { scriptId: data.scriptId, commandId: data.commandId }
          });
        }
        return { success: true };
      }
      
      // GM_cookie API
      case 'GM_cookie_list': {
        try {
          const details = {};
          if (data.url) details.url = data.url;
          if (data.domain) details.domain = data.domain;
          if (data.name) details.name = data.name;
          if (data.path) details.path = data.path;
          const cookies = await chrome.cookies.getAll(details);
          return { success: true, cookies };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_cookie_set': {
        try {
          if (!data.url) return { error: 'url is required for cookie set' };
          if (!data.name) return { error: 'name is required for cookie set' };
          const cookie = await chrome.cookies.set({
            url: data.url,
            name: data.name,
            value: data.value || '',
            domain: data.domain,
            path: data.path || '/',
            secure: data.secure || false,
            httpOnly: data.httpOnly || false,
            expirationDate: data.expirationDate,
            sameSite: data.sameSite || 'unspecified'
          });
          return { success: true, cookie };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_cookie_delete': {
        try {
          if (!data.url || !data.name) return { error: 'url and name are required for cookie delete' };
          await chrome.cookies.remove({
            url: data.url,
            name: data.name
          });
          return { success: true };
        } catch (e) {
          return { error: e.message };
        }
      }

      // GM_webRequest — runtime rule update from script
      case 'GM_webRequest': {
        const scriptId = sender.userScriptId || data.scriptId;
        if (!scriptId) return { error: 'No script context' };
        // Verify the script has @grant GM_webRequest
        const script = await ScriptStorage.get(scriptId);
        if (!script?.meta?.grant?.includes('GM_webRequest')) return { error: 'Not granted' };
        const rules = Array.isArray(data.rules) ? data.rules : (data.rules ? [data.rules] : []);
        await applyWebRequestRules(scriptId, rules);
        return { success: true, count: rules.length };
      }

      // Execution profiling - get stats for dashboard
      case 'getScriptStats': {
        const scriptId = data.scriptId;
        if (scriptId) {
          const script = await ScriptStorage.get(scriptId);
          return { stats: script?.stats || null };
        }
        // Get stats for all scripts
        const scripts = await ScriptStorage.getAll();
        const allStats = {};
        for (const s of scripts) {
          if (s.stats) allStats[s.id] = s.stats;
        }
        return { allStats };
      }

      case 'resetScriptStats': {
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (script) {
          script.stats = { runs: 0, totalTime: 0, avgTime: 0, lastRun: 0, errors: 0 };
          await ScriptStorage.set(scriptId, script);
        }
        return { success: true };
      }

      case 'reportExecTime': {
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (script) {
          if (!script.stats) script.stats = { runs: 0, totalTime: 0, avgTime: 0, lastRun: 0, errors: 0 };
          script.stats.runs++;
          script.stats.totalTime += data.time;
          script.stats.avgTime = Math.round(script.stats.totalTime / script.stats.runs * 100) / 100;
          script.stats.lastRun = Date.now();
          script.stats.lastUrl = data.url;
          // Update cache only (debounced save to avoid excessive storage writes)
          _debouncedStatsSave();
        }
        return { success: true };
      }

      case 'reportExecError': {
        const scriptId = data.scriptId;
        const script = await ScriptStorage.get(scriptId);
        if (script) {
          if (!script.stats) script.stats = { runs: 0, totalTime: 0, avgTime: 0, lastRun: 0, errors: 0 };
          script.stats.errors++;
          script.stats.lastError = data.error;
          script.stats.lastErrorTime = Date.now();
          // Update cache only (debounced save to avoid excessive storage writes)
          _debouncedStatsSave();
        }
        return { success: true };
      }

      // GM_audio API - Tab mute control (Tampermonkey-compatible)
      case 'GM_audio_setMute': {
        try {
          const tabId = sender.tab?.id;
          if (!tabId) return { error: 'No tab context' };
          const mute = typeof data.mute === 'object' ? data.mute.mute : !!data.mute;
          await chrome.tabs.update(tabId, { muted: mute });
          return { success: true };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_audio_getState': {
        try {
          const tabId = sender.tab?.id;
          if (!tabId) return { error: 'No tab context' };
          const tab = await chrome.tabs.get(tabId);
          return {
            muted: tab.mutedInfo?.muted || false,
            reason: tab.mutedInfo?.reason || 'user',
            audible: tab.audible || false
          };
        } catch (e) {
          return { error: e.message };
        }
      }

      case 'GM_audio_watchState': {
        // Start watching tab audio state changes for the requesting tab
        const tabId = sender.tab?.id;
        if (!tabId) return { error: 'No tab context' };
        if (!self._audioWatchedTabs) self._audioWatchedTabs = new Set();
        self._audioWatchedTabs.add(tabId);
        return { success: true };
      }

      case 'GM_audio_unwatchState': {
        const tabId = sender.tab?.id;
        if (tabId && self._audioWatchedTabs) self._audioWatchedTabs.delete(tabId);
        return { success: true };
      }

      // ── v2.0 Module Handlers ──────────────────────────────────────────────

      // NPM Package Resolution
      case 'npmResolve': {
        if (typeof NpmResolver !== 'undefined') {
          return await NpmResolver.resolve(data.spec);
        }
        return { error: 'NpmResolver not available' };
      }

      case 'npmResolveAll': {
        if (typeof NpmResolver !== 'undefined') {
          return await NpmResolver.resolveAll(data.requires);
        }
        return { error: 'NpmResolver not available' };
      }

      // Error Log
      case 'logError': {
        if (typeof ErrorLog !== 'undefined') {
          await ErrorLog.log(data.entry || data);
          return { success: true };
        }
        return { error: 'ErrorLog not available' };
      }

      case 'getErrorLog': {
        if (typeof ErrorLog !== 'undefined') {
          return await ErrorLog.getAll(data.filters);
        }
        return { log: [] };
      }

      case 'getErrorLogGrouped': {
        if (typeof ErrorLog !== 'undefined') {
          return await ErrorLog.getGrouped();
        }
        return { groups: [] };
      }

      case 'exportErrorLog': {
        if (typeof ErrorLog !== 'undefined') {
          const format = data.format || 'json';
          if (format === 'csv') return { data: await ErrorLog.exportCSV() };
          if (format === 'text') return { data: await ErrorLog.exportText() };
          return { data: await ErrorLog.exportJSON() };
        }
        return { error: 'ErrorLog not available' };
      }

      case 'clearErrorLog': {
        if (typeof ErrorLog !== 'undefined') {
          await ErrorLog.clear();
          return { success: true };
        }
        return { error: 'ErrorLog not available' };
      }

      // Notification System
      case 'getNotificationPrefs': {
        if (typeof NotificationSystem !== 'undefined') {
          return await NotificationSystem.getPreferences();
        }
        return {};
      }

      case 'setNotificationPrefs': {
        if (typeof NotificationSystem !== 'undefined') {
          await NotificationSystem.setPreferences(data.prefs);
          return { success: true };
        }
        return { error: 'NotificationSystem not available' };
      }

      case 'generateDigest': {
        if (typeof NotificationSystem !== 'undefined') {
          return await NotificationSystem.generateDigest();
        }
        return { error: 'NotificationSystem not available' };
      }

      // Performance History
      // Easy Cloud Sync
      case 'easyCloudConnect': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.connect();
        }
        return { error: 'EasyCloudSync not available' };
      }

      case 'easyCloudDisconnect': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.disconnect();
        }
        return { error: 'EasyCloudSync not available' };
      }

      case 'easyCloudSync': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.sync();
        }
        return { error: 'EasyCloudSync not available' };
      }

      case 'easyCloudStatus': {
        if (typeof EasyCloudSync !== 'undefined') {
          return await EasyCloudSync.getStatus();
        }
        return { connected: false };
      }

      // Script Console Capture (for debugger)
      case 'scriptConsoleCapture': {
        // Append captured console entries to session storage
        const key = `console_${data.scriptId}`;
        const existing = await chrome.storage.session.get(key);
        const entries = existing[key] || [];
        const incoming = (data.entries || []).slice(-200);
        entries.push(...incoming);
        // Keep last 200 entries per script
        const trimmedEntries = entries.slice(-200);
        await chrome.storage.session.set({ [key]: trimmedEntries });
        return { success: true };
      }

      case 'getScriptConsole': {
        const consoleData = await chrome.storage.session.get(`console_${data.scriptId}`);
        return { entries: consoleData[`console_${data.scriptId}`] || [] };
      }

      case 'clearScriptConsole': {
        await chrome.storage.session.remove(`console_${data.scriptId}`);
        return { success: true };
      }

      // Live Reload toggle
      case 'setLiveReload': {
        const lrData = await chrome.storage.local.get('liveReloadScripts');
        const lrScripts = lrData.liveReloadScripts || {};
        if (data.enabled) {
          lrScripts[data.scriptId] = true;
        } else {
          delete lrScripts[data.scriptId];
        }
        await chrome.storage.local.set({ liveReloadScripts: lrScripts });
        return { success: true };
      }

      case 'getLiveReloadScripts': {
        const lrData2 = await chrome.storage.local.get('liveReloadScripts');
        return { scripts: lrData2.liveReloadScripts || {} };
      }

      case 'openDashboard': {
        const dashUrl = chrome.runtime.getURL('pages/dashboard.html');
        const scriptParam = data.scriptId ? `#script_${encodeURIComponent(data.scriptId)}` : '';
        const newParam = data.newScript ? '#new_script' : '';
        await chrome.tabs.create({ url: dashUrl + (scriptParam || newParam) });
        return { success: true };
      }

      case 'factoryReset': {
        // Clear all scripts
        const allScripts = await ScriptStorage.getAll();
        for (const s of allScripts) {
          await unregisterScript(s.id);
        }
        await chrome.storage.local.remove('userscripts');
        ScriptStorage.cache = {};
        // Reset settings
        await SettingsManager.reset();
        await updateBadge();
        return { success: true };
      }

      case 'resetScriptSettings': {
        const script = await ScriptStorage.get(data.scriptId);
        if (!script) return { error: 'Script not found' };
        script.settings = {};
        await ScriptStorage.set(data.scriptId, script);
        return { success: true };
      }

      default:
        return { error: 'Unknown action: ' + action };
    }
  } catch (e) {
    console.error('[ScriptVault] Message handler error:', e);
    // Log to error system if available
    if (typeof ErrorLog !== 'undefined') {
      try { ErrorLog.log({ timestamp: Date.now(), error: e.message, stack: e.stack, context: 'handleMessage', action: action }); } catch {}
    }
    return { error: e.message };
  }
}

// ============================================================================
// Auto-reload matching tabs
// ============================================================================

// Debounced auto-reload to prevent mass tab reloads on rapid saves
let _autoReloadTimer = null;
let _autoReloadScriptsMap = new Map(); // scriptId → script (deduplicates rapid saves)

async function autoReloadMatchingTabs(script) {
  const settings = await SettingsManager.get();
  if (!settings.autoReload) return;

  _autoReloadScriptsMap.set(script.id, script);
  if (_autoReloadTimer) clearTimeout(_autoReloadTimer);

  _autoReloadTimer = setTimeout(async () => {
    const scripts = [..._autoReloadScriptsMap.values()];
    _autoReloadScriptsMap.clear();
    _autoReloadTimer = null;

    try {
      const tabs = await chrome.tabs.query({});
      const reloaded = new Set();
      for (const tab of tabs) {
        if (reloaded.has(tab.id)) continue;
        if (tab.url && scripts.some(s => doesScriptMatchUrl(s, tab.url))) {
          chrome.tabs.reload(tab.id).catch(() => {});
          reloaded.add(tab.id);
        }
      }
    } catch (e) {
      console.error('[ScriptVault] Auto-reload failed:', e);
    }
  }, 500);
}

// ============================================================================
// Badge Management
// ============================================================================

async function updateBadge(tabId = null) {
  const settings = await SettingsManager.get();

  if (!settings.showBadge || settings.enabled === false) {
    chrome.action.setBadgeText({ text: '', tabId: tabId || undefined });
    return;
  }

  if (tabId) {
    // Update a specific tab
    try {
      const tab = await chrome.tabs.get(tabId);
      if (tab && tab.url) {
        await updateBadgeForTab(tabId, tab.url, settings);
      }
    } catch (e) {
      chrome.action.setBadgeText({ text: '', tabId });
    }
    return;
  }

  // No specific tab — update all tabs in parallel
  try {
    const [tabs, scripts] = await Promise.all([
      chrome.tabs.query({}),
      ScriptStorage.getAll()
    ]);
    await Promise.allSettled(
      tabs.filter(t => t.id && t.url).map(t => updateBadgeForTab(t.id, t.url, settings, scripts))
    );
  } catch (e) {
    chrome.action.setBadgeText({ text: '' });
  }
}

// Update badge for a specific tab based on its URL.
// Accepts optional pre-fetched settings/scripts to avoid redundant cache reads when
// called from updateBadge() in a loop over many tabs.
async function updateBadgeForTab(tabId, url, settings, scripts) {
  if (!settings) settings = await SettingsManager.get();

  if (!settings.showBadge || settings.enabled === false) {
    chrome.action.setBadgeText({ text: '', tabId });
    return;
  }

  if (!url || url.startsWith('chrome://') || url.startsWith('chrome-extension://') || url.startsWith('about:')) {
    chrome.action.setBadgeText({ text: '', tabId });
    return;
  }

  try {
    // Check global page filter
    if (isUrlBlockedByGlobalSettings(url, settings)) {
      chrome.action.setBadgeText({ text: '', tabId });
      return;
    }

    if (!scripts) scripts = await ScriptStorage.getAll();
    const matchingScripts = scripts.filter(script => script.enabled && doesScriptMatchUrl(script, url));

    const badgeInfo = settings.badgeInfo || 'running';
    let badgeText = '';
    if (badgeInfo === 'running') {
      badgeText = matchingScripts.length > 0 ? String(matchingScripts.length) : '';
    } else if (badgeInfo === 'total') {
      const allEnabled = scripts.filter(s => s.enabled).length;
      badgeText = allEnabled > 0 ? String(allEnabled) : '';
    }
    // badgeInfo === 'none' leaves badgeText empty
    chrome.action.setBadgeText({ text: badgeText, tabId });
    chrome.action.setBadgeBackgroundColor({ color: settings.badgeColor || '#22c55e', tabId });
  } catch (e) {
    console.error('[ScriptVault] Failed to update badge:', e);
  }
}

// Check if URL is blocked by global page filter or denied hosts
function isUrlBlockedByGlobalSettings(url, globalSettings) {
  if (!url) return false;
  try {
    const urlObj = new URL(url);
    // Denied hosts
    const denied = globalSettings.deniedHosts;
    if (denied && Array.isArray(denied)) {
      for (const host of denied) {
        if (host && (urlObj.hostname === host || urlObj.hostname.endsWith('.' + host))) {
          return true;
        }
      }
    }
    // Page filter mode
    const mode = globalSettings.pageFilterMode || 'blacklist';
    if (mode === 'whitelist') {
      const whitelist = (globalSettings.whitelistedPages || '').split('\n').map(s => s.trim()).filter(Boolean);
      if (whitelist.length > 0) {
        const matched = whitelist.some(p => matchIncludePattern(p, url, urlObj));
        if (!matched) return true;
      }
    } else if (mode === 'blacklist') {
      const blacklist = (globalSettings.blacklistedPages || '').split('\n').map(s => s.trim()).filter(Boolean);
      if (blacklist.length > 0) {
        const matched = blacklist.some(p => matchIncludePattern(p, url, urlObj));
        if (matched) return true;
      }
    }
  } catch (e) {}
  return false;
}

// Check if a script matches a URL (with URL override support)
function doesScriptMatchUrl(script, url) {
  const meta = script.meta || {};
  const settings = script.settings || {};

  try {
    const urlObj = new URL(url);

    // Build effective patterns based on settings
    let effectiveMatches = [];
    let effectiveIncludes = [];
    let effectiveExcludes = [];
    
    // Original @match patterns (if enabled)
    if (settings.useOriginalMatches !== false) {
      const origMatches = Array.isArray(meta.match) ? meta.match : (meta.match ? [meta.match] : []);
      effectiveMatches.push(...origMatches);
    }
    
    // User @match patterns
    if (settings.userMatches && settings.userMatches.length > 0) {
      effectiveMatches.push(...settings.userMatches);
    }
    
    // Original @include patterns (if enabled)
    if (settings.useOriginalIncludes !== false) {
      const origIncludes = Array.isArray(meta.include) ? meta.include : (meta.include ? [meta.include] : []);
      effectiveIncludes.push(...origIncludes);
    }
    
    // User @include patterns
    if (settings.userIncludes && settings.userIncludes.length > 0) {
      effectiveIncludes.push(...settings.userIncludes);
    }
    
    // Original @exclude patterns (if enabled)
    if (settings.useOriginalExcludes !== false) {
      const origExcludes = Array.isArray(meta.exclude) ? meta.exclude : (meta.exclude ? [meta.exclude] : []);
      effectiveExcludes.push(...origExcludes);
    }
    
    // User @exclude patterns
    if (settings.userExcludes && settings.userExcludes.length > 0) {
      effectiveExcludes.push(...settings.userExcludes);
    }
    
    // Also check @exclude-match (stored as excludeMatch by parser)
    const excludeMatchPatterns = Array.isArray(meta.excludeMatch) ? meta.excludeMatch :
                          (meta.excludeMatch ? [meta.excludeMatch] : []);
    
    // First check if URL matches any exclude pattern
    for (const pattern of effectiveExcludes) {
      if (matchIncludePattern(pattern, url, urlObj)) return false;
    }
    for (const pattern of excludeMatchPatterns) {
      if (matchPattern(pattern, url, urlObj)) return false;
    }
    
    // Then check if URL matches any include/match pattern
    for (const pattern of effectiveMatches) {
      if (matchPattern(pattern, url, urlObj)) return true;
    }
    for (const pattern of effectiveIncludes) {
      if (matchIncludePattern(pattern, url, urlObj)) return true;
    }
    
    return false;
  } catch (e) {
    return false;
  }
}

// Match a @match pattern against a URL
function matchPattern(pattern, url, urlObj) {
  if (!pattern) return false;
  if (pattern === '<all_urls>') return true;
  if (pattern === '*') return true;
  
  try {
    // Parse the pattern
    const patternMatch = pattern.match(/^(\*|https?|file|ftp):\/\/([^/]+)(\/.*)$/);
    if (!patternMatch) return false;
    
    const [, scheme, host, path] = patternMatch;
    
    // Check scheme
    if (scheme !== '*' && scheme !== urlObj.protocol.slice(0, -1)) {
      return false;
    }
    
    // Check host (use urlObj.host when pattern includes port, urlObj.hostname otherwise)
    if (host !== '*') {
      const hasPort = host.includes(':');
      const urlHost = hasPort ? urlObj.host : urlObj.hostname;
      if (host.startsWith('*.')) {
        const baseDomain = host.slice(2);
        if (hasPort) {
          // For *.example.com:8080, compare host (includes port) against baseDomain
          if (urlHost !== baseDomain && !urlHost.endsWith('.' + baseDomain)) {
            return false;
          }
        } else {
          // For *.example.com, compare hostname only
          if (urlObj.hostname !== baseDomain && !urlObj.hostname.endsWith('.' + baseDomain)) {
            return false;
          }
        }
      } else if (host !== urlHost) {
        return false;
      }
    }
    
    // Check path (convert glob to regex)
    const pathRegex = new RegExp('^' + path.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
    if (!pathRegex.test(urlObj.pathname + urlObj.search)) {
      return false;
    }
    
    return true;
  } catch (e) {
    return false;
  }
}

// Match an @include pattern (glob-style or regex)
function matchIncludePattern(pattern, url, urlObj) {
  if (!pattern) return false;
  if (pattern === '*') return true;

  try {
    // Handle regex patterns: /regex/ or /regex/flags
    if (isRegexPattern(pattern)) {
      const re = parseRegexPattern(pattern);
      return re ? re.test(url) : false;
    }

    // Convert glob to regex — collapse consecutive wildcards to prevent ReDoS
    let regex = pattern
      .replace(/\*{2,}/g, '*')                // Collapse consecutive * to single
      .replace(/[.+^${}()|[\]\\]/g, '\\$&')  // Escape special chars
      .replace(/\*/g, '.*')                   // * -> .*
      .replace(/\?/g, '.');                   // ? -> .

