// Vestibule blocked page — shown when a top-level navigation is
// denied by the URL policy (safelist mode).
//
// The attempted URL arrives as the ?u= query parameter. Only the
// hostname is displayed, and only via textContent — the parameter is
// never written into the DOM as markup.

(() => {
  const params = new URLSearchParams(location.search);
  const attempted = params.get("u") || "";

  let host = attempted;
  try {
    host = new URL(attempted).hostname;
  } catch (e) {
    /* unparsable — display the raw value; textContent makes it inert */
  }

  document.getElementById("block-domain").textContent = host;

  document.getElementById("btn-home").addEventListener("click", () => {
    browser.runtime.sendMessage({ type: "navigate-home" }).catch(() => {});
  });
})();