camel_component_file/

lib.rs

//! File system component for rust-camel — polls directories for new or changed
//! files as consumer, writes exchange bodies to files as producer.
//!
//! Main types: `FileBundle`, `FileComponent`, `FileConsumer`, `FileProducer`.
//! Main modules: `bundle`.

mod atomic_write;
pub mod bundle;
pub mod health;
mod poll_logic;
mod polling_consumer;

use poll_logic::poll_directory;

pub use bundle::FileBundle;
pub use health::FileHealthCheck;

use std::collections::HashSet;
use std::future::Future;
use std::path::PathBuf;
use std::pin::Pin;
use std::str::FromStr;
use std::sync::Arc;
use std::task::{Context, Poll};
use std::time::Duration;

use async_trait::async_trait;
use dashmap::DashMap;
use regex::Regex;
use tokio::fs;
use tokio::fs::OpenOptions;
use tokio::io;
use tokio::io::AsyncWriteExt;
use tokio::time;
use tower::Service;
use tracing::{debug, warn};

use camel_component_api::{Body, BoxProcessor, CamelError, Exchange};
use camel_component_api::{
    Component, ComponentMetadata, Consumer, ConsumerContext, Endpoint, PollingConsumer,
    ProducerContext, UriOption,
};
use camel_component_api::{UriConfig, parse_uri};
use camel_language_api::Language;
use camel_language_simple::SimpleLanguage;

// ---------------------------------------------------------------------------
// TempFileGuard — RAII cleanup for temp files (panic-safe)
// ---------------------------------------------------------------------------

/// RAII guard that ensures temp file cleanup even on panic.
///
/// When dropped, removes the file at `path` unless `disarm` is set to true.
/// This protects against temp file leaks if `io::copy` panics mid-write.
pub(crate) struct TempFileGuard {
    path: PathBuf,
    disarm: bool,
}

impl TempFileGuard {
    pub(crate) fn new(path: PathBuf) -> Self {
        Self {
            path,
            disarm: false,
        }
    }

    /// Call after successful rename to prevent cleanup.
    pub(crate) fn disarm(&mut self) {
        self.disarm = true;
    }
}

impl Drop for TempFileGuard {
    fn drop(&mut self) {
        if !self.disarm {
            // Best-effort cleanup; ignore errors (file may not exist)
            let _ = std::fs::remove_file(&self.path);
        }
    }
}

// ---------------------------------------------------------------------------
// FileExistStrategy
// ---------------------------------------------------------------------------

/// Strategy for handling existing files when writing.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum FileExistStrategy {
    /// Overwrite existing file (default).
    #[default]
    Override,
    /// Append to existing file.
    Append,
    /// Fail if file exists.
    Fail,
    /// Skip write if file already exists.
    Ignore,
    TryRename,
}

impl FromStr for FileExistStrategy {
    type Err = String;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "Override" | "override" => Ok(FileExistStrategy::Override),
            "Append" | "append" => Ok(FileExistStrategy::Append),
            "Fail" | "fail" => Ok(FileExistStrategy::Fail),
            "Ignore" | "ignore" => Ok(FileExistStrategy::Ignore),
            "TryRename" | "tryRename" => Ok(FileExistStrategy::TryRename),
            other => Err(format!("unknown FileExistStrategy: {other}")),
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum ReadLockStrategy {
    #[default]
    None,
    InProcess,
    Rename,
}

impl FromStr for ReadLockStrategy {
    type Err = String;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "None" | "none" => Ok(Self::None),
            "InProcess" | "inProcess" | "inprocess" => Ok(Self::InProcess),
            "Rename" | "rename" => Ok(Self::Rename),
            other => Err(format!("unknown ReadLockStrategy: {other}")),
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum IdempotentKey {
    #[default]
    None,
    FileName,
    FilePath,
    FileSize,
    /// Lightweight fingerprint using file path + last-modified timestamp (not a cryptographic hash).
    Digest,
}

impl FromStr for IdempotentKey {
    type Err = String;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "None" | "none" => Ok(Self::None),
            "FileName" | "fileName" | "filename" => Ok(Self::FileName),
            "FilePath" | "filePath" | "filepath" => Ok(Self::FilePath),
            "FileSize" | "fileSize" | "filesize" => Ok(Self::FileSize),
            "Digest" | "digest" => Ok(Self::Digest),
            other => Err(format!("unknown IdempotentKey: {other}")),
        }
    }
}

// ---------------------------------------------------------------------------
// FileGlobalConfig
// ---------------------------------------------------------------------------

/// Global configuration for File component.
/// Supports serde deserialization with defaults and builder methods.
/// These are the fallback defaults when URI params are not set.
#[derive(Debug, Clone, PartialEq, serde::Deserialize)]
#[serde(default)]
pub struct FileGlobalConfig {
    pub delay_ms: u64,
    pub initial_delay_ms: u64,
    pub read_timeout_ms: u64,
    pub write_timeout_ms: u64,
}

impl Default for FileGlobalConfig {
    fn default() -> Self {
        Self {
            delay_ms: 500,
            initial_delay_ms: 1_000,
            read_timeout_ms: 30_000,
            write_timeout_ms: 30_000,
        }
    }
}

impl FileGlobalConfig {
    pub fn new() -> Self {
        Self::default()
    }
    pub fn with_delay_ms(mut self, v: u64) -> Self {
        self.delay_ms = v;
        self
    }
    pub fn with_initial_delay_ms(mut self, v: u64) -> Self {
        self.initial_delay_ms = v;
        self
    }
    pub fn with_read_timeout_ms(mut self, v: u64) -> Self {
        self.read_timeout_ms = v;
        self
    }
    pub fn with_write_timeout_ms(mut self, v: u64) -> Self {
        self.write_timeout_ms = v;
        self
    }
}

// ---------------------------------------------------------------------------
// CompiledFilters — precompiled file selection predicates
// ---------------------------------------------------------------------------

#[derive(Debug, Clone, Default)]
pub(crate) struct CompiledFilters {
    pub include_re: Option<Regex>,
    pub exclude_re: Option<Regex>,
    pub ant_include_patterns: Option<Vec<glob::Pattern>>,
    pub ant_exclude_patterns: Option<Vec<glob::Pattern>>,
    pub include_exts: Option<Vec<String>>,
    pub exclude_exts: Option<Vec<String>>,
}

impl CompiledFilters {
    pub fn compile(config: &FileConfig) -> Result<Self, CamelError> {
        let include_re = config
            .include
            .as_deref()
            .map(|p| {
                Regex::new(p).map_err(|e| CamelError::Config(format!("invalid include regex: {e}")))
            })
            .transpose()?;
        let exclude_re = config
            .exclude
            .as_deref()
            .map(|p| {
                Regex::new(p).map_err(|e| CamelError::Config(format!("invalid exclude regex: {e}")))
            })
            .transpose()?;
        let ant_include_patterns = config
            .ant_include
            .as_deref()
            .map(|list| {
                list.split(',')
                    .map(|s| {
                        s.trim().parse::<glob::Pattern>().map_err(|e| {
                            CamelError::Config(format!("invalid antInclude pattern '{s}': {e}"))
                        })
                    })
                    .collect::<Result<Vec<_>, _>>()
            })
            .transpose()?;
        let ant_exclude_patterns = config
            .ant_exclude
            .as_deref()
            .map(|list| {
                list.split(',')
                    .map(|s| {
                        s.trim().parse::<glob::Pattern>().map_err(|e| {
                            CamelError::Config(format!("invalid antExclude pattern '{s}': {e}"))
                        })
                    })
                    .collect::<Result<Vec<_>, _>>()
            })
            .transpose()?;
        let include_exts = config
            .include_ext
            .as_deref()
            .map(|list| list.split(',').map(|s| s.trim().to_lowercase()).collect());
        let exclude_exts = config
            .exclude_ext
            .as_deref()
            .map(|list| list.split(',').map(|s| s.trim().to_lowercase()).collect());
        Ok(Self {
            include_re,
            exclude_re,
            ant_include_patterns,
            ant_exclude_patterns,
            include_exts,
            exclude_exts,
        })
    }
}

// ---------------------------------------------------------------------------
// SortSpec — sort order for files (file:name, file:length, file:modified)
// ---------------------------------------------------------------------------

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum SortField {
    Name,
    Length,
    Modified,
}

#[derive(Debug, Clone)]
pub(crate) struct SortGroup {
    pub field: SortField,
    pub reverse: bool,
    pub ignore_case: bool,
}

#[derive(Debug, Clone)]
pub(crate) struct SortSpec {
    pub groups: Vec<SortGroup>,
}

impl FromStr for SortSpec {
    type Err = String;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        let mut groups = Vec::new();
        for raw_group in s.split(';') {
            let trimmed = raw_group.trim();
            if trimmed.is_empty() {
                continue;
            }
            let mut reverse = false;
            let mut ignore_case = false;
            let mut remaining = trimmed;
            let mut saw_ignore_case = false;

            loop {
                if let Some(rest) = remaining.strip_prefix("reverse:") {
                    if saw_ignore_case {
                        return Err("sortBy: reverse must precede ignoreCase".into());
                    }
                    reverse = true;
                    remaining = rest;
                    continue;
                }
                if let Some(rest) = remaining.strip_prefix("ignoreCase:") {
                    ignore_case = true;
                    saw_ignore_case = true;
                    remaining = rest;
                    continue;
                }
                break;
            }

            let field = match remaining {
                "file:name" => SortField::Name,
                "file:length" => SortField::Length,
                "file:modified" => SortField::Modified,
                other => return Err(format!("unsupported sortBy field: '{other}'")),
            };

            groups.push(SortGroup {
                field,
                reverse,
                ignore_case,
            });
        }
        if groups.is_empty() {
            return Err("sortBy must have at least one group".into());
        }
        Ok(SortSpec { groups })
    }
}

// ---------------------------------------------------------------------------
// FileConfig
// ---------------------------------------------------------------------------

/// Private container for macro-derived `uri_options()` and `metadata()`.
///
/// Mirrors `FileConfig`'s URI-parsed fields using `FromStr`-compatible types
/// (`u64` companion fields for Duration). `FileConfig` holds non-URI fields
/// (the `Duration` fields derived from `_ms` fields, `directory` as path);
/// metadata delegation targets this inner type.
#[derive(Debug, Clone, UriConfig)]
#[allow(dead_code)]
#[uri_scheme = "file"]
#[uri_config(
    skip_impl,
    metadata(
        scheme = "file",
        description = "Read/write files from a directory",
        producer,
        consumer
    ),
    crate = "camel_component_api"
)]
struct FileUriConfig {
    #[allow(dead_code)]
    _path: String,
    #[uri_param(
        name = "delay",
        default = "500",
        desc = "Delay between polls in milliseconds"
    )]
    delay_ms: u64,
    #[uri_param(
        name = "initialDelay",
        default = "1000",
        desc = "Initial delay before first poll in milliseconds"
    )]
    initial_delay_ms: u64,
    #[uri_param(
        default = "false",
        desc = "Do not delete or move files after processing"
    )]
    noop: bool,
    #[uri_param(default = "false", desc = "Delete files after processing")]
    delete: bool,
    #[uri_param(name = "move", desc = "Directory to move processed files to")]
    move_to: Option<String>,
    #[uri_param(name = "fileName", desc = "Fixed filename for producer")]
    file_name: Option<String>,
    #[uri_param(desc = "Regex pattern for including files")]
    include: Option<String>,
    #[uri_param(desc = "Regex pattern for excluding files")]
    exclude: Option<String>,
    #[uri_param(default = "false", desc = "Scan directories recursively")]
    recursive: bool,
    #[uri_param(
        name = "fileExist",
        kind = "enum:Override,Append,Fail,Ignore,TryRename",
        default = "Override",
        desc = "Strategy for handling existing files when writing"
    )]
    file_exist: FileExistStrategy,
    #[uri_param(
        name = "readLock",
        kind = "enum:None,InProcess,Rename",
        default = "None",
        desc = "Read lock strategy for concurrent consumers"
    )]
    read_lock_strategy: ReadLockStrategy,
    #[uri_param(
        name = "idempotentKey",
        kind = "enum:None,FileName,FilePath,FileSize,Digest",
        default = "None",
        desc = "In-memory idempotent key selector"
    )]
    idempotent_key: IdempotentKey,
    #[uri_param(name = "doneFileName", desc = "Done marker filename pattern")]
    done_file_name: Option<String>,
    #[uri_param(desc = "Charset for string body encoding")]
    charset: Option<String>,
    #[uri_param(
        name = "tempPrefix",
        desc = "Prefix for temporary files during atomic writes"
    )]
    temp_prefix: Option<String>,
    #[uri_param(
        default = "false",
        desc = "If true, fsync temp file and parent directory after atomic write"
    )]
    durable: bool,
    #[uri_param(
        name = "autoCreate",
        default = "true",
        desc = "Automatically create directories"
    )]
    auto_create: bool,
    #[uri_param(
        name = "startingDirectoryMustExist",
        default = "false",
        desc = "Verify the starting directory exists at startup"
    )]
    starting_directory_must_exist: bool,
    #[uri_param(
        name = "readTimeout",
        default = "30000",
        desc = "Read timeout in milliseconds"
    )]
    read_timeout_ms: u64,
    #[uri_param(
        name = "writeTimeout",
        default = "30000",
        desc = "Write timeout in milliseconds"
    )]
    write_timeout_ms: u64,
    #[uri_param(name = "maxDepth", desc = "Maximum recursion depth for scanning")]
    max_depth: usize,
    #[uri_param(
        name = "minDepth",
        default = "0",
        desc = "Minimum recursion depth for scanning"
    )]
    min_depth: usize,
    #[uri_param(
        name = "maxMessagesPerPoll",
        default = "0",
        desc = "Maximum messages per poll"
    )]
    max_messages_per_poll: i64,
    #[uri_param(
        name = "eagerMaxMessagesPerPoll",
        default = "true",
        desc = "Eagerly enforce maxMessagesPerPoll"
    )]
    eager_max_messages_per_poll: bool,
    #[uri_param(
        name = "antInclude",
        desc = "Ant-style include pattern (comma-separated)"
    )]
    ant_include: Option<String>,
    #[uri_param(
        name = "antExclude",
        desc = "Ant-style exclude pattern (comma-separated)"
    )]
    ant_exclude: Option<String>,
    #[uri_param(
        name = "includeExt",
        desc = "File extensions to include (comma-separated)"
    )]
    include_ext: Option<String>,
    #[uri_param(
        name = "excludeExt",
        desc = "File extensions to exclude (comma-separated)"
    )]
    exclude_ext: Option<String>,
    #[uri_param(default = "false", desc = "Shuffle files before processing")]
    shuffle: bool,
    #[uri_param(name = "sortBy", desc = "Sort specification for file ordering")]
    sort_spec: Option<SortSpec>,
    #[uri_param(
        name = "cleanupStaleTemps",
        default = "true",
        desc = "Sweep stale temp files at consumer startup"
    )]
    cleanup_stale_temps: bool,
    #[uri_param(
        name = "maxWriteBytes",
        default = "0",
        desc = "Maximum bytes written per file (0 = unlimited). Guards disk-fill via large/streaming bodies"
    )]
    max_write_bytes: u64,
}