    // Handle scheme wildcards
    regex = regex.replace(/^(\\\*):\/\//, '(https?|file|ftp)://');

    const re = new RegExp('^' + regex + '$', 'i');
    return re.test(url);
  } catch (e) {
    return false;
  }
}

// ============================================================================
// Context Menu
// ============================================================================

async function setupContextMenus() {
  await chrome.contextMenus.removeAll();
  const settings = await SettingsManager.get();
  if (settings.enableContextMenu === false) return;

  chrome.contextMenus.create({
    id: 'scriptvault-new',
    title: 'Create script for this site',
    contexts: ['page']
  });

  chrome.contextMenus.create({
    id: 'scriptvault-dashboard',
    title: 'Open ScriptVault Dashboard',
    contexts: ['page']
  });

  chrome.contextMenus.create({
    id: 'scriptvault-toggle',
    title: 'Toggle all scripts',
    contexts: ['page']
  });

  // v2.0: Install from link — right-click a .user.js link to install
  chrome.contextMenus.create({
    id: 'scriptvault-install-link',
    title: 'Install userscript from link',
    contexts: ['link'],
    targetUrlPatterns: ['*://*/*.user.js', '*://*/*.user.js?*']
  });

  // Add context menu entries for @run-at context-menu scripts
  const scripts = await ScriptStorage.getAll();
  const contextScripts = scripts.filter(s => s.enabled !== false && s.meta && s.meta['run-at'] === 'context-menu');
  if (contextScripts.length > 0) {
    chrome.contextMenus.create({
      id: 'scriptvault-separator',
      type: 'separator',
      contexts: ['page', 'selection', 'link', 'image']
    });
    for (const script of contextScripts) {
      chrome.contextMenus.create({
        id: `scriptvault-ctx-${script.id}`,
        title: script.meta.name || script.id,
        contexts: ['page', 'selection', 'link', 'image']
      });
    }
  }
}

chrome.runtime.onInstalled.addListener(async (details) => {
  setupContextMenus();

  // v2.0: Initialize backup scheduler (needs alarm registration on install)
  if (typeof BackupScheduler !== 'undefined') {
    try { await BackupScheduler.init(); } catch (e) { console.error('[ScriptVault] BackupScheduler init error:', e); }
  }

  // v2.0: Schedule notification digest (needs alarm registration on install)
  if (typeof NotificationSystem !== 'undefined') {
    try { await NotificationSystem.scheduleDigest(); } catch (e) { console.error('[ScriptVault] Digest schedule error:', e); }
  }

  // v2.0: Register public API listeners
  if (typeof PublicAPI !== 'undefined') {
    try { PublicAPI.init(); } catch (e) { console.error('[ScriptVault] PublicAPI init error:', e); }
  }

  // Note: Migration.run() is called in the main init() function, not here,
  // to avoid running it twice on install (onInstalled + init both fire).
});

chrome.contextMenus.onClicked.addListener(async (info, tab) => {
  switch (info.menuItemId) {
    case 'scriptvault-new': {
      if (!tab?.url) break;
      try {
        const url = new URL(tab.url);
        chrome.tabs.create({
          url: `pages/dashboard.html?new=1&host=${encodeURIComponent(url.hostname)}`
        });
      } catch { chrome.tabs.create({ url: 'pages/dashboard.html?new=1' }); }
      break;
    }
    case 'scriptvault-dashboard':
      chrome.tabs.create({ url: 'pages/dashboard.html' });
      break;
    case 'scriptvault-toggle': {
      const settings = await SettingsManager.get();
      await SettingsManager.set('enabled', !settings.enabled);
      await registerAllScripts(true);
      await updateBadge();
      break;
    }
    case 'scriptvault-install-link': {
      // v2.0: Install userscript from a right-clicked .user.js link
      const linkUrl = info.linkUrl;
      if (linkUrl) {
        try {
          const response = await fetch(linkUrl);
          if (!response.ok) throw new Error(`HTTP ${response.status}`);
          const code = await response.text();
          if (code.includes('==UserScript==')) {
            await chrome.storage.local.set({
              pendingInstall: { code, url: linkUrl, timestamp: Date.now() }
            });
            chrome.tabs.create({ url: chrome.runtime.getURL('pages/install.html') });
          } else {
            chrome.notifications.create({
              type: 'basic', iconUrl: 'images/icon128.png',
              title: 'Not a Userscript',
              message: 'The linked file does not contain a valid ==UserScript== block.'
            });
          }
        } catch (e) {
          chrome.notifications.create({
            type: 'basic', iconUrl: 'images/icon128.png',
            title: 'Install Failed',
            message: `Could not fetch script: ${e.message}`
          });
        }
      }
      break;
    }
    default: {
      // Handle @run-at context-menu script execution
      if (info.menuItemId && typeof info.menuItemId === 'string' && info.menuItemId.startsWith('scriptvault-ctx-')) {
        const scriptId = info.menuItemId.replace('scriptvault-ctx-', '');
        const script = await ScriptStorage.get(scriptId);
        if (script && tab?.id) {
          try {
            // Build wrapped script with GM API support (same as auto-registered scripts)
            const meta = script.meta;
            const requires = Array.isArray(meta.require) ? meta.require : (meta.require ? [meta.require] : []);
            const requireScripts = [];
            for (const url of requires) {
              try {
                const code = await fetchRequireScript(url);
                if (code) requireScripts.push({ url, code });
              } catch (e) {}
            }
            const storedValues = await ScriptValues.getAll(script.id) || {};
            const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, [], []);
            // Execute in ISOLATED world (content script context) which has chrome.runtime access
            // The wrapper's sendToBackground uses chrome.runtime.sendMessage directly
            await chrome.scripting.executeScript({
              target: { tabId: tab.id },
              func: (code) => { (0, eval)(code); },
              args: [wrappedCode]
            });
            // Feedback notification
            const settings = await SettingsManager.get();
            if (settings.notifyOnError !== false) {
              chrome.notifications.create({
                type: 'basic',
                iconUrl: 'images/icon128.png',
                title: 'Script Executed',
                message: `${script.meta.name} ran via context menu`
              });
            }
          } catch (e) {
            console.error(`[ScriptVault] Context-menu script execution failed:`, e);
            chrome.notifications.create({
              type: 'basic',
              iconUrl: 'images/icon128.png',
              title: 'Script Failed',
              message: `${script.meta.name}: ${e.message || 'Unknown error'}`
            });
          }
        }
      }
      break;
    }
  }
});

// ============================================================================
// Keyboard Shortcuts
// ============================================================================

chrome.commands.onCommand.addListener(async (command) => {
  switch (command) {
    case 'open_dashboard':
      chrome.tabs.create({ url: 'pages/dashboard.html' });
      break;
    case 'toggle_scripts': {
      const settings = await SettingsManager.get();
      await SettingsManager.set('enabled', !settings.enabled);
      await registerAllScripts(true);
      await updateBadge();
      
      chrome.notifications.create({
        type: 'basic',
        iconUrl: 'images/icon128.png',
        title: 'ScriptVault',
        message: settings.enabled ? 'Scripts disabled' : 'Scripts enabled'
      });
      break;
    }
  }
});

// ============================================================================
// Alarms (Auto-update & Sync)
// ============================================================================

// Debounced stats save — coalesces rapid reportExecTime/Error writes into a single storage write
let _statsSaveTimer = null;
function _debouncedStatsSave() {
  if (_statsSaveTimer) clearTimeout(_statsSaveTimer);
  _statsSaveTimer = setTimeout(() => {
    _statsSaveTimer = null;
    ScriptStorage.save().catch(() => {});
  }, 5000);
}

let _backgroundTaskRunning = false;
let _backgroundTaskToken = 0;
chrome.alarms.onAlarm.addListener(async (alarm) => {
  // Handle notification auto-close alarms
  if (alarm.name.startsWith('notif_clear_')) {
    const notifId = alarm.name.slice('notif_clear_'.length);
    chrome.notifications.clear(notifId).catch(() => {});
    if (self._notifCallbacks) self._notifCallbacks.delete(notifId);
    return;
  }

  // Handle notification context cleanup alarms
  if (alarm.name.startsWith('notifCtx_clean_')) {
    const notifId = alarm.name.slice('notifCtx_clean_'.length);
    chrome.storage.local.remove(`notifCtx_${notifId}`).catch(() => {});
    return;
  }

  // Handle @crontab script execution alarms (independent of the update/sync mutex)
  if (alarm.name.startsWith('crontab_')) {
    const scriptId = alarm.name.slice('crontab_'.length);
    handleCrontabAlarm(scriptId).catch(e => console.error('[ScriptVault] Crontab alarm error:', e));
    return;
  }

  // Delegate to NotificationSystem for weekly-digest + internal context alarms.
  // Without this dispatch the `scriptvault-weekly-digest` alarm would fire into
  // nothing (the branches below only handle autoUpdate/autoSync), so the digest
  // notification — which users explicitly opt into via prefs.digest — would
  // silently never generate.
  if (typeof NotificationSystem !== 'undefined' && typeof NotificationSystem.handleAlarm === 'function') {
    try {
      const handled = await NotificationSystem.handleAlarm(alarm);
      if (handled) return;
    } catch (e) {
      console.error('[ScriptVault] NotificationSystem alarm error:', e);
    }
  }

  // Mutual exclusion — don't run update and sync concurrently
  if (_backgroundTaskRunning) {
    debugLog('Skipping alarm', alarm.name, '- another task is running');
    return;
  }
  _backgroundTaskRunning = true;
  // Safety timeout: release mutex after 5 minutes even if the task hangs.
  // Each task gets a unique token so the late-finishing task can tell whether
  // the safety timer has already released the mutex for the next task — if so,
  // the stale finally block must NOT clobber the new task's `true` flag.
  const myToken = ++_backgroundTaskToken;
  const safetyTimer = setTimeout(() => {
    if (_backgroundTaskToken === myToken) _backgroundTaskRunning = false;
  }, 300000);
  try {
    if (alarm.name === 'autoUpdate') {
      await UpdateSystem.autoUpdate();
    } else if (alarm.name === 'autoSync') {
      await CloudSync.sync();
    }
  } catch (e) {
    console.error('[ScriptVault] Alarm handler error:', e);
  } finally {
    clearTimeout(safetyTimer);
    if (_backgroundTaskToken === myToken) _backgroundTaskRunning = false;
  }
});

// ============================================================================
// @crontab Support
// ============================================================================

// Convert a simplified cron expression to a period in minutes.
// Chrome alarms have a minimum of 1 minute.
// Supports: every-N-minutes, hourly, every-N-hours, daily.
// Falls back to 1 minute for complex expressions.
function parseCronToMinutes(expr) {
  if (!expr || typeof expr !== 'string') return 60;
  const parts = expr.trim().split(/\s+/);
  if (parts.length < 5) return 60;
  const [min, hour, dom, month, dow] = parts;
  if (min.startsWith('*/') && hour === '*' && dom === '*' && month === '*' && dow === '*') {
    const n = parseInt(min.slice(2), 10);
    return isNaN(n) || n < 1 ? 1 : Math.min(n, 1440);
  }
  if (min === '0' && hour.startsWith('*/') && dom === '*' && month === '*' && dow === '*') {
    const n = parseInt(hour.slice(2), 10);
    return isNaN(n) || n < 1 ? 60 : Math.min(n * 60, 1440);
  }
  if (min === '0' && hour === '*' && dom === '*' && month === '*' && dow === '*') {
    return 60;
  }
  if (min === '0' && hour === '0' && dom === '*' && month === '*' && dow === '*') {
    return 1440;
  }
  // Complex expression not supported by simplified parser — fall back to hourly
  debugLog(`[parseCronToMinutes] Unrecognized cron expression: "${expr}", defaulting to 60 min`);
  return 60;
}

/** Execute a @crontab script in all currently-open matching tabs. */
async function handleCrontabAlarm(scriptId) {
  const script = await ScriptStorage.get(scriptId);
  if (!script || !script.enabled || !script.meta?.crontab) {
    chrome.alarms.clear('crontab_' + scriptId).catch(() => {});
    return;
  }

  const meta = script.meta;
  const hasMatches = (meta.match && meta.match.length > 0) || (meta.include && meta.include.length > 0);
  if (!hasMatches) {
    debugLog(`@crontab script ${meta.name} has no @match patterns, skipping`);
    return;
  }

  // Fetch @require scripts
  const requireScripts = [];
  const requires = Array.isArray(meta.require) ? meta.require : (meta.require ? [meta.require] : []);
  for (const url of requires) {
    try {
      const code = await fetchRequireScript(url);
      if (code) requireScripts.push({ url, code });
    } catch (e) {}
  }

  const storedValues = await ScriptValues.getAll(script.id) || {};
  // Extract regex @include/@exclude patterns for runtime URL guard in wrapper
  const regexIncludes = [];
  const regexExcludes = [];
  for (const inc of (meta.include || [])) {
    if (/^\/.*\/$|^\/.*\/[gimsuy]+$/.test(inc)) regexIncludes.push(inc);
  }
  for (const exc of (meta.exclude || [])) {
    if (/^\/.*\/$|^\/.*\/[gimsuy]+$/.test(exc)) regexExcludes.push(exc);
  }
  const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, regexIncludes, regexExcludes);

  const tabs = await chrome.tabs.query({ status: 'complete' });
  for (const tab of tabs) {
    if (!tab.url || !tab.id) continue;
    if (!doesScriptMatchUrl(script, tab.url)) continue;
    try {
      await chrome.scripting.executeScript({
        target: { tabId: tab.id },
        func: (code) => { (new Function(code))(); },
        args: [wrappedCode],
        world: 'ISOLATED'
      });
      debugLog(`@crontab ${meta.name}: executed in tab ${tab.id}`);
    } catch (e) {
      debugLog(`@crontab ${meta.name}: failed in tab ${tab.id}: ${e.message}`);
    }
  }
}

/** Create/refresh chrome alarms for all enabled @crontab scripts. */
async function setupCrontabAlarms() {
  const scripts = await ScriptStorage.getAll();
  for (const script of scripts) {
    const alarmName = 'crontab_' + script.id;
    await chrome.alarms.clear(alarmName).catch(() => {});
    if (script.enabled && script.meta?.crontab) {
      const minutes = Math.max(1, parseCronToMinutes(script.meta.crontab));
      chrome.alarms.create(alarmName, { periodInMinutes: minutes });
    }
  }
}

async function setupAlarms() {
  const settings = await SettingsManager.get();
  
  // Clear only the alarms we manage here (preserve notification/backup alarms)
  await chrome.alarms.clear('autoUpdate').catch(() => {});
  await chrome.alarms.clear('autoSync').catch(() => {});
  
  // Setup auto-update alarm
  // checkInterval is hours from dashboard, updateInterval is ms legacy
  if (settings.autoUpdate) {
    const intervalMs = settings.checkInterval
      ? parseInt(settings.checkInterval) * 3600000
      : (settings.updateInterval || 86400000);
    chrome.alarms.create('autoUpdate', {
      periodInMinutes: Math.max(1, intervalMs / 60000)
    });
  }
  
  // Setup sync alarm
  if (settings.syncEnabled && settings.syncProvider !== 'none') {
    const syncMs = settings.syncInterval || 3600000; // Default 1 hour
    chrome.alarms.create('autoSync', {
      periodInMinutes: Math.max(1, syncMs / 60000)
    });
  }

  // Setup @crontab alarms for all enabled scripts
  await setupCrontabAlarms();
}

// ============================================================================
// Tab Listeners (for badge updates)
// ============================================================================

// Update badge when tab is activated
chrome.tabs.onActivated.addListener(async (activeInfo) => {
  try {
    const tab = await chrome.tabs.get(activeInfo.tabId);
    if (tab.url) {
      await updateBadgeForTab(activeInfo.tabId, tab.url);
    }
  } catch (e) {
    // Tab might not exist
  }
});

// Update badge when tab URL changes
chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {
  if (changeInfo.url || changeInfo.status === 'complete') {
    if (tab.url) {
      await updateBadgeForTab(tabId, tab.url);
    }
  }

  // Forward audio state changes to watched tabs
  if (('audible' in changeInfo || 'mutedInfo' in changeInfo) && self._audioWatchedTabs?.has(tabId)) {
    try {
      await chrome.tabs.sendMessage(tabId, {
        action: 'audioStateChanged',
        data: {
          muted: tab.mutedInfo?.muted || false,
          reason: tab.mutedInfo?.reason || 'user',
          audible: tab.audible || false
        }
      });
    } catch (e) {
      // Tab may have been closed
      self._audioWatchedTabs.delete(tabId);
    }
  }
});

