import { describe, it, expect, vi } from 'vitest';
import { compileHtmlToMarkdown, extractIndependentStaticReference } from '../src/core/transformer';
import { isSafePublicUrl, verifyResolvedHostSafety } from '../src/core/security';
import { isSafeTwinCandidate, isSafeRedirectDestination, resolveAuthoritativeTwin } from '../src/services/twin-resolver';
import { fetchOrigin } from '../src/core/fetcher';
import { LIMITS } from '../src/config/constants';
import { app } from '../src/index';

describe('Golden Corpus Regression Suite (Adversarial Parity Gates)', () => {
  it('Next.js Documentation: passes visible-text recall, preserves doc context, and avoids sidebar cutoff', async () => {
    // Synthetic mirror of Next.js Docs DOM structure with complex sidebar, nested broken tags, and article
    const nextDocsHtml = `
      <!DOCTYPE html>
      <html>
        <head>
          <title>Next.js Docs | Next.js</title>
          <meta name="description" content="Welcome to the Next.js documentation.">
        </head>
        <body>
          <main>
            <!-- Left Sidebar Navigation with version dropdown and invalid/nested tags -->
            <div class="sidebar">
              <button aria-label="Version selector">
                Features available in /app
                <svg class="chevron-down" aria-label="Expand dropdown"><path d="M6 9l6 6 6-6"/></svg>
                <p>Latest Version</p>
                <p>16.4.0</p>
                <svg class="caret" aria-label="Open menu"><path d="M1 1"/></svg>
              </button>
              <nav aria-label="Sidebar">
                <ul>
                  <li><a href="/docs/app/guides/migrating">Migrating</a></div></a></li>
                  <li><a href="/docs/app/guides/internationalization">i18n</a></li>
                </ul>
              </nav>
            </div>
            <!-- Main Documentation Article Body -->
            <article>
              <nav aria-label="Breadcrumb">
                <ol><li>Docs</li><li>App Router</li></ol>
              </nav>
              <h1>Next.js Docs</h1>
              <p>Welcome to the Next.js documentation!</p>
              <h2>What is Next.js?</h2>
              <p>Next.js is a React framework for building full-stack web applications. You use React Components to build user interfaces.</p>
              <h2>How to use the docs</h2>
              <p>On each page, you will find documentation and guides for implementing Next.js features.</p>
              <h2>App Router and Pages Router</h2>
              <p>Next.js has two different routers: the App Router and the Pages Router.</p>
              <h2>React version handling</h2>
              <p>Next.js uses the latest stable or canary versions of React.</p>

              <!-- Document Pagination -->
              <nav aria-label="Pagination">
                <a aria-label="Go to previous page: Rspack" href="/docs/community/rspack"><span>Previous</span><span>Rspack</span></a>
                <a aria-label="Go to next page: App Router" href="/docs/app"><span>Next</span><span>App Router</span></a>
              </nav>

              <!-- Feedback Widget (Residual to strip) -->
              <div data-feedback-inline="" class="feedback-widget">
                <p>Was this helpful?</p>
                <button aria-label="Select Hate it emoji">supported</button>
                <button type="submit">Send</button>
              </div>
            </article>
          </main>
        </body>
      </html>
    `;

    const result = await compileHtmlToMarkdown(nextDocsHtml, 'https://nextjs.org/docs');

    // 1. Visible-Text Recall Gate: All key article sections MUST be present
    expect(result.markdown).toContain('## What is Next.js?');
    expect(result.markdown).toContain('Next.js is a React framework for building full-stack web applications');
    expect(result.markdown).toContain('## How to use the docs');
    expect(result.markdown).toContain('## App Router and Pages Router');
    expect(result.markdown).toContain('## React version handling');

    // 2. Document Context Gate: Version & router context preserved cleanly
    expect(result.markdown).toContain('Latest Version: 16.4.0');
    expect(result.markdown).toContain('Using App Router');

    // 3. No Spurious "Yes" Gate: Dropdown chevrons MUST NOT emit "Yes"
    expect(result.markdown).not.toContain('16.4.0 / Yes');
    expect(result.markdown).not.toContain('/ Yes');

    // 4. Anti-Scaffolding Gate: No synthetic HTML cite- anchors or wrapper headings
    expect(result.markdown).not.toContain('id="cite-');
    expect(result.markdown).not.toContain('## Core Page Content');
    expect(result.markdown).not.toContain('## Structured Entity Metadata');