/// Configuration for file component endpoints.
///
/// # Streaming
///
/// Both the file consumer and producer use **native streaming** with no RAM
/// materialization:
///
/// - The **consumer** creates a `Body::Stream` backed by `tokio::fs::File` via
///   `ReaderStream`. Files of any size are handled without loading them into memory.
///
/// - The **producer** writes via `tokio::io::copy` directly to a `tokio::fs::File`
///   using `Body::into_async_read()`. Writes for the `Override` strategy are
///   **atomic**: data is written to a temporary file first and renamed only on
///   success, preventing partial files on failure.
///
/// # Write strategies (`fileExist` URI parameter)
///
/// | Value | Behavior |
/// |-------|----------|
/// | `Override` (default) | Atomic write via temp file + rename |
/// | `Append` | Appends to existing file; non-atomic by nature |
/// | `Fail` | Returns error if file already exists |
/// | `Ignore` | Skip write if file already exists |
#[derive(Debug, Clone)]
pub struct FileConfig {
    /// Directory path to read from or write to.
    pub directory: String,

    /// Polling delay in milliseconds (companion field for `delay`).
    #[allow(dead_code)]
    delay_ms: u64,

    /// Polling delay as Duration.
    pub delay: Duration,

    /// Initial delay in milliseconds (companion field for `initial_delay`).
    #[allow(dead_code)]
    initial_delay_ms: u64,

    /// Initial delay as Duration.
    pub initial_delay: Duration,

    /// If true, don't delete or move files after processing.
    pub noop: bool,

    /// If true, delete files after processing.
    pub delete: bool,

    /// Directory to move processed files to (only if not noop/delete).
    /// Default is ".camel" when not specified and noop/delete are false.
    move_to: Option<String>,

    /// Fixed filename for producer (optional).
    pub file_name: Option<String>,

    /// Regex pattern for including files (consumer).
    pub include: Option<String>,

    /// Regex pattern for excluding files (consumer).
    pub exclude: Option<String>,

    /// Ant-style include pattern (comma-separated).
    pub ant_include: Option<String>,

    /// Ant-style exclude pattern (comma-separated).
    pub ant_exclude: Option<String>,

    /// File extensions to include (comma-separated).
    pub include_ext: Option<String>,

    /// File extensions to exclude (comma-separated).
    pub exclude_ext: Option<String>,

    /// Whether to scan directories recursively.
    pub recursive: bool,

    /// Strategy for handling existing files when writing.
    pub file_exist: FileExistStrategy,

    /// Read lock strategy for concurrent consumers.
    pub read_lock_strategy: ReadLockStrategy,

    /// In-memory idempotent key selector for consumer.
    pub idempotent_key: IdempotentKey,

    /// Done marker filename pattern created after successful write.
    pub done_file_name: Option<String>,

    /// Charset for string body encoding (UTF-8, ISO-8859-1).
    pub charset: Option<String>,

    /// Prefix for temporary files during atomic writes.
    pub temp_prefix: Option<String>,

    /// If true, fsync temp file and parent directory after atomic write, in the
    /// correct order (temp → rename → parent). Crash-safe but slower. Opt-in via
    /// `?durable=true`. Default false (preserves current latency characteristics).
    pub durable: bool,

    /// Whether to automatically create directories.
    pub auto_create: bool,

    /// If true, verify the starting directory exists at startup.
    pub starting_directory_must_exist: bool,

    /// Read timeout in milliseconds (companion field for `read_timeout`).
    #[allow(dead_code)]
    read_timeout_ms: u64,

    /// Read timeout as Duration.
    pub read_timeout: Duration,

    /// Write timeout in milliseconds (companion field for `write_timeout`).
    #[allow(dead_code)]
    write_timeout_ms: u64,

    /// Write timeout as Duration.
    pub write_timeout: Duration,

    /// Maximum bytes written per produced file (audit 2026-08-31, F4-3).
    /// `0` = unlimited (back-compat default). Streaming bodies are truncated
    /// with an error past the cap.
    pub max_write_bytes: u64,

    pub max_depth: usize,
    pub min_depth: usize,
    pub max_messages_per_poll: i64,
    pub eager_max_messages_per_poll: bool,
    pub shuffle: bool,
    pub(crate) sort_spec: Option<SortSpec>,

    /// If true (default), sweep stale temp files at consumer startup.
    /// Temp files older than `4 * write_timeout` (floor 60s) matching the
    /// configured `temp_prefix` are removed. Leftover `.tmp.*` files from
    /// SIGKILL or crash are cleaned up automatically.
    pub cleanup_stale_temps: bool,
}

impl UriConfig for FileConfig {
    fn scheme() -> &'static str {
        "file"
    }

    fn from_uri(uri: &str) -> Result<Self, CamelError> {
        let parts = parse_uri(uri)?;
        Self::from_components(parts)
    }

    fn from_components(parts: camel_component_api::UriComponents) -> Result<Self, CamelError> {
        if parts.scheme != Self::scheme() {
            return Err(CamelError::InvalidUri(format!(
                "unsupported scheme '{}', expected '{}'",
                parts.scheme,
                Self::scheme()
            )));
        }

        fn parse_bool_param(
            params: &std::collections::HashMap<String, String>,
            key: &str,
            default: bool,
        ) -> Result<bool, CamelError> {
            match params.get(key) {
                Some(v) => match v.to_lowercase().as_str() {
                    "true" | "1" | "yes" => Ok(true),
                    "false" | "0" | "no" => Ok(false),
                    _ => Err(CamelError::InvalidUri(format!(
                        "invalid value for {key}: invalid boolean value: '{v}'"
                    ))),
                },
                None => Ok(default),
            }
        }

        fn parse_u64_param(
            params: &std::collections::HashMap<String, String>,
            key: &str,
            default: u64,
        ) -> Result<u64, CamelError> {
            match params.get(key) {
                Some(v) => v
                    .parse::<u64>()
                    .map_err(|e| CamelError::InvalidUri(format!("invalid value for {key}: {e}"))),
                None => Ok(default),
            }
        }

        fn parse_enum_param<T: FromStr>(
            params: &std::collections::HashMap<String, String>,
            key: &str,
            default: &str,
        ) -> Result<T, CamelError>
        where
            T::Err: std::fmt::Display,
        {
            let raw = params.get(key).map(String::as_str).unwrap_or(default);
            raw.parse::<T>().map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for parameter '{key}': {e}"))
            })
        }

        let params = &parts.params;
        let delay_ms = parse_u64_param(params, "delay", 500)?;
        let initial_delay_ms = parse_u64_param(params, "initialDelay", 1000)?;
        let read_timeout_ms = parse_u64_param(params, "readTimeout", 30_000)?;
        let write_timeout_ms = parse_u64_param(params, "writeTimeout", 30_000)?;
        let max_write_bytes = parse_u64_param(params, "maxWriteBytes", 0)?;

        let cfg = Self {
            directory: parts.path,
            delay_ms,
            delay: Duration::from_millis(delay_ms),
            initial_delay_ms,
            initial_delay: Duration::from_millis(initial_delay_ms),
            noop: parse_bool_param(params, "noop", false)?,
            delete: parse_bool_param(params, "delete", false)?,
            move_to: params.get("move").cloned(),
            file_name: params.get("fileName").cloned(),
            include: params.get("include").cloned(),
            exclude: params.get("exclude").cloned(),
            recursive: parse_bool_param(params, "recursive", false)?,
            file_exist: parse_enum_param(params, "fileExist", "Override")?,
            read_lock_strategy: parse_enum_param(params, "readLock", "None")?,
            idempotent_key: parse_enum_param(params, "idempotentKey", "None")?,
            done_file_name: params.get("doneFileName").cloned(),
            charset: params.get("charset").cloned(),
            temp_prefix: params.get("tempPrefix").cloned(),
            durable: parse_bool_param(params, "durable", false)?,
            auto_create: parse_bool_param(params, "autoCreate", true)?,
            starting_directory_must_exist: parse_bool_param(
                params,
                "startingDirectoryMustExist",
                false,
            )?,
            read_timeout_ms,
            read_timeout: Duration::from_millis(read_timeout_ms),
            write_timeout_ms,
            write_timeout: Duration::from_millis(write_timeout_ms),
            max_write_bytes,
            max_depth: parse_u64_param(params, "maxDepth", u64::MAX)? as usize,
            min_depth: parse_u64_param(params, "minDepth", 0)? as usize,
            max_messages_per_poll: params
                .get("maxMessagesPerPoll")
                .map(|v| {
                    v.parse::<i64>().map_err(|e| {
                        CamelError::InvalidUri(format!("invalid value for maxMessagesPerPoll: {e}"))
                    })
                })
                .transpose()?
                .unwrap_or(0),
            eager_max_messages_per_poll: parse_bool_param(params, "eagerMaxMessagesPerPoll", true)?,
            ant_include: params.get("antInclude").cloned(),
            ant_exclude: params.get("antExclude").cloned(),
            include_ext: params.get("includeExt").cloned(),
            exclude_ext: params.get("excludeExt").cloned(),
            shuffle: parse_bool_param(params, "shuffle", false)?,
            sort_spec: params
                .get("sortBy")
                .map(|v| v.parse::<SortSpec>())
                .transpose()
                .map_err(|e| CamelError::InvalidUri(format!("invalid sortBy: {e}")))?,
            cleanup_stale_temps: parse_bool_param(params, "cleanupStaleTemps", true)?,
        };

        cfg.validate()
    }

    fn validate(self) -> Result<Self, CamelError> {
        // Reject path traversal in move_to
        if let Some(ref move_to) = self.move_to
            && path_contains_traversal(move_to)
        {
            return Err(CamelError::Config(format!(
                "move_to contains path traversal component: {move_to}"
            )));
        }

        if let Some(ref move_to) = self.move_to
            && std::path::Path::new(move_to).is_absolute()
        {
            return Err(CamelError::InvalidUri(format!(
                "move_to must be relative path within base directory: {move_to}"
            )));
        }

        // Reject path traversal in temp_prefix
        if let Some(ref temp_prefix) = self.temp_prefix
            && path_contains_traversal(temp_prefix)
        {
            return Err(CamelError::Config(format!(
                "temp_prefix contains path traversal component: {temp_prefix}"
            )));
        }

        if let Some(ref temp_prefix) = self.temp_prefix
            && !is_valid_temp_prefix(temp_prefix)
        {
            return Err(CamelError::Config(
                "temp_prefix must be plain filename prefix (no path separators, absolute paths, or null bytes)".into(),
            ));
        }

        if self.file_exist == FileExistStrategy::TryRename && self.temp_prefix.is_none() {
            return Err(CamelError::Config(
                "fileExist=TryRename requires tempPrefix to be set".into(),
            ));
        }

        // Reject empty file_name
        if let Some(ref file_name) = self.file_name {
            if file_name.is_empty() {
                return Err(CamelError::Config("file_name must not be empty".into()));
            }
            // Reject null bytes in file_name
            if file_name.contains('\0') {
                return Err(CamelError::Config(
                    "file_name must not contain null bytes".into(),
                ));
            }
        }

        if self.min_depth > self.max_depth {
            return Err(CamelError::Config(
                "minDepth cannot be greater than maxDepth".into(),
            ));
        }

        // If starting_directory_must_exist, verify directory exists
        if self.starting_directory_must_exist {
            let dir_path = std::path::Path::new(&self.directory);
            if !dir_path.exists() {
                return Err(CamelError::Config(format!(
                    "starting directory does not exist: {}",
                    self.directory
                )));
            }
        }

        // Apply conditional logic for move_to:
        // - If noop or delete is true, move_to should be None
        // - Otherwise, if move_to is None, default to ".camel"
        let move_to = if self.noop || self.delete {
            None
        } else {
            Some(self.move_to.unwrap_or_else(|| ".camel".to_string()))
        };

        Ok(Self { move_to, ..self })
    }
}

impl FileConfig {
    /// Component metadata for the file scheme, derived from `#[uri_param]`
    /// annotations on `FileUriConfig`.
    pub fn metadata() -> ComponentMetadata {
        FileUriConfig::metadata()
    }

    /// Generated URI option definitions for the file scheme, derived from
    /// `#[uri_param]` annotations on `FileUriConfig`.
    pub fn uri_options() -> Vec<UriOption> {
        FileUriConfig::uri_options()
    }

    /// Apply global config defaults. Since FileConfig uses a proc macro that bakes in
    /// defaults, we compare Duration values against the known macro defaults to detect
    /// "not explicitly set by user". Only overrides when current value == macro default.
    ///
    /// **Note**: If a user explicitly sets a URI param to its default value (e.g.,
    /// `?delay=500`), it is indistinguishable from "not set" and will be overridden
    /// by global config. This is a known limitation of the Duration comparison approach.
    pub fn apply_global_defaults(&mut self, global: &FileGlobalConfig) {
        if self.delay == Duration::from_millis(500) {
            self.delay = Duration::from_millis(global.delay_ms);
        }
        if self.initial_delay == Duration::from_millis(1_000) {
            self.initial_delay = Duration::from_millis(global.initial_delay_ms);
        }
        if self.read_timeout == Duration::from_millis(30_000) {
            self.read_timeout = Duration::from_millis(global.read_timeout_ms);
        }
        if self.write_timeout == Duration::from_millis(30_000) {
            self.write_timeout = Duration::from_millis(global.write_timeout_ms);
        }
    }
}

// ---------------------------------------------------------------------------
// FileComponent
// ---------------------------------------------------------------------------

pub struct FileComponent {
    config: Option<FileGlobalConfig>,
}

impl FileComponent {
    pub fn new() -> Self {
        Self { config: None }
    }

    pub fn with_config(config: FileGlobalConfig) -> Self {
        Self {
            config: Some(config),
        }
    }

    pub fn with_optional_config(config: Option<FileGlobalConfig>) -> Self {
        Self { config }
    }
}

impl Default for FileComponent {
    fn default() -> Self {
        Self::new()
    }
}

impl Component for FileComponent {
    fn scheme(&self) -> &str {
        "file"
    }

    fn metadata(&self) -> ComponentMetadata {
        FileConfig::metadata()
    }

    fn create_endpoint(
        &self,
        uri: &str,
        ctx: &dyn camel_component_api::ComponentContext,
    ) -> Result<Box<dyn Endpoint>, CamelError> {
        let mut config = FileConfig::from_uri(uri)?;
        if let Some(ref global_config) = self.config {
            config.apply_global_defaults(global_config);
        }
        let filters = CompiledFilters::compile(&config)?;
        let dir_path = std::path::PathBuf::from(&config.directory);
        let health_check = FileHealthCheck::new(dir_path.clone());
        ctx.register_current_route_health_check(std::sync::Arc::new(health_check));
        Ok(Box::new(FileEndpoint {
            uri: uri.to_string(),
            config,
            filters,
            in_process_locks: std::sync::Arc::new(DashMap::new()),
            idempotent_repo: std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new())),
        }))
    }
}

// ---------------------------------------------------------------------------
// FileEndpoint
// ---------------------------------------------------------------------------

struct FileEndpoint {
    uri: String,
    config: FileConfig,
    filters: CompiledFilters,
    in_process_locks: std::sync::Arc<DashMap<PathBuf, ()>>,
    idempotent_repo: std::sync::Arc<tokio::sync::Mutex<HashSet<String>>>,
}

impl Endpoint for FileEndpoint {
    fn uri(&self) -> &str {
        &self.uri
    }

    fn create_consumer(
        &self,
        rt: Arc<dyn camel_component_api::RuntimeObservability>,
    ) -> Result<Box<dyn Consumer>, CamelError> {
        Ok(Box::new(FileConsumer::new(
            self.config.clone(),
            self.filters.clone(),
            self.in_process_locks.clone(),
            self.idempotent_repo.clone(),
            rt,
        )))
    }

    fn create_producer(
        &self,
        _rt: Arc<dyn camel_component_api::RuntimeObservability>,
        _ctx: &ProducerContext,
    ) -> Result<BoxProcessor, CamelError> {
        Ok(BoxProcessor::new(FileProducer {
            config: self.config.clone(),
        }))
    }

    fn polling_consumer(&self) -> Option<Box<dyn PollingConsumer>> {
        Some(Box::new(polling_consumer::FilePollingConsumer::new(
            self.config.clone(),
            self.in_process_locks.clone(),
            self.idempotent_repo.clone(),
            self.filters.clone(),
        )))
    }
}