// GM_openInTab onclose: fire callback when tracked tab closes
chrome.tabs.onRemoved.addListener((tabId) => {
  const tracker = self._openTabTrackers?.get(tabId);
  if (tracker) {
    chrome.tabs.sendMessage(tracker.callerTabId, {
      action: 'openedTabClosed',
      data: { tabId, scriptId: tracker.scriptId }
    }).catch(() => {});
    self._openTabTrackers.delete(tabId);
  }
  // Clean up audio watch tracking for closed tabs
  if (self._audioWatchedTabs) self._audioWatchedTabs.delete(tabId);
});

// GM_notification onclick/ondone: fire callbacks on notification interaction
chrome.notifications.onClicked.addListener((notifId) => {
  const cb = self._notifCallbacks?.get(notifId);
  if (cb && cb.hasOnclick) {
    chrome.tabs.sendMessage(cb.tabId, {
      action: 'notificationEvent',
      data: { notifId, scriptId: cb.scriptId, type: 'click' }
    }).catch(() => {});
  }
});

chrome.notifications.onClosed.addListener((notifId, byUser) => {
  const cb = self._notifCallbacks?.get(notifId);
  if (cb && cb.hasOndone) {
    chrome.tabs.sendMessage(cb.tabId, {
      action: 'notificationEvent',
      data: { notifId, scriptId: cb.scriptId, type: 'done', byUser }
    }).catch(() => {});
  }
  if (self._notifCallbacks) self._notifCallbacks.delete(notifId);
});

// Update badge when window focus changes
chrome.windows.onFocusChanged.addListener(async (windowId) => {
  if (windowId === chrome.windows.WINDOW_ID_NONE) return;
  
  try {
    const [tab] = await chrome.tabs.query({ active: true, windowId });
    if (tab?.id && tab.url) {
      await updateBadgeForTab(tab.id, tab.url);
    }
  } catch (e) {
    // Window might not exist
  }
});

// ============================================================================
// Userscript Installation Handler
// ============================================================================

// Intercept navigation to .user.js files
const _pendingFetches = new Set(); // Dedup concurrent fetches
const MAX_SCRIPT_SIZE = 5 * 1024 * 1024; // 5MB limit

chrome.webNavigation.onBeforeNavigate.addListener(async (details) => {
  // Only handle main frame navigation
  if (details.frameId !== 0) return;

  const url = details.url;

  // Check if this is a .user.js URL
  if (!url.match(/\.user\.js(\?.*)?$/i)) return;

  // Don't intercept extension pages
  if (url.startsWith('chrome-extension://')) return;

  // Dedup concurrent fetches for same URL
  if (_pendingFetches.has(url)) return;
  _pendingFetches.add(url);

  debugLog('Intercepting userscript URL:', url);

  try {
    // Fetch with timeout
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), 30000);
    const response = await fetch(url, { signal: controller.signal });
    clearTimeout(timeoutId);

    if (!response.ok) {
      throw new Error(`HTTP ${response.status}: ${response.statusText}`);
    }

    // Check content length before reading body
    const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
    if (contentLength > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(contentLength)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }

    const code = await response.text();

    if (code.length > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }
    
    // Verify it looks like a userscript
    if (!code.includes('==UserScript==')) {
      debugLog('Not a valid userscript, allowing normal navigation');
      _pendingFetches.delete(url);
      await chrome.storage.local.remove('pendingInstall');
      return;
    }
    
    // Store pending install data
    await chrome.storage.local.set({
      pendingInstall: {
        url: url,
        code: code,
        timestamp: Date.now()
      }
    });
    
    // Redirect to install page
    chrome.tabs.update(details.tabId, {
      url: chrome.runtime.getURL('pages/install.html')
    });
    
  } catch (error) {
    console.error('[ScriptVault] Failed to fetch script:', error);
    // Store error for install page to display
    await chrome.storage.local.set({
      pendingInstall: {
        url: url,
        error: error.message,
        timestamp: Date.now()
      }
    });
    
    chrome.tabs.update(details.tabId, {
      url: chrome.runtime.getURL('pages/install.html')
    });
  } finally {
    _pendingFetches.delete(url);
  }
}, {
  url: [
    { urlMatches: '.*\\.user\\.js(\\?.*)?$' }
  ]
});

// Handle direct script installation from URL
async function installFromUrl(url) {
  try {
    // Timeout after 30 seconds
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), 30000);

    const response = await fetch(url, { signal: controller.signal });
    clearTimeout(timeoutId);

    if (!response.ok) {
      throw new Error(`HTTP ${response.status}`);
    }

    // Size limit: 5MB (same as webNavigation handler)
    const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
    if (contentLength > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(contentLength)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }

    const code = await response.text();

    // Post-read size check (content-length may be missing)
    if (code.length > MAX_SCRIPT_SIZE) {
      throw new Error(`Script too large (${formatBytes(code.length)}). Maximum is ${formatBytes(MAX_SCRIPT_SIZE)}.`);
    }

    if (!code.includes('==UserScript==')) {
      throw new Error('Not a valid userscript');
    }
    
    // Parse and save
    const parsed = parseUserscript(code);
    if (parsed.error) {
      throw new Error(parsed.error);
    }
    const meta = parsed.meta;
    const allScripts = await ScriptStorage.getAll();

    // Check for existing script with same name+namespace (update instead of duplicate)
    const existing = allScripts.find(s => s.meta.name === meta.name && s.meta.namespace === meta.namespace);
    const id = existing ? existing.id : generateId();

    const script = {
      id,
      code,
      meta,
      enabled: existing ? existing.enabled : true,
      position: existing ? existing.position : allScripts.length,
      createdAt: existing ? existing.createdAt : Date.now(),
      updatedAt: Date.now()
    };

    await ScriptStorage.set(id, script);
    await registerAllScripts(true);
    await updateBadge();
    await autoReloadMatchingTabs(script);

    return { success: true, script };
  } catch (error) {
    return { success: false, error: error.message };
  }
}

// ============================================================================
// Initialization
// ============================================================================

async function init() {
  await SettingsManager.init();

  // v2.0: Run migration BEFORE ScriptStorage.init() so that any migration-driven
  // rewrites of `userscripts` storage are visible to the in-memory cache. Running
  // it after ScriptStorage.init() left the cache pinned to pre-migration data,
  // causing every subsequent cached read (dashboard, registration, badge) to see
  // the old shape until the next SW cold start.
  if (typeof Migration !== 'undefined') {
    try { await Migration.run(); } catch (e) { console.error('[ScriptVault] Migration error:', e); }
  }

  await ScriptStorage.init();

  // Apply language setting to I18n
  const settings = await SettingsManager.get();
  if (settings.language && settings.language !== 'default' && settings.language !== 'auto') {
    I18n.setLocale(settings.language);
  }

  // Configure userScripts world
  await configureUserScriptsWorld();

  // Setup context menus
  await setupContextMenus();

  // Register all enabled scripts — force re-registration on extension install/update
  // (new GM_* wrappers / match patterns require rewriting all registered scripts).
  // On plain SW wake within the same extension version, skip the destructive cycle.
  let needsForceReregister = false;
  try {
    const currentVersion = chrome.runtime.getManifest().version;
    const stored = await chrome.storage.local.get('_lastRegisteredVersion');
    if (stored._lastRegisteredVersion !== currentVersion) {
      needsForceReregister = true;
      await chrome.storage.local.set({ _lastRegisteredVersion: currentVersion });
    }
  } catch (e) {
    // Unable to read version — force re-register to be safe on update
    needsForceReregister = true;
  }
  await registerAllScripts(needsForceReregister);

  await updateBadge();
  await setupAlarms();

  // Clean up stale persistent caches (require_cache_, res_cache_)
  cleanupStaleCaches();

  // v2.0: Auto-cleanup storage if above threshold
  if (typeof QuotaManager !== 'undefined') {
    try { await QuotaManager.autoCleanup(); } catch (e) { console.error('[ScriptVault] Quota cleanup error:', e); }
  }

  // v2.0: Register global error handlers for ErrorLog
  if (typeof ErrorLog !== 'undefined' && typeof ErrorLog.registerGlobalHandlers === 'function') {
    ErrorLog.registerGlobalHandlers();
  }

  // v2.0 module initializers: these register alarm/message listeners and
  // load per-module state. Previously they were only called from
  // chrome.runtime.onInstalled, which only fires at install/update — after
  // the first SW shutdown (~30s idle) the listeners were gone and modules
  // were dormant until the next extension update. Each module is
  // `_initialized`-guarded so calling them every wake is cheap and safe.
  if (typeof BackupScheduler !== 'undefined') {
    try { await BackupScheduler.init(); } catch (e) { console.error('[ScriptVault] BackupScheduler init error:', e); }
  }
  if (typeof NotificationSystem !== 'undefined' && typeof NotificationSystem.init === 'function') {
    try { await NotificationSystem.init(); } catch (e) { console.error('[ScriptVault] NotificationSystem init error:', e); }
  }
  if (typeof PublicAPI !== 'undefined') {
    try { await PublicAPI.init(); } catch (e) { console.error('[ScriptVault] PublicAPI init error:', e); }
  }
  if (typeof EasyCloudSync !== 'undefined') {
    try { await EasyCloudSync.init(); } catch (e) { console.error('[ScriptVault] EasyCloudSync init error:', e); }
  }

  console.log('[ScriptVault] Service worker ready');
}

// Remove expired persistent cache entries and stale trash items to prevent storage bloat
async function cleanupStaleCaches() {
  try {
    const all = await chrome.storage.local.get(null);
    const now = Date.now();
    const maxRequireAge = 7 * 24 * 60 * 60 * 1000; // 7 days
    const maxResourceAge = ResourceCache.maxAge; // 24 hours
    const keysToRemove = [];

    for (const [key, value] of Object.entries(all)) {
      if (key.startsWith('require_cache_') && value?.timestamp) {
        if (now - value.timestamp > maxRequireAge) keysToRemove.push(key);
      } else if (key.startsWith('res_cache_') && value?.timestamp) {
        if (now - value.timestamp > maxResourceAge) keysToRemove.push(key);
      }
    }

    if (keysToRemove.length > 0) {
      await chrome.storage.local.remove(keysToRemove);
      debugLog(`Cleaned up ${keysToRemove.length} stale cache entries`);
    }
  } catch (e) {
    // Non-critical, ignore errors
  }

  // Prune sync tombstones older than 30 days (they're only needed during the sync window)
  try {
    const tombstoneData = await chrome.storage.local.get('syncTombstones');
    const tombstones = tombstoneData.syncTombstones || {};
    const cutoff = Date.now() - 30 * 24 * 60 * 60 * 1000;
    const pruned = Object.fromEntries(Object.entries(tombstones).filter(([, ts]) => ts > cutoff));
    if (Object.keys(pruned).length !== Object.keys(tombstones).length) {
      await chrome.storage.local.set({ syncTombstones: pruned });
    }
  } catch (e) { /* non-critical */ }

  // Prune expired trash entries based on trashMode retention setting
  try {
    const settings = await SettingsManager.get();
    const trashMode = settings.trashMode || '30';
    if (trashMode === 'disabled') return;
    const maxAge = trashMode === '1' ? 86400000 : trashMode === '7' ? 604800000 : 2592000000; // 1/7/30 days
    const trashData = await chrome.storage.local.get('trash');
    const trash = trashData.trash || [];
    const now = Date.now();
    const valid = trash.filter(s => now - s.trashedAt < maxAge);
    if (valid.length !== trash.length) {
      await chrome.storage.local.set({ trash: valid });
      debugLog(`Pruned ${trash.length - valid.length} expired trash entries`);
    }
  } catch (e) {
    // Non-critical, ignore errors
  }
}

// Detect Chrome major version from user agent (available in service worker via self.navigator)
function _getChromeVersion() {
  try {
    const m = (self.navigator?.userAgent || '').match(/Chrome\/(\d+)/);
    return m ? parseInt(m[1], 10) : 0;
  } catch (e) {
    return 0;
  }
}

// Configure the userScripts execution world
async function configureUserScriptsWorld() {
  try {
    // Check if userScripts API is available
    if (!chrome.userScripts) {
      // Determine why: Chrome 120+ requires either Developer Mode (pre-138)
      // or the "Allow User Scripts" toggle (138+)
      const ver = _getChromeVersion();
      if (ver >= 138) {
        console.warn('[ScriptVault] userScripts API not available — enable the "Allow User Scripts" toggle in chrome://extensions for ScriptVault');
      } else if (ver >= 120) {
        console.warn('[ScriptVault] userScripts API not available — enable Developer Mode in chrome://extensions');
      } else {
        console.warn('[ScriptVault] userScripts API not available — Chrome 120+ required');
      }
      await SettingsManager.set({ _userScriptsAvailable: false, _chromeVersion: ver });
      return;
    }

    await SettingsManager.set({ _userScriptsAvailable: true, _chromeVersion: _getChromeVersion() });

    // Configure the default USER_SCRIPT world
    await chrome.userScripts.configureWorld({
      csp: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *",
      messaging: true
    });

    debugLog('userScripts world configured (Chrome', _getChromeVersion(), ')');
  } catch (e) {
    console.error('[ScriptVault] Failed to configure userScripts world:', e);
  }
}

// Register all enabled scripts with the userScripts API
async function registerAllScripts(forceReregister = false) {
  try {
    if (!chrome.userScripts) {
      console.warn('[ScriptVault] userScripts API not available');
      return;
    }

    // On normal SW wake, check if scripts are already registered to avoid
    // the destructive unregister→register cycle that creates a gap where
    // scripts aren't active on page navigations.
    //
    // Round 11: Compute a diff between enabled-in-storage and currently-registered.
    // If a previous `Promise.allSettled` registration partially failed, the registered
    // set may be missing some scripts indefinitely — register just the missing subset
    // rather than short-circuiting the whole call.
    if (!forceReregister) {
      try {
        const existing = await chrome.userScripts.getScripts();
        if (existing && existing.length > 0) {
          const settings = await SettingsManager.get();
          if (!settings.enabled) {
            debugLog(`Skipping re-registration: scripts globally disabled`);
            return;
          }
          const scripts = await ScriptStorage.getAll();
          const enabledScripts = scripts.filter(s => s.enabled !== false);
          const registeredIds = new Set(existing.map(s => s.id));
          const missing = enabledScripts.filter(s => !registeredIds.has(s.id));

          if (missing.length === 0) {
            debugLog(`Skipping re-registration: ${existing.length} scripts already registered, none missing`);
            return;
          }

          // Preload @require deps for the missing subset in parallel
          const missingRequires = new Set();
          for (const script of missing) {
            for (const req of (script.meta?.require || [])) {
              missingRequires.add(req);
            }
          }
          if (missingRequires.size > 0) {
            debugLog(`Preloading ${missingRequires.size} @require deps for ${missing.length} missing scripts`);
            await Promise.allSettled([...missingRequires].map(url => fetchRequireScript(url)));
          }

          debugLog(`Registering ${missing.length} missing script(s) (diff from ${existing.length} already registered)`);
          const diffResults = await Promise.allSettled(missing.map(script => registerScript(script)));
          const diffFailures = diffResults.filter(r => r.status === 'rejected');
          if (diffFailures.length > 0) {
            console.warn(`[ScriptVault] ${diffFailures.length} missing script(s) failed to register:`, diffFailures.map(r => r.reason?.message || r.reason));
          }
          return;
        }
      } catch (e) {
        // getScripts not available or failed — fall through to full registration
      }
    }

    // Full re-registration: unregister all, then register fresh
    await chrome.userScripts.unregister().catch(() => {});
    
    const scripts = await ScriptStorage.getAll();
    const settings = await SettingsManager.get();
    
    if (!settings.enabled) {
      debugLog('Scripts globally disabled');
      return;
    }
    
    const enabledScripts = scripts.filter(s => s.enabled !== false);

    // Sort by @priority (higher = first), then position
    enabledScripts.sort((a, b) => {
      const pa = a.meta?.priority || 0;
      const pb = b.meta?.priority || 0;
      if (pb !== pa) return pb - pa;
      return (a.position || 0) - (b.position || 0);
    });

    debugLog(`Registering ${enabledScripts.length} scripts`);

    // v2.0: Preload all @require dependencies in parallel before registration
    // This prevents N sequential fetches during registration
    const allRequires = new Set();
    for (const script of enabledScripts) {
      for (const req of (script.meta?.require || [])) {
        allRequires.add(req);
      }
    }
    if (allRequires.size > 0) {
      debugLog(`Preloading ${allRequires.size} @require dependencies`);
      const preloadStart = Date.now();
      await Promise.allSettled([...allRequires].map(url => fetchRequireScript(url)));
      debugLog(`Preloaded in ${Date.now() - preloadStart}ms`);
    }

    // Register all scripts in parallel — significantly faster on large script collections
    const results = await Promise.allSettled(enabledScripts.map(script => registerScript(script)));
    const failures = results.filter(r => r.status === 'rejected');
    if (failures.length > 0) {
      console.warn(`[ScriptVault] ${failures.length} script(s) failed to register:`, failures.map(r => r.reason?.message || r.reason));
    }
  } catch (e) {
    console.error('[ScriptVault] Failed to register scripts:', e);
  }
}

// Register a single script
async function registerScript(script) {
  try {
    const meta = script.meta;
    const settings = script.settings || {};

    // @crontab scripts execute on a schedule rather than on page load.
    // Register a chrome alarm instead of a chrome.userScripts entry.
    if (meta.crontab) {
      const alarmName = 'crontab_' + script.id;
      await chrome.alarms.clear(alarmName).catch(() => {});
      const minutes = Math.max(1, parseCronToMinutes(meta.crontab));
      chrome.alarms.create(alarmName, { periodInMinutes: minutes });
      debugLog(`Registered @crontab: ${meta.name} (every ${minutes} min)`);
      return;
    }

    if (!chrome.userScripts) return;
    
    // Build match patterns with URL override support
    const matches = [];
    const excludeMatches = [];
    
    // Process @match (if enabled in settings)
    if (settings.useOriginalMatches !== false && meta.match && Array.isArray(meta.match)) {
      for (const m of meta.match) {
        if (isValidMatchPattern(m)) {
          matches.push(m);
        }
      }
    }
    
    // Process user @match patterns
    if (settings.userMatches && Array.isArray(settings.userMatches)) {
      for (const m of settings.userMatches) {
        if (isValidMatchPattern(m)) {
          matches.push(m);
        } else {
          // Try to convert glob-style to match pattern
          const converted = convertIncludeToMatch(m);
          if (converted && isValidMatchPattern(converted)) {
            matches.push(converted);
          }
        }
      }
    }
    