    // 5. Strictly ONE Primary H1 Gate: Must not duplicate page title and article H1
    const h1Headings = result.markdown.match(/^#\s+[^\n]+/gm) || [];
    expect(h1Headings).toHaveLength(1);
    expect(result.markdown).toContain('# Next.js Docs');
    expect(result.markdown).not.toContain('# Next.js Docs | Next.js');

    // 6. Feedback Widget Stripping Gate: "Was this helpful? supported. Send" MUST NOT leak
    expect(result.markdown).not.toContain('Was this helpful?');
    expect(result.markdown).not.toContain('supported. Send');

    // 7. Zero Synthetic Metadata Table Gate: Bot-only tables from JSON-LD stripped
    expect(result.markdown).not.toContain('### Technical Documentation');

    // 8. Pagination Context Gate: Previous/Next navigation preserved
    expect(result.markdown).toContain('**Navigation:**');
    expect(result.markdown).toContain('[← Previous: Rspack](/docs/community/rspack)');
    expect(result.markdown).toContain('[Next: App Router →](/docs/app)');
  });

  it('SaaS Pricing Matrix (Resend Benchmark): verifies clean tables, deduplicates carousels, prunes orphan tablists, and marks exclusions', async () => {
    const resendPricingHtml = `
      <!DOCTYPE html>
      <html>
        <head>
          <title>Pricing · Resend</title>
          <script type="application/ld+json">
          {
            "@context": "https://schema.org",
            "@type": "FAQPage",
            "mainEntity": [
              {
                "@type": "Question",
                "name": "Do you offer any discounts for annual subscriptions?",
                "acceptedAnswer": { "@type": "Answer", "text": "No, we only provide monthly plans." }
              }
            ]
          }
          </script>
        </head>
        <body>
          <main>
            <h1>Pricing</h1>
            <!-- Client-rendered tab switcher with orphan labels -->
            <div data-orientation="horizontal" role="tablist">
              <button role="tab">Transactional emails</button>
              <button role="tab">Marketing emails</button>
            </div>

            <!-- Plan Cards with opacity-0 hidden badges and check/cross icons in li -->
            <section class="plans">
              <div class="card">
                <h3>Free<span class="opacity-0">Recommended</span></h3>
                <span>$0 / mo</span>
                <ul>
                  <li><svg class="text-green-10" aria-label="Included"><path d="M...check"/></svg> 3,000 emails/mo</li>
                  <li><svg class="text-default" aria-label="Excluded"><path d="M...1.414 1.414l-1.06 1.06a1.5 1.5 0 0 0 0 2.121"/></svg> Single Sign-On</li>
                </ul>
              </div>
              <div class="card">
                <h3>Pro<span class="opacity-0">Recommended</span></h3>
                <span>$20 / mo</span>
                <ul>
                  <li><svg class="text-green-10" aria-label="Included"><path d="M...check"/></svg> 50,000 emails/mo</li>
                  <li><svg class="text-default" aria-label="Excluded"><path d="M...1.414 1.414l-1.06 1.06a1.5 1.5 0 0 0 0 2.121"/></svg> Single Sign-On</li>
                </ul>
              </div>
            </section>

            <!-- Detailed Comparison Table with SVG checks and dashes -->
            <h2>Deliverability & reliability</h2>
            <table>
              <thead>
                <tr><th>Feature</th><th>Free</th><th>Pro</th></tr>
              </thead>
              <tbody>
                <tr>
                  <td>Custom domains</td>
                  <td>3</td>
                  <td>10</td>
                </tr>
                <tr>
                  <td>DKIM, SPF, DMARC</td>
                  <td><svg class="text-green-10" aria-label="Supported"></svg></td>
                  <td><svg class="text-green-10" aria-label="Supported"></svg></td>
                </tr>
                <tr>
                  <td>Dedicated IPs</td>
                  <td>–</td>
                  <td>With add-on</td>
                </tr>
              </tbody>
            </table>

            <!-- FAQ Accordion with Chevrons and Tailwind state transitions -->
            <h2>Frequently asked questions</h2>
            <div class="faq-item">
              <h3>
                <button type="button">
                  <svg class="chevron" aria-label="Expand accordion"><path d="M...chevron"/></svg>
                  <p>Do you offer any discounts for annual subscriptions?</p>
                </button>
              </h3>
              <div hidden="" class="data-starting-style:opacity-0 data-ending-style:opacity-0">
                <p>No, we only provide monthly plans.</p>
              </div>
            </div>