// ---------------------------------------------------------------------------
// FileConsumer
// ---------------------------------------------------------------------------

struct FileConsumer {
    config: FileConfig,
    filters: CompiledFilters,
    seen: HashSet<PathBuf>,
    in_process_locks: std::sync::Arc<DashMap<PathBuf, ()>>,
    idempotent_repo: std::sync::Arc<tokio::sync::Mutex<HashSet<String>>>,
    runtime: Arc<dyn camel_component_api::RuntimeObservability>,
}

impl FileConsumer {
    fn new(
        config: FileConfig,
        filters: CompiledFilters,
        in_process_locks: std::sync::Arc<DashMap<PathBuf, ()>>,
        idempotent_repo: std::sync::Arc<tokio::sync::Mutex<HashSet<String>>>,
        runtime: Arc<dyn camel_component_api::RuntimeObservability>,
    ) -> Self {
        Self {
            config,
            filters,
            seen: HashSet::new(),
            in_process_locks,
            idempotent_repo,
            runtime,
        }
    }
}

#[async_trait]
impl Consumer for FileConsumer {
    async fn start(&mut self, context: ConsumerContext) -> Result<(), CamelError> {
        let config = self.config.clone();

        // Sweep stale temp files left by a previous crash/SIGKILL.
        if config.cleanup_stale_temps {
            let stale_age =
                Duration::from_secs((config.write_timeout.as_secs()).saturating_mul(4).max(60));
            let prefix = config
                .temp_prefix
                .as_deref()
                .unwrap_or(atomic_write::DEFAULT_TEMP_PREFIX);
            let dir = std::path::Path::new(&config.directory);
            if let Err(e) = atomic_write::sweep_stale_temps(dir, prefix, stale_age).await {
                warn!(
                    directory = config.directory,
                    error = %e,
                    "Stale temp sweep failed at startup"
                );
            }
        }

        if !config.initial_delay.is_zero() {
            tokio::select! {
                _ = time::sleep(config.initial_delay) => {}
                _ = context.cancelled() => {
                    debug!(directory = config.directory, "File consumer cancelled during initial delay");
                    return Ok(());
                }
            }
        }

        let mut interval = time::interval(config.delay);

        loop {
            tokio::select! {
                _ = context.cancelled() => {
                    debug!(directory = config.directory, "File consumer received cancellation, stopping");
                    break;
                }
                _ = interval.tick() => {
                    if let Err(e) = poll_directory(
                        &config,
                        &context,
                        &self.runtime,
                        &self.filters,
                        &mut self.seen,
                        &self.in_process_locks,
                        &self.idempotent_repo,
                    ).await {
                        warn!(directory = config.directory, error = %e, "Error polling directory");
                    }
                }
            }
        }

        Ok(())
    }

    async fn stop(&mut self) -> Result<(), CamelError> {
        Ok(())
    }
}

// ---------------------------------------------------------------------------
// Path validation for security
// ---------------------------------------------------------------------------

/// Returns true if the path string contains a `..` component (path traversal).
fn path_contains_traversal(path: &str) -> bool {
    std::path::Path::new(path)
        .components()
        .any(|c| matches!(c, std::path::Component::ParentDir))
}

/// Lexical pre-validation for user-influenced path segments (e.g. the resolved
/// `file_name` or a substituted `doneFileName` pattern). Runs BEFORE joining so
/// that an absolute value cannot silently discard the base via `Path::join`,
/// and traversal components are rejected even when the target does not exist
/// yet (where canonicalize-based checks have nothing to resolve).
///
/// `label` identifies the source in the error message (e.g. "fileName",
/// "doneFileName").
fn validate_relative_filename(raw: &str, label: &str) -> Result<(), CamelError> {
    let p = std::path::Path::new(raw);
    if raw.is_empty() {
        return Err(CamelError::ProcessorError(format!(
            "{label} resolved to an empty path"
        )));
    }
    if raw.contains('\0') {
        return Err(CamelError::ProcessorError(format!(
            "{label} contains a NUL byte"
        )));
    }
    if p.is_absolute() {
        return Err(CamelError::ProcessorError(format!(
            "{label} must be relative to the endpoint directory, got absolute path: '{raw}'"
        )));
    }
    if path_contains_traversal(raw) {
        return Err(CamelError::ProcessorError(format!(
            "{label} contains directory traversal: '{raw}'"
        )));
    }
    Ok(())
}

/// Open a file for writing/append, refusing to follow a symlink in the final
/// path component. Closes the TOCTOU window between
/// `validate_path_is_within_base` (which canonicalizes the path by name) and
/// the open itself: even if an attacker swaps the leaf for a symlink after
/// validation, the open fails instead of escaping the base directory.
///
/// On non-Unix platforms there is no `O_NOFOLLOW` equivalent in std; fall back
/// to the plain open (the canonicalize check in `validate_path_is_within_base`
/// still applies).
fn open_options_no_follow() -> OpenOptions {
    let mut opts = OpenOptions::new();
    // Inherent tokio method (cfg-gated on unix inside tokio); no trait import needed.
    #[cfg(unix)]
    opts.custom_flags(libc::O_NOFOLLOW);
    opts
}

fn is_valid_temp_prefix(prefix: &str) -> bool {
    !prefix.contains('\0')
        && !std::path::Path::new(prefix).is_absolute()
        && !prefix.contains(std::path::MAIN_SEPARATOR)
        && !prefix.contains('/')
        && !prefix.contains('\\')
}

fn validate_path_is_within_base(
    base_dir: &std::path::Path,
    target_path: &std::path::Path,
) -> Result<(), CamelError> {
    // If the base exists, enforce strict containment: canonicalize the base,
    // reject any symlinked component below the ORIGINAL (non-canonicalized)
    // base, and require the nearest existing ancestor of the target to stay
    // within the canonicalized base.
    if base_dir.exists() {
        let canonical_base = base_dir.canonicalize().map_err(|e| {
            CamelError::ProcessorError(format!("Cannot canonicalize base directory: {}", e))
        })?;

        // Relative components against the original (non-canonicalized) base.
        let rel = target_path.strip_prefix(base_dir).map_err(|_| {
            CamelError::ProcessorError(format!(
                "Path '{}' is not under base '{}'",
                target_path.display(),
                base_dir.display()
            ))
        })?;
        if path_contains_traversal(&rel.to_string_lossy()) {
            return Err(CamelError::ProcessorError(format!(
                "Path '{}' contains directory traversal",
                target_path.display()
            )));
        }

        // Symlink-chain rejection: every cumulative component below the base
        // must be symlink-free at validation time, including symlinks that
        // resolve inside the canonicalized base (they are mutable
        // retargeting points). The base itself may be a symlink
        // (canonicalized above, per the operator contract).
        let mut cumulative = base_dir.to_path_buf();
        for component in rel.components() {
            cumulative.push(component);
            if std::fs::symlink_metadata(&cumulative).is_ok_and(|m| m.file_type().is_symlink()) {
                return Err(CamelError::ProcessorError(format!(
                    "Path '{}' traverses symlinked component '{}' below base '{}'",
                    target_path.display(),
                    cumulative.display(),
                    base_dir.display()
                )));
            }
        }

        // Nearest-existing-ancestor containment: walk up to the closest
        // existing ancestor, canonicalize it, and require it to stay within
        // the canonicalized base. Since the base exists and lexically
        // prefixes the target, the walk terminates at the base at the
        // latest; the parent-less fallback degenerates to base containment.
        let mut ancestor = target_path;
        while std::fs::symlink_metadata(ancestor).is_err() {
            match ancestor.parent() {
                Some(parent) => ancestor = parent,
                None => {
                    ancestor = base_dir;
                    break;
                }
            }
        }
        let canonical_ancestor = ancestor.canonicalize().map_err(|e| {
            CamelError::ProcessorError(format!(
                "Cannot canonicalize existing ancestor '{}': {}",
                ancestor.display(),
                e
            ))
        })?;
        if !canonical_ancestor.starts_with(&canonical_base) {
            return Err(CamelError::ProcessorError(format!(
                "Path '{}' is outside base directory '{}'",
                canonical_ancestor.display(),
                canonical_base.display()
            )));
        }
    } else {
        // Base dir doesn't exist yet (auto_create case): nothing below it
        // can be a pre-existing symlink, so a lexical traversal check
        // suffices.
        let rel = target_path.strip_prefix(base_dir).map_err(|_| {
            CamelError::ProcessorError(format!(
                "Path '{}' is not under base '{}'",
                target_path.display(),
                base_dir.display()
            ))
        })?;
        let rel_str = rel.to_string_lossy();
        if path_contains_traversal(&rel_str) {
            return Err(CamelError::ProcessorError(format!(
                "Path '{}' contains directory traversal",
                target_path.display()
            )));
        }
    }

    Ok(())
}

// ---------------------------------------------------------------------------
// FileProducer
// ---------------------------------------------------------------------------

#[derive(Clone)]
struct FileProducer {
    config: FileConfig,
}

impl FileProducer {
    async fn resolve_filename(
        exchange: &Exchange,
        config: &FileConfig,
    ) -> Result<String, CamelError> {
        let raw = if let Some(name) = exchange
            .input
            .header("CamelFileName")
            .and_then(|v| v.as_str())
        {
            Some(name.to_string())
        } else {
            config.file_name.clone()
        };

        match raw {
            Some(name) if name.contains("${") => {
                let lang = SimpleLanguage::new();
                let expr = lang.create_expression(&name).map_err(|e| {
                    CamelError::ProcessorError(format!(
                        "cannot parse fileName expression '{}': {e}",
                        name
                    ))
                })?;
                let val = expr.evaluate(exchange).await.map_err(|e| {
                    CamelError::ProcessorError(format!(
                        "cannot evaluate fileName expression '{}': {e}",
                        name
                    ))
                })?;
                match val {
                    serde_json::Value::String(s) => Ok(s),
                    other => Ok(other.to_string()),
                }
            }
            Some(name) => Ok(name),
            None => Err(CamelError::ProcessorError(
                "No filename specified: set CamelFileName header or fileName option".to_string(),
            )),
        }
    }
}

impl Service<Exchange> for FileProducer {
    type Response = Exchange;
    type Error = CamelError;
    type Future = Pin<Box<dyn Future<Output = Result<Exchange, CamelError>> + Send>>;

    fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
        Poll::Ready(Ok(()))
    }

    fn call(&mut self, mut exchange: Exchange) -> Self::Future {
        let config = self.config.clone();

        Box::pin(async move {
            let file_name = FileProducer::resolve_filename(&exchange, &config).await?;
            let body = exchange.input.body.clone();

            // 0. Security: lexical pre-check of the resolved name (rejects
            // absolute paths that would discard `dir_path` on join, NUL bytes,
            // and `..` traversal before any filesystem touch).
            validate_relative_filename(&file_name, "fileName")?;

            let dir_path = std::path::Path::new(&config.directory);
            let target_path = dir_path.join(&file_name);

            // 1. Security: validate path is within base directory
            validate_path_is_within_base(dir_path, &target_path)?;

            // 2. Auto-create directories (after path validation)
            if config.auto_create
                && let Some(parent) = target_path.parent()
            {
                tokio::time::timeout(config.write_timeout, fs::create_dir_all(parent))
                    .await
                    .map_err(|_| CamelError::ProcessorError("Timeout creating directories".into()))?
                    .map_err(CamelError::from)?;
            }

            // 2b. Post-create re-verification: a symlink followed during
            // directory creation yields an outside-base canonical parent and
            // the write is refused before any open/rename. It cannot undo
            // directories created during a concurrent race — documented
            // residual (see CONTEXT.md).
            validate_path_is_within_base(dir_path, &target_path)?;

            // 3. Handle file-exist strategy
            match config.file_exist {
                FileExistStrategy::Fail => {
                    let mut file = tokio::time::timeout(
                        config.write_timeout,
                        open_options_no_follow()
                            .write(true)
                            .create_new(true)
                            .open(&target_path),
                    )
                    .await
                    .map_err(|_| {
                        CamelError::ProcessorError("Timeout opening file with create_new".into())
                    })?
                    .map_err(CamelError::from)?;

                    write_body_with_charset(
                        body,
                        &config.charset,
                        &mut file,
                        config.write_timeout,
                        config.max_write_bytes,
                    )
                    .await?;
                    file.flush().await.map_err(CamelError::from)?;
                }
                FileExistStrategy::Ignore if target_path.exists() => return Ok(exchange),
                FileExistStrategy::Append => {
                    // Append: write directly without temp file (append is inherently non-atomic).
                    // O_NOFOLLOW (via open_options_no_follow) closes the dangling-symlink escape:
                    // a symlink leaf fails the open instead of being followed outside the base.
                    let mut file = tokio::time::timeout(
                        config.write_timeout,
                        open_options_no_follow()
                            .append(true)
                            .create(true)
                            .open(&target_path),
                    )
                    .await
                    .map_err(|_| {
                        CamelError::ProcessorError("Timeout opening file for append".into())
                    })?
                    .map_err(CamelError::from)?;

                    write_body_with_charset(
                        body,
                        &config.charset,
                        &mut file,
                        config.write_timeout,
                        config.max_write_bytes,
                    )
                    .await?;

                    file.flush().await.map_err(CamelError::from)?;
                }
                FileExistStrategy::TryRename => {
                    // TryRename requires an explicit tempPrefix (validated at config time).
                    // Delegates to atomic_write so both branches share one rename path.
                    let prefix = config.temp_prefix.as_deref().ok_or_else(|| {
                        CamelError::Config("fileExist=TryRename requires tempPrefix".into())
                    })?;
                    crate::atomic_write::atomic_write(
                        &target_path,
                        body,
                        Some(prefix),
                        config.durable,
                        config.write_timeout,
                        &config.charset,
                        config.max_write_bytes,
                    )
                    .await?;
                }
                _ => {
                    // Override (and Fail when file doesn't exist): always atomic via temp file.
                    // Delegates to atomic_write — fixes Bug C (rc-o6o.3): temp path was previously
                    // computed by joining dir_path with prefix+full_file_name, producing a path
                    // whose parent did not exist for nested fileName values.
                    crate::atomic_write::atomic_write(
                        &target_path,
                        body,
                        config.temp_prefix.as_deref(),
                        config.durable,
                        config.write_timeout,
                        &config.charset,
                        config.max_write_bytes,
                    )
                    .await?;
                }
            }

            if let Some(done_pattern) = &config.done_file_name {
                let done_name = done_pattern.replace("${file:name}", &file_name);
                // Security: the substituted name derives from the (header-influenced)
                // file_name, so it needs the same confinement as the body write:
                // reject absolute paths / traversal lexically, then confirm the
                // joined path stays within the base directory.
                validate_relative_filename(&done_name, "doneFileName")?;
                let done_path = dir_path.join(&done_name);
                validate_path_is_within_base(dir_path, &done_path)?;
                tokio::time::timeout(
                    config.write_timeout,
                    open_options_no_follow()
                        .write(true)
                        .create(true)
                        .truncate(true)
                        .open(&done_path),
                )
                .await
                .map_err(|_| CamelError::ProcessorError("Timeout creating done file".into()))?
                .map_err(CamelError::from)?;
            }

            // 4. Set output header
            let abs_path = target_path
                .canonicalize()
                .unwrap_or_else(|_| target_path.clone())
                .to_string_lossy()
                .to_string();
            exchange
                .input
                .set_header("CamelFileNameProduced", serde_json::Value::String(abs_path));

            debug!(
                file = %target_path.display(),
                correlation_id = %exchange.correlation_id(),
                "File written"
            );