    // Collect regex @include/@exclude patterns for runtime filtering
    const regexIncludes = [];
    const regexExcludes = [];

    // Process @include (if enabled in settings)
    if (settings.useOriginalIncludes !== false && meta.include && Array.isArray(meta.include)) {
      for (const inc of meta.include) {
        if (isRegexPattern(inc)) {
          // Regex pattern - extract broad match patterns for registration, filter at runtime
          regexIncludes.push(inc);
          const broad = extractMatchPatternsFromRegex(inc);
          if (broad.length > 0) {
            matches.push(...broad);
          }
        } else {
          const converted = convertIncludeToMatch(inc);
          if (converted && isValidMatchPattern(converted)) {
            matches.push(converted);
          } else if (inc === '*') {
            matches.push('<all_urls>');
          }
        }
      }
    }
    
    // Process user @include patterns
    if (settings.userIncludes && Array.isArray(settings.userIncludes)) {
      for (const inc of settings.userIncludes) {
        const converted = convertIncludeToMatch(inc);
        if (converted && isValidMatchPattern(converted)) {
          matches.push(converted);
        } else if (inc === '*') {
          matches.push('<all_urls>');
        }
      }
    }
    
    // Process @exclude-match (stored as excludeMatch by parser)
    if (meta.excludeMatch && Array.isArray(meta.excludeMatch)) {
      for (const m of meta.excludeMatch) {
        if (isValidMatchPattern(m)) {
          excludeMatches.push(m);
        }
      }
    }
    
    // Process @exclude (if enabled) - convert to exclude matches where possible
    if (settings.useOriginalExcludes !== false && meta.exclude && Array.isArray(meta.exclude)) {
      for (const exc of meta.exclude) {
        if (isRegexPattern(exc)) {
          regexExcludes.push(exc);
          continue;
        }
        const converted = convertIncludeToMatch(exc);
        if (converted && isValidMatchPattern(converted)) {
          excludeMatches.push(converted);
        }
      }
    }
    
    // Process user @exclude patterns
    if (settings.userExcludes && Array.isArray(settings.userExcludes)) {
      for (const exc of settings.userExcludes) {
        const converted = convertIncludeToMatch(exc);
        if (converted && isValidMatchPattern(converted)) {
          excludeMatches.push(converted);
        }
      }
    }
    
    // Add denied hosts as exclude patterns
    const globalSettings = await SettingsManager.get();
    const deniedHosts = globalSettings.deniedHosts;
    if (deniedHosts && Array.isArray(deniedHosts)) {
      for (const host of deniedHosts) {
        if (host) excludeMatches.push(`*://${host}/*`, `*://*.${host}/*`);
      }
    }
    // Add blacklisted pages as exclude patterns
    if (globalSettings.pageFilterMode === 'blacklist' && globalSettings.blacklistedPages) {
      const blacklist = globalSettings.blacklistedPages.split('\n').map(s => s.trim()).filter(Boolean);
      for (const p of blacklist) {
        const converted = convertIncludeToMatch(p);
        if (converted && isValidMatchPattern(converted)) {
          excludeMatches.push(converted);
        }
      }
    }

    // If no matches, use <all_urls> (some scripts use @include *)
    if (matches.length === 0) {
      matches.push('<all_urls>');
    }
    
    // Map run-at values (with per-script setting override)
    const runAtMap = {
      'document-start': 'document_start',
      'document-end': 'document_end',
      'document-idle': 'document_idle',
      'document-body': 'document_end',
      'context-menu': 'document_idle' // context-menu scripts register idle, triggered via context menu
    };

    // @run-in: filter by tab type (normal-tabs, incognito-tabs)
    const runIn = meta['run-in'] || '';
    if (runIn === 'incognito-tabs') {
      // Only run in incognito — skip registration for normal context
      // (chrome.userScripts doesn't support incognito filtering natively,
      // so we inject a runtime guard into the wrapper)
    } else if (runIn === 'normal-tabs') {
      // Only run in normal tabs — runtime guard injected
    }

    // Check for per-script runAt override
    let effectiveRunAt = meta['run-at'];
    if (settings.runAt && settings.runAt !== 'default') {
      effectiveRunAt = settings.runAt;
    }
    const isContextMenu = effectiveRunAt === 'context-menu';
    if (isContextMenu) {
      // Context-menu scripts are not auto-registered; they run on-demand via context menu click
      debugLog(`Skipping auto-register for context-menu script: ${meta.name}`);
      return;
    }
    const runAt = runAtMap[effectiveRunAt] || 'document_idle';

    // Determine execution world based on @inject-into and @sandbox
    // chrome.userScripts API only supports 'USER_SCRIPT' world, not 'MAIN'
    // For @inject-into page / @sandbox raw, we still register in USER_SCRIPT world
    // but pass a flag so the wrapper injects the user's code into the page context via <script>
    const world = 'USER_SCRIPT';
    const injectInto = meta['inject-into'] || 'auto';
    const sandbox = meta.sandbox || '';
    const injectIntoPage = (injectInto === 'page' || sandbox === 'raw');
    
    // Fetch @require dependencies
    const requireScripts = [];
    const requires = Array.isArray(meta.require) ? meta.require : (meta.require ? [meta.require] : []);
    
    const failedRequires = [];
    for (const url of requires) {
      try {
        const code = await fetchRequireScript(url);
        if (code) {
          requireScripts.push({ url, code });
        } else {
          failedRequires.push(url);
        }
      } catch (e) {
        console.warn(`[ScriptVault] Failed to fetch @require ${url}:`, e.message);
        failedRequires.push(url);
      }
    }

    // Track failed @require dependencies on the script for UI notification
    if (failedRequires.length > 0) {
      script.settings = script.settings || {};
      script.settings._failedRequires = failedRequires;
      await ScriptStorage.set(script.id, script);
      debugWarn(`${meta.name}: ${failedRequires.length} @require dependency(s) failed to load`);
    } else if (script.settings?._failedRequires) {
      // Clear previous failures
      delete script.settings._failedRequires;
      await ScriptStorage.set(script.id, script);
    }
    
    // Pre-fetch @resource dependencies
    await ResourceCache.prefetchResources(meta.resource);

    // Pre-fetch storage values for this script
    const storedValues = await ScriptValues.getAll(script.id) || {};
    
    // Build the script code with GM API wrapper, @require scripts, and pre-loaded storage
    if (injectIntoPage) {
      debugLog(`Note: @inject-into page / @sandbox raw not fully supported in MV3, running in USER_SCRIPT world: ${meta.name}`);
    }
    const wrappedCode = buildWrappedScript(script, requireScripts, storedValues, regexIncludes, regexExcludes);
    
    // Register the script
    const registration = {
      id: script.id,
      matches: matches,
      excludeMatches: excludeMatches.length > 0 ? excludeMatches : undefined,
      js: [{ code: wrappedCode }],
      runAt: runAt,
      allFrames: !meta.noframes,
      world: world
    };

    // Chrome 133+: configure and use a per-script worldId for isolation.
    // Each script gets its own USER_SCRIPT world so globals don't bleed across scripts.
    let worldConfigured = false;
    try {
      await chrome.userScripts.configureWorld({
        worldId: script.id,
        csp: "script-src 'self' 'unsafe-inline' 'unsafe-eval' *",
        messaging: true
      });
      worldConfigured = true;
    } catch (e) {
      // Chrome <133 doesn't support worldId on configureWorld — fall through to default world
    }

    if (worldConfigured) {
      registration.worldId = script.id;
    }

    try {
      // Chrome 131+ supports messaging in USER_SCRIPT world
      await chrome.userScripts.register([{ ...registration, messaging: world === 'USER_SCRIPT' }]);
    } catch (e) {
      if (e.message?.includes('messaging')) {
        // Fallback for older Chrome versions that don't support the messaging property
        await chrome.userScripts.register([registration]);
      } else {
        throw e;
      }
    }
    
    debugLog(`Registered: ${meta.name} (${requires.length} @require, ${Object.keys(storedValues).length} stored values)`);

    // Apply @webRequest declarativeNetRequest rules if defined
    if (meta.webRequest) {
      const rules = Array.isArray(meta.webRequest) ? meta.webRequest : [meta.webRequest];
      await applyWebRequestRules(script.id, rules);
    }
  } catch (e) {
    console.error(`[ScriptVault] Failed to register ${script.meta?.name || script.id}:`, e);
    // Mark script with registration failure for UI display
    try {
      script.settings = script.settings || {};
      script.settings._registrationError = e.message || 'Registration failed';
      await ScriptStorage.set(script.id, script);
    } catch {}
  }
}

// Cache for @require scripts (in-memory for current session)
// Capped at 500 entries to prevent unbounded memory growth; evicts oldest entry on overflow.
const requireCache = new Map();
const REQUIRE_CACHE_MAX = 500;

function requireCacheSet(key, value) {
  if (!requireCache.has(key) && requireCache.size >= REQUIRE_CACHE_MAX) {
    requireCache.delete(requireCache.keys().next().value);
  }
  requireCache.set(key, value);
}

// Common library fallback URLs
const LIBRARY_FALLBACKS = {
  'jquery': [
    'https://code.jquery.com/jquery-3.7.1.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js',
    'https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js'
  ],
  'jquery@3': [
    'https://code.jquery.com/jquery-3.7.1.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js'
  ],
  'jquery@2': [
    'https://code.jquery.com/jquery-2.2.4.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js'
  ],
  'gm_config': [
    'https://cdn.jsdelivr.net/npm/gm_config@2024.12.1/gm_config.min.js',
    'https://cdn.jsdelivr.net/gh/sizzlemctwizzle/GM_config@master/gm_config.js',
    'https://raw.githubusercontent.com/sizzlemctwizzle/GM_config/master/gm_config.js',
    'https://greasyfork.org/scripts/1884-gm-config/code/gm_config.js',
    'https://openuserjs.org/src/libs/sizzle/GM_config.js'
  ],
  'mutation-summary': [
    'https://cdn.jsdelivr.net/npm/mutation-summary@1.0.1/dist/mutation-summary.min.js',
    'https://cdnjs.cloudflare.com/ajax/libs/mutation-summary/1.0.1/mutation-summary.min.js',
    'https://unpkg.com/mutation-summary@1.0.1/dist/mutation-summary.min.js'
  ]
};

// Find fallback URLs for a library
function getFallbackUrls(url) {
  const lowerUrl = url.toLowerCase();
  
  // Check for known libraries
  if (lowerUrl.includes('gm_config') || lowerUrl.includes('gm-config') || 
      lowerUrl.includes('gm4_config') || lowerUrl.includes('sizzle/gm_config') ||
      lowerUrl.includes('1884-gm-config')) {
    return LIBRARY_FALLBACKS['gm_config'];
  }
  if (lowerUrl.includes('mutation-summary') || lowerUrl.includes('mutationsummary')) {
    return LIBRARY_FALLBACKS['mutation-summary'];
  }
  if (lowerUrl.includes('jquery')) {
    if (lowerUrl.includes('@2') || lowerUrl.includes('2.')) {
      return LIBRARY_FALLBACKS['jquery@2'];
    }
    return LIBRARY_FALLBACKS['jquery'];
  }
  
  // For unpkg URLs, try jsdelivr as fallback
  if (lowerUrl.includes('unpkg.com')) {
    const jsdelivrUrl = url.replace('unpkg.com', 'cdn.jsdelivr.net/npm');
    return [jsdelivrUrl];
  }
  
  // For rawgit/raw.githubusercontent, try jsdelivr gh
  if (lowerUrl.includes('raw.githubusercontent.com')) {
    // Convert: https://raw.githubusercontent.com/user/repo/branch/path
    // To: https://cdn.jsdelivr.net/gh/user/repo@branch/path
    const match = url.match(/raw\.githubusercontent\.com\/([^/]+)\/([^/]+)\/([^/]+)\/(.+)/);
    if (match) {
      const [, user, repo, branch, path] = match;
      return [`https://cdn.jsdelivr.net/gh/${user}/${repo}@${branch}/${path}`];
    }
  }
  
  return [];
}

// Check if a URL is known to be unfetchable (requires auth, blocked by CORS, etc.)
function isUnfetchableUrl(url) {
  const lowerUrl = url.toLowerCase();
  
  // Font Awesome kit URLs require authentication
  if (lowerUrl.includes('kit.fontawesome.com')) {
    return true;
  }
  
  // Google Fonts CSS (not JS, but sometimes used)
  if (lowerUrl.includes('fonts.googleapis.com')) {
    return true;
  }
  
  // URLs with authentication tokens that will fail
  if (lowerUrl.includes('?token=') || lowerUrl.includes('&token=')) {
    return true;
  }
  
  return false;
}

// Fetch a @require script with caching and fallbacks
// Verify SRI hash for fetched content
async function verifySRI(code, hashStr) {
  if (!hashStr) return true;
  // Support formats: sha256-<base64>, md5-<hex>, or just <hex>
  const match = hashStr.match(/^(sha256|sha384|sha512|md5)[-=](.+)$/i);
  if (!match) return true; // Unknown format, skip verification
  const [, algo, expected] = match;
  if (algo.toLowerCase() === 'md5') {
    console.warn('[ScriptVault] SRI: MD5 hash cannot be verified with SubtleCrypto; skipping integrity check for', hashStr);
    return true; // Can't verify MD5 with SubtleCrypto
  }
  const algoMap = { sha256: 'SHA-256', sha384: 'SHA-384', sha512: 'SHA-512' };
  try {
    const digest = await crypto.subtle.digest(algoMap[algo.toLowerCase()], new TextEncoder().encode(code));
    const actual = btoa(String.fromCharCode(...new Uint8Array(digest)));
    return actual === expected;
  } catch (e) {
    console.warn('[ScriptVault] SRI verification error for hash', hashStr, '—', e.message, '; allowing require');
    return true; // Verification not possible, allow
  }
}

async function fetchRequireScript(url) {
  // Extract SRI hash from URL fragment (e.g., url#sha256=abc123 or url#md5=abc123)
  let sriHash = null;
  let fetchUrl = url;
  const hashIdx = url.indexOf('#');
  if (hashIdx > 0) {
    const fragment = url.slice(hashIdx + 1);
    if (/^(sha256|sha384|sha512|md5)[-=]/i.test(fragment)) {
      sriHash = fragment;
      fetchUrl = url.slice(0, hashIdx);
    }
  }

  debugLog('Fetching @require:', fetchUrl);

  // Skip URLs that are known to be unfetchable
  if (isUnfetchableUrl(fetchUrl)) {
    console.warn(`[ScriptVault] Skipping unfetchable @require: ${url}`);
    return null;
  }

  // Check in-memory cache first
  if (requireCache.has(fetchUrl)) {
    debugLog('Using cached @require:', fetchUrl);
    return requireCache.get(fetchUrl);
  }
  
  // Check persistent cache in chrome.storage.local
  // Hash the URL to create a fixed-length collision-resistant cache key
  const cacheKey = await (async () => {
    const data = new TextEncoder().encode(url);
    const hash = await crypto.subtle.digest('SHA-256', data);
    const hex = Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
    return `require_cache_${hex}`;
  })();
  try {
    const cached = await chrome.storage.local.get(cacheKey);
    if (cached[cacheKey]?.code) {
      // Check if cache is less than 7 days old
      const age = Date.now() - (cached[cacheKey].timestamp || 0);
      if (age < 7 * 24 * 60 * 60 * 1000) {
        debugLog('Using persistent cached @require:', url);
        requireCacheSet(fetchUrl, cached[cacheKey].code);
        return cached[cacheKey].code;
      }
    }
  } catch (e) {
    // Ignore cache errors
  }
  
  // Build list of URLs to try (original + fallbacks)
  const fallbacks = getFallbackUrls(fetchUrl);
  const urlsToTry = [fetchUrl, ...fallbacks];
  debugLog(`Will try ${urlsToTry.length} URLs for:`, fetchUrl);

  for (const tryUrl of urlsToTry) {
    try {
      debugLog('Trying:', tryUrl);
      const code = await fetchWithRetry(tryUrl);
      if (code) {
        // Verify SRI hash if provided
        if (sriHash) {
          const valid = await verifySRI(code, sriHash);
          if (!valid) {
            console.warn(`[ScriptVault] SRI hash mismatch for ${tryUrl}, skipping`);
            continue;
          }
        }
        // Store in both caches
        requireCacheSet(fetchUrl, code);
        
        // Store in persistent cache
        try {
          await chrome.storage.local.set({
            [cacheKey]: { code, timestamp: Date.now(), url: tryUrl }
          });
        } catch (e) {
          // Ignore storage errors
        }
        
        if (tryUrl !== url) {
          debugLog(`Successfully fetched ${url} from fallback:`, tryUrl);
        } else {
          debugLog('Successfully fetched:', url);
        }
        return code;
      }
    } catch (e) {
      console.warn(`[ScriptVault] Failed to fetch ${tryUrl}: ${e.message}`);
      // Try next URL
      continue;
    }
  }
  
  console.error(`[ScriptVault] Failed to fetch ${url} (tried ${urlsToTry.length} URLs)`);
  return null;
}

// Fetch with retry and proper options
async function fetchWithRetry(url, retries = 2) {
  for (let i = 0; i <= retries; i++) {
    try {
      const controller = new AbortController();
      const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 second timeout
      
      const response = await fetch(url, {
        method: 'GET',
        headers: {
          'Accept': 'text/javascript, application/javascript, text/plain, */*',
          'Cache-Control': 'no-cache'
        },
        mode: 'cors',
        credentials: 'omit',
        signal: controller.signal
      });
      
      clearTimeout(timeoutId);
      
      if (!response.ok) {
        throw new Error(`HTTP ${response.status}`);
      }

      // Reject excessively large @require scripts (>5MB) to prevent memory issues
      const MAX_REQUIRE_BYTES = 5 * 1024 * 1024;
      const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
      if (contentLength > MAX_REQUIRE_BYTES) {
        throw new Error(`Response too large (${Math.round(contentLength / 1024)}KB, max 5MB)`);
      }

      const code = await response.text();

      if (code.length > MAX_REQUIRE_BYTES) {
        throw new Error(`Response too large (${Math.round(code.length / 1024)}KB, max 5MB)`);
      }

      // Basic validation - should look like JavaScript
      if (code && code.length > 0) {
        return code;
      }

      throw new Error('Empty response');
    } catch (e) {
      if (i === retries) {
        throw e;
      }
      // Wait before retry
      await new Promise(r => setTimeout(r, 500 * (i + 1)));
    }
  }
  return null;
}

