// SPDX-License-Identifier: GPL-3.0-only
/**
 * Inferway Studio — bridge protocol (Studio L3b, slice 2), version 1.
 *
 * One closed list of message types shared by BOTH sides of the postMessage
 * channel:
 *
 *   - frame side  : `website/studio-editor/inferway-shim.js`, loaded in the
 *                   sandboxed editor document. It does NOT import this file —
 *                   this file is a CLASSIC script (no `export`, so it can be
 *                   pulled in with `<script src>` before the module bundle);
 *                   it is executed first and publishes
 *                   `globalThis.InferwayBridgeProtocol`.
 *   - parent side : `website/src/lib/studioBridge.ts`, which carries its own
 *                   copy of the type list. The identity of the two lists (and
 *                   of the version and the size caps) is proved by
 *                   `website/src/lib/__tests__/studioBridge.test.ts`, which
 *                   evaluates this very file the way the browser does and
 *                   compares the two.
 *
 * Channel rules (L3b requirement 5):
 *
 *   - every message is `{v: 1, type, id, …}`; `id` is chosen by the requester
 *     and a request gets EXACTLY ONE response carrying the same `id`;
 *   - the frame accepts only `event.source === window.parent`, the parent only
 *     `event.source === iframe.contentWindow`; NEITHER side looks at
 *     `event.origin` (it is the string `"null"` for an opaque origin);
 *   - both sides SEND with `"*"` — the only possible target for an opaque
 *     origin — so the parent re-checks the frame before every send and never
 *     puts a credential into a message;
 *   - every inbound message is schema-validated here: version, type in the
 *     closed list, field types, and — for `api-request` — a closed method
 *     allow-list plus a purely syntactic path pattern (an absolute editor
 *     path, never a list of paths); for `download`, a closed media-type
 *     allow-list. Size caps: workflow-class payloads (api-request body,
 *     api-response body, download bytes) ≤ 512 KiB, everything else ≤ 64 KiB,
 *     measured in UTF-8 bytes of the payload (decoded bytes for `download`).
 *
 * This file is served unminified next to the dist; it is its own source.
 */
(function (global) {
  "use strict";

  var PROTOCOL_VERSION = 1;

  /** The closed list. Adding a type is a protocol change, not a tweak. */
  var MESSAGE_TYPES = Object.freeze([
    "api-request",
    "api-response",
    "download",
    "download-ack",
    "clipboard-write",
    "clipboard-ack",
  ]);

  /** Requests the frame may send; the parent never initiates. */
  var REQUEST_TYPES = Object.freeze(["api-request", "download", "clipboard-write"]);

  /** Exactly one response type per request type. */
  var RESPONSE_TYPE_FOR = Object.freeze({
    "api-request": "api-response",
    download: "download-ack",
    "clipboard-write": "clipboard-ack",
  });

  var REQUEST_METHODS = Object.freeze(["GET", "POST", "PUT", "DELETE"]);

  /**
   * The closed set of media types a download may carry (parent side: the
   * `download` handler only ever sees one of these). Anything that executes
   * or renders as a document when the saved file is opened later — `text/html`,
   * `image/svg+xml`, `application/xhtml+xml`, scripts — is absent on purpose.
   * Keeping the list here as well as in `studioBridge.ts` lets the frame
   * refuse its own outbound message with a clear error instead of waiting
   * for the parent's rejection; the two copies are proved equal by the parent
   * protocol-parity test.
   */
  var DOWNLOAD_MIME_TYPES = Object.freeze([
    "application/json",
    "application/octet-stream",
    "application/pdf",
    "application/zip",
    "application/gzip",
    "application/x-tar",
    "application/xml",
    "application/yaml",
    "application/x-yaml",
    "text/plain",
    "text/csv",
    "text/markdown",
    "text/css",
    "text/xml",
    "text/yaml",
    "image/png",
    "image/jpeg",
    "image/gif",
    "image/webp",
    "image/bmp",
    "image/avif",
    "image/tiff",
    "video/mp4",
    "video/webm",
    "video/quicktime",
    "audio/mpeg",
    "audio/wav",
    "audio/ogg",
    "model/gltf-binary",
    "model/gltf+json",
  ]);