            Ok(exchange)
        })
    }
}

pub(crate) async fn write_body_with_charset(
    body: Body,
    charset: &Option<String>,
    file: &mut fs::File,
    timeout: Duration,
    max_bytes: u64,
) -> Result<(), CamelError> {
    match body {
        Body::Text(text) | Body::Xml(text) => {
            let bytes = encode_text_by_charset(&text, charset)?;
            if max_bytes > 0 && bytes.len() as u64 > max_bytes {
                return Err(CamelError::ProcessorError(format!(
                    "body of {} bytes exceeds maxWriteBytes limit of {max_bytes}",
                    bytes.len()
                )));
            }
            tokio::time::timeout(timeout, file.write_all(&bytes))
                .await
                .map_err(|_| CamelError::ProcessorError("Timeout writing file".into()))?
                .map_err(CamelError::from)?;
            Ok(())
        }
        other => {
            let mut reader = other.into_async_read()?;
            // F4-3: cap streamed bytes so a large/unbounded stream body cannot
            // fill the disk. `take` truncates silently, so we compare the
            // copied count against the cap afterwards and error.
            let mut limited = tokio::io::AsyncReadExt::take(
                &mut reader,
                if max_bytes > 0 {
                    max_bytes + 1
                } else {
                    u64::MAX
                },
            );
            let copied = tokio::time::timeout(timeout, io::copy(&mut limited, file))
                .await
                .map_err(|_| CamelError::ProcessorError("Timeout writing to file".into()))?
                .map_err(|e| CamelError::ProcessorError(e.to_string()))?;
            if max_bytes > 0 && copied > max_bytes {
                return Err(CamelError::ProcessorError(format!(
                    "streamed body exceeds maxWriteBytes limit of {max_bytes} bytes"
                )));
            }
            Ok(())
        }
    }
}

fn encode_text_by_charset(text: &str, charset: &Option<String>) -> Result<Vec<u8>, CamelError> {
    let Some(charset) = charset.as_ref() else {
        return Ok(text.as_bytes().to_vec());
    };

    if charset.eq_ignore_ascii_case("utf-8") {
        return Ok(text.as_bytes().to_vec());
    }

    if charset.eq_ignore_ascii_case("iso-8859-1") {
        let mut out = Vec::with_capacity(text.len());
        for ch in text.chars() {
            let code = ch as u32;
            if code > 0xFF {
                return Err(CamelError::ProcessorError(format!(
                    "character '{ch}' cannot be encoded as ISO-8859-1"
                )));
            }
            out.push(code as u8);
        }
        return Ok(out);
    }

    Err(CamelError::Config(format!(
        "unsupported charset '{charset}', supported: UTF-8, ISO-8859-1"
    )))
}

#[cfg(test)]
mod tests {
    use camel_component_api::test_support::PanicRuntimeObservability;
    fn rt() -> std::sync::Arc<dyn camel_component_api::RuntimeObservability> {
        std::sync::Arc::new(PanicRuntimeObservability)
    }

    use super::*;
    use crate::poll_logic::{
        ModificationDetectingStream, apply_sort_and_limit, list_files, poll_one_file,
        scan_candidates,
    };
    use bytes::Bytes;
    use camel_component_api::{Message, NoOpComponentContext, StreamBody, StreamMetadata};
    use futures::StreamExt;
    use std::time::Duration;
    use tokio_util::io::ReaderStream;
    use tokio_util::sync::CancellationToken;

    fn test_producer_ctx() -> ProducerContext {
        ProducerContext::new()
    }

    #[test]
    fn test_file_config_defaults() {
        let config = FileConfig::from_uri("file:/tmp/inbox").unwrap();
        assert_eq!(config.directory, "/tmp/inbox");
        assert_eq!(config.delay, Duration::from_millis(500));
        assert_eq!(config.initial_delay, Duration::from_millis(1000));
        assert!(!config.noop);
        assert!(!config.delete);
        assert_eq!(config.move_to, Some(".camel".to_string()));
        assert!(config.file_name.is_none());
        assert!(config.include.is_none());
        assert!(config.exclude.is_none());
        assert!(!config.recursive);
        assert_eq!(config.file_exist, FileExistStrategy::Override);
        assert!(config.temp_prefix.is_none());
        assert!(config.auto_create);
        // New timeout defaults
        assert_eq!(config.read_timeout, Duration::from_secs(30));
        assert_eq!(config.write_timeout, Duration::from_secs(30));
    }

    #[test]
    fn file_config_durable_defaults_to_false() {
        let config = FileConfig::from_uri("file:/tmp/inbox").unwrap();
        assert!(!config.durable, "durable must default to false");
    }

    #[test]
    fn file_config_durable_true_parsed_from_uri() {
        let config = FileConfig::from_uri("file:/tmp/inbox?durable=true").unwrap();
        assert!(config.durable, "durable=true must parse from URI");
    }

    #[test]
    fn file_config_durable_rejects_invalid_value() {
        let result = FileConfig::from_uri("file:/tmp/inbox?durable=maybe");
        assert!(result.is_err(), "invalid durable value must be rejected");
    }

    #[test]
    fn test_file_config_consumer_options() {
        let config = FileConfig::from_uri(
            "file:/data/input?delay=1000&initialDelay=2000&noop=true&recursive=true&include=.*\\.csv"
        ).unwrap();
        assert_eq!(config.directory, "/data/input");
        assert_eq!(config.delay, Duration::from_millis(1000));
        assert_eq!(config.initial_delay, Duration::from_millis(2000));
        assert!(config.noop);
        assert!(config.recursive);
        assert_eq!(config.include, Some(".*\\.csv".to_string()));
    }

    #[test]
    fn test_file_config_producer_options() {
        let config = FileConfig::from_uri(
            "file:/data/output?fileExist=Append&tempPrefix=.tmp&autoCreate=false&fileName=out.txt",
        )
        .unwrap();
        assert_eq!(config.file_exist, FileExistStrategy::Append);
        assert_eq!(config.temp_prefix, Some(".tmp".to_string()));
        assert!(!config.auto_create);
        assert_eq!(config.file_name, Some("out.txt".to_string()));
    }

    #[test]
    fn test_file_config_delete_mode() {
        let config = FileConfig::from_uri("file:/tmp/inbox?delete=true").unwrap();
        assert!(config.delete);
        assert!(config.move_to.is_none());
    }

    #[test]
    fn test_file_config_noop_mode() {
        let config = FileConfig::from_uri("file:/tmp/inbox?noop=true").unwrap();
        assert!(config.noop);
        assert!(config.move_to.is_none());
    }

    #[test]
    fn test_file_config_wrong_scheme() {
        let result = FileConfig::from_uri("timer:tick");
        assert!(result.is_err());
    }

    #[test]
    fn test_min_depth_greater_than_max_depth_rejected() {
        let result = FileConfig::from_uri("file:///tmp?minDepth=5&maxDepth=2");
        assert!(result.is_err());
        assert!(
            result
                .unwrap_err()
                .to_string()
                .contains("minDepth cannot be greater")
        );
    }

    #[test]
    fn test_file_component_scheme() {
        let component = FileComponent::new();
        assert_eq!(component.scheme(), "file");
    }

    #[test]
    fn test_file_component_creates_endpoint() {
        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint("file:/tmp/test", &ctx);
        assert!(endpoint.is_ok());
    }

    // -----------------------------------------------------------------------
    // Consumer tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_file_consumer_reads_files() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        std::fs::write(dir.path().join("test1.txt"), "hello").unwrap();
        std::fs::write(dir.path().join("test2.txt"), "world").unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?noop=true&initialDelay=0&delay=100"),
                &ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "file-test-route".to_string());

        tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        let mut received = Vec::new();
        let timeout = tokio::time::timeout(Duration::from_secs(2), async {
            while let Some(envelope) = rx.recv().await {
                received.push(envelope.exchange);
                if received.len() == 2 {
                    break;
                }
            }
        })
        .await;
        token.cancel();

        assert!(timeout.is_ok(), "Should have received 2 exchanges");
        assert_eq!(received.len(), 2);

        for ex in &received {
            assert!(ex.input.header("CamelFileName").is_some());
            assert!(ex.input.header("CamelFileNameOnly").is_some());
            assert!(ex.input.header("CamelFileAbsolutePath").is_some());
            assert!(ex.input.header("CamelFileLength").is_some());
            assert!(ex.input.header("CamelFileLastModified").is_some());
        }
    }

    #[tokio::test]
    async fn noop_second_poll_does_not_re_emit_seen_files() {
        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("test.txt");
        tokio::fs::write(&file_path, b"hello").await.unwrap();

        let uri = format!(
            "file:{}?noop=true&initialDelay=0&delay=50",
            dir.path().display()
        );
        let config = FileConfig::from_uri(&uri).unwrap();
        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        let filters = CompiledFilters::default();
        let mut seen = std::collections::HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();
        assert!(rx.try_recv().is_ok(), "first poll should emit file");
        assert!(rx.try_recv().is_err(), "should only emit once");

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();
        assert!(
            rx.try_recv().is_err(),
            "second poll should not re-emit seen file"
        );
    }

    #[tokio::test]
    async fn noop_new_files_picked_up_after_first_poll() {
        let dir = tempfile::tempdir().unwrap();
        let file1 = dir.path().join("a.txt");
        tokio::fs::write(&file1, b"a").await.unwrap();

        let uri = format!(
            "file:{}?noop=true&initialDelay=0&delay=50",
            dir.path().display()
        );
        let config = FileConfig::from_uri(&uri).unwrap();
        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        let filters = CompiledFilters::default();
        let mut seen = std::collections::HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();
        let _ = rx.try_recv();

        let file2 = dir.path().join("b.txt");
        tokio::fs::write(&file2, b"b").await.unwrap();

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();
        assert!(
            rx.try_recv().is_ok(),
            "b.txt should be emitted on second poll"
        );
        assert!(rx.try_recv().is_err(), "a.txt should not be re-emitted");
    }

    #[tokio::test]
    async fn test_file_consumer_include_filter() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        std::fs::write(dir.path().join("data.csv"), "a,b,c").unwrap();
        std::fs::write(dir.path().join("readme.txt"), "hello").unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?noop=true&initialDelay=0&delay=100&include=.*\\.csv"),
                &ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "file-test-route".to_string());

        tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        let mut received = Vec::new();
        let _ = tokio::time::timeout(Duration::from_millis(500), async {
            while let Some(envelope) = rx.recv().await {
                received.push(envelope.exchange);
                if received.len() == 1 {
                    break;
                }
            }
        })
        .await;
        token.cancel();

        assert_eq!(received.len(), 1);
        let name = received[0]
            .input
            .header("CamelFileNameOnly")
            .and_then(|v| v.as_str())
            .unwrap();
        assert_eq!(name, "data.csv");
    }

    #[tokio::test]
    async fn test_file_consumer_delete_mode() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        std::fs::write(dir.path().join("deleteme.txt"), "bye").unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?delete=true&initialDelay=0&delay=100"),
                &ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "file-test-route".to_string());

        tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        let _ = tokio::time::timeout(Duration::from_millis(500), async { rx.recv().await }).await;
        token.cancel();

        tokio::time::sleep(Duration::from_millis(100)).await;

        assert!(
            !dir.path().join("deleteme.txt").exists(),
            "File should be deleted"
        );
    }

    #[tokio::test]
    async fn test_file_consumer_move_mode() {
        let dir = tempfile::tempdir().unwrap();
        tokio::fs::write(dir.path().join("moveme.txt"), b"data")
            .await
            .unwrap();

        let uri = format!("file:{}?initialDelay=0&delay=50", dir.path().display());
        let config = FileConfig::from_uri(&uri).unwrap();
        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        let filters = CompiledFilters::default();
        let mut seen = std::collections::HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();

        let ex = rx.try_recv().expect("should receive exchange");
        drop(ex);

        assert!(
            !dir.path().join("moveme.txt").exists(),
            "Original file should be gone"
        );
        assert!(
            dir.path().join(".camel").join("moveme.txt").exists(),
            "File should be in .camel/"
        );
    }

    #[tokio::test]
    async fn test_file_consumer_respects_cancellation() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?initialDelay=0&delay=50"), &ctx)
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, _rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "file-test-route".to_string());

        let handle = tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        tokio::time::sleep(Duration::from_millis(150)).await;
        token.cancel();

        let result = tokio::time::timeout(Duration::from_secs(1), handle).await;
        assert!(
            result.is_ok(),
            "Consumer should have stopped after cancellation"
        );
    }

    // -----------------------------------------------------------------------
    // Producer tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_file_producer_writes_file() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("file content"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("output.txt".to_string()),
        );

        let result = producer.oneshot(exchange).await.unwrap();

        let content = std::fs::read_to_string(dir.path().join("output.txt")).unwrap();
        assert_eq!(content, "file content");

        assert!(result.input.header("CamelFileNameProduced").is_some());
    }

    #[tokio::test]
    async fn test_file_producer_auto_create_dirs() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}/sub/dir"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("nested"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("file.txt".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        assert!(dir.path().join("sub/dir/file.txt").exists());
    }

    #[tokio::test]
    async fn test_file_producer_file_exist_fail() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        std::fs::write(dir.path().join("existing.txt"), "old").unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileExist=Fail"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("new"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("existing.txt".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(
            result.is_err(),
            "Should fail when file exists with Fail strategy"
        );
    }

    #[tokio::test]
    async fn test_file_producer_file_exist_append() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        std::fs::write(dir.path().join("append.txt"), "old").unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileExist=Append"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("new"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("append.txt".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        let content = std::fs::read_to_string(dir.path().join("append.txt")).unwrap();
        assert_eq!(content, "oldnew");
    }

    #[tokio::test]
    async fn test_file_producer_temp_prefix() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?tempPrefix=.tmp"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("atomic write"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("final.txt".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        assert!(dir.path().join("final.txt").exists());
        assert!(!dir.path().join(".tmpfinal.txt").exists());
        let content = std::fs::read_to_string(dir.path().join("final.txt")).unwrap();
        assert_eq!(content, "atomic write");
    }

    #[tokio::test]
    async fn file_producer_writes_nested_filename_override() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        // Override is the default fileExist strategy.
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("nested body"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("sub/dir/payload.bin".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        let target = dir.path().join("sub").join("dir").join("payload.bin");
        assert!(target.exists(), "target file should exist at {:?}", target);
        let content = std::fs::read(&target).unwrap();
        assert_eq!(content, b"nested body");
        // No leftover temp file in the directory root (Bug C symptom: .tmp.sub/dir/payload.bin
        // path was being computed and the parent dir did not exist).
        assert!(
            !dir.path().join(".tmp.sub").exists(),
            "no stray temp path should be created at directory root"
        );
    }

    #[tokio::test]
    async fn file_producer_writes_nested_filename_try_rename() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?fileExist=TryRename&tempPrefix=.t."),
                &ctx,
            )
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("try-rename nested"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("deep/dir/x.bin".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        let target = dir.path().join("deep").join("dir").join("x.bin");
        assert!(target.exists());
        assert_eq!(std::fs::read(&target).unwrap(), b"try-rename nested");
        // Temp file must not leak.
        assert!(
            !dir.path()
                .join("deep")
                .join("dir")
                .join(".t.x.bin")
                .exists(),
            "temp file should have been renamed away"
        );
    }

    #[tokio::test]
    async fn file_producer_writes_nested_filename_fail_strategy() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileExist=Fail"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("fail-strategy nested"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("a/b/c.bin".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        let target = dir.path().join("a").join("b").join("c.bin");
        assert!(target.exists());
        assert_eq!(std::fs::read(&target).unwrap(), b"fail-strategy nested");
    }