            <!-- Customer Logo Noise (Image-only li items with build hashes) -->
            <ul class="logo-marquee">
              <li><div class="logo"><img alt="Warner Bros" src="/static/customers/warner-bros.svg?dpl=dpl_123"/></div></li>
              <li><div class="logo"><img alt="Gumroad" src="/static/customers/gumroad.svg?dpl=dpl_456"/></div></li>
            </ul>

            <!-- Cloned Carousel Testimonial Track (duplicated 3x for infinite loop) -->
            <div class="carousel-container">
              <div class="track-wrapper">
                <ul class="marquee-track">
                  <li><blockquote>Our team loves Resend. It makes email sending so easy and reliable. Highly recommended for developer teams.</blockquote></li>
                </ul>
                <ul class="marquee-track">
                  <li><blockquote>Our team loves Resend. It makes email sending so easy and reliable. Highly recommended for developer teams.</blockquote></li>
                </ul>
                <ul class="marquee-track">
                  <li><blockquote>Our team loves Resend. It makes email sending so easy and reliable. Highly recommended for developer teams.</blockquote></li>
                </ul>
              </div>
            </div>
          </main>
        </body>
      </html>
    `;

    const result = await compileHtmlToMarkdown(resendPricingHtml, 'https://resend.com/pricing');

    // 1. FAQ Heading & Answer Gate: Must NOT prepend "### Yes" or leave empty "### "
    expect(result.markdown).not.toContain('#### Yes');
    expect(result.markdown).not.toMatch(/^###\s*$/m);
    expect(result.markdown).toContain('### Do you offer any discounts for annual subscriptions?');
    expect(result.markdown).toContain('No, we only provide monthly plans.');

    // 2. Tablist Pruning Gate: Orphan tablist button labels MUST be pruned from AST
    expect(result.markdown).not.toContain('Transactional emails\nMarketing emails');
    expect(result.markdown).toContain('omitted_dynamic_states: ["non_default_tab_panels", "volume_slider_tiers"]');

    // 3. Hidden Text Gate: Opacity-0 badges must NOT concatenate onto plan titles
    expect(result.markdown).not.toContain('FreeRecommended');
    expect(result.markdown).not.toContain('ProRecommended');
    expect(result.markdown).toContain('### Free');
    expect(result.markdown).toContain('### Pro');
    expect(result.markdown).toMatch(/^###\s+Free\s*$/m);
    expect(result.markdown).toMatch(/^###\s+Pro\s*$/m);

    // 4. Plan Pricing & Quota Recall Gate
    expect(result.markdown).toContain('$0 / mo');
    expect(result.markdown).toContain('$20 / mo');
    expect(result.markdown).toContain('3,000 emails/mo');
    expect(result.markdown).toContain('50,000 emails/mo');

    // 5. Exclusions Marker Gate: Single Sign-On must be marked as excluded in Free plan card
    expect(result.markdown).toContain('✖ Single Sign-On');

    // 6. Comparison Table Gate: Checks converted to Yes, dashes preserved
    expect(result.markdown).toContain('| DKIM, SPF, DMARC | Yes | Yes |');
    expect(result.markdown).toContain('| Dedicated IPs | – | With add-on |');

    // 7. No Raw JSON-LD in Body Gate: <script> tags removed from DOM
    expect(result.markdown).not.toContain('{"@context":"https://schema.org"');
    expect(result.markdown).not.toContain('{"@type":"FAQPage"');

    // 8. Carousel Deduplication Gate: Testimonial text must only appear once, not 3x
    const testimonialMatches = result.markdown.match(/Our team loves Resend/g);
    expect(testimonialMatches).toHaveLength(1);

