camel_component_http/

lib.rs

pub mod bundle;
pub(crate) mod client_cache;
pub mod config;
mod header_policy;
pub mod health;
pub mod registry;
pub(crate) mod rest_match;
pub(crate) mod ssrf;
pub mod static_config;
pub mod static_dispatch;
pub mod static_endpoint;
#[cfg(test)]
mod tls_harness;
pub(crate) mod tls_reload;
use crate::config::parse_ok_status_code_range;
pub use bundle::HttpBundle;
pub use bundle::HttpStaticBundle;
pub(crate) use client_cache::{
    HttpComponentKind, PINNED_CLIENT_MAX_ENTRIES, PINNED_CLIENT_TTL, PinnedClientCache,
};
pub use config::HttpConfig;
pub use health::HttpHealthCheck;
pub use registry::HttpRouteRegistry;
pub use static_config::HttpStaticConfig;
pub use static_endpoint::{HttpStaticComponent, HttpStaticConsumer, HttpStaticEndpoint};

use std::collections::HashMap;
use std::future::Future;
use std::pin::Pin;

use std::sync::{Arc, Mutex, OnceLock};
use std::task::{Context, Poll};
use std::time::Duration;

use tokio::sync::OnceCell;
use tower::Layer;
use tower::Service;
use tracing::debug;

use axum::body::BodyDataStream;
use camel_api::component_metadata::ComponentMetadata;
use camel_auth::bearer_token_layer::BearerTokenLayer;
use camel_auth::oauth2::TokenProvider;
use camel_component_api::tls_source::ServerTlsSource;
use camel_component_api::{Body, BoxProcessor, CamelError, Exchange, StreamBody, StreamMetadata};
use camel_component_api::{Component, Consumer, Endpoint, ProducerContext, RuntimeObservability};
use camel_component_api::{UriComponents, UriConfig, parse_uri, raw_query_pairs};
use futures::StreamExt;
use futures::TryStreamExt;
use futures::stream::BoxStream;

// ---------------------------------------------------------------------------
// HttpEndpointConfig
// ---------------------------------------------------------------------------

/// Configuration for an HTTP client (producer) endpoint.
///
/// # Memory Limits
///
/// HTTP operations enforce conservative memory limits to prevent denial-of-service
/// attacks from untrusted network sources. These limits are significantly lower than
/// file component limits (100MB) because HTTP typically handles API responses rather
/// than large file transfers, and clients may be untrusted.
///
/// ## Default Limits
///
/// - **HTTP client body**: 10MB (typical API responses)
/// - **HTTP server request**: 2MB (untrusted network input - see `HttpServerConfig`)
/// - **HTTP server response**: 10MB (same as client - see `HttpServerConfig`)
///
/// ## Rationale
///
/// The 10MB limit for HTTP client responses is appropriate for most API interactions
/// while providing protection against:
/// - Malicious servers sending oversized responses
/// - Runaway processes generating unexpectedly large payloads
/// - Memory exhaustion attacks
///
/// The 2MB server request limit is even more conservative because it handles input
/// from potentially untrusted clients on the public internet.
///
/// ## Overriding Limits
///
/// Override the default client body limit using the `maxBodySize` URI parameter:
///
/// ```text
/// http://api.example.com/large-data?maxBodySize=52428800
/// ```
///
/// For server endpoints, use `maxRequestBody` and `maxResponseBody` parameters:
///
/// ```text
/// http://0.0.0.0:8080/upload?maxRequestBody=52428800
/// ```
///
/// ## Behavior When Exceeded
///
/// When a body exceeds the configured limit:
/// - An error is returned immediately
/// - No memory is exhausted - the limit is checked before allocation
/// - The HTTP connection is terminated cleanly
///
/// ## Security Considerations
///
/// HTTP endpoints should be treated with more caution than file endpoints because:
/// - Clients may be unknown and untrusted
/// - Network traffic can be spoofed or malicious
/// - DoS attacks often exploit unbounded resource consumption
///
/// Only increase limits when you control both ends of the connection or when
/// business requirements demand larger payloads.
#[derive(Clone)]
pub struct HttpEndpointConfig {
    pub base_url: String,
    pub http_method: Option<String>,
    pub throw_exception_on_failure: bool,
    pub ok_status_code_range: (u16, u16),
    pub response_timeout: Option<Duration>,
    /// Programmatic query parameters, serialized in declaration order with
    /// minimal RFC-3986 encoding (`%20`, never `+`). Never populated from
    /// the endpoint URI — set by callers via config construction.
    pub query_params: Vec<(String, String)>,
    /// Authored query bytes from the endpoint URI, verbatim (no decode, no
    /// re-encode, no `RAW(...)` unwrapping). `Some("")` preserves a bare
    /// `?` marker. Sole carrier of URI-authored pairs; consumed option
    /// keys are filtered out at serialization time.
    pub raw_query: Option<String>,
    pub allow_internal: bool,
    /// Public-cleartext transport consent (ADR-0081): when `false` (the
    /// default), cleartext `http://` requests to PUBLIC targets are
    /// rejected. Independent of `allow_internal` — internal-network
    /// consent and cleartext-transport consent are separate decisions, and
    /// there is deliberately no global cleartext lever.
    pub allow_cleartext: bool,
    pub blocked_hosts: Vec<String>,
    pub max_body_size: usize,
    pub read_timeout_ms: u64,
    pub max_response_bytes: usize,
    pub auth: HttpAuth,
    pub token_provider: Option<Arc<dyn TokenProvider>>,
    pub user_agent: Option<String>,
    pub bridge_endpoint: bool,
    pub connection_close: bool,
    pub skip_request_headers: Vec<String>,
    pub skip_response_headers: Vec<String>,
    pub follow_redirects: bool,
    pub max_redirects: usize,
    /// CamelHttpUri host fence (`allowedUriHosts`): `None` when the option
    /// is absent (override behavior unchanged); `Some` arms the fail-closed
    /// fence. Parsed entries only — never re-serialized into the outbound
    /// query.
    pub allowed_uri_hosts: Option<Vec<AllowedUriHost>>,
}

/// ADR-0051 redact-by-construction, ADR-0076 strictest-wins: query bytes
/// (authored `raw_query` and programmatic `query_params`) may carry
/// credentials. The display-surface Debug renders the raw view
/// blanket-masked (mirroring `redact_url_for_diagnostics`) and programmatic
/// values masked, mirroring `UriComponents`' sensitive-value masking.
/// `base_url` routes through the canonical
/// [`camel_api::redact::redact_url`] (string surgery, no `url::Url`
/// roundtrip, so authored bytes are never WHATWG-normalized): userinfo is
/// masked in every authority window, query and fragment bytes are dropped
/// behind their sentinels, and the result is capped at 256 bytes (rc-yvjp3
/// converged the former byte-preserving local variant). Wire fidelity is
/// unaffected.
impl std::fmt::Debug for HttpEndpointConfig {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("HttpEndpointConfig")
            .field("base_url", &camel_api::redact::redact_url(&self.base_url))
            .field("http_method", &self.http_method)
            .field(
                "throw_exception_on_failure",
                &self.throw_exception_on_failure,
            )
            .field("ok_status_code_range", &self.ok_status_code_range)
            .field("response_timeout", &self.response_timeout)
            .field(
                "query_params",
                &self
                    .query_params
                    .iter()
                    .map(|(key, _)| (key, "***"))
                    .collect::<Vec<_>>(),
            )
            .field("raw_query", &self.raw_query.as_ref().map(|_| "?[redacted]"))
            .field("allow_internal", &self.allow_internal)
            .field("allow_cleartext", &self.allow_cleartext)
            .field("blocked_hosts", &self.blocked_hosts)
            .field("max_body_size", &self.max_body_size)
            .field("read_timeout_ms", &self.read_timeout_ms)
            .field("max_response_bytes", &self.max_response_bytes)
            .field("auth", &self.auth)
            .field("token_provider", &self.token_provider)
            .field("user_agent", &self.user_agent)
            .field("bridge_endpoint", &self.bridge_endpoint)
            .field("connection_close", &self.connection_close)
            .field("skip_request_headers", &self.skip_request_headers)
            .field("skip_response_headers", &self.skip_response_headers)
            .field("follow_redirects", &self.follow_redirects)
            .field("max_redirects", &self.max_redirects)
            .field("allowed_uri_hosts", &self.allowed_uri_hosts)
            .finish()
    }
}

#[derive(Clone, PartialEq)]
pub enum HttpAuth {
    None,
    Basic { username: String, password: String },
    Bearer { token: String },
}

impl std::fmt::Debug for HttpAuth {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            HttpAuth::None => f.write_str("None"),
            HttpAuth::Basic { username, .. } => f
                .debug_struct("Basic")
                .field("username", username)
                .field("password", &"***")
                .finish(),
            HttpAuth::Bearer { .. } => f.debug_struct("Bearer").field("token", &"***").finish(),
        }
    }
}

/// Whether `key` names a camel-http endpoint option consumed at parse time.
///
/// Single metadata-driven owner of OUTBOUND option filtering (ADR-0041):
/// derived from the `#[uri_param]` metadata behind
/// [`HttpEndpointConfig::uri_options`], so the raw query filter consumes
/// exactly the keys the component documents — no duplicated handwritten
/// key lists. `from_components`'s manual typed parsing stays direct and
/// unchanged; this predicate never re-wires it.
fn is_consumed_option(key: &str) -> bool {
    HttpEndpointConfig::uri_options()
        .iter()
        .any(|option| option.name == key || option.aliases.iter().any(|alias| alias == key))
}

impl UriConfig for HttpEndpointConfig {
    /// Returns "http" as the primary scheme (also accepts "https")
    fn scheme() -> &'static str {
        "http"
    }

    fn from_uri(uri: &str) -> Result<Self, CamelError> {
        let parts = parse_uri(uri)?;
        Self::from_components(parts)
    }

    fn from_components(parts: UriComponents) -> Result<Self, CamelError> {
        // Validate scheme - accept both http and https
        if parts.scheme != "http" && parts.scheme != "https" {
            return Err(CamelError::InvalidUri(format!(
                "expected scheme 'http' or 'https', got '{}'",
                parts.scheme
            )));
        }

        // Construct base_url from scheme + path
        // e.g., "http://localhost:8080/api" from scheme "http" and path "//localhost:8080/api"
        let base_url = format!("{}:{}", parts.scheme, parts.path);

        let http_method = parts.params.get("httpMethod").cloned();

        let throw_exception_on_failure = match parts.params.get("throwExceptionOnFailure") {
            Some(v) => parse_bool_param_http(v).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for throwExceptionOnFailure: {e}"))
            })?,
            None => true,
        };

        // Parse status code range from "start-end" format (e.g., "200-299")
        let ok_status_code_range = match parts.params.get("okStatusCodeRange") {
            Some(v) => parse_ok_status_code_range(v)?,
            None => (200, 299),
        };

        let response_timeout = match parts.params.get("responseTimeout") {
            Some(v) => Some(v.parse::<u64>().map(Duration::from_millis).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for responseTimeout: {e}"))
            })?),
            None => None,
        };

        // SSRF protection settings
        let allow_internal = match parts.params.get("allowInternal") {
            Some(v) => parse_bool_param_http(v).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for allowInternal: {e}"))
            })?,
            None => false, // Default: block private IPs
        };

        // Public-cleartext transport consent (ADR-0081) — per-endpoint
        // only, deliberately never inherited from the global HttpConfig.
        let allow_cleartext = match parts.params.get("allowCleartext") {
            Some(v) => parse_bool_param_http(v).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for allowCleartext: {e}"))
            })?,
            None => false, // Default: reject cleartext http:// to public targets
        };

        // Parse comma-separated blocked hosts
        let blocked_hosts = parts
            .params
            .get("blockedHosts")
            .map(|v| v.split(',').map(|s| s.trim().to_string()).collect())
            .unwrap_or_default();

        let max_body_size = match parts.params.get("maxBodySize") {
            Some(v) => v.parse::<usize>().map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for maxBodySize: {e}"))
            })?,
            None => 10 * 1024 * 1024, // Default: 10MB
        };

        let read_timeout_ms = match parts.params.get("readTimeout") {
            Some(v) => v.parse::<u64>().map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for readTimeout: {e}"))
            })?,
            None => 30_000, // Default: 30s
        };

        let max_response_bytes = match parts.params.get("maxResponseBytes") {
            Some(v) => v.parse::<usize>().map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for maxResponseBytes: {e}"))
            })?,
            None => 10 * 1024 * 1024, // Default: 10MB
        };

        let auth = parse_auth_from_params(&parts.params)?;

        let user_agent = parts.params.get("userAgent").cloned();

        if parts.params.contains_key("cookieHandling") {
            return Err(CamelError::InvalidUri(
                "cookieHandling is not supported".into(),
            ));
        }

        let bridge_endpoint = match parts.params.get("bridgeEndpoint") {
            Some(v) => parse_bool_param_http(v).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for bridgeEndpoint: {e}"))
            })?,
            None => false,
        };

        let connection_close = match parts.params.get("connectionClose") {
            Some(v) => parse_bool_param_http(v).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for connectionClose: {e}"))
            })?,
            None => false,
        };

        let skip_request_headers = parts
            .params
            .get("skipRequestHeaders")
            .map(|v| {
                v.split(',')
                    .map(str::trim)
                    .filter(|s| !s.is_empty())
                    .map(|s| s.to_ascii_lowercase())
                    .collect::<Vec<_>>()
            })
            .unwrap_or_default();

        let skip_response_headers = parts
            .params
            .get("skipResponseHeaders")
            .map(|v| {
                v.split(',')
                    .map(str::trim)
                    .filter(|s| !s.is_empty())
                    .map(|s| s.to_ascii_lowercase())
                    .collect::<Vec<_>>()
            })
            .unwrap_or_default();

        let follow_redirects = match parts.params.get("followRedirects") {
            Some(v) => parse_bool_param_http(v).map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for followRedirects: {e}"))
            })?,
            None => false,
        };

        let max_redirects = match parts.params.get("maxRedirects") {
            Some(v) => v.parse::<usize>().map_err(|e| {
                CamelError::InvalidUri(format!("invalid value for maxRedirects: {e}"))
            })?,
            None => 10,
        };

        // CamelHttpUri host fence: parsed eagerly so a malformed or empty
        // allowlist fails endpoint creation (fail-closed), not resolution.
        let allowed_uri_hosts = match parts.params.get("allowedUriHosts") {
            Some(v) => Some(parse_allowed_uri_hosts(v)?),
            None => None,
        };

        // Authored pairs ride raw_query verbatim (the sole carrier);
        // query_params is programmatic-only — never auto-populated from
        // URI leftovers. Consumed option keys are filtered at
        // serialization time by `is_consumed_option`.
        let raw_query = parts.raw_query.clone();

        Ok(Self {
            base_url,
            http_method,
            throw_exception_on_failure,
            ok_status_code_range,
            response_timeout,
            query_params: Vec::new(),
            raw_query,
            allow_internal,
            allow_cleartext,
            blocked_hosts,
            max_body_size,
            read_timeout_ms,
            max_response_bytes,
            auth,
            token_provider: None,
            user_agent,
            bridge_endpoint,
            connection_close,
            skip_request_headers,
            skip_response_headers,
            follow_redirects,
            max_redirects,
            allowed_uri_hosts,
        })
    }
}

/// Private container for macro-derived `uri_options()` and `metadata()`.
///
/// Mirrors the URI query parameters parsed by `HttpEndpointConfig::from_components`.
/// `HttpEndpointConfig` holds typed fields (tuples, `Duration`, `HttpAuth`,
/// `Arc<dyn TokenProvider>`) that the derive cannot represent, so metadata
/// derivation targets this inner type whose fields are all URI-param-compatible.
#[derive(Debug, Clone, UriConfig)]
#[allow(dead_code)]
#[uri_scheme = "http"]
#[uri_config(
    skip_impl,
    metadata(
        scheme = "http",
        description = "HTTP client and server component",
        producer,
        consumer,
        streaming
    ),
    crate = "camel_component_api"
)]
struct HttpEndpointUriConfig {
    #[allow(dead_code)]
    _base_url: String,

    #[uri_param(
        name = "httpMethod",
        desc = "HTTP method. Defaults to CamelHttpMethod header or POST/GET"
    )]
    http_method: Option<String>,

    #[uri_param(
        name = "throwExceptionOnFailure",
        default = "true",
        desc = "Throw on non-2xx status"
    )]
    throw_exception_on_failure: bool,

    #[uri_param(
        name = "okStatusCodeRange",
        default = "200-299",
        desc = "Success status code range"
    )]
    ok_status_code_range: String,

    #[uri_param(name = "responseTimeout", desc = "Response timeout in milliseconds")]
    response_timeout: Option<u64>,

    #[uri_param(
        name = "connectTimeout",
        desc = "Connection timeout in milliseconds (consumed option; effective timeout comes from the global http config)"
    )]
    connect_timeout: Option<u64>,

    #[uri_param(
        name = "allowInternal",
        default = "false",
        desc = "Allow private/internal network destinations (SSRF)"
    )]
    allow_internal: bool,

    #[uri_param(
        name = "allowCleartext",
        default = "false",
        desc = "Allow cleartext http:// to public targets (transport consent; ADR-0081)"
    )]
    allow_cleartext: bool,

    #[uri_param(name = "blockedHosts", desc = "Comma-separated blocked host list")]
    blocked_hosts: Option<String>,

    #[uri_param(
        name = "maxBodySize",
        default = "10485760",
        desc = "Max request/response body bytes"
    )]
    max_body_size: u64,

    #[uri_param(name = "readTimeout", desc = "Socket read timeout in milliseconds")]
    read_timeout: Option<u64>,

    #[uri_param(name = "maxResponseBytes", desc = "Max response body bytes")]
    max_response_bytes: Option<u64>,

    #[uri_param(
        name = "authMethod",
        kind = "enum:None,Basic,Bearer",
        desc = "Authentication method"
    )]
    auth_method: Option<String>,

    #[uri_param(name = "authUsername", secret, desc = "Basic auth username")]
    auth_username: Option<String>,

    #[uri_param(name = "authPassword", secret, desc = "Basic auth password")]
    auth_password: Option<String>,

    #[uri_param(name = "authBearerToken", secret, desc = "Bearer auth token")]
    auth_bearer_token: Option<String>,

    #[uri_param(name = "userAgent", desc = "User-Agent header")]
    user_agent: Option<String>,

    #[uri_param(
        name = "bridgeEndpoint",
        default = "false",
        desc = "Bridge endpoint mode"
    )]
    bridge_endpoint: bool,

    #[uri_param(
        name = "connectionClose",
        default = "false",
        desc = "Send Connection: close"
    )]
    connection_close: bool,

    #[uri_param(
        name = "skipRequestHeaders",
        desc = "Comma-separated request headers to skip"
    )]
    skip_request_headers: Option<String>,

    #[uri_param(
        name = "skipResponseHeaders",
        desc = "Comma-separated response headers to skip"
    )]
    skip_response_headers: Option<String>,

    #[uri_param(
        name = "followRedirects",
        default = "false",
        desc = "Follow HTTP redirects"
    )]
    follow_redirects: bool,

    #[uri_param(name = "maxRedirects", default = "10", desc = "Max redirect hops")]
    max_redirects: u64,

    #[uri_param(
        name = "allowedUriHosts",
        desc = "Comma-separated allowlist of CamelHttpUri override hosts (host or host:port)"
    )]
    allowed_uri_hosts: Option<String>,
}

impl HttpEndpointConfig {
    /// Component metadata for the http/https scheme, derived from the
    /// `#[uri_param]` fields on `HttpEndpointUriConfig`.
    pub fn metadata() -> ComponentMetadata {
        HttpEndpointUriConfig::metadata()
    }

    /// URI option definitions, derived from `#[uri_param]` fields.
    pub fn uri_options() -> Vec<camel_api::component_metadata::UriOption> {
        HttpEndpointUriConfig::uri_options()
    }
}

fn parse_auth_from_params(params: &HashMap<String, String>) -> Result<HttpAuth, CamelError> {
    let Some(method) = params.get("authMethod") else {
        return Ok(HttpAuth::None);
    };

    if method.eq_ignore_ascii_case("none") {
        return Ok(HttpAuth::None);
    }

    if method.eq_ignore_ascii_case("basic") {
        let username = params.get("authUsername").cloned().ok_or_else(|| {
            CamelError::InvalidUri("authUsername is required for authMethod=Basic".to_string())
        })?;
        let password = params.get("authPassword").cloned().ok_or_else(|| {
            CamelError::InvalidUri("authPassword is required for authMethod=Basic".to_string())
        })?;
        return Ok(HttpAuth::Basic { username, password });
    }

    if method.eq_ignore_ascii_case("bearer") {
        let token = params.get("authBearerToken").cloned().ok_or_else(|| {
            CamelError::InvalidUri("authBearerToken is required for authMethod=Bearer".to_string())
        })?;
        return Ok(HttpAuth::Bearer { token });
    }

    Err(CamelError::InvalidUri(format!(
        "invalid value for authMethod: {method} (expected None, Basic, or Bearer)"
    )))
}

fn parse_bool_param_http(value: &str) -> Result<bool, CamelError> {
    match value.to_ascii_lowercase().as_str() {
        "true" | "1" | "yes" => Ok(true),
        "false" | "0" | "no" => Ok(false),
        _ => Err(CamelError::InvalidUri(format!(
            "invalid boolean value: '{value}'"
        ))),
    }
}

impl HttpEndpointConfig {
    pub fn from_uri_with_defaults(uri: &str, config: &HttpConfig) -> Result<Self, CamelError> {
        let parts = parse_uri(uri)?;
        let mut endpoint = Self::from_components(parts.clone())?;
        if endpoint.response_timeout.is_none() {
            endpoint.response_timeout = Some(Duration::from_millis(config.response_timeout_ms));
        }
        if !parts.params.contains_key("allowInternal") {
            endpoint.allow_internal = config.allow_internal;
        }
        if !parts.params.contains_key("blockedHosts") {
            endpoint.blocked_hosts = config.blocked_hosts.clone();
        }
        if !parts.params.contains_key("maxBodySize") {
            endpoint.max_body_size = config.max_body_size;
        }
        if !parts.params.contains_key("readTimeout") {
            endpoint.read_timeout_ms = config.read_timeout_ms;
        }
        if !parts.params.contains_key("maxResponseBytes") {
            endpoint.max_response_bytes = config.max_response_bytes;
        }
        if !parts.params.contains_key("okStatusCodeRange")
            && let Some(range) = &config.ok_status_code_range
        {
            endpoint.ok_status_code_range = parse_ok_status_code_range(range)?;
        }
        if !parts.params.contains_key("followRedirects") {
            endpoint.follow_redirects = config.follow_redirects;
        }
        if !parts.params.contains_key("maxRedirects") {
            endpoint.max_redirects = config.max_redirects.unwrap_or(10);
        }

        Ok(endpoint)
    }
}

// ---------------------------------------------------------------------------
// HttpServerConfig
// ---------------------------------------------------------------------------

/// Configuration for an HTTP server (consumer) endpoint.
#[derive(Debug, Clone)]
pub struct HttpServerConfig {
    /// URI scheme ("http" or "https") parsed from the endpoint URI.
    pub scheme: String,
    /// Bind address, e.g. "0.0.0.0" or "127.0.0.1".
    pub host: String,
    /// TCP port to listen on.
    pub port: u16,
    /// URL path this consumer handles, e.g. "/orders".
    pub path: String,
    /// Maximum request body size in bytes.
    pub max_request_body: usize,
    /// Maximum response body size for materializing streams in bytes.
    pub max_response_body: usize,
    /// Maximum number of in-flight requests handled concurrently by this server.
    /// bd rc-ns3yc: values above `tokio::sync::Semaphore::MAX_PERMITS` are
    /// rejected at parse, `create_consumer`, start, and `spawn_entry` (the
    /// inflight semaphore panics above that bound); `0` remains a
    /// representable reject-everything value.
    pub max_inflight_requests: usize,
    /// HTTP method this consumer handles (e.g. `"GET"`). When `Some`,
    /// the consumer registers as a method-aware REST endpoint and the
    /// path is treated as a template (e.g. `/users/{id}` is matched
    /// against any `/users/<value>`). When `None`, the consumer
    /// registers in the legacy path-only `api_routes` registry.
    /// Extracted from the `httpMethod=` URI param at config build time.
    pub method: Option<String>,
    /// Server-side TLS config. Populated from `tlsCert`/`tlsKey` URI params.
    /// `None` for plain HTTP servers.
    pub tls_config: Option<crate::config::ServerTlsConfig>,
}

impl UriConfig for HttpServerConfig {
    /// Returns "http" as the primary scheme (also accepts "https")
    fn scheme() -> &'static str {
        "http"
    }

    fn from_uri(uri: &str) -> Result<Self, CamelError> {
        let parts = parse_uri(uri)?;
        Self::from_components(parts)
    }

    fn from_components(parts: UriComponents) -> Result<Self, CamelError> {
        // Validate scheme - accept both http and https
        if parts.scheme != "http" && parts.scheme != "https" {
            return Err(CamelError::InvalidUri(format!(
                "expected scheme 'http' or 'https', got '{}'",
                parts.scheme
            )));
        }

        // parts.path is everything after the scheme colon, e.g. "//0.0.0.0:8080/orders"
        // Strip leading "//"
        let authority_and_path = parts.path.trim_start_matches('/');

        // Split on the first "/" to separate "host:port" from "/path"
        let (authority, path_suffix) = if let Some(idx) = authority_and_path.find('/') {
            (&authority_and_path[..idx], &authority_and_path[idx..])
        } else {
            (authority_and_path, "/")
        };

        let path = if path_suffix.is_empty() {
            "/"
        } else {
            path_suffix
        }
        .to_string();

        // Parse host:port from authority
        let (host, port) = if let Some(colon) = authority.rfind(':') {
            let port_str = &authority[colon + 1..];
            match port_str.parse::<u16>() {
                Ok(p) => (authority[..colon].to_string(), p),
                Err(_) => {
                    return Err(CamelError::InvalidUri(format!(
                        "invalid port '{}' in authority",
                        port_str
                    )));
                }
            }
        } else {
            // Default port based on scheme: 443 for https, 80 for http
            let default_port = if parts.scheme == "https" { 443 } else { 80 };
            (authority.to_string(), default_port)
        };

        let max_request_body = parts
            .params
            .get("maxRequestBody")
            .and_then(|v| v.parse::<usize>().ok())
            .unwrap_or(2 * 1024 * 1024); // Default: 2MB

        let max_response_body = parts
            .params
            .get("maxResponseBody")
            .and_then(|v| v.parse::<usize>().ok())
            .unwrap_or(10 * 1024 * 1024); // Default: 10MB

        let max_inflight_requests = parts
            .params
            .get("maxInflightRequests")
            .and_then(|v| v.parse::<usize>().ok())
            .unwrap_or(1024);
        // bd rc-ns3yc: reject values above the semaphore primitive's bound
        // at parse time — `Semaphore::new` panics above MAX_PERMITS
        // (mirror of grpc consumer_concurrency_limit, commit 101327e5).
        let max_inflight_requests = max_inflight_requests_limit(max_inflight_requests)?;

        // Uppercase-normalize so a hand-written `httpMethod=get` matches the
        // uppercase method the dispatcher compares against (axum's
        // `req.method().to_string()` yields "GET"). Without this, a
        // lower-case `httpMethod` would never match and silently 404.
        // Review I5.
        let method = parts.params.get("httpMethod").map(|m| m.to_uppercase());

        Ok(Self {
            scheme: parts.scheme,
            host,
            port,
            path,
            max_request_body,
            max_response_body,
            max_inflight_requests,
            method,
            tls_config: {
                let cert = parts.params.get("tlsCert").cloned();
                let key = parts.params.get("tlsKey").cloned();
                match (cert, key) {
                    (Some(c), Some(k)) => Some(crate::config::ServerTlsConfig {
                        cert_path: c,
                        key_path: k,
                    }),
                    (None, None) => None,
                    _ => None, // partial — enforced in create_consumer, not here
                }
            },
        })
    }
}

impl HttpServerConfig {
    pub fn from_uri_with_defaults(uri: &str, config: &HttpConfig) -> Result<Self, CamelError> {
        let parts = parse_uri(uri)?;
        let mut server = Self::from_components(parts.clone())?;
        if !parts.params.contains_key("maxRequestBody") {
            server.max_request_body = config.max_request_body;
        }
        if !parts.params.contains_key("maxResponseBody") {
            // Default max_response_body is 10MB via HttpConfig::default().max_body_size.
            server.max_response_body = config.max_body_size;
        }
        Ok(server)
    }
}

// ---------------------------------------------------------------------------
// RequestEnvelope / HttpReply
// ---------------------------------------------------------------------------

/// Body of the HTTP response: already-materialized bytes or a lazy stream.
///
/// **Internal plumbing** — subject to change without notice.
pub enum HttpReplyBody {
    Bytes(bytes::Bytes),
    Stream(BoxStream<'static, Result<bytes::Bytes, CamelError>>),
}

/// An inbound HTTP request sent from the Axum dispatch handler to an
/// `HttpConsumer` receive loop.
///
/// **Internal plumbing** — subject to change without notice.
pub struct RequestEnvelope {
    pub method: String,
    pub path: String,
    pub query: String,
    pub headers: http::HeaderMap,
    pub body: StreamBody,
    /// Path parameters extracted from a REST template match, e.g.
    /// `id=42` for a request to `/users/42` matched against
    /// `/users/{id}`. Empty for non-REST requests or for literal
    /// template matches. The consumer turns these into
    /// `CamelHttpPath_<param>` headers on the Exchange (expert guidance E2).
    pub path_params: std::collections::HashMap<String, String>,
    pub reply_tx: tokio::sync::oneshot::Sender<HttpReply>,
}

/// The HTTP response that `HttpConsumer` sends back to the Axum handler.
///
/// **Internal plumbing** — subject to change without notice.
pub struct HttpReply {
    pub status: u16,
    pub headers: Vec<(String, String)>,
    pub body: HttpReplyBody,
}

// ---------------------------------------------------------------------------
// HttpRouteRegistry / ServerRegistry
// ---------------------------------------------------------------------------

type ServerKey = (String, u16);

/// Handle to a running Axum server on one interface/port.
struct ServerHandle {
    registry: HttpRouteRegistry,
    /// Actual local address of the served listening socket (differs from the
    /// configured `host:port` when spawning from a staged/pre-bound listener).
    bound_addr: std::net::SocketAddr,
    max_request_body: usize,
    max_response_body: usize,
    max_inflight_requests: usize,
    is_tls: bool,
    tls_cert_path: Option<String>,
    tls_key_path: Option<String>,
    /// JoinHandle for the monitor_axum_task wrapper. `is_finished()` is the
    /// dead-server eviction signal in `get_or_spawn`.
    monitor_task: tokio::task::JoinHandle<()>,
    /// Abort handle for the Axum server task itself. The JoinHandle is
    /// consumed by `monitor_axum_task`; this survives on the handle so
    /// crashed-server tests (and future ops tooling) can deterministically
    /// kill the shared transport to exercise the death path.
    /// Test-only today — no production reader yet (rc-szmob).
    #[allow(dead_code)]
    server_abort: tokio::task::AbortHandle,
    // Retained so the reload handler (Task 7) can call reload_from_config()
    // to hot-swap certs without restarting the server.
    tls_config: Option<axum_server::tls_rustls::RustlsConfig>,
    tls_source: Option<ServerTlsSource>,
}

/// Internal registry state: live server entries plus pre-bound listeners
/// staged for consumption by the next spawn on the same key.
#[derive(Default)]
struct RegistryState {
    entries: HashMap<ServerKey, Arc<OnceCell<ServerHandle>>>,
    staged: HashMap<ServerKey, tokio::net::TcpListener>,
}

/// Process-global registry mapping (host, port) → running Axum server handle.
pub struct ServerRegistry {
    inner: Mutex<RegistryState>,
}

impl ServerRegistry {
    /// Returns the global singleton.
    pub fn global() -> &'static Self {
        static INSTANCE: OnceLock<ServerRegistry> = OnceLock::new();
        INSTANCE.get_or_init(|| ServerRegistry {
            inner: Mutex::new(RegistryState::default()),
        })
    }

    /// Returns route registry for `port`, spawning new Axum server if
    /// none is running on that port yet.
    #[allow(clippy::too_many_arguments)]
    pub async fn get_or_spawn(
        &'static self,
        host: &str,
        port: u16,
        max_request_body: usize,
        max_response_body: usize,
        max_inflight_requests: usize,
        runtime: Arc<dyn RuntimeObservability>,
        route_id: String,
        tls_config: Option<crate::config::ServerTlsConfig>,
    ) -> Result<HttpRouteRegistry, CamelError> {
        self.get_or_spawn_internal(
            host,
            port,
            max_request_body,
            max_response_body,
            max_inflight_requests,
            runtime,
            route_id,
            tls_config,
            None,
        )
        .await
    }

    /// Like [`ServerRegistry::get_or_spawn`], but serves `listener` instead
    /// of binding `host:port`. The registry key is derived from the listener's
    /// actual local address, so callers must query that port afterwards. If an
    /// entry for the key already holds a live server, the same compatibility
    /// checks as `get_or_spawn` apply and the entry is reused; the passed
    /// listener is simply dropped.
    #[allow(clippy::too_many_arguments)]
    pub async fn get_or_spawn_with_listener(
        &'static self,
        listener: tokio::net::TcpListener,
        max_request_body: usize,
        max_response_body: usize,
        max_inflight_requests: usize,
        runtime: Arc<dyn RuntimeObservability>,
        route_id: String,
        tls_config: Option<crate::config::ServerTlsConfig>,
    ) -> Result<HttpRouteRegistry, CamelError> {
        let addr = listener
            .local_addr()
            .map_err(|e| CamelError::EndpointCreationFailed(format!("listener local_addr: {e}")))?;
        self.get_or_spawn_internal(
            &addr.ip().to_string(),
            addr.port(),
            max_request_body,
            max_response_body,
            max_inflight_requests,
            runtime,
            route_id,
            tls_config,
            Some(listener),
        )
        .await
    }

    /// Stage a pre-bound listener so the next `get_or_spawn` for its
    /// `(ip, port)` key serves this socket instead of binding a new one.
    ///
    /// The staged listener is consumed by exactly one spawn: the exact-key
    /// `get_or_spawn` takes it under the registry lock, eliminating the bind
    /// window between a port probe and server startup (itest-bound-ports).
    pub async fn stage_listener(
        &'static self,
        listener: tokio::net::TcpListener,
    ) -> Result<(), CamelError> {
        let addr = listener
            .local_addr()
            .map_err(|e| CamelError::EndpointCreationFailed(format!("listener local_addr: {e}")))?;
        let host = addr.ip().to_string();
        use std::collections::hash_map::Entry;
        let mut guard = self.inner.lock().map_err(|_| {
            CamelError::EndpointCreationFailed("ServerRegistry lock poisoned".into())
        })?;
        match guard.staged.entry((host.clone(), addr.port())) {
            Entry::Occupied(_) => Err(CamelError::EndpointCreationFailed(format!(
                "listener already staged for {host}:{}",
                addr.port()
            ))),
            Entry::Vacant(slot) => {
                slot.insert(listener);
                Ok(())
            }
        }
    }

    /// Returns the bound address of the live server entry for `(host, port)`,
    /// if one is initialized.
    pub fn bound_addr(&'static self, host: &str, port: u16) -> Option<std::net::SocketAddr> {
        let guard = self.inner.lock().ok()?;
        guard
            .entries
            .get(&(host.to_string(), port))
            .and_then(|cell| cell.get())
            .map(|handle| handle.bound_addr)
    }

    #[allow(clippy::too_many_arguments)]
    async fn get_or_spawn_internal(
        &'static self,
        host: &str,
        port: u16,
        max_request_body: usize,
        max_response_body: usize,
        max_inflight_requests: usize,
        runtime: Arc<dyn RuntimeObservability>,
        route_id: String,
        tls_config: Option<crate::config::ServerTlsConfig>,
        provided: Option<tokio::net::TcpListener>,
    ) -> Result<HttpRouteRegistry, CamelError> {
        let host_owned = host.to_string();
        let key = (host.to_string(), port);

        let cell = {
            let mut guard = self.inner.lock().map_err(|_| {
                CamelError::EndpointCreationFailed("ServerRegistry lock poisoned".into())
            })?;
            // Evict dead server so a fresh one can spawn (matches gRPC D-L2 pattern).
            // The monitor task awaits the server task, so monitor_task.is_finished()
            // is a reliable proxy for the server being gone (either crashed or aborted).
            if let Some(existing) = guard.entries.get(&key)
                && let Some(handle) = existing.get()
                && handle.monitor_task.is_finished()
            {
                // Deregister TLS reload handler so a respawned HTTPS server
                // doesn't reload stale cert config from the crashed handler.
                if handle.is_tls {
                    let scheme = if handle.is_tls { "https" } else { "http" };
                    camel_component_api::tls_source::TlsReloadRegistry::global()
                        .unregister(scheme, host, port);
                }
                guard.entries.remove(&key);
            }
            guard
                .entries
                .entry(key)
                .or_insert_with(|| Arc::new(OnceCell::new()))
                .clone()
        };

        if let Some(existing) = cell.get()
            && existing.max_request_body != max_request_body
        {
            return Err(CamelError::EndpointCreationFailed(format!(
                "incompatible maxRequestBody for shared server (host={host}, port={port}): {} vs {}",
                existing.max_request_body, max_request_body
            )));
        }

        if let Some(existing) = cell.get()
            && existing.max_response_body != max_response_body
        {
            return Err(CamelError::EndpointCreationFailed(format!(
                "incompatible maxResponseBody for shared server (host={host}, port={port}): {} vs {}",
                existing.max_response_body, max_response_body
            )));
        }

        if let Some(existing) = cell.get()
            && existing.max_inflight_requests != max_inflight_requests
        {
            return Err(CamelError::EndpointCreationFailed(format!(
                "incompatible maxInflightRequests for shared server (host={host}, port={port}): {} vs {}",
                existing.max_inflight_requests, max_inflight_requests
            )));
        }

        // TLS mode mismatch: plain vs TLS
        if let Some(existing) = cell.get()
            && existing.is_tls != tls_config.is_some()
        {
            return Err(CamelError::EndpointCreationFailed(format!(
                "incompatible TLS mode for shared server (host={host}, port={port}): existing is_tls={}, new has_tls={}",
                existing.is_tls,
                tls_config.is_some()
            )));
        }

        // TLS cert/key mismatch: different cert on same TLS port
        if let (Some(existing), Some(new_tls)) = (cell.get(), &tls_config)
            && (existing.tls_cert_path.as_deref() != Some(&new_tls.cert_path)
                || existing.tls_key_path.as_deref() != Some(&new_tls.key_path))
        {
            return Err(CamelError::EndpointCreationFailed(format!(
                "incompatible TLS cert/key for shared server (host={host}, port={port}): routes on the same TLS port must use the same cert and key"
            )));
        }

        let handle = cell
            .get_or_try_init(|| {
                let rt = Arc::clone(&runtime);
                let rid = route_id.clone();
                let key = (host_owned.clone(), port);
                async move {
                    // Resolve the listener source inside the init body so
                    // exactly one caller — the init winner — consumes a
                    // staged listener. Resolving it before the cell init let
                    // a racing caller strand the staged socket in the
                    // loser's hands: the winner then bound the same port and
                    // failed with EADDRINUSE. The sync registry lock here is
                    // never held across an await. Occupied cells never run
                    // this body, so they never touch the staged map.
                    let source = match provided {
                        Some(listener) => ListenerSource::Staged(listener),
                        None => {
                            let mut guard = self.inner.lock().map_err(|_| {
                                CamelError::EndpointCreationFailed(
                                    "ServerRegistry lock poisoned".into(),
                                )
                            })?;
                            match guard.staged.remove(&key) {
                                Some(listener) => ListenerSource::Staged(listener),
                                // Conflict check before any entry is
                                // initialized so the error leaves the staged
                                // slot untouched.
                                None => {
                                    if let Some((staged_host, _)) = guard
                                        .staged
                                        .keys()
                                        .find(|(_, staged_port)| *staged_port == port)
                                    {
                                        let staged_host = staged_host.clone();
                                        return Err(CamelError::EndpointCreationFailed(
                                            format!(
                                                "staged listener conflict on port {port}: staged under host {staged_host}, requested {host_owned}"
                                            ),
                                        ));
                                    }
                                    ListenerSource::Bind
                                }
                            }
                        }
                    };
                    spawn_entry(
                        key,
                        source,
                        max_request_body,
                        max_response_body,
                        max_inflight_requests,
                        rt,
                        rid,
                        tls_config,
                    )
                    .await
                    .and_then(|handle| {
                        // spawn_entry returns a freshly created Arc (refcount
                        // 1), so unwrapping it back into the owned handle for
                        // the cell always succeeds here.
                        Arc::try_unwrap(handle).map_err(|_| {
                            CamelError::EndpointCreationFailed(
                                "spawned server handle has dangling clones".into(),
                            )
                        })
                    })
                }
            })
            .await?;

        Ok(handle.registry.clone())
    }

    /// Unregister one consumer from a server. HTTP servers are process-lifetime:
    /// the server stays in the registry for potential restart. Path
    /// deregistration happens separately in the consumer's cleanup.
    pub async fn unregister(&self, host: &str, port: u16) {
        debug!(
            host = camel_api::redact::redact_host(host),
            port = port,
            "consumer unregistered from HTTP server"
        );
    }

    /// Reset the global registry — **test-only**.
    ///
    /// Clears all registered server handles so that tests can start from a clean
    /// state. This is intentionally `#[cfg(test)]` because the registry is a
    /// process-global singleton in production and resetting it would break
    /// running servers.
    #[cfg(test)]
    pub fn reset() {
        let instance = Self::global();
        let mut guard = instance
            .inner
            .lock()
            .expect("ServerRegistry lock poisoned during test reset");
        guard.entries.clear();
        guard.staged.clear();
    }
}

/// Where a spawned server's listening socket comes from: a fresh bind on
/// `key`, or a listener pre-bound (staged or passed) by the caller.
enum ListenerSource {
    Bind,
    Staged(tokio::net::TcpListener),
}

/// Create the server handle for a vacant registry entry: serve `key` via a
/// freshly bound or caller-provided listener. This is the OnceCell init body
/// of `get_or_spawn`, extracted so the legacy and staged entry points share
/// one spawn path.
#[allow(clippy::too_many_arguments)]
async fn spawn_entry(
    key: ServerKey,
    source: ListenerSource,
    max_request_body: usize,
    max_response_body: usize,
    max_inflight_requests: usize,
    runtime: Arc<dyn RuntimeObservability>,
    route_id: String,
    tls_config: Option<crate::config::ServerTlsConfig>,
) -> Result<Arc<ServerHandle>, CamelError> {
    // bd rc-ns3yc: defense-in-depth — validate before any listener side
    // effect (fresh bind or staged-listener consumption), before the
    // registry/CancellationToken work, and immediately guarding the
    // `tokio::sync::Semaphore::new` construction below (panics above
    // MAX_PERMITS).
    max_inflight_requests_limit(max_inflight_requests)?;
    let rt = Arc::clone(&runtime);
    let rid = route_id.clone();
    let (host_owned, port) = key;
    let listener = match source {
        ListenerSource::Bind => {
            let addr = format!("{host_owned}:{port}");
            tokio::net::TcpListener::bind(&addr).await.map_err(|e| {
                CamelError::EndpointCreationFailed(format!("Failed to bind {addr}: {e}"))
            })?
        }
        ListenerSource::Staged(listener) => listener,
    };
    let bound_addr = listener
        .local_addr()
        .map_err(|e| CamelError::EndpointCreationFailed(format!("listener local_addr: {e}")))?;
    let server_exited = tokio_util::sync::CancellationToken::new();
    let registry = HttpRouteRegistry::new_with_server_exited(server_exited.clone());
    let inflight = Arc::new(tokio::sync::Semaphore::new(max_inflight_requests));
    // Constructed once in the TLS branch so they can be retained
    // on ServerHandle for the reload handler (Task 7).
    let tls_rustls_cfg: Option<axum_server::tls_rustls::RustlsConfig>;
    let tls_source: Option<ServerTlsSource>;
    let server_task = if let Some(ref tls) = tls_config {
        let rustls_config = load_tls_config(&tls.cert_path, &tls.key_path)?;
        let source = ServerTlsSource {
            cert_path: std::path::PathBuf::from(&tls.cert_path),
            key_path: std::path::PathBuf::from(&tls.key_path),
            client_ca_path: None,
        };
        // Build the RustlsConfig once — clone() is cheap (Arc
        // internally) and shares the ArcSwap the reload handler
        // will mutate via reload_from_config().
        let rustls_cfg =
            axum_server::tls_rustls::RustlsConfig::from_config(std::sync::Arc::new(rustls_config));
        tls_rustls_cfg = Some(rustls_cfg.clone());
        tls_source = Some(source);
        // Convert tokio listener to std for axum-server
        let std_listener = listener.into_std().map_err(|e| {
            CamelError::EndpointCreationFailed(format!("TLS listener conversion: {e}"))
        })?;
        tokio::spawn(run_axum_server_tls(
            std_listener,
            rustls_cfg,
            registry.clone(),
            max_request_body,
            max_response_body,
            Arc::clone(&inflight),
            Arc::clone(&rt),
            rid.clone(),
        ))
    } else {
        tls_rustls_cfg = None;
        tls_source = None;
        tokio::spawn(run_axum_server(
            listener,
            registry.clone(),
            max_request_body,
            max_response_body,
            Arc::clone(&inflight),
            Arc::clone(&rt),
            rid.clone(),
        ))
    };
    let addr_for_monitor = format!("{host_owned}:{port}");
    let server_abort = server_task.abort_handle();
    let monitor_task = tokio::spawn(monitor_axum_task(
        server_task,
        addr_for_monitor,
        Arc::clone(&rt),
        rid,
        server_exited,
    ));
    let handle = ServerHandle {
        registry,
        bound_addr,
        max_request_body,
        max_response_body,
        max_inflight_requests,
        is_tls: tls_config.is_some(),
        tls_cert_path: tls_config.as_ref().map(|t| t.cert_path.clone()),
        tls_key_path: tls_config.as_ref().map(|t| t.key_path.clone()),
        monitor_task,
        server_abort,
        tls_config: tls_rustls_cfg,
        tls_source,
    };
    // Register reload handler (exactly-once: inside OnceCell init closure).
    // Note: HTTP servers are process-lifetime (no release/eviction path),
    // so handlers are never unregistered. If eviction is added later,
    // add TlsReloadRegistry::global().unregister() there.
    if let (Some(tls_cfg), Some(source)) = (handle.tls_config.as_ref(), handle.tls_source.as_ref())
    {
        let handler = Arc::new(crate::tls_reload::HttpReloadHandler::new(
            tls_cfg.clone(),
            source.clone(),
            host_owned.clone(),
            port,
        ));
        camel_component_api::tls_source::TlsReloadRegistry::global().register(handler);
    }
    Ok(Arc::new(handle))
}

// ---------------------------------------------------------------------------
// Axum server
// ---------------------------------------------------------------------------

use axum::{
    Router,
    body::Body as AxumBody,
    extract::{Request, State},
    http::{Response, StatusCode},
    response::IntoResponse,
};

#[derive(Clone)]
pub(crate) struct AppState {
    registry: HttpRouteRegistry,
    max_request_body: usize,
    max_response_body: usize,
    inflight: Arc<tokio::sync::Semaphore>,
}

/// Hard wall-clock limit for one inbound request on the consumer side
/// (audit 2026-08-31, F2-1). A slow-drip client otherwise holds an
/// `inflight` semaphore permit (and its connection) indefinitely, starving
/// the consumer into 503s. 30s matches the documented component default
/// timeouts. Applies to the whole dispatch; streaming bodies are additionally
/// protected by the byte cap in `dispatch_handler`.
const CONSUMER_REQUEST_TIMEOUT: Duration = Duration::from_secs(30);

async fn run_axum_server(
    listener: tokio::net::TcpListener,
    registry: HttpRouteRegistry,
    max_request_body: usize,
    max_response_body: usize,
    inflight: Arc<tokio::sync::Semaphore>,
    runtime: Arc<dyn RuntimeObservability>,
    route_id: String,
) {
    let state = AppState {
        registry,
        max_request_body,
        max_response_body,
        inflight,
    };
    let app = Router::new()
        .fallback(dispatch_handler)
        .with_state(state)
        .layer(tower_http::timeout::TimeoutLayer::with_status_code(
            StatusCode::REQUEST_TIMEOUT,
            CONSUMER_REQUEST_TIMEOUT,
        ));

    axum::serve(listener, app).await.unwrap_or_else(|e| {
        runtime
            .metrics()
            .increment_errors(&route_id, "e:http:accept");
        // log-policy: outside-contract
        tracing::error!(error = %e, "Axum server error");
    });
}

#[allow(clippy::too_many_arguments)]
async fn run_axum_server_tls(
    listener: std::net::TcpListener,
    tls_cfg: axum_server::tls_rustls::RustlsConfig,
    registry: HttpRouteRegistry,
    max_request_body: usize,
    max_response_body: usize,
    inflight: Arc<tokio::sync::Semaphore>,
    runtime: Arc<dyn RuntimeObservability>,
    route_id: String,
) {
    let state = AppState {
        registry,
        max_request_body,
        max_response_body,
        inflight,
    };
    let app = Router::new()
        .fallback(dispatch_handler)
        .with_state(state)
        .layer(tower_http::timeout::TimeoutLayer::with_status_code(
            StatusCode::REQUEST_TIMEOUT,
            CONSUMER_REQUEST_TIMEOUT,
        ));

    // RustlsConfig is now constructed once in get_or_spawn and retained on
    // ServerHandle so the reload handler can call reload_from_config() on it.