    #[tokio::test]
    async fn test_file_producer_uses_filename_option() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileName=fixed.txt"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::new("content"));

        producer.oneshot(exchange).await.unwrap();
        assert!(dir.path().join("fixed.txt").exists());
    }

    #[tokio::test]
    async fn test_file_producer_no_filename_errors() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::new("content"));

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should error when no filename is provided");
    }

    // -----------------------------------------------------------------------
    // Security tests - Path traversal protection
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_file_producer_rejects_path_traversal_parent_directory() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        // Create a subdirectory
        std::fs::create_dir(dir.path().join("subdir")).unwrap();
        std::fs::write(dir.path().join("secret.txt"), "secret").unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}/subdir"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("malicious"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("../secret.txt".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should reject path traversal attempt");

        let err = result.unwrap_err();
        // Rejected either by the lexical pre-check ("traversal") or by the
        // canonicalize-based base check ("outside") — both are valid refusals.
        let msg = err.to_string();
        assert!(
            msg.contains("outside") || msg.contains("traversal"),
            "Error should mention path confinement violation, got: {msg}"
        );
    }

    #[tokio::test]
    async fn test_file_producer_rejects_absolute_path_outside_base() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("malicious"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("/etc/passwd".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should reject absolute path outside base");
    }

    #[tokio::test]
    async fn test_file_producer_does_not_create_dirs_before_path_validation() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let outside_parent = dir.path().parent().unwrap().join("escaped-create-dir");
        if outside_parent.exists() {
            std::fs::remove_dir_all(&outside_parent).unwrap();
        }

        let mut exchange = Exchange::new(Message::new("malicious"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("../escaped-create-dir/file.txt".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should reject traversal path");
        assert!(
            !outside_parent.exists(),
            "Must not create outside directories before path validation"
        );
    }

    #[cfg(unix)]
    #[tokio::test]
    async fn test_list_files_skips_symlink_cycle() {
        use std::os::unix::fs as unix_fs;

        let dir = tempfile::tempdir().unwrap();
        let nested = dir.path().join("nested");
        std::fs::create_dir_all(&nested).unwrap();
        std::fs::write(nested.join("a.txt"), "x").unwrap();
        unix_fs::symlink(dir.path(), nested.join("loop")).unwrap();

        let files = list_files(dir.path(), true).await.unwrap();
        assert_eq!(files.iter().filter(|p| p.ends_with("a.txt")).count(), 1);
    }

    // -----------------------------------------------------------------------
    // Large file streaming tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    #[ignore = "slow test: file polling (run with --ignored)"]
    async fn test_large_file_streaming_constant_memory() {
        use std::io::Write;
        use tempfile::NamedTempFile;

        // Create a 150MB file (larger than 100MB limit)
        let mut temp_file = NamedTempFile::new().unwrap();
        let file_size = 150 * 1024 * 1024; // 150MB
        let chunk = vec![b'X'; 1024 * 1024]; // 1MB chunk

        for _ in 0..150 {
            temp_file.write_all(&chunk).unwrap();
        }
        temp_file.flush().unwrap();

        let dir = temp_file.path().parent().unwrap();
        let dir_path = dir.to_str().unwrap();
        let file_name = temp_file
            .path()
            .file_name()
            .unwrap()
            .to_str()
            .unwrap()
            .to_string();

        // Read file as stream (should succeed with lazy evaluation)
        let component = FileComponent::new();
        let component_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?noop=true&initialDelay=0&delay=100&fileName={file_name}"),
                &component_ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "file-test-route".to_string());

        tokio::spawn(async move {
            let _ = consumer.start(ctx).await;
        });

        let exchange = tokio::time::timeout(Duration::from_secs(5), async {
            rx.recv().await.unwrap().exchange
        })
        .await
        .expect("Should receive exchange");
        token.cancel();

        // Verify body is a stream (not materialized)
        assert!(matches!(exchange.input.body, Body::Stream(_)));

        // Verify we can read metadata without consuming
        if let Body::Stream(ref stream_body) = exchange.input.body {
            assert!(stream_body.metadata.size_hint.is_some());
            let size = stream_body.metadata.size_hint.unwrap();
            assert_eq!(size, file_size as u64);
        }

        // Materializing should fail (exceeds 100MB limit)
        if let Body::Stream(stream_body) = exchange.input.body {
            let body = Body::Stream(stream_body);
            let result = body.into_bytes(100 * 1024 * 1024).await;
            assert!(result.is_err());
        }

        // But we CAN read chunks one at a time (simulating line-by-line processing)
        // This demonstrates lazy evaluation - we don't need to load entire file
        let component2 = FileComponent::new();
        let endpoint2 = component2
            .create_endpoint(
                &format!("file:{dir_path}?noop=true&initialDelay=0&delay=100&fileName={file_name}"),
                &component_ctx,
            )
            .unwrap();
        let mut consumer2 = endpoint2.create_consumer(rt()).unwrap();

        let (tx2, mut rx2) = tokio::sync::mpsc::channel(16);
        let token2 = CancellationToken::new();
        let ctx2 = ConsumerContext::new(tx2, token2.clone(), "file-test-route-2".to_string());

        tokio::spawn(async move {
            let _ = consumer2.start(ctx2).await;
        });

        let exchange2 = tokio::time::timeout(Duration::from_secs(5), async {
            rx2.recv().await.unwrap().exchange
        })
        .await
        .expect("Should receive exchange");
        token2.cancel();

        if let Body::Stream(stream_body) = exchange2.input.body {
            let mut stream_lock = stream_body.stream.lock().await;
            let mut stream = stream_lock.take().unwrap();

            // Read first chunk (size varies based on ReaderStream's buffer)
            if let Some(chunk_result) = stream.next().await {
                let chunk = chunk_result.unwrap();
                assert!(!chunk.is_empty());
                assert!(chunk.len() < file_size);
                // Memory usage is constant - we only have this chunk in memory, not 150MB
            }
        }
    }

    // -----------------------------------------------------------------------
    // Streaming producer tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_producer_writes_stream_body() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let uri = format!("file:{dir_path}?fileName=out.txt");

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint(&uri, &ctx).unwrap();
        let producer = endpoint
            .create_producer(rt(), &test_producer_ctx())
            .unwrap();

        let chunks: Vec<Result<Bytes, CamelError>> = vec![
            Ok(Bytes::from("hello ")),
            Ok(Bytes::from("streaming ")),
            Ok(Bytes::from("world")),
        ];
        let stream = futures::stream::iter(chunks);
        let body = Body::Stream(StreamBody {
            stream: std::sync::Arc::new(tokio::sync::Mutex::new(Some(Box::pin(stream)))),
            metadata: StreamMetadata {
                size_hint: None,
                content_type: None,
                origin: None,
            },
        });

        let exchange = Exchange::new(Message::new(body));
        tower::ServiceExt::oneshot(producer, exchange)
            .await
            .unwrap();

        let content = tokio::fs::read_to_string(format!("{dir_path}/out.txt"))
            .await
            .unwrap();
        assert_eq!(content, "hello streaming world");
    }

    #[tokio::test]
    async fn test_producer_stream_atomic_no_partial_on_error() {
        // If the stream errors mid-write, no file should exist at the target path
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let uri = format!("file:{dir_path}?fileName=out.txt");

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint(&uri, &ctx).unwrap();
        let producer = endpoint
            .create_producer(rt(), &test_producer_ctx())
            .unwrap();

        let chunks: Vec<Result<Bytes, CamelError>> = vec![
            Ok(Bytes::from("partial")),
            Err(CamelError::ProcessorError(
                "simulated stream error".to_string(),
            )),
        ];
        let stream = futures::stream::iter(chunks);
        let body = Body::Stream(StreamBody {
            stream: std::sync::Arc::new(tokio::sync::Mutex::new(Some(Box::pin(stream)))),
            metadata: StreamMetadata {
                size_hint: None,
                content_type: None,
                origin: None,
            },
        });

        let exchange = Exchange::new(Message::new(body));
        let result = tower::ServiceExt::oneshot(producer, exchange).await;
        assert!(
            result.is_err(),
            "expected error when stream fails mid-write"
        );

        // Target file must NOT exist — write was aborted and temp file cleaned up
        assert!(
            !std::path::Path::new(&format!("{dir_path}/out.txt")).exists(),
            "partial file must not exist after failed write"
        );

        // Temp file must also be cleaned up
        assert!(
            !std::path::Path::new(&format!("{dir_path}/.tmp.out.txt")).exists(),
            "temp file must be cleaned up after failed write"
        );
    }

    #[tokio::test]
    async fn test_producer_stream_append() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let target = format!("{dir_path}/out.txt");

        // Pre-create file with initial content
        tokio::fs::write(&target, b"line1\n").await.unwrap();

        let uri = format!("file:{dir_path}?fileName=out.txt&fileExist=Append");
        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint(&uri, &ctx).unwrap();
        let producer = endpoint
            .create_producer(rt(), &test_producer_ctx())
            .unwrap();

        let chunks: Vec<Result<Bytes, CamelError>> = vec![Ok(Bytes::from("line2\n"))];
        let stream = futures::stream::iter(chunks);
        let body = Body::Stream(StreamBody {
            stream: std::sync::Arc::new(tokio::sync::Mutex::new(Some(Box::pin(stream)))),
            metadata: StreamMetadata {
                size_hint: None,
                content_type: None,
                origin: None,
            },
        });

        let exchange = Exchange::new(Message::new(body));
        tower::ServiceExt::oneshot(producer, exchange)
            .await
            .unwrap();

        let content = tokio::fs::read_to_string(&target).await.unwrap();
        assert_eq!(content, "line1\nline2\n");
    }

    #[tokio::test]
    async fn test_producer_stream_append_partial_on_error() {
        // Append is inherently non-atomic: if the stream errors mid-write,
        // the file will contain partial data. This test documents that behavior.
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let target = format!("{dir_path}/out.txt");

        // Pre-create file with initial content
        tokio::fs::write(&target, b"initial\n").await.unwrap();

        let uri = format!("file:{dir_path}?fileName=out.txt&fileExist=Append");
        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint(&uri, &ctx).unwrap();
        let producer = endpoint
            .create_producer(rt(), &test_producer_ctx())
            .unwrap();

        // Stream with an error in the middle
        let chunks: Vec<Result<Bytes, CamelError>> = vec![
            Ok(Bytes::from("partial-")), // This will be written
            Err(CamelError::ProcessorError("stream error".to_string())), // This causes failure
            Ok(Bytes::from("never-written")), // This won't be reached
        ];
        let stream = futures::stream::iter(chunks);
        let body = Body::Stream(StreamBody {
            stream: std::sync::Arc::new(tokio::sync::Mutex::new(Some(Box::pin(stream)))),
            metadata: StreamMetadata {
                size_hint: None,
                content_type: None,
                origin: None,
            },
        });

        let exchange = Exchange::new(Message::new(body));
        let result = tower::ServiceExt::oneshot(producer, exchange).await;

        // 1. Producer must return an error
        assert!(
            result.is_err(),
            "expected error when stream fails during append"
        );

        // 2. File must contain initial content + partial data written before the error
        let content = tokio::fs::read_to_string(&target).await.unwrap();
        assert_eq!(
            content, "initial\npartial-",
            "append leaves partial data on stream error (non-atomic by nature)"
        );
    }

    #[tokio::test]
    async fn test_producer_stream_already_consumed_errors() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let uri = format!("file:{dir_path}?fileName=out.txt");

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint(&uri, &ctx).unwrap();
        let producer = endpoint
            .create_producer(rt(), &test_producer_ctx())
            .unwrap();

        // Mutex holds None -> stream already consumed
        type MaybeStream = std::sync::Arc<
            tokio::sync::Mutex<
                Option<
                    std::pin::Pin<
                        Box<dyn futures::Stream<Item = Result<Bytes, CamelError>> + Send>,
                    >,
                >,
            >,
        >;
        let arc: MaybeStream = std::sync::Arc::new(tokio::sync::Mutex::new(None));
        let body = Body::Stream(StreamBody {
            stream: arc,
            metadata: StreamMetadata {
                size_hint: None,
                content_type: None,
                origin: None,
            },
        });

        let exchange = Exchange::new(Message::new(body));
        let result = tower::ServiceExt::oneshot(producer, exchange).await;
        assert!(
            result.is_err(),
            "expected error for already-consumed stream"
        );
    }

    // -----------------------------------------------------------------------
    // GlobalConfig tests - apply_global_defaults behavior
    // -----------------------------------------------------------------------

    #[test]
    fn test_global_config_applied_to_endpoint() {
        // Global config with non-default values
        let global = FileGlobalConfig::default()
            .with_delay_ms(2000)
            .with_initial_delay_ms(5000)
            .with_read_timeout_ms(60_000)
            .with_write_timeout_ms(45_000);
        let component = FileComponent::with_config(global);
        let ctx = NoOpComponentContext;
        // URI uses no explicit delay/timeout params → macro defaults apply
        let endpoint = component.create_endpoint("file:/tmp/inbox", &ctx).unwrap();
        // We cannot call endpoint.config directly (FileEndpoint is private),
        // but we can test apply_global_defaults on FileConfig directly:
        let mut config = FileConfig::from_uri("file:/tmp/inbox").unwrap();
        let global2 = FileGlobalConfig::default()
            .with_delay_ms(2000)
            .with_initial_delay_ms(5000)
            .with_read_timeout_ms(60_000)
            .with_write_timeout_ms(45_000);
        config.apply_global_defaults(&global2);
        assert_eq!(config.delay, Duration::from_millis(2000));
        assert_eq!(config.initial_delay, Duration::from_millis(5000));
        assert_eq!(config.read_timeout, Duration::from_millis(60_000));
        assert_eq!(config.write_timeout, Duration::from_millis(45_000));
        // endpoint creation succeeds too
        let _ = endpoint; // just verify create_endpoint didn't fail
    }

    #[test]
    fn test_uri_param_wins_over_global_config() {
        // URI explicitly sets delay=1000 (NOT the 500ms macro default)
        let mut config =
            FileConfig::from_uri("file:/tmp/inbox?delay=1000&initialDelay=2000").unwrap();
        // Global config would want 3000ms delay
        let global = FileGlobalConfig::default()
            .with_delay_ms(3000)
            .with_initial_delay_ms(4000);
        config.apply_global_defaults(&global);
        // URI value of 1000ms must be preserved (not replaced by 3000ms)
        assert_eq!(config.delay, Duration::from_millis(1000));
        // URI value of 2000ms must be preserved (not replaced by 4000ms)
        assert_eq!(config.initial_delay, Duration::from_millis(2000));
        // read_timeout was not set by URI → macro default (30000) → global wins if different
        // (read_timeout stays at 30000 since global has same default = 30000)
        assert_eq!(config.read_timeout, Duration::from_millis(30_000));
    }

    #[tokio::test]
    async fn test_file_producer_filename_simple_language_from_header() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("content"));
        exchange
            .input
            .set_header("CamelTimerCounter", serde_json::Value::Number(42.into()));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("test-${header.CamelTimerCounter}.txt".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        assert!(
            dir.path().join("test-42.txt").exists(),
            "fileName should have been evaluated from Simple Language expression"
        );
        let content = std::fs::read_to_string(dir.path().join("test-42.txt")).unwrap();
        assert_eq!(content, "content");
    }