// Unregister a single script
// ============================================================================
// GM_webRequest — declarativeNetRequest rule management
// ============================================================================

// Maps scriptId -> array of rule IDs applied via @webRequest / GM_webRequest
// Round 11: Persisted to chrome.storage.local under `_webRequestRuleMap` so the
// map survives SW shutdown. Without persistence, once the SW is killed,
// `removeWebRequestRules` can no longer clean up rules inserted by prior SW
// generations — script deletion would leak DNR rules permanently.
const _webRequestRuleMap = new Map();
let _webRequestRuleMapHydrated = false;
let _webRequestRuleMapHydratingPromise = null;

async function _hydrateWebRequestRuleMap() {
  if (_webRequestRuleMapHydrated) return;
  if (_webRequestRuleMapHydratingPromise) return _webRequestRuleMapHydratingPromise;
  _webRequestRuleMapHydratingPromise = (async () => {
    try {
      const result = await chrome.storage.local.get('_webRequestRuleMap');
      const stored = result?._webRequestRuleMap;
      if (stored && typeof stored === 'object') {
        for (const [scriptId, ruleIds] of Object.entries(stored)) {
          if (Array.isArray(ruleIds) && ruleIds.length > 0) {
            _webRequestRuleMap.set(scriptId, ruleIds);
          }
        }
      }
    } catch (e) {
      console.warn('[ScriptVault] Failed to hydrate _webRequestRuleMap:', e?.message || e);
    } finally {
      _webRequestRuleMapHydrated = true;
      _webRequestRuleMapHydratingPromise = null;
    }
  })();
  return _webRequestRuleMapHydratingPromise;
}

async function _persistWebRequestRuleMap() {
  try {
    const obj = {};
    for (const [scriptId, ruleIds] of _webRequestRuleMap.entries()) {
      obj[scriptId] = ruleIds;
    }
    await chrome.storage.local.set({ _webRequestRuleMap: obj });
  } catch (e) {
    console.warn('[ScriptVault] Failed to persist _webRequestRuleMap:', e?.message || e);
  }
}

// Stable numeric rule ID from a string (scriptId + rule index)
function _makeRuleId(scriptId, index) {
  // Use a hash-like approach: sum char codes * position, full 31-bit range
  // Reserve low bits for rule index (up to 1000 rules per script)
  let h = 0;
  for (let i = 0; i < scriptId.length; i++) h = (h * 31 + scriptId.charCodeAt(i)) & 0x7fffffff;
  // Use upper 21 bits for script hash (2M buckets) + lower 10 bits for index (1024 rules)
  return (((h & 0x1fffff) << 10) | (index & 0x3ff)) + 1;
}

// Translate GM_webRequest rule selector/action to declarativeNetRequest format
function _translateWebRequestRule(rule, ruleId) {
  const dnr = { id: ruleId, priority: rule.priority || 1, condition: {}, action: {} };

  // Selector -> condition
  const sel = rule.selector || {};
  if (sel.url) {
    const urlFilter = sel.url;
    if (Array.isArray(urlFilter)) {
      // Multiple URL patterns: pick first include (DNR only supports one urlFilter per rule)
      const incl = urlFilter.find(u => u.include);
      if (incl) dnr.condition.urlFilter = incl.include;
      const excl = urlFilter.find(u => u.exclude);
      if (excl) dnr.condition.excludedInitiatorDomains = [excl.exclude.replace(/\*/g, '')].filter(Boolean);
    } else if (typeof urlFilter === 'string') {
      dnr.condition.urlFilter = urlFilter;
    }
  }
  if (sel.tab) dnr.condition.tabIds = Array.isArray(sel.tab) ? sel.tab : [sel.tab];
  if (sel.type) dnr.condition.resourceTypes = Array.isArray(sel.type) ? sel.type : [sel.type];

  // Action
  const act = rule.action || {};
  if (act.cancel) {
    dnr.action.type = 'block';
  } else if (act.redirect) {
    dnr.action.type = 'redirect';
    dnr.action.redirect = typeof act.redirect === 'string'
      ? { url: act.redirect }
      : { url: act.redirect.url || act.redirect.regexSubstitution || '' };
  } else if (act.setRequestHeaders) {
    dnr.action.type = 'modifyHeaders';
    dnr.action.requestHeaders = Object.entries(act.setRequestHeaders).map(([name, value]) =>
      value === null ? { header: name, operation: 'remove' } : { header: name, operation: 'set', value }
    );
  } else if (act.setResponseHeaders) {
    dnr.action.type = 'modifyHeaders';
    dnr.action.responseHeaders = Object.entries(act.setResponseHeaders).map(([name, value]) =>
      value === null ? { header: name, operation: 'remove' } : { header: name, operation: 'set', value }
    );
  } else {
    return null; // unsupported action
  }

  return dnr;
}

async function applyWebRequestRules(scriptId, rules) {
  if (!chrome.declarativeNetRequest || !Array.isArray(rules) || rules.length === 0) return;
  try {
    // Round 11: Ensure map is rehydrated from storage before mutating (SW may have restarted)
    await _hydrateWebRequestRuleMap();
    // Remove any existing rules for this script first
    await removeWebRequestRules(scriptId);

    const dnrRules = [];
    const ruleIds = [];
    rules.forEach((rule, idx) => {
      const ruleId = _makeRuleId(scriptId, idx);
      const dnr = _translateWebRequestRule(rule, ruleId);
      if (dnr) {
        dnrRules.push(dnr);
        ruleIds.push(ruleId);
      }
    });

    if (dnrRules.length > 0) {
      // Check dynamic rule quota (Chrome limit: 30,000)
      const existing = await chrome.declarativeNetRequest.getDynamicRules();
      if (existing.length + dnrRules.length > 30000) {
        console.warn(`[ScriptVault] DNR rule limit would be exceeded: ${existing.length} + ${dnrRules.length} > 30000`);
        return;
      }
      await chrome.declarativeNetRequest.updateDynamicRules({ addRules: dnrRules });
      _webRequestRuleMap.set(scriptId, ruleIds);
      await _persistWebRequestRuleMap();
      debugLog(`[GM_webRequest] Applied ${dnrRules.length} rules for script ${scriptId}`);
    }
  } catch (e) {
    console.warn('[ScriptVault] GM_webRequest rule apply failed:', e.message);
  }
}

async function removeWebRequestRules(scriptId) {
  if (!chrome.declarativeNetRequest) return;
  // Round 11: Rehydrate from storage before reading — the SW may have restarted
  // since the rules were originally inserted, and without this the in-memory Map
  // would be empty and we'd silently leak the DNR rules.
  await _hydrateWebRequestRuleMap();
  const existing = _webRequestRuleMap.get(scriptId);
  if (existing && existing.length > 0) {
    try {
      await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existing });
    } catch (e) {}
    _webRequestRuleMap.delete(scriptId);
    await _persistWebRequestRuleMap();
  }
}

async function unregisterScript(scriptId) {
  // Clear @crontab alarm if present
  chrome.alarms.clear('crontab_' + scriptId).catch(() => {});
  // Remove any @webRequest declarativeNetRequest rules
  await removeWebRequestRules(scriptId);
  try {
    if (!chrome.userScripts) return;
    await chrome.userScripts.unregister({ ids: [scriptId] });
    // Chrome 133+: reset the per-script world configuration to free resources
    try {
      await chrome.userScripts.resetWorldConfiguration({ worldId: scriptId });
    } catch (e) {
      // Chrome <133 doesn't support resetWorldConfiguration — ignore
    }
  } catch (e) {
    // Script might not be registered
  }
}

// Build wrapped script code with GM API
function buildWrappedScript(script, requireScripts = [], preloadedStorage = {}, regexIncludes = [], regexExcludes = []) {
  const meta = script.meta;
  const grants = meta.grant || ['none'];
  
  // Build @require scripts section
  // Code runs INSIDE the main IIFE after GM APIs are available
  // No try/catch wrapper because let/const are block-scoped and wouldn't escape
  let requireCode = '';
  for (const req of requireScripts) {
    const safeUrl = req.url.replace(/\*\//g, '* /');
    requireCode += `
// @require ${safeUrl}
${req.code}
`;
  }
  
  // After @require code, expose common libraries to window for cross-script access
  const libraryExports = requireCode ? `
  // Expose common @require libraries to window
  if (typeof GM_config !== 'undefined' && typeof window.GM_config === 'undefined') window.GM_config = GM_config;
  if (typeof GM_configStruct !== 'undefined' && typeof window.GM_configStruct === 'undefined') window.GM_configStruct = GM_configStruct;
  if (typeof $ !== 'undefined' && typeof window.$ === 'undefined') window.$ = $;
  if (typeof jQuery !== 'undefined' && typeof window.jQuery === 'undefined') window.jQuery = jQuery;
  if (typeof Fuse !== 'undefined' && typeof window.Fuse === 'undefined') window.Fuse = Fuse;
  if (typeof JSZip !== 'undefined' && typeof window.JSZip === 'undefined') window.JSZip = JSZip;
` : '';
  
  // Build the GM API initialization with pre-loaded storage
  // Get the extension ID at build time so it's available in the wrapper
  const extId = chrome.runtime.id;
  
  const apiInit = `
(function() {
  'use strict';
  
  // ============ Console Capture (v2.0) ============
  // Intercept console.log/warn/error for per-script debugging
  {
    const _origConsole = { log: console.log, warn: console.warn, error: console.error, info: console.info, debug: console.debug };
    const _scriptId = ${JSON.stringify(script.id)};
    const _captureLimit = 200;
    let _captureBuffer = [];
    function _captureConsole(level, args) {
      try {
        _captureBuffer.push({ level, args: Array.from(args).map(a => { try { return typeof a === 'object' ? JSON.stringify(a).slice(0, 500) : String(a); } catch { return String(a); } }), timestamp: Date.now() });
        if (_captureBuffer.length > _captureLimit) _captureBuffer.shift();
        // Batch-send every 2 seconds
        if (!_captureConsole._timer) {
          _captureConsole._timer = setTimeout(() => {
            try { chrome.runtime.sendMessage({ action: 'scriptConsoleCapture', scriptId: _scriptId, entries: _captureBuffer.splice(0) }); } catch {}
            _captureConsole._timer = null;
          }, 2000);
        }
      } catch {}
    }
    console.log = function() { _captureConsole('log', arguments); return _origConsole.log.apply(console, arguments); };
    console.warn = function() { _captureConsole('warn', arguments); return _origConsole.warn.apply(console, arguments); };
    console.error = function() { _captureConsole('error', arguments); return _origConsole.error.apply(console, arguments); };
    console.info = function() { _captureConsole('info', arguments); return _origConsole.info.apply(console, arguments); };
    console.debug = function() { _captureConsole('debug', arguments); return _origConsole.debug.apply(console, arguments); };
  }
  // ============ End Console Capture ============

  // ============ Error Suppression ============
  // Suppress uncaught errors and unhandled rejections from userscripts
  // to prevent them from appearing on chrome://extensions error page.
  // Chrome captures any error/warn/log from USER_SCRIPT world, so we
  // must silently swallow these without any console output.
  window.addEventListener('error', function(event) {
    event.stopImmediatePropagation();
    event.preventDefault();
    // Report to error log
    try { chrome.runtime.sendMessage({ action: 'logError', entry: { scriptId: ${JSON.stringify(script.id)}, scriptName: ${JSON.stringify(meta.name)}, error: event.message || 'Unknown error', url: location.href, line: event.lineno, col: event.colno, timestamp: Date.now() } }); } catch {}
    return true;
  }, true);
  window.addEventListener('unhandledrejection', function(event) {
    event.stopImmediatePropagation();
    event.preventDefault();
    try { chrome.runtime.sendMessage({ action: 'logError', entry: { scriptId: ${JSON.stringify(script.id)}, scriptName: ${JSON.stringify(meta.name)}, error: event.reason?.message || String(event.reason) || 'Unhandled rejection', url: location.href, timestamp: Date.now() } }); } catch {}
  }, true);
  // ============ End Error Suppression ============

  ${meta['run-in'] === 'incognito-tabs' ? `
  // ============ @run-in incognito-tabs Guard ============
  if (!chrome?.extension?.inIncognitoContext) return;
  // ============ End @run-in Guard ============
` : meta['run-in'] === 'normal-tabs' ? `
  // ============ @run-in normal-tabs Guard ============
  if (chrome?.extension?.inIncognitoContext) return;
  // ============ End @run-in Guard ============
` : ''}
  ${(() => {
    const validIncludes = regexIncludes.map(p => {
      const m = p.match(/^\/(.+)\/([gimsuy]*)$/);
      return m ? `new RegExp(${JSON.stringify(m[1])}, ${JSON.stringify(m[2])})` : null;
    }).filter(Boolean);
    const validExcludes = regexExcludes.map(p => {
      const m = p.match(/^\/(.+)\/([gimsuy]*)$/);
      return m ? `new RegExp(${JSON.stringify(m[1])}, ${JSON.stringify(m[2])})` : null;
    }).filter(Boolean);
    if (validIncludes.length === 0 && validExcludes.length === 0) return '';
    return `
  // ============ Regex @include/@exclude URL Guard ============
  {
    const __url = location.href;
    ${validIncludes.length > 0 ? `const __regexIncludes = [${validIncludes.join(', ')}];
    const __includeMatch = __regexIncludes.some(re => re.test(__url));
    if (!__includeMatch) return;` : ''}
    ${validExcludes.length > 0 ? `const __regexExcludes = [${validExcludes.join(', ')}];
    const __excludeMatch = __regexExcludes.some(re => re.test(__url));
    if (__excludeMatch) return;` : ''}
  }
  // ============ End URL Guard ============
`;
  })()}
  const scriptId = ${JSON.stringify(script.id)};
  const meta = ${JSON.stringify(meta)};
  const grants = ${JSON.stringify(grants)};
  const grantSet = new Set(grants);
  
  // Channel ID for communication with content script bridge
  // Extension ID is injected at build time since chrome.runtime isn't available in USER_SCRIPT world
  const CHANNEL_ID = ${JSON.stringify('ScriptVault_' + extId)};
  
  // console.log('[ScriptVault] Script initializing:', meta.name, 'Channel:', CHANNEL_ID);
  
  // Grant checking - @grant none or empty grants means NO APIs except GM_info
  const hasNone = grantSet.has('none');
  const hasGrant = (n) => {
    if (hasNone || grants.length === 0) return false;
    return grantSet.has(n) || grantSet.has('*');
  };
  
  // GM_info - always available
  const GM_info = {
    script: {
      name: meta.name || 'Unknown',
      namespace: meta.namespace || '',
      description: meta.description || '',
      version: meta.version || '1.0',
      author: meta.author || '',
      homepage: meta.homepage || meta.homepageURL || '',
      icon: meta.icon || '',
      icon64: meta.icon64 || '',
      matches: meta.match || [],
      includes: meta.include || [],
      excludes: meta.exclude || [],
      excludeMatches: meta.excludeMatch || [],
      grants: grants,
      resources: meta.resource || {},
      requires: meta.require || [],
      runAt: meta['run-at'] || 'document-idle',
      connect: meta.connect || [],
      noframes: meta.noframes || false,
      unwrap: meta.unwrap || false,
      antifeatures: meta.antifeature || [],
      tags: meta.tag || [],
      license: meta.license || '',
      updateURL: meta.updateURL || '',
      downloadURL: meta.downloadURL || '',
      supportURL: meta.supportURL || ''
    },
    scriptMetaStr: ${JSON.stringify(script.code.match(/\/\/\s*==UserScript==([\s\S]*?)\/\/\s*==\/UserScript==/)?.[0] || '')},
    scriptHandler: 'ScriptVault',
    scriptSource: 'ScriptVault',
    version: ${JSON.stringify(chrome.runtime.getManifest().version)},
    scriptWillUpdate: !!(meta.updateURL || meta.downloadURL),
    isIncognito: typeof chrome !== 'undefined' && chrome.extension ? chrome.extension.inIncognitoContext : false,
    injectInto: ${JSON.stringify(meta['inject-into'] || 'auto')},
    downloadMode: 'browser',
    platform: {
      os: navigator.userAgentData?.platform || navigator.platform || 'unknown',
      arch: navigator.userAgentData?.architecture || 'unknown',
      browserName: 'Chrome',
      browserVersion: navigator.userAgent?.match(/Chrome\\/([\\d.]+)/)?.[1] || 'unknown'
    },
    uuid: ${JSON.stringify(script.id)}
  };
  
  // Storage cache - mutable so we can refresh it with fresh values from background
  // Pre-loaded values serve as fallback if background fetch fails
  let _cache = ${JSON.stringify(preloadedStorage)};
  let _cacheReady = false; // Track if we've fetched fresh values
  let _cacheReadyPromise = null;
  let _cacheReadyResolve = null;
  
  // XHR request tracking (like Violentmonkey's idMap)
  const _xhrRequests = new Map(); // requestId -> { details, aborted }
  let _xhrSeqId = 0;
  
  // Value change listeners (like Tampermonkey)
  const _valueChangeListeners = new Map(); // listenerId -> { key, callback }
  let _valueChangeListenerId = 0;
  
  // Listen for messages from content script (for menu commands, value changes, and XHR events)
  window.addEventListener('message', (event) => {
    if (event.source !== window) return;
    const msg = event.data;
    if (!msg || msg.channel !== CHANNEL_ID || msg.direction !== 'to-userscript') return;
    
    // Handle menu command execution
    if (msg.type === 'menuCommand' && msg.scriptId === scriptId) {
      const cmd = _menuCmds.get(msg.commandId);
      if (cmd?.callback) try { cmd.callback(); } catch(err) { /* silently ignore menu command errors */ }
    }
    
    // Handle value change notifications (cross-tab sync)
    if (msg.type === 'valueChanged' && msg.scriptId === scriptId) {
      const oldValue = _cache[msg.key];
      if (msg.newValue === undefined) {
        delete _cache[msg.key];
      } else {
        _cache[msg.key] = msg.newValue;
      }
      // Notify value change listeners
      _valueChangeListeners.forEach((listener) => {
        if (listener.key === msg.key || listener.key === null) {
          try {
            listener.callback(msg.key, oldValue, msg.newValue, msg.remote !== false);
          } catch (e) {
            /* silently ignore value change listener errors */
          }
        }
      });
    }
    
    // Handle XHR events
    if (msg.type === 'xhrEvent' && msg.scriptId === scriptId) {
      const request = _xhrRequests.get(msg.requestId);
      if (!request || request.aborted) return;
      
      const { details } = request;
      const eventType = msg.eventType;
      const eventData = msg.data || {};
      