    // axum-server 0.8: from_tcp_rustls is fallible (TLS acceptor setup).
    let server = match axum_server::from_tcp_rustls(listener, tls_cfg) {
        Ok(server) => server,
        Err(e) => {
            runtime
                .metrics()
                .increment_errors(&route_id, "e:http:accept-tls");
            // log-policy: outside-contract
            tracing::error!(error = %e, "Axum TLS server setup error");
            return;
        }
    };

    server
        .serve(app.into_make_service())
        .await
        .unwrap_or_else(|e| {
            runtime
                .metrics()
                .increment_errors(&route_id, "e:http:accept-tls");
            // log-policy: outside-contract
            tracing::error!(error = %e, "Axum TLS server error");
        });
}

/// Monitors the shared Axum server task of one (host, port).
///
/// On unexpected exit (panic or abort) it records the structured error
/// event and cancels the server's `server_exited` token. Every
/// `HttpConsumer` hosted on that server observes the cancellation in its
/// `start()` loop and returns `Err`, which camel-core's consumer watcher
/// turns into a per-route `CrashNotification` → `FailRoute` → supervision
/// backoff restart (ADR-0007). A clean exit (`Ok(())` — process shutdown)
/// cancels nothing: route stops own their termination.
async fn monitor_axum_task(
    handle: tokio::task::JoinHandle<()>,
    addr: String,
    runtime: Arc<dyn RuntimeObservability>,
    route_id: String,
    server_exited: tokio_util::sync::CancellationToken,
) {
    match handle.await {
        Ok(()) => {
            // Clean exit (process shutdown or normal stop)
        }
        Err(join_err) => {
            runtime
                .metrics()
                .increment_errors(&route_id, "e:http:server-task-exited");
            // log-policy: outside-contract
            tracing::error!(
                addr = %addr,
                error = %join_err,
                "Axum server task exited unexpectedly — all routes on this port are now dead"
            );
            // Fail every hosted route's consumer: each `start()` returns Err
            // and camel-core emits one CrashNotification per route (ADR-0007
            // parity with per-route transport death).
            server_exited.cancel();
        }
    }
}

/// Load a rustls ServerConfig from PEM cert/key files.
/// Adapted from camel-ws lib.rs load_tls_config.
fn load_tls_config(
    cert_path: &str,
    key_path: &str,
) -> Result<tokio_rustls::rustls::ServerConfig, CamelError> {
    use std::fs::File;
    use std::io::BufReader;

    let cert_file = File::open(cert_path)
        .map_err(|e| CamelError::EndpointCreationFailed(format!("TLS cert file error: {e}")))?;
    let key_file = File::open(key_path)
        .map_err(|e| CamelError::EndpointCreationFailed(format!("TLS key file error: {e}")))?;

    let certs: Vec<_> = rustls_pemfile::certs(&mut BufReader::new(cert_file))
        .collect::<Result<Vec<_>, _>>()
        .map_err(|e| CamelError::EndpointCreationFailed(format!("TLS cert parse error: {e}")))?;

    let key = rustls_pemfile::private_key(&mut BufReader::new(key_file))
        .map_err(|e| CamelError::EndpointCreationFailed(format!("TLS key parse error: {e}")))?
        .ok_or_else(|| CamelError::EndpointCreationFailed("TLS: no private key found".into()))?;

    tokio_rustls::rustls::ServerConfig::builder()
        .with_no_client_auth()
        .with_single_cert(certs, key)
        .map_err(|e| CamelError::EndpointCreationFailed(format!("TLS config error: {e}")))
}

async fn dispatch_handler(State(state): State<AppState>, req: Request) -> impl IntoResponse {
    let path = req.uri().path().to_owned();
    let method = req.method().to_string();

    // Dispatch precedence (spec §7.2 / ADR-0009):
    //   1. Exact API path match (legacy `http:` routes without httpMethod)
    //   2. Templated API path match (REST, method-aware, by specificity)
    //   3. Static mount longest-prefix
    //   4. SPA fallback
    //
    // Legacy exact runs first: it is a cheap HashMap get, and the two
    // registries are mutually exclusive per route — a legacy route carries
    // no `httpMethod` and lives only in `api_routes`, while a REST-lowered
    // route carries `httpMethod` and lives only in `rest_endpoints`. So an
    // exact hit can never shadow a REST route that should have matched,
    // and running exact-first honours the documented precedence (the prior
    // REST-first order let a templated `GET /api/{resource}` steal a
    // request meant for an exact `GET /api/users`). Intra-REST method
    // disambiguation is handled inside `match_endpoint`, not by this
    // ordering. Review C2.
    let api_sender = {
        let inner = state.registry.inner.read().await;
        inner.api_routes.get(&path).cloned()
    }; // lock released BEFORE any IO

    let (rest_sender, path_params) = if api_sender.is_some() {
        // Exact legacy match won — skip the templated scan entirely.
        (None, Default::default())
    } else {
        let inner = state.registry.inner.read().await;
        match rest_match::match_endpoint(&method, &path, &inner.rest_endpoints) {
            rest_match::MatchOutcome::Found(m) => (Some(m.payload), m.path_params),
            rest_match::MatchOutcome::Ambiguous => {
                // Ambiguous registration should have been rejected at
                // lowering time (rest.rs). Reaching here means two
                // equal-specificity templates matched one request —
                // surface a loud error rather than a silent 404. Review C3.
                // log-policy: handler-owned
                tracing::warn!(
                    method = %method,
                    path = %path,
                    "ambiguous REST template match — returning 500"
                );
                return Response::builder()
                    .status(StatusCode::INTERNAL_SERVER_ERROR)
                    .body(AxumBody::from("Internal Server Error"))
                    .expect("infallible"); // allow-unwrap
            }
            rest_match::MatchOutcome::NotFound => (None, Default::default()),
        }
    }; // lock released BEFORE any IO

    let sender = api_sender.or(rest_sender);

    if let Some(sender) = sender {
        let query = req.uri().query().unwrap_or("").to_string();
        let headers = req.headers().clone();

        // Check Content-Length against limit BEFORE opening the stream
        let content_length: Option<u64> = headers
            .get(http::header::CONTENT_LENGTH)
            .and_then(|v| v.to_str().ok())
            .and_then(|s| s.parse().ok());

        if let Some(len) = content_length
            && len > state.max_request_body as u64
        {
            return Response::builder()
                .status(StatusCode::PAYLOAD_TOO_LARGE)
                .body(AxumBody::from("Request body exceeds configured limit"))
                .expect("infallible"); // allow-unwrap
        }

        let _permit = match Arc::clone(&state.inflight).try_acquire_owned() {
            Ok(permit) => permit,
            Err(_) => {
                return Response::builder()
                    .status(StatusCode::SERVICE_UNAVAILABLE)
                    .body(AxumBody::from("Service Unavailable"))
                    .expect("infallible"); // allow-unwrap
            }
        };

        // Build StreamBody from Axum body WITHOUT materializing.
        // SECURITY (audit 2026-08-31, F2-1): the Content-Length pre-check above
        // cannot see chunked/no-length requests. Wrap the stream with a hard
        // byte cap so ANY downstream consumption fails closed once
        // max_request_body is exceeded — the cap travels with the body.
        let content_type = headers
            .get(http::header::CONTENT_TYPE)
            .and_then(|v| v.to_str().ok())
            .map(|s| s.to_string());

        let data_stream: BodyDataStream = req.into_body().into_data_stream();
        let max_body = state.max_request_body;
        let mut seen: u64 = 0;
        let capped_stream =
            data_stream
                .map_err(|e| CamelError::Io(e.to_string()))
                .map(move |chunk| match chunk {
                    Ok(bytes) => {
                        seen = seen.saturating_add(bytes.len() as u64);
                        if seen > max_body as u64 {
                            Err(CamelError::ProcessorError(format!(
                                "Request body exceeds configured limit of {max_body} bytes"
                            )))
                        } else {
                            Ok(bytes)
                        }
                    }
                    Err(e) => Err(e),
                });
        let boxed: BoxStream<'static, Result<bytes::Bytes, CamelError>> = Box::pin(capped_stream);

        let stream_body = StreamBody {
            stream: Arc::new(tokio::sync::Mutex::new(Some(boxed))),
            metadata: StreamMetadata {
                size_hint: content_length,
                content_type,
                origin: None,
            },
        };

        let (reply_tx, reply_rx) = tokio::sync::oneshot::channel::<HttpReply>();
        let envelope = RequestEnvelope {
            method,
            path,
            query,
            headers,
            body: stream_body,
            path_params,
            reply_tx,
        };

        if sender.send(envelope).await.is_err() {
            return Response::builder()
                .status(StatusCode::SERVICE_UNAVAILABLE)
                .body(AxumBody::from("Consumer unavailable"))
                .expect("infallible"); // allow-unwrap
        }

        match reply_rx.await {
            Ok(reply) => {
                let reply = match reply.body {
                    HttpReplyBody::Bytes(b)
                        if exceeds_max_response_body(b.len(), state.max_response_body) =>
                    {
                        HttpReply {
                            status: 500,
                            headers: vec![],
                            body: HttpReplyBody::Bytes(bytes::Bytes::from(
                                "Response body exceeds configured limit",
                            )),
                        }
                    }
                    _ => reply,
                };

                let status =
                    StatusCode::from_u16(reply.status).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
                let mut builder = Response::builder().status(status);
                for (k, v) in &reply.headers {
                    builder = builder.header(k.as_str(), v.as_str());
                }
                match reply.body {
                    HttpReplyBody::Bytes(b) => {
                        builder.body(AxumBody::from(b)).unwrap_or_else(|_| {
                            Response::builder()
                                .status(StatusCode::INTERNAL_SERVER_ERROR)
                                .body(AxumBody::from("Invalid response headers from consumer"))
                                .expect("infallible") // allow-unwrap
                        })
                    }
                    HttpReplyBody::Stream(stream) => builder
                        .body(AxumBody::from_stream(stream))
                        .unwrap_or_else(|_| {
                            Response::builder()
                                .status(StatusCode::INTERNAL_SERVER_ERROR)
                                .body(AxumBody::from("Invalid response headers from consumer"))
                                .expect("infallible") // allow-unwrap
                        }),
                }
            }
            Err(_) => Response::builder()
                .status(StatusCode::INTERNAL_SERVER_ERROR)
                .body(AxumBody::from("Pipeline error"))
                .expect("infallible"), // allow-unwrap
        }
    } else {
        // No API route matched — try static mounts
        static_dispatch::dispatch_static(&state, req, &path).await
    }
}

fn exceeds_max_response_body(len: usize, max: usize) -> bool {
    len > max
}

fn title_case_header(name: &str) -> String {
    name.split('-')
        .map(|part| {
            let mut chars = part.chars();
            match chars.next() {
                None => String::new(),
                Some(first) => first.to_uppercase().chain(chars.as_str().chars()).collect(),
            }
        })
        .collect::<Vec<_>>()
        .join("-")
}

// ---------------------------------------------------------------------------
// HttpConsumer
// ---------------------------------------------------------------------------

/// Kernel authentication state captured from a route's [`SecurityContext`]
/// (`unify-transport-auth`, Task 2.9).
///
/// Same construction-order lifecycle as gRPC's `GrpcKernelAuth` (Task 2.1):
/// the compiled plan and the provider registry arrive via
/// `Consumer::set_security_context` before `start()` accepts requests. A
/// context lacking either piece keeps `kernel = None` — a plan without
/// providers can never mint a principal (fail-closed, never a silently
/// unauthenticated route: the controller's strict-mode dispatch check then
/// denies carrier-less Exchanges on non-Public plans).
pub(crate) struct HttpKernelAuth {
    pub(crate) plan: camel_api::security_policy::RouteSecurityPlan,
    pub(crate) providers: Arc<camel_auth::ProviderRegistry>,
}

impl HttpKernelAuth {
    /// Capture the kernel state from a route's security context.
    ///
    /// `None` unless both the compiled plan and the provider registry are
    /// present.
    pub(crate) fn from_security_context(
        ctx: &camel_component_api::SecurityContext,
    ) -> Option<Self> {
        Some(Self {
            plan: ctx.plan.clone()?,
            providers: ctx.providers.clone()?,
        })
    }
}

/// Capacity for the per-route RequestEnvelope channel.
///
/// Each in-flight request holds exactly one `maxInflightRequests` semaphore
/// permit from before `send()` until its reply, so at most N envelopes can be
/// outstanding at any time. A buffer of N therefore can never fill before the
/// semaphore exhausts: dispatcher `send()` calls never park on a full buffer
/// and the semaphore stays the single, URI-configurable backpressure point.
/// A hardcoded smaller buffer would act as a second, hidden inflight cap
/// (rc-3y6j: 64 vs default 1024 permits).
///
/// `max(1)`: `maxInflightRequests=0` is a representable "reject everything"
/// configuration, but `tokio::sync::mpsc::channel(0)` panics — keep consumer
/// start panic-free (the empty semaphore still 503s every request).
fn envelope_channel_capacity(max_inflight_requests: usize) -> usize {
    max_inflight_requests.max(1)
}

/// Upper bound check for `maxInflightRequests`.
///
/// bd rc-ns3yc: `tokio::sync::Semaphore::new` panics for permit counts above
/// [`tokio::sync::Semaphore::MAX_PERMITS`], so any representable `usize`
/// above that bound must be rejected fail-closed with a typed configuration
/// error naming the parameter, the configured value, and the limit — before
/// the semaphore primitive is ever constructed. Enforced at URI parse,
/// `create_consumer`, consumer start, and `spawn_entry` (defense-in-depth);
/// mirror of the grpc `consumer_concurrency_limit` fix (commit 101327e5).
///
/// `0` is deliberately NOT normalized here (rc-3y6j): it remains a
/// representable reject-everything value (`envelope_channel_capacity`
/// separately guards the one primitive — the envelope channel — that
/// cannot take 0).
pub(crate) fn max_inflight_requests_limit(configured: usize) -> Result<usize, CamelError> {
    if configured > tokio::sync::Semaphore::MAX_PERMITS {
        return Err(CamelError::Config(format!(
            "maxInflightRequests {configured} exceeds the supported upper bound {} (tokio::sync::Semaphore::MAX_PERMITS)",
            tokio::sync::Semaphore::MAX_PERMITS
        )));
    }
    Ok(configured)
}

pub struct HttpConsumer {
    config: HttpServerConfig,
    /// Runtime observability handle for ADR-0012 metrics and health calls.
    runtime: Arc<dyn RuntimeObservability>,
    /// Kernel authentication state (plan + providers), set via
    /// `set_security_context` before `start()` (Task 2.9). `None` for routes
    /// without route-level security (Public under the per-bind gate).
    kernel: Option<Arc<HttpKernelAuth>>,
}

impl HttpConsumer {
    pub fn new(config: HttpServerConfig, runtime: Arc<dyn RuntimeObservability>) -> Self {
        Self {
            config,
            runtime,
            kernel: None,
        }
    }
}

#[async_trait::async_trait]
impl Consumer for HttpConsumer {
    async fn start(&mut self, ctx: camel_component_api::ConsumerContext) -> Result<(), CamelError> {
        use camel_component_api::{Body, Exchange, Message};

        // bd rc-ns3yc: fail-closed BEFORE shared-server registry
        // interaction, listener binding, envelope-channel construction, or
        // inflight-semaphore construction — an oversized value must never
        // reach Semaphore::new (panic).
        max_inflight_requests_limit(self.config.max_inflight_requests)?;

        let registry = ServerRegistry::global()
            .get_or_spawn(
                &self.config.host,
                self.config.port,
                self.config.max_request_body,
                self.config.max_response_body,
                self.config.max_inflight_requests,
                self.runtime.clone(),
                ctx.route_id().to_string(),
                self.config.tls_config.clone(),
            )
            .await?;

        // Create channel for this path and register it. Capacity matches the
        // dispatcher's inflight semaphore (see envelope_channel_capacity) so
        // the channel can never become a second backpressure point.
        let (env_tx, mut env_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(
            envelope_channel_capacity(self.config.max_inflight_requests),
        );
        // When the from-URI carries `httpMethod=...` (REST-lowered
        // route), register the consumer as a method-aware REST endpoint
        // so the dispatcher can route by (method, path template).
        // Otherwise fall back to the legacy path-only api_routes
        // registry. The two registries never overlap for the same
        // route: each consumer registers in exactly one of them.
        if let Some(method) = self.config.method.clone() {
            let segments = rest_match::parse_path_template(&self.config.path);
            registry
                .register_rest_endpoint(method, segments, env_tx)
                .await;
        } else {
            registry
                .register_api_route(self.config.path.clone(), env_tx)
                .await;
        }

        // rc-w1u9: Signal readiness AFTER (1) TcpListener::bind succeeded
        // (inside get_or_spawn above), (2) the axum server task was spawned,
        // and (3) this route's path/REST endpoint was registered. At this
        // point the listener is genuinely accepting connections and any
        // request to this route will be dispatched (not 404'd). The runtime
        // uses this signal to publish RouteStarted and to release
        // ctx.start() so external benchmarks can emit a reliable
        // listener-bound marker.
        ctx.mark_ready();

        // rc-nftni (drainclaim): capture the context-global counter once;
        // every envelope this raw-sender consumer constructs carries a
        // claim minted at the acceptance dequeue below.
        let in_flight = ctx.in_flight_counter();

        let path = self.config.path.clone();
        let registry_for_cleanup = registry.clone();
        let server_exited = registry.server_exited.clone();
        let cancel_token = ctx.cancel_token();
        let kernel = self.kernel.clone();
        // Set when the loop exits because the shared server died. The
        // post-loop cleanup still runs, then `start()` returns Err so
        // camel-core's consumer watcher emits a CrashNotification for THIS
        // route and supervision backoff engages (ADR-0007).
        let mut server_died = false;
        loop {
            tokio::select! {
                _ = ctx.cancelled() => {
                    break;
                }
                _ = server_exited.cancelled() => {
                    // Shared transport death: this route's consumer cannot
                    // continue. Fail (do NOT hang in Running) — parity with
                    // per-route transport death, which also surfaces as a
                    // consumer-task error.
                    server_died = true;
                    break;
                }
                 envelope = env_rx.recv() => {
                    let Some(envelope) = envelope else { break; };

                    // rc-nftni: mint at acceptance — the dequeue of the
                    // dispatcher's RequestEnvelope is where this consumer
                    // takes ownership of the wire request. The claim is held
                    // across the authn await, the route channel, and the
                    // pipeline; every early exit in the per-request task
                    // (cancel-503, auth denial) drops it, and a failed push
                    // rolls it back with the dropped envelope (RAII).
                    let claim =
                        in_flight.as_ref().map(camel_component_api::InFlightClaim::attach);

                    // Build Exchange from HTTP request
                    let mut msg = Message::default();

                    // Set standard Camel HTTP headers
                    msg.set_header("CamelHttpMethod",
                        serde_json::Value::String(envelope.method.clone()));
                    msg.set_header("CamelHttpPath",
                        serde_json::Value::String(envelope.path.clone()));
                    msg.set_header("CamelHttpQuery",
                        serde_json::Value::String(envelope.query.clone()));

                    // Set path-parameter headers from REST template
                    // match. Expert guidance E2: the consumer is
                    // responsible for translating the dispatcher's
                    // matched params into `CamelHttpPath_<param>`
                    // headers on the Exchange, matching the convention
                    // used by Camel HTTP for templated routes.
                    for (param_name, param_value) in &envelope.path_params {
                        msg.set_header(
                            format!("CamelHttpPath_{param_name}"),
                            serde_json::Value::String(param_value.clone()),
                        );
                    }

                    // Forward HTTP headers with Title-Case names (hyper lowercases them)
                    for (k, v) in &envelope.headers {
                        if let Ok(val_str) = v.to_str() {
                            msg.set_header(
                                title_case_header(k.as_str()),
                                serde_json::Value::String(val_str.to_string()),
                            );
                        }
                    }

                    // Body: always arrives as Body::Stream (native streaming)
                    // Routes can call into_bytes() if they need to materialize
                    msg.body = Body::Stream(envelope.body);

                    #[allow(unused_mut)]
                    let mut exchange = Exchange::new(msg);

                    // Extract W3C TraceContext headers for distributed tracing (opt-in via "otel" feature)
                    #[cfg(feature = "otel")]
                    {
                        let headers: HashMap<String, String> = envelope
                            .headers
                            .iter()
                            .filter_map(|(k, v)| {
                                Some((k.as_str().to_lowercase(), v.to_str().ok()?.to_string()))
                            })
                            .collect();
                        camel_otel::extract_into_exchange(&mut exchange, &headers);
                    }

                    let reply_tx = envelope.reply_tx;
                    let sender = ctx.sender().clone();
                    let path_clone = path.clone();
                    let cancel = cancel_token.clone();
                    // Task 2.9 boundary-auth inputs: the raw header map and
                    // the request URI (path + query) feed kernel credential
                    // extraction inside the per-request task.
                    let auth_headers = envelope.headers.clone();
                    let auth_uri: http::Uri = {
                        let full = if envelope.query.is_empty() {
                            envelope.path.clone()
                        } else {
                            format!("{}?{}", envelope.path, envelope.query)
                        };
                        // A malformed path cannot become a valid `Uri`; the
                        // empty default then carries no credentials, so
                        // extraction finds nothing and authn fails closed.
                        full.parse().unwrap_or_default()
                    };
                    let kernel = kernel.clone();

                    // Spawn a task to handle this request concurrently
                    //
                    // NOTE: This spawns a separate tokio task for each incoming HTTP request to enable
                    // true concurrent request processing. This change was introduced as part of the
                    // pipeline concurrency feature and was NOT part of the original HttpConsumer design.
                    //
                    // Rationale:
                    // 1. Without spawning per-request tasks, the send_and_wait() operation would block
                    //    the consumer's main loop until the pipeline processing completes
                    // 2. This blocking would prevent multiple HTTP requests from being processed
                    //    concurrently, even when ConcurrencyModel::Concurrent is enabled on the pipeline
                    // 3. The channel would never have multiple exchanges buffered simultaneously,
                    //    defeating the purpose of pipeline-side concurrency
                    // 4. By spawning a task per request, we allow the consumer loop to continue
                    //    accepting new requests while existing ones are processed in the pipeline
                    //
                    // This approach effectively decouples request acceptance from pipeline processing,
                    // allowing the channel to buffer multiple exchanges that can be processed concurrently
                    // by the pipeline when ConcurrencyModel::Concurrent is active.
                    tokio::spawn(async move {
                        // Check for cancellation before sending to pipeline.
                        // Returns 503 (Service Unavailable) instead of letting the request
                        // enter a shutting-down pipeline. This is a behavioral change from
                        // the pre-concurrency implementation where cancellation during
                        // processing would result in a 500 (Internal Server Error).
                        // 503 is more semantically correct: the server is temporarily
                        // unable to handle the request due to shutdown.
                        if cancel.is_cancelled() {
                            let _ = reply_tx.send(HttpReply {
                                status: 503,
                                headers: vec![],
                                body: HttpReplyBody::Bytes(bytes::Bytes::from("Service Unavailable")),
                            });
                            return;
                        }

                        // ADR-0061 Task 2.9: kernel authentication at the
                        // request boundary. A `Public` plan passes through
                        // with no extraction; any other mode extracts per
                        // the plan's sources, authenticates through the
                        // kernel, and installs the typed carrier BEFORE the
                        // pipeline runs. A denial renders in the HTTP idiom
                        // (401 via `pipeline_error_to_reply`) and the route
                        // body never sees the request.
                        if let Some(kernel) = kernel.as_ref()
                            && !matches!(
                                kernel.plan.access_mode,
                                camel_api::security_policy::AccessMode::Public
                            )
                        {
                            let principal = match camel_auth::extract_token_multi(
                                &auth_headers,
                                &auth_uri,
                                &kernel.plan.credential_sources,
                            ) {
                                Some(extracted) => {
                                    match camel_auth::kernel_authenticate(
                                        &kernel.plan,
                                        &kernel.providers,
                                        &extracted,
                                    )
                                    .await
                                    {
                                        Ok(principal) => principal,
                                        Err(e) => {
                                            // log-policy: handler-owned
                                            tracing::warn!(
                                                path = %path_clone,
                                                error = %e,
                                                "HTTP request authentication failed"
                                            );
                                            let _ = reply_tx.send(pipeline_error_to_reply(
                                                e,
                                                &path_clone,
                                            ));
                                            return;
                                        }
                                    }
                                }
                                None => {
                                    // log-policy: handler-owned
                                    tracing::warn!(
                                        path = %path_clone,
                                        "HTTP request rejected: no credential found in any source"
                                    );
                                    let _ = reply_tx.send(pipeline_error_to_reply(
                                        CamelError::Unauthenticated(
                                            "no credential found in any source".to_string(),
                                        ),
                                        &path_clone,
                                    ));
                                    return;
                                }
                            };
                            camel_auth::install_carrier(&mut exchange, &principal);
                        }

                        // Send through pipeline and await result
                        let (tx, rx) = tokio::sync::oneshot::channel();
                        let envelope = camel_component_api::consumer::ExchangeEnvelope {
                            exchange,
                            reply_tx: Some(tx),
                            // rc-nftni: the acceptance-minted claim rides the
                            // envelope; the pipeline drain sites take it and
                            // hold it across the pipeline (release at
                            // completion; rejection paths above already
                            // dropped it).
                            in_flight_claim: claim,
                        };

                        let result = match sender.send(envelope).await {
                            Ok(()) => rx.await.map_err(|_| camel_component_api::CamelError::ChannelClosed),
                            Err(_) => Err(camel_component_api::CamelError::ChannelClosed),
                        }
                        .and_then(|r| r);

                        let reply = match result {
                            Ok(out) => {
                                let status = out
                                    .input
                                    .header("CamelHttpResponseCode")
                                    .and_then(|v| {
                                        let raw = v.as_u64()
                                            .or_else(|| v.as_str().and_then(|s| s.parse().ok()))?;
                                        let code = raw as u16;
                                        (100..1000).contains(&code).then_some(code)
                                    })
                                    .unwrap_or(200);

                                let user_content_type = out
                                    .input
                                    .header("Content-Type")
                                    .and_then(|v| v.as_str().map(|s| s.to_string()));

                                let (reply_body, inferred_content_type): (HttpReplyBody, Option<String>) = match out.input.body {
                                    Body::Bytes(b) => (HttpReplyBody::Bytes(b), None),
                                    Body::Text(s) => (HttpReplyBody::Bytes(bytes::Bytes::from(s.into_bytes())), Some("text/plain; charset=utf-8".to_string())),
                                    Body::Xml(s) => (HttpReplyBody::Bytes(bytes::Bytes::from(s.into_bytes())), Some("application/xml".to_string())),
                                    Body::Json(v) => (HttpReplyBody::Bytes(bytes::Bytes::from(
                                        v.to_string().into_bytes(),
                                    )), Some("application/json".to_string())),
                                    Body::Stream(s) => {
                                        let ct = s.metadata.content_type.clone();
                                        match s.stream.lock().await.take() {
                                            Some(stream) => (
                                                HttpReplyBody::Stream(stream),
                                                ct,
                                            ),
                                            None => {
                                                // log-policy: system-broken
                                                tracing::error!(
                                                    "Body::Stream already consumed before HTTP reply — returning 500"
                                                );
                                                let error_reply = HttpReply {
                                                    status: 500,
                                                    headers: vec![],
                                                    body: HttpReplyBody::Bytes(bytes::Bytes::new()),
                                                };
                                                if reply_tx.send(error_reply).is_err() {
                                                    debug!("reply_tx dropped before error reply could be sent");
                                                }
                                                return;
                                            }
                                        }
                                    }
                                    // Empty and future variants produce an empty reply body.
                                    _ => (HttpReplyBody::Bytes(bytes::Bytes::new()), None),
                                };

                                let resp_headers = select_response_headers(
                                    &out.input.headers,
                                    user_content_type,
                                    inferred_content_type,
                                );

                                HttpReply {
                                    status,
                                    headers: resp_headers,
                                    body: reply_body,
                                }
                            }
                            Err(e) => {
                                pipeline_error_to_reply(e, &path_clone)
                            }
                        };

                        // Reply to Axum handler (ignore error if client disconnected)
                        let _ = reply_tx.send(reply);
                    });
                }
            }
        }

        // Deregister this consumer. Mirror the registration choice:
        // REST-registered consumers remove their (method, path) endpoint
        // WITHOUT touching sibling verbs on the same template (review C1);
        // legacy consumers clean up api_routes.
        if let Some(method) = &self.config.method {
            registry_for_cleanup
                .unregister_rest_endpoint(method, &path)
                .await;
        } else {
            registry_for_cleanup.unregister_api_route(&path).await;
        }

        // Leave the shared-server entry: `unregister` is a no-op today (no
        // refcount exists — stale D-L10 wording removed, rc-szmob review).
        // Dead servers are evicted lazily by `get_or_spawn_internal`, which
        // checks `monitor_task.is_finished()` and rebinds on the next spawn
        // (e.g. a supervision restart after this consumer's Err).
        ServerRegistry::global()
            .unregister(&self.config.host, self.config.port)
            .await;

        if server_died {
            // log-policy: system-broken
            tracing::error!(
                host = %camel_api::redact::redact_host(&self.config.host),
                port = self.config.port,
                path = %path,
                "Shared HTTP server exited — failing consumer to engage route supervision (ADR-0007)"
            );
            // The error value is logged upstream by supervision (ADR-0076):
            // the host must ride the canonical masker, message structure
            // unchanged (bd rc-8bxeo item 3).
            return Err(CamelError::RouteError(format!(
                "shared HTTP server for {}:{} exited unexpectedly; route transport is dead",
                camel_api::redact::redact_host(&self.config.host),
                self.config.port
            )));
        }

        Ok(())
    }

    async fn stop(&mut self) -> Result<(), CamelError> {
        Ok(())
    }

    fn concurrency_model(&self) -> camel_component_api::ConcurrencyModel {
        camel_component_api::ConcurrencyModel::Concurrent { max: None }
    }

    // rc-w1u9: HTTP consumer binds a TcpListener inside start() (via
    // ServerRegistry::get_or_spawn) and only THEN can it accept connections.
    // Opting into Explicit startup makes ctx.start() await the bind+register
    // completion so listeners fail fast on bind errors (previously a silent
    // background log) and external markers can reliably detect listener-bound
    // state.
    fn startup_mode(&self) -> camel_component_api::ConsumerStartupMode {
        camel_component_api::ConsumerStartupMode::Explicit
    }

    // Task 2.9: capture the kernel state (compiled plan + provider registry)
    // wired by the route controller before start(). See `HttpKernelAuth`.
    fn set_security_context(&mut self, ctx: camel_component_api::SecurityContext) {
        self.kernel = HttpKernelAuth::from_security_context(&ctx).map(Arc::new);
    }
}

// ---------------------------------------------------------------------------
// HttpComponent / HttpsComponent
// ---------------------------------------------------------------------------

pub struct HttpComponent {
    config: HttpConfig,
    pinned_cache: std::sync::Arc<PinnedClientCache>,
    client: reqwest::Client,
    /// Set at construction when `tls.strict` is on and the configured
    /// material fails to load; surfaced as an endpoint-creation failure
    /// (rc-ayrwk).
    strict_tls_error: Option<CamelError>,
}

#[cfg(test)]
thread_local! {
    static BUILD_CLIENT_CALLS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
    static BUILD_CLIENT_FALLBACKS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
    /// Test seam arming [`build_client`] to skip the platform-verifier
    /// primary and enter [`webpki_fallback_client`] directly (see
    /// [`FallbackTrigger::Forced`]). Always manipulated through the
    /// panic-safe [`crate::tls_harness::force_webpki_fallback`] guard.
    static FORCE_WEBPKI_FALLBACK: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
    /// Test seam arming the shared second-error terminal in
    /// [`webpki_fallback_client`]: a successful preconfigured-backend
    /// build is then treated as a rebuild failure, exercising the
    /// terminal hermetically (it is unreachable through real triggers
    /// on reqwest 0.13.4). Always manipulated through the panic-safe
    /// [`crate::tls_harness::force_webpki_fallback_rebuild_failure`]
    /// guard.
    static FORCE_FALLBACK_REBUILD_FAIL: std::cell::Cell<bool> =
        const { std::cell::Cell::new(false) };
}

/// Shared builder assembly for [`build_client`]: everything except the
/// terminal `build()` — proxy, timeouts, pool, redirect policy, DNS-pin
/// override, and the permissive (warn-on-degrade) TLS material loads
/// (rc-ayrwk / audit F2-7).
fn client_builder(
    config: &HttpConfig,
    resolve_override: Option<(&str, &[std::net::SocketAddr])>,
) -> reqwest::ClientBuilder {
    let mut builder = reqwest::Client::builder()
        .no_proxy() // CRITICAL: env proxies bypass resolve_to_addrs
        .connect_timeout(Duration::from_millis(config.connect_timeout_ms))
        .pool_max_idle_per_host(config.pool_max_idle_per_host)
        .pool_idle_timeout(Duration::from_millis(config.pool_idle_timeout_ms));

    // Redirects are always handled manually in the producer's send path
    // so that each hop can be SSRF-validated. reqwest's built-in redirect
    // policy is sync and cannot perform async DNS resolution or SSRF checks.
    builder = builder.redirect(reqwest::redirect::Policy::none());

    if let Some((host, addrs)) = resolve_override {
        builder = builder.resolve_to_addrs(host, addrs);
    }

    if let Some(tls) = &config.tls
        && tls.enabled
    {
        if tls.insecure || !tls.verify_peer {
            // log-policy: handler-owned
            tracing::warn!("HTTP TLS verification disabled — connections are vulnerable to MitM");
            builder = builder.danger_accept_invalid_certs(true);
        }

        if let Some(ca_path) = &tls.ca_cert_path {
            // Audit 2026-08-31, F2-7: a configured CA that fails to load must
            // never degrade silently to system roots. Loud warn (config error
            // class: fail-fast would break existing deployments relying on the
            // fallback; the warning is the operator signal).
            match std::fs::read(ca_path) {
                Ok(ca_bytes) => {
                    // Under the rustls backend `Certificate::from_pem`
                    // never fails (it defers parsing), so the parse-error
                    // warn below is effectively dead and a file with zero
                    // parseable PEM CERTIFICATE sections would silently
                    // contribute no roots. Warn on that case explicitly
                    // (e_glm stage-4 finding 1).
                    let pem_sections = rustls_pemfile::certs(&mut std::io::Cursor::new(&ca_bytes))
                        .filter(|r| r.is_ok())
                        .count();
                    if pem_sections == 0 {
                        // log-policy: handler-owned
                        tracing::warn!(
                            "configured CA certificate contains no parseable PEM CERTIFICATE section — falling back to system roots"
                        );
                    }
                    match reqwest::Certificate::from_pem(&ca_bytes)
                        .or_else(|_| reqwest::Certificate::from_der(&ca_bytes))
                    {
                        Ok(ca_cert) => {
                            builder = builder.add_root_certificate(ca_cert);
                        }
                        Err(e) => {
                            // log-policy: handler-owned
                            tracing::warn!(
                                error = %e,
                                "configured CA certificate failed to parse — falling back to system roots"
                            );
                        }
                    }
                }
                Err(e) => {
                    // log-policy: handler-owned
                    tracing::warn!(
                        error = %e,
                        "configured CA certificate file unreadable — falling back to system roots"
                    );
                }
            }
        }

        // mTLS identity: BOTH files must load and parse, or the identity is
        // absent. A partial failure previously meant silently downgrading to
        // non-mTLS — now loud.
        if let (Some(cert_path), Some(key_path)) = (&tls.client_cert_path, &tls.client_key_path) {
            match (std::fs::read(cert_path), std::fs::read(key_path)) {
                (Ok(cert_bytes), Ok(key_bytes)) => {
                    let mut identity_pem = cert_bytes;
                    identity_pem.extend_from_slice(&key_bytes);
                    match reqwest::Identity::from_pem(&identity_pem) {
                        Ok(identity) => {
                            builder = builder.identity(identity);
                        }
                        Err(e) => {
                            // log-policy: handler-owned
                            tracing::warn!(
                                error = %e,
                                "configured mTLS identity failed to parse — client certificate NOT used"
                            );
                        }
                    }
                }
                (cert_r, key_r) => {
                    // log-policy: handler-owned
                    tracing::warn!(
                        cert_ok = cert_r.is_ok(),
                        key_ok = key_r.is_ok(),
                        "configured mTLS cert/key file unreadable — client certificate NOT used"
                    );
                }
            }
        }
    }

    builder
}

/// Bundled-root TLS config for the CA-less-platform fallback (rc-3j4mq):
/// Mozilla's root set from `webpki-roots`, precedent rc-ayy11 (camel-cli
/// redis-tls pure-rust roots).
///
/// Why a preconfigured `rustls::ClientConfig` and not a reqwest root
/// knob: reqwest 0.13 removed `tls_built_in_root_certs` and its
/// webpki-roots feature, `Certificate::from_der` needs full DER
/// certificates while webpki-roots ships pre-parsed `TrustAnchor`s, and
/// `tls_certs_merge` still routes through rustls-platform-verifier
/// (which hard-errors on android/apple targets when extra roots are
/// set). `tls_backend_preconfigured` swaps the whole TLS backend; on
/// reqwest 0.13.4 the preconfigured path builds its connector without
/// consulting platform roots, so the empty-CA-store builder error cannot
/// recur there.
fn webpki_root_client_config() -> rustls::ClientConfig {
    // Mirror reqwest's own provider resolution (async_impl/client.rs):
    // process-default provider when the host installed one (camel-cli
    // installs ring), else the aws-lc-rs default reqwest's `rustls`
    // feature falls back to.
    let provider = rustls::crypto::CryptoProvider::get_default()
        .cloned()
        .unwrap_or_else(|| std::sync::Arc::new(rustls::crypto::aws_lc_rs::default_provider()));
    rustls::ClientConfig::builder_with_provider(provider)
        .with_safe_default_protocol_versions()
        // Stock rustls providers (ring, aws-lc-rs) always support the
        // safe default TLS versions; this config is static, not input- or
        // platform-dependent.
        .expect("stock rustls provider supports the safe default protocol versions") // allow-unwrap
        .with_root_certificates(mozilla_only())
        .with_no_client_auth()
    // No ALPN override: the workspace reqwest builds without the http2
    // feature, so the primary path negotiates plain HTTP/1.1. Sending no
    // ALPN extension yields the same HTTP/1.1 outcome here without
    // duplicating reqwest feature knowledge in this crate.
}

/// Root store for the CA-less-platform fallback that UNIONS the bundled
/// Mozilla anchors with any configured custom CA, instead of the
/// primary path's system-roots-plus-CA scheme (which cannot load on a
/// CA-less platform — that is what triggered the fallback). Order
/// contract: accepted custom anchors come FIRST, then the bundled
/// Mozilla anchors — parity with the primary `add_root_certificate`
/// path's extra-roots-before-platform-roots order (rustls-platform-
/// verifier 0.7.0 `src/verification/others.rs:61-93` adds extra roots
/// before native certs). The no-CA path and the non-strict degrade
/// paths (unreadable file, zero PEM sections, zero roots accepted)
/// return Mozilla-only stores. Strict mode fails closed on every CA
/// load/parse/reject failure; non-strict warns and degrades to
/// Mozilla-only.
fn fallback_root_store(
    custom_ca: Option<&str>,
    strict: bool,
) -> Result<rustls::RootCertStore, CamelError> {
    // Start EMPTY, not Mozilla-seeded: the custom anchors must land
    // before the Mozilla tail, so the bundle is appended only on the
    // success path (and served verbatim by `mozilla_only()` elsewhere).
    // A missed early-return rewrite would otherwise hand back an empty
    // store and break every handshake, which the degrade arms below
    // must never do.
    let mut store = rustls::RootCertStore::empty();
    let Some(ca_path) = custom_ca else {
        return Ok(mozilla_only());
    };
    let ca_bytes = match std::fs::read(ca_path) {
        Ok(bytes) => bytes,
        Err(e) => {
            if strict {
                return Err(CamelError::EndpointCreationFailed(format!(
                    "tls.strict/webpki-fallback: configured CA certificate '{ca_path}' is unreadable: {e}"
                )));
            }
            // log-policy: handler-owned
            tracing::warn!(
                error = %e,
                "configured CA certificate file unreadable — falling back to bundled Mozilla roots"
            );
            return Ok(mozilla_only());
        }
    };
    let certs: Vec<_> = rustls_pemfile::certs(&mut std::io::Cursor::new(&ca_bytes))
        .filter_map(|r| r.ok())
        .collect();
    if certs.is_empty() {
        if strict {
            return Err(CamelError::EndpointCreationFailed(format!(
                "tls.strict/webpki-fallback: configured CA certificate '{ca_path}' has no \
                 parseable PEM CERTIFICATE section"
            )));
        }
        // log-policy: handler-owned
        tracing::warn!(
            "configured CA certificate contains no parseable PEM CERTIFICATE section — \
             falling back to bundled Mozilla roots"
        );
        return Ok(mozilla_only());
    }
    let certs_len = certs.len();
    let (added, _ignored) = store.add_parsable_certificates(certs);
    if added == 0 {
        if strict {
            return Err(CamelError::EndpointCreationFailed(format!(
                "tls.strict/webpki-fallback: configured CA certificate '{ca_path}' was \
                 rejected by the TLS root store (0 of {certs_len} accepted)"
            )));
        }
        // log-policy: handler-owned
        tracing::warn!(
            "configured CA certificate was rejected by the TLS root store — \
             falling back to bundled Mozilla roots"
        );
        return Ok(mozilla_only());
    }
    // Custom anchors first, then the bundled Mozilla anchors — the
    // same extra-roots-before-platform-roots order the primary path
    // produces (rustls-platform-verifier 0.7.0
    // `src/verification/others.rs:61-93`). Order does not affect
    // accept/reject (webpki tries anchors until one validates), so
    // this is parity hygiene, not a security boundary.
    store
        .roots
        .extend_from_slice(webpki_roots::TLS_SERVER_ROOTS);
    Ok(store)
}

/// The bundled Mozilla webpki anchors alone — the no-CA root set, the
/// target of every non-strict degrade path in [`fallback_root_store`],
/// and the root store behind [`webpki_root_client_config`].
fn mozilla_only() -> rustls::RootCertStore {
    rustls::RootCertStore {
        roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
    }
}

/// Server-cert verifier that accepts any certificate without validation
/// — the preconfigured-backend stand-in for reqwest's
/// `danger_accept_invalid_certs(true)` knob (that knob does not exist on
/// the `tls_backend_preconfigured` path). Mirrors reqwest 0.13.4's
/// internal `NoVerifier` exactly, scheme list included.
#[derive(Debug)]
struct NoVerifyServerCertVerifier;

impl rustls::client::danger::ServerCertVerifier for NoVerifyServerCertVerifier {
    fn verify_server_cert(
        &self,
        _end_entity: &rustls::pki_types::CertificateDer<'_>,
        _intermediates: &[rustls::pki_types::CertificateDer<'_>],
        _server_name: &rustls::pki_types::ServerName<'_>,
        _ocsp_response: &[u8],
        _now: rustls::pki_types::UnixTime,
    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
        // danger_accept_invalid_certs parity: no validation whatsoever.
        Ok(rustls::client::danger::ServerCertVerified::assertion())
    }

    fn verify_tls12_signature(
        &self,
        _message: &[u8],
        _cert: &rustls::pki_types::CertificateDer<'_>,
        _dss: &rustls::DigitallySignedStruct,
    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
    }

    fn verify_tls13_signature(
        &self,
        _message: &[u8],
        _cert: &rustls::pki_types::CertificateDer<'_>,
        _dss: &rustls::DigitallySignedStruct,
    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
    }

    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
        // Mirrors reqwest 0.13.4 NoVerifier (src/tls.rs): SHA1-legacy and
        // P-521 included, ED448 included.
        vec![
            rustls::SignatureScheme::RSA_PKCS1_SHA1,
            rustls::SignatureScheme::ECDSA_SHA1_Legacy,
            rustls::SignatureScheme::RSA_PKCS1_SHA256,
            rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
            rustls::SignatureScheme::RSA_PKCS1_SHA384,
            rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
            rustls::SignatureScheme::RSA_PKCS1_SHA512,
            rustls::SignatureScheme::ECDSA_NISTP521_SHA512,
            rustls::SignatureScheme::RSA_PSS_SHA256,
            rustls::SignatureScheme::RSA_PSS_SHA384,
            rustls::SignatureScheme::RSA_PSS_SHA512,
            rustls::SignatureScheme::ED25519,
            rustls::SignatureScheme::ED448,
        ]
    }
}