    // 9. Logo Noise Gate: Image-only customer logo list items with build hashes stripped
    expect(result.markdown).not.toContain('dpl=');
    expect(result.markdown).not.toContain('Warner Bros');
  });

  it('Pricing Matrix Numeric & Currency Recall Gate: handles thousands separators, split spans, HTML entities, token boundaries, and non-vacuous zero-token states', async () => {
    // Multi-tier SaaS Pricing Page with thousands separators ($1,150), split spans (<span>$</span><span>20</span>),
    // HTML entities (&#36;49), and non-visible phantom prices in <script>/<template>/display:none
    const pricingHtml = `
      <!DOCTYPE html>
      <html>
        <head>
          <title>SaaS Enterprise Pricing</title>
          <script>window.__HYDRATION_DATA__ = { legacyHiddenPrice: "$9,999 / mo" };</script>
        </head>
        <body>
          <main>
            <h1>Enterprise Pricing</h1>
            <template><p>Draft tier: $777 / mo</p></template>
            <div style="display: none"><p>Deprecated tier: $888 / mo</p></div>
            <div class="plans">
              <div class="card">
                <h3>Starter</h3>
                <div class="price"><span>$</span><span>20</span> / mo</div>
                <p>Base tier</p>
              </div>
              <div class="card">
                <h3>Team</h3>
                <div class="price">&#36;49 / mo</div>
                <p>Collaborative tier</p>
              </div>
              <div class="card">
                <h3>Scale</h3>
                <span class="price">$200 / mo</span>
                <p>Growth tier</p>
              </div>
              <div class="card">
                <h3>Enterprise</h3>
                <span class="price">$1,150 / mo</span>
                <p>Includes dedicated IP and SLA</p>
              </div>
            </div>
            <h2>Volume Pricing</h2>
            <p>High-volume automations billed at $0.0015 / per run.</p>
          </main>
        </body>
      </html>
    `;

    // 1. Direct verification of the converter-independent reference extractor
    const independentRef = extractIndependentStaticReference(pricingHtml);
    expect(independentRef.currencyTokens).toContain('$20 / mo');
    expect(independentRef.currencyTokens).toContain('$49 / mo');
    expect(independentRef.currencyTokens).toContain('$200 / mo');
    expect(independentRef.currencyTokens).toContain('$1,150 / mo');
    expect(independentRef.currencyTokens).toContain('$0.0015 / per run');
    // Non-visible prices in <script>, <template>, and display:none MUST be excluded from reference tokens
    expect(independentRef.currencyTokens).not.toContain('$9,999 / mo');
    expect(independentRef.currencyTokens).not.toContain('$777 / mo');
    expect(independentRef.currencyTokens).not.toContain('$888 / mo');

    const result = await compileHtmlToMarkdown(pricingHtml, 'https://example.com/pricing');

    // 2. Verify all prices including split spans, HTML entities, thousands separators, and small decimals
    expect(result.markdown).toContain('$20 / mo');
    expect(result.markdown).toContain('$49 / mo');
    expect(result.markdown).toContain('$200 / mo');
    expect(result.markdown).toContain('$1,150 / mo');
    expect(result.markdown).toContain('$0.0015 / per run');

    // 3. Verify token boundary handling: dropping $20 when $200 is present MUST NOT be masked by substring match
    const boundaryShortfallHtml = `
      <!DOCTYPE html>
      <html>
        <head><title>Boundary Test</title></head>
        <body>
          <main>
            <h1>Plans</h1>
            <aside class="dropped-tier"><p>Starter: $20</p></aside>
            <p>Scale: $200</p>
          </main>
        </body>
      </html>
    `;
    const boundaryResult = await compileHtmlToMarkdown(boundaryShortfallHtml, 'https://example.com/boundary');
    expect(boundaryResult.monitoredCurrencyTokens).toContain('$20');
    expect(boundaryResult.monitoredCurrencyTokens).toContain('$200');
    expect(boundaryResult.missingCurrencyTokens).toContain('$20');
    expect(boundaryResult.currencyRecallRatio).toBe(0.5);

    // 4. Currency Recall Gate: 100% of monitored static figures verified on valid pricing page
    expect(result.markdown).toContain('currency_recall: "100%"');
    expect(result.markdown).toContain('currency_recall_static_html: "100%"');
    expect(result.currencyRecallRatio).toBe(1.0);