      // Decode binary responses transferred as base64/dataURL
      let responseValue = eventData.response;
      if (responseValue && typeof responseValue === 'object' && responseValue.__sv_base64__) {
        // arraybuffer: base64 -> ArrayBuffer
        const binary = atob(responseValue.data);
        const bytes = new Uint8Array(binary.length);
        for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
        responseValue = bytes.buffer;
      } else if (details.responseType === 'blob' && typeof responseValue === 'string' && responseValue.startsWith('data:')) {
        // blob: data URL -> Blob
        try {
          const [header, b64] = responseValue.split(',');
          const mime = header.match(/:(.*?);/)?.[1] || 'application/octet-stream';
          const binary = atob(b64);
          const bytes = new Uint8Array(binary.length);
          for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
          responseValue = new Blob([bytes], { type: mime });
        } catch (e) {
          // Fall through with data URL string if conversion fails
        }
      }

      // Build response object matching GM_xmlhttpRequest spec
      const response = {
        readyState: eventData.readyState || 0,
        status: eventData.status || 0,
        statusText: eventData.statusText || '',
        responseHeaders: eventData.responseHeaders || '',
        response: responseValue,
        responseText: eventData.responseText || '',
        responseXML: eventData.responseXML,
        finalUrl: eventData.finalUrl || details.url,
        context: details.context,
        lengthComputable: eventData.lengthComputable,
        loaded: eventData.loaded,
        total: eventData.total
      };
      
      // Call appropriate callback
      const callbackName = 'on' + eventType;
      if (eventType.startsWith('upload.')) {
        const uploadEvent = eventType.replace('upload.', '');
        if (details.upload && details.upload['on' + uploadEvent]) {
          try {
            details.upload['on' + uploadEvent](response);
          } catch (e) {
            /* silently ignore XHR upload callback errors */
          }
        }
      } else if (details[callbackName]) {
        try {
          details[callbackName](response);
        } catch (e) {
          /* silently ignore XHR callback errors */
        }
      }
      
      // Clean up on loadend
      if (eventType === 'loadend') {
        _xhrRequests.delete(msg.requestId);
      }
    }
  });
  
  // Bridge ready state tracking
  let _bridgeReady = false;
  let _bridgeReadyPromise = null;
  let _bridgeReadyResolve = null;
  
  // Wait for bridge to be ready
  function waitForBridge() {
    // Check if already ready (content script sets this global)
    if (window.__ScriptVault_BridgeReady__ || _bridgeReady) {
      _bridgeReady = true;
      return Promise.resolve();
    }
    
    // Return existing promise if already waiting
    if (_bridgeReadyPromise) return _bridgeReadyPromise;
    
    // Create promise to wait for bridge ready message
    _bridgeReadyPromise = new Promise((resolve) => {
      _bridgeReadyResolve = resolve;
      
      // Listen for bridgeReady message from content script
      function bridgeReadyHandler(event) {
        if (event.source !== window) return;
        const msg = event.data;
        if (!msg || msg.channel !== CHANNEL_ID || msg.direction !== 'to-userscript') return;
        if (msg.type === 'bridgeReady') {
          window.removeEventListener('message', bridgeReadyHandler);
          _bridgeReady = true;
          resolve();
        }
      }
      window.addEventListener('message', bridgeReadyHandler);
      
      // Also check global flag periodically (fallback)
      const checkInterval = setInterval(() => {
        if (window.__ScriptVault_BridgeReady__) {
          clearInterval(checkInterval);
          window.removeEventListener('message', bridgeReadyHandler);
          _bridgeReady = true;
          resolve();
        }
      }, 10);
      
      // Timeout after 1 second - bridge should be ready much faster
      setTimeout(() => {
        clearInterval(checkInterval);
        window.removeEventListener('message', bridgeReadyHandler);
        if (!_bridgeReady) {
          // This is normal in some contexts, proceed without warning spam
          _bridgeReady = true;
          resolve();
        }
      }, 1000);
    });
    
    return _bridgeReadyPromise;
  }
  
  // Send message to background script
  // Prefers chrome.runtime.sendMessage (direct, no bridge needed) when available via messaging: true
  // Falls back to postMessage bridge for older Chrome versions
  async function sendToBackground(action, data) {
    // Try direct messaging first (available when userScripts world has messaging: true)
    if (typeof chrome !== 'undefined' && chrome.runtime && chrome.runtime.sendMessage) {
      try {
        return await chrome.runtime.sendMessage({ action, data });
      } catch (e) {
        // Extension context invalidated or messaging not available, fall through to bridge
      }
    }

    // Fallback: use content script bridge via postMessage
    await waitForBridge();

    return new Promise((resolve, reject) => {
      const id = Math.random().toString(36).substring(2) + Date.now().toString(36);

      // Set timeout for response
      const timeout = setTimeout(() => {
        window.removeEventListener('message', handler);
        resolve(undefined);
      }, 10000);

      // Listen for response
      function handler(event) {
        if (event.source !== window) return;
        const msg = event.data;
        if (!msg || msg.channel !== CHANNEL_ID || msg.direction !== 'to-userscript') return;
        if (msg.id !== id) return;

        window.removeEventListener('message', handler);
        clearTimeout(timeout);

        if (msg.success) {
          resolve(msg.result);
        } else {
          resolve(undefined);
        }
      }

      window.addEventListener('message', handler);

      // Send to content script bridge
      window.postMessage({
        channel: CHANNEL_ID,
        direction: 'to-background',
        id: id,
        action: action,
        data: data
      }, '*');
    });
  }

  // Refresh storage cache from background
  // This ensures we have the latest values, not stale values from registration time
  async function _refreshStorageCache() {
    if (_cacheReady) return;
    
    try {
      const freshValues = await sendToBackground('GM_getValues', { scriptId });
      if (freshValues && typeof freshValues === 'object') {
        // Merge fresh values with any local changes made before refresh completed
        _cache = { ..._cache, ...freshValues };
      }
      _cacheReady = true;
      if (_cacheReadyResolve) _cacheReadyResolve();
    } catch (e) {
      // If refresh fails, continue with pre-loaded values
      _cacheReady = true;
      if (_cacheReadyResolve) _cacheReadyResolve();
    }
  }
  
  // Start refreshing cache immediately (don't await - let script start running)
  // Scripts can use GM_getValue immediately with pre-loaded values
  // Fresh values will be available after the async refresh completes
  _refreshStorageCache();
  
  // Synchronous GM_getValue - returns from cache (pre-loaded or refreshed)
  function GM_getValue(key, defaultValue) {
    if (!hasGrant('GM_getValue') && !hasGrant('GM.getValue')) return defaultValue;
    if (key in _cache) return _cache[key];
    return defaultValue;
  }
  
  // GM_setValue - updates cache IMMEDIATELY, persists async (like Tampermonkey/Violentmonkey)
  function GM_setValue(key, value) {
    if (!hasGrant('GM_setValue') && !hasGrant('GM.setValue')) {
      return;
    }
    // Update local cache IMMEDIATELY - this makes subsequent GM_getValue instant
    _cache[key] = value;
    // Persist async (fire and forget) - background handles debouncing
    sendToBackground('GM_setValue', { scriptId, key, value }).catch(() => {});
    return value;
  }
  
  // GM_deleteValue
  function GM_deleteValue(key) {
    if (!hasGrant('GM_deleteValue') && !hasGrant('GM.deleteValue')) return;
    delete _cache[key];
    sendToBackground('GM_deleteValue', { scriptId, key }).catch(() => {});
  }
  
  // GM_listValues - returns cached keys synchronously
  function GM_listValues() {
    if (!hasGrant('GM_listValues') && !hasGrant('GM.listValues')) return [];
    return Object.keys(_cache);
  }
  
  // GM_getValues - Get multiple values at once (like Violentmonkey)
  // Accepts array of keys or object with default values
  function GM_getValues(keysOrDefaults) {
    if (!hasGrant('GM_getValue') && !hasGrant('GM.getValue') && 
        !hasGrant('GM_getValues') && !hasGrant('GM.getValues')) {
      return Array.isArray(keysOrDefaults) ? {} : keysOrDefaults;
    }
    const result = {};
    if (Array.isArray(keysOrDefaults)) {
      // Array of keys - return values or undefined
      for (const key of keysOrDefaults) {
        if (key in _cache) {
          result[key] = _cache[key];
        }
      }
    } else if (typeof keysOrDefaults === 'object' && keysOrDefaults !== null) {
      // Object with defaults - return values or defaults
      for (const key of Object.keys(keysOrDefaults)) {
        result[key] = key in _cache ? _cache[key] : keysOrDefaults[key];
      }
    }
    return result;
  }
  
  // GM_setValues - Set multiple values at once (like Violentmonkey)
  function GM_setValues(values) {
    if (!hasGrant('GM_setValue') && !hasGrant('GM.setValue') &&
        !hasGrant('GM_setValues') && !hasGrant('GM.setValues')) {
      return;
    }
    if (typeof values !== 'object' || values === null) return;
    
    // Update local cache immediately for all values
    for (const [key, value] of Object.entries(values)) {
      _cache[key] = value;
    }
    // Persist all values to background in one call
    sendToBackground('GM_setValues', { scriptId, values }).catch(() => {});
  }
  
  // GM_deleteValues - Delete multiple values at once (like Violentmonkey)
  function GM_deleteValues(keys) {
    if (!hasGrant('GM_deleteValue') && !hasGrant('GM.deleteValue') &&
        !hasGrant('GM_deleteValues') && !hasGrant('GM.deleteValues')) {
      return;
    }
    if (!Array.isArray(keys)) return;
    
    // Delete from local cache immediately
    for (const key of keys) {
      delete _cache[key];
    }
    // Persist deletions to background in one call
    sendToBackground('GM_deleteValues', { scriptId, keys }).catch(() => {});
  }
  
  // GM_addStyle - inject CSS with robust DOM handling
  function GM_addStyle(css) {
    const style = document.createElement('style');
    style.textContent = css;
    style.setAttribute('data-scriptvault', scriptId);
    
    // Try to inject immediately
    function inject() {
      const target = document.head || document.documentElement || document.body;
      if (target && target.appendChild) {
        try {
          target.appendChild(style);
          return true;
        } catch (e) {
          // appendChild failed, will retry
        }
      }
      return false;
    }
    
    if (!inject()) {
      // DOM not ready - wait for it
      if (document.readyState === 'loading') {
        // Document still loading, wait for DOMContentLoaded
        document.addEventListener('DOMContentLoaded', () => inject(), { once: true });
      } else {
        // Document loaded but no valid target - use MutationObserver
        const observer = new MutationObserver(() => {
          if (inject()) {
            observer.disconnect();
          }
        });
        
        // Observe whatever root we can find
        const root = document.documentElement || document;
        if (root && root.nodeType === Node.ELEMENT_NODE) {
          observer.observe(root, { childList: true, subtree: true });
        }
        
        // Fallback timeout - try one more time after a delay
        setTimeout(() => {
          observer.disconnect();
          if (!style.parentNode) {
            inject();
          }
        }, 1000);
      }
    }
    
    return style;
  }
  
  // GM_xmlhttpRequest - Full implementation with all events (like Violentmonkey)
  function GM_xmlhttpRequest(details) {
    if (!hasGrant('GM_xmlhttpRequest') && !hasGrant('GM.xmlHttpRequest')) {
      if (details.onerror) details.onerror({ error: 'Permission denied', status: 0 });
      return { abort: () => {} };
    }
    
    // Generate unique request ID
    const localId = 'xhr_' + (++_xhrSeqId) + '_' + Date.now().toString(36);
    let requestId = null;
    let aborted = false;
    let currentMapKey = localId;

    // Store request details for event handling
    const requestEntry = { details, aborted: false };
    _xhrRequests.set(localId, requestEntry);

    // Control object returned to the script
    const control = {
      abort: () => {
        aborted = true;
        requestEntry.aborted = true;
        // Send abort using server ID if available, clean up both keys
        if (requestId) {
          sendToBackground('GM_xmlhttpRequest_abort', { requestId }).catch(() => {});
        }
        // Call onabort callback
        if (details.onabort) {
          try {
            details.onabort({ error: 'Aborted', status: 0 });
          } catch (e) {}
        }
        // Clean up both possible keys to avoid orphans
        _xhrRequests.delete(localId);
        if (requestId) _xhrRequests.delete(requestId);
      }
    };

    // Serialize request body to a structured-clone-safe format.
    // Blob/File/FormData cannot cross the extension messaging boundary natively.
    async function _serializeBody(d) {
      if (!d || typeof d === 'string' || d instanceof ArrayBuffer || ArrayBuffer.isView(d)) return d;
      if (d instanceof URLSearchParams) return d.toString();
      function _ab2b64(buf) {
        const bytes = new Uint8Array(buf), chunk = 8192;
        let s = '';
        for (let i = 0; i < bytes.length; i += chunk) s += String.fromCharCode(...bytes.subarray(i, i + chunk));
        return btoa(s);
      }
      if (d instanceof Blob || d instanceof File) {
        const buf = await d.arrayBuffer();
        return { __sv_blob__: true, b64: _ab2b64(buf), type: d.type, name: d instanceof File ? d.name : undefined };
      }
      if (d instanceof FormData) {
        const entries = [];
        for (const [name, val] of d.entries()) {
          if (val instanceof Blob || val instanceof File) {
            const buf = await val.arrayBuffer();
            entries.push({ name, b64: _ab2b64(buf), type: val.type, filename: val instanceof File ? val.name : 'blob' });
          } else {
            entries.push({ name, value: val });
          }
        }
        return { __sv_formdata__: true, entries };
      }
      return d;
    }

    // Start the request (async to allow body serialization)
    (async () => {
      const serializedData = await _serializeBody(details.data);
      const response = await sendToBackground('GM_xmlhttpRequest', {
        scriptId,
        method: details.method || 'GET',
        url: details.url,
        headers: details.headers,
        data: serializedData,
        timeout: details.timeout,
        responseType: details.responseType,
        overrideMimeType: details.overrideMimeType,
        user: details.user,
        password: details.password,
        context: details.context,
        anonymous: details.anonymous,
        // Track which callbacks are registered so background knows what to send
        hasCallbacks: {
          onload: !!details.onload,
          onerror: !!details.onerror,
          onprogress: !!details.onprogress,
          onreadystatechange: !!details.onreadystatechange,
          ontimeout: !!details.ontimeout,
          onabort: !!details.onabort,
          onloadstart: !!details.onloadstart,
          onloadend: !!details.onloadend,
          upload: !!(details.upload && (
            details.upload.onprogress || 
            details.upload.onloadstart || 
            details.upload.onload || 
            details.upload.onerror
          ))
        }
      });
      if (aborted) return;

      if (!response) {
        // No response (bridge failure)
        if (details.onerror) details.onerror({ error: 'Request failed - no response', status: 0 });
        _xhrRequests.delete(currentMapKey);
      } else if (response.error) {
        // Immediate error
        if (details.onerror) details.onerror({ error: response.error, status: 0 });
        _xhrRequests.delete(currentMapKey);
      } else if (response.requestId) {
        // Re-key: add server ID entry, then remove local ID
        requestId = response.requestId;
        _xhrRequests.set(requestId, requestEntry);
        _xhrRequests.delete(localId);
        currentMapKey = requestId;
      }
    })().catch(err => {
      if (aborted) return;
      if (details.onerror) details.onerror({ error: err.message || 'Request failed', status: 0 });
      _xhrRequests.delete(currentMapKey);
    });
    
    return control;
  }
  
  // GM_addValueChangeListener - Watch for value changes (like Tampermonkey)
  function GM_addValueChangeListener(key, callback) {
    if (!hasGrant('GM_addValueChangeListener') && !hasGrant('GM.addValueChangeListener')) return null;
    if (typeof callback !== 'function') return null;
    
    const listenerId = ++_valueChangeListenerId;
    _valueChangeListeners.set(listenerId, { key, callback });
    return listenerId;
  }
  
  // GM_removeValueChangeListener - Stop watching for value changes
  function GM_removeValueChangeListener(listenerId) {
    if (!hasGrant('GM_removeValueChangeListener') && !hasGrant('GM.removeValueChangeListener')) return false;
    return _valueChangeListeners.delete(listenerId);
  }
  
  // GM_setClipboard
  function GM_setClipboard(text, type) {
    if (!hasGrant('GM_setClipboard') && !hasGrant('GM.setClipboard')) return;
    if (navigator.clipboard && navigator.clipboard.writeText) {
      navigator.clipboard.writeText(text).catch(() => fallbackCopyText(text));
    } else {
      fallbackCopyText(text);
    }
  }
  
  function fallbackCopyText(text) {
    const target = document.body || document.documentElement;
    if (!target) return;
    const ta = document.createElement('textarea');
    ta.value = text;
    ta.style.cssText = 'position:fixed;left:-9999px;top:-9999px';
    target.appendChild(ta);
    ta.select();
    try { document.execCommand('copy'); } catch(e) {}
    ta.remove();
  }
  
  // GM_head — convenience wrapper for HEAD requests
  function GM_head(url, callback) {
    if (!hasGrant('GM_xmlhttpRequest') && !hasGrant('GM.xmlHttpRequest')) {
      if (typeof callback === 'function') callback({ error: 'Missing @grant GM_xmlhttpRequest' });
      return;
    }
    GM_xmlhttpRequest({ method: 'HEAD', url, onload: callback, onerror: callback });
  }

  // GM_notification (with onclick, ondone, timeout, tag, silent, highlight, url)
  const _notifCallbacks = new Map();
  function GM_notification(details, ondone) {
    if (!hasGrant('GM_notification') && !hasGrant('GM.notification')) return;
    let opts;
    if (typeof details === 'string') {
      // GM_notification(text, title, image, onclick)
      opts = { text: details, title: ondone, image: arguments[2] };
      const onclickArg = arguments[3];
      if (typeof onclickArg === 'function') opts.onclick = onclickArg;
      ondone = undefined;
    } else {
      opts = details;
    }
    if (typeof ondone === 'function') opts.ondone = ondone;
    const notifTag = opts.tag || ('notif_' + Math.random().toString(36).substring(2));
    // Store callbacks
    _notifCallbacks.set(notifTag, {
      onclick: opts.onclick, ondone: opts.ondone
    });
    // Highlight tab instead of notification
    if (opts.highlight) {
      sendToBackground('GM_focusTab', {}).catch(() => {});
      if (opts.ondone) { try { opts.ondone(); } catch(e) {} }
      _notifCallbacks.delete(notifTag); // Clean up — no notification created
      return;
    }
    sendToBackground('GM_notification', {
      scriptId,
      title: opts.title || GM_info.script.name,
      text: opts.text || opts.body || '',
      image: opts.image,
      timeout: opts.timeout || 0,
      tag: notifTag,
      silent: opts.silent || false,
      hasOnclick: !!opts.onclick,
      hasOndone: !!opts.ondone
    }).catch(() => { _notifCallbacks.delete(notifTag); });
  }
  