/// Full rustls `ClientConfig` for the CA-less-platform fallback when the
/// configured TLS material must be honored: custom CA union store
/// (fallback_root_store), optional no-verify mode (insecure /
/// verify_peer=false), and mTLS client auth. Returns `Ok(None)` when the
/// plain `webpki_root_client_config()` suffices (TLS on, no material,
/// verification on) — callers resolve `config.tls` presence before
/// calling. Strict mode fails closed on every material failure;
/// non-strict warns and degrades per item.
fn fallback_client_config(
    tls: &crate::config::TlsConfig,
) -> Result<Option<rustls::ClientConfig>, CamelError> {
    if !tls.enabled {
        return Ok(None);
    }
    let material = tls.ca_cert_path.is_some()
        || tls.client_cert_path.is_some()
        || tls.client_key_path.is_some();
    let verification_disabled = tls.insecure || !tls.verify_peer;
    if !material && !verification_disabled {
        return Ok(None);
    }
    // Mirror reqwest's own provider resolution (async_impl/client.rs):
    // process-default provider when the host installed one (camel-cli
    // installs ring), else the aws-lc-rs default reqwest's `rustls`
    // feature falls back to.
    let provider = rustls::crypto::CryptoProvider::get_default()
        .cloned()
        .unwrap_or_else(|| std::sync::Arc::new(rustls::crypto::aws_lc_rs::default_provider()));
    // Computed ALWAYS: strict material validation must happen even when
    // the danger verifier would bypass the roots; `Err` propagates only
    // under strict by construction of `fallback_root_store`.
    let store = fallback_root_store(tls.ca_cert_path.as_deref(), tls.strict)?;
    let builder = rustls::ClientConfig::builder_with_provider(provider)
        .with_safe_default_protocol_versions()
        // Stock rustls providers (ring, aws-lc-rs) always support the
        // safe default TLS versions; this config is static, not input- or
        // platform-dependent.
        .expect("stock rustls provider supports the safe default protocol versions") // allow-unwrap
        ;
    let builder = if verification_disabled {
        builder
            .dangerous()
            .with_custom_certificate_verifier(std::sync::Arc::new(NoVerifyServerCertVerifier))
    } else {
        builder.with_root_certificates(store)
    };
    let config = match (&tls.client_cert_path, &tls.client_key_path) {
        (Some(cert_path), Some(key_path)) => {
            match (std::fs::read(cert_path), std::fs::read(key_path)) {
                (Ok(cert_bytes), Ok(key_bytes)) => {
                    let chain: Vec<_> =
                        rustls_pemfile::certs(&mut std::io::Cursor::new(&cert_bytes))
                            .filter_map(|r| r.ok())
                            .collect();
                    if chain.is_empty() {
                        if tls.strict {
                            return Err(CamelError::EndpointCreationFailed(format!(
                                "tls.strict/webpki-fallback: configured client certificate \
                                 chain '{cert_path}' has no parseable PEM CERTIFICATE section"
                            )));
                        }
                        // log-policy: handler-owned
                        tracing::warn!(
                            "configured client certificate chain has no parseable PEM \
                             CERTIFICATE section — client certificate NOT used"
                        );
                        builder.with_no_client_auth()
                    } else {
                        match rustls_pemfile::private_key(&mut std::io::Cursor::new(&key_bytes)) {
                            // Clone-on-attempt: rustls consumes the builder
                            // in `with_client_auth_cert`, but a rejection
                            // must fall back to `with_no_client_auth` on
                            // the SAME builder state.
                            Ok(Some(key)) => {
                                match builder.clone().with_client_auth_cert(chain, key) {
                                    Ok(config) => config,
                                    Err(e) => {
                                        if tls.strict {
                                            return Err(CamelError::EndpointCreationFailed(
                                                format!(
                                                    "tls.strict/webpki-fallback: configured mTLS \
                                             identity was rejected by the TLS backend: {e}"
                                                ),
                                            ));
                                        }
                                        // log-policy: handler-owned
                                        tracing::warn!(
                                            error = %e,
                                            "configured mTLS identity was rejected by the TLS \
                                             backend — client certificate NOT used"
                                        );
                                        builder.with_no_client_auth()
                                    }
                                }
                            }
                            // `Ok(None)` (no private-key section) and `Err`
                            // (malformed section) are the same failure for
                            // our purposes: no usable key.
                            Ok(None) | Err(_) => {
                                if tls.strict {
                                    return Err(CamelError::EndpointCreationFailed(format!(
                                        "tls.strict/webpki-fallback: configured client key \
                                         '{key_path}' has no parseable private key section"
                                    )));
                                }
                                // log-policy: handler-owned
                                tracing::warn!(
                                    "configured client key has no parseable private key \
                                     section — client certificate NOT used"
                                );
                                builder.with_no_client_auth()
                            }
                        }
                    }
                }
                (cert_r, key_r) => {
                    if tls.strict {
                        return Err(CamelError::EndpointCreationFailed(
                            "tls.strict/webpki-fallback: configured mTLS cert/key files are \
                             unreadable"
                                .to_string(),
                        ));
                    }
                    // log-policy: handler-owned
                    tracing::warn!(
                        cert_ok = cert_r.is_ok(),
                        key_ok = key_r.is_ok(),
                        "configured mTLS cert/key file unreadable — client certificate NOT used"
                    );
                    builder.with_no_client_auth()
                }
            }
        }
        // Half-configured mTLS pair (cert XOR key) — mirror of
        // strict_tls_error's half-pair rejection.
        (Some(_), None) | (None, Some(_)) => {
            if tls.strict {
                return Err(CamelError::EndpointCreationFailed(
                    "tls.strict/webpki-fallback: mTLS requires BOTH client_cert_path and \
                     client_key_path"
                        .to_string(),
                ));
            }
            // log-policy: handler-owned
            tracing::warn!(
                "mTLS requires BOTH client_cert_path and client_key_path — \
                 client certificate NOT used"
            );
            builder.with_no_client_auth()
        }
        (None, None) => builder.with_no_client_auth(),
    };
    Ok(Some(config))
}

/// Last-resort client for the (unreachable-on-reqwest-0.13.4) second
/// build error inside [`webpki_fallback_client`]: no proxy, no
/// redirects, webpki roots. Reaching the `expect` means the TLS stack
/// is broken process-wide, CA store or not — the caller logs
/// system-broken before delegating here.
fn emergency_webpki_client() -> reqwest::Client {
    reqwest::Client::builder()
        .no_proxy()
        .redirect(reqwest::redirect::Policy::none())
        .tls_backend_preconfigured(webpki_root_client_config())
        .build()
        .expect("preconfigured webpki-rooted client build has no fallible stage") // allow-unwrap
}

/// Why the webpki fallback was entered: a real platform-verifier
/// build failure, or (tests only) a forced entry to exercise the
/// fallback path hermetically on hosts where a valid configured CA
/// rescues the primary verifier (e_glm adjudication, rc-hl9cn).
enum FallbackTrigger {
    Platform(reqwest::Error),
    #[cfg(test)]
    Forced,
}

impl std::fmt::Display for FallbackTrigger {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            // Same rendering as the pre-seam `error = %first_error`
            // field, so operator-facing logs are unchanged.
            FallbackTrigger::Platform(e) => std::fmt::Display::fmt(e, f),
            #[cfg(test)]
            FallbackTrigger::Forced => f.write_str("forced webpki fallback entry (test)"),
        }
    }
}

/// Shared terminal for a failed webpki fallback client rebuild —
/// `build_with_backend`'s `Err` arm and its `cfg(test)` seam twin:
/// always emits the system-broken error line, then fails closed with a
/// typed error under `tls.strict`, or degrades to the material-free
/// [`emergency_webpki_client`] otherwise.
fn fallback_rebuild_failed(
    config: &HttpConfig,
    failure: &dyn std::fmt::Display,
) -> Result<reqwest::Client, CamelError> {
    // log-policy: system-broken
    tracing::error!(
        error = %failure,
        "webpki fallback client build failed — TLS stack broken process-wide"
    );
    if config.tls.as_ref().is_some_and(|tls| tls.strict) {
        Err(CamelError::EndpointCreationFailed(format!(
            "tls.strict/webpki-fallback: webpki fallback client rebuild failed — \
             refusing material-free emergency client under tls.strict: {failure}"
        )))
    } else {
        Ok(emergency_webpki_client())
    }
}

/// Fallback path when the platform-verifier client build fails (typical
/// trigger: a platform without a system CA store at the probed paths,
/// e.g. Android/Termux — the eager `HttpComponent::new()` in the BASE
/// flavor used to panic there, rc-3j4mq). Startup must never panic on
/// CA-less platforms, so the retry swaps the TLS backend for the bundled
/// Mozilla root set — and, unlike the preconfigured backend of old, the
/// retry HONORS the configured TLS material (custom CA union, mTLS
/// identity, no-verify mode) via [`fallback_client_config`]. The
/// fallback is ONLY reachable through a failed primary build (or, under
/// `cfg(test)`, a [`FallbackTrigger::Forced`] seam entry) — it never
/// activates when native roots load.
///
/// `Err` is typed and strict-only by construction: [`fallback_client_config`]
/// fails closed only under `tls.strict`, and the shared second-error
/// rebuild terminal ([`fallback_rebuild_failed`]) fails closed the same
/// way — so a permissive config always leaves here with a built
/// (possibly item-downgraded, possibly material-free emergency) client.
fn webpki_fallback_client(
    config: &HttpConfig,
    resolve_override: Option<(&str, &[std::net::SocketAddr])>,
    trigger: FallbackTrigger,
) -> Result<reqwest::Client, CamelError> {
    #[cfg(test)]
    BUILD_CLIENT_FALLBACKS.with(|c| c.set(c.get() + 1));

    // log-policy: handler-owned
    tracing::warn!(
        error = %trigger,
        "HTTP client build failed on platform TLS roots — the platform CA store \
         is missing or unreadable (typical on Android/Termux). Retrying with \
         bundled Mozilla root certificates; platform trust settings do not \
         apply to this client"
    );

    // Shared second-error terminal: unreachable on reqwest 0.13.4 (the
    // preconfigured backend has no fallible stage — no platform
    // verifier, no root-store parse — unless the http3 feature is on,
    // which this workspace does not enable). Kept as an honest,
    // loudly-logged terminal instead of silently re-panicking: reaching
    // it means the TLS stack is broken process-wide, CA store or not.
    // Strict-fail-closed: under `tls.strict` the rebuild failure is a
    // typed `Err` (`fallback_rebuild_failed`); non-strict keeps the
    // material-free emergency-client degrade. The `cfg(test)` seam in
    // the `Ok` arm routes the forced-rebuild-failure twin through the
    // same terminal so both outcomes stay test-hermetic.
    let build_with_backend =
        |backend: rustls::ClientConfig| -> Result<reqwest::Client, CamelError> {
            match client_builder(config, resolve_override)
                .tls_backend_preconfigured(backend)
                .build()
            {
                Ok(client) => {
                    #[cfg(test)]
                    if FORCE_FALLBACK_REBUILD_FAIL.with(std::cell::Cell::get) {
                        return fallback_rebuild_failed(
                            config,
                            &"forced webpki fallback rebuild failure (test)",
                        );
                    }
                    Ok(client)
                }
                Err(second_error) => fallback_rebuild_failed(config, &second_error),
            }
        };

    // The strict carry note is accurate only when material is actually
    // configured: in the strict + insecure/verify_peer=false + zero-material
    // corner the fallback config exists solely for the danger verifier and
    // carries nothing.
    let material_configured = config.tls.as_ref().is_some_and(|tls| {
        tls.ca_cert_path.is_some()
            || tls.client_cert_path.is_some()
            || tls.client_key_path.is_some()
    });

    match config.tls.as_ref().map(fallback_client_config) {
        // No TLS config, TLS off, or verification-on with no material:
        // the plain webpki-rooted backend is the parity configuration.
        None | Some(Ok(None)) => build_with_backend(webpki_root_client_config()),
        Some(Ok(Some(strict_or_parity_config))) => {
            if material_configured && config.tls.as_ref().is_some_and(|tls| tls.strict) {
                // log-policy: handler-owned
                tracing::info!(
                    "platform CA store unavailable — webpki fallback carries \
                     configured TLS material"
                );
            }
            build_with_backend(strict_or_parity_config)
        }
        // Typed fail-closed conflict (strict-only by construction).
        Some(Err(e)) => Err(e),
    }
}

/// Build the shared/dns-pinned reqwest client. Primary path is the
/// platform verifier; on a platform whose CA store cannot be loaded the
/// build retries on bundled Mozilla roots honoring the configured TLS
/// material (see [`webpki_fallback_client`]) instead of panicking
/// (rc-3j4mq). `Err` is strict-only by construction: it means the
/// configured CA/mTLS material failed to load under `tls.strict`, or —
/// in the broken-TLS-stack corner — the webpki fallback client rebuild
/// failed under `tls.strict`, and the caller must fail closed rather
/// than serve with a degraded client.
pub(crate) fn build_client(
    config: &HttpConfig,
    resolve_override: Option<(&str, &[std::net::SocketAddr])>,
) -> Result<reqwest::Client, CamelError> {
    #[cfg(test)]
    BUILD_CLIENT_CALLS.with(|c| c.set(c.get() + 1));

    // Test seam (e_glm adjudication, rc-hl9cn): on hosts where a valid
    // configured CA rescues the primary verifier build
    // (rustls-platform-verifier merges extra roots first), the fallback
    // path with VALID material is unreachable through real triggers;
    // armed tests enter the fallback directly. Release builds are
    // unchanged.
    #[cfg(test)]
    if FORCE_WEBPKI_FALLBACK.with(std::cell::Cell::get) {
        return webpki_fallback_client(config, resolve_override, FallbackTrigger::Forced);
    }

    match client_builder(config, resolve_override).build() {
        Ok(client) => Ok(client),
        Err(first_error) => webpki_fallback_client(
            config,
            resolve_override,
            FallbackTrigger::Platform(first_error),
        ),
    }
}

/// Eagerly load and parse the configured TLS material when strict mode is
/// on (audit 2026-08-31 R3 / rc-ayrwk). Returns the first failure as an
/// `EndpointCreationFailed` error; `None` when the material loads, or when
/// strict mode is off (the permissive F2-7 fallback with its loud warns
/// stays the default for back-compat).
///
/// Mirrors the four load sites in [`build_client`]: CA unreadable, CA
/// unparseable, mTLS cert/key unreadable, mTLS identity unparseable.
fn strict_tls_error(config: &HttpConfig) -> Option<CamelError> {
    let tls = config.tls.as_ref()?;
    if !tls.enabled || !tls.strict {
        return None;
    }
    if let Some(ca_path) = &tls.ca_cert_path {
        match std::fs::read(ca_path) {
            Ok(ca_bytes) => {
                // `reqwest::Certificate::{from_pem,from_der}` defer parsing
                // under rustls, and unparseable entries are silently
                // skipped at client build — so strict validation must be
                // eager AND match what the backend actually enforces:
                // a PEM bundle with at least one parseable CERTIFICATE
                // section (rustls-pemfile). A raw-DER file is rejected
                // outright: the rustls backend never honors lone-DER
                // bytes here (they wrap unvalidated and are dropped at
                // root-store insertion), so certifying one under strict
                // would certify an unenforced config (e_glm stage-4
                // finding 1). Operators convert DER bundles to PEM.
                let pem_sections = rustls_pemfile::certs(&mut std::io::Cursor::new(&ca_bytes))
                    .filter(|r| r.is_ok())
                    .count();
                if pem_sections == 0 {
                    return Some(CamelError::EndpointCreationFailed(format!(
                        "tls.strict: configured CA certificate '{ca_path}' has no \
                         parseable PEM CERTIFICATE section (DER bundles are not \
                         enforced by the TLS backend — convert to PEM)"
                    )));
                }
            }
            Err(e) => {
                return Some(CamelError::EndpointCreationFailed(format!(
                    "tls.strict: configured CA certificate '{ca_path}' is unreadable: {e}"
                )));
            }
        }
    }
    // A half-configured mTLS pair (cert XOR key) previously degraded
    // silently to non-mTLS even under strict — reject it (e_glm stage-4
    // finding 2).
    if tls.client_cert_path.is_some() != tls.client_key_path.is_some() {
        return Some(CamelError::EndpointCreationFailed(
            "tls.strict: mTLS requires BOTH client_cert_path and client_key_path".to_string(),
        ));
    }
    if let (Some(cert_path), Some(key_path)) = (&tls.client_cert_path, &tls.client_key_path) {
        match (std::fs::read(cert_path), std::fs::read(key_path)) {
            (Ok(mut cert_bytes), Ok(key_bytes)) => {
                cert_bytes.extend_from_slice(&key_bytes);
                if reqwest::Identity::from_pem(&cert_bytes).is_err() {
                    return Some(CamelError::EndpointCreationFailed(
                        "tls.strict: configured mTLS identity failed to parse".to_string(),
                    ));
                }
            }
            _ => {
                return Some(CamelError::EndpointCreationFailed(
                    "tls.strict: configured mTLS cert/key files are unreadable".to_string(),
                ));
            }
        }
    }
    None
}

#[cfg(test)]
pub(crate) fn build_client_call_count() -> u64 {
    BUILD_CLIENT_CALLS.with(|c| c.get())
}

#[cfg(test)]
pub(crate) fn build_client_fallback_count() -> u64 {
    BUILD_CLIENT_FALLBACKS.with(|c| c.get())
}

/// Shared constructor fold: build the client, or — when the strict
/// webpki fallback fails closed — pair an emergency webpki client
/// (never issues a request; `create_endpoint` fails first via the
/// folded error) with the typed build error (rc-hl9cn).
fn client_or_emergency(config: &HttpConfig) -> (reqwest::Client, Option<CamelError>) {
    match build_client(config, None) {
        Ok(c) => (c, None),
        Err(e) => (emergency_webpki_client(), Some(e)),
    }
}

impl HttpComponent {
    pub fn new() -> Self {
        let config = HttpConfig::default();
        let strict_err = strict_tls_error(&config);
        let (client, build_err) = client_or_emergency(&config);
        Self {
            client,
            config,
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            strict_tls_error: strict_err.or(build_err),
        }
    }

    pub fn with_config(config: HttpConfig) -> Self {
        let strict_err = strict_tls_error(&config);
        let (client, build_err) = client_or_emergency(&config);
        Self {
            client,
            config,
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            strict_tls_error: strict_err.or(build_err),
        }
    }

    pub fn with_optional_config(config: Option<HttpConfig>) -> Self {
        match config {
            Some(cfg) => Self::with_config(cfg),
            None => Self::new(),
        }
    }
}

impl Default for HttpComponent {
    fn default() -> Self {
        Self::new()
    }
}

impl Component for HttpComponent {
    fn scheme(&self) -> &str {
        "http"
    }

    fn metadata(&self) -> ComponentMetadata {
        HttpEndpointConfig::metadata()
    }

    fn create_endpoint(
        &self,
        uri: &str,
        ctx: &dyn camel_component_api::ComponentContext,
    ) -> Result<Box<dyn Endpoint>, CamelError> {
        if let Some(err) = &self.strict_tls_error {
            return Err(err.clone());
        }
        self.config.validate()?;
        let config = HttpEndpointConfig::from_uri_with_defaults(uri, &self.config)?;
        let server_config = HttpServerConfig::from_uri_with_defaults(uri, &self.config)?;
        ctx.register_current_route_health_check(Arc::new(HttpHealthCheck::new(
            server_config.host.clone(),
            server_config.port,
        )));
        self.pinned_cache
            .wire(HttpComponentKind::Http, ctx.metrics());
        Ok(Box::new(HttpEndpoint {
            uri: uri.to_string(),
            config,
            server_config,
            client: self.client.clone(),
            pinned_cache: std::sync::Arc::clone(&self.pinned_cache),
            http_config: self.config.clone(),
        }))
    }
}

pub struct HttpsComponent {
    config: HttpConfig,
    pinned_cache: std::sync::Arc<PinnedClientCache>,
    client: reqwest::Client,
    /// Set at construction when `tls.strict` is on and the configured
    /// material fails to load; surfaced as an endpoint-creation failure
    /// (rc-ayrwk).
    strict_tls_error: Option<CamelError>,
}

impl HttpsComponent {
    pub fn new() -> Self {
        let config = HttpConfig::default();
        let strict_err = strict_tls_error(&config);
        let (client, build_err) = client_or_emergency(&config);
        Self {
            client,
            config,
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            strict_tls_error: strict_err.or(build_err),
        }
    }

    pub fn with_config(config: HttpConfig) -> Self {
        let strict_err = strict_tls_error(&config);
        let (client, build_err) = client_or_emergency(&config);
        Self {
            client,
            config,
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            strict_tls_error: strict_err.or(build_err),
        }
    }

    pub fn with_optional_config(config: Option<HttpConfig>) -> Self {
        match config {
            Some(cfg) => Self::with_config(cfg),
            None => Self::new(),
        }
    }
}

impl Default for HttpsComponent {
    fn default() -> Self {
        Self::new()
    }
}

impl Component for HttpsComponent {
    fn scheme(&self) -> &str {
        "https"
    }

    fn metadata(&self) -> ComponentMetadata {
        // HTTPS shares the same URI option surface and capabilities as HTTP.
        // Only the scheme and description differ.
        let mut meta = HttpEndpointConfig::metadata();
        meta.scheme = "https".to_string();
        meta.description = "HTTPS client and server component (TLS over HTTP)".to_string();
        meta
    }

    fn create_endpoint(
        &self,
        uri: &str,
        ctx: &dyn camel_component_api::ComponentContext,
    ) -> Result<Box<dyn Endpoint>, CamelError> {
        if let Some(err) = &self.strict_tls_error {
            return Err(err.clone());
        }
        self.config.validate()?;
        let config = HttpEndpointConfig::from_uri_with_defaults(uri, &self.config)?;
        let server_config = HttpServerConfig::from_uri_with_defaults(uri, &self.config)?;
        ctx.register_current_route_health_check(Arc::new(HttpHealthCheck::new(
            server_config.host.clone(),
            server_config.port,
        )));
        self.pinned_cache
            .wire(HttpComponentKind::Https, ctx.metrics());
        Ok(Box::new(HttpEndpoint {
            uri: uri.to_string(),
            config,
            server_config,
            client: self.client.clone(),
            pinned_cache: std::sync::Arc::clone(&self.pinned_cache),
            http_config: self.config.clone(),
        }))
    }
}

// ---------------------------------------------------------------------------
// HttpEndpoint
// ---------------------------------------------------------------------------

struct HttpEndpoint {
    uri: String,
    config: HttpEndpointConfig,
    server_config: HttpServerConfig,
    client: reqwest::Client,
    pinned_cache: std::sync::Arc<PinnedClientCache>,
    http_config: HttpConfig,
}

impl Endpoint for HttpEndpoint {
    fn uri(&self) -> &str {
        &self.uri
    }

    fn create_consumer(
        &self,
        rt: Arc<dyn camel_component_api::RuntimeObservability>,
    ) -> Result<Box<dyn Consumer>, CamelError> {
        // Scheme/config consistency check (spec §5) — uses parsed scheme
        // from HttpServerConfig, not a fragile port-443 heuristic.
        let scheme_is_https = self.server_config.scheme == "https";
        let has_tls = self.server_config.tls_config.is_some();

        if scheme_is_https && !has_tls {
            return Err(CamelError::EndpointCreationFailed(
                "https:// consumer requires tlsCert and tlsKey parameters".to_string(),
            ));
        }
        if !scheme_is_https && has_tls {
            return Err(CamelError::EndpointCreationFailed(
                "http:// is incompatible with tlsCert/tlsKey — use https:// for TLS".to_string(),
            ));
        }
        // bd rc-ns3yc: fail-closed BEFORE any HttpConsumer is constructed —
        // a directly-built HttpServerConfig never passed the parse seam, and
        // the inflight semaphore panics above the primitive bound
        // (mirror of grpc consumer_concurrency_limit, commit 101327e5).
        max_inflight_requests_limit(self.server_config.max_inflight_requests)?;
        Ok(Box::new(HttpConsumer::new(self.server_config.clone(), rt)))
    }

    fn create_producer(
        &self,
        rt: Arc<dyn camel_component_api::RuntimeObservability>,
        _ctx: &ProducerContext,
    ) -> Result<BoxProcessor, CamelError> {
        let producer = HttpProducer {
            config: Arc::new(self.config.clone()),
            client: self.client.clone(),
            pinned_cache: std::sync::Arc::clone(&self.pinned_cache),
            http_config: Arc::new(self.http_config.clone()),
            runtime: rt,
        };
        if let Some(ref provider) = self.config.token_provider {
            let layer = BearerTokenLayer::new(Arc::clone(provider));
            Ok(BoxProcessor::new(layer.layer(producer)))
        } else {
            Ok(BoxProcessor::new(producer))
        }
    }
}

// ---------------------------------------------------------------------------
// HttpProducer
// ---------------------------------------------------------------------------

#[derive(Clone)]
struct HttpProducer {
    config: Arc<HttpEndpointConfig>,
    client: reqwest::Client,
    pinned_cache: std::sync::Arc<PinnedClientCache>,
    http_config: Arc<HttpConfig>,
    /// Runtime observability handle powering the component-ops facade at
    /// the request boundary (`("http","request")`, dashboard-observability
    /// Task 4.3). The retained `e:http:accept*` labels are consumer-side
    /// (server accept loop) — different boundary, no collision with
    /// `e:http:request`.
    runtime: Arc<dyn RuntimeObservability>,
}

impl HttpProducer {
    fn resolve_method(exchange: &Exchange, config: &HttpEndpointConfig) -> String {
        if let Some(ref method) = config.http_method {
            return method.to_uppercase();
        }
        if let Some(method) = exchange
            .input
            .header("CamelHttpMethod")
            .and_then(|v| v.as_str())
        {
            return method.to_uppercase();
        }
        if !exchange.input.body.is_empty() {
            return "POST".to_string();
        }
        "GET".to_string()
    }

    fn resolve_url(exchange: &Exchange, config: &HttpEndpointConfig) -> Result<String, CamelError> {
        // bridgeEndpoint=true: exchange URL headers (CamelHttpUri,
        // CamelHttpPath, CamelHttpQuery) are ignored per Apache Camel
        // bridging semantics. The endpoint's own query still rides: the
        // same raw-preserving, consumed-option-filtered query as the
        // non-bridge path (bridgeEndpoint itself is a consumed option),
        // with programmatic query_params appending absent keys after the
        // raw base. This check MUST come before the CamelHttpUri override
        // so bridging wins over that header.
        if config.bridge_endpoint {
            let Some(query) = resolve_endpoint_query(config)? else {
                return Ok(config.base_url.clone());
            };
            // Validation only (rc-ph7z2): a malformed base still errors
            // through the redacted-diagnostic path below. The parsed value
            // is NEVER re-emitted — assembly is verbatim string
            // composition, authored bytes end-to-end: no WHATWG
            // normalization (dot-segment collapse, default-port strip,
            // scheme/host lowercasing), matching every other arm (Papal
            // Direction A).
            let _: url::Url = url::Url::parse(&config.base_url).map_err(|e| {
                CamelError::ProcessorError(format!(
                    "invalid base URL '{}': {e}",
                    redact_url_for_diagnostics(&config.base_url)
                ))
            })?;
            let mut url = config.base_url.clone();
            url.push('?');
            url.push_str(&query);
            return Ok(url);
        }

        if let Some(uri) = exchange
            .input
            .header("CamelHttpUri")
            .and_then(|v| v.as_str())
        {
            // Host fence (allowedUriHosts): opt-in, fail-closed. Evaluated
            // on the raw override before any path/query assembly; a
            // rejection renders the URL only through the diagnostics
            // redaction path (ADR-0051).
            if let Some(fence) = &config.allowed_uri_hosts
                && !uri_host_allowed(uri, fence)?
            {
                return Err(CamelError::ProcessorError(format!(
                    "CamelHttpUri host not allowed by allowedUriHosts fence: {}",
                    redact_url_for_diagnostics(uri)
                )));
            }
            // The override replaces the base URL; its own query is the
            // higher-precedence source for composition (ADR-0071) — the
            // endpoint base query does not ride an override. Split at the
            // first `?` so CamelHttpPath applies to the path component
            // and the queries merge at pair level, never a second `?`
            // marker.
            let (base, override_query) = match uri.split_once('?') {
                Some((base, query)) => (base, Some(query)),
                None => (uri, None),
            };
            // Resolve-time span validation for the override URI's own query
            // (rc-m4xk1): a forbidden byte is a resolve error naming the
            // byte, never a verbatim ride that later surfaces as a reqwest
            // send error. Covers both downstream arms — the verbatim push
            // and merge_header_query, which validates only the header side.
            if let Some(query) = override_query {
                for (_key, span) in raw_query_pairs(query)? {
                    validate_raw_query_span(span)?;
                }
            }
            let mut url = base.to_string();
            if let Some(path) = exchange
                .input
                .header("CamelHttpPath")
                .and_then(|v| v.as_str())
            {
                if !url.ends_with('/') && !path.starts_with('/') {
                    url.push('/');
                }
                url.push_str(path);
            }
            if let Some(query) = exchange
                .input
                .header("CamelHttpQuery")
                .and_then(|v| v.as_str())
            {
                if let Some(merged) = merge_header_query(override_query, query)? {
                    url.push('?');
                    url.push_str(&merged);
                }
                return Ok(url);
            }
            if let Some(query) = override_query {
                url.push('?');
                url.push_str(query);
            }
            return Ok(url);
        }

        let mut url = config.base_url.clone();

        if let Some(path) = exchange
            .input
            .header("CamelHttpPath")
            .and_then(|v| v.as_str())
        {
            if !url.ends_with('/') && !path.starts_with('/') {
                url.push('/');
            }
            url.push_str(path);
        }

        if let Some(query) = exchange
            .input
            .header("CamelHttpQuery")
            .and_then(|v| v.as_str())
        {
            // Compose: the endpoint query (raw-preserving,
            // consumed-option-filtered) comes first and wins collisions;
            // header pairs append verbatim for absent keys (ADR-0071).
            // An empty header leaves the endpoint query unchanged.
            if let Some(merged) =
                merge_header_query(resolve_endpoint_query(config)?.as_deref(), query)?
            {
                url.push('?');
                url.push_str(&merged);
            }
            return Ok(url);
        }

        if let Some(query) = resolve_endpoint_query(config)? {
            url.push('?');
            url.push_str(&query);
        }

        Ok(url)
    }

    fn is_ok_status(status: u16, range: (u16, u16)) -> bool {
        status >= range.0 && status <= range.1
    }
}

/// One allowlist entry of the `CamelHttpUri` host fence (`allowedUriHosts`
/// endpoint option). DNS hosts are stored ASCII-lowercased; IPv6 literals
/// in bracketed canonical form (the `url` crate's host serialization). A
/// `port` of `None` is a host-only entry and permits any port.
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct AllowedUriHost {
    /// Canonical host: lowercased DNS name or bracketed IPv6 literal.
    pub host: String,
    /// `Some` pins the entry to one effective port; `None` permits any.
    pub port: Option<u16>,
}

/// Parse the `allowedUriHosts` option value: comma-separated `host` or
/// `host:port` entries. Bracketed IPv6 is supported (`[::1]:8443`, bare
/// `[::1]` host-only). Empty segments are dropped. Segments are parsed
/// through the `url` crate (with an `http://` scheme injected) so DNS
/// names are lowercased and ports range-checked; anything it rejects is a
/// malformed entry. A value yielding zero valid entries is also an error.
/// Both failure modes fail endpoint creation (fail-closed).
fn parse_allowed_uri_hosts(raw: &str) -> Result<Vec<AllowedUriHost>, CamelError> {
    let mut entries = Vec::new();
    for segment in raw.split(',') {
        let segment = segment.trim();
        if segment.is_empty() {
            continue;
        }
        let parsed = url::Url::parse(&format!("http://{segment}"))
            .map_err(|_| invalid_allowed_uri_host_entry(segment))?;
        // A segment carrying a path or userinfo is a typo'd entry — the
        // spec's "any other malformed entry" clause. Silently narrowing it
        // to its hostname would widen or skew the fence.
        if parsed.path() != "/" || !parsed.username().is_empty() || parsed.password().is_some() {
            return Err(invalid_allowed_uri_host_entry(segment));
        }
        let Some(host) = parsed.host_str() else {
            return Err(invalid_allowed_uri_host_entry(segment));
        };
        entries.push(AllowedUriHost {
            host: host.to_string(),
            port: parsed.port(),
        });
    }
    if entries.is_empty() {
        return Err(CamelError::InvalidUri(
            "allowedUriHosts declares no valid host entries".to_string(),
        ));
    }
    Ok(entries)
}

fn invalid_allowed_uri_host_entry(segment: &str) -> CamelError {
    CamelError::InvalidUri(format!("invalid allowedUriHosts entry '{segment}'"))
}

/// Whether `url_str` matches the fence. Parse failure or a host-less URL
/// is fail-closed (`Ok(false)`). DNS hosts compare case-insensitively
/// (both sides are lowercased by the `url` crate); IPv6 compares in
/// bracketed canonical form. A host-only entry permits any port; a
/// `host:port` entry matches only the effective port — the explicit port
/// or the scheme default (443 for https, 80 for http).
pub(crate) fn uri_host_allowed(
    url_str: &str,
    fence: &[AllowedUriHost],
) -> Result<bool, CamelError> {
    let Ok(parsed) = url::Url::parse(url_str) else {
        return Ok(false);
    };
    let Some(host) = parsed.host_str() else {
        return Ok(false);
    };
    let effective_port = parsed.port().or(match parsed.scheme() {
        "https" => Some(443_u16),
        "http" => Some(80),
        _ => None,
    });
    Ok(fence.iter().any(|entry| {
        entry.host == host
            && match entry.port {
                None => true,
                Some(port) => effective_port == Some(port),
            }
    }))
}

/// Serialize the outbound query for the endpoint base.
///
/// Authored raw pairs come first, byte-for-byte minus consumed option keys
/// (order, separators and authored escapes — including `RAW(...)` text —
/// preserved); then programmatic `query_params` entries whose key is absent
/// from the authored pairs, in declaration order with minimal RFC-3986
/// encoding (`%20`, never `+`). Authored keys always win — no duplication,
/// no override.
///
/// Returns `Ok(None)` when no query component is emitted: no pairs at all,
/// or a non-empty raw query whose every pair was consumed. A bare `?`
/// marker (`raw_query == Some("")`) always emits the query component.
fn resolve_endpoint_query(config: &HttpEndpointConfig) -> Result<Option<String>, CamelError> {
    let mut parts: Vec<String> = Vec::new();
    let mut authored_keys = std::collections::HashSet::new();

    if let Some(raw) = config.raw_query.as_deref() {
        for (key, span) in raw_query_pairs(raw)? {
            authored_keys.insert(key.clone());
            if is_consumed_option(&key) {
                continue;
            }
            validate_raw_query_span(span)?;
            parts.push(span.to_string());
        }
    }

    for (key, value) in &config.query_params {
        if !authored_keys.contains(key.as_str()) {
            parts.push(format!(
                "{}={}",
                encode_query_component(key),
                encode_query_component(value)
            ));
        }
    }

    if parts.is_empty() && config.raw_query.as_deref() != Some("") {
        return Ok(None);
    }
    Ok(Some(parts.join("&")))
}

/// Compose the outbound query when a `CamelHttpQuery` exchange header is
/// present (ADR-0071). `higher_precedence` — the endpoint query in the
/// base arm, the override URI's own query in the override arm — comes
/// first and wins any key collision; header pairs append verbatim for
/// absent keys only. An empty header leaves the higher-precedence query
/// unchanged (no additional `?` marker). Header spans are validated, not
/// re-encoded: a byte forbidden in a query component is a resolve error
/// naming the byte (Wave-A law).
fn merge_header_query(
    higher_precedence: Option<&str>,
    header_query: &str,
) -> Result<Option<String>, CamelError> {
    if header_query.is_empty() {
        return Ok(higher_precedence.map(str::to_string));
    }
    let mut parts: Vec<String> = Vec::new();
    let mut higher_keys = std::collections::HashSet::new();
    for (key, span) in raw_query_pairs(higher_precedence.unwrap_or(""))? {
        higher_keys.insert(key);
        parts.push(span.to_string());
    }
    for (key, span) in raw_query_pairs(header_query)? {
        validate_raw_query_span(span)?;
        if !higher_keys.contains(key.as_str()) {
            parts.push(span.to_string());
        }
    }
    if parts.is_empty() {
        return Ok(None);
    }
    Ok(Some(parts.join("&")))
}

/// Bytes that may appear unescaped in a URI query component. RFC 3986
/// (`query = *( pchar / "/" / "?" )`) admits unreserved, sub-delims, `:`,
/// `@`, `/`, `?`, and `%` — with ONE deliberate exclusion from the RFC set:
/// the apostrophe (`'`, 0x27). reqwest's WHATWG URL parser re-encodes 0x27
/// to `%27` in the special-query percent-encode set (http/https), so an
/// authored apostrophe can never ride the wire verbatim; admitting it would
/// silently normalize authored bytes (rc-nmupb). Authors write `%27`
/// explicitly when they mean the byte on the wire. The WHATWG set's other
/// extras (`"`, `` ` ``, `<`, `>`) are already rejected here — they are not
/// RFC 3986 query-legal bytes, so no special exclusion is needed for them.
fn is_legal_query_byte(byte: u8) -> bool {
    matches!(byte,
        b'0'..=b'9' | b'A'..=b'Z' | b'a'..=b'z'
        | b'-' | b'.' | b'_' | b'~'
        | b'!' | b'$' | b'&' | b'(' | b')' | b'*' | b'+' | b',' | b';' | b'='
        | b':' | b'@' | b'/' | b'?'
        | b'%')
}

/// Reject an authored raw pair carrying a byte that is not legal in a query
/// component (e.g. literal space, `#`, non-ASCII). The serializer never
/// silently re-encodes operator-authored bytes: "byte-for-byte" is bounded
/// to wire-legal bytes, and the check fires before the resolved string
/// reaches any consumer (SSRF pre-check, diagnostics redaction).
fn validate_raw_query_span(span: &str) -> Result<(), CamelError> {
    for &byte in span.as_bytes() {
        if !is_legal_query_byte(byte) {
            return Err(CamelError::ProcessorError(format!(
                "raw query pair '{span}' contains byte 0x{byte:02X}, which is not legal in a URL query component"
            )));
        }
    }
    Ok(())
}

/// Minimal RFC-3986 percent-encoding for one programmatic query component:
/// unreserved bytes pass through, every other byte encodes as uppercase
/// hex. A space encodes as `%20`, never `+`.
fn encode_query_component(component: &str) -> String {
    const HEX: &[u8; 16] = b"0123456789ABCDEF";
    let mut out = String::with_capacity(component.len());
    for &byte in component.as_bytes() {
        match byte {
            b'0'..=b'9' | b'A'..=b'Z' | b'a'..=b'z' | b'-' | b'.' | b'_' | b'~' => {
                out.push(byte as char);
            }
            _ => {
                out.push('%');
                out.push(HEX[(byte >> 4) as usize] as char);
                out.push(HEX[(byte & 0x0f) as usize] as char);
            }
        }
    }
    out
}

/// Redact credentials from a URL before it reaches logs or error values
/// (ADR-0051 redact-by-construction). Masks userinfo (`user:pass@`) and
/// the query string (which commonly carries API keys/tokens). Host and
/// path stay visible for diagnosability. Fragments are never echoed: a
/// fragment (OAuth2 callback tokens such as `#access_token=...`) is
/// dropped and replaced with the `#[redacted]` sentinel in both the
/// parsed arm and the unparseable arm. Fail-closed: when the parse fails
/// and any authority window contains `@`, only the `[redacted]`
/// sentinel is returned. Every authority window is scanned: windows are
/// enumerated over maximal runs of `/` and `\` — pure-slash runs of two
/// or more characters, backslash-bearing runs only behind an RFC 3986
/// scheme prefix (see [`camel_api::redact`] for the canonical window
/// rule) — each window starts immediately after the run (so evaders like
/// `scheme:////user:pass@evil/` cannot hide a `@` behind a slash run)
/// and ends at the next `/`, `?`, or `#`; scanning all windows keeps
/// later `//user:pass@` substrings from hiding behind a benign first
/// window.
///
/// The parsed arm keeps `url::Url::parse` (the authority can only be
/// judged by the parser) and masks the real authority accessors, then
/// delegates wholesale to the canonical string surgery in
/// [`camel_api::redact::redact_url`]: rust-url can park later-window
/// userinfo bytes in the path (`https://h//user:pass@evil/`), and the
/// canonical helper owns window masking, `?`/`#` sentinel composition
/// (one per distinct introducer, first-occurrence order), and the
/// 256-byte UTF-8 cap. The unparseable arm delegates to
/// [`camel_api::redact::redact_url_fail_closed`].
pub(crate) fn redact_url_for_diagnostics(raw: &str) -> String {
    match url::Url::parse(raw) {
        Ok(mut u) => {
            // Fail closed when an authority marker was accepted but no
            // host was stored: userinfo-shaped bytes can hide in the path
            // behind the marker, and empty-host schemes (`file:///us@r/x`,
            // `unix:///@socket`) can put a `@` in that window too. Such
            // inputs are sentineled wholesale — deliberate fail-closed
            // over-redaction per ADR-0051.
            if !u.cannot_be_a_base()
                && u.host_str().is_none()
                && camel_api::redact::window_has_at_sign(raw)
            {
                return "[redacted]".to_string();
            }
            if !u.username().is_empty() || u.password().is_some() {
                let _ = u.set_username("***");
                let _ = u.set_password(None);
            }
            // Query and fragment stay on the rendered URL; the canonical
            // redactor drops them and composes the sentinels.
            let s = u.to_string();
            camel_api::redact::redact_url(&s)
        }
        Err(_) => camel_api::redact::redact_url_fail_closed(raw),
    }
}

/// Maximum bytes of an upstream error response body embedded into
/// `CamelError::HttpOperationFailed`. The body is attacker-controllable (a
/// malicious or compromised upstream), so it is truncated and lossy-decoded to
/// bound log injection / DLQ payload size.
const MAX_ERROR_RESPONSE_BODY_BYTES: usize = 4096;

fn truncate_error_body(body: &[u8]) -> String {
    if body.len() <= MAX_ERROR_RESPONSE_BODY_BYTES {
        String::from_utf8_lossy(body).into_owned()
    } else {
        let mut s = String::from_utf8_lossy(&body[..MAX_ERROR_RESPONSE_BODY_BYTES]).into_owned();
        s.push_str("...[truncated]");
        s
    }
}

impl HttpProducer {
    /// Whether the HTTP method is entity-enclosing (may carry a request
    /// body). Follows Apache Camel's `HttpMethods` set: POST, PUT, PATCH are
    /// entity-enclosing; GET, HEAD, DELETE, OPTIONS, TRACE are not (RFC 9110
    /// §9.3.1/§9.3.2).
    fn is_entity_enclosing(method: &str) -> bool {
        matches!(method, "POST" | "PUT" | "PATCH")
    }
}

impl Service<Exchange> for HttpProducer {
    type Response = Exchange;
    type Error = CamelError;
    type Future = Pin<Box<dyn Future<Output = Result<Exchange, CamelError>> + Send>>;

    fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
        Poll::Ready(Ok(()))
    }

    fn call(&mut self, exchange: Exchange) -> Self::Future {
        let config = self.config.clone();
        let shared_client = self.client.clone();
        let pinned_cache = std::sync::Arc::clone(&self.pinned_cache);
        let http_config = self.http_config.clone();
        let component_metrics = self.runtime.component_metrics();

        Box::pin(async move {
            let mut exchange = exchange;
            let outcome = async {
                let method_str = HttpProducer::resolve_method(&exchange, &config);
                // Entity-enclosing gate (RFC 9110 §9.3.1/§9.3.2): only POST, PUT
                // and PATCH may carry a request body. Any other resolved method
                // drops the exchange body before the request is built (Apache
                // Camel `HttpMethods` parity).
                let suppress_body = !HttpProducer::is_entity_enclosing(&method_str);
                let url = HttpProducer::resolve_url(&exchange, &config)?;

                // SECURITY: Validate URL for SSRF
                ssrf::validate_url_for_ssrf(&url, &config)?;

                // Resolve hostname and pin validated IPs to prevent DNS-rebinding TOCTOU
                // (L-H2). When the URL uses a domain name and SSRF protection is active,
                // reuse the endpoint's cached DNS-pinned client for that validated
                // (host, addrs) pair — built once with resolve_to_addrs, then shared so
                // repeated requests keep one connection pool without re-resolving DNS.
                // Per-request SSRF validation and DNS pinning are unchanged. IP-literal
                // URLs use the endpoint's unpinned shared client.
                let resolved = ssrf::resolve_initial_url_for_ssrf(
                    &url,
                    config.allow_internal,
                    config.allow_cleartext,
                )
                .await?;
                let client: reqwest::Client = if let Some((ref host, ref addrs)) = resolved {
                    // A failed pinned build (strict fail-closed material
                    // conflict) propagates into the request error path —
                    // no degraded client is built or served.
                    pinned_cache
                        .get_or_build(host.as_str(), addrs, || {
                            build_client(&http_config, Some((host.as_str(), addrs)))
                        })
                        .await?
                } else {
                    shared_client.clone()
                };

                debug!(
                    correlation_id = %exchange.correlation_id(),
                    method = %method_str,
                    url = %redact_url_for_diagnostics(&url),
                    "HTTP request"
                );

                let method = method_str.parse::<reqwest::Method>().map_err(|e| {
                    CamelError::ProcessorError(format!(
                        "Invalid HTTP method '{}': {}",
                        method_str, e
                    ))
                })?;

                // Collect headers for potential redirect replay
                let mut collected_headers: Vec<(
                    reqwest::header::HeaderName,
                    reqwest::header::HeaderValue,
                )> = Vec::new();

                if let Some(user_agent) = &config.user_agent
                    && !config.bridge_endpoint
                {
                    match constructed_header("user-agent", user_agent) {
                        Ok((_, val)) => {
                            collected_headers.push((reqwest::header::USER_AGENT, val));
                        }
                        Err(drop) => debug!(
                            correlation_id = %exchange.correlation_id(),
                            header = %drop.name,
                            "outbound header dropped: {}",
                            drop.reason
                        ),
                    }
                }

                // Inject W3C TraceContext headers for distributed tracing (opt-in via "otel" feature)
                #[cfg(feature = "otel")]
                let should_inject_otel = !config.bridge_endpoint;
                #[cfg(feature = "otel")]
                if should_inject_otel {
                    let mut otel_headers = HashMap::new();
                    camel_otel::inject_from_exchange(&exchange, &mut otel_headers);
                    for (k, v) in otel_headers {
                        match constructed_header(&k, &v) {
                            Ok((name, val)) => collected_headers.push((name, val)),
                            Err(drop) => debug!(
                                correlation_id = %exchange.correlation_id(),
                                header = %drop.name,
                                "outbound header dropped: {}",
                                drop.reason
                            ),
                        }
                    }
                }

                let conn_tokens = header_policy::connection_tokens(
                    exchange
                        .input
                        .headers
                        .iter()
                        .filter(|(k, _)| k.eq_ignore_ascii_case("connection"))
                        .filter_map(|(_, v)| v.as_str()),
                );

                let outbound = select_outbound_headers(
                    &exchange.input.headers,
                    &config.skip_request_headers,
                    &conn_tokens,
                );
                for drop in &outbound.drops {
                    if let Some(value_kind) = drop.value_kind {
                        debug!(
                            correlation_id = %exchange.correlation_id(),
                            header = %drop.name,
                            value_kind = value_kind,
                            "outbound header dropped: {}",
                            drop.reason
                        );
                    } else {
                        debug!(
                            correlation_id = %exchange.correlation_id(),
                            header = %drop.name,
                            "outbound header dropped: {}",
                            drop.reason
                        );
                    }
                }
                collected_headers.extend(outbound.accepted);

                // Auth headers
                if !config.bridge_endpoint {
                    match &config.auth {
                        HttpAuth::None => {}
                        HttpAuth::Basic { username, password } => {
                            use base64::Engine;
                            // allow-secret: credentials combined for base64 Basic auth header
                            let credentials = format!("{username}:{password}");
                            let encoded =
                                base64::engine::general_purpose::STANDARD.encode(credentials);
                            // Base64 output is always header-safe; the guard is kept
                            // for uniformity with Bearer.
                            match constructed_header("authorization", &format!("Basic {encoded}")) {
                                Ok((_, val)) => {
                                    collected_headers.push((reqwest::header::AUTHORIZATION, val));
                                }
                                Err(drop) => debug!(
                                    correlation_id = %exchange.correlation_id(),
                                    header = %drop.name,
                                    "outbound header dropped: {}",
                                    drop.reason
                                ),
                            }
                        }
                        HttpAuth::Bearer { token } => {
                            // allow-secret: Bearer token in Authorization header
                            let bearer = format!("Bearer {token}");
                            match constructed_header("authorization", &bearer) {
                                Ok((_, val)) => {
                                    collected_headers.push((reqwest::header::AUTHORIZATION, val));
                                }
                                Err(drop) => debug!(
                                    correlation_id = %exchange.correlation_id(),
                                    header = %drop.name,
                                    "outbound header dropped: {}",
                                    drop.reason
                                ),
                            }
                        }
                    }

                    if config.connection_close {
                        collected_headers.push((
                            reqwest::header::CONNECTION,
                            reqwest::header::HeaderValue::from_static("close"),
                        ));
                    }
                }