    // 5. Zero-token non-vacuous pass + No synthetic <title>-to-# H1 promotion when body has content
    const docsHtml = `
      <!DOCTYPE html>
      <html>
        <head><title>Documentation Guide | Head Metadata</title></head>
        <body><main><h2>Quickstart</h2><p>Getting started guide without pricing or an H1 tag.</p></main></body>
      </html>
    `;
    const docsResult = await compileHtmlToMarkdown(docsHtml, 'https://example.com/guide');
    expect(docsResult.currencyRecallRatio).toBeUndefined();
    expect(docsResult.markdown).toContain('currency_recall_static_html: "not_applicable"');
    expect(docsResult.markdown).not.toContain('currency_recall: "100%"');
    // Head <title> stays in frontmatter and is NOT promoted to a synthetic # H1 in the body
    expect(docsResult.markdown).toContain('title: "Documentation Guide | Head Metadata"');
    expect(docsResult.markdown).not.toContain('# Documentation Guide | Head Metadata');
    expect(docsResult.markdown).toContain('## Quickstart');
  });

  it('Live Production Fail-Closed Gates: falls closed to raw origin HTML when currency or FAQ answer recall drops below 100%', async () => {
    const originalFetch = globalThis.fetch;

    // 1. Normal pricing page with 100% currency & FAQ recall serves compiled Markdown
    const pricingHtml = `
      <!DOCTYPE html>
      <html>
        <head><title>SaaS Pricing</title></head>
        <body>
          <main>
            <h1>Plans</h1>
            <p>Pro Plan: $49 / mo</p>
            <h3>Do you offer annual billing?</h3>
            <div hidden=""><p>Yes, annual billing saves 20 percent across all plans.</p></div>
          </main>
        </body>
      </html>
    `;

    globalThis.fetch = vi.fn().mockImplementation(async () => {
      return new Response(pricingHtml, {
        status: 200,
        headers: { 'Content-Type': 'text/html; charset=utf-8' },
      });
    });

    const normalRes = await app.request('/proxy?url=https://mock-saas.com/pricing&twin=false&purge=1', {
      headers: {
        Host: 'answerrail.com',
        'User-Agent': 'Mozilla/5.0 (compatible; ClaudeBot/1.0; +https://anthropic.com)',
        'Accept': 'text/markdown',
      },
    });

    expect(normalRes.status).toBe(200);
    expect(normalRes.headers.get('x-answerrail-routing')).toBe('edge-interception');
    expect(normalRes.headers.get('x-answerrail-currency-recall')).toBe('100%');
    expect(normalRes.headers.get('x-answerrail-faq-recall')).toBe('100%');
    expect(normalRes.headers.get('content-type')).toContain('text/markdown');

    // 2. Genuine Currency Shortfall: <aside> inside <main> contains a price ($499 / mo) that AST clutter-stripping
    // removes, while the independent reference extractor monitors all visible prices in <main>.
    // Recall drops to 50% (1 of 2 prices) and /proxy MUST fail-closed to raw HTML passthrough with CACHE BYPASS.
    const shortfallHtml = `
      <!DOCTYPE html>
      <html>
        <head><title>Pricing With Dropped Aside Tier</title></head>
        <body>
          <main>
            <h1>Plans</h1>
            <p>Standard Tier: $49 / mo</p>
            <aside class="enterprise-callout">
              <h3>Dedicated Cluster</h3>
              <p>Enterprise rate: $499 / mo</p>
            </aside>
          </main>
        </body>
      </html>
    `;

    globalThis.fetch = vi.fn().mockImplementation(async () => {
      return new Response(shortfallHtml, {
        status: 200,
        headers: { 'Content-Type': 'text/html; charset=utf-8' },
      });
    });

    const shortfallRes = await app.request('/proxy?url=https://mock-saas.com/pricing-shortfall&twin=false&purge=1', {
      headers: {
        Host: 'answerrail.com',
        'User-Agent': 'Mozilla/5.0 (compatible; ClaudeBot/1.0; +https://anthropic.com)',
        'Accept': 'text/markdown',
      },
    });

    expect(shortfallRes.status).toBe(200);
    expect(shortfallRes.headers.get('x-answerrail-routing')).toBe('fail-closed-currency-shortfall');
    expect(shortfallRes.headers.get('x-answerrail-currency-recall')).toBe('50%');
    expect(shortfallRes.headers.get('x-answerrail-missing-prices')).toContain('$499 / mo');
    expect(shortfallRes.headers.get('x-answerrail-cache')).toBe('BYPASS');
    expect(shortfallRes.headers.get('content-type')).toContain('text/html');
    const shortfallBody = await shortfallRes.text();
    expect(shortfallBody).toContain('<!DOCTYPE html>');
    expect(shortfallBody).toContain('$499 / mo');