    #[tokio::test]
    async fn test_file_producer_filename_simple_language_from_uri_param() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?fileName=msg-${{header.id}}.dat"),
                &ctx,
            )
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("data"));
        exchange
            .input
            .set_header("id", serde_json::Value::String("abc".to_string()));

        producer.oneshot(exchange).await.unwrap();

        assert!(
            dir.path().join("msg-abc.dat").exists(),
            "fileName URI param should have been evaluated from Simple Language expression"
        );
    }

    #[tokio::test]
    async fn test_file_producer_filename_literal_without_expression() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileName=plain.txt"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::new("data"));
        producer.oneshot(exchange).await.unwrap();

        assert!(
            dir.path().join("plain.txt").exists(),
            "literal fileName without expressions should still work"
        );
    }

    // -----------------------------------------------------------------------
    // Config validation tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_rejects_path_traversal_in_move_to() {
        let result = FileConfig::from_uri("file:/tmp/inbox?move=../etc/passwd");
        assert!(result.is_err(), "should reject path traversal in move_to");
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("path traversal"),
            "error should mention path traversal: {err}"
        );
    }

    #[test]
    fn test_rejects_absolute_move_to() {
        let result = FileConfig::from_uri("file:/tmp/inbox?move=/tmp/outside");
        assert!(result.is_err(), "should reject absolute move_to");
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("relative path") || err.contains("Invalid URI"),
            "error should mention invalid move_to path: {err}"
        );
    }

    #[test]
    fn test_rejects_path_traversal_in_temp_prefix() {
        let result = FileConfig::from_uri("file:/tmp/inbox?tempPrefix=../tmp");
        assert!(
            result.is_err(),
            "should reject path traversal in temp_prefix"
        );
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("path traversal"),
            "error should mention path traversal: {err}"
        );
    }

    #[test]
    fn test_rejects_temp_prefix_with_path_separator() {
        let result = FileConfig::from_uri("file:/tmp/inbox?tempPrefix=tmp/sub");
        assert!(result.is_err(), "should reject temp_prefix with separator");
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("plain filename prefix"),
            "error should mention plain filename prefix restriction: {err}"
        );
    }

    #[test]
    fn test_rejects_absolute_temp_prefix() {
        let result = FileConfig::from_uri("file:/tmp/inbox?tempPrefix=/tmp/");
        assert!(result.is_err(), "should reject absolute temp_prefix");
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("plain filename prefix"),
            "error should mention plain filename prefix restriction: {err}"
        );
    }

    #[test]
    fn test_rejects_null_byte_in_temp_prefix() {
        let config = FileConfig {
            directory: "/tmp/inbox".into(),
            delay: Duration::from_millis(500),
            delay_ms: 500,
            initial_delay: Duration::from_millis(1000),
            initial_delay_ms: 1000,
            noop: false,
            delete: false,
            move_to: None,
            file_name: Some("ok.txt".into()),
            include: None,
            exclude: None,
            ant_include: None,
            ant_exclude: None,
            include_ext: None,
            exclude_ext: None,
            recursive: false,
            file_exist: FileExistStrategy::Override,
            read_lock_strategy: ReadLockStrategy::None,
            idempotent_key: IdempotentKey::None,
            done_file_name: None,
            charset: None,
            temp_prefix: Some("tmp\0".into()),
            durable: false,
            auto_create: true,
            starting_directory_must_exist: false,
            read_timeout: Duration::from_millis(30_000),
            read_timeout_ms: 30_000,
            write_timeout: Duration::from_millis(30_000),
            write_timeout_ms: 30_000,
            max_write_bytes: 0,
            max_depth: usize::MAX,
            min_depth: 0,
            max_messages_per_poll: 0,
            eager_max_messages_per_poll: true,
            shuffle: false,
            sort_spec: None,
            cleanup_stale_temps: true,
        };

        let result = config.validate();
        assert!(result.is_err(), "should reject null byte in temp_prefix");
    }

    #[test]
    fn test_rejects_null_byte_in_filename() {
        // Null bytes in URI params are typically URL-encoded, so we test via
        // direct config construction to simulate the validation logic.
        let config = FileConfig {
            directory: "/tmp/inbox".into(),
            delay: Duration::from_millis(500),
            delay_ms: 500,
            initial_delay: Duration::from_millis(1000),
            initial_delay_ms: 1000,
            noop: false,
            delete: false,
            move_to: None,
            file_name: Some("foo\0bar".into()),
            include: None,
            exclude: None,
            ant_include: None,
            ant_exclude: None,
            include_ext: None,
            exclude_ext: None,
            recursive: false,
            file_exist: FileExistStrategy::Override,
            read_lock_strategy: ReadLockStrategy::None,
            idempotent_key: IdempotentKey::None,
            done_file_name: None,
            charset: None,
            temp_prefix: None,
            durable: false,
            auto_create: true,
            starting_directory_must_exist: false,
            read_timeout: Duration::from_millis(30_000),
            read_timeout_ms: 30_000,
            write_timeout: Duration::from_millis(30_000),
            write_timeout_ms: 30_000,
            max_write_bytes: 0,
            max_depth: usize::MAX,
            min_depth: 0,
            max_messages_per_poll: 0,
            eager_max_messages_per_poll: true,
            shuffle: false,
            sort_spec: None,
            cleanup_stale_temps: true,
        };
        let result = config.validate();
        assert!(result.is_err(), "should reject null byte in filename");
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("null"),
            "error should mention null bytes: {err}"
        );
    }

    #[test]
    fn test_rejects_empty_filename() {
        let config = FileConfig {
            directory: "/tmp/inbox".into(),
            delay: Duration::from_millis(500),
            delay_ms: 500,
            initial_delay: Duration::from_millis(1000),
            initial_delay_ms: 1000,
            noop: false,
            delete: false,
            move_to: None,
            file_name: Some("".into()),
            include: None,
            exclude: None,
            ant_include: None,
            ant_exclude: None,
            include_ext: None,
            exclude_ext: None,
            recursive: false,
            file_exist: FileExistStrategy::Override,
            read_lock_strategy: ReadLockStrategy::None,
            idempotent_key: IdempotentKey::None,
            done_file_name: None,
            charset: None,
            temp_prefix: None,
            durable: false,
            auto_create: true,
            starting_directory_must_exist: false,
            read_timeout: Duration::from_millis(30_000),
            read_timeout_ms: 30_000,
            write_timeout: Duration::from_millis(30_000),
            write_timeout_ms: 30_000,
            max_write_bytes: 0,
            max_depth: usize::MAX,
            min_depth: 0,
            max_messages_per_poll: 0,
            eager_max_messages_per_poll: true,
            shuffle: false,
            sort_spec: None,
            cleanup_stale_temps: true,
        };
        let result = config.validate();
        assert!(result.is_err(), "should reject empty filename");
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("empty") || err.contains("must not"),
            "error should mention empty: {err}"
        );
    }

    #[test]
    fn test_rejects_nonexistent_directory_when_starting_directory_must_exist() {
        let result =
            FileConfig::from_uri("file:/tmp/nonexistent_dir_12345?startingDirectoryMustExist=true");
        assert!(
            result.is_err(),
            "should reject non-existent directory when startingDirectoryMustExist=true"
        );
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("does not exist"),
            "error should mention directory does not exist: {err}"
        );
    }

    #[test]
    fn test_accepts_existing_directory_when_starting_directory_must_exist() {
        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let result =
            FileConfig::from_uri(&format!("file:{dir_path}?startingDirectoryMustExist=true"));
        assert!(
            result.is_ok(),
            "should accept existing directory when startingDirectoryMustExist=true: {:?}",
            result.err()
        );
    }

    #[test]
    fn test_valid_config_passes() {
        let cfg = FileConfig::from_uri("file:/tmp/inbox").unwrap();
        assert!(cfg.validate().is_ok());
    }

    #[test]
    fn test_file_exist_strategy_rejects_unknown() {
        // Unknown strategy values should be rejected by from_str
        let result = FileExistStrategy::from_str("BogusValue");
        assert!(
            result.is_err(),
            "unknown FileExistStrategy should return Err"
        );
    }

    #[test]
    fn test_path_contains_traversal_detects_parent_dir() {
        assert!(path_contains_traversal("../etc/passwd"));
        assert!(path_contains_traversal("foo/../bar"));
        assert!(path_contains_traversal(".."));
        assert!(path_contains_traversal("a/b/../../../c"));
    }

    #[test]
    fn test_path_contains_traversal_accepts_safe_paths() {
        assert!(!path_contains_traversal("safe/path"));
        assert!(!path_contains_traversal("/absolute/path"));
        assert!(!path_contains_traversal("filename.txt"));
        assert!(!path_contains_traversal(".hidden"));
        assert!(!path_contains_traversal(""));
    }

    // -----------------------------------------------------------------------
    // File modification detection tests (C-20)
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_stream_detects_file_modified_during_read() {
        use futures::StreamExt;

        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("mutable.txt");
        std::fs::write(&file_path, b"initial content here").unwrap();

        // Capture initial metadata
        let initial_meta = std::fs::metadata(&file_path).unwrap();
        let initial_size = initial_meta.len();
        let initial_mtime = initial_meta.modified().ok();

        // Create a raw file stream (simulating what the consumer does)
        let file = tokio::fs::File::open(&file_path).await.unwrap();
        let raw_stream = ReaderStream::new(file).map(|res| res.map_err(CamelError::from));

        let mut stream = ModificationDetectingStream::new(
            raw_stream,
            file_path.clone(),
            initial_size,
            initial_mtime,
        );

        // Read a chunk (file not modified yet — should succeed)
        let chunk = stream.next().await;
        assert!(chunk.is_some(), "should produce at least one chunk");
        assert!(chunk.as_ref().unwrap().is_ok(), "first chunk should be Ok");

        // Modify the file (change content/size)
        std::fs::write(&file_path, b"modified content - different size!!").unwrap();

        // Drain remaining chunks — the stream should produce an error after EOF
        let mut got_error = false;
        while let Some(result) = stream.next().await {
            if let Err(err) = result {
                let msg = err.to_string();
                assert!(
                    msg.contains("file modified during read"),
                    "expected modification error, got: {msg}"
                );
                got_error = true;
                break;
            }
        }

        assert!(
            got_error,
            "stream should detect file was modified during read"
        );
    }

    #[tokio::test]
    async fn test_stream_succeeds_when_file_not_modified() {
        use futures::StreamExt;

        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("stable.txt");
        std::fs::write(&file_path, b"stable content").unwrap();

        let initial_meta = std::fs::metadata(&file_path).unwrap();
        let initial_size = initial_meta.len();
        let initial_mtime = initial_meta.modified().ok();

        let file = tokio::fs::File::open(&file_path).await.unwrap();
        let raw_stream = ReaderStream::new(file).map(|res| res.map_err(CamelError::from));

        let mut stream = ModificationDetectingStream::new(
            raw_stream,
            file_path.clone(),
            initial_size,
            initial_mtime,
        );

        // Drain entire stream — should produce no errors
        let mut all_ok = true;
        while let Some(result) = stream.next().await {
            if result.is_err() {
                all_ok = false;
                break;
            }
        }

        assert!(
            all_ok,
            "stream should complete without errors when file is not modified"
        );
    }

    // -----------------------------------------------------------------------
    // SortSpec::from_str tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_sort_spec_bare_field() {
        let spec: SortSpec = "file:name".parse().unwrap();
        assert_eq!(spec.groups.len(), 1);
        let g = &spec.groups[0];
        assert_eq!(g.field, SortField::Name);
        assert!(!g.reverse);
        assert!(!g.ignore_case);
    }

    #[test]
    fn test_sort_spec_reverse() {
        let spec: SortSpec = "reverse:file:length".parse().unwrap();
        assert_eq!(spec.groups.len(), 1);
        let g = &spec.groups[0];
        assert_eq!(g.field, SortField::Length);
        assert!(g.reverse);
        assert!(!g.ignore_case);
    }

    #[test]
    fn test_sort_spec_ignore_case() {
        let spec: SortSpec = "ignoreCase:file:name".parse().unwrap();
        assert_eq!(spec.groups.len(), 1);
        let g = &spec.groups[0];
        assert_eq!(g.field, SortField::Name);
        assert!(!g.reverse);
        assert!(g.ignore_case);
    }

    #[test]
    fn test_sort_spec_reverse_ignore_case() {
        let spec: SortSpec = "reverse:ignoreCase:file:modified".parse().unwrap();
        assert_eq!(spec.groups.len(), 1);
        let g = &spec.groups[0];
        assert_eq!(g.field, SortField::Modified);
        assert!(g.reverse);
        assert!(g.ignore_case);
    }

    #[test]
    fn test_sort_spec_wrong_order_rejection() {
        let result: Result<SortSpec, _> = "ignoreCase:reverse:file:name".parse();
        assert!(result.is_err());
        let err = result.unwrap_err();
        assert!(
            err.contains("reverse must precede"),
            "expected 'reverse must precede' error, got: {err}"
        );
    }

    #[test]
    fn test_sort_spec_multi_group() {
        let spec: SortSpec = "file:name;reverse:file:length".parse().unwrap();
        assert_eq!(spec.groups.len(), 2);
        assert_eq!(spec.groups[0].field, SortField::Name);
        assert!(!spec.groups[0].reverse);
        assert_eq!(spec.groups[1].field, SortField::Length);
        assert!(spec.groups[1].reverse);
    }

    #[test]
    fn test_sort_spec_unsupported_field() {
        let result: Result<SortSpec, _> = "file:unknown".parse();
        assert!(result.is_err());
        let err = result.unwrap_err();
        assert!(
            err.contains("unsupported"),
            "expected 'unsupported' error, got: {err}"
        );
    }

    #[test]
    fn test_sort_spec_empty_string() {
        let result: Result<SortSpec, _> = "".parse();
        assert!(result.is_err());
        let err = result.unwrap_err();
        assert!(
            err.contains("at least one group"),
            "expected 'at least one group' error, got: {err}"
        );
    }

    #[tokio::test]
    async fn test_max_depth_limits_recursion() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::create_dir_all(base.join("sub/deep")).await.unwrap();
        fs::write(base.join("root.txt"), b"r").await.unwrap();
        fs::write(base.join("sub/mid.txt"), b"m").await.unwrap();
        fs::write(base.join("sub/deep/leaf.txt"), b"l")
            .await
            .unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?recursive=true&maxDepth=2",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert!(names.contains(&"root.txt".to_string()));
        assert!(names.contains(&"mid.txt".to_string()));
        assert!(!names.contains(&"leaf.txt".to_string()));
    }

    #[tokio::test]
    async fn test_min_depth_skips_base_files() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::create_dir_all(base.join("sub")).await.unwrap();
        fs::write(base.join("root.txt"), b"r").await.unwrap();
        fs::write(base.join("sub/deep.txt"), b"d").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?recursive=true&minDepth=2",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert!(!names.contains(&"root.txt".to_string()));
        assert!(names.contains(&"deep.txt".to_string()));
    }

    #[tokio::test]
    async fn test_include_ext_filter() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("data.txt"), b"t").await.unwrap();
        fs::write(base.join("data.csv"), b"c").await.unwrap();
        fs::write(base.join("data.json"), b"j").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?includeExt=txt,csv", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert_eq!(names.len(), 2);
        assert!(names.contains(&"data.txt".to_string()));
        assert!(names.contains(&"data.csv".to_string()));
    }

    #[tokio::test]
    async fn test_ant_include_glob() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("report.txt"), b"r").await.unwrap();
        fs::write(base.join("data.csv"), b"d").await.unwrap();
        fs::write(base.join("image.png"), b"i").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?antInclude=*.txt,*.csv", base.display()))
                .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert_eq!(names.len(), 2);
        assert!(names.contains(&"report.txt".to_string()));
        assert!(names.contains(&"data.csv".to_string()));
    }