                // Materialize body
                let is_stream_body = matches!(exchange.input.body, Body::Stream(_));
                let materialized_body: Option<Vec<u8>> = if is_stream_body {
                    if suppress_body {
                        // A stream body dropped under a non-entity-enclosing
                        // method always warns (its emptiness is unknowable) and
                        // stays consumed (mem::take). The stream attach arm below
                        // still runs its outer flag check, but the inner `if let
                        // Body::Stream` re-match fails on the now-Empty body, so
                        // no stream is attached and no AlreadyConsumed error can
                        // fire.
                        std::mem::take(&mut exchange.input.body);
                        // log-policy: handler-owned
                        tracing::warn!(
                            correlation_id = %exchange.correlation_id(),
                            method = %method_str,
                            "dropping request body for non-entity-enclosing HTTP method"
                        );
                    }
                    None // Streams can't be replayed on redirect
                } else {
                    let body = std::mem::take(&mut exchange.input.body);
                    let bytes = body.into_bytes(config.max_body_size).await?;
                    if bytes.is_empty() {
                        // Empty body: nothing to send and nothing to warn about.
                        None
                    } else if suppress_body {
                        // log-policy: handler-owned
                        tracing::warn!(
                            correlation_id = %exchange.correlation_id(),
                            method = %method_str,
                            "dropping request body for non-entity-enclosing HTTP method"
                        );
                        None
                    } else {
                        Some(bytes.to_vec())
                    }
                };

                let response = if config.follow_redirects && !is_stream_body {
                    // Use manual redirect loop with per-hop SSRF validation.
                    // `client` is the pinned-or-shared binding for the initial
                    // request (a hostname initial request keeps its DNS-pinned
                    // client); `shared_client` is the unpinned endpoint client
                    // reused by IP-literal redirect hops.
                    ssrf::send_with_ssrf_safe_redirects(
                        &client,
                        &shared_client,
                        &pinned_cache,
                        &http_config,
                        &config,
                        method,
                        &url,
                        collected_headers,
                        materialized_body,
                        config.max_redirects,
                        config.response_timeout,
                    )
                    .await?
                } else {
                    // Direct send (no redirect following, or streaming body)
                    let mut request = client.request(method, &url);

                    if let Some(timeout) = config.response_timeout {
                        request = request.timeout(timeout);
                    }

                    for (name, value) in &collected_headers {
                        request = request.header(name, value);
                    }

                    if is_stream_body {
                        if let Body::Stream(ref s) = exchange.input.body {
                            let mut stream_lock = s.stream.lock().await;
                            if let Some(stream) = stream_lock.take() {
                                request = request.body(reqwest::Body::wrap_stream(stream));
                            } else {
                                return Err(CamelError::AlreadyConsumed);
                            }
                        }
                    } else if let Some(ref body_bytes) = materialized_body {
                        request = request.body(body_bytes.clone());
                    }

                    request.send().await.map_err(|e| {
                        CamelError::ProcessorError(format!("HTTP request failed: {e}"))
                    })?
                };

                let status_code = response.status().as_u16();
                let status_text = response
                    .status()
                    .canonical_reason()
                    .unwrap_or("Unknown")
                    .to_string();

                for (key, value) in response.headers() {
                    if config
                        .skip_response_headers
                        .iter()
                        .any(|h| h.eq_ignore_ascii_case(key.as_str()))
                    {
                        continue;
                    }
                    if let Ok(val_str) = value.to_str() {
                        exchange.input.set_header(
                            title_case_header(key.as_str()),
                            serde_json::Value::String(val_str.to_string()),
                        );
                    }
                }

                exchange.input.set_header(
                    "CamelHttpResponseCode",
                    serde_json::Value::Number(status_code.into()),
                );
                exchange.input.set_header(
                    "CamelHttpResponseText",
                    serde_json::Value::String(status_text.clone()),
                );

                // Read response body with timeout and size guard (HTTP-004, HTTP-005)
                let read_timeout = Duration::from_millis(config.read_timeout_ms);
                let response_body = tokio::time::timeout(read_timeout, async {
                    // Check Content-Length header before allocating
                    if let Some(content_len) = response.content_length()
                        && content_len > config.max_response_bytes as u64
                    {
                        return Err(CamelError::ProcessorError(format!(
                            "Response body too large: {} bytes exceeds limit of {} bytes",
                            content_len, config.max_response_bytes
                        )));
                    }
                    // Use bytes_stream() for lazy streaming with size guard
                    use futures::TryStreamExt;
                    let mut stream = response.bytes_stream();
                    let mut total: usize = 0;
                    let mut collected = Vec::new();
                    while let Some(chunk) = stream.try_next().await.map_err(|e| {
                        CamelError::ProcessorError(format!("Failed to read response body: {e}"))
                    })? {
                        total += chunk.len();
                        if total > config.max_response_bytes {
                            return Err(CamelError::ProcessorError(format!(
                                "Response body too large: {} bytes exceeds limit of {} bytes",
                                total, config.max_response_bytes
                            )));
                        }
                        collected.push(chunk);
                    }
                    let mut result = bytes::BytesMut::with_capacity(total);
                    for chunk in collected {
                        result.extend_from_slice(&chunk);
                    }
                    Ok::<bytes::Bytes, CamelError>(result.freeze())
                })
                .await
                .map_err(|_| {
                    CamelError::ProcessorError(format!(
                        "Read timeout after {}ms",
                        config.read_timeout_ms
                    ))
                })??;

                if config.throw_exception_on_failure
                    && !HttpProducer::is_ok_status(status_code, config.ok_status_code_range)
                {
                    return Err(CamelError::HttpOperationFailed {
                        method: method_str,
                        // ADR-0051 redact-by-construction: never embed
                        // userinfo/query credentials in the error value.
                        url: redact_url_for_diagnostics(&url),
                        status_code,
                        status_text,
                        response_body: Some(truncate_error_body(&response_body)),
                    });
                }

                if !response_body.is_empty() {
                    exchange.input.body = Body::Bytes(bytes::Bytes::from(response_body.to_vec()));
                }

                debug!(
                    correlation_id = %exchange.correlation_id(),
                    status = status_code,
                    url = %redact_url_for_diagnostics(&url),
                    "HTTP response"
                );
                Ok(exchange)
            }
            .await;
            // ("http","request") facade (dashboard-observability 4.3): the
            // request boundary is the full client round-trip — SSRF checks,
            // send, response read, and (with throwExceptionOnFailure) the
            // status gate. http runs no retry_async and the producer
            // previously emitted nothing, so no label collides with
            // e:http:request.
            component_metrics.observe("http", "request", outcome.is_err());
            outcome
        })
    }
}

/// Serializes tests that mutate or depend on the global `ServerRegistry`.
///
/// `ServerRegistry::global()` is a process-wide singleton that persists
/// across tests. `ServerRegistry::reset()` clears ALL entries; if it races
/// with another test that has a live server on a fixed port (e.g. 9991),
/// the registry entry is removed while the OS socket is still bound, so
/// the next `get_or_spawn` call on that port fails with "Address already
/// in use". This mutex does not give blanket protection by itself. It
/// helps only where every participant follows the mutex law: the
/// consumer-test readiness helper holds it from `stage_listener` until
/// readiness-complete (http-test-harness spec, requirement
/// "Registry-mutation serialization during setup"), and each `reset()`
/// caller takes it before the reset.
#[cfg(test)]
pub(crate) static REGISTRY_TEST_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());

/// Poison-recovering acquire of REGISTRY_TEST_MUTEX (httpflake).
///
/// The mutex guards test SERIALIZATION only - the registry own data is
/// protected by its inner lock - so a sibling test that panics while
/// holding the guard must not poison the mutex and cascade failures
/// into every other holder. Recovery via into_inner is therefore safe
/// and keeps one failing test failing as ONE test.
#[cfg(test)]
pub(crate) fn lock_registry_test_mutex() -> std::sync::MutexGuard<'static, ()> {
    REGISTRY_TEST_MUTEX
        .lock()
        .unwrap_or_else(|poisoned| poisoned.into_inner())
}

/// Serializes tests that mutate (or assert on) the process-global
/// SSL_CERT_FILE/SSL_CERT_DIR CA-probe env vars (rc-3j4mq). Poison-
/// recovering for the same reason as REGISTRY_TEST_MUTEX.
#[cfg(test)]
static CA_STORE_TEST_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());

#[cfg(test)]
pub(crate) fn lock_ca_store_test_mutex() -> std::sync::MutexGuard<'static, ()> {
    CA_STORE_TEST_MUTEX
        .lock()
        .unwrap_or_else(|poisoned| poisoned.into_inner())
}

/// Map a pipeline error to an HTTP reply.
///
/// Extracted from the inline `match` in `dispatch_handler` for unit
/// testability (rc-1dk4). Client-fault errors map to their 4xx codes
/// with a structured JSON error body: `TypeConversionFailed`/
/// `ValidationError` → 400, `UnsupportedMediaType` → 415 (media
/// negotiation gate, REST lowering), `NotAcceptable` → 406 (same
/// gate); `Unauthenticated`/`Unauthorized` keep their `401`/`403`
/// mappings; all other errors map to `500 Internal Server Error`.
fn pipeline_error_to_reply(e: CamelError, path: &str) -> HttpReply {
    match e {
        CamelError::Unauthenticated(msg) => {
            tracing::warn!(error = %msg, path = %path, "Authentication failed");
            HttpReply {
                status: 401,
                headers: vec![("WWW-Authenticate".to_string(), "Bearer".to_string())],
                body: HttpReplyBody::Bytes(bytes::Bytes::from("Unauthorized")),
            }
        }
        CamelError::Unauthorized(msg) => {
            tracing::warn!(error = %msg, path = %path, "Authorization failed");
            HttpReply {
                status: 403,
                headers: vec![],
                body: HttpReplyBody::Bytes(bytes::Bytes::from("Forbidden")),
            }
        }
        CamelError::TypeConversionFailed(msg) => {
            tracing::warn!(error = %msg, path = %path, "Type conversion failed (bad request)");
            json_error_reply(400, "bad_request", msg)
        }
        CamelError::ValidationError(msg) => {
            tracing::warn!(error = %msg, path = %path, "Schema validation failed (bad request)");
            json_error_reply(400, "validation_error", msg)
        }
        CamelError::ConsumerStopping => {
            tracing::debug!(path = %path, "Pipeline aborted during route shutdown");
            HttpReply {
                status: 503,
                headers: vec![],
                body: HttpReplyBody::Bytes(bytes::Bytes::from("Service Unavailable")),
            }
        }
        CamelError::UnsupportedMediaType { consumed, declared } => {
            tracing::warn!(error = %consumed, declared = %declared, path = %path, "Unsupported media type (bad request)");
            json_error_reply(
                415,
                "unsupported_media_type",
                format!("consumed {consumed}, declared {declared}"),
            )
        }
        CamelError::NotAcceptable { accept, produced } => {
            tracing::warn!(error = %accept, produced = %produced, path = %path, "Not acceptable (bad request)");
            json_error_reply(
                406,
                "not_acceptable",
                format!("accept {accept}, produced {produced}"),
            )
        }
        e => {
            // log-policy: handler-owned
            tracing::warn!(error = %e, path = %path, "Pipeline error processing HTTP request");
            HttpReply {
                status: 500,
                headers: vec![],
                body: HttpReplyBody::Bytes(bytes::Bytes::from("Internal Server Error")),
            }
        }
    }
}

/// Build a JSON error reply with the given status, error code, and message.
///
/// Shared by the `TypeConversionFailed`/`ValidationError` (400),
/// `UnsupportedMediaType` (415), and `NotAcceptable` (406) arms of
/// `pipeline_error_to_reply` so the four replies cannot drift apart. The
/// `unwrap_or_else(|_| "{}".to_string())` fallback keeps the reply valid
/// JSON even if serialization fails.
fn json_error_reply(status: u16, code: &str, message: String) -> HttpReply {
    let body = serde_json::to_string(&serde_json::json!({
        "error": code,
        "message": message,
    }))
    .unwrap_or_else(|_| "{}".to_string()); // allow-unwrap
    HttpReply {
        status,
        headers: vec![("Content-Type".to_string(), "application/json".to_string())],
        body: HttpReplyBody::Bytes(bytes::Bytes::from(body)),
    }
}

/// Lowercase kind name for a JSON value, used in drop diagnostics so log
/// readers see *why* a header had no scalar string form without the value
/// itself ever entering diagnostics.
const fn json_value_kind(v: &serde_json::Value) -> &'static str {
    match v {
        serde_json::Value::Null => "null",
        serde_json::Value::Bool(_) => "bool",
        serde_json::Value::Number(_) => "number",
        serde_json::Value::String(_) => "string",
        serde_json::Value::Array(_) => "array",
        serde_json::Value::Object(_) => "object",
    }
}

/// Scalar string form of a JSON value: strings pass through, `Number` and
/// `Bool` are stringified, everything else has no single-value form.
/// Shared by the consumer reply finaliser and the producer outbound filter
/// so the two directions cannot drift apart (rc-lidtk / rc-8l23a).
fn scalar_string_form(v: &serde_json::Value) -> Option<String> {
    match v {
        serde_json::Value::String(s) => Some(s.clone()),
        serde_json::Value::Number(n) => Some(n.to_string()),
        serde_json::Value::Bool(b) => Some(b.to_string()),
        _ => None,
    }
}

/// Select the HTTP response headers emitted by the consumer reply finaliser
/// (ADR-0057 / rc-2jj2). Extracted from the inline filter in
/// `dispatch_handler` for unit testability.
///
/// Drops Camel-namespace headers, hop-by-hop/framing, request-only, and
/// server-owned headers, plus `content-length`/`content-type` (re-derived),
/// and any header named by a `Connection` token. Scalar non-string values
/// (`Number`/`Bool`) are stringified so `set_header("X-Retries", 3)` reaches
/// the wire instead of being silently discarded (rc-lidtk); `null`, objects,
/// and arrays have no single-value form and are dropped. Every drop is
/// logged at DEBUG with the header name and reason — names only, never
/// values, so credentials cannot leak into diagnostics (ADR-0051).
/// Appends a single `Content-Type` from `user_content_type` falling back to
/// `inferred_content_type` when either is present.
fn select_response_headers(
    headers: &HashMap<String, serde_json::Value>,
    user_content_type: Option<String>,
    inferred_content_type: Option<String>,
) -> Vec<(String, String)> {
    let conn_tokens = header_policy::connection_tokens(
        headers
            .iter()
            .filter(|(k, _)| k.eq_ignore_ascii_case("connection"))
            .filter_map(|(_, v)| v.as_str()),
    );
    let mut selected: Vec<(String, String)> = Vec::new();
    for (k, v) in headers {
        if k.starts_with("Camel") {
            debug!(header = %k, "reply header dropped: Camel namespace");
            continue;
        }
        if header_policy::excluded_response(k, &conn_tokens) {
            debug!(header = %k, "reply header dropped: emission policy");
            continue;
        }
        match scalar_string_form(v) {
            Some(s) => selected.push((k.clone(), s)),
            None => debug!(
                header = %k,
                value_kind = json_value_kind(v),
                "reply header dropped: no scalar string form"
            ),
        }
    }
    if let Some(ct) = user_content_type.or(inferred_content_type) {
        selected.push(("Content-Type".to_string(), ct));
    }
    selected
}

/// One outbound header drop: the exchange header name, a stable reason
/// string, and — when the drop was caused by the value having no scalar
/// string form — the JSON value kind. Names and kinds only, never values
/// (ADR-0051).
#[derive(Debug)]
struct OutboundHeaderDrop<'a> {
    name: &'a str,
    reason: &'static str,
    value_kind: Option<&'static str>,
}

/// Outbound exchange-header selection result: headers accepted for the
/// wire plus drop records for call-site DEBUG logging.
struct OutboundHeaderSelection<'a> {
    accepted: Vec<(reqwest::header::HeaderName, reqwest::header::HeaderValue)>,
    drops: Vec<OutboundHeaderDrop<'a>>,
}

/// Select the exchange headers the HTTP producer forwards on the outbound
/// request (ADR-0057 / rc-8l23a). Extracted from the inline filter in
/// `HttpProducer::call` for unit testability.
///
/// Drops `Camel`-namespace headers, names listed in `skip_request_headers`,
/// hop-by-hop/framing and connection-token-named headers excluded by the
/// outbound emission policy, and headers whose name or stringified value
/// fails `HeaderName`/`HeaderValue` construction. Scalar non-string values
/// (`Number`/`Bool`) are stringified so `set_header("X-Retries", 3)` reaches
/// the wire instead of being silently discarded (rc-8l23a); `null`, objects,
/// and arrays have no single-value form and are dropped. Drops are returned
/// rather than logged so the call site can attach the correlation id; log
/// consumers see names and kinds only, never values (ADR-0051).
fn select_outbound_headers<'a>(
    headers: &'a HashMap<String, serde_json::Value>,
    skip_request_headers: &[String],
    conn_tokens: &[String],
) -> OutboundHeaderSelection<'a> {
    let mut accepted = Vec::new();
    let mut drops = Vec::new();
    for (key, value) in headers {
        if key.starts_with("Camel") {
            drops.push(OutboundHeaderDrop {
                name: key,
                reason: "Camel namespace",
                value_kind: None,
            });
            continue;
        }
        if skip_request_headers
            .iter()
            .any(|h| h.eq_ignore_ascii_case(key))
        {
            drops.push(OutboundHeaderDrop {
                name: key,
                reason: "skip_request_headers",
                value_kind: None,
            });
            continue;
        }
        if header_policy::excluded_outbound(key, conn_tokens) {
            drops.push(OutboundHeaderDrop {
                name: key,
                reason: "outbound emission policy",
                value_kind: None,
            });
            continue;
        }
        let Some(val_str) = scalar_string_form(value) else {
            drops.push(OutboundHeaderDrop {
                name: key,
                reason: "no scalar string form",
                value_kind: Some(json_value_kind(value)),
            });
            continue;
        };
        match constructed_header(key, &val_str) {
            Ok((name, val)) => accepted.push((name, val)),
            Err(drop) => drops.push(drop),
        }
    }
    OutboundHeaderSelection { accepted, drops }
}

/// Construct a wire-ready `(HeaderName, HeaderValue)` pair for one outbound
/// header, or a drop record when the name or value fails construction
/// (rc-jbs1v). Drop records carry name and reason only, never values
/// (ADR-0051).
fn constructed_header<'a>(
    name: &'a str,
    value: &str,
) -> Result<(reqwest::header::HeaderName, reqwest::header::HeaderValue), OutboundHeaderDrop<'a>> {
    let header_name = match reqwest::header::HeaderName::from_bytes(name.as_bytes()) {
        Ok(header_name) => header_name,
        Err(_) => {
            return Err(OutboundHeaderDrop {
                name,
                reason: "invalid header name",
                value_kind: None,
            });
        }
    };
    let header_value = match reqwest::header::HeaderValue::from_str(value) {
        Ok(header_value) => header_value,
        Err(_) => {
            return Err(OutboundHeaderDrop {
                name,
                reason: "invalid header value",
                value_kind: None,
            });
        }
    };
    Ok((header_name, header_value))
}

#[cfg(test)]
mod tests {
    use camel_component_api::test_support::NoopRuntimeObservability;

    #[test]
    fn test_metadata_authmethod_enum_covers_runtime_vocab() {
        // The lint's R-URI-known kind check validates `authMethod` values
        // against the metadata Enum variants; the runtime accepts `none`
        // (case-insensitive, parse_auth_from_params → HttpAuth::None), so
        // the variant list must cover it or camel lint false-positives on
        // runtime-legal routes (rc-68q6 review finding).
        use camel_api::component_metadata::OptionKind;
        let meta = super::HttpEndpointConfig::metadata();
        let auth = meta
            .uri_options
            .iter()
            .find(|o| o.name == "authMethod")
            .expect("authMethod option must exist");
        let OptionKind::Enum(variants) = &auth.kind else {
            panic!("authMethod kind must be Enum; got {:?}", auth.kind);
        };
        for value in ["None", "Basic", "Bearer"] {
            assert!(
                variants.iter().any(|v| v.eq_ignore_ascii_case(value)),
                "metadata authMethod variants must cover runtime-accepted `{value}`; got {variants:?}"
            );
        }
    }

    // Producer/consumer tests drive the component-ops facade on every
    // call (dashboard-observability 4.3), so even non-observability tests
    // must supply a collector-returning runtime — Noop everywhere.
    fn test_rt() -> std::sync::Arc<dyn camel_component_api::RuntimeObservability> {
        std::sync::Arc::new(NoopRuntimeObservability)
    }
    fn rt() -> std::sync::Arc<dyn camel_component_api::RuntimeObservability> {
        std::sync::Arc::new(NoopRuntimeObservability)
    }
    fn noop_rt() -> std::sync::Arc<dyn camel_component_api::RuntimeObservability> {
        std::sync::Arc::new(NoopRuntimeObservability)
    }

    use super::*;
    use crate::config::TlsConfig;
    use crate::rest_match::PathSegment;
    use crate::tls_harness::*;
    use camel_component_api::{Message, NoOpComponentContext};
    use std::sync::Arc;
    use std::time::Duration;

    fn test_producer_ctx() -> ProducerContext {
        ProducerContext::new()
    }

    // -----------------------------------------------------------------------
    // Security: credential redaction (audit 2026-08-31, finding F3-1)
    // -----------------------------------------------------------------------

    /// ADR-0076: bare `host` log fields route through the canonical
    /// [`camel_api::redact::redact_host`] (bd rc-8bxeo promoted the
    /// crate-local twin — `redact_url_for_diagnostics` never opens an
    /// authority window on a base-less string). Thin local pin — the
    /// full matrix lives in camel-api's
    /// `redact_host_masks_userinfo_keeps_clean_hosts`.
    #[test]
    fn canonical_redact_host_pinned() {
        assert_eq!(
            camel_api::redact::redact_host("host.example:8080"),
            "host.example:8080"
        );
        assert_eq!(camel_api::redact::redact_host("a@b@c"), "***@c");
    }

    #[test]
    fn redact_url_drops_oauth2_fragment_access_token() {
        let redacted =
            redact_url_for_diagnostics("https://app.example/cb#access_token=SECRET&state=x");
        assert!(
            !redacted.contains("SECRET"),
            "fragment access token leaked: {redacted}"
        );
        assert!(
            !redacted.contains("access_token"),
            "fragment key leaked: {redacted}"
        );
        assert!(
            redacted.ends_with("#[redacted]"),
            "fragment must be replaced with the sentinel: {redacted}"
        );
    }

    #[test]
    fn redact_url_drops_oauth2_fragment_id_token() {
        let redacted =
            redact_url_for_diagnostics("https://app.example/cb#id_token=eyJhbG.SECRET.SIG&state=y");
        assert!(
            !redacted.contains("eyJhbG"),
            "id token payload leaked: {redacted}"
        );
        assert!(
            !redacted.contains("id_token"),
            "id token key leaked: {redacted}"
        );
        assert!(
            !redacted.contains("SECRET"),
            "id token signature leaked: {redacted}"
        );
        assert!(
            redacted.ends_with("#[redacted]"),
            "fragment must be replaced with the sentinel: {redacted}"
        );
    }

    #[test]
    fn redact_url_drops_generic_fragment_kv() {
        let redacted = redact_url_for_diagnostics("https://h.example/p/session#session=abc123");
        assert!(
            !redacted.contains("abc123"),
            "fragment value leaked: {redacted}"
        );
        assert!(
            !redacted.contains("session="),
            "fragment key leaked: {redacted}"
        );
        assert!(
            redacted.contains("#[redacted]"),
            "fragment must be replaced with the sentinel: {redacted}"
        );
    }

    #[test]
    fn redact_url_query_and_fragment_sentinels_compose() {
        let redacted = redact_url_for_diagnostics("https://h.example/p?a=1#access_token=x");
        assert_eq!(
            redacted, "https://h.example/p?[redacted]#[redacted]",
            "query and fragment sentinels must compose: {redacted}"
        );
    }

    #[test]
    fn redact_url_drops_benign_fragment_too() {
        // Fragments never reach the wire, so nothing in them is diagnostic:
        // strictest-wins drops benign fragments too.
        let redacted = redact_url_for_diagnostics("https://h.example/docs#section-3");
        assert_eq!(
            redacted, "https://h.example/docs#[redacted]",
            "benign fragment must still be dropped: {redacted}"
        );
    }

    #[test]
    fn redact_url_unparseable_fragment_credentials_dropped() {
        let raw = "ht tps://app.example/cb#access_token=SECRET";
        assert!(
            url::Url::parse(raw).is_err(),
            "fixture must be unparseable: {raw}"
        );
        let redacted = redact_url_for_diagnostics(raw);
        assert!(
            !redacted.contains("SECRET"),
            "unparseable fragment token leaked: {redacted}"
        );
        assert!(
            !redacted.contains("access_token"),
            "unparseable fragment bytes leaked: {redacted}"
        );
        assert!(
            redacted.contains("#[redacted]"),
            "unparseable fragment must end in the sentinel: {redacted}"
        );
    }

    #[test]
    fn redact_url_double_slash_evader_sentinel() {
        // url::Url::parse accepts this (empty host allowed for non-special
        // schemes), parking userinfo-shaped bytes in the opaque path.
        let redacted = redact_url_for_diagnostics("scheme:////user:pass@evil/");
        assert_eq!(
            redacted, "[redacted]",
            "double-slash evader must fail closed: {redacted}"
        );
    }

    #[test]
    fn redact_url_triple_slash_evader_sentinel() {
        let redacted = redact_url_for_diagnostics("scheme:///user:pass@evil/");
        assert_eq!(
            redacted, "[redacted]",
            "triple-slash evader must fail closed: {redacted}"
        );
    }

    #[test]
    fn redact_url_bare_protocol_relative_userinfo_sentinel() {
        let redacted = redact_url_for_diagnostics("//user:pass@evil");
        assert_eq!(
            redacted, "[redacted]",
            "protocol-relative userinfo must fail closed: {redacted}"
        );
    }

    #[test]
    fn redact_url_empty_host_userinfo_sentinel() {
        // url::Url::parse rejects this with EmptyHost; the failure arm must
        // fail closed without panicking on the empty host.
        let redacted = redact_url_for_diagnostics("scheme://user@");
        assert_eq!(
            redacted, "[redacted]",
            "empty-host userinfo must fail closed: {redacted}"
        );
    }

    #[test]
    fn redact_url_unparseable_slash_run_evader_sentinel() {
        // Unlike `scheme:////user:pass@evil/` (parses Ok, host=None, and
        // hits the parsed-arm guard), the space in the scheme forces the
        // parse to fail, driving the failure arm's slash-run skip directly.
        let raw = "schem e:////user:pass@evil/";
        assert!(
            url::Url::parse(raw).is_err(),
            "fixture must be unparseable: {raw}"
        );
        let redacted = redact_url_for_diagnostics(raw);
        assert_eq!(
            redacted, "[redacted]",
            "unparseable slash-run evader must fail closed: {redacted}"
        );
    }

    #[test]
    fn redact_url_unparseable_later_window_userinfo_sentinel() {
        // The first `//` window ("ho st") carries no `@`, but a later
        // `//user:pass@evil/` window does. The scan must consider every
        // `//` window, not just the first, or the credentials echo.
        let raw = "http://ho st/a//user:pass@evil/";
        assert!(
            url::Url::parse(raw).is_err(),
            "fixture must be unparseable: {raw}"
        );
        let redacted = redact_url_for_diagnostics(raw);
        assert_eq!(
            redacted, "[redacted]",
            "userinfo in a later // window must fail closed: {redacted}"
        );
    }

    #[test]
    fn redact_url_parsed_later_window_userinfo_masked() {
        // rust-url accepts this with host `h` and parks the userinfo bytes
        // in the path, so the accessor mask never fires. The parsed arm
        // must apply the same window-masking surgery as the string-based
        // redactors or the later window renders verbatim.
        let redacted = redact_url_for_diagnostics("https://h//user:pass@evil/");
        assert!(
            !redacted.contains("user:pass"),
            "parsed later-window userinfo leaked: {redacted}"
        );
        assert!(
            redacted.contains("h//***@evil/"),
            "later window must be masked in place: {redacted}"
        );
    }

    #[test]
    fn redact_url_parsed_window_mask_idempotent_with_real_userinfo() {
        // Real userinfo is masked by the accessor step; the window surgery
        // on the rendered string must not double-mask it (`***@h` stays),
        // and the later `x@y` path window must still be masked.
        let redacted = redact_url_for_diagnostics("https://user:pass@h//x@y/");
        assert!(
            redacted.contains("***@h"),
            "accessor mask must survive the window surgery: {redacted}"
        );
        assert!(
            !redacted.contains("user:pass"),
            "real userinfo leaked: {redacted}"
        );
        assert!(
            !redacted.contains("x@y"),
            "later path window leaked: {redacted}"
        );
    }

    #[test]
    fn redact_url_backslash_authority_ruling() {
        // Probe outcome: url::Url::parse accepts this input. http is a
        // special scheme, so backslashes normalize to slashes and the
        // credentials land in real userinfo
        // (`http://user:pass@evil/path`). The parsed arm must mask them
        // like any other userinfo.
        let redacted = redact_url_for_diagnostics("http:\\\\user:pass@evil\\path");
        assert!(
            redacted.contains("***@"),
            "backslash authority must be userinfo-masked: {redacted}"
        );
        assert!(
            !redacted.contains("user:pass"),
            "backslash authority must not leak credentials: {redacted}"
        );
    }

    #[test]
    fn non_special_backslash_authority_masked() {
        // Non-special scheme: the url crate does not normalize the
        // backslashes, so the string carries no `//` run — the
        // scheme-prefixed backslash window must still suppress the
        // credentials.
        let redacted = redact_url_for_diagnostics("foo:\\user:pass@evil/");
        assert!(
            !redacted.contains("user:pass"),
            "non-special backslash authority leaked: {redacted}"
        );
        assert!(
            !redacted.contains("pass"),
            "non-special backslash authority leaked a credential byte: {redacted}"
        );
        // Clean sibling stays visible (spec scenario's second given).
        assert_eq!(
            redact_url_for_diagnostics("foo:\\clean/path"),
            "foo:\\clean/path"
        );
    }

    #[test]
    fn one_char_scheme_credential_content_masked() {
        // Single backslash after the one-character scheme `x:` with
        // credential-shaped window content (`:` before the last `@`).
        let redacted = redact_url_for_diagnostics("x:\\user:pass@evil");
        assert!(
            !redacted.contains("user:pass"),
            "one-char-scheme backslash authority leaked: {redacted}"
        );
        assert!(
            !redacted.contains("pass"),
            "one-char-scheme backslash authority leaked a credential byte: {redacted}"
        );
    }

    #[test]
    fn drive_and_unc_inputs_stay_visible() {
        // Drive path: single backslash after a one-character scheme, no
        // `:` in the candidate window — no qualifying backslash window.
        // The parse-success arm lowercases the scheme (`C:` → `c:`); the
        // diagnostic content must stay visible with no sentinel and no
        // mask (spec scenario: query-redaction/cap rules only).
        let drive = redact_url_for_diagnostics("C:\\Users\\x@corp\\file");
        assert!(
            !drive.contains("[redacted]"),
            "drive path must not be sentineled: {drive}"
        );
        assert!(
            !drive.contains("***"),
            "drive path must not be masked: {drive}"
        );
        assert!(
            drive.contains("x@corp"),
            "drive path keeps its at-sign content visible: {drive}"
        );
        // UNC path: no scheme prefix before the backslash run; the
        // unparseable arm renders it byte-identically.
        let unc = redact_url_for_diagnostics("\\\\server\\x@y");
        assert_eq!(unc, "\\\\server\\x@y");
        assert!(
            !unc.contains("[redacted]"),
            "UNC path must not be sentineled: {unc}"
        );
    }

    #[test]
    fn redact_url_masks_userinfo_and_query() {
        let redacted =
            redact_url_for_diagnostics("http://user:secretpass@internal.example/api?token=abc123");
        assert!(
            !redacted.contains("secretpass"),
            "password must be masked: {redacted}"
        );
        assert!(
            !redacted.contains("token=abc123"),
            "query must be masked: {redacted}"
        );
        assert!(
            !redacted.contains("user@"),
            "username must be masked: {redacted}"
        );
        assert!(
            redacted.contains("internal.example"),
            "host stays visible: {redacted}"
        );
        assert!(redacted.contains("[redacted]"), "query marked: {redacted}");
    }

    #[test]
    fn redact_url_keeps_clean_urls_visible() {
        let redacted = redact_url_for_diagnostics("https://api.example.com/v1/items");
        assert_eq!(redacted, "https://api.example.com/v1/items");
    }

    #[test]
    fn redact_url_masks_password_only_userinfo() {
        let redacted = redact_url_for_diagnostics("http://:pwsecret@host.example/");
        assert!(
            !redacted.contains("pwsecret"),
            "password-only userinfo leaked: {redacted}"
        );
        assert_eq!(redacted, "http://***@host.example/");

        let redacted = redact_url_for_diagnostics("http://user:pw2@host.example/api");
        assert!(!redacted.contains("pw2"), "password leaked: {redacted}");
        assert_eq!(redacted, "http://***@host.example/api");

        let redacted = redact_url_for_diagnostics("http://host.example/api");
        assert_eq!(redacted, "http://host.example/api");
    }

    #[test]
    fn redact_url_truncates_unparseable() {
        let long = "x".repeat(1000);
        let redacted = redact_url_for_diagnostics(&long);
        assert_eq!(redacted.len(), 256, "unparseable URL must be truncated");
    }

    /// e_gpt stage-4: the 256-byte cap must not split an appended sentinel.
    /// The base is truncated at `256 - sentinel_len` BEFORE the sentinel is
    /// appended, so the sentinel always renders intact and the total stays
    /// ≤ 256. Both arms (parsed and unparseable) are exercised.
    #[test]
    fn redact_url_keeps_sentinels_intact_under_256_cap() {
        // Parsed arm: base (scheme+host+path) is 250 bytes, so byte 256
        // lands inside the appended `?[redacted]` (starts at 250) pre-fix.
        let parsed = format!("https://example.com/{}?x=1", "a".repeat(230));
        assert!(
            url::Url::parse(&parsed).is_ok(),
            "fixture must parse: {parsed}"
        );
        let redacted = redact_url_for_diagnostics(&parsed);
        assert!(redacted.len() <= 256, "len={}", redacted.len());
        assert!(
            redacted.ends_with("?[redacted]"),
            "parsed-arm sentinel must render intact: {redacted}"
        );

        // Unparseable arm: base is 249 bytes, so byte 256 lands inside the
        // appended `?[redacted]` (starts at 249) pre-fix.
        let unparseable = format!("http://{} ?x=1", "a".repeat(240));
        assert!(
            url::Url::parse(&unparseable).is_err(),
            "fixture must not parse: {unparseable}"
        );
        let redacted = redact_url_for_diagnostics(&unparseable);
        assert!(redacted.len() <= 256, "len={}", redacted.len());
        assert!(
            redacted.ends_with("?[redacted]"),
            "unparseable-arm sentinel must render intact: {redacted}"
        );
    }

    #[test]
    fn redact_url_suppresses_unparseable_authority_credentials() {
        let fixtures = [
            "http://u:secretpw@/x",
            "http://u:secretpw@host:99999/x",
            "http://u:secretpw@host:99999",
            "//u:secretpw@h/x",
        ];
        for fixture in fixtures {
            assert!(
                url::Url::parse(fixture).is_err(),
                "fixture must be unparseable: {fixture}"
            );
            let redacted = redact_url_for_diagnostics(fixture);
            assert_eq!(
                redacted, "[redacted]",
                "credential-bearing authority must be suppressed: {fixture}"
            );
        }
    }

    #[test]
    fn redact_url_bd_repro_never_leaks_credentials() {
        let redacted = redact_url_for_diagnostics("http://user:pa%ss@host/path");
        assert!(
            !redacted.contains("user:pa%ss"),
            "bd rc-2i5c5 repro leaked userinfo: {redacted}"
        );
        assert!(
            !redacted.contains("pa%ss"),
            "bd rc-2i5c5 repro leaked password: {redacted}"
        );
    }

    #[test]
    fn redact_url_unparseable_query_redacted_short_and_long() {
        let short = "http://host:99999/path?token=shortsecret";
        assert!(
            url::Url::parse(short).is_err(),
            "fixture must be unparseable: {short}"
        );
        let redacted = redact_url_for_diagnostics(short);
        assert_eq!(
            redacted, "http://host:99999/path?[redacted]",
            "short unparseable query must end with the suffix: {redacted}"
        );

        let mut long = String::from("http://host:99999/");
        long.push_str(&"a".repeat(300));
        long.push_str("?token=longsecret");
        assert!(
            url::Url::parse(&long).is_err(),
            "fixture must be unparseable: {long}"
        );
        let redacted = redact_url_for_diagnostics(&long);
        assert!(
            !redacted.contains("longsecret"),
            "long unparseable query leaked a query byte: {redacted}"
        );
        assert!(
            redacted.len() <= 256,
            "long unparseable query must be capped: {} bytes",
            redacted.len()
        );
    }

    #[test]
    fn redact_url_unparseable_sentinels_compose_both() {
        // Compose-both rule: one sentinel per distinct introducer found in
        // the raw string, in first-occurrence order.
        let raw = "ht tp://h.example/p?a=1#tok=x";
        assert!(
            url::Url::parse(raw).is_err(),
            "fixture must be unparseable: {raw}"
        );
        assert_eq!(
            redact_url_for_diagnostics(raw),
            "ht tp://h.example/p?[redacted]#[redacted]",
            "query and fragment sentinels must compose: {raw}"
        );
    }

    #[test]
    fn redact_url_unparseable_sentinels_compose_fragment_first() {
        let raw = "ht tp://h.example/p#tok=x?a=1";
        assert!(
            url::Url::parse(raw).is_err(),
            "fixture must be unparseable: {raw}"
        );
        assert_eq!(
            redact_url_for_diagnostics(raw),
            "ht tp://h.example/p#[redacted]?[redacted]",
            "sentinels must follow the introducers' first-occurrence order: {raw}"
        );
    }

    #[test]
    fn redact_url_unparseable_utf8_straddle_no_panic() {
        let fixture = format!("a{}", "é".repeat(200));
        let redacted = redact_url_for_diagnostics(&fixture);
        assert!(
            redacted.len() <= 256,
            "straddle fixture must be capped: {} bytes",
            redacted.len()
        );
        assert!(
            redacted.len() >= 253,
            "straddle fixture must not over-truncate: {} bytes",
            redacted.len()
        );
        assert!(
            fixture.is_char_boundary(redacted.len()),
            "cut must land on a UTF-8 char boundary: {} bytes",
            redacted.len()
        );
    }

    #[test]
    fn redact_url_at_sign_outside_authority_window_visible() {
        let at_sign_in_path = "http://host:99999/x@y";
        assert!(
            url::Url::parse(at_sign_in_path).is_err(),
            "fixture must be unparseable: {at_sign_in_path}"
        );
        assert_eq!(
            redact_url_for_diagnostics(at_sign_in_path),
            at_sign_in_path,
            "at-sign in path must not be suppressed"
        );
        // mailto parses as a cannot-be-a-base URL (no is_err precondition).
        assert_eq!(
            redact_url_for_diagnostics("mailto:user@example.com"),
            "mailto:user@example.com",
            "at-sign in mailto must round-trip byte-identically"
        );
    }

    #[test]
    fn parse_success_fragment_composes() {
        // Parsed arm: the fragment stays on the rendered URL and the
        // canonical redactor drops it and appends the sentinel.
        assert_eq!(
            redact_url_for_diagnostics("https://h/p#access_token=x"),
            "https://h/p#[redacted]"
        );
        // A `?` inside the fragment composes both sentinels, in
        // first-occurrence order (# before ?).
        assert_eq!(
            redact_url_for_diagnostics("https://h/cb#f?state=x"),
            "https://h/cb#[redacted]?[redacted]"
        );
    }

    #[test]
    fn err_arm_delegation_pin() {
        // Unparseable (port 99999) with userinfo in the authority window:
        // the Err arm delegates wholesale to the fail-closed canonical
        // redactor — nothing of the URL is rendered.
        assert_eq!(
            redact_url_for_diagnostics("http://u:secretpw@host:99999/x"),
            "[redacted]"
        );
        // Cross-surface fixture: same unparseable port without userinfo —
        // drop at `?`, append the query sentinel.
        assert_eq!(
            redact_url_for_diagnostics("http://h:99999/p?token=secret"),
            "http://h:99999/p?[redacted]"
        );
    }

    #[test]
    fn truncate_error_body_caps_attacker_body() {
        let big = vec![b'A'; 10 * 1024 * 1024];
        let truncated = truncate_error_body(&big);
        assert!(
            truncated.len() <= MAX_ERROR_RESPONSE_BODY_BYTES + 20,
            "body must be capped near {} bytes, got {}",
            MAX_ERROR_RESPONSE_BODY_BYTES,
            truncated.len()
        );
        assert!(truncated.ends_with("...[truncated]"));
    }

    #[test]
    fn truncate_error_body_keeps_small_body() {
        assert_eq!(truncate_error_body(b"boom"), "boom");
    }

    #[test]
    fn test_http_config_defaults() {
        let config = HttpEndpointConfig::from_uri("http://localhost:8080/api").unwrap();
        assert_eq!(config.base_url, "http://localhost:8080/api");
        assert!(config.http_method.is_none());
        assert!(config.throw_exception_on_failure);
        assert_eq!(config.ok_status_code_range, (200, 299));
        assert!(config.response_timeout.is_none());
        assert!(matches!(config.auth, HttpAuth::None));
        assert!(!config.bridge_endpoint);
        assert!(!config.connection_close);
    }

    #[test]
    fn test_http_config_scheme() {
        // UriConfig trait method returns "http" as primary scheme
        assert_eq!(HttpEndpointConfig::scheme(), "http");
    }

    #[test]
    fn test_http_config_from_components() {
        // Test from_components directly (trait method)
        let components = camel_component_api::UriComponents {
            scheme: "https".to_string(),
            path: "//api.example.com/v1".to_string(),
            params: std::collections::HashMap::from([(
                "httpMethod".to_string(),
                "POST".to_string(),
            )]),
            raw_query: None,
        };
        let config = HttpEndpointConfig::from_components(components).unwrap();
        assert_eq!(config.base_url, "https://api.example.com/v1");
        assert_eq!(config.http_method, Some("POST".to_string()));
    }

    #[test]
    fn test_http_config_with_options() {
        let config = HttpEndpointConfig::from_uri(
            "https://api.example.com/v1?httpMethod=PUT&throwExceptionOnFailure=false&followRedirects=true&connectTimeout=5000&responseTimeout=10000"
        ).unwrap();
        assert_eq!(config.base_url, "https://api.example.com/v1");
        assert_eq!(config.http_method, Some("PUT".to_string()));
        assert!(!config.throw_exception_on_failure);
        assert_eq!(config.response_timeout, Some(Duration::from_millis(10000)));
    }

    #[test]
    fn test_http_endpoint_config_auth_and_headers_options() {
        let config = HttpEndpointConfig::from_uri(
            "http://localhost/api?authMethod=Basic&authUsername=u&authPassword=p&userAgent=camel-test&bridgeEndpoint=true&connectionClose=true&skipRequestHeaders=Authorization,X-Secret&skipResponseHeaders=Set-Cookie",
        )
        .unwrap();

        assert!(matches!(
            config.auth,
            HttpAuth::Basic { username, password } if username == "u" && password == "p"
        ));
        assert_eq!(config.user_agent.as_deref(), Some("camel-test"));
        assert!(config.bridge_endpoint);
        assert!(config.connection_close);
        assert_eq!(
            config.skip_request_headers,
            vec!["authorization".to_string(), "x-secret".to_string()]
        );
        assert_eq!(config.skip_response_headers, vec!["set-cookie".to_string()]);
    }

    #[test]
    fn test_http_endpoint_config_bearer_auth() {
        let config = HttpEndpointConfig::from_uri(
            "http://localhost/api?authMethod=Bearer&authBearerToken=t",
        )
        .unwrap();
        assert!(matches!(
            config.auth,
            HttpAuth::Bearer { token } if token == "t"
        ));
    }

    #[test]
    fn rejects_cookie_handling_inmemory() {
        let result = HttpEndpointConfig::from_uri("http://localhost/api?cookieHandling=InMemory");
        match result {
            Err(CamelError::InvalidUri(msg)) => {
                assert!(
                    msg.contains("cookieHandling is not supported"),
                    "expected rejection message, got: {msg}"
                );
            }
            other => panic!("expected InvalidUri error, got: {other:?}"),
        }
    }

    #[test]
    fn rejects_cookie_handling_disabled() {
        let result = HttpEndpointConfig::from_uri("http://localhost/api?cookieHandling=Disabled");
        match result {
            Err(CamelError::InvalidUri(msg)) => {
                assert!(
                    msg.contains("cookieHandling is not supported"),
                    "expected rejection message, got: {msg}"
                );
            }
            other => panic!("expected InvalidUri error, got: {other:?}"),
        }
    }

    #[test]
    fn test_from_uri_with_defaults_applies_config_when_uri_param_absent() {
        let config = HttpConfig::default()
            .with_response_timeout_ms(999)
            .with_allow_internal(true)
            .with_blocked_hosts(vec!["evil.com".to_string()])
            .with_max_body_size(12345);
        let endpoint =
            HttpEndpointConfig::from_uri_with_defaults("http://example.com/api", &config).unwrap();
        assert_eq!(endpoint.response_timeout, Some(Duration::from_millis(999)));
        assert!(endpoint.allow_internal);
        assert_eq!(endpoint.blocked_hosts, vec!["evil.com".to_string()]);
        assert_eq!(endpoint.max_body_size, 12345);
    }

    #[test]
    fn test_from_uri_with_defaults_uri_overrides_config() {
        let config = HttpConfig::default()
            .with_response_timeout_ms(999)
            .with_allow_internal(true)
            .with_blocked_hosts(vec!["evil.com".to_string()])
            .with_max_body_size(12345);
        let endpoint = HttpEndpointConfig::from_uri_with_defaults(
            "http://example.com/api?responseTimeout=500&allowInternal=false&blockedHosts=bad.net&maxBodySize=99",
            &config,
        )
        .unwrap();
        assert_eq!(endpoint.response_timeout, Some(Duration::from_millis(500)));
        assert!(!endpoint.allow_internal);
        assert_eq!(endpoint.blocked_hosts, vec!["bad.net".to_string()]);
        assert_eq!(endpoint.max_body_size, 99);
    }

    #[test]
    fn test_http_config_ok_status_range() {
        let config =
            HttpEndpointConfig::from_uri("http://localhost/api?okStatusCodeRange=200-204").unwrap();
        assert_eq!(config.ok_status_code_range, (200, 204));
    }

    #[test]
    fn test_http_config_wrong_scheme() {
        let result = HttpEndpointConfig::from_uri("file:/tmp");
        assert!(result.is_err());
    }

    #[test]
    fn test_http_component_scheme() {
        let component = HttpComponent::new();
        assert_eq!(component.scheme(), "http");
    }

    // -----------------------------------------------------------------------
    // tls.strict — fail-closed knob (audit 2026-08-31 R3 / rc-ayrwk).
    // Default stays permissive (F2-7 warns); strict fails endpoint creation
    // on any CA/mTLS load failure.
    // -----------------------------------------------------------------------

    #[test]
    fn tls_strict_defaults_false_on_deserialize() {
        let tls: TlsConfig = serde_json::from_value(serde_json::json!({
            "enabled": true
        }))
        .unwrap();
        assert!(!tls.strict, "absent strict must default to false");
    }

    fn strict_config(ca_path: Option<&str>, strict: bool) -> HttpConfig {
        HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict,
                ca_cert_path: ca_path.map(|p| p.to_string()),
                ..TlsConfig::default()
            }),
            ..HttpConfig::default()
        }
    }

    #[test]
    fn strict_tls_missing_ca_fails_endpoint_creation() {
        let component =
            HttpComponent::with_config(strict_config(Some("/nonexistent/ca.pem"), true));
        let err = component
            .create_endpoint("http://localhost/api", &NoOpComponentContext)
            .err()
            .expect("strict + missing CA must fail endpoint creation");
        assert!(
            err.to_string().contains("tls.strict"),
            "must name the strict knob: {err}"
        );
        assert!(
            err.to_string().contains("unreadable"),
            "must name the failure class: {err}"
        );
    }

    #[test]
    fn strict_tls_unparseable_ca_fails_endpoint_creation() {
        let path = camel_component_api::test_support::tls::write_pem_tmp(
            "strict-bad-ca.pem",
            "not a certificate",
        );
        let component =
            HttpComponent::with_config(strict_config(Some(path.to_str().unwrap()), true));
        let err = component
            .create_endpoint("http://localhost/api", &NoOpComponentContext)
            .err()
            .expect("strict + unparseable CA must fail endpoint creation");
        assert!(
            err.to_string()
                .contains("no parseable PEM CERTIFICATE section"),
            "must name the failure class: {err}"
        );
    }