    // 3. Genuine FAQ Answer Shortfall: If a collapsed FAQ answer (<div hidden>) is stripped by a selector
    // (e.g. nested inside an aside/sidebar), FAQ recall drops to 0% and /proxy fails closed to raw HTML.
    const faqShortfallHtml = `
      <!DOCTYPE html>
      <html>
        <head><title>FAQ With Dropped Answer</title></head>
        <body>
          <main>
            <h1>Documentation FAQ</h1>
            <h3>How are rate limits enforced?</h3>
            <aside class="faq-drawer">
              <div hidden=""><p>Rate limits are enforced per API key at 100 requests per second.</p></div>
            </aside>
          </main>
        </body>
      </html>
    `;

    globalThis.fetch = vi.fn().mockImplementation(async () => {
      return new Response(faqShortfallHtml, {
        status: 200,
        headers: { 'Content-Type': 'text/html; charset=utf-8' },
      });
    });

    const faqShortfallRes = await app.request('/proxy?url=https://mock-saas.com/faq-shortfall&twin=false&purge=1', {
      headers: {
        Host: 'answerrail.com',
        'User-Agent': 'Mozilla/5.0 (compatible; ClaudeBot/1.0; +https://anthropic.com)',
        'Accept': 'text/markdown',
      },
    });

    expect(faqShortfallRes.status).toBe(200);
    expect(faqShortfallRes.headers.get('x-answerrail-routing')).toBe('fail-closed-faq-recall-shortfall');
    expect(faqShortfallRes.headers.get('x-answerrail-faq-recall')).toBe('0%');
    expect(faqShortfallRes.headers.get('x-answerrail-cache')).toBe('BYPASS');
    expect(faqShortfallRes.headers.get('content-type')).toContain('text/html');
    expect(await faqShortfallRes.text()).toContain('Rate limits are enforced per API key');

    globalThis.fetch = originalFetch;
  });

  it('Twin Resolver Production Service: verifies same-origin, multi-hop redirect revalidation, DNS rebinding guard, content-type guards, and size limits', async () => {
    const originTarget = 'https://resend.com/pricing';

    // 1. Production Candidate Validator
    expect(isSafeTwinCandidate('/pricing.md', originTarget).safe).toBe(true);
    expect(isSafeTwinCandidate('https://resend.com/pricing.md', originTarget).safe).toBe(true);

    // Cross-origin rejected
    expect(isSafeTwinCandidate('https://evil.com/pricing.md', originTarget).safe).toBe(false);
    expect(isSafeTwinCandidate('https://sub.resend.com/pricing.md', originTarget).safe).toBe(false);

    // Alternate port rejected
    expect(isSafeTwinCandidate('https://resend.com:8443/pricing.md', originTarget).safe).toBe(false);

    // 2. Production Redirect Destination Validator
    expect(isSafeRedirectDestination('https://resend.com/pricing.md', '/static/pricing.md', originTarget).safe).toBe(true);
    expect(isSafeRedirectDestination('https://resend.com/pricing.md', 'https://evil.com/leak', originTarget).safe).toBe(false);
    expect(isSafeRedirectDestination('https://resend.com/pricing.md', 'http://169.254.169.254/latest/meta-data', originTarget).safe).toBe(false);

    // 3. Mocked resolveAuthoritativeTwin execution: Happy Path & Multi-Hop Same-Origin Redirect
    const htmlWithTwin = `
      <html>
        <head>
          <link rel="alternate" type="text/markdown" href="/pricing.md" />
        </head>
      </html>
    `;

    const mockFetchMultiHop: typeof fetch = vi.fn().mockImplementation(async (url: any) => {
      if (String(url) === 'https://resend.com/pricing.md') {
        return new Response(null, {
          status: 302,
          headers: { Location: '/docs/pricing-v2.md' },
        });
      }
      return new Response('# Authoritative Resend Pricing Twin\n\n- Free: $0\n- Pro: $20\n', {
        status: 200,
        headers: { 'Content-Type': 'text/markdown; charset=utf-8' },
      });
    });

    const twinResult = await resolveAuthoritativeTwin(htmlWithTwin, originTarget, mockFetchMultiHop);
    expect(twinResult).not.toBeNull();
    expect(twinResult?.twinUrl).toBe('https://resend.com/docs/pricing-v2.md');
    expect(twinResult?.markdown).toContain('# Authoritative Resend Pricing Twin');