  /** One media type: parameters and case folded (`Text/Plain; charset=utf-8` → `text/plain`). */
  function normaliseDownloadMime(raw) {
    return String(raw.split(";")[0] || "")
      .trim()
      .toLowerCase();
  }

  function isAllowedDownloadMime(raw) {
    return DOWNLOAD_MIME_TYPES.indexOf(normaliseDownloadMime(raw)) >= 0;
  }

  /** The only keys each type may carry (closed schema, both directions). */
  var KEYS_FOR = Object.freeze({
    "api-request": ["v", "type", "id", "method", "path", "body"],
    "api-response": ["v", "type", "id", "status", "body", "contentType"],
    download: ["v", "type", "id", "name", "mime", "data"],
    "download-ack": ["v", "type", "id", "ok", "error"],
    "clipboard-write": ["v", "type", "id", "text"],
    "clipboard-ack": ["v", "type", "id", "ok", "error"],
  });

  /** 512 KiB: one workflow graph JSON is capped at exactly this (L0 D4). */
  var MAX_WORKFLOW_BYTES = 512 * 1024;
  /** 64 KiB for everything that is not a workflow-class payload. */
  var MAX_MESSAGE_BYTES = 64 * 1024;
  /** Types whose payload may be a workflow (512 KiB cap). */
  var WORKFLOW_PAYLOAD_TYPES = Object.freeze(["api-request", "api-response", "download"]);

  var MAX_ID_LENGTH = 128;
  var MAX_PATH_LENGTH = 2048;
  /** `/…` but never `//…` (protocol-relative), never a backslash, no traversal. */
  var PATH_PATTERN = /^\/(?!\/)[A-Za-z0-9._~\-/?=&%+@:]*$/;

  var encoder = typeof TextEncoder !== "undefined" ? new TextEncoder() : null;

  function utf8Length(text) {
    if (typeof text !== "string") return 0;
    if (encoder) return encoder.encode(text).length;
    // Fallback for engines without TextEncoder: count UTF-8 bytes by hand.
    var bytes = 0;
    for (var i = 0; i < text.length; i += 1) {
      var code = text.charCodeAt(i);
      if (code < 0x80) bytes += 1;
      else if (code < 0x800) bytes += 2;
      else if (code >= 0xd800 && code <= 0xdbff) {
        bytes += 4;
        i += 1;
      } else bytes += 3;
    }
    return bytes;
  }

  function isBase64(text) {
    return typeof text === "string" && text.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(text);
  }

  function base64ByteLength(text) {
    if (!isBase64(text)) return Number.NaN;
    var padding = text.endsWith("==") ? 2 : text.endsWith("=") ? 1 : 0;
    return (text.length / 4) * 3 - padding;
  }

  /**
   * Payload bytes of one message — the number the caps are measured against.
   * Download data is base64 on the wire, so it is measured DECODED: the
   * 512 KiB workflow budget is the budget of the file, not of its encoding.
   */
  function messageSizeBytes(message) {
    if (typeof message !== "object" || message === null) return Number.NaN;
    switch (message.type) {
      case "api-request":
        return utf8Length(typeof message.body === "string" ? message.body : "") + utf8Length(message.path);
      case "api-response":
        return utf8Length(message.body) + utf8Length(message.contentType);
      case "download":
        return base64ByteLength(message.data) + utf8Length(message.name) + utf8Length(message.mime);
      case "clipboard-write":
        return utf8Length(message.text);
      case "download-ack":
      case "clipboard-ack":
        return utf8Length(message.error || "");
      default:
        return utf8Length(JSON.stringify(message));
    }
  }

  function capFor(type) {
    return WORKFLOW_PAYLOAD_TYPES.indexOf(type) >= 0 ? MAX_WORKFLOW_BYTES : MAX_MESSAGE_BYTES;
  }

  function isPlainObject(value) {
    return typeof value === "object" && value !== null && !Array.isArray(value);
  }

  function isNonEmptyString(value, max) {
    return typeof value === "string" && value.length > 0 && value.length <= max;
  }