    #[test]
    fn strict_tls_der_file_rejected_not_certified() {
        // e_glm stage-4 finding 1: a DER-looking file (first byte 0x30 =
        // ASCII '0') must NOT pass strict — the rustls backend never
        // enforces lone-DER bundles, so certifying one would certify an
        // unenforced config.
        let path = camel_component_api::test_support::tls::write_pem_tmp(
            "strict-der-ca.pem",
            "00
garbage-bytes",
        );
        let component =
            HttpComponent::with_config(strict_config(Some(path.to_str().unwrap()), true));
        let err = component
            .create_endpoint("http://localhost/api", &NoOpComponentContext)
            .err()
            .expect("strict + DER file must fail endpoint creation");
        assert!(
            err.to_string().contains("convert to PEM"),
            "must tell the operator to convert: {err}"
        );
    }

    #[test]
    fn strict_tls_half_mtls_pair_rejected() {
        // e_glm stage-4 finding 2: cert XOR key must fail under strict,
        // not silently degrade to non-mTLS.
        let cfg = strict_mtls_config(Some("/any/cert.pem"), None);
        let component = HttpComponent::with_config(cfg);
        let err = component
            .create_endpoint("http://localhost/api", &NoOpComponentContext)
            .err()
            .expect("strict + half mTLS pair must fail endpoint creation");
        assert!(
            err.to_string().contains("BOTH"),
            "must name the pair requirement: {err}"
        );
    }

    #[test]
    fn strict_tls_valid_material_allows_endpoint_creation() {
        let (ca, _cert, _key) = camel_component_api::test_support::tls::gen_server_cert();
        let path = camel_component_api::test_support::tls::write_pem_tmp("strict-ok-ca.pem", &ca);
        let component =
            HttpComponent::with_config(strict_config(Some(path.to_str().unwrap()), true));
        assert!(
            component
                .create_endpoint("http://localhost/api", &NoOpComponentContext)
                .is_ok(),
            "valid CA under strict must create the endpoint"
        );
    }

    #[test]
    fn permissive_missing_ca_keeps_back_compat() {
        // strict absent (false): the F2-7 warn-and-fallback behavior stays;
        // endpoint creation succeeds.
        let component =
            HttpComponent::with_config(strict_config(Some("/nonexistent/ca.pem"), false));
        assert!(
            component
                .create_endpoint("http://localhost/api", &NoOpComponentContext)
                .is_ok(),
            "permissive mode must keep the back-compat fallback"
        );
    }

    fn strict_mtls_config(cert_path: Option<&str>, key_path: Option<&str>) -> HttpConfig {
        HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                client_cert_path: cert_path.map(|p| p.to_string()),
                client_key_path: key_path.map(|p| p.to_string()),
                ..TlsConfig::default()
            }),
            ..HttpConfig::default()
        }
    }

    #[test]
    fn strict_tls_missing_mtls_cert_fails_endpoint_creation() {
        // Key present, cert file missing: a half-readable mTLS pair must
        // fail creation under strict, not silently drop the identity.
        let (_ca, _cert, key) = camel_component_api::test_support::tls::gen_server_cert();
        let key_path =
            camel_component_api::test_support::tls::write_pem_tmp("strict-mtls-key.pem", &key);
        let component = HttpComponent::with_config(strict_mtls_config(
            Some("/nonexistent/cert.pem"),
            Some(key_path.to_str().unwrap()),
        ));
        let err = component
            .create_endpoint("http://localhost/api", &NoOpComponentContext)
            .err()
            .expect("strict + unreadable mTLS pair must fail endpoint creation");
        assert!(
            err.to_string().contains("tls.strict"),
            "must name the strict knob: {err}"
        );
        assert!(
            err.to_string().contains("unreadable"),
            "must name the failure class: {err}"
        );
    }

    #[test]
    fn strict_tls_valid_mtls_pair_allows_endpoint_creation() {
        let (_ca, cert, key) = camel_component_api::test_support::tls::gen_server_cert();
        let cert_path =
            camel_component_api::test_support::tls::write_pem_tmp("strict-mtls-cert.pem", &cert);
        let key_path =
            camel_component_api::test_support::tls::write_pem_tmp("strict-mtls-key2.pem", &key);
        let component = HttpComponent::with_config(strict_mtls_config(
            Some(cert_path.to_str().unwrap()),
            Some(key_path.to_str().unwrap()),
        ));
        assert!(
            component
                .create_endpoint("http://localhost/api", &NoOpComponentContext)
                .is_ok(),
            "valid mTLS pair under strict must create the endpoint"
        );
    }

    #[test]
    fn test_https_component_scheme() {
        let component = HttpsComponent::new();
        assert_eq!(component.scheme(), "https");
    }

    #[test]
    fn test_http_endpoint_creates_consumer() {
        let component = HttpComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint("http://0.0.0.0:19100/test", &ctx)
            .unwrap();
        assert!(endpoint.create_consumer(rt()).is_ok());
    }

    #[test]
    fn test_https_endpoint_creates_consumer_errors_without_tls() {
        let component = HttpsComponent::new();
        let ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint("https://0.0.0.0:8443/test", &ctx)
            .unwrap();
        // https:// without tlsCert/tlsKey must fail (scheme enforcement)
        assert!(endpoint.create_consumer(rt()).is_err());
    }

    #[test]
    fn test_http_endpoint_creates_producer() {
        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint("http://localhost/api", &endpoint_ctx)
            .unwrap();
        assert!(endpoint.create_producer(rt(), &ctx).is_ok());
    }

    // -----------------------------------------------------------------------
    // Producer tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_producer_with_token_provider() {
        use camel_auth::oauth2::TokenProvider;
        use tower::ServiceExt;

        let captured_auth: Arc<std::sync::Mutex<Option<String>>> =
            Arc::new(std::sync::Mutex::new(None));
        let captured_clone = Arc::clone(&captured_auth);

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();

        let _handle = tokio::spawn(async move {
            use tokio::io::{AsyncReadExt, AsyncWriteExt};
            if let Ok((mut stream, _)) = listener.accept().await {
                let mut buf = vec![0u8; 8192];
                let n = stream.read(&mut buf).await.unwrap_or(0);
                let request = String::from_utf8_lossy(&buf[..n]).to_string();
                let auth = request
                    .lines()
                    .find(|l| l.to_lowercase().starts_with("authorization:"))
                    .map(|l| {
                        l.split(':')
                            .nth(1)
                            .map(|s| s.trim().to_string())
                            .unwrap_or_default()
                    });
                *captured_clone.lock().unwrap() = auth;
                let body = r#"{"echo":"ok"}"#;
                let resp = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
                    body.len(),
                    body
                );
                let _ = stream.write_all(resp.as_bytes()).await;
            }
        });

        #[derive(Debug)]
        struct StaticProvider;
        #[async_trait::async_trait]
        impl TokenProvider for StaticProvider {
            async fn get_token(&self) -> Result<String, camel_auth::types::AuthError> {
                Ok("injected-token".into())
            }
        }

        let uri = format!("http://127.0.0.1:{}/api?allowInternal=true", port);
        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component.create_endpoint(&uri, &endpoint_ctx).unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::new("hello"));

        let layer = BearerTokenLayer::new(Arc::new(StaticProvider));
        let mut layered = layer.layer(producer);
        let result = layered.ready().await.unwrap().call(exchange).await;
        assert!(result.is_ok(), "producer call failed: {:?}", result);

        tokio::time::sleep(Duration::from_millis(100)).await;
        let auth = captured_auth.lock().unwrap().take();
        assert_eq!(auth.as_deref(), Some("Bearer injected-token"));
    }

    async fn start_test_server() -> (String, tokio::task::JoinHandle<()>) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let handle = tokio::spawn(async move {
            loop {
                if let Ok((mut stream, _)) = listener.accept().await {
                    tokio::spawn(async move {
                        use tokio::io::{AsyncReadExt, AsyncWriteExt};
                        let mut buf = vec![0u8; 4096];
                        let n = stream.read(&mut buf).await.unwrap_or(0);
                        let request = String::from_utf8_lossy(&buf[..n]).to_string();

                        let method = request.split_whitespace().next().unwrap_or("GET");

                        let body = format!(r#"{{"method":"{}","echo":"ok"}}"#, method);
                        let response = format!(
                            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nX-Custom: test-value\r\n\r\n{}",
                            body.len(),
                            body
                        );
                        let _ = stream.write_all(response.as_bytes()).await;
                    });
                }
            }
        });

        (url, handle)
    }

    async fn start_status_server(status: u16) -> (String, tokio::task::JoinHandle<()>) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let handle = tokio::spawn(async move {
            loop {
                if let Ok((mut stream, _)) = listener.accept().await {
                    let status = status;
                    tokio::spawn(async move {
                        use tokio::io::{AsyncReadExt, AsyncWriteExt};
                        let mut buf = vec![0u8; 4096];
                        let _ = stream.read(&mut buf).await;

                        let status_text = match status {
                            404 => "Not Found",
                            500 => "Internal Server Error",
                            _ => "Error",
                        };
                        let body = "error body";
                        let response = format!(
                            "HTTP/1.1 {} {}\r\nContent-Length: {}\r\n\r\n{}",
                            status,
                            status_text,
                            body.len(),
                            body
                        );
                        let _ = stream.write_all(response.as_bytes()).await;
                    });
                }
            }
        });

        (url, handle)
    }

    async fn start_request_capturing_server() -> (
        String,
        Arc<std::sync::Mutex<Option<String>>>,
        tokio::task::JoinHandle<()>,
    ) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        let url = format!("http://127.0.0.1:{port}");
        let captured: Arc<std::sync::Mutex<Option<String>>> = Arc::new(std::sync::Mutex::new(None));
        let captured_clone = Arc::clone(&captured);
        let handle = tokio::spawn(async move {
            use tokio::io::{AsyncReadExt, AsyncWriteExt};
            if let Ok((mut stream, _)) = listener.accept().await {
                let mut buf = vec![0u8; 16384];
                let n = stream.read(&mut buf).await.unwrap_or(0);
                let request = String::from_utf8_lossy(&buf[..n]).to_string();
                if request.contains("\r\n\r\n") {
                    *captured_clone.lock().unwrap() = Some(request);
                }
                let body = r#"{"echo":"ok"}"#;
                let resp = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
                    body.len(),
                    body
                );
                let _ = stream.write_all(resp.as_bytes()).await;
            }
        });
        (url, captured, handle)
    }

    #[tokio::test]
    async fn test_http_producer_get_request() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api/test?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);

        assert!(!result.input.body.is_empty());
    }

    #[tokio::test]
    async fn producer_excludes_host_and_framing() {
        use tower::ServiceExt;

        let (url, captured, _handle) = start_request_capturing_server().await;
        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api/test?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header("Host", "localhost");
        exchange.input.set_header("Content-Length", "42");
        exchange.input.set_header("Connection", "keep-alive");
        exchange.input.set_header("Upgrade", "h2c");

        let result = producer.oneshot(exchange).await;
        assert!(result.is_ok(), "producer call failed: {:?}", result);

        tokio::time::sleep(Duration::from_millis(100)).await;
        let request = captured
            .lock()
            .unwrap()
            .take()
            .expect("no outbound request captured");
        let lower = request.to_ascii_lowercase();
        assert!(
            !lower.contains("\r\nhost: localhost"),
            "forwarded Host: localhost must be stripped\n{request}"
        );
        assert!(
            !lower.contains("content-length: 42"),
            "exchange Content-Length must not be copied\n{request}"
        );
        assert!(
            !lower.lines().any(|l| l.starts_with("connection:")),
            "Connection header must not be forwarded\n{request}"
        );
        assert!(
            !lower.lines().any(|l| l.starts_with("upgrade:")),
            "Upgrade header must not be forwarded\n{request}"
        );
        let host_header = lower
            .lines()
            .find(|l| l.starts_with("host:"))
            .map(|l| l.split_once(':').map(|(_, v)| v).unwrap_or("").trim())
            .expect("outbound Host header must be set by reqwest");
        assert!(
            host_header.starts_with("127.0.0.1:"),
            "outbound Host '{host_header}' must match the capture-server address"
        );
    }

    #[tokio::test]
    async fn producer_forwards_request_only_headers() {
        use tower::ServiceExt;

        let (url, captured, _handle) = start_request_capturing_server().await;
        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api/test?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header("Accept", "application/json");
        exchange.input.set_header("User-Agent", "myclient/1.0");

        let result = producer.oneshot(exchange).await;
        assert!(result.is_ok(), "producer call failed: {:?}", result);

        tokio::time::sleep(Duration::from_millis(100)).await;
        let request = captured
            .lock()
            .unwrap()
            .take()
            .expect("no outbound request captured");
        let lower = request.to_ascii_lowercase();
        assert!(
            lower.contains("accept: application/json"),
            "request-only Accept header must be forwarded\n{request}"
        );
        assert!(
            lower.contains("user-agent: myclient/1.0"),
            "request-only User-Agent header must be forwarded\n{request}"
        );
    }

    // -----------------------------------------------------------------------
    // Configured-header construction failures are surfaced, never silent
    // (rc-jbs1v)
    // -----------------------------------------------------------------------

    /// Build an endpoint whose URI parses normally but whose `user_agent`
    /// and `auth` are then overridden programmatically, so CRLF-bearing
    /// test values never pass through URI parsing.
    fn endpoint_with_config_overrides(
        base_url: &str,
        user_agent: Option<String>,
        auth: HttpAuth,
    ) -> HttpEndpoint {
        let uri = format!("{base_url}/api/test?allowInternal=true");
        let mut config =
            HttpEndpointConfig::from_uri(&uri).expect("producer endpoint config parses");
        config.user_agent = user_agent;
        config.auth = auth;
        HttpEndpoint {
            uri: uri.clone(),
            config,
            server_config: HttpServerConfig::from_uri(&uri).expect("server config parses"),
            client: plain_http_test_client(),
            pinned_cache: Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            http_config: HttpConfig::default(),
        }
    }

    /// A configured user-agent / bearer token that fails `HeaderValue`
    /// construction must be dropped with a DEBUG record (name + reason
    /// only, never the value — ADR-0051) and reach the wire absent, while
    /// a valid config passes through unchanged.
    #[tracing_test::traced_test]
    #[tokio::test]
    async fn producer_invalid_configured_headers_surfaced() {
        use tower::ServiceExt;

        let (bad_url, bad_captured, _bad_handle) = start_request_capturing_server().await;
        let (ok_url, ok_captured, _ok_handle) = start_request_capturing_server().await;
        let ctx = test_producer_ctx();

        let bad_producer = endpoint_with_config_overrides(
            &bad_url,
            Some("bad\r\nua".to_string()),
            HttpAuth::Bearer {
                token: "tok\r\nen".to_string(),
            },
        )
        .create_producer(rt(), &ctx)
        .unwrap();
        let ok_producer = endpoint_with_config_overrides(
            &ok_url,
            Some("httpsweep-ok/1".to_string()),
            HttpAuth::Bearer {
                token: "valid-token".to_string(),
            },
        )
        .create_producer(rt(), &ctx)
        .unwrap();

        let bad_exchange = Exchange::new(Message::default());
        let ok_exchange = Exchange::new(Message::default());
        let bad_cid = bad_exchange.correlation_id().to_string();
        let ok_cid = ok_exchange.correlation_id().to_string();

        let bad_result = bad_producer.oneshot(bad_exchange).await;
        assert!(
            bad_result.is_ok(),
            "invalid-config producer call failed: {bad_result:?}"
        );
        let ok_result = ok_producer.oneshot(ok_exchange).await;
        assert!(
            ok_result.is_ok(),
            "valid-config producer call failed: {ok_result:?}"
        );

        tokio::time::sleep(Duration::from_millis(100)).await;
        let bad_request = bad_captured
            .lock()
            .unwrap()
            .take()
            .expect("no outbound request captured");
        let ok_request = ok_captured
            .lock()
            .unwrap()
            .take()
            .expect("no outbound request captured");

        // Invalid config: neither header reaches the wire. Value-absence,
        // not "any UA" — reqwest may inject a default user-agent.
        let bad_lower = bad_request.to_ascii_lowercase();
        assert!(
            !bad_lower.lines().any(|l| l.starts_with("authorization:")),
            "invalid Bearer token must not reach the wire\n{bad_request}"
        );
        assert!(
            !bad_request.contains("bad\r\nua"),
            "invalid configured user-agent must not reach the wire\n{bad_request}"
        );

        logs_assert(|lines: &[&str]| {
            let drops: Vec<&&str> = lines
                .iter()
                .filter(|l| {
                    l.contains("outbound header dropped")
                        && l.contains(&format!("correlation_id={bad_cid}"))
                })
                .collect();
            if drops.len() != 2 {
                return Err(format!(
                    "expected exactly 2 drop records for {bad_cid}, found {}",
                    drops.len()
                ));
            }
            let has_ua = drops.iter().any(|l| l.contains("header=user-agent"));
            let has_auth = drops.iter().any(|l| l.contains("header=authorization"));
            let reason_ok = drops
                .iter()
                .all(|l| l.contains("outbound header dropped: invalid header value"));
            match (has_ua, has_auth, reason_ok) {
                (true, true, true) => Ok(()),
                _ => Err(format!(
                    "drop records mismatched: user-agent={has_ua} \
                     authorization={has_auth} reason-ok={reason_ok}"
                )),
            }
        });
        logs_assert(|lines: &[&str]| {
            if lines
                .iter()
                .any(|l| l.contains("bad\r\nua") || l.contains("tok\r\nen"))
            {
                Err("sentinel CRLF values leaked into logs".to_string())
            } else {
                Ok(())
            }
        });

        // Valid config: both headers reach the wire exactly as configured,
        // with zero drop records.
        let ok_lower = ok_request.to_ascii_lowercase();
        assert!(
            ok_lower.contains("user-agent: httpsweep-ok/1"),
            "valid configured user-agent must reach the wire\n{ok_request}"
        );
        assert!(
            ok_lower.contains("authorization: bearer valid-token"),
            "valid Bearer token must reach the wire\n{ok_request}"
        );
        logs_assert(|lines: &[&str]| {
            let hits = lines
                .iter()
                .filter(|l| {
                    l.contains("outbound header dropped")
                        && l.contains(&format!("correlation_id={ok_cid}"))
                })
                .count();
            match hits {
                0 => Ok(()),
                n => Err(format!("expected no drop records for {ok_cid}, found {n}")),
            }
        });
    }

    #[tokio::test]
    async fn producer_honours_skip_request_headers() {
        use tower::ServiceExt;

        let (url, captured, _handle) = start_request_capturing_server().await;
        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}/api/test?allowInternal=true&skipRequestHeaders=Authorization"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header("Authorization", "Bearer x");

        let result = producer.oneshot(exchange).await;
        assert!(result.is_ok(), "producer call failed: {:?}", result);

        tokio::time::sleep(Duration::from_millis(100)).await;
        let request = captured
            .lock()
            .unwrap()
            .take()
            .expect("no outbound request captured");
        assert!(
            !request.to_ascii_lowercase().contains("authorization"),
            "Authorization must be stripped by skipRequestHeaders\n{request}"
        );
    }

    #[tokio::test]
    async fn producer_stringifies_scalar_header_values_on_wire() {
        use tower::ServiceExt;

        let (url, captured, _handle) = start_request_capturing_server().await;
        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api/test?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header("X-Retries", serde_json::json!(3));
        exchange
            .input
            .set_header("X-Enabled", serde_json::json!(true));
        exchange
            .input
            .set_header("X-Obj", serde_json::json!({"a": 1}));

        let result = producer.oneshot(exchange).await;
        assert!(result.is_ok(), "producer call failed: {:?}", result);

        tokio::time::sleep(Duration::from_millis(100)).await;
        let request = captured
            .lock()
            .unwrap()
            .take()
            .expect("no outbound request captured");
        let lower = request.to_ascii_lowercase();
        assert!(
            lower.contains("x-retries: 3"),
            "numeric header must reach the wire stringified\n{request}"
        );
        assert!(
            lower.contains("x-enabled: true"),
            "bool header must reach the wire stringified\n{request}"
        );
        assert!(
            !lower.contains("x-obj:"),
            "object header has no single-value form and must not reach the wire\n{request}"
        );
    }

    #[tokio::test]
    async fn test_http_producer_post_with_body() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api/data?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::new("request body"));
        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    #[tokio::test]
    async fn test_http_producer_method_from_header() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpMethod",
            serde_json::Value::String("DELETE".to_string()),
        );

        let result = producer.oneshot(exchange).await.unwrap();
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    #[tokio::test]
    async fn test_http_producer_forced_method() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}/api?httpMethod=PUT&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    #[tokio::test]
    async fn test_http_producer_throw_exception_on_failure() {
        use tower::ServiceExt;

        let (url, _handle) = start_status_server(404).await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}/not-found?allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await;
        assert!(result.is_err());

        match result.unwrap_err() {
            CamelError::HttpOperationFailed { status_code, .. } => {
                assert_eq!(status_code, 404);
            }
            e => panic!("Expected HttpOperationFailed, got: {e}"),
        }
    }

    #[tokio::test]
    async fn test_http_producer_no_throw_on_failure() {
        use tower::ServiceExt;

        let (url, _handle) = start_status_server(500).await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}/error?throwExceptionOnFailure=false&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 500);
    }

    #[tokio::test]
    async fn test_http_producer_uri_override() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                "http://localhost:1/does-not-exist?allowInternal=true",
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String(format!("{url}/api")),
        );

        let result = producer.oneshot(exchange).await.unwrap();
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    #[tokio::test]
    async fn test_http_producer_response_headers_mapped() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        assert!(
            result.input.header("Content-Type").is_some(),
            "Response should have Content-Type header"
        );
        assert!(result.input.header("CamelHttpResponseText").is_some());
    }

    // -----------------------------------------------------------------------
    // Bug fix tests: Client configuration per-endpoint
    // -----------------------------------------------------------------------

    async fn start_redirect_server() -> (String, tokio::task::JoinHandle<()>) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let handle = tokio::spawn(async move {
            use tokio::io::{AsyncReadExt, AsyncWriteExt};
            loop {
                if let Ok((mut stream, _)) = listener.accept().await {
                    tokio::spawn(async move {
                        let mut buf = vec![0u8; 4096];
                        let n = stream.read(&mut buf).await.unwrap_or(0);
                        let request = String::from_utf8_lossy(&buf[..n]).to_string();

                        // Check if this is a request to /final
                        if request.contains("GET /final") {
                            let body = r#"{"status":"final"}"#;
                            let response = format!(
                                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
                                body.len(),
                                body
                            );
                            let _ = stream.write_all(response.as_bytes()).await;
                        } else {
                            // Redirect to /final
                            // Connection: close stops the client pooling the
                            // connection the server drops right after this
                            // response (pooled-race, rc-u3aw class).
                            let response = "HTTP/1.1 302 Found\r\nLocation: /final\r\nConnection: close\r\nContent-Length: 0\r\n\r\n";
                            let _ = stream.write_all(response.as_bytes()).await;
                        }
                    });
                }
            }
        });

        (url, handle)
    }

    struct CapturedRequest {
        method: String,
        path: String,
        body: Vec<u8>,
        content_length: Option<String>,
        transfer_encoding: Option<String>,
    }

    /// Parse a request head plus its Content-Length-driven body from a freshly
    /// accepted connection. Returns `None` if the client closes before sending
    /// a complete request head. Does NOT read until EOF/shutdown (reqwest pools
    /// keep-alive connections and never sends FIN) and does NOT rely on a
    /// single fixed-size read (a segmented small body would flake).
    async fn capture_request(stream: &mut tokio::net::TcpStream) -> Option<CapturedRequest> {
        use tokio::io::AsyncReadExt;

        // Read the request head (up to and including the terminating CRLF CRLF).
        let mut buf: Vec<u8> = Vec::new();
        let mut chunk = [0u8; 4096];
        let head_end: usize;
        loop {
            let n = stream.read(&mut chunk).await.unwrap_or(0);
            if n == 0 {
                return None;
            }
            buf.extend_from_slice(&chunk[..n]);
            if let Some(pos) = buf.windows(4).position(|w| w == b"\r\n\r\n") {
                head_end = pos + 4;
                break;
            }
        }

        // Parse the request head.
        let head = String::from_utf8_lossy(&buf[..head_end]);
        let mut lines = head.split("\r\n");
        let request_line = lines.next().unwrap_or("");
        let mut parts = request_line.split_whitespace();
        let method = parts.next().unwrap_or("").to_string();
        let path = parts.next().unwrap_or("").to_string();

        let mut content_length: Option<String> = None;
        let mut transfer_encoding: Option<String> = None;
        for line in lines {
            if let Some((name, value)) = line.split_once(':') {
                let name = name.trim().to_ascii_lowercase();
                let value = value.trim().to_string();
                if name == "content-length" {
                    content_length = Some(value);
                } else if name == "transfer-encoding" {
                    transfer_encoding = Some(value);
                }
            }
        }

        // Content-Length-driven exact read. A missing header means a 0-length body.
        let body_len: usize = content_length
            .as_deref()
            .and_then(|v| v.parse::<usize>().ok())
            .unwrap_or(0);

        let mut body: Vec<u8> = buf[head_end..].to_vec();
        while body.len() < body_len {
            let n = stream.read(&mut chunk).await.unwrap_or(0);
            if n == 0 {
                break;
            }
            body.extend_from_slice(&chunk[..n]);
        }
        body.truncate(body_len);

        Some(CapturedRequest {
            method,
            path,
            body,
            content_length,
            transfer_encoding,
        })
    }

    /// A raw-TCP capture server. Each connection parses the request head, then
    /// performs a Content-Length-driven exact read of the body (see
    /// [`capture_request`]). Each connection is dropped after the response so
    /// every hop opens a fresh connection.
    async fn start_capture_server() -> (
        String,
        tokio::task::JoinHandle<()>,
        Arc<Mutex<Vec<CapturedRequest>>>,
    ) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let captured: Arc<Mutex<Vec<CapturedRequest>>> = Arc::new(Mutex::new(Vec::new()));
        let captured_for_return = Arc::clone(&captured);

        let handle = tokio::spawn(async move {
            use tokio::io::AsyncWriteExt;
            loop {
                // Per-iteration deadline (lintwiden D4.2, idle-relay
                // re-arm): every caller drops the returned handle, so
                // this accept loop is a detached server for the test
                // process's lifetime and quiet gaps between client
                // requests are normal — a lapsed deadline re-arms (as
                // does a transient accept error, prior behavior).
                // Process exit reaps the task.
                if let Ok(Ok((mut stream, _))) =
                    tokio::time::timeout(Duration::from_secs(10), listener.accept()).await
                {
                    let captured = Arc::clone(&captured);
                    tokio::spawn(async move {
                        // Per-connection deadline (lintwiden D4.2): a client
                        // that connects but never completes a request must
                        // not pin the handler task — drop the connection.
                        let Some(req) = tokio::time::timeout(
                            Duration::from_secs(10),
                            capture_request(&mut stream),
                        )
                        .await
                        .ok()
                        .flatten() else {
                            return;
                        };
                        captured.lock().unwrap().push(req);

                        // 200 OK with Content-Length: 0 and no body, then drop
                        // the stream so the client opens a fresh connection.
                        let response = "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n";
                        let _ = stream.write_all(response.as_bytes()).await;
                    });
                }
            }
        });

        (url, handle, captured_for_return)
    }

    /// A raw-TCP capture server whose `/hop307` and `/hop308` paths answer with
    /// `307 Temporary Redirect` / `308 Permanent Redirect` to `/final`, and
    /// whose `/final` path answers `200 OK` with an empty body. Every hop
    /// records a `CapturedRequest` (Content-Length-driven exact read) and drops
    /// the connection after responding so each hop is a fresh connection.
    async fn start_redirect_capture_server() -> (
        String,
        tokio::task::JoinHandle<()>,
        Arc<Mutex<Vec<CapturedRequest>>>,
    ) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let captured: Arc<Mutex<Vec<CapturedRequest>>> = Arc::new(Mutex::new(Vec::new()));
        let captured_for_return = Arc::clone(&captured);

        let handle = tokio::spawn(async move {
            use tokio::io::AsyncWriteExt;
            loop {
                // Per-iteration deadline (lintwiden D4.2, idle-relay
                // re-arm): every caller drops the returned handle, so
                // this accept loop is a detached server for the test
                // process's lifetime and quiet gaps between client
                // requests are normal — a lapsed deadline re-arms (as
                // does a transient accept error, prior behavior).
                // Process exit reaps the task.
                if let Ok(Ok((mut stream, _))) =
                    tokio::time::timeout(Duration::from_secs(10), listener.accept()).await
                {
                    let captured = Arc::clone(&captured);
                    tokio::spawn(async move {
                        // Per-connection deadline (lintwiden D4.2): a client
                        // that connects but never completes a request must
                        // not pin the handler task — drop the connection.
                        let Some(req) = tokio::time::timeout(
                            Duration::from_secs(10),
                            capture_request(&mut stream),
                        )
                        .await
                        .ok()
                        .flatten() else {
                            return;
                        };
                        let path = req.path.clone();
                        captured.lock().unwrap().push(req);

                        let (status_line, location) = match path.as_str() {
                            "/hop307" => ("HTTP/1.1 307 Temporary Redirect", Some("/final")),
                            "/hop308" => ("HTTP/1.1 308 Permanent Redirect", Some("/final")),
                            "/final" => ("HTTP/1.1 200 OK", None),
                            _ => ("HTTP/1.1 404 Not Found", None),
                        };

                        let response = match location {
                            // Connection: close stops the client pooling the
                            // connection this handler drops right after the
                            // response (pooled-race, rc-u3aw class).
                            Some(loc) => format!(
                                "{status_line}\r\nLocation: {loc}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
                            ),
                            None => format!("{status_line}\r\nContent-Length: 0\r\n\r\n"),
                        };
                        let _ = stream.write_all(response.as_bytes()).await;
                    });
                }
            }
        });

        (url, handle, captured_for_return)
    }

    #[tokio::test]
    async fn test_get_with_body_sends_no_body_and_no_framing_headers() {
        use tower::ServiceExt;

        let (url, _handle, captured) = start_capture_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?httpMethod=GET&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.body = Body::Bytes(bytes::Bytes::from_static(b"payload"));

        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);

        let captured = captured.lock().unwrap();
        assert_eq!(captured.len(), 1, "expected exactly one captured request");
        let req = &captured[0];
        assert_eq!(req.method, "GET");
        // `httpMethod`/`allowInternal` are URI options, not request-target
        // query params, so the origin-form target is just "/".
        assert_eq!(req.path, "/");
        assert!(req.body.is_empty(), "GET must not carry a body");
        assert!(
            req.content_length.is_none(),
            "suppressed request must not carry Content-Length"
        );
        assert!(
            req.transfer_encoding.is_none(),
            "suppressed request must not carry Transfer-Encoding"
        );

        // The exchange body is consumed by the producer (std::mem::take).
        assert!(
            result.input.body.is_empty(),
            "exchange body must be consumed"
        );
    }

    #[tokio::test]
    async fn test_head_with_body_suppressed_via_header() {
        use tower::ServiceExt;

        let (url, _handle, captured) = start_capture_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpMethod",
            serde_json::Value::String("HEAD".to_string()),
        );
        exchange.input.body = Body::Bytes(bytes::Bytes::from_static(b"payload"));

        let result = producer.oneshot(exchange).await.unwrap();
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);

        let captured = captured.lock().unwrap();
        assert_eq!(captured.len(), 1);
        let req = &captured[0];
        assert_eq!(req.method, "HEAD");
        assert!(req.body.is_empty(), "HEAD must not carry a body");
    }

    #[tokio::test]
    async fn test_delete_options_trace_with_body_suppressed() {
        use tower::ServiceExt;

        let (url, _handle, captured) = start_capture_server().await;
        let ctx = test_producer_ctx();
        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;

        for method in ["DELETE", "OPTIONS", "TRACE"] {
            let endpoint = component
                .create_endpoint(
                    &format!("{url}?httpMethod={method}&allowInternal=true"),
                    &endpoint_ctx,
                )
                .unwrap();
            let producer = endpoint.create_producer(rt(), &ctx).unwrap();

            let mut exchange = Exchange::new(Message::default());
            exchange.input.body = Body::Bytes(bytes::Bytes::from_static(b"payload"));

            let result = producer.oneshot(exchange).await.unwrap();
            let status = result
                .input
                .header("CamelHttpResponseCode")
                .and_then(|v| v.as_u64())
                .unwrap();
            assert_eq!(status, 200, "method {method} should succeed");
        }

        let captured = captured.lock().unwrap();
        assert_eq!(captured.len(), 3, "expected three captured requests");
        for method in ["DELETE", "OPTIONS", "TRACE"] {
            let req = captured
                .iter()
                .find(|r| r.method == method)
                .unwrap_or_else(|| panic!("missing captured request for {method}"));
            assert!(req.body.is_empty(), "{} must not carry a body", req.method);
        }
    }

    #[tokio::test]
    async fn test_post_put_patch_with_body_still_sent() {
        use tower::ServiceExt;

        let (url, _handle, captured) = start_capture_server().await;
        let ctx = test_producer_ctx();
        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;

        for method in ["POST", "PUT", "PATCH"] {
            let endpoint = component
                .create_endpoint(
                    &format!("{url}?httpMethod={method}&allowInternal=true"),
                    &endpoint_ctx,
                )
                .unwrap();
            let producer = endpoint.create_producer(rt(), &ctx).unwrap();

            let payload = format!("body-for-{method}");
            let mut exchange = Exchange::new(Message::default());
            exchange.input.body = Body::Bytes(bytes::Bytes::from(payload.as_bytes().to_vec()));

            let result = producer.oneshot(exchange).await.unwrap();
            let status = result
                .input
                .header("CamelHttpResponseCode")
                .and_then(|v| v.as_u64())
                .unwrap();
            assert_eq!(status, 200, "method {method} should succeed");
        }

        let captured = captured.lock().unwrap();
        assert_eq!(captured.len(), 3, "expected three captured requests");
        for method in ["POST", "PUT", "PATCH"] {
            let req = captured
                .iter()
                .find(|r| r.method == method)
                .unwrap_or_else(|| panic!("missing captured request for {method}"));
            let expected = format!("body-for-{method}");
            assert!(!req.body.is_empty(), "{method} must still carry its body");
            assert_eq!(req.body, expected.as_bytes(), "{method} body mismatch");
        }
    }

    /// A GET with a stream body must not attach the stream: the entity-enclosing
    /// gate drops the stream (mem::take) before the request is built, leaving
    /// the exchange body Empty instead of a partially-consumed Body::Stream.
    #[tokio::test]
    async fn test_stream_body_under_get_not_attached() {
        use tower::ServiceExt;

        let (url, _handle, captured) = start_capture_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?httpMethod=GET&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let chunks: Vec<Result<bytes::Bytes, CamelError>> =
            vec![Ok(bytes::Bytes::from_static(b"stream-body"))];
        let stream = Box::pin(futures::stream::iter(chunks));
        let mut exchange = Exchange::new(Message::default());
        exchange.input.body = Body::Stream(StreamBody {
            stream: Arc::new(tokio::sync::Mutex::new(Some(stream))),
            metadata: StreamMetadata::default(),
        });

        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);

        let captured = captured.lock().unwrap();
        assert_eq!(captured.len(), 1, "expected exactly one captured request");
        assert!(
            captured[0].body.is_empty(),
            "GET must not carry a stream body"
        );
        assert!(
            captured[0].transfer_encoding.is_none(),
            "suppressed request must not carry Transfer-Encoding"
        );
        assert!(
            captured[0].content_length.is_none(),
            "suppressed request must not carry Content-Length"
        );
        assert!(
            result.input.body.is_empty(),
            "exchange body must be consumed to Empty, not left as a stream"
        );
    }

    /// A suppressed body must never be replayed across 307/308 redirect hops:
    /// the gate empties `materialized_body` before the redirect loop runs, so
    /// neither the first hop nor the final hop carries the body.
    #[tokio::test]
    async fn test_redirect_hops_never_replay_suppressed_body() {
        use tower::ServiceExt;

        let (url, _handle, captured) = start_redirect_capture_server().await;
        let ctx = test_producer_ctx();

        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(true));
        let endpoint_ctx = NoOpComponentContext;

        for path in ["/hop307", "/hop308"] {
            let endpoint = component
                .create_endpoint(
                    &format!("{url}{path}?httpMethod=GET&allowInternal=true"),
                    &endpoint_ctx,
                )
                .unwrap();
            let producer = endpoint.create_producer(rt(), &ctx).unwrap();

            let mut exchange = Exchange::new(Message::default());
            exchange.input.body = Body::Bytes(bytes::Bytes::from_static(b"payload"));

            let result = producer.oneshot(exchange).await.unwrap();
            let status = result
                .input
                .header("CamelHttpResponseCode")
                .and_then(|v| v.as_u64())
                .unwrap();
            assert_eq!(
                status, 200,
                "redirect chain for {path} should end at /final"
            );
        }

        // Two chains (307 and 308), each with two hops (redirect + final).
        let captured = captured.lock().unwrap();
        assert_eq!(captured.len(), 4, "expected 2 chains × 2 hops");
        for req in captured.iter() {
            assert!(
                req.body.is_empty(),
                "hop {} {} must not carry a body",
                req.method,
                req.path
            );
        }
    }

    /// The warn! emitted on a suppressed body renders three distinguishable
    /// substrings in the log line (tracing-subscriber default field format):
    ///   - the message:       "dropping request body ..."
    ///   - `method = %method_str`            → `method=GET`
    ///   - `correlation_id = %exchange.correlation_id()` → `correlation_id=<uuid>`
    /// The closure matches all three so exactly one warn per suppressed
    /// request is required (the "HTTP request" debug! also carries
    /// `method=GET` and the same `correlation_id=`, but not the message).
    #[tracing_test::traced_test]
    #[tokio::test]
    async fn test_suppressed_body_logs_exactly_one_warn() {
        use tower::ServiceExt;

        let (url, _handle, _captured) = start_capture_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?httpMethod=GET&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.body = Body::Bytes(bytes::Bytes::from_static(b"payload"));
        let correlation_id = exchange.correlation_id().to_string();

        let result = producer.oneshot(exchange).await.unwrap();
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);

        logs_assert(|lines: &[&str]| {
            let hits = lines
                .iter()
                .filter(|l| {
                    l.contains("dropping request body")
                        && l.contains("method=GET")
                        && l.contains(&format!("correlation_id={correlation_id}"))
                })
                .count();
            match hits {
                1 => Ok(()),
                n => Err(format!("expected exactly one body-drop warn, found {n}")),
            }
        });
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn test_empty_body_get_emits_no_warn() {
        use tower::ServiceExt;

        let (url, _handle, _captured) = start_capture_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::with_config(HttpConfig::default());
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?httpMethod=GET&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);

        logs_assert(|lines: &[&str]| {
            let hits = lines
                .iter()
                .filter(|l| l.contains("dropping request body"))
                .count();
            match hits {
                0 => Ok(()),
                n => Err(format!("expected no body-drop warn, found {n}")),
            }
        });
    }

    #[tokio::test]
    async fn test_follow_redirects_false_does_not_follow() {
        use tower::ServiceExt;

        let (url, _handle) = start_redirect_server().await;
        let ctx = test_producer_ctx();

        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(false));
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?throwExceptionOnFailure=false&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        // Should get 302, NOT follow redirect to 200
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(
            status, 302,
            "Should NOT follow redirect when followRedirects=false"
        );
    }

    #[tokio::test]
    async fn test_follow_redirects_true_follows_redirect() {
        use tower::ServiceExt;

        let (url, _handle) = start_redirect_server().await;
        let ctx = test_producer_ctx();

        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(true));
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        // Should follow redirect and get 200
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(
            status, 200,
            "Should follow redirect when followRedirects=true"
        );
    }

    /// Integration test: with allowInternal=true, redirects to private IPs are followed.
    /// This verifies the manual redirect loop executes correctly.
    #[tokio::test]
    async fn test_redirect_to_private_ip_is_ssrf_blocked() {
        use tower::ServiceExt;

        // Use the existing redirect server which redirects to /final on the same server
        let (url, _handle) = start_redirect_server().await;
        let ctx = test_producer_ctx();

        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(true));
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await;

        // With allowInternal=true, the redirect should succeed
        assert!(
            result.is_ok(),
            "Redirect should succeed with allowInternal=true, got: {:?}",
            result
        );
        let exchange = result.unwrap();
        let status = exchange
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200, "Should follow redirect to /final");
    }

    /// With allowInternal=true, redirects to private IPs should be followed.
    #[tokio::test]
    async fn test_redirect_to_private_ip_allowed_when_configured() {
        use tower::ServiceExt;

        // Start a server that redirects to /final on the same server (127.0.0.1)
        let (url, _handle) = start_redirect_server().await;
        let ctx = test_producer_ctx();

        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(true));
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(
            status, 200,
            "Should follow redirect to private IP when allowInternal=true"
        );
    }

    /// Integration test: with allowInternal=false (default), a redirect to a
    /// private/metadata IP must be blocked by the SSRF guard — NOT followed.
    #[tokio::test]
    async fn test_redirect_to_private_ip_blocked_when_ssrf_guard_active() {
        use tower::ServiceExt;

        // Server that redirects to the AWS metadata endpoint (link-local private IP)
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let handle = tokio::spawn(async move {
            use tokio::io::{AsyncReadExt, AsyncWriteExt};
            loop {
                if let Ok((mut stream, _)) = listener.accept().await {
                    tokio::spawn(async move {
                        let mut buf = vec![0u8; 4096];
                        let _ = stream.read(&mut buf).await;
                        // Always redirect to the metadata endpoint
                        let response = "HTTP/1.1 302 Found\r\nLocation: http://169.254.169.254/latest/meta-data/\r\nContent-Length: 0\r\n\r\n";
                        let _ = stream.write_all(response.as_bytes()).await;
                    });
                }
            }
        });

        let ctx = test_producer_ctx();
        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(true));
        let endpoint_ctx = NoOpComponentContext;
        // allowInternal=false is the default — do NOT set it
        let endpoint = component.create_endpoint(&url, &endpoint_ctx).unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await;

        // Must be an error — SSRF guard blocks the redirect target
        assert!(
            result.is_err(),
            "Redirect to private IP 169.254.169.254 must be blocked when allowInternal=false"
        );
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("blocked IP")
                || err.contains("private IP")
                || err.contains("SSRF")
                || err.contains("not allowed"),
            "Error should mention SSRF/IP blocking, got: {err}"
        );

        handle.abort();
    }

    /// Integration test: exceeding maxRedirects produces a clear error.
    #[tokio::test]
    async fn test_too_many_redirects_returns_error() {
        use tower::ServiceExt;

        // Server that always redirects to itself (infinite loop)
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let handle = tokio::spawn(async move {
            use tokio::io::{AsyncReadExt, AsyncWriteExt};
            loop {
                if let Ok((mut stream, _)) = listener.accept().await {
                    tokio::spawn(async move {
                        let mut buf = vec![0u8; 4096];
                        let _ = stream.read(&mut buf).await;
                        // Always redirect to /loop
                        // Connection: close stops the client pooling the
                        // connection the server drops right after this
                        // response (pooled-race, rc-u3aw).
                        let response = "HTTP/1.1 302 Found\r\nLocation: /loop\r\nConnection: close\r\nContent-Length: 0\r\n\r\n";
                        let _ = stream.write_all(response.as_bytes()).await;
                    });
                }
            }
        });

        let ctx = test_producer_ctx();
        let component =
            HttpComponent::with_config(HttpConfig::default().with_follow_redirects(true));
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?allowInternal=true&maxRedirects=2"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await;

        // With the fix, exceeding max redirects returns the redirect response
        // as-is instead of erroring. The 302 redirect response is returned
        // after followRedirects exhausts the allowed redirect count (2).
        // Disable throwExceptionOnFailure to inspect the raw response status.
        //
        // Old behavior: Err("Too many redirects (max 2)")
        // New behavior: Ok(ex) with CamelHttpResponseCode = 302
        match result {
            Err(e) => {
                // If throw_exception_on_failure is on, we get HttpOperationFailed
                let msg = e.to_string();
                assert!(
                    msg.contains("HTTP operation failed") || msg.contains("302"),
                    "expected redirect-after-exhaustion error, got: {msg}"
                );
            }
            Ok(ex) => {
                let response_code = ex
                    .input
                    .header("CamelHttpResponseCode")
                    .and_then(|v| v.as_u64());
                assert_eq!(
                    response_code,
                    Some(302),
                    "expected 302 after exhausting redirects"
                );
            }
        }

        handle.abort();
    }

    #[tokio::test]
    async fn test_query_params_forwarded_to_http_request() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        // apiKey is NOT a Camel option, should be forwarded as query param
        let endpoint = component
            .create_endpoint(
                &format!("{url}/api?apiKey=secret123&httpMethod=GET&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        // The test server returns the request info in response
        // We just verify it succeeds (the query param was sent)
        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    #[test]
    fn test_non_camel_query_params_are_forwarded() {
        // Authored pairs ride raw_query (the sole carrier); query_params is
        // programmatic-only (http-query-wire-fidelity).
        let config = HttpEndpointConfig::from_uri(
            "http://example.com/api?apiKey=secret123&httpMethod=GET&token=abc456",
        )
        .unwrap();

        // apiKey and token are NOT camel-http options: the authored bytes
        // (including the interleaved httpMethod) ride raw_query verbatim.
        assert_eq!(
            config.raw_query.as_deref(),
            Some("apiKey=secret123&httpMethod=GET&token=abc456")
        );
        assert!(config.query_params.is_empty());
    }

    #[test]
    fn test_authored_query_bytes_survive_resolve_url() {
        let config =
            HttpEndpointConfig::from_uri("http://example.com/api?q=hello%20world&tag=a+b").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Authored bytes ride verbatim: `%20` stays `%20` (never re-encoded
        // to `+` or double-encoded) and `+` stays `+`.
        assert!(url.contains("q=hello%20world"), "url was: {url}");
        assert!(url.contains("tag=a+b"), "url was: {url}");
    }

    // -----------------------------------------------------------------------
    // Timeout tests (HTTP-004)
    // -----------------------------------------------------------------------

    async fn start_slow_server(delay_ms: u64) -> (String, tokio::task::JoinHandle<()>) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let url = format!("http://127.0.0.1:{}", addr.port());

        let handle = tokio::spawn(async move {
            loop {
                if let Ok((mut stream, _)) = listener.accept().await {
                    let delay = delay_ms;
                    tokio::spawn(async move {
                        use tokio::io::{AsyncReadExt, AsyncWriteExt};
                        let mut buf = vec![0u8; 4096];
                        let _ = stream.read(&mut buf).await;
                        // Send headers immediately (no Content-Length → chunked)
                        let headers = "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\n\r\n";
                        let _ = stream.write_all(headers.as_bytes()).await;
                        // Delay before sending body chunk
                        tokio::time::sleep(Duration::from_millis(delay)).await;
                        let body = r#"{"status":"slow"}"#;
                        let chunk = format!("{:x}\r\n{}\r\n0\r\n\r\n", body.len(), body);
                        let _ = stream.write_all(chunk.as_bytes()).await;
                    });
                }
            }
        });

        (url, handle)
    }

    #[tokio::test]
    async fn test_http_producer_timeout() {
        use tower::ServiceExt;

        // Server delays 500ms, client timeout is 100ms → should timeout
        let (url, _handle) = start_slow_server(500).await;
        let ctx = test_producer_ctx();

        let component = HttpComponent::with_config(
            HttpConfig::default()
                .with_read_timeout_ms(100)
                .with_response_timeout_ms(30_000), // generous response timeout
        );
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/slow?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await;

        assert!(result.is_err(), "Expected timeout error, got: {:?}", result);
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("Read timeout") || err.contains("timeout"),
            "Error should mention timeout, got: {}",
            err
        );
    }

    #[tokio::test]
    async fn test_http_producer_no_timeout_when_fast() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let ctx = test_producer_ctx();

        let component =
            HttpComponent::with_config(HttpConfig::default().with_read_timeout_ms(5_000));
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("{url}/api?allowInternal=true"), &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());
        let result = producer.oneshot(exchange).await.unwrap();

        let status = result
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    // -----------------------------------------------------------------------
    // SSRF Protection tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_http_producer_blocks_metadata_endpoint() {
        use tower::ServiceExt;

        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint("http://example.com/api?allowInternal=false", &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://169.254.169.254/latest/meta-data/".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should block AWS metadata endpoint");

        let err = result.unwrap_err();
        assert!(
            err.to_string().contains("Private IP"),
            "Error should mention private IP blocking, got: {}",
            err
        );
    }