    // 3b. Multi-hop redirect to cross-origin or private IP on hop 2 is rejected
    const mockFetchUnsafeHop2: typeof fetch = vi.fn().mockImplementation(async (url: any) => {
      if (String(url) === 'https://resend.com/pricing.md') {
        return new Response(null, {
          status: 302,
          headers: { Location: '/hop1.md' },
        });
      }
      return new Response(null, {
        status: 302,
        headers: { Location: 'http://127.0.0.1/secret.md' },
      });
    });
    const unsafeHopResult = await resolveAuthoritativeTwin(htmlWithTwin, originTarget, mockFetchUnsafeHop2);
    expect(unsafeHopResult).toBeNull();

    // 4. Mocked resolveAuthoritativeTwin: Rejects text/html payloads masquerading as markdown
    const mockFetchHtml: typeof fetch = vi.fn().mockImplementation(async () => {
      return new Response('<!DOCTYPE html><html><body><h1>Fake Markdown</h1></body></html>', {
        status: 200,
        headers: { 'Content-Type': 'text/html; charset=utf-8' },
      });
    });
    const htmlRejectionResult = await resolveAuthoritativeTwin(htmlWithTwin, originTarget, mockFetchHtml);
    expect(htmlRejectionResult).toBeNull();

    // 5. Mocked resolveAuthoritativeTwin: Rejects payloads exceeding 2MB limit
    const oversizedBody = 'A'.repeat(LIMITS.MAX_HTML_BYTES + 1024);
    const mockFetchOversized: typeof fetch = vi.fn().mockImplementation(async () => {
      return new Response(oversizedBody, {
        status: 200,
        headers: { 'Content-Type': 'text/markdown; charset=utf-8' },
      });
    });
    const oversizedResult = await resolveAuthoritativeTwin(htmlWithTwin, originTarget, mockFetchOversized);
    expect(oversizedResult).toBeNull();
  });

  it('SSRF, Network Boundary & Resolution-Time DNS Rebinding Hardening: blocks 0.0.0.0, 127.1, IPv4-mapped IPv6, userinfo, and TTL=0 DNS rebinding', async () => {
    // 1. Zero address & loopback short forms
    expect(isSafePublicUrl('http://0.0.0.0/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://127.1/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://127.0.1/pricing.md', false).safe).toBe(false);

    // 2. IPv4-mapped IPv6 (both dotted-quad and WHATWG normalized hex form ::ffff:7f00:1)
    expect(isSafePublicUrl('http://[::ffff:127.0.0.1]/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://[::ffff:7f00:1]/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://[::ffff:169.254.169.254]/pricing.md', false).safe).toBe(false);
    // Public IPv4 mapped in IPv6 (93.184.216.34) is properly decoded and permitted
    expect(isSafePublicUrl('http://[::ffff:93.184.216.34]/pricing.md', false).safe).toBe(true);

    // 3. Trailing dot DNS root evasion
    expect(isSafePublicUrl('http://localhost./pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://broadcasthost./pricing.md', false).safe).toBe(false);

    // 4. Embedded userinfo in URL
    expect(isSafePublicUrl('https://resend.com@evil.example/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('https://user:password@resend.com/pricing.md', false).safe).toBe(false);

    // 5. Hex, octal, integer representations
    expect(isSafePublicUrl('http://0x7f000001/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://2130706433/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://0177.0.0.1/pricing.md', false).safe).toBe(false);

    // 6. Private IPv6 loopback and subnets
    expect(isSafePublicUrl('http://[::1]/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://[fe80::1]/pricing.md', false).safe).toBe(false);
    expect(isSafePublicUrl('http://[fc00::1]/pricing.md', false).safe).toBe(false);

    // 7. Legitimate public URLs must pass static check
    expect(isSafePublicUrl('https://resend.com/pricing', false).safe).toBe(true);
    expect(isSafePublicUrl('https://nextjs.org/docs', false).safe).toBe(true);

    // 8. Resolution-Time DNS Verification: Public IP passes
    const publicCheck = await verifyResolvedHostSafety(
      'https://resend.com/pricing',
      async () => ['93.184.216.34'],
      false
    );
    expect(publicCheck.safe).toBe(true);