  // GM_openInTab (with close(), onclose, insert, setParent, incognito)
  const _openedTabs = new Map();
  function GM_openInTab(url, options) {
    if (!hasGrant('GM_openInTab') && !hasGrant('GM.openInTab')) return null;
    const opts = typeof options === 'boolean' ? { active: !options } : (options || {});
    const tabHandle = { closed: false, onclose: null, close: () => {} };
    sendToBackground('GM_openInTab', {
      url, scriptId, trackClose: true,
      active: opts.active, insert: opts.insert,
      setParent: opts.setParent, background: opts.background
    }).then(result => {
      if (result && result.tabId) {
        _openedTabs.set(result.tabId, tabHandle);
        tabHandle.close = () => {
          sendToBackground('GM_closeTab', { tabId: result.tabId }).catch(() => {});
          tabHandle.closed = true;
        };
      }
    }).catch(() => {});
    return tabHandle;
  }
  
  // GM_download (with onload, onerror, onprogress, ontimeout callbacks)
  const _downloadCallbacks = new Map();
  function GM_download(details) {
    if (!hasGrant('GM_download') && !hasGrant('GM.download')) return;
    let opts;
    if (typeof details === 'string') {
      opts = { url: details, name: arguments[1] || details.split('/').pop() };
    } else {
      opts = { ...details };
    }
    const callbacks = {
      onload: opts.onload, onerror: opts.onerror,
      onprogress: opts.onprogress, ontimeout: opts.ontimeout
    };
    delete opts.onload; delete opts.onerror;
    delete opts.onprogress; delete opts.ontimeout;
    opts.scriptId = scriptId;
    opts.hasCallbacks = !!(callbacks.onload || callbacks.onerror || callbacks.onprogress || callbacks.ontimeout);
    sendToBackground('GM_download', opts).then(result => {
      if (result && result.downloadId) {
        _downloadCallbacks.set(result.downloadId, callbacks);
      }
      if (result && result.error) {
        if (callbacks.onerror) try { callbacks.onerror({ error: result.error }); } catch(e) {}
        if (result.downloadId) _downloadCallbacks.delete(result.downloadId);
      }
    }).catch(e => {
      if (callbacks.onerror) try { callbacks.onerror({ error: e.message || 'Download failed' }); } catch(ex) {}
    });
  }
  
  // GM_log
  function GM_log(...args) {
    console.log('[' + GM_info.script.name + ']', ...args);
  }
  
  // GM_registerMenuCommand (with extended options: id, accessKey, autoClose, title)
  const _menuCmds = new Map();
  function GM_registerMenuCommand(caption, callback, accessKeyOrOptions) {
    if (!hasGrant('GM_registerMenuCommand') && !hasGrant('GM.registerMenuCommand')) return null;
    let opts = {};
    if (typeof accessKeyOrOptions === 'string') {
      opts.accessKey = accessKeyOrOptions;
    } else if (accessKeyOrOptions && typeof accessKeyOrOptions === 'object') {
      opts = accessKeyOrOptions;
    }
    const id = opts.id || Math.random().toString(36).substring(2);
    _menuCmds.set(id, { callback, caption });
    sendToBackground('GM_registerMenuCommand', {
      scriptId, commandId: id, caption,
      accessKey: opts.accessKey || '',
      autoClose: opts.autoClose !== false,
      title: opts.title || ''
    }).catch(() => {});
    return id;
  }

  function GM_unregisterMenuCommand(id) {
    if (!hasGrant('GM_registerMenuCommand') && !hasGrant('GM.registerMenuCommand') &&
        !hasGrant('GM_unregisterMenuCommand') && !hasGrant('GM.unregisterMenuCommand')) return;
    _menuCmds.delete(id);
    sendToBackground('GM_unregisterMenuCommand', { scriptId, commandId: id }).catch(() => {});
  }

  function GM_getMenuCommands() {
    if (!hasGrant('GM_registerMenuCommand') && !hasGrant('GM.registerMenuCommand')) return [];
    return Array.from(_menuCmds.entries()).map(([id, entry]) => ({ id, name: entry.caption || id, caption: entry.caption || id }));
  }
  
  // GM_getResourceText / GM_getResourceURL
  async function GM_getResourceText(name) {
    if (!hasGrant('GM_getResourceText') && !hasGrant('GM.getResourceText')) return null;
    return await sendToBackground('GM_getResourceText', { scriptId, name });
  }
  
  async function GM_getResourceURL(name, isBlobUrl) {
    if (!hasGrant('GM_getResourceURL') && !hasGrant('GM.getResourceUrl')) return null;
    const dataUri = await sendToBackground('GM_getResourceURL', { scriptId, name });
    if (!dataUri) return null;
    // Return data URI by default, or convert to blob URL if requested
    if (isBlobUrl !== true) return dataUri;
    try {
      const resp = await fetch(dataUri);
      const blob = await resp.blob();
      return URL.createObjectURL(blob);
    } catch (e) {
      return dataUri;
    }
  }
  
  // GM_addElement
  function GM_addElement(parentOrTag, tagOrAttrs, attrsOrUndefined) {
    if (!hasGrant('GM_addElement') && !hasGrant('GM.addElement')) return null;
    let parent, tag, attrs;
    if (typeof parentOrTag === 'string') {
      tag = parentOrTag;
      attrs = tagOrAttrs;
      parent = document.head || document.documentElement;
    } else {
      parent = parentOrTag;
      tag = tagOrAttrs;
      attrs = attrsOrUndefined;
    }
    const el = document.createElement(tag);
    if (attrs) {
      Object.entries(attrs).forEach(([k, v]) => {
        if (k === 'textContent') el.textContent = v;
        else if (k === 'innerHTML') {
          // Sanitize: strip event handlers and script tags to prevent XSS
          const temp = document.createElement('template');
          temp.innerHTML = v;
          temp.content.querySelectorAll('script').forEach(s => s.remove());
          temp.content.querySelectorAll('*').forEach(node => {
            for (const attr of [...node.attributes]) {
              const lowerName = attr.name.toLowerCase();
              const lowerValue = attr.value.trim().toLowerCase();
              if (lowerName.startsWith('on') || lowerValue.startsWith('javascript:') || lowerValue.startsWith('vbscript:')) {
                node.removeAttribute(attr.name);
              }
            }
          });
          el.innerHTML = temp.innerHTML;
        }
        else {
          // Apply the same defensive sanitization to direct attribute sets so
          // this path stays consistent with the innerHTML branch above: drop
          // inline event handlers (onclick/onerror/...) and reject javascript:
          // or vbscript: URLs regardless of attribute name (covers href, src,
          // formaction, xlink:href, poster, action, etc.). The tradeoff is
          // bare minimum — this is not a full HTML sanitizer, just matching the
          // innerHTML branch's baseline.
          const lowerName = String(k).toLowerCase();
          if (lowerName.startsWith('on')) return;
          const lowerValue = String(v ?? '').trim().toLowerCase();
          if (lowerValue.startsWith('javascript:') || lowerValue.startsWith('vbscript:')) return;
          try { el.setAttribute(k, v); } catch { /* ignore invalid attribute names */ }
        }
      });
    }
    if (parent) parent.appendChild(el);
    return el;
  }
  
  // GM_loadScript - Dynamically fetch and eval a script URL at runtime
  // Fetches via background service worker (bypasses CORS/CSP), evals in userscript scope
  // Masks module/define/exports to force UMD libraries to set globals on window
  const _loadedScripts = new Set();
  async function GM_loadScript(url, options = {}) {
    if (!hasGrant('GM_xmlhttpRequest') && !hasGrant('GM.xmlHttpRequest')) {
      throw new Error('GM_loadScript requires @grant GM_xmlhttpRequest');
    }
    if (!url) throw new Error('GM_loadScript: No URL provided');
    if (!options.force && _loadedScripts.has(url)) return;
    const result = await sendToBackground('GM_loadScript', { url, timeout: options.timeout });
    if (!result || result.error) throw new Error('GM_loadScript: ' + (result?.error || 'request timed out'));
    // Temporarily mask module systems so UMD scripts create window globals
    const _savedModule = window.module;
    const _savedExports = window.exports;
    const _savedDefine = window.define;
    try {
      window.module = undefined;
      window.exports = undefined;
      window.define = undefined;
      const fn = new Function(result.code);
      fn.call(window);
    } finally {
      window.module = _savedModule;
      window.exports = _savedExports;
      window.define = _savedDefine;
    }
    _loadedScripts.add(url);
  }

  // GM_getTab / GM_saveTab / GM_getTabs (real implementations via background)
  let _tabData = {};
  function GM_getTab(callback) {
    if (!hasGrant('GM_getTab') && !hasGrant('GM.getTab')) { if (callback) callback(_tabData); return _tabData; }
    sendToBackground('GM_getTab', { scriptId }).then(data => {
      _tabData = data || {};
      if (callback) callback(_tabData);
    }).catch(() => { if (callback) callback(_tabData); });
    return _tabData;
  }
  function GM_saveTab(tab) {
    if (!hasGrant('GM_saveTab') && !hasGrant('GM.saveTab')) return;
    _tabData = tab || {};
    sendToBackground('GM_saveTab', { scriptId, data: _tabData }).catch(() => {});
  }
  function GM_getTabs(callback) {
    if (!hasGrant('GM_getTabs') && !hasGrant('GM.getTabs')) { if (callback) callback({}); return; }
    sendToBackground('GM_getTabs', { scriptId }).then(data => {
      if (callback) callback(data || {});
    }).catch(() => { if (callback) callback({}); });
  }

  function GM_focusTab() {
    if (!hasGrant('GM_focusTab') && !hasGrant('GM.focusTab') &&
        !hasGrant('GM_openInTab') && !hasGrant('GM.openInTab')) return;
    sendToBackground('GM_focusTab', {}).catch(() => {});
  }

  // unsafeWindow
  const unsafeWindow = window;
  
  // Helper to wait for cache to be ready (used by async GM.* API)
  function _waitForCache() {
    if (_cacheReady) return Promise.resolve();
    if (!_cacheReadyPromise) {
      _cacheReadyPromise = new Promise(resolve => {
        _cacheReadyResolve = resolve;
      });
    }
    return _cacheReadyPromise;
  }
  
  // GM.* Promise-based API
  // These wait for storage to be refreshed before returning, ensuring fresh values
  // GM_cookie (list, set, delete)
  const GM_cookie = {
    list: (details, callback) => {
      if (!hasGrant('GM_cookie') && !hasGrant('GM.cookie')) {
        if (callback) callback([], new Error('Permission denied'));
        return;
      }
      sendToBackground('GM_cookie_list', details || {}).then(r => {
        if (callback) callback(r?.cookies || [], r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback([], e); });
    },
    set: (details, callback) => {
      if (!hasGrant('GM_cookie') && !hasGrant('GM.cookie')) {
        if (callback) callback(new Error('Permission denied'));
        return;
      }
      sendToBackground('GM_cookie_set', details || {}).then(r => {
        if (callback) callback(r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(e); });
    },
    delete: (details, callback) => {
      if (!hasGrant('GM_cookie') && !hasGrant('GM.cookie')) {
        if (callback) callback(new Error('Permission denied'));
        return;
      }
      sendToBackground('GM_cookie_delete', details || {}).then(r => {
        if (callback) callback(r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(e); });
    }
  };

  // Event listener for notification/download/tab close events from background
  // Content.js forwards these with 'type' field (not 'action') and flat structure (not nested 'data')
  window.addEventListener('message', function __svEventHandler(event) {
    if (!event.data || event.data.channel !== CHANNEL_ID || event.data.direction !== 'to-userscript') return;

    // Notification events (content.js sends: type, scriptId, notifTag, eventType)
    if (event.data.type === 'notificationEvent' && event.data.scriptId === scriptId) {
      const tag = event.data.notifTag;
      const cbs = _notifCallbacks.get(tag);
      if (!cbs) return;
      if (event.data.eventType === 'click' && cbs.onclick) { try { cbs.onclick(); } catch(e) {} }
      if (event.data.eventType === 'done') {
        if (cbs.ondone) { try { cbs.ondone(); } catch(e) {} }
        _notifCallbacks.delete(tag);
      }
    }

    // Download events (content.js sends: type, scriptId, downloadId, eventType, data)
    if (event.data.type === 'downloadEvent' && event.data.scriptId === scriptId) {
      const d = event.data.data || {};
      const cbs = _downloadCallbacks.get(event.data.downloadId);
      if (!cbs) return;
      const evType = event.data.eventType;
      if (evType === 'load' && cbs.onload) { try { cbs.onload({ url: d.url }); } catch(e) {} _downloadCallbacks.delete(event.data.downloadId); }
      if (evType === 'error' && cbs.onerror) { try { cbs.onerror({ error: d.error }); } catch(e) {} _downloadCallbacks.delete(event.data.downloadId); }
      if (evType === 'progress' && cbs.onprogress) { try { cbs.onprogress({ loaded: d.loaded, total: d.total }); } catch(e) {} }
      if (evType === 'timeout' && cbs.ontimeout) { try { cbs.ontimeout(); } catch(e) {} _downloadCallbacks.delete(event.data.downloadId); }
    }

    // Tab close events (content.js sends: type, scriptId, closedTabId)
    if (event.data.type === 'openedTabClosed' && event.data.scriptId === scriptId) {
      const tabId = event.data.closedTabId;
      const handle = _openedTabs.get(tabId);
      if (handle) {
        handle.closed = true;
        if (typeof handle.onclose === 'function') { try { handle.onclose(); } catch(e) {} }
        _openedTabs.delete(tabId);
      }
    }
  });

  // GM.* Promise-based API
  const GM = {
    info: GM_info,
    getValue: async (k, d) => {
      await _waitForCache();
      return GM_getValue(k, d);
    },
    setValue: (k, v) => Promise.resolve(GM_setValue(k, v)),
    deleteValue: (k) => Promise.resolve(GM_deleteValue(k)),
    listValues: async () => {
      await _waitForCache();
      return GM_listValues();
    },
    getValues: async (keys) => {
      await _waitForCache();
      return GM_getValues(keys);
    },
    setValues: (vals) => Promise.resolve(GM_setValues(vals)),
    deleteValues: (keys) => Promise.resolve(GM_deleteValues(keys)),
    addStyle: (css) => Promise.resolve(GM_addStyle(css)),
    xmlHttpRequest: (d) => {
      let control;
      const promise = new Promise((res, rej) => {
        control = GM_xmlhttpRequest({
          ...d,
          onload: (r) => { if (d.onload) d.onload(r); res(r); },
          onerror: (e) => { if (d.onerror) d.onerror(e); rej(e.error || e); },
          ontimeout: (e) => { if (d.ontimeout) d.ontimeout(e); rej(new Error('timeout')); },
          onabort: (e) => { if (d.onabort) d.onabort(e); rej(new Error('aborted')); }
        });
      });
      promise.abort = () => control.abort();
      return promise;
    },
    notification: (d, ondone) => Promise.resolve(GM_notification(d, ondone)),
    setClipboard: (t, type) => Promise.resolve(GM_setClipboard(t, type)),
    openInTab: (u, o) => Promise.resolve(GM_openInTab(u, o)),
    download: (d) => Promise.resolve(GM_download(d)),
    getResourceText: (n) => GM_getResourceText(n),
    getResourceUrl: (n) => GM_getResourceURL(n),
    registerMenuCommand: (c, cb, o) => Promise.resolve(GM_registerMenuCommand(c, cb, o)),
    unregisterMenuCommand: (id) => Promise.resolve(GM_unregisterMenuCommand(id)),
    addValueChangeListener: (k, cb) => Promise.resolve(GM_addValueChangeListener(k, cb)),
    removeValueChangeListener: (id) => Promise.resolve(GM_removeValueChangeListener(id)),
    getTab: () => new Promise(r => GM_getTab(r)),
    saveTab: (t) => Promise.resolve(GM_saveTab(t)),
    getTabs: () => new Promise(r => GM_getTabs(r)),
    loadScript: (url, opts) => GM_loadScript(url, opts),
    cookies: {
      list: (d) => new Promise((res, rej) => GM_cookie.list(d, (cookies, err) => err ? rej(err) : res(cookies))),
      set: (d) => new Promise((res, rej) => GM_cookie.set(d, (err) => err ? rej(err) : res())),
      delete: (d) => new Promise((res, rej) => GM_cookie.delete(d, (err) => err ? rej(err) : res()))
    }
  };

  // CRITICAL: Expose all GM_* functions to window for Tampermonkey/Violentmonkey compatibility
  window.GM_info = GM_info;
  window.GM_getValue = GM_getValue;
  window.GM_setValue = GM_setValue;
  window.GM_deleteValue = GM_deleteValue;
  window.GM_listValues = GM_listValues;
  window.GM_getValues = GM_getValues;
  window.GM_setValues = GM_setValues;
  window.GM_deleteValues = GM_deleteValues;
  window.GM_addStyle = GM_addStyle;
  window.GM_xmlhttpRequest = GM_xmlhttpRequest;
  window.GM_head = GM_head;
  window.GM_setClipboard = GM_setClipboard;
  window.GM_notification = GM_notification;
  window.GM_openInTab = GM_openInTab;
  window.GM_download = GM_download;
  window.GM_log = GM_log;
  window.GM_registerMenuCommand = GM_registerMenuCommand;
  window.GM_unregisterMenuCommand = GM_unregisterMenuCommand;
  window.GM_getMenuCommands = GM_getMenuCommands;
  window.GM_getResourceText = GM_getResourceText;
  window.GM_getResourceURL = GM_getResourceURL;
  window.GM_addElement = GM_addElement;
  window.GM_loadScript = GM_loadScript;
  window.GM_getTab = GM_getTab;
  window.GM_saveTab = GM_saveTab;
  window.GM_getTabs = GM_getTabs;
  window.GM_addValueChangeListener = GM_addValueChangeListener;
  window.GM_removeValueChangeListener = GM_removeValueChangeListener;
  window.GM_cookie = GM_cookie;
  window.GM_focusTab = GM_focusTab;