    #[test]
    fn test_ssrf_config_defaults() {
        let config = HttpEndpointConfig::from_uri("http://example.com/api").unwrap();
        assert!(
            !config.allow_internal,
            "Private IPs should be blocked by default"
        );
        assert!(
            config.blocked_hosts.is_empty(),
            "Blocked hosts should be empty by default"
        );
    }

    #[test]
    fn test_ssrf_config_allow_internal() {
        let config =
            HttpEndpointConfig::from_uri("http://example.com/api?allowInternal=true").unwrap();
        assert!(
            config.allow_internal,
            "Private IPs should be allowed when explicitly set"
        );
    }

    #[test]
    fn test_uri_option_allow_cleartext_parses() {
        let config =
            HttpEndpointConfig::from_uri("http://example.com/?allowCleartext=true").unwrap();
        assert!(
            config.allow_cleartext,
            "allowCleartext=true must parse into the endpoint config"
        );

        let plain = HttpEndpointConfig::from_uri("http://example.com/").unwrap();
        assert!(
            !plain.allow_cleartext,
            "cleartext consent must default to false"
        );

        let err =
            HttpEndpointConfig::from_uri("http://example.com/?allowCleartext=banana").unwrap_err();
        assert!(
            matches!(&err, CamelError::InvalidUri(msg) if msg.contains("allowCleartext")),
            "bad allowCleartext value must yield InvalidUri naming the option, got: {err:?}"
        );
    }

    /// ADR-0081: a CamelHttpUri override to a public cleartext target is
    /// gated by the endpoint's `allowCleartext` consent — override URLs go
    /// through the same `validate_url_for_ssrf` as the base URL.
    #[test]
    fn test_camel_http_uri_override_public_cleartext_follows_endpoint_flags() {
        let endpoint =
            HttpEndpointConfig::from_uri("http://localhost/?allowCleartext=false").unwrap();
        let err = crate::ssrf::validate_url_for_ssrf("http://93.184.216.34/exfil", &endpoint)
            .expect_err("public cleartext override must be rejected without consent");
        assert!(
            err.to_string().contains("allowCleartext"),
            "error must name the remedy, got: {err}"
        );

        let endpoint =
            HttpEndpointConfig::from_uri("http://localhost/?allowCleartext=true").unwrap();
        assert!(
            crate::ssrf::validate_url_for_ssrf("http://93.184.216.34/exfil", &endpoint).is_ok(),
            "endpoint consent must admit a public cleartext override"
        );
    }

    #[test]
    fn test_ssrf_config_blocked_hosts() {
        let config = HttpEndpointConfig::from_uri(
            "http://example.com/api?blockedHosts=evil.com,malware.net",
        )
        .unwrap();
        assert_eq!(config.blocked_hosts, vec!["evil.com", "malware.net"]);
    }

    #[tokio::test]
    async fn test_http_producer_blocks_localhost() {
        use tower::ServiceExt;

        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint("http://example.com/api", &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://localhost:8080/internal".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should block localhost");
    }

    #[tokio::test]
    async fn test_http_producer_blocks_loopback_ip() {
        use tower::ServiceExt;

        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint("http://example.com/api", &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://127.0.0.1:8080/internal".to_string()),
        );

        let result = producer.oneshot(exchange).await;
        assert!(result.is_err(), "Should block loopback IP");
    }

    #[tokio::test]
    async fn test_http_producer_allows_private_ip_when_enabled() {
        use tower::ServiceExt;

        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        // With allowInternal=true, the validation should pass
        // (actual connection will fail, but that's expected)
        let endpoint = component
            .create_endpoint("http://192.168.1.1/api?allowInternal=true", &endpoint_ctx)
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        let exchange = Exchange::new(Message::default());

        // The request will fail because we can't connect, but it should NOT fail
        // due to SSRF protection
        let result = producer.oneshot(exchange).await;
        // We expect connection error, not SSRF error
        if let Err(ref e) = result {
            let err_str = e.to_string();
            assert!(
                !err_str.contains("Private IP") && !err_str.contains("not allowed"),
                "Should not be SSRF error, got: {}",
                err_str
            );
        }
    }

    // -----------------------------------------------------------------------
    // HttpServerConfig tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_http_server_config_parse() {
        let cfg = HttpServerConfig::from_uri("http://0.0.0.0:8080/orders").unwrap();
        assert_eq!(cfg.host, "0.0.0.0");
        assert_eq!(cfg.port, 8080);
        assert_eq!(cfg.path, "/orders");
        assert_eq!(cfg.max_inflight_requests, 1024);
    }

    #[test]
    fn test_http_server_config_scheme() {
        // UriConfig trait method returns "http" as primary scheme
        assert_eq!(HttpServerConfig::scheme(), "http");
    }

    #[test]
    fn test_http_server_config_from_components() {
        // Test from_components directly (trait method)
        let components = camel_component_api::UriComponents {
            scheme: "https".to_string(),
            path: "//0.0.0.0:8443/api".to_string(),
            params: std::collections::HashMap::from([
                ("maxRequestBody".to_string(), "5242880".to_string()),
                ("maxInflightRequests".to_string(), "7".to_string()),
            ]),
            raw_query: None,
        };
        let cfg = HttpServerConfig::from_components(components).unwrap();
        assert_eq!(cfg.host, "0.0.0.0");
        assert_eq!(cfg.port, 8443);
        assert_eq!(cfg.path, "/api");
        assert_eq!(cfg.max_request_body, 5242880);
        assert_eq!(cfg.max_inflight_requests, 7);
    }

    #[test]
    fn test_http_server_config_default_path() {
        let cfg = HttpServerConfig::from_uri("http://0.0.0.0:3000").unwrap();
        assert_eq!(cfg.path, "/");
    }

    #[test]
    fn test_http_server_config_wrong_scheme() {
        assert!(HttpServerConfig::from_uri("file:/tmp").is_err());
    }

    #[test]
    fn test_http_server_config_invalid_port() {
        assert!(HttpServerConfig::from_uri("http://localhost:abc/path").is_err());
    }

    #[test]
    fn test_http_server_config_default_port_by_scheme() {
        // HTTP without explicit port should default to 80
        let cfg_http = HttpServerConfig::from_uri("http://0.0.0.0/orders").unwrap();
        assert_eq!(cfg_http.port, 80);

        // HTTPS without explicit port should default to 443
        let cfg_https = HttpServerConfig::from_uri("https://0.0.0.0/orders").unwrap();
        assert_eq!(cfg_https.port, 443);
    }

    #[test]
    fn test_request_envelope_and_reply_are_send() {
        fn assert_send<T: Send>() {}
        assert_send::<RequestEnvelope>();
        assert_send::<HttpReply>();
    }

    // -----------------------------------------------------------------------
    // ServerRegistry tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_server_registry_global_is_singleton() {
        let r1 = ServerRegistry::global();
        let r2 = ServerRegistry::global();
        assert!(std::ptr::eq(r1 as *const _, r2 as *const _));
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_concurrent_get_or_spawn_returns_same_registry() {
        let _guard = lock_registry_test_mutex();
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let results: Arc<std::sync::Mutex<Vec<HttpRouteRegistry>>> =
            Arc::new(std::sync::Mutex::new(Vec::new()));

        let mut handles = Vec::new();
        for _ in 0..4 {
            let results = results.clone();
            handles.push(tokio::spawn(async move {
                let registry = ServerRegistry::global()
                    .get_or_spawn(
                        "127.0.0.1",
                        port,
                        2 * 1024 * 1024,
                        10 * 1024 * 1024,
                        1024,
                        test_rt(),
                        "test-route".into(),
                        None,
                    )
                    .await
                    .unwrap();
                results.lock().unwrap().push(registry);
            }));
        }

        for h in handles {
            h.await.unwrap();
        }

        let registries = results.lock().unwrap();
        assert_eq!(registries.len(), 4);
        for i in 1..registries.len() {
            assert!(
                Arc::ptr_eq(&registries[0].inner, &registries[i].inner),
                "all concurrent callers should get same route registry"
            );
        }
    }

    #[test]
    fn test_server_registry_distinguishes_host_and_port() {
        let _guard = lock_registry_test_mutex();
        let rt = tokio::runtime::Runtime::new().expect("runtime");
        rt.block_on(async {
            let registry = ServerRegistry::global();
            // Use two distinct host values with same configured port key.
            // Port 0 is acceptable here because the registry key uses the configured
            // tuple, not the OS-assigned ephemeral port.
            let d1 = registry
                .get_or_spawn(
                    "127.0.0.1",
                    0,
                    1024 * 1024,
                    10 * 1024 * 1024,
                    1024,
                    test_rt(),
                    "test-route-1".into(),
                    None,
                )
                .await;
            let d2 = registry
                .get_or_spawn(
                    "0.0.0.0",
                    0,
                    1024 * 1024,
                    10 * 1024 * 1024,
                    1024,
                    test_rt(),
                    "test-route-2".into(),
                    None,
                )
                .await;
            assert!(d1.is_ok());
            assert!(d2.is_ok());
            assert!(!Arc::ptr_eq(&d1.unwrap().inner, &d2.unwrap().inner));
        });
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_shared_server_max_request_body_policy_is_deterministic() {
        let _guard = lock_registry_test_mutex();
        let registry = ServerRegistry::global();
        // First registration: maxRequestBody = 1 MB
        let d1 = registry
            .get_or_spawn(
                "127.0.0.1",
                9991,
                1024 * 1024,
                10 * 1024 * 1024,
                1024,
                test_rt(),
                "test-route".into(),
                None,
            )
            .await;
        assert!(d1.is_ok());

        // Second registration on same (host,port): maxRequestBody = 2 MB
        // Expected: explicit EndpointCreationFailed about incompatible maxRequestBody
        let d2 = registry
            .get_or_spawn(
                "127.0.0.1",
                9991,
                2 * 1024 * 1024,
                10 * 1024 * 1024,
                1024,
                test_rt(),
                "test-route-2".into(),
                None,
            )
            .await;
        assert!(d2.is_err());
        let err = d2.unwrap_err();
        assert!(
            err.to_string().contains("maxRequestBody") || err.to_string().contains("incompatible"),
            "Expected incompatible maxRequestBody error, got: {}",
            err
        );
    }

    #[test]
    fn test_server_registry_reset_clears_entries() {
        let _guard = lock_registry_test_mutex();
        let rt = tokio::runtime::Runtime::new().expect("runtime");
        rt.block_on(async {
            // Register something on a unique port
            let d1 = ServerRegistry::global()
                .get_or_spawn(
                    "127.0.0.1",
                    9992,
                    1024 * 1024,
                    10 * 1024 * 1024,
                    1024,
                    test_rt(),
                    "test-route".into(),
                    None,
                )
                .await;
            assert!(d1.is_ok());

            // Verify entry exists
            let guard = ServerRegistry::global().inner.lock().expect("lock");
            assert!(guard.entries.contains_key(&("127.0.0.1".to_string(), 9992)));
            drop(guard);

            // Reset
            ServerRegistry::reset();

            // Verify cleared
            let guard = ServerRegistry::global().inner.lock().expect("lock");
            assert!(
                guard.entries.is_empty(),
                "registry should be empty after reset, has {} entries",
                guard.entries.len()
            );
        });
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn registry_rejects_tls_on_plain_port() {
        // httpflake: this reset previously ran WITHOUT the registry test
        // mutex, so it could wipe another test's freshly staged entry
        // mid-window (traced 2026-09-14) — spec law: every reset caller
        // holds REGISTRY_TEST_MUTEX.
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let rt: Arc<dyn RuntimeObservability> = Arc::new(NoopRuntimeObservability);

        // First route: plain HTTP
        let _r1 = ServerRegistry::global()
            .get_or_spawn(
                "127.0.0.1",
                0,
                1024,
                1024,
                16,
                Arc::clone(&rt),
                "route-1".into(),
                None, // plain
            )
            .await;

        // Second route: TLS on same port → must fail
        let result = ServerRegistry::global()
            .get_or_spawn(
                "127.0.0.1",
                0,
                1024,
                1024,
                16,
                Arc::clone(&rt),
                "route-2".into(),
                Some(crate::config::ServerTlsConfig {
                    cert_path: "/x.pem".into(),
                    key_path: "/y.pem".into(),
                }),
            )
            .await;
        assert!(result.is_err(), "must reject TLS on plain port");
    }

    // -----------------------------------------------------------------------
    // D-L10: HTTP server is process-lifetime — it survives consumer
    // unregister (no refcount; dead servers are evicted on next spawn)
    // -----------------------------------------------------------------------

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_unregister_last_http_route_keeps_server_alive() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener); // Release — ServerRegistry will rebind
        let rt = test_rt();

        // Register 2 routes on the same (host, port) — OnceCell returns the
        // same ServerHandle.
        let _r1 = registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                1024 * 1024,
                10 * 1024 * 1024,
                16,
                rt.clone(),
                "test-route-1".into(),
                None,
            )
            .await
            .unwrap();
        let _r2 = registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                1024 * 1024,
                10 * 1024 * 1024,
                16,
                rt,
                "test-route-2".into(),
                None,
            )
            .await
            .unwrap();

        let key = ("127.0.0.1".to_string(), port);
        let cell = {
            let guard = registry.inner.lock().expect("lock");
            guard.entries.get(&key).expect("entry should exist").clone()
        };

        // Unregister first route -> monitor still alive (count = 1).
        registry.unregister("127.0.0.1", port).await;
        {
            let handle = cell
                .get()
                .expect("handle should still exist after first unregister");
            assert!(
                !handle.monitor_task.is_finished(),
                "monitor task should still be alive after first unregister"
            );
        }

        // Unregister second route -> server stays alive (process-lifetime).
        registry.unregister("127.0.0.1", port).await;
        tokio::time::sleep(Duration::from_millis(20)).await;
        {
            let handle = cell
                .get()
                .expect("handle should still exist after last unregister");
            assert!(
                !handle.monitor_task.is_finished(),
                "monitor task should still be alive — server is process-lifetime"
            );
        }

        // Entry stays in registry for potential restart.
        {
            let guard = registry.inner.lock().expect("lock");
            assert!(
                guard.entries.contains_key(&key),
                "entry should remain in registry — server kept alive for restart"
            );
        }
    }

    // -----------------------------------------------------------------------
    // Staged listeners (itest-bound-ports Task 1)
    // -----------------------------------------------------------------------

    /// CLONE-FIXTURE: bind a std listener on `127.0.0.1:0`, retain a blocking
    /// std clone (`probe`) so the port stays reserved, and hand the original
    /// socket to tokio as a non-blocking listener. `tokio::net::TcpListener`
    /// has no `try_clone`, so clones come from the std handle.
    async fn clone_fixture_listener() -> (
        tokio::net::TcpListener,
        std::net::TcpListener,
        std::net::SocketAddr,
    ) {
        let l = std::net::TcpListener::bind("127.0.0.1:0").expect("bind std listener");
        let probe = l.try_clone().expect("clone probe");
        l.set_nonblocking(true).expect("set_nonblocking");
        let listener = tokio::net::TcpListener::from_std(l).expect("from_std");
        let addr = listener.local_addr().expect("local_addr");
        (listener, probe, addr)
    }

    /// Default-limit constants the existing registry tests in this file use.
    fn staged_limits() -> (usize, usize, usize) {
        (1024 * 1024, 10 * 1024 * 1024, 1024)
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn staged_listener_first_spawn_serves_without_second_bind() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (listener, _probe, addr) = clone_fixture_listener().await;
        let port = addr.port();
        registry
            .stage_listener(listener)
            .await
            .expect("stage listener");

        let (max_req, max_res, max_inflight) = staged_limits();
        let routes = registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "staged-first-spawn".into(),
                None,
            )
            .await
            .expect("spawn from staged listener must succeed");

        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "served socket must be the staged listener's addr"
        );
        // The probe clone shares the socket, so service is proven by an HTTP
        // response, not by accepting on the probe.
        let resp = reqwest::get(format!("http://127.0.0.1:{port}/__staged_probe__"))
            .await
            .expect("http request against staged listener must connect");
        assert!(
            resp.status().as_u16() >= 200,
            "any status proves the staged socket serves"
        );
        drop(routes);
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn staged_entry_reused_by_second_caller() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (listener, _probe, addr) = clone_fixture_listener().await;
        let port = addr.port();
        registry
            .stage_listener(listener)
            .await
            .expect("stage listener");

        let (max_req, max_res, max_inflight) = staged_limits();
        let first = registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "staged-reuse-1".into(),
                None,
            )
            .await
            .expect("first spawn from staged listener");
        let second = registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "staged-reuse-2".into(),
                None,
            )
            .await
            .expect("second caller must reuse the entry");
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "entry reused — bound addr unchanged, no second bind"
        );
        drop(first);
        drop(second);
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn staged_race_two_callers_single_resolver() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (listener, _probe, addr) = clone_fixture_listener().await;
        let port = addr.port();
        registry
            .stage_listener(listener)
            .await
            .expect("stage listener");

        // Two racing callers for the exact staged key: the staged listener
        // must be consumed by the single cell-init winner and served to
        // both — never leave the winner binding a port the loser still
        // holds (EADDRINUSE).
        let (max_req, max_res, max_inflight) = staged_limits();
        let (first, second) = tokio::join!(
            registry.get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "staged-race-1".into(),
                None,
            ),
            registry.get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "staged-race-2".into(),
                None,
            ),
        );
        let first = first.expect("first racing caller must succeed");
        let second = second.expect("second racing caller must succeed");
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "single entry must be served from the staged socket — no EADDRINUSE path"
        );
        drop(first);
        drop(second);
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn unstaged_spawn_binds_legacy() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        // Fresh port P2: reserve then release — the legacy path rebinds.
        let probe = std::net::TcpListener::bind("127.0.0.1:0").expect("probe bind");
        let port = probe.local_addr().expect("local addr").port();
        drop(probe);

        let (max_req, max_res, max_inflight) = staged_limits();
        registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "legacy-bind".into(),
                None,
            )
            .await
            .expect("legacy bind spawn");
        let resp = reqwest::get(format!("http://127.0.0.1:{port}/__legacy_probe__"))
            .await
            .expect("connect to freshly bound port must succeed");
        assert!(resp.status().as_u16() >= 200);
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(std::net::SocketAddr::from(([127, 0, 0, 1], port))),
            "bound addr must be the legacy bound (host, port)"
        );
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn wrong_host_staged_port_fails_deterministically() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (listener, _probe, addr) = clone_fixture_listener().await;
        let port = addr.port();
        registry
            .stage_listener(listener)
            .await
            .expect("stage listener under 127.0.0.1");

        let (max_req, max_res, max_inflight) = staged_limits();
        let err = registry
            .get_or_spawn(
                "localhost",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "conflict-probe".into(),
                None,
            )
            .await
            .expect_err("wrong host on staged port must fail deterministically");
        assert!(
            err.to_string().contains("staged listener conflict on port"),
            "unexpected error: {err}"
        );

        // Slot untouched by the failed call: the correct host now consumes it.
        registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "conflict-after".into(),
                None,
            )
            .await
            .expect("correct host must serve the staged listener");
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "staged slot must be untouched by the conflicting call"
        );
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn duplicate_stage_same_key_rejected() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (listener, probe, addr) = clone_fixture_listener().await;
        registry
            .stage_listener(listener)
            .await
            .expect("stage listener A");

        // Second tokio handle to the SAME socket: clone the std probe handle.
        let dup = probe.try_clone().expect("clone2");
        dup.set_nonblocking(true).expect("set_nonblocking2");
        let b = tokio::net::TcpListener::from_std(dup).expect("from_std2");

        let err = registry
            .stage_listener(b)
            .await
            .expect_err("duplicate stage must be rejected");
        assert!(
            err.to_string().contains("listener already staged"),
            "unexpected error: {err}"
        );

        let (max_req, max_res, max_inflight) = staged_limits();
        registry
            .get_or_spawn(
                "127.0.0.1",
                addr.port(),
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "dup-stage-after".into(),
                None,
            )
            .await
            .expect("spawn from first staged listener");
        assert_eq!(
            registry.bound_addr("127.0.0.1", addr.port()),
            Some(addr),
            "first staged listener retained"
        );
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn distinct_keys_stage_independently() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (l1, _p1, addr1) = clone_fixture_listener().await;
        let (l2, _p2, addr2) = clone_fixture_listener().await;
        registry.stage_listener(l1).await.expect("stage P1");
        registry.stage_listener(l2).await.expect("stage P2");

        let (max_req, max_res, max_inflight) = staged_limits();
        registry
            .get_or_spawn(
                "127.0.0.1",
                addr1.port(),
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "distinct-1".into(),
                None,
            )
            .await
            .expect("spawn P1");
        registry
            .get_or_spawn(
                "127.0.0.1",
                addr2.port(),
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "distinct-2".into(),
                None,
            )
            .await
            .expect("spawn P2");
        assert_eq!(
            registry.bound_addr("127.0.0.1", addr1.port()),
            Some(addr1),
            "P1 bound addr must be its own listener"
        );
        assert_eq!(
            registry.bound_addr("127.0.0.1", addr2.port()),
            Some(addr2),
            "P2 bound addr must be its own listener"
        );
        let r1 = reqwest::get(format!("http://127.0.0.1:{}/__distinct__", addr1.port()))
            .await
            .expect("connect P1");
        assert!(r1.status().as_u16() >= 200);
        let r2 = reqwest::get(format!("http://127.0.0.1:{}/__distinct__", addr2.port()))
            .await
            .expect("connect P2");
        assert!(r2.status().as_u16() >= 200);
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn tls_prebound_listener_served() {
        use camel_component_api::test_support::tls;

        // Install rustls crypto provider (aws-lc-rs — matches the existing
        // TLS registry tests).
        let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();

        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let (listener, _probe, addr) = clone_fixture_listener().await;
        let port = addr.port();

        let (ca_pem, cert_pem, key_pem) = tls::gen_server_cert();
        let cert_path = tls::write_pem_tmp("http-staged-tls-cert.pem", &cert_pem);
        let key_path = tls::write_pem_tmp("http-staged-tls-key.pem", &key_pem);
        let ca_path = tls::write_pem_tmp("http-staged-tls-ca.pem", &ca_pem);

        let (max_req, max_res, max_inflight) = staged_limits();
        let routes = registry
            .get_or_spawn_with_listener(
                listener,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "staged-tls".into(),
                Some(crate::config::ServerTlsConfig {
                    cert_path: cert_path.to_string_lossy().into_owned(),
                    key_path: key_path.to_string_lossy().into_owned(),
                }),
            )
            .await
            .expect("spawn TLS server from pre-bound listener");

        // Client with CA cert — REAL verification (no danger_accept_invalid),
        // same helper pattern as the existing TLS registry tests.
        let ca_bytes = std::fs::read(&ca_path).expect("read ca pem");
        let client = reqwest::Client::builder()
            .add_root_certificate(reqwest::Certificate::from_pem(&ca_bytes).expect("parse ca pem"))
            .build()
            .expect("build tls client");

        let resp = client
            .get(format!("https://127.0.0.1:{port}/__staged_tls__"))
            .send()
            .await
            .expect("TLS handshake + request must succeed");
        assert_eq!(resp.status().as_u16(), 404, "unknown path 404s through TLS");
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "bound addr equals the pre-bound listener addr"
        );
        drop(routes);
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn with_listener_direct_spawn_keyed_by_actual_addr() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();
        let registry = ServerRegistry::global();
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
            .await
            .expect("bind un-staged listener");
        let addr = listener.local_addr().expect("local addr");
        let port = addr.port();

        let (max_req, max_res, max_inflight) = staged_limits();
        registry
            .get_or_spawn_with_listener(
                listener,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "with-listener".into(),
                None,
            )
            .await
            .expect("direct spawn from un-staged listener");
        let resp = reqwest::get(format!("http://127.0.0.1:{port}/__with_listener__"))
            .await
            .expect("connect on actual port");
        assert!(resp.status().as_u16() >= 200);
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "registry key is the listener's actual port"
        );

        registry
            .get_or_spawn(
                "127.0.0.1",
                port,
                max_req,
                max_res,
                max_inflight,
                test_rt(),
                "with-listener-reuse".into(),
                None,
            )
            .await
            .expect("legacy caller must reuse the entry");
        assert_eq!(
            registry.bound_addr("127.0.0.1", port),
            Some(addr),
            "entry reused — no second bind"
        );
    }

    // -----------------------------------------------------------------------
    // Axum dispatch handler tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_dispatch_handler_returns_404_for_unknown_path() {
        let registry = HttpRouteRegistry::new();
        // Nothing registered in route registry
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        tokio::spawn(run_axum_server(
            listener,
            registry,
            2 * 1024 * 1024,
            10 * 1024 * 1024,
            Arc::new(tokio::sync::Semaphore::new(1024)),
            test_rt(),
            "test-route".into(),
        ));

        // Wait for server to start
        tokio::time::sleep(std::time::Duration::from_millis(20)).await;

        let resp = reqwest::get(format!("http://127.0.0.1:{port}/unknown"))
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 404);
    }

    // -----------------------------------------------------------------------
    // HttpConsumer tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_http_consumer_start_registers_path() {
        use camel_component_api::ConsumerContext;

        // Get an OS-assigned free port
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener); // Release port — ServerRegistry will rebind it

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/ping".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let resp_future = client
            .post(format!("http://127.0.0.1:{port}/ping"))
            .body("hello world")
            .send();

        let (http_result, _) = tokio::join!(resp_future, async {
            if let Some(mut envelope) = rx.recv().await {
                // Set a custom status code
                envelope.exchange.input.set_header(
                    "CamelHttpResponseCode",
                    serde_json::Value::Number(201.into()),
                );
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 201);

        token.cancel();
    }

    /// rc-nftni (drainclaim): the raw-sender dispatch path mints a claim at
    /// the acceptance dequeue and carries it on the envelope. Exact totals:
    /// 1 while the envelope is held, 0 after release. No wall-clock sleeps —
    /// readiness is the startup signal, the recv IS the barrier.
    #[tokio::test]
    async fn http_consumer_raw_dispatch_carries_in_flight_claim() {
        use camel_component_api::ConsumerContext;
        use camel_component_api::StartupSignal;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/claim".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let counter = std::sync::Arc::new(camel_api::InFlightGauge::new());
        let (tx, mut rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let (signal, startup_rx) = StartupSignal::pair();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-claim-route".to_string())
            .with_startup(signal)
            .with_in_flight_counter(std::sync::Arc::clone(&counter));

        tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        // Deterministic readiness: the consumer marks ready only after the
        // listener is bound and the path registered.
        tokio::time::timeout(std::time::Duration::from_secs(5), startup_rx.await_ready())
            .await
            .expect("startup must resolve within 5s")
            .expect("startup must be Ok");

        let client = plain_http_test_client();
        let (http_result, claim) = tokio::join!(
            client
                .post(format!("http://127.0.0.1:{port}/claim"))
                .body("hello")
                .send(),
            async {
                let mut envelope = rx.recv().await.expect("envelope must arrive");
                let claim = envelope
                    .in_flight_claim
                    .take()
                    .expect("raw dispatch must carry an acceptance-minted claim");
                assert_eq!(
                    counter.total(),
                    1,
                    "exact total: the acceptance mint is the only live claim"
                );
                // Materialized reply body: echoing the request's Stream body
                // back would tie the response to the request-body stream
                // (not what this test exercises).
                let reply_tx = envelope.reply_tx.take().expect("reply channel must be set");
                let reply_exchange = Exchange::new(camel_component_api::Message::new(
                    camel_component_api::Body::Text("done".to_string()),
                ));
                reply_tx
                    .send(Ok(reply_exchange))
                    .expect("reply must be taken");
                claim
            },
        );

        let resp = http_result.expect("http roundtrip must complete");
        assert_eq!(resp.status().as_u16(), 200);

        drop(claim);
        assert_eq!(
            counter.total(),
            0,
            "release exactly once when the holder drops"
        );
        token.cancel();
    }

    /// rc-3y6j: the RequestEnvelope channel capacity must mirror the
    /// dispatcher's inflight semaphore so the semaphore stays the single
    /// backpressure point. Zero maps to 1 because `mpsc::channel(0)` panics.
    #[test]
    fn test_envelope_channel_capacity_follows_max_inflight() {
        assert_eq!(envelope_channel_capacity(0), 1);
        assert_eq!(envelope_channel_capacity(1), 1);
        assert_eq!(envelope_channel_capacity(7), 7);
        assert_eq!(envelope_channel_capacity(64), 64);
        assert_eq!(envelope_channel_capacity(1024), 1024);
    }

    /// rc-3y6j: `maxInflightRequests=0` is a representable reject-everything
    /// configuration. Consumer start must not panic on it (the channel guard)
    /// and every request must get 503 from the empty semaphore.
    #[tokio::test]
    async fn test_http_consumer_start_with_zero_max_inflight_rejects_503() {
        use camel_component_api::ConsumerContext;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/ping".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 0,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, _rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        let start_handle = tokio::spawn(async move {
            consumer.start(ctx).await.unwrap();
        });

        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let resp = client
            .post(format!("http://127.0.0.1:{port}/ping"))
            .body("hello world")
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 503);

        token.cancel();
        let _ = start_handle.await;
    }

    // -----------------------------------------------------------------------
    // maxInflightRequests upper bound (bd rc-ns3yc — mirror of the grpc
    // consumer_concurrency_limit fix, commit 101327e5)
    // -----------------------------------------------------------------------

    /// bd rc-ns3yc: `L-1` and `L` are accepted unchanged, `L+1` is rejected
    /// with a typed config error naming the parameter, the configured value,
    /// and the limit, and `0` stays a representable reject-everything value
    /// (no `.max(1)` normalization — rc-3y6j). A semaphore of exactly L
    /// permits must construct without panicking: the accepted bound is
    /// exactly the primitive's bound.
    #[test]
    fn test_max_inflight_requests_limit_boundary() {
        let l = tokio::sync::Semaphore::MAX_PERMITS;
        assert_eq!(max_inflight_requests_limit(l - 1).unwrap(), l - 1);
        assert_eq!(max_inflight_requests_limit(l).unwrap(), l);
        assert_eq!(max_inflight_requests_limit(0).unwrap(), 0);
        match max_inflight_requests_limit(l + 1) {
            Err(CamelError::Config(msg)) => {
                assert!(msg.contains("maxInflightRequests"), "message was: {msg}");
                assert!(msg.contains(&format!("{}", l + 1)), "message was: {msg}");
                assert!(msg.contains(&format!("{l}")), "message was: {msg}");
            }
            other => panic!("expected CamelError::Config, got: {other:?}"),
        }
        let _ = tokio::sync::Semaphore::new(l);
    }

    /// bd rc-ns3yc: the accepted upper bound is exactly
    /// `tokio::sync::Semaphore::MAX_PERMITS`; URI parse must accept L
    /// unchanged. Boundary-regression guard (green before and after the
    /// fix — red-first is not definable for an accepted value).
    #[test]
    fn test_parse_http_uri_max_inflight_at_limit_accepted() {
        let l = tokio::sync::Semaphore::MAX_PERMITS;
        let uri = format!("http://localhost:8080/api?maxInflightRequests={l}");
        let cfg = HttpServerConfig::from_uri(&uri).unwrap();
        assert_eq!(cfg.max_inflight_requests, l);
    }

    /// bd rc-ns3yc: values above `tokio::sync::Semaphore::MAX_PERMITS` are
    /// rejected at parse with a typed config error naming the parameter,
    /// the configured value, and the limit.
    #[test]
    fn test_parse_http_uri_max_inflight_above_limit_rejected() {
        let l = tokio::sync::Semaphore::MAX_PERMITS;
        let uri = format!("http://localhost:8080/api?maxInflightRequests={}", l + 1);
        match HttpServerConfig::from_uri(&uri) {
            Err(CamelError::Config(msg)) => {
                assert!(msg.contains("maxInflightRequests"), "message was: {msg}");
                assert!(msg.contains(&format!("{}", l + 1)), "message was: {msg}");
                assert!(msg.contains(&format!("{l}")), "message was: {msg}");
            }
            other => panic!("expected CamelError::Config, got: {other:?}"),
        }
    }

    /// bd rc-ns3yc: an oversized maxInflightRequests must be rejected at
    /// create_consumer even when the endpoint's HttpServerConfig was
    /// constructed directly (not via URI parse). Mirrors the
    /// https_consumer_without_tls_cert_errors direct-endpoint fixture.
    #[test]
    fn test_create_consumer_rejects_oversized_max_inflight() {
        let l = tokio::sync::Semaphore::MAX_PERMITS;
        let endpoint = HttpEndpoint {
            uri: "http://0.0.0.0:8080/api".to_string(),
            config: HttpEndpointConfig::from_uri("http://0.0.0.0:8080/api").unwrap(),
            server_config: HttpServerConfig {
                scheme: "http".to_string(),
                host: "0.0.0.0".to_string(),
                port: 8080,
                path: "/api".to_string(),
                max_request_body: 2 * 1024 * 1024,
                max_response_body: 10 * 1024 * 1024,
                max_inflight_requests: l + 1,
                method: None,
                tls_config: None,
            },
            client: reqwest::Client::new(),
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            http_config: HttpConfig::default(),
        };
        match endpoint.create_consumer(rt()) {
            Err(CamelError::Config(msg)) => {
                assert!(msg.contains("maxInflightRequests"), "message was: {msg}");
                assert!(msg.contains(&format!("{}", l + 1)), "message was: {msg}");
                assert!(msg.contains(&format!("{l}")), "message was: {msg}");
            }
            Err(other) => panic!("expected CamelError::Config, got: {other:?}"),
            Ok(_) => panic!("expected error, got Ok"),
        }
    }

    /// bd rc-ns3yc: `start` must reject an oversized maxInflightRequests
    /// BEFORE shared-server registry interaction, listener binding,
    /// envelope-channel construction, or semaphore construction — a typed
    /// config error, no panic. Mirrors the
    /// test_http_consumer_start_with_zero_max_inflight_rejects_503 fixture.
    #[tokio::test]
    async fn test_http_consumer_start_rejects_oversized_before_spawn() {
        use camel_component_api::ConsumerContext;

        let l = tokio::sync::Semaphore::MAX_PERMITS;
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/ping".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: l + 1,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, _rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        match consumer.start(ctx).await {
            Err(CamelError::Config(msg)) => {
                assert!(msg.contains("maxInflightRequests"), "message was: {msg}");
                assert!(msg.contains(&format!("{}", l + 1)), "message was: {msg}");
                assert!(msg.contains(&format!("{l}")), "message was: {msg}");
            }
            other => panic!("expected CamelError::Config, got: {other:?}"),
        }
        token.cancel();
    }

    /// bd rc-ns3yc: defense-in-depth — `spawn_entry` must reject an
    /// oversized max_inflight_requests before any listener side effect and
    /// before `tokio::sync::Semaphore::new` is reached (which would panic).
    #[tokio::test]
    async fn test_spawn_entry_rejects_oversized_before_semaphore() {
        let l = tokio::sync::Semaphore::MAX_PERMITS;
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let key: ServerKey = (addr.ip().to_string(), addr.port());

        let result = spawn_entry(
            key,
            ListenerSource::Staged(listener),
            1,
            1,
            l + 1,
            test_rt(),
            "route-test".into(),
            None,
        )
        .await;

        match result {
            Err(CamelError::Config(msg)) => {
                assert!(msg.contains("maxInflightRequests"), "message was: {msg}");
                assert!(msg.contains(&format!("{}", l + 1)), "message was: {msg}");
                assert!(msg.contains(&format!("{l}")), "message was: {msg}");
            }
            Err(other) => panic!("expected CamelError::Config, got: {other:?}"),
            Ok(_) => panic!("expected CamelError::Config, got Ok"),
        }
    }

    /// rc-w1u9: HttpConsumer MUST declare Explicit startup_mode so the runtime
    /// waits for the listener bind before publishing RouteStarted.
    #[test]
    fn test_http_consumer_startup_mode_is_explicit() {
        use camel_component_api::ConsumerStartupMode;
        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port: 0,
            path: "/x".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let consumer = HttpConsumer::new(consumer_cfg, test_rt());
        assert_eq!(
            consumer.startup_mode(),
            ConsumerStartupMode::Explicit,
            "HttpConsumer must opt into Explicit startup"
        );
    }

    /// rc-w1u9: HttpConsumer::start() MUST call ctx.mark_ready() AFTER bind
    /// + route registration. The StartupSignal resolves Ok only when that
    /// happens. Verified here by injecting our own signal pair into the
    /// ConsumerContext and asserting the receiver resolves within a bounded
    /// window even before any HTTP request is made.
    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_http_consumer_emits_mark_ready_after_bind() {
        use camel_component_api::{ConsumerContext, StartupSignal};

        let _guard = lock_registry_test_mutex();

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/ready-probe".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, _rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "ready-probe-route".to_string());

        // Inject our own startup signal so we can observe mark_ready.
        let (signal, startup_rx) = StartupSignal::pair();
        let ctx = ctx.with_startup(signal);

        // Spawn start() — it MUST call mark_ready once the listener is bound
        // and the path is registered.
        tokio::spawn(async move {
            let _ = consumer.start(ctx).await;
        });

        // The receiver MUST resolve Ok within a bounded window — proving
        // mark_ready was called by start(). A short timeout catches the
        // regression where mark_ready is never called (the old behaviour
        // would hang the receiver forever, which is exactly the rc-w1u9 bug).
        let result =
            tokio::time::timeout(std::time::Duration::from_secs(2), startup_rx.await_ready())
                .await
                .expect("HttpConsumer must call ctx.mark_ready() after bind (rc-w1u9)");
        assert!(result.is_ok(), "mark_ready must resolve Ok after bind");

        // Cancellation tears down the spawned start() loop.
        token.cancel();
    }

    // -----------------------------------------------------------------------
    // Shared-server death supervision (rc-szmob / ADR-0007)
    // -----------------------------------------------------------------------

    /// RuntimeObservability stub that records every `increment_errors`
    /// `(route_id, label)` pair so tests can assert error counters.
    #[derive(Default, Clone)]
    struct ErrorRecordingRuntime {
        errors: std::sync::Arc<std::sync::Mutex<Vec<(String, String)>>>,
    }

    impl camel_api::MetricsCollector for ErrorRecordingRuntime {
        fn record_exchange_duration(&self, _route_id: &str, _duration: std::time::Duration) {}
        fn increment_errors(&self, route_id: &str, error_type: &str) {
            self.errors
                .lock()
                .expect("error recorder lock")
                .push((route_id.to_string(), error_type.to_string()));
        }
        fn increment_exchanges(&self, _route_id: &str) {}
        fn set_queue_depth(&self, _queue: &str, _depth: usize) {}
        fn record_circuit_breaker_change(&self, _route_id: &str, _from: &str, _to: &str) {}
    }

    impl camel_component_api::HealthCheckRegistry for ErrorRecordingRuntime {
        fn force_unhealthy_for_route(&self, _route_id: &str, _name: &str, _reason: &str) {}
    }

    impl camel_component_api::RuntimeObservability for ErrorRecordingRuntime {
        fn metrics(&self) -> std::sync::Arc<dyn camel_api::MetricsCollector> {
            std::sync::Arc::new(self.clone())
        }
        fn health(&self) -> std::sync::Arc<dyn camel_component_api::HealthCheckRegistry> {
            std::sync::Arc::new(self.clone())
        }
    }

    /// rc-szmob (ADR-0007 parity): when the shared Axum server task for a
    /// host:port dies, EVERY HttpConsumer hosted on that port must fail its
    /// `start()` with an Err — that Err is the signal camel-core's consumer
    /// watcher turns into a per-route CrashNotification → FailRoute →
    /// supervision backoff restart. Before the fix the consumers hung in
    /// `Running` forever (zombie routes): neither `ctx.cancelled()` nor
    /// `env_rx.recv()` fires when the server task dies, because the envelope
    /// senders live in the (still-alive) registry, not in the dead task.
    ///
    /// Deterministic by construction: readiness is awaited via the injected
    /// StartupSignal (no sleeps), the server is killed via its AbortHandle
    /// (real JoinError → monitor's unexpected-exit branch), and consumer
    /// resolution is bounded by a timeout — on unmodified behavior the
    /// timeout trips, which is exactly the zombie this test pins down.
    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn shared_server_death_fails_every_hosted_consumer() {
        use camel_component_api::{ConsumerContext, StartupSignal};

        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();

        // Reserve a port, release it, let get_or_spawn bind it.
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let rt = ErrorRecordingRuntime::default();

        let make_consumer = |path: &str| {
            HttpConsumer::new(
                HttpServerConfig {
                    scheme: "http".to_string(),
                    host: "127.0.0.1".to_string(),
                    port,
                    path: path.to_string(),
                    max_request_body: 2 * 1024 * 1024,
                    max_response_body: 10 * 1024 * 1024,
                    max_inflight_requests: 16,
                    method: None,
                    tls_config: None,
                },
                std::sync::Arc::new(rt.clone()),
            )
        };

        let spawn_consumer = |path: &str, route_id: &str| {
            let mut consumer = make_consumer(path);
            let (tx, _rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
            let token = tokio_util::sync::CancellationToken::new();
            let ctx = ConsumerContext::new(tx, token, route_id.to_string());
            let (signal, startup_rx) = StartupSignal::pair();
            let ctx = ctx.with_startup(signal);
            let task = tokio::spawn(async move { consumer.start(ctx).await });
            (task, startup_rx)
        };

        // Two routes hosted on the SAME shared server (same host:port).
        let (task_a, ready_a) = spawn_consumer("/zombie-a", "zombie-route-a");
        let (task_b, ready_b) = spawn_consumer("/zombie-b", "zombie-route-b");

        // Both consumers registered and the server is up (bounded, no sleeps).
        for (name, ready) in [("a", ready_a), ("b", ready_b)] {
            let result =
                tokio::time::timeout(std::time::Duration::from_secs(2), ready.await_ready())
                    .await
                    .unwrap_or_else(|_| panic!("consumer {name} never became ready"));
            assert!(
                result.is_ok(),
                "consumer {name} readiness must resolve Ok (bind + registration complete)"
            );
        }

        // Kill the shared server task: abort → JoinError → the monitor's
        // unexpected-exit branch. This is the real crash path (no mock).
        {
            let registry = ServerRegistry::global();
            let guard = registry.inner.lock().expect("ServerRegistry lock");
            let cell = guard
                .entries
                .get(&("127.0.0.1".to_string(), port))
                .expect("shared server entry must exist");
            let handle = cell.get().expect("server handle must be initialized");
            handle.server_abort.abort();
        }

        // THE assertion: both hosted consumers must fail (bounded). On the
        // zombie bug they never resolve and this timeout trips.
        let outcome_a = tokio::time::timeout(std::time::Duration::from_secs(2), task_a)
            .await
            .expect("ZOMBIE: consumer-a still running after shared server death (rc-szmob)");
        let outcome_b = tokio::time::timeout(std::time::Duration::from_secs(2), task_b)
            .await
            .expect("ZOMBIE: consumer-b still running after shared server death (rc-szmob)");

        let err_a = outcome_a
            .expect("consumer-a task must join")
            .expect_err("consumer-a start() must return Err when the shared server dies");
        let err_b = outcome_b
            .expect("consumer-b task must join")
            .expect_err("consumer-b start() must return Err when the shared server dies");

        // The error must identify the dead shared transport (it flows into the
        // CrashNotification message camel-core records against the route).
        for (name, err) in [("a", &err_a), ("b", &err_b)] {
            assert!(
                err.to_string().contains("127.0.0.1")
                    && err.to_string().contains(&port.to_string()),
                "consumer-{name} error must name the dead shared server, got: {err}"
            );
        }

        // Error counter regression guard: the monitor still records
        // `e:http:server-task-exited` for the route that spawned the server.
        let recorded = rt.errors.lock().expect("error recorder lock").clone();
        assert!(
            recorded
                .iter()
                .any(|(route, label)| label == "e:http:server-task-exited"
                    && route == "zombie-route-a"),
            "expected e:http:server-task-exited for the spawning route, got: {recorded:?}"
        );
    }

    #[tokio::test]
    async fn test_http_consumer_returns_503_when_inflight_limit_reached() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/saturation".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let (first_seen_tx, first_seen_rx) = tokio::sync::oneshot::channel::<()>();
        let (unblock_first_tx, unblock_first_rx) = tokio::sync::oneshot::channel::<()>();

        tokio::spawn(async move {
            let mut first_seen_tx = Some(first_seen_tx);
            let mut unblock_first_rx = Some(unblock_first_rx);

            loop {
                match tokio::time::timeout(Duration::from_secs(2), rx.recv()).await {
                    Ok(Some(envelope)) => {
                        if let Some(tx) = first_seen_tx.take() {
                            let _ = tx.send(());
                            if let Some(rx_unblock) = unblock_first_rx.take() {
                                // Deadline-bound like the recv above: a
                                // parked first exchange fails loudly
                                // instead of hanging the pipeline task.
                                let _ = tokio::time::timeout(Duration::from_secs(2), rx_unblock)
                                    .await
                                    .expect("first exchange unblock within 2s");
                            }
                        }

                        if let Some(reply_tx) = envelope.reply_tx {
                            let _ = reply_tx.send(Ok(envelope.exchange));
                        }
                    }
                    // Channel closed: drainer ends.
                    Ok(None) => break, // closed: drain complete
                    // Stalled: drainer ends.
                    Err(_) => break, // stalled: drainer ends
                }
            }
        });

        let client = plain_http_test_client();
        let first_req = {
            let client = client.clone();
            async move {
                client
                    .get(format!("http://127.0.0.1:{port}/saturation"))
                    .send()
                    .await
                    .unwrap()
            }
        };

        let first_handle = tokio::spawn(first_req);
        first_seen_rx.await.unwrap();

        let second_resp = client
            .get(format!("http://127.0.0.1:{port}/saturation"))
            .send()
            .await
            .unwrap();

        assert_eq!(second_resp.status().as_u16(), 503);

        let _ = unblock_first_tx.send(());
        let first_resp = first_handle.await.unwrap();
        assert_eq!(first_resp.status().as_u16(), 200);

        token.cancel();
    }

    /// Audit 2026-08-31, F2-1: a chunked (no Content-Length) request body must
    /// still be capped — the byte limit travels with the stream, so any
    /// downstream materialization fails closed past `max_request_body`.
    #[tokio::test]
    async fn test_http_consumer_chunked_body_is_capped() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/chunked-cap".to_string(),
            max_request_body: 1024, // tiny cap for the test
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 16,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        // Chunked body: reqwest streams it without Content-Length.
        let chunks: Vec<Result<bytes::Bytes, std::io::Error>> = (0..8)
            .map(|_| Ok(bytes::Bytes::from(vec![b'A'; 512])))
            .collect();
        let stream_body = reqwest::Body::wrap_stream(futures::stream::iter(chunks));

        let client = plain_http_test_client();
        let send_fut = client
            .post(format!("http://127.0.0.1:{port}/chunked-cap"))
            .body(stream_body)
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                // The route materializes the body — the cap must fire.
                let materialized = envelope
                    .exchange
                    .input
                    .body
                    .clone()
                    .into_bytes(64 * 1024)
                    .await;
                assert!(
                    materialized.is_err(),
                    "materializing a 4 KiB chunked body under a 1 KiB cap must fail"
                );
                let err = materialized.unwrap_err().to_string();
                assert!(
                    err.contains("limit") || err.contains("exceeds"),
                    "error should mention the limit: {err}"
                );
                if let Some(reply_tx) = envelope.reply_tx {
                    envelope.exchange.input.body =
                        camel_component_api::Body::Text("handled".to_string());
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);

        token.cancel();
    }

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_http_consumer_enforces_max_response_body_for_bytes() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let _guard = lock_registry_test_mutex();

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/limit-bytes".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 16,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/limit-bytes"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Bytes(bytes::Bytes::from(vec![b'x'; 32]));
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 500);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "Response body exceeds configured limit");
        token.cancel();
    }

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_http_consumer_enforces_max_response_body_for_json() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let _guard = lock_registry_test_mutex();

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/limit-json".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 16,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/limit-json"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body = camel_component_api::Body::Json(
                    serde_json::json!({"message":"this response is bigger than sixteen"}),
                );
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 500);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "Response body exceeds configured limit");
        token.cancel();
    }

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_http_consumer_enforces_max_response_body_for_xml() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let _guard = lock_registry_test_mutex();

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: "/limit-xml".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 16,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/limit-xml"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body = camel_component_api::Body::Xml(
                    "<root><value>way-too-large</value></root>".into(),
                );
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 500);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "Response body exceeds configured limit");
        token.cancel();
    }