    #[tokio::test]
    async fn test_exclude_ext_filter() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("keep.txt"), b"k").await.unwrap();
        fs::write(base.join("skip.log"), b"s").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?excludeExt=log", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert_eq!(names.len(), 1);
        assert!(names.contains(&"keep.txt".to_string()));
    }

    #[tokio::test]
    async fn test_ant_exclude_glob() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("report.txt"), b"r").await.unwrap();
        fs::write(base.join("temp.tmp"), b"t").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?antExclude=*.tmp", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert_eq!(names.len(), 1);
        assert!(names.contains(&"report.txt".to_string()));
    }

    #[tokio::test]
    async fn test_done_file_consumer_skips_without_marker() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("ready.txt"), b"ready").await.unwrap();
        fs::write(base.join("ready.txt.done"), b"").await.unwrap();
        fs::write(base.join("pending.txt"), b"pending")
            .await
            .unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?doneFileName=${{file:name}}.done",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        let names: Vec<String> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap().to_string())
            .collect();
        assert!(names.contains(&"ready.txt".to_string()));
        assert!(!names.contains(&"pending.txt".to_string()));
        assert!(!names.contains(&"ready.txt.done".to_string()));
    }

    #[tokio::test]
    async fn test_done_file_static_pattern() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("data.txt"), b"d").await.unwrap();
        fs::write(base.join("ready"), b"").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?doneFileName=ready", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        assert_eq!(candidates.len(), 1);
        assert_eq!(
            candidates[0].path.file_name().unwrap().to_str().unwrap(),
            "data.txt"
        );
    }

    // -----------------------------------------------------------------------
    // Sort + shuffle tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_sort_by_name() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("c.txt"), b"3").await.unwrap();
        fs::write(base.join("a.txt"), b"1").await.unwrap();
        fs::write(base.join("b.txt"), b"2").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?sortBy=file:name", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        apply_sort_and_limit(&mut candidates, &config);
        let names: Vec<&str> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap())
            .collect();
        assert_eq!(names, vec!["a.txt", "b.txt", "c.txt"]);
    }

    #[tokio::test]
    async fn test_sort_by_length() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("big.txt"), b"xxx").await.unwrap();
        fs::write(base.join("small.txt"), b"x").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?sortBy=file:length", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        apply_sort_and_limit(&mut candidates, &config);
        let names: Vec<&str> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap())
            .collect();
        assert_eq!(names, vec!["small.txt", "big.txt"]);
    }

    #[tokio::test]
    async fn test_sort_by_reverse_name() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("a.txt"), b"1").await.unwrap();
        fs::write(base.join("b.txt"), b"2").await.unwrap();
        fs::write(base.join("c.txt"), b"3").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?sortBy=reverse:file:name",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        apply_sort_and_limit(&mut candidates, &config);
        let names: Vec<&str> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap())
            .collect();
        assert_eq!(names, vec!["c.txt", "b.txt", "a.txt"]);
    }

    #[tokio::test]
    async fn test_shuffle_deterministic() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("a.txt"), b"1").await.unwrap();
        fs::write(base.join("b.txt"), b"2").await.unwrap();
        fs::write(base.join("c.txt"), b"3").await.unwrap();
        fs::write(base.join("d.txt"), b"4").await.unwrap();

        let config =
            FileConfig::from_uri(&format!("file://{}?shuffle=true", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        crate::poll_logic::apply_sort_and_limit(&mut candidates, &config);

        let mut candidates2 =
            crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
                .await
                .unwrap()
                .candidates;
        crate::poll_logic::apply_sort_and_limit(&mut candidates2, &config);

        let names1: Vec<&str> = candidates
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap())
            .collect();
        let names2: Vec<&str> = candidates2
            .iter()
            .map(|c| c.path.file_name().unwrap().to_str().unwrap())
            .collect();
        assert_eq!(names1, names2);
        assert_ne!(names1, vec!["a.txt", "b.txt", "c.txt", "d.txt"]);
    }

    #[tokio::test]
    async fn test_non_eager_limit() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("a.txt"), b"1").await.unwrap();
        fs::write(base.join("b.txt"), b"2").await.unwrap();
        fs::write(base.join("c.txt"), b"3").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?maxMessagesPerPoll=2&eagerMaxMessagesPerPoll=false",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = crate::poll_logic::scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        assert_eq!(candidates.len(), 3);
        crate::poll_logic::apply_sort_and_limit(&mut candidates, &config);
        assert_eq!(candidates.len(), 2);
    }

    #[tokio::test]
    async fn test_poll_one_file_sets_all_headers() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("test.txt"), b"hello world")
            .await
            .unwrap();

        let config = FileConfig::from_uri(&format!("file:{}?noop=true", base.display())).unwrap();

        let file_path = base.join("test.txt");
        let include_re = None;
        let exclude_re = None;
        let mut seen = std::collections::HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));

        let result = poll_one_file(
            &config,
            file_path.clone(),
            base,
            &include_re,
            &exclude_re,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();

        let exchange = result.expect("poll_one_file should return an exchange");

        let camel_file_name = exchange
            .input
            .header("CamelFileName")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFileName header");
        let camel_file_name_only = exchange
            .input
            .header("CamelFileNameOnly")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFileNameOnly header");
        let camel_file_absolute_path = exchange
            .input
            .header("CamelFileAbsolutePath")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFileAbsolutePath header");
        exchange
            .input
            .header("CamelFileLength")
            .and_then(|v| v.as_u64())
            .expect("CamelFileLength header");
        exchange
            .input
            .header("CamelFileLastModified")
            .and_then(|v| v.as_u64())
            .expect("CamelFileLastModified header");
        let camel_file_path = exchange
            .input
            .header("CamelFilePath")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFilePath header");
        let camel_file_parent = exchange
            .input
            .header("CamelFileParent")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFileParent header");
        let camel_file_canonical_path = exchange
            .input
            .header("CamelFileCanonicalPath")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFileCanonicalPath header");
        let camel_file_relative_path = exchange
            .input
            .header("CamelFileRelativePath")
            .and_then(|v| v.as_str().map(String::from))
            .expect("CamelFileRelativePath header");

        assert_eq!(camel_file_name, "test.txt");
        assert_eq!(camel_file_name_only, "test.txt");
        assert_eq!(camel_file_relative_path, camel_file_name);
        assert_eq!(camel_file_path, base.to_string_lossy());
        assert_eq!(camel_file_parent, base.to_string_lossy());
        assert!(camel_file_absolute_path.ends_with("test.txt"));
        assert!(camel_file_canonical_path.ends_with("test.txt"));
    }

    #[test]
    fn test_try_rename_requires_temp_prefix() {
        let result = FileConfig::from_uri("file:///tmp?fileExist=TryRename");
        assert!(result.is_err());
        assert!(
            result
                .unwrap_err()
                .to_string()
                .contains("TryRename requires tempPrefix")
        );
    }

    #[test]
    fn test_try_rename_with_temp_prefix_ok() {
        let result = FileConfig::from_uri("file:///tmp?fileExist=TryRename&tempPrefix=tmp_");
        assert!(result.is_ok());
        assert_eq!(result.unwrap().file_exist, FileExistStrategy::TryRename);
    }

    #[tokio::test]
    async fn test_try_rename_producer_writes_file() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!(
                    "file://{}?fileExist=TryRename&tempPrefix=tmp_",
                    base.display()
                ),
                &ctx,
            )
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("hello"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("output.txt".to_string()),
        );

        producer.oneshot(exchange).await.unwrap();

        let target = base.join("output.txt");
        assert!(target.exists(), "output file should exist");
        let content = std::fs::read_to_string(&target).unwrap();
        assert_eq!(content, "hello");

        let tmp_files: Vec<_> = std::fs::read_dir(base)
            .unwrap()
            .filter_map(|e| e.ok())
            .filter(|e| e.file_name().to_string_lossy().starts_with("tmp_"))
            .collect();
        assert!(tmp_files.is_empty(), "no temp files should remain");
    }

    // -----------------------------------------------------------------------
    // Integration tests: scan_candidates + apply_sort_and_limit pipeline
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_pipeline_sort_then_limit() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("c.txt"), b"ccc").await.unwrap();
        fs::write(base.join("a.txt"), b"a").await.unwrap();
        fs::write(base.join("b.txt"), b"bb").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?sortBy=file:length&maxMessagesPerPoll=2&eagerMaxMessagesPerPoll=false",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        apply_sort_and_limit(&mut candidates, &config);
        assert_eq!(candidates.len(), 2);
        assert_eq!(
            candidates[0].path.file_name().unwrap().to_str().unwrap(),
            "a.txt"
        );
        assert_eq!(
            candidates[1].path.file_name().unwrap().to_str().unwrap(),
            "b.txt"
        );
    }

    #[tokio::test]
    async fn test_sort_reverse_ignore_case() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("Alpha.txt"), b"a").await.unwrap();
        fs::write(base.join("beta.txt"), b"b").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?sortBy=reverse:ignoreCase:file:name",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let mut candidates = scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        apply_sort_and_limit(&mut candidates, &config);
        assert_eq!(
            candidates[0].path.file_name().unwrap().to_str().unwrap(),
            "beta.txt"
        );
    }

    #[tokio::test]
    async fn test_done_file_noop_no_deletion() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("data.txt"), b"d").await.unwrap();
        fs::write(base.join("done"), b"").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?doneFileName=done&noop=true",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let candidates = scan_candidates(&config, &filters, base, &mut seen)
            .await
            .unwrap()
            .candidates;
        assert_eq!(candidates.len(), 1);
        assert!(base.join("done").exists());
    }

    #[tokio::test]
    async fn test_static_done_file_deleted_after_all_processed() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("data.txt"), b"d").await.unwrap();
        fs::write(base.join("ready"), b"").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?doneFileName=ready&delete=true",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));
        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();

        assert!(rx.try_recv().is_ok());
        assert!(!base.join("ready").exists());
    }

    #[tokio::test]
    async fn test_static_done_file_not_deleted_when_limited() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("a.txt"), b"a").await.unwrap();
        fs::write(base.join("b.txt"), b"b").await.unwrap();
        fs::write(base.join("ready"), b"").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?doneFileName=ready&delete=true&maxMessagesPerPoll=1&eagerMaxMessagesPerPoll=true",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));
        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();

        let _ = rx.try_recv();
        assert!(base.join("ready").exists());
    }

    #[tokio::test]
    async fn test_dynamic_done_file_deleted_per_file() {
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        fs::write(base.join("data.txt"), b"d").await.unwrap();
        fs::write(base.join("data.txt.done"), b"").await.unwrap();

        let config = FileConfig::from_uri(&format!(
            "file://{}?doneFileName=${{file:name}}.done&delete=true",
            base.display()
        ))
        .unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));
        let (tx, mut rx) = tokio::sync::mpsc::channel(16);
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        poll_directory(
            &config,
            &ctx,
            &rt(),
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await
        .unwrap();

        assert!(rx.try_recv().is_ok());
        assert!(!base.join("data.txt.done").exists());
    }

    // -----------------------------------------------------------------------
    // Security: adversarial path tests (audit 2026-08-31, findings F4-1/F4-2)
    // -----------------------------------------------------------------------

    /// F4-1: an absolute CamelFileName header must NOT let the done file escape
    /// the endpoint directory (Path::join would otherwise discard the base).
    #[tokio::test]
    async fn test_done_file_rejects_absolute_file_name_header() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let outside = dir.path().parent().unwrap().join("pwn.done");

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?doneFileName=${{file:name}}.done"),
                &ctx,
            )
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("data"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("/tmp/pwn".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "absolute CamelFileName must be rejected");
        assert!(
            !outside.exists() && !std::path::Path::new("/tmp/pwn.done").exists(),
            "no done file may be created outside the base directory"
        );
    }

    /// F4-1: traversal in CamelFileName must not let the done file escape.
    #[tokio::test]
    async fn test_done_file_rejects_traversal_in_file_name_header() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("file:{dir_path}?doneFileName=${{file:name}}.done"),
                &ctx,
            )
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("data"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("../escape".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(
            result.is_err(),
            "traversal in CamelFileName must be rejected"
        );
        assert!(
            !dir.path().parent().unwrap().join("escape.done").exists(),
            "no done file may be created outside the base directory"
        );
    }

    /// F4-2: fileExist=Append must refuse to follow a symlink leaf, even when
    /// the symlink points to a path that does not exist yet (dangling).
    #[cfg(unix)]
    #[tokio::test]
    async fn test_append_refuses_dangling_symlink_leaf() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let outside = dir.path().parent().unwrap().join("escape_target");

        // Plant a dangling symlink inside the base dir pointing outside.
        std::os::unix::fs::symlink(&outside, dir.path().join("link")).unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileExist=Append"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("attacker bytes"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("link".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(
            result.is_err(),
            "Append must refuse to open a symlink leaf (O_NOFOLLOW)"
        );
        assert!(
            !outside.exists(),
            "no file may be created outside the base via dangling symlink"
        );
    }

    /// F4-2: fileExist=Fail must refuse a symlink leaf too (create_new already
    /// fails, but the refusal must remain under O_NOFOLLOW semantics).
    #[cfg(unix)]
    #[tokio::test]
    async fn test_fail_refuses_symlink_leaf() {
        use tower::ServiceExt;

        let dir = tempfile::tempdir().unwrap();
        let dir_path = dir.path().to_str().unwrap();
        let outside = dir.path().parent().unwrap().join("fail_escape_target");
        std::fs::write(&outside, b"precious").unwrap();

        // Symlink inside base -> existing file outside base.
        std::os::unix::fs::symlink(&outside, dir.path().join("link")).unwrap();

        let component = FileComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("file:{dir_path}?fileExist=Fail"), &ctx)
            .unwrap();
        let ctx = test_producer_ctx();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::new("clobber"));
        exchange.input.set_header(
            "CamelFileName",
            serde_json::Value::String("link".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Fail must refuse a symlink leaf");
        assert_eq!(
            std::fs::read(&outside).unwrap(),
            b"precious",
            "outside file must remain untouched"
        );
    }

    /// Unit: the lexical pre-validator rejects absolute paths, traversal and NUL.
    #[test]
    fn test_validate_relative_filename_rejects_evil_values() {
        assert!(validate_relative_filename("/etc/passwd", "fileName").is_err());
        assert!(validate_relative_filename("../x", "fileName").is_err());
        assert!(validate_relative_filename("a/../../x", "fileName").is_err());
        assert!(validate_relative_filename("a\0b", "fileName").is_err());
        assert!(validate_relative_filename("", "fileName").is_err());
        assert!(validate_relative_filename("ok/nested.txt", "fileName").is_ok());
    }

    // -------------------------------------------------------------------------
    // validate_path_is_within_base: symlinked-component confinement
    // (file-ancestor-confinement, Task 1.1)
    // -------------------------------------------------------------------------

    /// A symlinked intermediate component below base must be rejected even
    /// when nothing below it exists yet.
    #[cfg(unix)]
    #[test]
    fn validator_rejects_symlinked_ancestor() {
        let base = tempfile::tempdir().unwrap();
        let outside = tempfile::tempdir().unwrap();
        std::os::unix::fs::symlink(outside.path(), base.path().join("link")).unwrap();

        let target = base.path().join("link").join("new").join("f.txt");
        let err = validate_path_is_within_base(base.path(), &target)
            .unwrap_err()
            .to_string();
        assert!(
            err.contains("symlinked component"),
            "error must name the symlinked component, got: {err}"
        );
        assert!(
            err.contains(&base.path().join("link").display().to_string()),
            "error must name the symlinked component 'link', got: {err}"
        );
    }