  // ========== GM_webRequest (Tampermonkey-compatible, declarativeNetRequest-backed) ==========
  function GM_webRequest(rules, listener) {
    if (!hasGrant('GM_webRequest')) {
      console.warn('[ScriptVault] GM_webRequest requires @grant GM_webRequest');
      return;
    }
    const ruleArray = Array.isArray(rules) ? rules : [rules];
    sendToBackground('GM_webRequest', { rules: ruleArray }).catch(e =>
      console.warn('[ScriptVault] GM_webRequest failed:', e.message)
    );
    // listener is called with (info, message, details) when a rule matches;
    // declarativeNetRequest doesn't support runtime callbacks, so we no-op this.
    if (typeof listener === 'function') {
      console.info('[ScriptVault] GM_webRequest: runtime listener not supported in MV3 — use @webRequest metadata for static rules');
    }
  }
  window.GM_webRequest = GM_webRequest;

  window.unsafeWindow = unsafeWindow;
  window.GM = GM;

  // ========== window.onurlchange (SPA navigation detection) ==========
  // Tampermonkey-compatible: fires when URL changes via pushState/replaceState/popstate
  if (hasGrant('window.onurlchange')) {
    let _lastUrl = location.href;
    const _urlChangeHandlers = [];

    function __checkUrlChange() {
      const newUrl = location.href;
      if (newUrl !== _lastUrl) {
        const oldUrl = _lastUrl;
        _lastUrl = newUrl;
        const event = { url: newUrl, oldUrl };
        _urlChangeHandlers.forEach(fn => { try { fn(event); } catch(e) {} });
        if (typeof window.onurlchange === 'function') {
          try { window.onurlchange(event); } catch(e) {}
        }
      }
    }

    // Intercept history API
    const _origPushState = history.pushState;
    const _origReplaceState = history.replaceState;
    history.pushState = function() {
      _origPushState.apply(this, arguments);
      __checkUrlChange();
    };
    history.replaceState = function() {
      _origReplaceState.apply(this, arguments);
      __checkUrlChange();
    };
    window.addEventListener('popstate', __checkUrlChange);
    window.addEventListener('hashchange', __checkUrlChange);

    // Allow adding multiple handlers via addEventListener pattern
    window.addEventListener = new Proxy(window.addEventListener, {
      apply(target, thisArg, args) {
        if (args[0] === 'urlchange') {
          if (!_urlChangeHandlers.includes(args[1])) {
            _urlChangeHandlers.push(args[1]);
          }
          return;
        }
        return Reflect.apply(target, thisArg, args);
      }
    });
    window.removeEventListener = new Proxy(window.removeEventListener, {
      apply(target, thisArg, args) {
        if (args[0] === 'urlchange') {
          const idx = _urlChangeHandlers.indexOf(args[1]);
          if (idx >= 0) _urlChangeHandlers.splice(idx, 1);
          return;
        }
        return Reflect.apply(target, thisArg, args);
      }
    });
    window.onurlchange = null; // Initialize as settable
  }

  // ========== window.close / window.focus grants ==========
  if (hasGrant('window.close')) {
    // Already available in USER_SCRIPT world, but explicitly expose
    window.close = window.close.bind(window);
  }
  if (hasGrant('window.focus')) {
    window.focus = window.focus.bind(window);
  }

  // ========== GM_audio API (Tampermonkey-compatible tab mute control) ==========
  const GM_audio = {
    setMute: (details, callback) => {
      if (!hasGrant('GM_audio')) { if (callback) callback(new Error('Permission denied')); return; }
      sendToBackground('GM_audio_setMute', { mute: details?.mute ?? details }).then(r => {
        if (callback) callback(r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(e); });
    },
    getState: (callback) => {
      if (!hasGrant('GM_audio')) { if (callback) callback(null, new Error('Permission denied')); return; }
      sendToBackground('GM_audio_getState', {}).then(r => {
        if (callback) callback(r, r?.error ? new Error(r.error) : undefined);
      }).catch(e => { if (callback) callback(null, e); });
    },
    _listeners: [],
    _watching: false,
    _msgHandler: null,
    addStateChangeListener: (listener, callback) => {
      if (!hasGrant('GM_audio')) { if (callback) callback(new Error('Permission denied')); return; }
      GM_audio._listeners.push(listener);
      if (!GM_audio._watching) {
        GM_audio._watching = true;
        sendToBackground('GM_audio_watchState', {});
        // Listen for audio state change events from content script bridge
        GM_audio._msgHandler = (e) => {
          if (e.source !== window || !e.data || e.data.channel !== CHANNEL_ID) return;
          if (e.data.type === 'audioStateChanged') {
            const state = e.data.data;
            for (const fn of GM_audio._listeners) {
              try { fn(state); } catch (err) { console.error('[GM_audio listener]', err); }
            }
          }
        };
        window.addEventListener('message', GM_audio._msgHandler);
      }
      if (callback) callback();
    },
    removeStateChangeListener: (listener, callback) => {
      const idx = GM_audio._listeners.indexOf(listener);
      if (idx >= 0) GM_audio._listeners.splice(idx, 1);
      if (GM_audio._listeners.length === 0 && GM_audio._watching) {
        GM_audio._watching = false;
        if (GM_audio._msgHandler) {
          window.removeEventListener('message', GM_audio._msgHandler);
          GM_audio._msgHandler = null;
        }
        sendToBackground('GM_audio_unwatchState', {});
      }
      if (callback) callback();
    }
  };
  window.GM_audio = GM_audio;

  // ========== DOM HELPER FUNCTIONS ==========
  // These help userscripts handle DOM timing issues gracefully
  // Use these when document.body/head might not exist yet
  
  // Wait for any element matching selector to appear in DOM
  function __waitForElement(selector, timeout = 10000) {
    return new Promise((resolve, reject) => {
      // Check if already exists
      const existing = document.querySelector(selector);
      if (existing) return resolve(existing);
      
      let resolved = false;
      const observer = new MutationObserver((mutations, obs) => {
        if (resolved) return;
        const el = document.querySelector(selector);
        if (el) {
          resolved = true;
          obs.disconnect();
          resolve(el);
        }
      });
      
      // Start observing - handle case where documentElement might not exist yet
      const root = document.documentElement || document;
      if (root && typeof root.nodeType !== 'undefined') {
        observer.observe(root, { childList: true, subtree: true });
      }
      
      // Timeout with final check
      setTimeout(() => {
        if (resolved) return;
        observer.disconnect();
        const el = document.querySelector(selector);
        if (el) {
          resolve(el);
        } else {
          reject(new Error('[ScriptVault] Timeout waiting for element: ' + selector));
        }
      }, timeout);
    });
  }
  
  // Wait for document.body to be available
  function __waitForBody(timeout = 10000) {
    if (document.body) return Promise.resolve(document.body);
    return __waitForElement('body', timeout);
  }
  
  // Wait for document.head to be available
  function __waitForHead(timeout = 10000) {
    if (document.head) return Promise.resolve(document.head);
    return __waitForElement('head', timeout);
  }
  
  // Safe MutationObserver that waits for target element to exist
  // Prevents "parameter 1 is not of type 'Node'" errors
  function __safeObserve(target, options, callback) {
    // Handle selector string or element
    const element = typeof target === 'string' ? document.querySelector(target) : target;
    
    // If element exists and is valid, observe immediately
    if (element && element.nodeType === Node.ELEMENT_NODE) {
      const observer = new MutationObserver(callback);
      observer.observe(element, options);
      return { observer, promise: Promise.resolve(observer) };
    }
    
    // Element doesn't exist yet - wait for it
    const selectorToWait = typeof target === 'string' ? target : 'body';
    const promise = __waitForElement(selectorToWait)
      .then(el => {
        const observer = new MutationObserver(callback);
        observer.observe(el, options);
        return observer;
      })
      .catch(() => null);
    
    return { observer: null, promise };
  }
  
  // Expose DOM helpers to window for userscripts to use
  window.__ScriptVault_waitForElement = __waitForElement;
  window.__ScriptVault_waitForBody = __waitForBody;
  window.__ScriptVault_waitForHead = __waitForHead;
  window.__ScriptVault_safeObserve = __safeObserve;

  // Also expose as shorter aliases
  window.waitForElement = __waitForElement;
  window.waitForBody = __waitForBody;
  window.waitForHead = __waitForHead;
  window.safeObserve = __safeObserve;

  // ========== Network Proxy (full capture: fetch, XHR, WebSocket, sendBeacon) ==========
  // Intercepts all network calls made by this script and logs them to the network log.
  // Logs are viewable in the DevTools panel and the dashboard Network Log.
  (function __svNetProxy() {
    const _scriptName = ${JSON.stringify(meta.name || script.id)};
    const _scriptId = ${JSON.stringify(script.id)};

    function _log(entry) {
      sendToBackground('netlog_record', { scriptId: _scriptId, scriptName: _scriptName, ...entry }).catch(() => {});
    }

    // ── fetch ──────────────────────────────────────────────────────────────
    const _origFetch = window.fetch;
    window.fetch = function __svFetch(input, init) {
      const method = (init?.method || 'GET').toUpperCase();
      const url = typeof input === 'string' ? input : input?.url || String(input);
      const t0 = performance.now();
      return _origFetch.apply(this, arguments).then(resp => {
        const duration = Math.round(performance.now() - t0);
        const cl = parseInt(resp.headers.get('content-length') || '0') || 0;
        _log({ type: 'fetch', method, url, status: resp.status, statusText: resp.statusText, duration, responseSize: cl, responseHeaders: Object.fromEntries(resp.headers.entries()) });
        return resp;
      }, err => {
        const duration = Math.round(performance.now() - t0);
        _log({ type: 'fetch', method, url, error: err?.message || String(err), duration });
        throw err;
      });
    };

    // ── XMLHttpRequest ─────────────────────────────────────────────────────
    const _OrigXHR = window.XMLHttpRequest;
    window.XMLHttpRequest = function __svXHR() {
      const xhr = new _OrigXHR();
      let _method = 'GET', _url = '', _t0 = 0;
      const _origOpen = xhr.open.bind(xhr);
      xhr.open = function(method, url) {
        _method = (method || 'GET').toUpperCase();
        _url = String(url);
        return _origOpen.apply(this, arguments);
      };
      const _origSend = xhr.send.bind(xhr);
      xhr.send = function() {
        _t0 = performance.now();
        xhr.addEventListener('loadend', () => {
          const duration = Math.round(performance.now() - _t0);
          if (xhr.status) {
            _log({ type: 'xhr', method: _method, url: _url, status: xhr.status, statusText: xhr.statusText, duration, responseSize: (xhr.responseText || '').length });
          } else {
            _log({ type: 'xhr', method: _method, url: _url, error: 'Request failed', duration });
          }
        }, { once: true });
        return _origSend.apply(this, arguments);
      };
      return xhr;
    };
    window.XMLHttpRequest.prototype = _OrigXHR.prototype;

    // ── WebSocket ──────────────────────────────────────────────────────────
    const _OrigWS = window.WebSocket;
    window.WebSocket = function __svWebSocket(url, protocols) {
      const ws = protocols ? new _OrigWS(url, protocols) : new _OrigWS(url);
      const t0 = performance.now();
      let bytesSent = 0, bytesRecv = 0;
      ws.addEventListener('open', () => {
        _log({ type: 'websocket', method: 'WS', url: String(url), status: 101, statusText: 'Switching Protocols', duration: Math.round(performance.now() - t0) });
      });
      ws.addEventListener('message', e => { bytesRecv += (e.data?.length || 0); });
      ws.addEventListener('close', e => {
        _log({ type: 'websocket', method: 'WS_CLOSE', url: String(url), status: e.code, duration: Math.round(performance.now() - t0), responseSize: bytesRecv });
      });
      const _origSendWS = ws.send.bind(ws);
      ws.send = function(data) { bytesSent += (data?.length || 0); return _origSendWS(data); };
      return ws;
    };
    window.WebSocket.prototype = _OrigWS.prototype;
    Object.assign(window.WebSocket, { CONNECTING: 0, OPEN: 1, CLOSING: 2, CLOSED: 3 });

    // ── sendBeacon ─────────────────────────────────────────────────────────
    const _origBeacon = navigator.sendBeacon.bind(navigator);
    navigator.sendBeacon = function __svBeacon(url, data) {
      const result = _origBeacon(url, data);
      const size = data ? (typeof data === 'string' ? data.length : (data?.byteLength || data?.size || 0)) : 0;
      _log({ type: 'beacon', method: 'POST', url: String(url), status: result ? 200 : 0, duration: 0, responseSize: size });
      return result;
    };
  })();
  // ========== End Network Proxy ==========

  // GM APIs exposed log disabled for performance
  // console.log('[ScriptVault] GM APIs exposed to window for:', meta.name);

  // ============ @require Scripts ============
  // These run after GM APIs are available on window
${requireCode}
${libraryExports}
  // ============ End @require Scripts ============

  // Wait for storage to be refreshed, then execute the userscript
  // This ensures scripts see fresh values when using GM_getValue
  (async function __scriptMonkeyRunner() {
    await _waitForCache();
    const __startTime = performance.now();
    try {
`;

  const apiClose = `
    } catch (e) {
      // Report error to background for profiling
      sendToBackground('reportExecError', { scriptId, error: (e?.message || String(e)).slice(0, 200) }).catch(() => {});
    } finally {
      // Report execution time to background for profiling
      const __elapsed = Math.round((performance.now() - __startTime) * 100) / 100;
      sendToBackground('reportExecTime', { scriptId, time: __elapsed, url: location.href }).catch(() => {});
    }
  })();
})();
`;

  // @top-level-await: wrap user code in async IIFE so top-level await works
  let userCode = meta['top-level-await']
    ? `(async () => {\n${script.code}\n})();`
    : script.code;

  // @delay: postpone script execution by N milliseconds
  if (meta.delay > 0) {
    userCode = `setTimeout(() => {\n${userCode}\n}, ${meta.delay});`;
  }

  return apiInit + userCode + apiClose;
}

// Helper: Check if a pattern is a valid match pattern
function isValidMatchPattern(pattern) {
  if (!pattern) return false;
  if (pattern === '<all_urls>') return true;

  // Match pattern validation (allows ports: http://localhost:3000/*)
  const matchRegex = /^(\*|https?|file|ftp):\/\/(\*|\*\.[^/*]+|[^/*:]+(?::\d+)?)\/.*$/;
  return matchRegex.test(pattern);
}

// Check if a pattern is a regex @include (wrapped in /regex/)
function isRegexPattern(pattern) {
  if (!pattern || !pattern.startsWith('/') || pattern.length <= 2) return false;
  const match = pattern.match(/^\/(.+?)\/([gimsuy]*)$/);
  if (!match) return false;
  // Require at least one regex metacharacter to distinguish from plain URL paths like /path/to/file/
  return /[\\^$\[(+?{|]/.test(match[1]);
}

// Parse a regex @include pattern string into a RegExp object
function parseRegexPattern(pattern) {
  const match = pattern.match(/^\/(.+)\/([gimsuy]*)$/);
  if (!match) return null;
  try {
    return new RegExp(match[1], match[2]);
  } catch (e) {
    return null;
  }
}

// Extract broad match patterns from a regex to use for Chrome registration
// The actual fine-grained filtering happens at runtime in the injected wrapper
function extractMatchPatternsFromRegex(regexStr) {
  // Remove the /.../ wrapper and flags
  const inner = regexStr.replace(/^\//, '').replace(/\/[gimsuy]*$/, '');
  const patterns = [];

  // Strategy 1: Find domain patterns like "name\.(tld1|tld2|tld3)" or "name\.tld"
  // Handles: 1337x\.(to|st|ws|eu|se|is|gd|unblocked\.dk)
  const domainWithAlts = /([a-z0-9][-a-z0-9]*)\\\.\(([^)]+)\)/gi;
  let match;
  while ((match = domainWithAlts.exec(inner)) !== null) {
    const base = match[1];
    const altsRaw = match[2];
    // Split alternatives, handling escaped dots within them (e.g. unblocked\.dk)
    const alts = altsRaw.split('|').map(a => a.replace(/\\\./g, '.'));
    for (const alt of alts) {
      // Only use clean TLD/domain alternatives (no regex metacharacters)
      if (/^[a-z0-9][-a-z0-9.]*$/i.test(alt) && alt.length >= 2 && alt.length <= 30) {
        patterns.push(`*://*.${base}.${alt}/*`);
        patterns.push(`*://${base}.${alt}/*`);
      }
    }
  }

  // Strategy 2: Find simple "domain\.tld" patterns not inside groups
  const simpleDomain = /(?:^|\/\/)(?:\([^)]*\))?([a-z0-9][-a-z0-9]*(?:\\\.)[a-z]{2,10})(?:[\\\/\$\)]|$)/gi;
  while ((match = simpleDomain.exec(inner)) !== null) {
    const domain = match[1].replace(/\\\./g, '.');
    if (/^[a-z0-9][-a-z0-9]*\.[a-z]{2,10}$/i.test(domain)) {
      patterns.push(`*://*.${domain}/*`);
      patterns.push(`*://${domain}/*`);
    }
  }

  // Deduplicate
  return [...new Set(patterns)];
}

// Helper: Convert @include glob to @match pattern
function convertIncludeToMatch(include) {
  if (!include) return null;
  
  // If it's already a valid match pattern, return it
  if (isValidMatchPattern(include)) return include;
  
  // Handle common patterns
  if (include === '*') return '<all_urls>';
  
  // Try to convert glob to match pattern
  // Replace ** with * and handle http/https
  let pattern = include;
  
  // Handle patterns like *://example.com/*
  if (pattern.startsWith('*://')) {
    const afterScheme = pattern.slice(4);
    if (!afterScheme.includes('/')) pattern += '/*';
    return isValidMatchPattern(pattern) ? pattern : null;
  }

  // Handle patterns like http://example.com/*
  if (pattern.match(/^https?:\/\//)) {
    if (!pattern.includes('/*') && !pattern.endsWith('/')) pattern += '/*';
    return isValidMatchPattern(pattern) ? pattern : null;
  }

  // Handle patterns like *.example.com
  if (pattern.startsWith('*.')) {
    const result = '*://' + pattern + '/*';
    return isValidMatchPattern(result) ? result : null;
  }

  // Handle patterns like example.com
  if (!pattern.includes('://') && !pattern.startsWith('/')) {
    const result = '*://' + pattern + '/*';
    return isValidMatchPattern(result) ? result : null;
  }

  return null;
}

init();