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_http_consumer_does_not_enforce_max_response_body_for_stream() {
        use camel_component_api::{
            CamelError, ConsumerContext, ExchangeEnvelope, StreamBody, StreamMetadata,
        };
        use futures::stream;

        let _guard = lock_registry_test_mutex();

        let listener = tokio::net::TcpListener::bind("0.0.0.0:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "0.0.0.0".to_string(),
            port,
            path: "/limit-stream".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 16,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/limit-stream"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                let chunks: Vec<Result<bytes::Bytes, CamelError>> =
                    vec![Ok(bytes::Bytes::from(vec![b'x'; 32]))];
                let stream = Box::pin(stream::iter(chunks));
                envelope.exchange.input.body = camel_component_api::Body::Stream(StreamBody {
                    stream: Arc::new(tokio::sync::Mutex::new(Some(stream))),
                    metadata: StreamMetadata {
                        size_hint: Some(32),
                        content_type: Some("application/octet-stream".into()),
                        origin: None,
                    },
                });
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.bytes().await.unwrap();
        assert_eq!(body.len(), 32);
        token.cancel();
    }

    // -----------------------------------------------------------------------
    // Integration tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_integration_single_consumer_round_trip() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        // Spawns an HTTP consumer on the global ServerRegistry
        // (HttpConsumer::start → get_or_spawn). Serialize against the other
        // registry tests so parallel runs do not race on shared global state.
        let _guard = lock_registry_test_mutex();

        // Get an OS-assigned free port (ephemeral)
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener); // Release — ServerRegistry will rebind

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("http://127.0.0.1:{port}/echo"), &endpoint_ctx)
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client
            .post(format!("http://127.0.0.1:{port}/echo"))
            .header("Content-Type", "text/plain")
            .body("ping")
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                assert_eq!(
                    envelope.exchange.input.header("CamelHttpMethod"),
                    Some(&serde_json::Value::String("POST".into()))
                );
                assert_eq!(
                    envelope.exchange.input.header("CamelHttpPath"),
                    Some(&serde_json::Value::String("/echo".into()))
                );
                envelope.exchange.input.body = camel_component_api::Body::Text("pong".to_string());
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "pong");

        token.cancel();
    }

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_integration_two_consumers_shared_port() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let _guard = lock_registry_test_mutex();

        // Get an OS-assigned free port (ephemeral)
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;

        // Consumer A: /hello
        let endpoint_a = component
            .create_endpoint(&format!("http://127.0.0.1:{port}/hello"), &endpoint_ctx)
            .unwrap();
        let mut consumer_a = endpoint_a.create_consumer(rt()).unwrap();

        // Consumer B: /world
        let endpoint_b = component
            .create_endpoint(&format!("http://127.0.0.1:{port}/world"), &endpoint_ctx)
            .unwrap();
        let mut consumer_b = endpoint_b.create_consumer(rt()).unwrap();

        let (tx_a, mut rx_a) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token_a = tokio_util::sync::CancellationToken::new();
        let ctx_a = ConsumerContext::new(tx_a, token_a.clone(), "http-test-route-a".to_string());

        let (tx_b, mut rx_b) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token_b = tokio_util::sync::CancellationToken::new();
        let ctx_b = ConsumerContext::new(tx_b, token_b.clone(), "http-test-route-b".to_string());

        tokio::spawn(async move { consumer_a.start(ctx_a).await.unwrap() });
        tokio::spawn(async move { consumer_b.start(ctx_b).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();

        // Request to /hello
        let fut_hello = client.get(format!("http://127.0.0.1:{port}/hello")).send();
        let (resp_hello, _) = tokio::join!(fut_hello, async {
            if let Some(mut envelope) = rx_a.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Text("hello-response".to_string());
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        // Request to /world
        let fut_world = client.get(format!("http://127.0.0.1:{port}/world")).send();
        let (resp_world, _) = tokio::join!(fut_world, async {
            if let Some(mut envelope) = rx_b.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Text("world-response".to_string());
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let body_a = resp_hello.unwrap().text().await.unwrap();
        let body_b = resp_world.unwrap().text().await.unwrap();

        assert_eq!(body_a, "hello-response");
        assert_eq!(body_b, "world-response");

        token_a.cancel();
        token_b.cancel();
    }

    #[tokio::test]
    #[allow(clippy::await_holding_lock)]
    async fn test_integration_unregistered_path_returns_404() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let _guard = lock_registry_test_mutex();

        // Get an OS-assigned free port (ephemeral)
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("http://127.0.0.1:{port}/registered"),
                &endpoint_ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, _rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });

        // Wait until the server is actually accepting connections (CI runners can be slow).
        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
        loop {
            if tokio::net::TcpStream::connect(format!("127.0.0.1:{port}"))
                .await
                .is_ok()
            {
                break;
            }
            if std::time::Instant::now() >= deadline {
                panic!("HTTP server did not start within 5s on port {port}");
            }
            tokio::time::sleep(std::time::Duration::from_millis(20)).await;
        }

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/not-there"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 404);

        token.cancel();
    }

    #[test]
    fn test_http_consumer_declares_concurrent() {
        use camel_component_api::ConcurrencyModel;

        let config = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port: 19999,
            path: "/test".to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let consumer = HttpConsumer::new(config, test_rt());
        assert_eq!(
            consumer.concurrency_model(),
            ConcurrencyModel::Concurrent { max: None }
        );
    }

    #[test]
    fn server_config_parses_tls_cert_and_key() {
        let cfg = HttpServerConfig::from_uri(
            "https://0.0.0.0:8443/api?tlsCert=/a/cert.pem&tlsKey=/a/key.pem",
        )
        .unwrap();
        assert_eq!(cfg.tls_config.as_ref().unwrap().cert_path, "/a/cert.pem");
        assert_eq!(cfg.tls_config.as_ref().unwrap().key_path, "/a/key.pem");
    }

    #[test]
    fn server_config_no_tls_when_params_absent() {
        let cfg = HttpServerConfig::from_uri("http://0.0.0.0:8080/api").unwrap();
        assert!(cfg.tls_config.is_none());
    }

    // -----------------------------------------------------------------------
    // HttpReplyBody streaming tests
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_http_reply_body_stream_variant_exists() {
        use bytes::Bytes;
        use camel_component_api::CamelError;
        use futures::stream;

        let chunks: Vec<Result<Bytes, CamelError>> =
            vec![Ok(Bytes::from("hello")), Ok(Bytes::from(" world"))];
        let stream = Box::pin(stream::iter(chunks));
        let reply_body = HttpReplyBody::Stream(stream);
        // Si compila y el match funciona, el test pasa
        match reply_body {
            HttpReplyBody::Stream(_) => {}
            HttpReplyBody::Bytes(_) => panic!("expected Stream variant"),
        }
    }

    // -----------------------------------------------------------------------
    // OpenTelemetry propagation tests (only compiled with "otel" feature)
    // -----------------------------------------------------------------------

    #[cfg(feature = "otel")]
    mod otel_tests {
        use super::*;
        use camel_component_api::Message;
        use tower::ServiceExt;

        #[tokio::test]
        async fn test_producer_injects_traceparent_header() {
            let (url, _handle) = start_test_server_with_header_capture().await;
            let ctx = test_producer_ctx();

            let component = HttpComponent::new();
            let endpoint_ctx = NoOpComponentContext;
            let endpoint = component
                .create_endpoint(&format!("{url}/api?allowInternal=true"), &endpoint_ctx)
                .unwrap();
            let producer = endpoint.create_producer(rt(), &ctx).unwrap();

            // Create exchange with an OTel context by extracting from a traceparent header
            let mut exchange = Exchange::new(Message::default());
            let mut headers = std::collections::HashMap::new();
            headers.insert(
                "traceparent".to_string(),
                "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01".to_string(),
            );
            camel_otel::extract_into_exchange(&mut exchange, &headers);

            let result = producer.oneshot(exchange).await.unwrap();

            // Verify request succeeded
            let status = result
                .input
                .header("CamelHttpResponseCode")
                .and_then(|v| v.as_u64())
                .unwrap();
            assert_eq!(status, 200);

            // The test server echoes back the received traceparent header
            let traceparent = result.input.header("X-Received-Traceparent");
            assert!(
                traceparent.is_some(),
                "traceparent header should have been sent"
            );

            let traceparent_str = traceparent.unwrap().as_str().unwrap();
            // Verify format: version-traceid-spanid-flags
            let parts: Vec<&str> = traceparent_str.split('-').collect();
            assert_eq!(parts.len(), 4, "traceparent should have 4 parts");
            assert_eq!(parts[0], "00", "version should be 00");
            assert_eq!(
                parts[1], "4bf92f3577b34da6a3ce929d0e0e4736",
                "trace-id should match"
            );
            assert_eq!(parts[2], "00f067aa0ba902b7", "span-id should match");
            assert_eq!(parts[3], "01", "flags should be 01 (sampled)");
        }

        #[tokio::test]
        async fn test_consumer_extracts_traceparent_header() {
            use camel_component_api::{ConsumerContext, ExchangeEnvelope};

            // Get an OS-assigned free port
            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
            let port = listener.local_addr().unwrap().port();
            drop(listener);

            let component = HttpComponent::new();
            let endpoint_ctx = NoOpComponentContext;
            let endpoint = component
                .create_endpoint(&format!("http://127.0.0.1:{port}/trace"), &endpoint_ctx)
                .unwrap();
            let mut consumer = endpoint.create_consumer(rt()).unwrap();

            let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
            let token = tokio_util::sync::CancellationToken::new();
            let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

            tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
            tokio::time::sleep(std::time::Duration::from_millis(50)).await;

            // Send request with traceparent header
            let client = plain_http_test_client();
            let send_fut = client
                .post(format!("http://127.0.0.1:{port}/trace"))
                .header(
                    "traceparent",
                    "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
                )
                .body("test")
                .send();

            let (http_result, _) = tokio::join!(send_fut, async {
                if let Some(envelope) = rx.recv().await {
                    // Verify the exchange has a valid OTel context by re-injecting it
                    // and checking the traceparent matches
                    let mut injected_headers = std::collections::HashMap::new();
                    camel_otel::inject_from_exchange(&envelope.exchange, &mut injected_headers);

                    assert!(
                        injected_headers.contains_key("traceparent"),
                        "Exchange should have traceparent after extraction"
                    );

                    let traceparent = injected_headers.get("traceparent").unwrap();
                    let parts: Vec<&str> = traceparent.split('-').collect();
                    assert_eq!(parts.len(), 4, "traceparent should have 4 parts");
                    assert_eq!(
                        parts[1], "4bf92f3577b34da6a3ce929d0e0e4736",
                        "Trace ID should match the original traceparent header"
                    );

                    if let Some(reply_tx) = envelope.reply_tx {
                        let _ = reply_tx.send(Ok(envelope.exchange));
                    }
                }
            });

            let resp = http_result.unwrap();
            assert_eq!(resp.status().as_u16(), 200);

            token.cancel();
        }

        #[tokio::test]
        async fn test_consumer_extracts_mixed_case_traceparent_header() {
            use camel_component_api::{ConsumerContext, ExchangeEnvelope};

            // Get an OS-assigned free port
            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
            let port = listener.local_addr().unwrap().port();
            drop(listener);

            let component = HttpComponent::new();
            let endpoint_ctx = NoOpComponentContext;
            let endpoint = component
                .create_endpoint(&format!("http://127.0.0.1:{port}/trace"), &endpoint_ctx)
                .unwrap();
            let mut consumer = endpoint.create_consumer(rt()).unwrap();

            let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
            let token = tokio_util::sync::CancellationToken::new();
            let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

            tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
            tokio::time::sleep(std::time::Duration::from_millis(50)).await;

            // Send request with MIXED-CASE TraceParent header (not lowercase)
            let client = plain_http_test_client();
            let send_fut = client
                .post(format!("http://127.0.0.1:{port}/trace"))
                .header(
                    "TraceParent",
                    "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
                )
                .body("test")
                .send();

            let (http_result, _) = tokio::join!(send_fut, async {
                if let Some(envelope) = rx.recv().await {
                    // Verify the exchange has a valid OTel context by re-injecting it
                    // and checking the traceparent matches
                    let mut injected_headers = HashMap::new();
                    camel_otel::inject_from_exchange(&envelope.exchange, &mut injected_headers);

                    assert!(
                        injected_headers.contains_key("traceparent"),
                        "Exchange should have traceparent after extraction from mixed-case header"
                    );

                    let traceparent = injected_headers.get("traceparent").unwrap();
                    let parts: Vec<&str> = traceparent.split('-').collect();
                    assert_eq!(parts.len(), 4, "traceparent should have 4 parts");
                    assert_eq!(
                        parts[1], "4bf92f3577b34da6a3ce929d0e0e4736",
                        "Trace ID should match the original mixed-case TraceParent header"
                    );

                    if let Some(reply_tx) = envelope.reply_tx {
                        let _ = reply_tx.send(Ok(envelope.exchange));
                    }
                }
            });

            let resp = http_result.unwrap();
            assert_eq!(resp.status().as_u16(), 200);

            token.cancel();
        }

        #[tokio::test]
        async fn test_producer_no_trace_context_no_crash() {
            let (url, _handle) = start_test_server().await;
            let ctx = test_producer_ctx();

            let component = HttpComponent::new();
            let endpoint_ctx = NoOpComponentContext;
            let endpoint = component
                .create_endpoint(&format!("{url}/api?allowInternal=true"), &endpoint_ctx)
                .unwrap();
            let producer = endpoint.create_producer(rt(), &ctx).unwrap();

            // Create exchange with default (empty) otel_context - no trace context
            let exchange = Exchange::new(Message::default());

            // Should succeed without panic
            let result = producer.oneshot(exchange).await.unwrap();

            // Verify request succeeded
            let status = result
                .input
                .header("CamelHttpResponseCode")
                .and_then(|v| v.as_u64())
                .unwrap();
            assert_eq!(status, 200);
        }

        /// Test server that captures and echoes back the traceparent header
        async fn start_test_server_with_header_capture() -> (String, tokio::task::JoinHandle<()>) {
            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
            let addr = listener.local_addr().unwrap();
            let url = format!("http://127.0.0.1:{}", addr.port());

            let handle = tokio::spawn(async move {
                loop {
                    if let Ok((mut stream, _)) = listener.accept().await {
                        tokio::spawn(async move {
                            use tokio::io::{AsyncReadExt, AsyncWriteExt};
                            let mut buf = vec![0u8; 8192];
                            let n = stream.read(&mut buf).await.unwrap_or(0);
                            let request = String::from_utf8_lossy(&buf[..n]).to_string();

                            // Extract traceparent header from request
                            let traceparent = request
                                .lines()
                                .find(|line| line.to_lowercase().starts_with("traceparent:"))
                                .map(|line| {
                                    line.split(':')
                                        .nth(1)
                                        .map(|s| s.trim().to_string())
                                        .unwrap_or_default()
                                })
                                .unwrap_or_default();

                            let body =
                                format!(r#"{{"echo":"ok","traceparent":"{}"}}"#, traceparent);
                            let response = format!(
                                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nX-Received-Traceparent: {}\r\n\r\n{}",
                                body.len(),
                                traceparent,
                                body
                            );
                            let _ = stream.write_all(response.as_bytes()).await;
                        });
                    }
                }
            });

            (url, handle)
        }
    }

    // -----------------------------------------------------------------------
    // Response streaming tests (Eje A - Task 2)
    // -----------------------------------------------------------------------

    // -----------------------------------------------------------------------
    // Request streaming tests (Eje B - Task 3)
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_request_body_arrives_as_stream() {
        use camel_component_api::Body;
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("http://127.0.0.1:{port}/upload"), &endpoint_ctx)
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client
            .post(format!("http://127.0.0.1:{port}/upload"))
            .body("hello streaming world")
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                // Body must be Body::Stream, not Body::Text or Body::Bytes
                assert!(
                    matches!(envelope.exchange.input.body, Body::Stream(_)),
                    "expected Body::Stream, got discriminant {:?}",
                    std::mem::discriminant(&envelope.exchange.input.body)
                );
                // Materialize to verify content
                let bytes = envelope
                    .exchange
                    .input
                    .body
                    .into_bytes(1024 * 1024)
                    .await
                    .unwrap();
                assert_eq!(&bytes[..], b"hello streaming world");

                envelope.exchange.input.body = camel_component_api::Body::Empty;
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);

        token.cancel();
    }

    // -----------------------------------------------------------------------
    // Response streaming tests (Eje A - Task 2)
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_streaming_response_chunked() {
        use bytes::Bytes;
        use camel_component_api::Body;
        use camel_component_api::CamelError;
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};
        use camel_component_api::{StreamBody, StreamMetadata};
        use futures::stream;
        use std::sync::Arc;
        use tokio::sync::Mutex;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("http://127.0.0.1:{port}/stream"), &endpoint_ctx)
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client.get(format!("http://127.0.0.1:{port}/stream")).send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                // Respond with Body::Stream
                let chunks: Vec<Result<Bytes, CamelError>> =
                    vec![Ok(Bytes::from("chunk1")), Ok(Bytes::from("chunk2"))];
                let stream = Box::pin(stream::iter(chunks));
                envelope.exchange.input.body = Body::Stream(StreamBody {
                    stream: Arc::new(Mutex::new(Some(stream))),
                    metadata: StreamMetadata::default(),
                });
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "chunk1chunk2");

        token.cancel();
    }

    // -----------------------------------------------------------------------
    // 413 Content-Length limit test (Task 4)
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn test_413_when_content_length_exceeds_limit() {
        use camel_component_api::ConsumerContext;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        // maxRequestBody=100 — any request declaring more than 100 bytes must get 413
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("http://127.0.0.1:{port}/upload?maxRequestBody=100"),
                &endpoint_ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, _rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let resp = client
            .post(format!("http://127.0.0.1:{port}/upload"))
            .header("Content-Length", "1000") // declares 1000 bytes, limit is 100
            .body("x".repeat(1000))
            .send()
            .await
            .unwrap();

        assert_eq!(resp.status().as_u16(), 413);

        token.cancel();
    }

    /// Chunked upload without Content-Length header must NOT be rejected by maxRequestBody.
    /// The spec says: "If there is no Content-Length, the limit does not apply at the
    /// consumer level — the route is responsible."
    #[tokio::test]
    async fn test_chunked_upload_without_content_length_bypasses_limit() {
        use bytes::Bytes;
        use camel_component_api::Body;
        use camel_component_api::ConsumerContext;
        use futures::stream;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        // maxRequestBody=10 — very small limit; chunked uploads have no Content-Length
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("http://127.0.0.1:{port}/upload?maxRequestBody=10"),
                &endpoint_ctx,
            )
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

        let client = plain_http_test_client();

        // Use wrap_stream so reqwest sends chunked transfer encoding WITHOUT a
        // Content-Length header. 100 bytes exceeds the 10-byte maxRequestBody limit,
        // but since there's no Content-Length the 413 check must NOT fire.
        let chunks: Vec<Result<Bytes, std::io::Error>> = vec![
            Ok(Bytes::from("y".repeat(50))),
            Ok(Bytes::from("y".repeat(50))),
        ];
        let stream_body = reqwest::Body::wrap_stream(stream::iter(chunks));
        let send_fut = client
            .post(format!("http://127.0.0.1:{port}/upload"))
            .body(stream_body)
            .send();

        let consumer_fut = async {
            // Use timeout to avoid deadlock if the handler rejects before enqueueing
            match tokio::time::timeout(std::time::Duration::from_millis(500), rx.recv()).await {
                Ok(Some(mut envelope)) => {
                    assert!(
                        matches!(envelope.exchange.input.body, Body::Stream(_)),
                        "expected Body::Stream"
                    );
                    envelope.exchange.input.body = camel_component_api::Body::Empty;
                    if let Some(reply_tx) = envelope.reply_tx {
                        let _ = reply_tx.send(Ok(envelope.exchange));
                    }
                }
                Ok(None) => panic!("consumer channel closed unexpectedly"),
                Err(_) => {
                    // Timeout: the request was rejected before reaching the consumer.
                    // The HTTP response will carry the real status code (we check below).
                }
            }
        };

        let (http_result, _) = tokio::join!(send_fut, consumer_fut);

        let resp = http_result.unwrap();
        // Audit 2026-08-31 (F2-1): the request is no longer rejected at the door
        // (no Content-Length to pre-check), but the byte cap now travels with the
        // stream: ANY materialization past maxRequestBody fails closed. This test
        // does not consume the body, so the request still completes with 200 —
        // enforcement happens at consumption time (see
        // test_http_consumer_chunked_body_is_capped).
        assert_ne!(
            resp.status().as_u16(),
            413,
            "chunked upload has no Content-Length to pre-check"
        );
        assert_eq!(resp.status().as_u16(), 200);

        token.cancel();
    }

    #[test]
    fn test_is_private_ip_ranges() {
        use camel_api::is_ssrf_blocked_ip;
        assert!(is_ssrf_blocked_ip(&"10.0.0.1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"172.16.1.10".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"192.168.1.1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"127.0.0.1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"169.254.1.1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"0.1.2.3".parse().unwrap())); // allow-unwrap

        assert!(is_ssrf_blocked_ip(&"::1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"fc00::1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"fd12::1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"fe80::1".parse().unwrap())); // allow-unwrap
        // ::ffff:0:0/96 (IPv4-mapped): only blocked if the mapped IPv4 is blocked
        assert!(is_ssrf_blocked_ip(&"::ffff:10.0.0.1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"::ffff:192.168.1.1".parse().unwrap())); // allow-unwrap
        assert!(is_ssrf_blocked_ip(&"::ffff:127.0.0.1".parse().unwrap())); // allow-unwrap

        assert!(!is_ssrf_blocked_ip(&"8.8.8.8".parse().unwrap())); // allow-unwrap
        assert!(!is_ssrf_blocked_ip(&"::ffff:8.8.8.8".parse().unwrap())); // allow-unwrap — public IPv4-mapped
        assert!(!is_ssrf_blocked_ip(
            &"2001:4860:4860::8888".parse().unwrap()
        )); // allow-unwrap
    }

    #[test]
    fn test_title_case_header() {
        assert_eq!(title_case_header("content-type"), "Content-Type");
        assert_eq!(title_case_header("authorization"), "Authorization");
        assert_eq!(title_case_header("x-custom-header"), "X-Custom-Header");
        assert_eq!(title_case_header("host"), "Host");
        assert_eq!(title_case_header("x-b3-traceid"), "X-B3-Traceid");
        assert_eq!(title_case_header("single"), "Single");
        assert_eq!(title_case_header(""), "");
    }

    #[test]
    fn test_resolve_url_combines_path_and_query_sources() {
        let cfg = HttpEndpointConfig::from_uri("http://example.com/base?foo=bar").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpPath",
            serde_json::Value::String("next".to_string()),
        );
        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert!(url.starts_with("http://example.com/base/next?"));
        assert!(url.contains("foo=bar"));

        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://other.test/root".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("a=1&b=2".to_string()),
        );

        let override_url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(override_url, "http://other.test/root/next?a=1&b=2");
    }

    fn exchange_with_path_and_query(path: &str, query: &str) -> Exchange {
        let mut exchange = Exchange::new(Message::default());
        exchange
            .input
            .set_header("CamelHttpPath", serde_json::Value::String(path.to_string()));
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String(query.to_string()),
        );
        exchange
    }

    #[test]
    fn resolve_url_bridge_endpoint_true_ignores_exchange_path() {
        let mut cfg = HttpEndpointConfig::from_uri("http://x").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params
            .push(("token".to_string(), "secret".to_string()));
        let exchange = exchange_with_path_and_query("/foo", "dropme=1");
        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        // Verbatim assembly: the old round-trip normalized the empty base
        // path to `/` (`http://x/?token=secret`); authored bytes end-to-end
        // no longer insert it.
        assert_eq!(url, "http://x?token=secret");
        assert!(!url.contains("/foo"));
        assert!(!url.contains("dropme"));
    }

    #[test]
    fn resolve_url_bridge_endpoint_false_merges_path() {
        let mut cfg = HttpEndpointConfig::from_uri("http://x").unwrap();
        cfg.bridge_endpoint = false;
        let exchange = exchange_with_path_and_query("/foo", "dropme=1");
        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert!(url.contains("/foo"), "url should contain /foo: {url}");
        assert!(
            url.contains("dropme=1"),
            "url should contain dropme=1: {url}"
        );
    }

    #[test]
    fn resolve_url_bridge_endpoint_true_keeps_base_when_no_query_params() {
        let mut cfg = HttpEndpointConfig::from_uri("http://x").unwrap();
        cfg.bridge_endpoint = true;
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpPath",
            serde_json::Value::String("/foo".to_string()),
        );
        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://x");
        assert!(!url.contains("/foo"));
    }

    #[test]
    fn resolve_url_bridge_endpoint_true_ignores_camel_http_uri() {
        let mut cfg = HttpEndpointConfig::from_uri("http://x").unwrap();
        cfg.bridge_endpoint = true;
        // query_params stays empty ([])
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://dest/explicit".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpPath",
            serde_json::Value::String("/foo".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("x=1".to_string()),
        );
        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        // Under bridgeEndpoint=true ALL exchange URL headers (CamelHttpUri,
        // CamelHttpPath, CamelHttpQuery) are ignored; the endpoint base URL
        // wins verbatim.
        assert_eq!(url, "http://x");
    }

    #[test]
    fn bridge_programmatic_params_use_percent20() {
        let mut cfg = HttpEndpointConfig::from_uri("http://x").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params = vec![("b".to_string(), "x y".to_string())];
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // `%20 never +` is global for programmatic values — the bridge arm
        // uses the same encoder as the non-bridge path. Bridging
        // semantics (what gets bridged, precedence) are unchanged.
        assert_eq!(url, "http://x?b=x%20y");
        assert!(!url.contains('+'));
    }

    #[test]
    fn bridge_arm_carries_authored_raw_query() {
        let cfg = HttpEndpointConfig::from_uri("http://h/p?a=1&bridgeEndpoint=true").unwrap();
        // bridgeEndpoint is consumed as an endpoint option; a=1 is the
        // authored leftover riding raw_query.
        let exchange = exchange_with_path_and_query("/ignored", "dropme=1");

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // Authored leftovers ride under bridging (Apache Camel semantics):
        // query is a=1 in authored bytes; exchange path/query stay ignored.
        assert_eq!(url, "http://h/p?a=1");
        assert!(!url.contains("dropme"), "exchange query leaked: {url}");
        assert!(!url.contains("/ignored"), "exchange path leaked: {url}");
    }

    // -----------------------------------------------------------------------
    // Bridge arm verbatim assembly (Papal Direction A): the bridged base is
    // never round-tripped through `url::Url` normalization — authored bytes
    // end-to-end, identical assembly to every other resolve_url arm.
    // -----------------------------------------------------------------------

    #[test]
    fn resolve_url_bridge_preserves_dot_segments() {
        let mut cfg = HttpEndpointConfig::from_uri("http://h/a/../b").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params.push(("k".to_string(), "1".to_string()));
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // Dot segments are authored bytes; the old round-trip collapsed
        // them (`/a/../b` → `/b`). Verbatim keeps them.
        assert_eq!(url, "http://h/a/../b?k=1");
    }

    #[test]
    fn resolve_url_bridge_preserves_default_port() {
        let mut cfg = HttpEndpointConfig::from_uri("http://h:80/p").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params.push(("k".to_string(), "1".to_string()));
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // The old round-trip stripped the default port `:80`. Verbatim
        // keeps it.
        assert_eq!(url, "http://h:80/p?k=1");
    }

    #[test]
    fn resolve_url_bridge_preserves_scheme_and_host_case() {
        let mut cfg = HttpEndpointConfig::from_uri("http://ExAMPLE.COM/p").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params.push(("k".to_string(), "1".to_string()));
        // `from_uri`'s scheme validation is case-sensitive, so the scheme
        // case is applied on the stored base directly — the resolve path
        // must carry whatever bytes the operator authored.
        cfg.base_url = "HTTP://ExAMPLE.COM/p".to_string();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // The old round-trip lowercased scheme and host. Verbatim keeps
        // both authored.
        assert_eq!(url, "HTTP://ExAMPLE.COM/p?k=1");
    }

    #[test]
    fn resolve_url_bridge_no_query_emits_base_verbatim() {
        let mut cfg = HttpEndpointConfig::from_uri("http://h/p").unwrap();
        cfg.bridge_endpoint = true;
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // No resolved query: exactly the authored base — no synthetic `/`,
        // no dangling `?`.
        assert_eq!(url, "http://h/p");
    }

    #[test]
    fn resolve_url_bridge_and_non_bridge_byte_identical() {
        // (a) Bridged arm: the effective query comes from programmatic
        // query_params.
        let mut bridged = HttpEndpointConfig::from_uri("http://H:80/a/../b").unwrap();
        bridged.bridge_endpoint = true;
        bridged
            .query_params
            .push(("k".to_string(), "1".to_string()));
        let bridge_url =
            HttpProducer::resolve_url(&Exchange::new(Message::default()), &bridged).unwrap();

        // (b) Non-bridge CamelHttpQuery composition path: same effective
        // query riding the exchange header.
        let plain = HttpEndpointConfig::from_uri("http://H:80/a/../b").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("k=1".to_string()),
        );
        let plain_url = HttpProducer::resolve_url(&exchange, &plain).unwrap();

        assert_eq!(bridge_url, plain_url);
        assert_eq!(bridge_url, "http://H:80/a/../b?k=1");
    }

    #[test]
    fn resolve_url_bridge_preserves_ipv6_authority_verbatim() {
        let mut cfg = HttpEndpointConfig::from_uri("http://[::1]:8080/p").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params.push(("k".to_string(), "1".to_string()));
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        assert_eq!(url, "http://[::1]:8080/p?k=1");
    }

    #[test]
    fn resolve_url_bridge_empty_base_path_keeps_no_synthetic_slash() {
        let cfg = HttpEndpointConfig::from_uri("http://h?x=1&bridgeEndpoint=true").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // Authored query on an empty base path: the old round-trip
        // inserted a synthetic `/` (`http://h/?x=1`); verbatim does not.
        assert_eq!(url, "http://h?x=1");
    }

    // -----------------------------------------------------------------------
    // Raw-preserving outbound query serialization (http-query-wire-fidelity)
    // -----------------------------------------------------------------------

    #[test]
    fn resolve_url_preserves_authored_query_order_and_bytes() {
        let config =
            HttpEndpointConfig::from_uri("http://h/p?a=1&b=x,y&c=t:1&connectTimeout=5000").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Authored order, authored separators, no %2C/%3A re-encoding,
        // consumed option (connectTimeout) removed.
        assert_eq!(url, "http://h/p?a=1&b=x,y&c=t:1");
    }

    #[test]
    fn resolve_url_consumes_encoded_option_key() {
        let config = HttpEndpointConfig::from_uri("http://h/p?connect%54imeout=5000&a=1").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // The raw filter matches the decoded key, not the encoded bytes.
        assert_eq!(url, "http://h/p?a=1");
    }

    #[test]
    fn resolve_url_all_options_consumed_drops_query() {
        let config = HttpEndpointConfig::from_uri("http://h/p?connectTimeout=5000").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // A non-empty query whose every pair was consumed drops the query
        // component entirely — no dangling `?`.
        assert_eq!(url, "http://h/p");
        assert!(!url.contains('?'));
    }

    #[test]
    fn resolve_url_preserves_empty_query_marker() {
        let config = HttpEndpointConfig::from_uri("http://h/p?").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // A bare `?` marker is preserved distinctly, never conflated with
        // an all-consumed query.
        assert_eq!(url, "http://h/p?");
    }

    #[test]
    fn resolve_url_raw_wrapper_not_re_encoded() {
        let config = HttpEndpointConfig::from_uri("http://h/p?token=RAW(abc)").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // RAW(...) wrapper bytes survive exactly as authored (rc-g4isv).
        assert_eq!(url, "http://h/p?token=RAW(abc)");
        assert!(!url.contains("%28"), "RAW( wrapper re-encoded: {url}");
    }

    #[test]
    fn resolve_url_camel_http_query_composes_verbatim_span() {
        let config = HttpEndpointConfig::from_uri("http://h/p?x=1").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("userFilter=a%2Cb".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Policy change (ADR-0071): the header no longer replaces the
        // endpoint query — it composes, the endpoint winning collisions.
        // The header span bytes still ride verbatim: `a%2Cb` is carried
        // as-authored, never re-encoded (no %252C).
        assert_eq!(url, "http://h/p?x=1&userFilter=a%2Cb");
        assert!(!url.contains("%252C"), "header bytes re-encoded: {url}");
    }

    // -----------------------------------------------------------------------
    // Outbound query composition (http-contract-surface, ADR-0071)
    // -----------------------------------------------------------------------

    #[test]
    fn header_composes_with_endpoint_query() {
        let config =
            HttpEndpointConfig::from_uri("http://upstream/api?apiKey=secret&lang=en").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("lang=es&page=2".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Higher precedence (endpoint) wins collisions: `lang` stays `en`;
        // the header appends only its absent keys.
        assert_eq!(url, "http://upstream/api?apiKey=secret&lang=en&page=2");
    }

    #[test]
    fn header_alone_still_rides() {
        let config = HttpEndpointConfig::from_uri("http://upstream/api").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("page=2".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // No endpoint query: the header pairs are the whole query.
        assert_eq!(url, "http://upstream/api?page=2");
    }

    #[test]
    fn empty_reflected_query_leaves_endpoint_query_intact() {
        let config = HttpEndpointConfig::from_uri("http://upstream/api?apiKey=secret").unwrap();
        let mut exchange = Exchange::new(Message::default());
        // The consumer installs an empty CamelHttpQuery on requests that
        // arrived without a query string.
        exchange
            .input
            .set_header("CamelHttpQuery", serde_json::Value::String(String::new()));

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // No second `?` marker, no dropped endpoint pair.
        assert_eq!(url, "http://upstream/api?apiKey=secret");
        assert!(!url.ends_with('?'), "dangling '?' marker: {url}");
    }

    #[test]
    fn forbidden_byte_in_header_query_errors() {
        let config = HttpEndpointConfig::from_uri("http://upstream/api").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("q=ab<cd".to_string()),
        );

        let err = HttpProducer::resolve_url(&exchange, &config)
            .unwrap_err()
            .to_string();

        // Fail loud naming the forbidden byte (`<` = 0x3C); a resolve
        // error means no URL is emitted, never a re-encoded one.
        assert!(err.contains("0x3C"), "error must name the byte: {err}");
    }

    #[test]
    fn override_uri_with_query_plus_header_query() {
        let config = HttpEndpointConfig::from_uri("http://upstream/api").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://host/api?a=1".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("a=2&b=3".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Pair-level merge with a single `?`: the override's `a=1` wins
        // the collision, the header appends `b=3` — no `?a=1?a=2` concat.
        assert_eq!(url, "http://host/api?a=1&b=3");
    }

    #[test]
    fn path_applies_before_query_composition() {
        let config = HttpEndpointConfig::from_uri("http://upstream/api").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://host/api?a=1".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpPath",
            serde_json::Value::String("/extra".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("b=2".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // CamelHttpPath applies to the override base without its query,
        // then the query composes.
        assert_eq!(url, "http://host/api/extra?a=1&b=2");
    }

    #[test]
    fn plain_proxy_reflection_composes() {
        let config = HttpEndpointConfig::from_uri("http://upstream/api?apiKey=secret").unwrap();
        // Headers as the consumer installs them from the wire.
        let exchange = exchange_with_path_and_query("/in/extra", "page=2");

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Reflection rides by default and composes: the operator pair is
        // not replaced (rc-k3pir parity).
        assert_eq!(url, "http://upstream/api/in/extra?apiKey=secret&page=2");
    }

    #[test]
    fn bridge_endpoint_ignores_url_headers() {
        let cfg = HttpEndpointConfig::from_uri("http://h/p?a=1&bridgeEndpoint=true").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://evil.test/x".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpPath",
            serde_json::Value::String("/foo".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("z=9".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();

        // All three URL headers ignored; the endpoint base plus its own
        // (consumed-option-filtered) query is sent, exactly as before.
        assert_eq!(url, "http://h/p?a=1");
        assert!(!url.contains("evil"), "override leaked: {url}");
        assert!(!url.contains("z=9"), "header query leaked: {url}");
        assert!(!url.contains("/foo"), "header path leaked: {url}");
    }

    #[test]
    fn resolve_url_programmatic_params_use_percent20_deterministic() {
        let mut config = HttpEndpointConfig::from_uri("http://h/p").unwrap();
        config.query_params = vec![
            ("b".to_string(), "x y".to_string()),
            ("a".to_string(), "1".to_string()),
        ];
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Declaration order (not lexical), minimal RFC-3986 encoding,
        // `%20` — never `+` — for spaces.
        assert_eq!(url, "http://h/p?b=x%20y&a=1");
        assert!(!url.contains('+'));
    }

    #[test]
    fn resolve_url_authored_and_programmatic_merge() {
        let mut config = HttpEndpointConfig::from_uri("http://h/p?a=1&c=t:1").unwrap();
        config.query_params = vec![
            ("b".to_string(), "2".to_string()),
            ("a".to_string(), "9".to_string()),
        ];
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &config).unwrap();

        // Programmatic `b` appended (absent from raw); programmatic `a=9`
        // ignored (authored key wins); no duplication.
        assert_eq!(url, "http://h/p?a=1&c=t:1&b=2");
    }

    #[test]
    fn from_uri_no_longer_fills_query_params_from_uri() {
        let config = HttpEndpointConfig::from_uri("http://h/p?a=1&connectTimeout=5000").unwrap();

        // Authored pairs live in raw_query ONLY (provenance pin).
        assert!(
            config.query_params.is_empty(),
            "query_params is programmatic-only: {:?}",
            config.query_params
        );
        assert_eq!(config.raw_query.as_deref(), Some("a=1&connectTimeout=5000"));
    }

    #[test]
    fn resolve_url_forbidden_raw_byte_errors() {
        let mut config = HttpEndpointConfig::from_uri("http://h/p").unwrap();
        config.raw_query = Some("a=x y".to_string());
        let exchange = Exchange::new(Message::default());

        let err = HttpProducer::resolve_url(&exchange, &config)
            .expect_err("literal space in raw query must error");

        // The error names the forbidden byte; no output string is produced.
        assert!(
            err.to_string().contains("0x20"),
            "error must name the forbidden byte: {err}"
        );
    }

    /// rc-m4xk1: the override URI's own query is span-validated at resolve
    /// time — a forbidden byte in the override arm errors naming the byte,
    /// instead of riding verbatim to a reqwest send error.
    #[test]
    fn resolve_url_override_query_forbidden_byte_errors() {
        let config = HttpEndpointConfig::from_uri("http://h/p").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://h2/p?a=x y".to_string()),
        );

        let err = HttpProducer::resolve_url(&exchange, &config)
            .expect_err("literal space in the override URI's query must error");

        assert!(
            err.to_string().contains("0x20"),
            "error must name the forbidden byte from the override query: {err}"
        );
    }

    /// rc-m4xk1 pin: decoded-key collision — a header pair whose key decodes
    /// to a key already present in the higher-precedence query (here
    /// `%61=2`, decoding to `a`) is dropped by the shared decoded-key
    /// matching; the higher-precedence authored span rides verbatim.
    #[test]
    fn merge_header_query_decoded_key_collision_drops_header_pair() {
        let merged = merge_header_query(Some("a=1"), "%61=2")
            .expect("decoded-key collision must not be a parse error");
        assert_eq!(
            merged.as_deref(),
            Some("a=1"),
            "the higher-precedence span wins and the colliding header pair is dropped"
        );
    }

    /// rc-m4xk1 pin: duplicate keys within ONE header query are not
    /// deduplicated — both spans ride verbatim in authored order.
    #[test]
    fn merge_header_query_duplicate_keys_within_header_ride_verbatim() {
        let merged = merge_header_query(None, "k=1&k=2")
            .expect("duplicate header keys must not be a parse error");
        assert_eq!(
            merged.as_deref(),
            Some("k=1&k=2"),
            "intra-header duplicate keys ride verbatim"
        );
    }

    /// rc-dhkeo: the Debug surface masks userinfo-style bytes in
    /// `base_url` and leaves a userinfo-free base untouched, byte-for-byte.
    /// rc-yvjp3 (ADR-0076 strictest-wins): `base_url` routes through the
    /// canonical `camel_api::redact::redact_url` — query and fragment bytes
    /// now drop behind their sentinels and later `//user:pass@` windows
    /// mask too, dimensions the former byte-preserving local variant kept.
    #[test]
    fn endpoint_config_debug_masks_base_url_userinfo() {
        let mut config = HttpEndpointConfig::from_uri("http://h.example/p").unwrap();
        config.base_url = "http://user:pass@h.example/p".to_string();
        let rendered = format!("{config:?}");
        assert!(
            rendered.contains("***@h.example"),
            "userinfo must render masked: {rendered}"
        );
        assert!(
            !rendered.contains("user:pass"),
            "no credentials in Debug output: {rendered}"
        );

        let plain = HttpEndpointConfig::from_uri("http://h.example/p").unwrap();
        let rendered_plain = format!("{plain:?}");
        assert!(
            rendered_plain.contains("http://h.example/p"),
            "a base without userinfo renders unchanged: {rendered_plain}"
        );
    }

    /// rc-yvjp3 convergence: an authored query and fragment on `base_url`
    /// render as sentinels, never as raw bytes (strictest-wins over the
    /// former byte-preserving variant), and the rendered value is
    /// byte-identical to the canonical helper.
    #[test]
    fn endpoint_config_debug_base_url_converges_on_canonical_redact() {
        let mut config = HttpEndpointConfig::from_uri("http://h.example/p").unwrap();

        config.base_url = "http://h.example/p?token=secret#access_token=x".to_string();
        let rendered = format!("{config:?}");
        assert!(
            rendered.contains("base_url: \"http://h.example/p?[redacted]#[redacted]\""),
            "query and fragment must render as composed sentinels: {rendered}"
        );
        assert!(
            !rendered.contains("token=secret") && !rendered.contains("access_token"),
            "query/fragment credential bytes must not render: {rendered}"
        );

        config.base_url = "http://h.example//u2:p2@evil/".to_string();
        let rendered = format!("{config:?}");
        assert!(
            rendered.contains("base_url: \"http://h.example//***@evil/\""),
            "later //window userinfo must mask (canonical window rule): {rendered}"
        );
        assert!(
            !rendered.contains("u2:p2"),
            "later-window credentials must not render: {rendered}"
        );

        // Cross-surface identity: the Debug field is byte-identical to the
        // canonical helper output for the same input.
        config.base_url = "http://user:pass@h.example/p?token=x".to_string();
        let canonical = camel_api::redact::redact_url(&config.base_url);
        assert_eq!(canonical, "http://***@h.example/p?[redacted]");
        let rendered = format!("{config:?}");
        assert!(
            rendered.contains(&format!("base_url: \"{canonical}\"")),
            "Debug base_url must equal canonical redact_url output: {rendered}"
        );
    }

    /// rc-nmupb: authored apostrophe (0x27) is RFC 3986 pchar-legal, but
    /// reqwest's WHATWG parser re-encodes it as `%27` in every http/https
    /// query — the raw byte can never ride the wire verbatim. Resolve
    /// rejects it naming the byte; the authored `%27` escape is the
    /// wire-faithful form and rides verbatim.
    #[test]
    fn resolve_url_authored_apostrophe_rejected_percent_escape_rides() {
        let mut config = HttpEndpointConfig::from_uri("http://h/p").unwrap();

        config.raw_query = Some("q=it's".to_string());
        let exchange = Exchange::new(Message::default());
        let err = HttpProducer::resolve_url(&exchange, &config)
            .expect_err("authored apostrophe must be rejected, not silently %27-normalized");
        assert!(
            err.to_string().contains("0x27"),
            "error must name the apostrophe byte: {err}"
        );

        config.raw_query = Some("q=it%27s".to_string());
        let url = HttpProducer::resolve_url(&exchange, &config)
            .expect("authored %27 escape is wire-legal");
        assert!(
            url.contains("q=it%27s"),
            "the authored escape must ride byte-for-byte: {url}"
        );

        // The rest of reqwest's WHATWG special-query set shares the same
        // rationale and is rejected alongside (`"` and backtick are not
        // RFC 3986 query-legal bytes; `<`/`>` likewise).
        for &byte in b"\"`<>" {
            config.raw_query = Some(format!("k={}x", byte as char));
            let err = HttpProducer::resolve_url(&exchange, &config)
                .expect_err("WHATWG special-query byte must be rejected");
            assert!(
                err.to_string().contains(&format!("0x{byte:02X}")),
                "error must name byte 0x{byte:02X}: {err}"
            );
        }
    }

    #[test]
    fn armed_fence_rejects_unknown_host_redacted() {
        let cfg = HttpEndpointConfig::from_uri(
            "http://x?allowedUriHosts=api.internal:8443,cdn.example.com",
        )
        .unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String(
                "http://user:pass@evil.example.com/x?token=s3cret".to_string(),
            ),
        );

        let err = HttpProducer::resolve_url(&exchange, &cfg)
            .expect_err("override host outside the fence must fail resolution");

        let message = err.to_string();
        assert!(!message.contains("pass"), "userinfo leaked: {message}");
        assert!(!message.contains("s3cret"), "query leaked: {message}");
    }

    #[test]
    fn armed_fence_rejects_unparseable_override_redacted() {
        let cfg = HttpEndpointConfig::from_uri(
            "http://x?allowedUriHosts=api.internal:8443,cdn.example.com",
        )
        .unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://u:fencesecret@evil.example.com:99999/x".to_string()),
        );

        let err = HttpProducer::resolve_url(&exchange, &cfg)
            .expect_err("unparseable override outside the fence must fail resolution");

        let message = err.to_string();
        assert!(
            message.contains("allowedUriHosts fence"),
            "fence must be named: {message}"
        );
        assert!(
            message.contains("[redacted]"),
            "suppression sentinel missing: {message}"
        );
        assert!(
            !message.contains("evil.example.com"),
            "host leaked: fail-closed arm must render only the sentinel: {message}"
        );
        assert!(
            !message.contains("fencesecret"),
            "password leaked: {message}"
        );
        assert!(!message.contains("u:"), "userinfo leaked: {message}");
    }

    #[test]
    fn armed_fence_rejects_password_only_userinfo_redacted() {
        let cfg = HttpEndpointConfig::from_uri(
            "http://x?allowedUriHosts=api.internal:8443,cdn.example.com",
        )
        .unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String(
                "http://:passwordonly@evil.example.com/x?token=querysecret".to_string(),
            ),
        );

        let err = HttpProducer::resolve_url(&exchange, &cfg)
            .expect_err("password-only override outside the fence must fail resolution");

        let message = err.to_string();
        assert!(
            !message.contains("passwordonly"),
            "password-only userinfo leaked: {message}"
        );
        assert!(!message.contains("querysecret"), "query leaked: {message}");
        assert!(
            message.contains("http://***@evil.example.com/x?[redacted]"),
            "masked shape missing: {message}"
        );
    }

    #[test]
    fn armed_fence_allows_listed_host() {
        let cfg = HttpEndpointConfig::from_uri(
            "http://x?allowedUriHosts=api.internal:8443,cdn.example.com",
        )
        .unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://cdn.example.com/x".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://cdn.example.com/x");
    }

    #[test]
    fn host_only_entry_permits_any_port() {
        let cfg = HttpEndpointConfig::from_uri("http://x?allowedUriHosts=cdn.example.com").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://cdn.example.com:9443/x".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://cdn.example.com:9443/x");
    }

    #[test]
    fn unarmed_endpoint_unchanged() {
        let cfg = HttpEndpointConfig::from_uri("http://x").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://any.example.com/path".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://any.example.com/path");
    }

    #[test]
    fn empty_allowlist_fails_endpoint_creation() {
        assert!(HttpEndpointConfig::from_uri("http://x?allowedUriHosts=,,").is_err());
    }

    #[test]
    fn malformed_entry_fails_endpoint_creation() {
        assert!(HttpEndpointConfig::from_uri("http://x?allowedUriHosts=not a host!").is_err());
    }

    #[test]
    fn fence_entry_with_path_fails_creation() {
        // A trailing path is a typo'd entry: silently narrowing it to the
        // hostname would widen or skew the fence. Reject loudly.
        assert!(
            HttpEndpointConfig::from_uri("http://x?allowedUriHosts=api.internal:8443/v2").is_err()
        );
    }