  /**
   * Validate one inbound message. Returns `{ok: true}` or
   * `{ok: false, reason: "…"}` — the reason is always safe to log (it names
   * the field, never the payload).
   */
  function validateMessage(message) {
    if (!isPlainObject(message)) return { ok: false, reason: "not an object" };
    if (message.v !== PROTOCOL_VERSION) return { ok: false, reason: "unsupported protocol version" };
    if (typeof message.type !== "string" || MESSAGE_TYPES.indexOf(message.type) < 0) {
      return { ok: false, reason: "type not in the closed list" };
    }
    if (!isNonEmptyString(message.id, MAX_ID_LENGTH)) {
      return { ok: false, reason: "id must be a non-empty string of at most 128 characters" };
    }

    var keys = KEYS_FOR[message.type];
    for (var key in message) {
      if (Object.prototype.hasOwnProperty.call(message, key) && keys.indexOf(key) < 0) {
        return { ok: false, reason: "unexpected field \"" + key + "\" for " + message.type };
      }
    }

    switch (message.type) {
      case "api-request": {
        if (typeof message.method !== "string" || REQUEST_METHODS.indexOf(message.method) < 0) {
          return { ok: false, reason: "method not in the allow-list" };
        }
        if (typeof message.path !== "string" || message.path.length === 0 || message.path.length > MAX_PATH_LENGTH) {
          return { ok: false, reason: "path missing or too long" };
        }
        if (!PATH_PATTERN.test(message.path)) return { ok: false, reason: "path not an absolute editor path" };
        if (message.body !== undefined && message.body !== null && typeof message.body !== "string") {
          return { ok: false, reason: "body must be a string or null" };
        }
        break;
      }
      case "api-response": {
        if (!Number.isInteger(message.status) || message.status < 100 || message.status > 599) {
          return { ok: false, reason: "status must be an integer HTTP status" };
        }
        if (typeof message.body !== "string") return { ok: false, reason: "body must be a string" };
        if (message.contentType !== undefined && typeof message.contentType !== "string") {
          return { ok: false, reason: "contentType must be a string" };
        }
        break;
      }
      case "download": {
        if (!isNonEmptyString(message.name, 255)) return { ok: false, reason: "download name missing" };
        if (typeof message.mime !== "string" || message.mime.length === 0) {
          return { ok: false, reason: "download mime missing" };
        }
        if (!isAllowedDownloadMime(message.mime)) {
          return { ok: false, reason: "download mime is not in the allow-list" };
        }
        if (!isBase64(message.data || "")) return { ok: false, reason: "download data is not base64" };
        break;
      }
      case "clipboard-write": {
        if (typeof message.text !== "string") return { ok: false, reason: "clipboard text must be a string" };
        break;
      }
      case "download-ack":
      case "clipboard-ack": {
        if (typeof message.ok !== "boolean") return { ok: false, reason: "ack ok must be a boolean" };
        if (message.error !== undefined && typeof message.error !== "string") {
          return { ok: false, reason: "ack error must be a string" };
        }
        break;
      }
      default:
        return { ok: false, reason: "unhandled type" };
    }

    var size = messageSizeBytes(message);
    if (!Number.isFinite(size)) return { ok: false, reason: "payload is not measurable" };
    var cap = capFor(message.type);
    if (size > cap) {
      return {
        ok: false,
        reason: message.type + " payload is " + size + " bytes, over the " + cap + " byte cap",
      };
    }
    return { ok: true };
  }

  var api = Object.freeze({
    PROTOCOL_VERSION: PROTOCOL_VERSION,
    MESSAGE_TYPES: MESSAGE_TYPES,
    REQUEST_TYPES: REQUEST_TYPES,
    RESPONSE_TYPE_FOR: RESPONSE_TYPE_FOR,
    REQUEST_METHODS: REQUEST_METHODS,
    DOWNLOAD_MIME_TYPES: DOWNLOAD_MIME_TYPES,
    KEYS_FOR: KEYS_FOR,
    MAX_WORKFLOW_BYTES: MAX_WORKFLOW_BYTES,
    MAX_MESSAGE_BYTES: MAX_MESSAGE_BYTES,
    WORKFLOW_PAYLOAD_TYPES: WORKFLOW_PAYLOAD_TYPES,
    validateMessage: validateMessage,
    messageSizeBytes: messageSizeBytes,
    capFor: capFor,
  });

  // Classic script (the frame): publish for `inferway-shim.js`.
  global.InferwayBridgeProtocol = api;
  // CommonJS-shaped consumers (tests, tooling) may take the same object.
  if (typeof module !== "undefined" && module.exports) module.exports = api;
})(typeof globalThis !== "undefined" ? globalThis : this);