    // 9. Resolution-Time DNS Verification: Public-looking domain resolving to private IP (10.0.0.42) is blocked
    const privateDnsCheck = await verifyResolvedHostSafety(
      'https://internal-alias.example.com/pricing',
      async () => ['10.0.0.42'],
      false
    );
    expect(privateDnsCheck.safe).toBe(false);
    expect(privateDnsCheck.reason).toContain('DNS rebinding / private IP resolution blocked');

    // 10. TTL=0 TOCTOU DNS Rebinding Attack: Lookup 1 returns public IP (93.184.216.34), Lookup 2 flips to 127.0.0.1
    let lookupCount = 0;
    const rebindingResolver = async () => {
      lookupCount++;
      return lookupCount === 1 ? ['93.184.216.34'] : ['127.0.0.1'];
    };
    const rebindCheck = await verifyResolvedHostSafety(
      'https://rebind-attacker.example.com/pricing.md',
      rebindingResolver,
      false
    );
    expect(rebindCheck.safe).toBe(false);
    expect(rebindCheck.reason).toContain('127.0.0.1');
  });

  it('Origin Fetcher Limit Enforcement: enforces 2MB payload cap and timeout abort', async () => {
    // 1. Verify buffer slicing at exactly LIMITS.MAX_HTML_BYTES (2MB)
    expect(LIMITS.MAX_HTML_BYTES).toBe(2 * 1024 * 1024);
    expect(LIMITS.FETCH_TIMEOUT_MS).toBe(10000);

    const originalFetch = globalThis.fetch;
    const oversizedHtml = '<html><body>' + 'A'.repeat(LIMITS.MAX_HTML_BYTES + 4096) + '</body></html>';
    globalThis.fetch = vi.fn().mockImplementation(async () => {
      return new Response(oversizedHtml, {
        status: 200,
        headers: { 'Content-Type': 'text/html; charset=utf-8' },
      });
    });

    const truncatedResult = await fetchOrigin('https://mock-large.com');
    expect(truncatedResult.ok).toBe(true);
    expect(truncatedResult.html).toBeDefined();
    expect(Buffer.byteLength(truncatedResult.html!, 'utf8')).toBeLessThanOrEqual(LIMITS.MAX_HTML_BYTES);

    globalThis.fetch = originalFetch;

    // 2. Fetcher returns status 502 with structured error if connection times out
    const timeoutResult = await fetchOrigin('https://example.com', undefined, { timeoutMs: 1 });
    if (!timeoutResult.ok) {
      expect(timeoutResult.status).toBe(502);
      expect(timeoutResult.error).toBeDefined();
    }
  });

  it('Real Recorded SaaS Pricing Snapshot (Stripe/Supabase Pattern): verifies clean multi-tier extraction', async () => {
    const recordedSnapshotHtml = `
      <!DOCTYPE html>
      <html>
        <head><title>Cloud Database Pricing</title></head>
        <body>
          <main>
            <h1>Database Pricing & Tiers</h1>
            <p>Start for free, upgrade as your database scales.</p>
            <div class="pricing-grid">
              <div class="tier-card">
                <h3>Community</h3>
                <span class="cost">$0 / mo</span>
                <p>500MB database storage included.</p>
              </div>
              <div class="tier-card">
                <h3>Pro Tier</h3>
                <span class="cost">$25 / mo</span>
                <p>8GB database storage included.</p>
                <p>Extra compute: $10 / mo per project.</p>
              </div>
              <div class="tier-card">
                <h3>Team</h3>
                <span class="cost">$599 / mo</span>
                <p>SOC2, custom SLA, and priority support.</p>
              </div>
            </div>
            <h2>Storage Add-ons</h2>
            <table>
              <thead><tr><th>Add-on</th><th>Rate</th></tr></thead>
              <tbody>
                <tr><td>Additional Disk</td><td>$0.125 / GB</td></tr>
                <tr><td>Point-in-Time Recovery</td><td>$100 / mo</td></tr>
              </tbody>
            </table>
          </main>
        </body>
      </html>
    `;

    const result = await compileHtmlToMarkdown(recordedSnapshotHtml, 'https://example.com/db-pricing');
    expect(result.markdown).toContain('$0 / mo');
    expect(result.markdown).toContain('$25 / mo');
    expect(result.markdown).toContain('$599 / mo');
    expect(result.markdown).toContain('$10 / mo');
    expect(result.markdown).toContain('$100 / mo');
    expect(result.currencyRecallRatio).toBe(1.0);
    expect(result.markdown).toContain('currency_recall_static_html: "100%"');
  });
});