// Sandboxed viewers have opaque origins: authenticate the sender by WindowProxy,
// not origin. Only exchange a validated theme, never HTML, URLs or commands.
(() => {
  if (window.parent === window) return;
  let connected = false;
  window.addEventListener('message', event => {
    if (event.source !== window.parent || event.data?.type !== 'eldorado:set-theme') return;
    const theme = event.data.theme;
    if (theme !== 'light' && theme !== 'dark') return;
    connected = true;
    if (document.documentElement.dataset.theme !== theme) {
      document.getElementById('btn-theme').click();
      // Parent updates are not new user choices; do not echo stale acknowledgements.
      observer.takeRecords();
    }
  });
  const observer = new MutationObserver(() => {
    if (connected) window.parent.postMessage({type: 'eldorado:theme', theme: document.documentElement.dataset.theme}, '*');
  });
  observer.observe(document.documentElement, {attributes: true, attributeFilter: ['data-theme']});
})();