    /// An in-base symlink alias (`base/alias -> base/real`) is a component
    /// below the configured base and must be rejected even though it
    /// resolves inside the canonicalized base.
    #[cfg(unix)]
    #[test]
    fn validator_rejects_in_base_alias() {
        let base = tempfile::tempdir().unwrap();
        std::fs::create_dir(base.path().join("real")).unwrap();
        std::os::unix::fs::symlink(base.path().join("real"), base.path().join("alias")).unwrap();

        let target = base.path().join("alias").join("new").join("f.txt");
        let err = validate_path_is_within_base(base.path(), &target)
            .unwrap_err()
            .to_string();
        assert!(
            err.contains("symlinked component"),
            "in-base alias must be rejected, got: {err}"
        );
        assert!(
            err.contains(&base.path().join("alias").display().to_string()),
            "error must name the symlinked component 'alias', got: {err}"
        );
    }

    /// A deep not-yet-existing path with no symlinks stays accepted: the
    /// nearest-existing-ancestor containment degenerates to the base itself.
    #[test]
    fn validator_accepts_missing_deep_path() {
        let base = tempfile::tempdir().unwrap();
        let target = base.path().join("a").join("b").join("c.txt");
        validate_path_is_within_base(base.path(), &target).unwrap();
    }

    /// The base directory itself may be a symlink; only components below
    /// the configured base are subject to symlink rejection.
    #[cfg(unix)]
    #[test]
    fn validator_accepts_symlinked_base() {
        let parent = tempfile::tempdir().unwrap();
        std::fs::create_dir(parent.path().join("real")).unwrap();
        std::os::unix::fs::symlink(parent.path().join("real"), parent.path().join("base")).unwrap();

        let base = parent.path().join("base");
        let target = base.join("x.txt");
        validate_path_is_within_base(&base, &target).unwrap();
    }

    /// Regression guard: an existing target reached through
    /// `base/link -> outside` must be rejected by the symlink-chain scan
    /// (which fires before the ancestor-containment check).
    #[cfg(unix)]
    #[test]
    fn validator_rejects_existing_outside_target() {
        let base = tempfile::tempdir().unwrap();
        let outside = tempfile::tempdir().unwrap();
        std::fs::write(outside.path().join("existing.txt"), b"x").unwrap();
        std::os::unix::fs::symlink(outside.path(), base.path().join("link")).unwrap();

        let target = base.path().join("link").join("existing.txt");
        let err = validate_path_is_within_base(base.path(), &target)
            .unwrap_err()
            .to_string();
        assert!(
            err.contains("symlinked component"),
            "chain scan must fire before containment, got: {err}"
        );
    }

    // -------------------------------------------------------------------------
    // Producer regression tests: symlinked-ancestor confinement end-to-end
    // (file-ancestor-confinement, Task 1.2)
    // -------------------------------------------------------------------------

    /// Producer-level regression tests for symlink confinement. Each test
    /// drives `FileProducer::call` end-to-end through the component harness
    /// and asserts that a symlinked component below the configured base is
    /// rejected before any filesystem artifact is produced outside it, while
    /// legitimate nested creation and a symlinked base itself stay accepted.
    #[cfg(unix)]
    mod producer_symlink_confinement {
        use super::*;
        use tower::ServiceExt;

        /// Shared arrange: `base/` and `outside/` tempdirs on the same
        /// filesystem, with `base/link -> outside` planted (unless
        /// [`SymlinkFixture::new_without_link`]).
        struct SymlinkFixture {
            base: tempfile::TempDir,
            outside: tempfile::TempDir,
        }

        impl SymlinkFixture {
            fn new() -> Self {
                Self::build(true)
            }

            /// Variant without the planted symlink, for the plain
            /// no-symlinks success case.
            fn new_without_link() -> Self {
                Self::build(false)
            }

            fn build(with_link: bool) -> Self {
                let base = tempfile::tempdir().unwrap();
                let outside = tempfile::tempdir().unwrap();
                if with_link {
                    std::os::unix::fs::symlink(outside.path(), base.path().join("link")).unwrap();
                }
                Self { base, outside }
            }

            fn base(&self) -> &std::path::Path {
                self.base.path()
            }

            fn outside(&self) -> &std::path::Path {
                self.outside.path()
            }

            /// Config builder matching the existing producer-test shape:
            /// endpoint on this fixture's base with the given URI query.
            fn producer(&self, query: &str) -> BoxProcessor {
                make_producer(self.base(), query)
            }

            /// `outside/` must contain no artifacts at all.
            fn assert_outside_untouched(&self) {
                let entries: Vec<_> = std::fs::read_dir(self.outside())
                    .unwrap()
                    .collect::<Result<_, _>>()
                    .unwrap();
                assert!(
                    entries.is_empty(),
                    "outside/ must contain no artifacts, got: {:?}",
                    entries.iter().map(|e| e.path()).collect::<Vec<_>>()
                );
            }
        }

        /// Build a producer on `dir_path` the same way the existing producer
        /// tests do: `FileComponent` -> endpoint URI -> `create_producer`.
        fn make_producer(dir_path: &std::path::Path, query: &str) -> BoxProcessor {
            let component = FileComponent::new();
            let ctx = NoOpComponentContext;
            let endpoint = component
                .create_endpoint(&format!("file:{}{query}", dir_path.display()), &ctx)
                .unwrap();
            let ctx = test_producer_ctx();
            endpoint.create_producer(rt(), &ctx).unwrap()
        }

        /// Drive `FileProducer::call` with a text body and a `CamelFileName`
        /// header via `oneshot`.
        async fn call(
            producer: BoxProcessor,
            file_name: &str,
            body: &str,
        ) -> Result<Exchange, CamelError> {
            let mut exchange = Exchange::new(Message::new(body));
            exchange
                .input
                .set_header("CamelFileName", serde_json::Value::String(file_name.into()));
            producer.oneshot(exchange).await
        }

        /// For EVERY fileExist strategy, a fileName whose intermediate
        /// component is a symlink below the base must be rejected with the
        /// confinement violation, and the symlink target must stay empty.
        #[tokio::test]
        async fn producer_rejects_symlinked_ancestor_all_strategies() {
            for strategy in ["Fail", "Append", "Override", "TryRename"] {
                let fixture = SymlinkFixture::new();
                let query = if strategy == "TryRename" {
                    format!("?fileExist={strategy}&tempPrefix=tmp-")
                } else {
                    format!("?fileExist={strategy}")
                };
                let producer = fixture.producer(&query);

                let Err(err) = call(producer, "link/new/file.txt", "payload").await else {
                    panic!("fileExist={strategy}: symlinked ancestor must be rejected");
                };
                let msg = err.to_string();
                assert!(
                    msg.contains("symlinked component"),
                    "fileExist={strategy}: error must mention the confinement violation, got: {msg}"
                );
                assert!(
                    !fixture.outside().join("new").exists(),
                    "fileExist={strategy}: outside/new/ must not exist"
                );
                fixture.assert_outside_untouched();
            }
        }

        /// A safe body fileName plus an independently symlinked doneFileName
        /// ancestor must fail the exchange without creating the done file in
        /// the symlink target.
        #[tokio::test]
        async fn producer_done_file_rejects_symlinked_ancestor() {
            let fixture = SymlinkFixture::new();
            let producer = fixture.producer("?doneFileName=link/done-marker");

            let Err(err) = call(producer, "body.txt", "payload").await else {
                panic!("symlinked doneFileName ancestor must be rejected");
            };
            let msg = err.to_string();
            assert!(
                msg.contains("symlinked component"),
                "error must mention the confinement violation, got: {msg}"
            );
            // The body write precedes done-file validation, so it must have
            // landed before the rejection (pins error provenance to the
            // done-file path, not the write path).
            assert!(
                fixture.base().join("body.txt").exists(),
                "base/body.txt must exist: body write precedes done-file validation"
            );
            assert!(
                !fixture.outside().join("done-marker").exists(),
                "outside/done-marker must not exist"
            );
            fixture.assert_outside_untouched();
        }

        /// fileExist=Ignore must NOT degrade to the early no-op success when
        /// the existing target is reached through a symlinked ancestor; the
        /// probe must be rejected and the target file left unchanged.
        #[tokio::test]
        async fn producer_ignore_probe_rejects_symlinked_ancestor() {
            let fixture = SymlinkFixture::new();
            std::fs::write(fixture.outside().join("existing.txt"), b"original").unwrap();

            let producer = fixture.producer("?fileExist=Ignore");
            let Err(err) = call(producer, "link/existing.txt", "probe").await else {
                panic!("Ignore probe via symlinked ancestor must be rejected");
            };
            let msg = err.to_string();
            assert!(
                msg.contains("symlinked component"),
                "error must mention the confinement violation, got: {msg}"
            );

            let content = std::fs::read(fixture.outside().join("existing.txt")).unwrap();
            assert_eq!(
                content, b"original",
                "outside/existing.txt content must be unchanged"
            );
        }

        /// An in-base symlink alias (`base/alias -> base/real`) is a
        /// symlinked component below the base and must be rejected even
        /// though it resolves inside the base.
        #[tokio::test]
        async fn producer_in_base_alias_rejected() {
            let fixture = SymlinkFixture::new();
            std::fs::create_dir(fixture.base().join("real")).unwrap();
            std::os::unix::fs::symlink(fixture.base().join("real"), fixture.base().join("alias"))
                .unwrap();

            let producer = fixture.producer(""); // default Override
            let Err(err) = call(producer, "alias/f.txt", "payload").await else {
                panic!("in-base alias must be rejected");
            };
            let msg = err.to_string();
            assert!(
                msg.contains("symlinked component") && msg.contains("alias"),
                "error must name the symlinked component 'alias', got: {msg}"
            );
        }

        /// No over-blocking: plain nested directory auto-creation with no
        /// symlinks anywhere must still succeed.
        #[tokio::test]
        async fn producer_nested_new_dirs_still_succeed() {
            let fixture = SymlinkFixture::new_without_link();
            let producer = fixture.producer("?autoCreate=true");

            call(producer, "a/b/c.txt", "nested body")
                .await
                .expect("nested auto-created directories must succeed");

            let content = std::fs::read_to_string(fixture.base().join("a/b/c.txt")).unwrap();
            assert_eq!(content, "nested body");
        }

        /// No over-blocking: the base directory ITSELF may be a symlink
        /// (operator contract); writes through it must be accepted and land
        /// in the real directory.
        #[tokio::test]
        async fn producer_symlinked_base_still_accepted() {
            let parent = tempfile::tempdir().unwrap();
            std::fs::create_dir(parent.path().join("real")).unwrap();
            std::os::unix::fs::symlink(parent.path().join("real"), parent.path().join("base"))
                .unwrap();

            let producer = make_producer(&parent.path().join("base"), "");
            call(producer, "x.txt", "payload")
                .await
                .expect("a symlinked base directory must be accepted");

            let content =
                std::fs::read_to_string(parent.path().join("real").join("x.txt")).unwrap();
            assert_eq!(
                content, "payload",
                "file must be written under the real dir"
            );
        }
    }

    #[test]
    fn uri_options_count_parity() {
        assert_eq!(
            FileConfig::uri_options().len(),
            32,
            "FileUriConfig #[uri_param] count drifted from parser"
        );
    }

    // -------------------------------------------------------------------------
    // Recording metrics collector for testing increment_errors calls
    // (pattern: camel-direct tests::RecordingMetrics)
    // -------------------------------------------------------------------------

    struct RecordingMetrics {
        errors: Arc<std::sync::Mutex<Vec<(String, String)>>>,
    }

    impl camel_api::MetricsCollector for RecordingMetrics {
        fn record_exchange_duration(&self, _: &str, _: Duration) {}
        fn increment_errors(&self, route_id: &str, error_type: &str) {
            self.errors
                .lock()
                .unwrap()
                .push((route_id.to_string(), error_type.to_string()));
        }
        fn increment_exchanges(&self, _: &str) {}
        fn set_queue_depth(&self, _: &str, _: usize) {}
        fn record_circuit_breaker_change(&self, _: &str, _: &str, _: &str) {}
    }

    struct RecordingRuntime {
        metrics_collector: Arc<RecordingMetrics>,
    }

    impl RecordingRuntime {
        fn new(errors: Arc<std::sync::Mutex<Vec<(String, String)>>>) -> Self {
            Self {
                metrics_collector: Arc::new(RecordingMetrics { errors }),
            }
        }
    }

    impl camel_component_api::RuntimeObservability for RecordingRuntime {
        fn metrics(&self) -> Arc<dyn camel_api::MetricsCollector> {
            self.metrics_collector.clone() as Arc<dyn camel_api::MetricsCollector>
        }
        fn health(&self) -> Arc<dyn camel_component_api::HealthCheckRegistry> {
            panic!("RecordingRuntime::health not used in this test")
        }
    }

    #[tokio::test]
    async fn file_poll_send_failure_counts_b_prime() {
        // Positive: a poll whose pipeline send fails (receiver dropped) counts
        // exactly one `b-prime:file:poll-send` emission and propagates
        // ChannelClosed.
        let dir = tempfile::tempdir().unwrap();
        let base = dir.path();
        std::fs::write(base.join("data.txt"), b"payload").unwrap();

        let config = FileConfig::from_uri(&format!("file:{}", base.display())).unwrap();
        let filters = CompiledFilters::compile(&config).unwrap();
        let mut seen = HashSet::new();
        let in_process_locks = std::sync::Arc::new(DashMap::new());
        let idempotent_repo = std::sync::Arc::new(tokio::sync::Mutex::new(HashSet::new()));

        let (tx, rx) = tokio::sync::mpsc::channel(16);
        drop(rx); // pipeline receiver gone → context.send fails
        let token = CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token, "file-test-route".to_string());

        let errors = Arc::new(std::sync::Mutex::new(Vec::new()));
        let runtime: Arc<dyn camel_component_api::RuntimeObservability> =
            Arc::new(RecordingRuntime::new(Arc::clone(&errors)));

        let result = poll_directory(
            &config,
            &ctx,
            &runtime,
            &filters,
            &mut seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await;

        assert!(matches!(result, Err(CamelError::ChannelClosed)));
        let recorded = errors.lock().unwrap().clone();
        assert_eq!(
            recorded,
            vec![(
                "file-test-route".to_string(),
                "b-prime:file:poll-send".to_string()
            )]
        );

        // Negative: a scan failure (directory gone) must NOT emit the
        // poll-send label — the failure is not a dispatch send.
        let gone = tempfile::tempdir().unwrap();
        let gone_path = gone.path().to_path_buf();
        let scan_config = FileConfig::from_uri(&format!("file:{}", gone_path.display())).unwrap();
        let scan_filters = CompiledFilters::compile(&scan_config).unwrap();
        drop(gone); // directory no longer exists → scan_candidates fails

        let mut scan_seen = HashSet::new();
        let scan_errors = Arc::new(std::sync::Mutex::new(Vec::new()));
        let scan_runtime: Arc<dyn camel_component_api::RuntimeObservability> =
            Arc::new(RecordingRuntime::new(Arc::clone(&scan_errors)));
        let (scan_tx, mut scan_rx) = tokio::sync::mpsc::channel(16);
        let scan_token = CancellationToken::new();
        let scan_ctx = ConsumerContext::new(scan_tx, scan_token, "file-test-route".to_string());

        let scan_result = poll_directory(
            &scan_config,
            &scan_ctx,
            &scan_runtime,
            &scan_filters,
            &mut scan_seen,
            &in_process_locks,
            &idempotent_repo,
        )
        .await;

        assert!(scan_result.is_err());
        assert!(
            scan_errors.lock().unwrap().is_empty(),
            "scan failure must not emit b-prime:file:poll-send"
        );
        assert!(scan_rx.try_recv().is_err());
    }
}