    #[test]
    fn fence_entry_with_userinfo_fails_creation() {
        assert!(
            HttpEndpointConfig::from_uri("http://x?allowedUriHosts=user@cdn.example.com").is_err()
        );
    }

    #[test]
    fn ipv6_fence_entry_allows_bracketed_host() {
        let cfg = HttpEndpointConfig::from_uri("http://x?allowedUriHosts=[::1]:8443").unwrap();
        // The textual host forms differ; both parse to the same bracketed
        // canonical host (`[::1]`) that the entry stores, so both ride.
        for uri in ["http://[::1]:8443/x", "http://[0:0:0:0:0:0:0:1]:8443/x"] {
            let mut exchange = Exchange::new(Message::default());
            exchange
                .input
                .set_header("CamelHttpUri", serde_json::Value::String(uri.to_string()));
            let url = HttpProducer::resolve_url(&exchange, &cfg)
                .unwrap_or_else(|e| panic!("override {uri} must be honored: {e}"));
            assert_eq!(url, uri, "bracketed IPv6 override not honored");
        }
    }

    #[test]
    fn dns_case_insensitive_fence_match() {
        // The entry is stored ASCII-lowercased, so the mixed-case option
        // matches the lowercase override host.
        let cfg = HttpEndpointConfig::from_uri("http://x?allowedUriHosts=CDN.Example.COM").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://cdn.example.com/x".to_string()),
        );
        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://cdn.example.com/x");
    }

    #[test]
    fn fence_allowed_override_query_merges_with_header() {
        // Fence pass plus full composition: the override URI query is the
        // higher-precedence source, the header pair appends.
        let cfg =
            HttpEndpointConfig::from_uri("http://x?allowedUriHosts=host.example&k=v").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://host.example/api?a=1".to_string()),
        );
        exchange.input.set_header(
            "CamelHttpQuery",
            serde_json::Value::String("b=2".to_string()),
        );

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://host.example/api?a=1&b=2");
    }

    #[test]
    fn empty_header_with_armed_fence_leaves_no_query() {
        let cfg = HttpEndpointConfig::from_uri("http://x?allowedUriHosts=host.example").unwrap();
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String("http://host.example/api".to_string()),
        );
        exchange
            .input
            .set_header("CamelHttpQuery", serde_json::Value::String(String::new()));

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert_eq!(url, "http://host.example/api");
        assert!(!url.contains('?'), "query marker leaked: {url}");
    }

    #[test]
    fn fence_option_is_consumed() {
        // A raw query on the base URI plus the fence option; no override
        // header. The option is consumed at parse time and must never
        // appear in the outbound query.
        let cfg =
            HttpEndpointConfig::from_uri("http://h/p?x=1&allowedUriHosts=cdn.example.com").unwrap();
        let exchange = Exchange::new(Message::default());

        let url = HttpProducer::resolve_url(&exchange, &cfg).unwrap();
        assert!(!url.contains("allowedUriHosts"), "option leaked: {url}");
        assert!(url.contains("x=1"), "authored query lost: {url}");
    }

    #[tokio::test]
    async fn resolve_url_malformed_base_url_errors_no_panic() {
        use tower::ServiceExt;

        let (url, _handle) = start_test_server().await;
        let mut config = HttpEndpointConfig::from_uri("http://[::1:bad").unwrap();
        config.allow_internal = true; // test server binds 127.0.0.1
        let producer = HttpProducer {
            config: Arc::new(config),
            client: build_client(&HttpConfig::default(), None).expect("client must build"), // allow-unwrap(test)
            pinned_cache: Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            http_config: Arc::new(HttpConfig::default()),
            runtime: rt(),
        };

        // First call: malformed base URL propagates as an error through the
        // real producer path — no panic, no poisoned state (rc-ph7z2).
        let first = producer
            .clone()
            .oneshot(Exchange::new(Message::default()))
            .await;
        let err = first.expect_err("malformed base URL must error, not panic");
        assert!(
            err.to_string().to_lowercase().contains("url"),
            "error must name the malformed URL: {err}"
        );

        // Second call through the SAME producer succeeds — the failure
        // left no poisoned state.
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header(
            "CamelHttpUri",
            serde_json::Value::String(format!("{url}/api")),
        );
        let response = producer
            .oneshot(exchange)
            .await
            .expect("valid request through same producer must succeed");
        let status = response
            .input
            .header("CamelHttpResponseCode")
            .and_then(|v| v.as_u64())
            .unwrap();
        assert_eq!(status, 200);
    }

    #[test]
    fn resolve_url_bridge_malformed_base_errors_no_panic() {
        let mut cfg = HttpEndpointConfig::from_uri("http://h/p").unwrap();
        cfg.bridge_endpoint = true;
        cfg.query_params.push(("k".to_string(), "1".to_string()));
        // `from_uri` rejects the malformed authority, so the base is set on
        // the stored config directly (same build shape as the scheme-case
        // test). The bridge arm's validation-only parse (rc-ph7z2) must
        // surface it as an error — no panic.
        cfg.base_url = "http://[::1:bad".to_string();
        let exchange = Exchange::new(Message::default());

        let err = HttpProducer::resolve_url(&exchange, &cfg)
            .expect_err("malformed bridge base URL must error");
        assert!(
            err.to_string().contains("invalid base URL"),
            "error must name the invalid base URL: {err}"
        );
    }

    #[test]
    fn test_http_producer_helpers_status_and_size_boundaries() {
        assert!(HttpProducer::is_ok_status(200, (200, 299)));
        assert!(HttpProducer::is_ok_status(299, (200, 299)));
        assert!(!HttpProducer::is_ok_status(199, (200, 299)));
        assert!(!HttpProducer::is_ok_status(300, (200, 299)));

        assert!(!exceeds_max_response_body(10, 10));
        assert!(exceeds_max_response_body(11, 10));
    }

    // -----------------------------------------------------------------------
    // Content-Type inference tests
    // -----------------------------------------------------------------------

    #[allow(clippy::await_holding_lock)]
    async fn setup_consumer_on_free_port(
        path: &str,
    ) -> (
        u16,
        tokio::sync::mpsc::Receiver<camel_component_api::ExchangeEnvelope>,
        tokio_util::sync::CancellationToken,
    ) {
        use camel_component_api::ConsumerContext;

        // ADR-0070 staged-listener law: bind, KEEP the socket, and stage it
        // in the ServerRegistry; the consumer's `get_or_spawn` consumes the
        // staged listener, so the port never returns to the ephemeral pool
        // between probe and serve (no bind-read-drop race).
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();

        // Hold the registry test mutex across the whole stage→spawn→ready
        // window so a concurrent `ServerRegistry::reset()` cannot evict the
        // staged listener between staging and readiness. The guard covers
        // stage_listener, the consumer spawn, the readiness poll and the
        // tail-yield loop; it releases when this helper returns.
        // Poison-recovering acquire: a failed sibling test must not
        // cascade — the mutex guards test serialization only, no
        // structural invariant, so recovery via into_inner is safe.
        let _registry_guard = lock_registry_test_mutex();

        ServerRegistry::global()
            .stage_listener(listener)
            .await
            .expect("stage consumer test listener");

        let consumer_cfg = HttpServerConfig {
            scheme: "http".to_string(),
            host: "127.0.0.1".to_string(),
            port,
            path: path.to_string(),
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            max_inflight_requests: 1024,
            method: None,
            tls_config: None,
        };
        let mut consumer = HttpConsumer::new(consumer_cfg, test_rt());

        let (tx, rx) = tokio::sync::mpsc::channel::<camel_component_api::ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });

        // Readiness without a fixed wall-clock sleep: poll the registry
        // entry live (1ms doubling backoff, 10s deadline), then yield so
        // the spawned `start()` completes route registration (that tail
        // path has no pending timers — only the registry lock — so
        // scheduler yields order it deterministically behind this loop).
        wait_for_registry_ready("127.0.0.1", port).await;
        for _ in 0..8 {
            tokio::task::yield_now().await;
        }

        (port, rx, token)
    }

    /// Poll `ServerRegistry::bound_addr(host, port)` until the entry
    /// appears: 1ms backoff doubling per iteration, capped at 64ms, with
    /// a 10s deadline. Panics with a hint naming the likely causes when
    /// the deadline fires.
    async fn wait_for_registry_ready(host: &str, port: u16) {
        let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(10);
        let mut backoff = std::time::Duration::from_millis(1);
        while ServerRegistry::global().bound_addr(host, port).is_none() {
            assert!(
                tokio::time::Instant::now() < deadline,
                "consumer server did not become ready on port {port} — registry entry absent (concurrent reset or starvation)"
            );
            tokio::time::sleep(backoff).await;
            backoff = (backoff * 2).min(std::time::Duration::from_millis(64));
        }
    }

    #[tokio::test(start_paused = true)]
    #[should_panic(expected = "registry entry absent (concurrent reset or starvation)")]
    async fn readiness_deadline_fires_loud_with_hint() {
        // start_paused: the backoff sleeps and the 10s deadline run on
        // the mocked clock (tokio test-util dev-feature), so the loud
        // path costs no wall time.
        // Poll a key no writer can produce. Registry keys come from
        // either the listener's resolved IP string (staged path) or the
        // caller-provided host verbatim (legacy get_or_spawn path), so a
        // synthetic host literal that no test passes is unreachable on
        // BOTH paths. Binding and HOLDING the listener (never dropped,
        // never staged) additionally keeps its port out of the ephemeral
        // pool, so no concurrent test can register that port either.
        // (Earlier drafts polled 127.0.0.2 — rejected: macOS exposes only
        // 127.0.0.1 and the bind fails there, rc-dwmd; and "localhost" —
        // rejected: the legacy host-verbatim path could produce it.)
        let held = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = held.local_addr().unwrap().port();
        wait_for_registry_ready("httpflake-unreachable-host", port).await;
    }

    // -----------------------------------------------------------------------
    // Readiness vs concurrent registry reset (httpflake, regression RED)
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn readiness_survives_concurrent_registry_reset() {
        let contended = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
        let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));

        // Hammer thread: loop legal resets, counting a contention only
        // when its try-lock on the registry test mutex reports WouldBlock
        // (someone else held it). Poison is a sibling's panic, not
        // contention: recover through the poison-recovering helper
        // without counting it. The guard is dropped at each iteration
        // end.
        let contended_hammer = std::sync::Arc::clone(&contended);
        let stop_hammer = std::sync::Arc::clone(&stop);
        let handle = std::thread::spawn(move || {
            while !stop_hammer.load(std::sync::atomic::Ordering::Relaxed) {
                let _guard = match REGISTRY_TEST_MUTEX.try_lock() {
                    Err(std::sync::TryLockError::WouldBlock) => {
                        contended_hammer.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
                        lock_registry_test_mutex()
                    }
                    Err(std::sync::TryLockError::Poisoned(_)) => lock_registry_test_mutex(),
                    Ok(guard) => guard,
                };
                ServerRegistry::reset();
            }
        });

        // Drop guard: even if a setup panics, stop the hammer and join it so
        // the thread never outlives the test.
        struct StopHammerOnDrop {
            handle: Option<std::thread::JoinHandle<()>>,
            stop: std::sync::Arc<std::sync::atomic::AtomicBool>,
        }
        impl Drop for StopHammerOnDrop {
            fn drop(&mut self) {
                self.stop.store(true, std::sync::atomic::Ordering::Relaxed);
                if let Some(handle) = self.handle.take() {
                    let _ = handle.join();
                }
            }
        }
        let _hammer_guard = StopHammerOnDrop {
            handle: Some(handle),
            stop,
        };

        // Always at least 25 setups on fresh ephemeral ports; continue past
        // 25 only until one contended reset is observed; hard cap 50.
        let mut setups = 0;
        loop {
            setups += 1;
            let (_port, rx, token) = setup_consumer_on_free_port("/reset-hammer").await;
            drop(rx);
            token.cancel();
            if (setups >= 25 && contended.load(std::sync::atomic::Ordering::SeqCst) >= 1)
                || setups >= 50
            {
                break;
            }
        }

        let contended_hits = contended.load(std::sync::atomic::Ordering::SeqCst);
        assert!(
            contended_hits >= 1,
            "expected at least one contended registry reset across {setups} setups, got {contended_hits}"
        );
    }

    #[tokio::test]
    async fn test_content_type_inferred_for_json_body() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/json").await;

        let client = plain_http_test_client();
        let send_fut = client.get(format!("http://127.0.0.1:{port}/json")).send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Json(serde_json::json!({"message": "hello"}));
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let ct = resp
            .headers()
            .get("content-type")
            .expect("Content-Type header should be present");
        assert_eq!(ct, "application/json");
        let body = resp.text().await.unwrap();
        assert_eq!(body, r#"{"message":"hello"}"#);

        token.cancel();
    }

    #[tokio::test]
    async fn test_content_type_inferred_for_text_body() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/text").await;

        // build_client (not bare plain_http_test_client()): CA-store test
        // windows are process-visible and Client::new() panics when the
        // native store loads zero roots; the crate builder falls back to
        // webpki roots instead.
        let client = build_client(&HttpConfig::default(), None).expect("client must build"); // allow-unwrap(test)
        let send_fut = client.get(format!("http://127.0.0.1:{port}/text")).send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Text("plain text response".to_string());
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let ct = resp
            .headers()
            .get("content-type")
            .expect("Content-Type header should be present");
        assert_eq!(ct, "text/plain; charset=utf-8");
        let body = resp.text().await.unwrap();
        assert_eq!(body, "plain text response");

        token.cancel();
    }

    #[tokio::test]
    async fn test_content_type_inferred_for_xml_body() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/xml").await;

        let client = plain_http_test_client();
        let send_fut = client.get(format!("http://127.0.0.1:{port}/xml")).send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Xml("<root><item>value</item></root>".to_string());
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let ct = resp
            .headers()
            .get("content-type")
            .expect("Content-Type header should be present");
        assert_eq!(ct, "application/xml");
        let body = resp.text().await.unwrap();
        assert_eq!(body, "<root><item>value</item></root>");

        token.cancel();
    }

    #[tokio::test]
    async fn test_no_content_type_for_empty_body() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/empty").await;

        let client = plain_http_test_client();
        let send_fut = client.get(format!("http://127.0.0.1:{port}/empty")).send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body = camel_component_api::Body::Empty;
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        assert!(
            resp.headers().get("content-type").is_none(),
            "Empty body should not set Content-Type"
        );

        token.cancel();
    }

    #[tokio::test]
    async fn test_no_content_type_for_raw_bytes_body() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/bytes").await;

        let client = plain_http_test_client();
        let send_fut = client.get(format!("http://127.0.0.1:{port}/bytes")).send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Bytes(bytes::Bytes::from_static(b"\x00\x01\x02"));
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        assert!(
            resp.headers().get("content-type").is_none(),
            "Raw Bytes body should not set Content-Type"
        );

        token.cancel();
    }

    #[tokio::test]
    async fn test_content_type_from_stream_metadata() {
        use camel_component_api::{StreamBody, StreamMetadata};
        use futures::stream;

        let (port, mut rx, token) = setup_consumer_on_free_port("/stream-ct").await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/stream-ct"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                let chunks: Vec<Result<bytes::Bytes, CamelError>> =
                    vec![Ok(bytes::Bytes::from("audio data"))];
                let stream = Box::pin(stream::iter(chunks));
                envelope.exchange.input.body = camel_component_api::Body::Stream(StreamBody {
                    stream: Arc::new(tokio::sync::Mutex::new(Some(stream))),
                    metadata: StreamMetadata {
                        size_hint: None,
                        content_type: Some("audio/mpeg".to_string()),
                        origin: None,
                    },
                });
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let ct = resp
            .headers()
            .get("content-type")
            .expect("Content-Type header should be present");
        assert_eq!(ct, "audio/mpeg");
        let body = resp.text().await.unwrap();
        assert_eq!(body, "audio data");

        token.cancel();
    }

    #[tokio::test]
    async fn test_user_content_type_overrides_inferred() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/override-ct").await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/override-ct"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Json(serde_json::json!({"ok": true}));
                envelope.exchange.input.set_header(
                    "Content-Type",
                    serde_json::Value::String("text/html".to_string()),
                );
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let ct = resp
            .headers()
            .get("content-type")
            .expect("Content-Type header should be present");
        assert_eq!(
            ct, "text/html",
            "User-set Content-Type should take precedence over inferred type"
        );

        token.cancel();
    }

    #[tokio::test]
    async fn test_user_content_type_with_bytes_body() {
        let (port, mut rx, token) = setup_consumer_on_free_port("/bytes-ct").await;

        let client = plain_http_test_client();
        let send_fut = client
            .get(format!("http://127.0.0.1:{port}/bytes-ct"))
            .send();

        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body =
                    camel_component_api::Body::Bytes(bytes::Bytes::from_static(b"{\"ok\":true}"));
                envelope.exchange.input.set_header(
                    "Content-Type",
                    serde_json::Value::String("application/json".to_string()),
                );
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let ct = resp
            .headers()
            .get("content-type")
            .expect("Content-Type header should be present for Bytes body with user header");
        assert_eq!(
            ct, "application/json",
            "User Content-Type should be sent for Bytes body"
        );

        token.cancel();
    }

    // -----------------------------------------------------------------------
    // Server monitor tests (GRL-005)
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn monitor_task_silent_on_clean_exit() {
        let handle: tokio::task::JoinHandle<()> = tokio::spawn(async {});
        let server_exited = tokio_util::sync::CancellationToken::new();
        // Clean exit should complete without panicking or logging errors
        monitor_axum_task(
            handle,
            "127.0.0.1:0".to_string(),
            noop_rt(),
            "test-monitor".into(),
            server_exited.clone(),
        )
        .await;
        // rc-szmob: a clean exit must NOT fail hosted consumers — route
        // stops own their termination (no CrashNotification storm on
        // graceful process shutdown).
        assert!(
            !server_exited.is_cancelled(),
            "clean server exit must not cancel server_exited"
        );
    }

    #[tokio::test]
    async fn monitor_task_handles_panicked_task() {
        let handle: tokio::task::JoinHandle<()> = tokio::spawn(async {
            panic!("simulated server crash");
        });
        let server_exited = tokio_util::sync::CancellationToken::new();
        // Should complete without panicking even though the inner task panicked
        monitor_axum_task(
            handle,
            "127.0.0.1:9999".to_string(),
            noop_rt(),
            "test-monitor".into(),
            server_exited.clone(),
        )
        .await;
        // rc-szmob: unexpected exit must cancel the token so every hosted
        // consumer fails and supervision engages (ADR-0007).
        assert!(
            server_exited.is_cancelled(),
            "crashed server must cancel server_exited"
        );
    }

    // -----------------------------------------------------------------------
    // Credential redaction tests
    // -----------------------------------------------------------------------

    #[test]
    fn http_auth_basic_debug_redacts_password() {
        let auth = HttpAuth::Basic {
            username: "admin".to_string(),
            password: "hunter2".to_string(),
        };
        let debug = format!("{:?}", auth);
        assert!(
            !debug.contains("hunter2"),
            "password must be redacted: {debug}"
        );
        assert!(debug.contains("admin"), "username should appear: {debug}");
    }

    #[test]
    fn http_auth_bearer_debug_redacts_token() {
        let auth = HttpAuth::Bearer {
            token: "eyJhbGciOiJIUzI1NiJ9.secret".to_string(),
        };
        let debug = format!("{:?}", auth);
        assert!(
            !debug.contains("eyJhbGci"),
            "token must be redacted: {debug}"
        );
    }

    #[test]
    fn http_auth_none_debug_shows_variant() {
        let debug = format!("{:?}", HttpAuth::None);
        assert!(
            debug.contains("None"),
            "None variant should appear: {debug}"
        );
    }

    #[test]
    fn http_endpoint_config_debug_redacts_auth_credentials() {
        let config = HttpEndpointConfig::from_uri(
            "http://localhost/api?authMethod=Basic&authUsername=admin&authPassword=secret123",
        )
        .unwrap();
        let debug = format!("{:?}", config);
        assert!(
            !debug.contains("secret123"),
            "password must be redacted in HttpEndpointConfig debug: {debug}"
        );
    }

    #[test]
    fn debug_lists_all_public_fields() {
        let config = HttpEndpointConfig::from_uri("http://h/p").unwrap();
        let debug = format!("{:?}", config);
        for field in [
            "base_url",
            "http_method",
            "throw_exception_on_failure",
            "ok_status_code_range",
            "response_timeout",
            "query_params",
            "raw_query",
            "allow_internal",
            "allow_cleartext",
            "blocked_hosts",
            "max_body_size",
            "read_timeout_ms",
            "max_response_bytes",
            "auth",
            "token_provider",
            "user_agent",
            "bridge_endpoint",
            "connection_close",
            "skip_request_headers",
            "skip_response_headers",
            "follow_redirects",
            "max_redirects",
        ] {
            assert!(
                debug.contains(field),
                "Debug output missing field '{field}': {debug}"
            );
        }
    }

    // -----------------------------------------------------------------------
    // Static file serving tests (Task 5)
    // -----------------------------------------------------------------------

    use crate::registry::{HttpRouteRegistry, MountMode, StaticMount};
    use tower_http::services::ServeDir;

    fn make_test_registry() -> HttpRouteRegistry {
        HttpRouteRegistry::new()
    }

    fn make_test_state(registry: HttpRouteRegistry) -> AppState {
        AppState {
            registry,
            max_request_body: 2 * 1024 * 1024,
            max_response_body: 10 * 1024 * 1024,
            inflight: Arc::new(tokio::sync::Semaphore::new(1024)),
        }
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_static_file_serving_serves_file_contents() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();

        // Create temp dir with test files
        let temp_dir =
            std::env::temp_dir().join(format!("http_static_test_{}", std::process::id()));
        std::fs::create_dir_all(&temp_dir).unwrap();
        std::fs::write(temp_dir.join("hello.txt"), "Hello, static world!").unwrap();
        std::fs::write(temp_dir.join("style.css"), "body { color: red; }").unwrap();

        let canonical_dir = std::fs::canonicalize(&temp_dir).unwrap();

        let registry = make_test_registry();
        let serve_dir = ServeDir::new(&canonical_dir)
            .precompressed_gzip()
            .precompressed_br()
            .append_index_html_on_directories(true);

        let mount = StaticMount {
            mount_path: "/".to_string(),
            mode: MountMode::Static,
            dir: canonical_dir.clone(),
            cache_control: "public, max-age=3600".to_string(),
            error_pages: std::collections::HashMap::new(),
            serve_dir,
        };
        registry.register_static_mount(mount).await.unwrap();

        let state = make_test_state(registry);

        // Test serving hello.txt
        let req = Request::builder()
            .uri("/hello.txt")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/hello.txt").await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"Hello, static world!");

        // Test serving style.css
        let req = Request::builder()
            .uri("/style.css")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/style.css").await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"body { color: red; }");

        // Test 404 for non-existent file
        let req = Request::builder()
            .uri("/missing.txt")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/missing.txt").await;
        assert_eq!(resp.status(), StatusCode::NOT_FOUND);

        // Cleanup
        std::fs::remove_dir_all(&temp_dir).ok();
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_spa_fallback_serves_index_for_unknown_paths() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();

        let temp_dir = std::env::temp_dir().join(format!("http_spa_test_{}", std::process::id()));
        std::fs::create_dir_all(&temp_dir).unwrap();
        std::fs::write(temp_dir.join("index.html"), "<h1>SPA App</h1>").unwrap();
        std::fs::write(temp_dir.join("app.js"), "console.log('app')").unwrap();

        let canonical_dir = std::fs::canonicalize(&temp_dir).unwrap();

        let registry = make_test_registry();
        let serve_dir = ServeDir::new(&canonical_dir)
            .precompressed_gzip()
            .precompressed_br()
            .append_index_html_on_directories(true);

        let mount = StaticMount {
            mount_path: "/".to_string(),
            mode: MountMode::Spa,
            dir: canonical_dir.clone(),
            cache_control: "public, max-age=0".to_string(),
            error_pages: std::collections::HashMap::new(),
            serve_dir,
        };
        // Register as SPA mount
        registry.register_static_mount(mount).await.unwrap();

        let state = make_test_state(registry);

        // SPA fallback: GET /dashboard with Accept: text/html → index.html
        let req = Request::builder()
            .method("GET")
            .uri("/dashboard")
            .header("Accept", "text/html")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/dashboard").await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"<h1>SPA App</h1>");

        // Static file still works: GET /app.js
        let req = Request::builder()
            .method("GET")
            .uri("/app.js")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/app.js").await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"console.log('app')");

        // No SPA fallback for JSON accept → 404
        let req = Request::builder()
            .method("GET")
            .uri("/api/data")
            .header("Accept", "application/json")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/api/data").await;
        assert_eq!(resp.status(), StatusCode::NOT_FOUND);

        // No SPA fallback for file extensions → 404
        let req = Request::builder()
            .method("GET")
            .uri("/style.css")
            .header("Accept", "text/html")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/style.css").await;
        assert_eq!(resp.status(), StatusCode::NOT_FOUND);

        // Cleanup
        std::fs::remove_dir_all(&temp_dir).ok();
    }

    // Regression for rc-zoai: a conditional GET (If-None-Match / If-Modified-Since)
    // whose validator matches MUST return 304 Not Modified, not 404. The bug was
    // dispatch_static's L92 gate `if resp.status().is_success()` discarding
    // ServeDir's legitimate 304 and falling through to the generic 404. The fix
    // adds `|| resp.status() == StatusCode::NOT_MODIFIED` to that gate (and the
    // matching gate in serve_via_serve_dir so the 304 keeps its Cache-Control).
    #[allow(clippy::await_holding_lock)]
    async fn run_conditional_get_returns_304(mode: MountMode) {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();

        let temp_dir = std::env::temp_dir().join(format!(
            "http_cond_get_{}_{}",
            if mode == MountMode::Spa {
                "spa"
            } else {
                "static"
            },
            std::process::id()
        ));
        std::fs::create_dir_all(&temp_dir).unwrap();
        std::fs::write(temp_dir.join("index.html"), "<h1>Home</h1>").unwrap();

        let canonical_dir = std::fs::canonicalize(&temp_dir).unwrap();

        let registry = make_test_registry();
        let serve_dir = ServeDir::new(&canonical_dir)
            .precompressed_gzip()
            .precompressed_br()
            .append_index_html_on_directories(true);

        let mount = StaticMount {
            mount_path: "/".to_string(),
            mode,
            dir: canonical_dir.clone(),
            cache_control: "public, max-age=3600".to_string(),
            error_pages: std::collections::HashMap::new(),
            serve_dir,
        };
        registry.register_static_mount(mount).await.unwrap();

        let state = make_test_state(registry);

        // 1st request: normal GET → 200, capture validators.
        let req = Request::builder()
            .method("GET")
            .uri("/index.html")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/index.html").await;
        assert_eq!(
            resp.status(),
            StatusCode::OK,
            "first GET should return 200, got {}",
            resp.status()
        );
        // Cache-Control must be attached on 200 (sanity for serve_via_serve_dir).
        assert!(
            resp.headers().contains_key(http::header::CACHE_CONTROL),
            "200 response missing Cache-Control"
        );
        let etag = resp
            .headers()
            .get(http::header::ETAG)
            .expect("ServeDir must emit ETag on 200 for If-None-Match coverage")
            .clone();
        let last_modified = resp
            .headers()
            .get(http::header::LAST_MODIFIED)
            .expect("ServeDir must emit Last-Modified on 200 for If-Modified-Since coverage")
            .clone();
        // Consume the body so the response is fully drained.
        let _ = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();

        // 2nd request: If-None-Match with the captured ETag → 304.
        // Unconditional: ETag presence is required (asserted above) so this
        // sub-test cannot silently skip on a ServeDir etag_method change.
        let req = Request::builder()
            .method("GET")
            .uri("/index.html")
            .header(http::header::IF_NONE_MATCH, etag.clone())
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/index.html").await;
        assert_eq!(
            resp.status(),
            StatusCode::NOT_MODIFIED,
            "If-None-Match with matching ETag should return 304, got {}",
            resp.status()
        );
        // RFC 7232 §4.1: 304 SHOULD include Cache-Control (the serve_via_serve_dir fix).
        assert!(
            resp.headers().contains_key(http::header::CACHE_CONTROL),
            "304 (If-None-Match) missing Cache-Control"
        );
        // RFC 7232 §4.1: 304 SHOULD carry the validators forward. Assert the
        // response parts rebuild in serve_via_serve_dir preserves them.
        assert_eq!(
            resp.headers().get(http::header::ETAG),
            Some(&etag),
            "304 (If-None-Match) must echo the ETag validator"
        );
        assert_eq!(
            resp.headers().get(http::header::LAST_MODIFIED),
            Some(&last_modified),
            "304 (If-None-Match) must carry Last-Modified"
        );

        // 3rd request: If-Modified-Since with the captured Last-Modified → 304.
        let req = Request::builder()
            .method("GET")
            .uri("/index.html")
            .header(http::header::IF_MODIFIED_SINCE, last_modified.clone())
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/index.html").await;
        assert_eq!(
            resp.status(),
            StatusCode::NOT_MODIFIED,
            "If-Modified-Since with matching timestamp should return 304, got {}",
            resp.status()
        );
        assert!(
            resp.headers().contains_key(http::header::CACHE_CONTROL),
            "304 (If-Modified-Since) missing Cache-Control"
        );
        assert_eq!(
            resp.headers().get(http::header::ETAG),
            Some(&etag),
            "304 (If-Modified-Since) must carry the ETag validator"
        );
        assert_eq!(
            resp.headers().get(http::header::LAST_MODIFIED),
            Some(&last_modified),
            "304 (If-Modified-Since) must echo Last-Modified"
        );

        // Negative control: a PAST If-Modified-Since (before the file's mtime)
        // MUST return 200 — proving the 304 path is validator-aware, not a
        // blanket "always 304" regression. A future date would correctly yield
        // 304 since the file's mtime precedes it; that is RFC-correct 304
        // behaviour, not a negative control.
        let req = Request::builder()
            .method("GET")
            .uri("/index.html")
            .header(
                http::header::IF_MODIFIED_SINCE,
                "Wed, 21 Oct 2000 07:28:00 GMT",
            )
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/index.html").await;
        assert_eq!(
            resp.status(),
            StatusCode::OK,
            "past If-Modified-Since should return 200 (file modified after it), got {}",
            resp.status()
        );

        // Cleanup
        std::fs::remove_dir_all(&temp_dir).ok();
    }

    #[tokio::test]
    async fn test_conditional_get_returns_304_static_mode() {
        run_conditional_get_returns_304(MountMode::Static).await;
    }

    #[tokio::test]
    async fn test_conditional_get_returns_304_spa_mode() {
        run_conditional_get_returns_304(MountMode::Spa).await;
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn test_error_page_mapping_serves_custom_404() {
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();

        let temp_dir = std::env::temp_dir().join(format!("http_error_test_{}", std::process::id()));
        let errors_dir = temp_dir.join("errors");
        std::fs::create_dir_all(&errors_dir).unwrap();
        std::fs::write(temp_dir.join("index.html"), "<h1>Home</h1>").unwrap();
        std::fs::write(errors_dir.join("404.html"), "<h1>Custom 404</h1>").unwrap();

        let canonical_dir = std::fs::canonicalize(&temp_dir).unwrap();
        let canonical_404 = std::fs::canonicalize(errors_dir.join("404.html")).unwrap();

        let registry = make_test_registry();
        let serve_dir = ServeDir::new(&canonical_dir)
            .precompressed_gzip()
            .precompressed_br()
            .append_index_html_on_directories(true);

        let mut error_pages = std::collections::HashMap::new();
        error_pages.insert(404, canonical_404);

        let mount = StaticMount {
            mount_path: "/".to_string(),
            mode: MountMode::Static,
            dir: canonical_dir.clone(),
            cache_control: "public, max-age=0".to_string(),
            error_pages,
            serve_dir,
        };
        registry.register_static_mount(mount).await.unwrap();

        let state = make_test_state(registry);

        // Request non-existent file → custom 404 page
        let req = Request::builder()
            .method("GET")
            .uri("/missing.html")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/missing.html").await;
        assert_eq!(resp.status(), StatusCode::NOT_FOUND);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"<h1>Custom 404</h1>");

        // Existing file still works
        let req = Request::builder()
            .method("GET")
            .uri("/index.html")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/index.html").await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"<h1>Home</h1>");

        // Cleanup
        std::fs::remove_dir_all(&temp_dir).ok();
    }

    #[tokio::test]
    async fn http_consumer_returns_body_and_code_on_stop() {
        use camel_api::{Body, BoxProcessor, BoxProcessorExt, Exchange, Message};
        use camel_core::route::{CompiledStep, PipelineRuntimeCtx, compose_pipeline_with_handler};
        use tower::ServiceExt;

        // Pipeline: set_body("nope") + set CamelHttpResponseCode=409 + Stop.
        let set_body_step = CompiledStep::Process {
            kind_hint: camel_api::SpanKindHint::Internal,
            processor: BoxProcessor::from_fn(|mut ex: Exchange| {
                ex.input.body = Body::Text("nope".into());
                Box::pin(async move { Ok(ex) })
            }),
            body_contract: None,
            lifecycle: None,
            label: None,
            to_uri: None,
        };
        let set_status_step = CompiledStep::Process {
            kind_hint: camel_api::SpanKindHint::Internal,
            processor: BoxProcessor::from_fn(|mut ex: Exchange| {
                ex.input.set_header(
                    "CamelHttpResponseCode",
                    serde_json::Value::Number(409.into()),
                );
                Box::pin(async move { Ok(ex) })
            }),
            body_contract: None,
            lifecycle: None,
            label: None,
            to_uri: None,
        };
        let pipeline = compose_pipeline_with_handler(
            vec![set_body_step, set_status_step, CompiledStep::Stop],
            None,
            PipelineRuntimeCtx::compile_time(),
        );

        let ex = Exchange::new(Message::default());
        let result = pipeline.oneshot(ex).await;
        assert!(result.is_ok(), "Stop must arrive as Ok (Bug B fix)");
        let returned = result.unwrap();
        assert_eq!(returned.input.body.as_text(), Some("nope"));
        assert_eq!(
            returned
                .input
                .header("CamelHttpResponseCode")
                .and_then(|v| v.as_u64()),
            Some(409)
        );
    }

    #[tokio::test]
    async fn http_consumer_returns_200_when_body_empty_on_stop() {
        // After ADR-0024: Stop with no body + no status header produces 200 (same as
        // a normal completion with no body). The 204 default is gone — users who
        // want 204 set CamelHttpResponseCode=204 explicitly.
        //
        // This test stays at the pipeline level (consistent with the test above).
        // E2E coverage of the full HTTP dispatch path is in
        // crates/camel-test/tests/integration_test.rs.
        use camel_api::{Exchange, Message};
        use camel_core::route::{CompiledStep, PipelineRuntimeCtx, compose_pipeline_with_handler};
        use tower::ServiceExt;

        let pipeline = compose_pipeline_with_handler(
            vec![CompiledStep::Stop],
            None,
            PipelineRuntimeCtx::compile_time(),
        );
        let ex = Exchange::new(Message::default());
        let result = pipeline.oneshot(ex).await;
        assert!(result.is_ok(), "Stop with empty body arrives as Ok");
        // Body is default (empty); no CamelHttpResponseCode header was set.
        // The HTTP reply finaliser (tested at E2E) maps this to status=200 + empty body.
    }

    // -----------------------------------------------------------------------
    // Task 5: Method-aware REST dispatch tests
    // -----------------------------------------------------------------------

    /// Spins up an axum server on a free port with a fresh registry.
    /// Returns the port plus the registry so the caller can register
    /// REST endpoints directly.
    async fn spawn_test_server() -> (u16, HttpRouteRegistry) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        let registry = HttpRouteRegistry::new();
        tokio::spawn(run_axum_server(
            listener,
            registry.clone(),
            2 * 1024 * 1024,
            10 * 1024 * 1024,
            Arc::new(tokio::sync::Semaphore::new(1024)),
            test_rt(),
            "test-route".into(),
        ));
        // Give the server a moment to start accepting.
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
        (port, registry)
    }

    /// Helper for REST integration tests: spawns a responder task that
    /// reads from `rx`, writes a fixed `(status, body)` back via the
    /// envelope's reply channel, and returns once the test request is
    /// satisfied.
    fn spawn_responder(
        mut rx: tokio::sync::mpsc::Receiver<RequestEnvelope>,
        status: u16,
        body: String,
    ) -> tokio::task::JoinHandle<()> {
        tokio::spawn(async move {
            // Per-iteration deadline (lintwiden D4.2): the recv wait is
            // bounded; a stall panics the task (surfaced at the join)
            // instead of parking it. Channel close still ends silently.
            match tokio::time::timeout(Duration::from_secs(10), rx.recv()).await {
                Ok(Some(envelope)) => {
                    let _ = envelope.reply_tx.send(HttpReply {
                        status,
                        headers: vec![],
                        body: HttpReplyBody::Bytes(bytes::Bytes::from(body)),
                    });
                }
                Ok(None) => {}
                Err(_) => panic!("spawn_responder: no request arrived within 10s"),
            }
        })
    }

    #[tokio::test]
    async fn method_aware_dispatch_same_path_different_verbs() {
        let (port, registry) = spawn_test_server().await;

        // Register two REST endpoints on the same path with different
        // methods. This is the core scenario REST DSL needs to support:
        // GET /users (list) and POST /users (create) must not overwrite
        // each other.
        let (get_tx, get_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "GET".into(),
                vec![PathSegment::Literal("users".into())],
                get_tx,
            )
            .await;

        let (post_tx, post_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "POST".into(),
                vec![PathSegment::Literal("users".into())],
                post_tx,
            )
            .await;

        let get_handle = spawn_responder(get_rx, 200, "list".into());
        let post_handle = spawn_responder(post_rx, 201, "create".into());

        let client = plain_http_test_client();

        // GET /users → list route
        let resp = client
            .get(format!("http://127.0.0.1:{port}/users"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "list");

        // POST /users → create route
        let resp = client
            .post(format!("http://127.0.0.1:{port}/users"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 201);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "create");

        let (get_joined, post_joined) = tokio::join!(get_handle, post_handle);
        get_joined.expect("get responder task must not stall");
        post_joined.expect("post responder task must not stall");
    }

    #[tokio::test]
    async fn method_aware_dispatch_templated_path_extracts_params() {
        let (port, registry) = spawn_test_server().await;

        // Register GET /users/{id} as a templated endpoint. The
        // dispatcher should match `/users/42` against the template and
        // attach `id=42` to the envelope's path_params.
        let (tx, mut rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "GET".into(),
                vec![
                    PathSegment::Literal("users".into()),
                    PathSegment::Param("id".into()),
                ],
                tx,
            )
            .await;

        // Spawn a responder that echoes the captured id back in the body
        // so the test can verify the param was set.
        let handle = tokio::spawn(async move {
            match tokio::time::timeout(Duration::from_secs(2), rx.recv()).await {
                Ok(Some(envelope)) => {
                    let id = envelope.path_params.get("id").cloned().unwrap_or_default();
                    let _ = envelope.reply_tx.send(HttpReply {
                        status: 200,
                        headers: vec![],
                        body: HttpReplyBody::Bytes(bytes::Bytes::from(format!("id={id}"))),
                    });
                }
                // Channel closed: task ends as today.
                Ok(None) => {}
                // Stalled: responder ends.
                Err(_) => {}
            }
        });

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/users/42"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "id=42");

        let _ = handle.await;
    }

    #[tokio::test]
    async fn method_aware_dispatch_unmatched_method_falls_through() {
        // If no REST endpoint matches the method, dispatch must fall
        // through to the legacy api_routes lookup or static mounts. With
        // nothing else registered, the request gets 404 from static
        // dispatch.
        let (port, _registry) = spawn_test_server().await;

        // Register only GET /users; a DELETE /users request has no match.
        let (get_tx, get_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        _registry
            .register_rest_endpoint(
                "GET".into(),
                vec![PathSegment::Literal("users".into())],
                get_tx,
            )
            .await;

        // Drain the GET channel in the background so the consumer side
        // doesn't block (we don't expect any envelopes here).
        let drain = tokio::spawn(async move {
            let mut get_rx = get_rx;
            loop {
                match tokio::time::timeout(Duration::from_secs(2), get_rx.recv()).await {
                    Ok(Some(_)) => continue,
                    Ok(None) => break, // closed: drain complete
                    Err(_) => break,   // stalled: drainer ends
                }
            }
        });

        let client = plain_http_test_client();
        let resp = client
            .delete(format!("http://127.0.0.1:{port}/users"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 404);

        drop(drain);
    }

    #[tokio::test]
    async fn regression_legacy_exact_api_route_still_works() {
        // A `http:` route registered without an `httpMethod=` URI param
        // lands in the legacy api_routes registry. The dispatcher must
        // still find it via exact path lookup. This guards against
        // regressions introduced by the new REST-aware dispatch.
        let (port, registry) = spawn_test_server().await;

        let (tx, mut rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry.register_api_route("/legacy/path".into(), tx).await;

        let handle = tokio::spawn(async move {
            match tokio::time::timeout(Duration::from_secs(2), rx.recv()).await {
                Ok(Some(envelope)) => {
                    let _ = envelope.reply_tx.send(HttpReply {
                        status: 200,
                        headers: vec![],
                        body: HttpReplyBody::Bytes(bytes::Bytes::from("legacy ok")),
                    });
                }
                // Channel closed: task ends as today.
                Ok(None) => {}
                // Stalled: responder ends.
                Err(_) => {}
            }
        });

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/legacy/path"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "legacy ok");

        let _ = handle.await;
    }

    #[allow(clippy::await_holding_lock)]
    #[tokio::test]
    async fn regression_static_mount_still_works() {
        // Verify that static file serving still works after the
        // dispatch refactor. We register a temp-dir mount and request
        // a file from it; the static dispatcher should serve it.
        let _guard = lock_registry_test_mutex();
        ServerRegistry::reset();

        let temp_dir = std::env::temp_dir().join(format!("http_regress_{}", std::process::id()));
        std::fs::create_dir_all(&temp_dir).unwrap();
        std::fs::write(temp_dir.join("regress.txt"), "static works").unwrap();
        let canonical_dir = std::fs::canonicalize(&temp_dir).unwrap();

        let registry = make_test_registry();
        let serve_dir = ServeDir::new(&canonical_dir)
            .precompressed_gzip()
            .precompressed_br()
            .append_index_html_on_directories(true);
        let mount = StaticMount {
            mount_path: "/".to_string(),
            mode: MountMode::Static,
            dir: canonical_dir.clone(),
            cache_control: "public, max-age=3600".to_string(),
            error_pages: std::collections::HashMap::new(),
            serve_dir,
        };
        registry.register_static_mount(mount).await.unwrap();

        let state = make_test_state(registry);
        let req = Request::builder()
            .uri("/regress.txt")
            .body(AxumBody::empty())
            .unwrap();
        let resp = static_dispatch::dispatch_static(&state, req, "/regress.txt").await;
        assert_eq!(resp.status(), StatusCode::OK);
        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
            .await
            .unwrap();
        assert_eq!(&body[..], b"static works");

        std::fs::remove_dir_all(&temp_dir).ok();
    }

    // -----------------------------------------------------------------------
    // Review I4: dispatch-layer regression coverage for C1/C2/C3 + the
    // templated from-URI round-trip. These exercise the real axum dispatch
    // path (register → HTTP request → reply) so a regression in any of the
    // three critical fixes surfaces as a test failure rather than a silent
    // production 404/500.
    // -----------------------------------------------------------------------

    #[tokio::test]
    async fn deregister_one_method_keeps_sibling_verbs() {
        // Review C1: stopping the GET /users consumer must NOT tear down the
        // live POST /users endpoint. Register both, deregister GET only,
        // then verify POST still dispatches.
        let (port, registry) = spawn_test_server().await;

        let (get_tx, get_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "GET".into(),
                vec![PathSegment::Literal("users".into())],
                get_tx,
            )
            .await;

        let (post_tx, post_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "POST".into(),
                vec![PathSegment::Literal("users".into())],
                post_tx,
            )
            .await;

        // Drain GET in the background (no requests expected after deregister).
        let drain = tokio::spawn(async move {
            let mut get_rx = get_rx;
            loop {
                match tokio::time::timeout(Duration::from_secs(2), get_rx.recv()).await {
                    Ok(Some(_)) => continue,
                    Ok(None) => break, // closed: drain complete
                    Err(_) => break,   // stalled: drainer ends
                }
            }
        });

        // Deregister ONLY the GET endpoint — the C1 bug used to drop POST too.
        registry.unregister_rest_endpoint("GET", "/users").await;
        drop(drain);

        let post_handle = spawn_responder(post_rx, 201, "create".into());

        let client = plain_http_test_client();
        // POST /users must still reach its consumer after GET was removed.
        let resp = client
            .post(format!("http://127.0.0.1:{port}/users"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 201);
        assert_eq!(resp.text().await.unwrap(), "create");

        post_handle
            .await
            .expect("post responder task must not stall");
    }

    #[tokio::test]
    async fn dispatch_exact_legacy_beats_rest_template() {
        // Review C2: an exact legacy API route (`GET /api/users`, no
        // httpMethod) must win over a templated REST route
        // (`GET /api/{resource}`) for the request `/api/users`, per spec
        // §7.2 / ADR-0009 precedence (exact → templated → static → SPA).
        let (port, registry) = spawn_test_server().await;

        // Exact legacy route.
        let (exact_tx, exact_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_api_route("/api/users".into(), exact_tx)
            .await;
        let exact_handle = spawn_responder(exact_rx, 200, "exact".into());

        // Templated REST route that would ALSO match /api/users.
        let (tpl_tx, tpl_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "GET".into(),
                vec![
                    PathSegment::Literal("api".into()),
                    PathSegment::Param("resource".into()),
                ],
                tpl_tx,
            )
            .await;
        // The templated handler must NOT receive the /api/users request. If
        // it does, it replies "template-leak" so a future assertion could
        // catch it. We do NOT await this task: the exact-match branch wins
        // and the templated channel never receives, so awaiting would block
        // until the test runtime tears down.
        let _tpl_drain = tokio::spawn(async move {
            let mut tpl_rx = tpl_rx;
            match tokio::time::timeout(Duration::from_secs(2), tpl_rx.recv()).await {
                Ok(Some(env)) => {
                    let _ = env.reply_tx.send(HttpReply {
                        status: 200,
                        headers: vec![],
                        body: HttpReplyBody::Bytes(bytes::Bytes::from("template-leak")),
                    });
                }
                // Channel closed: task ends as today.
                Ok(None) => {}
                // Stalled: responder ends.
                Err(_) => {}
            }
        });

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/api/users"))
            .send()
            .await
            .unwrap();
        assert_eq!(resp.status().as_u16(), 200);
        // Exact-match handler answered — not the templated one.
        assert_eq!(resp.text().await.unwrap(), "exact");

        exact_handle
            .await
            .expect("exact responder task must not stall");
    }

    #[tokio::test]
    async fn ambiguous_rest_templates_return_500_not_silent_404() {
        // Review C3: two equal-specificity templates that both match one
        // request are an ambiguous registration. At runtime this must
        // surface as a loud 500 (with a warn! log), NOT a silent fall-through
        // to 404. Compile-time rejection is covered in camel-dsl rest tests.
        let (port, registry) = spawn_test_server().await;

        let (a_tx, _a_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "GET".into(),
                vec![
                    PathSegment::Literal("users".into()),
                    PathSegment::Param("id".into()),
                ],
                a_tx,
            )
            .await;

        let (b_tx, _b_rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry
            .register_rest_endpoint(
                "GET".into(),
                vec![
                    PathSegment::Literal("users".into()),
                    PathSegment::Param("name".into()),
                ],
                b_tx,
            )
            .await;

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/users/42"))
            .send()
            .await
            .unwrap();
        // Ambiguous → 500 (previously a silent 404).
        assert_eq!(resp.status().as_u16(), 500);
    }

    #[test]
    fn from_uri_round_trips_templated_path_with_http_method() {
        // Review I4: a REST-lowered from-URI like
        // `http://0.0.0.0:8080/users/{id}?httpMethod=GET` must round-trip
        // through HttpServerConfig::from_uri, preserving the templated path
        // and the (uppercased) method. This is the binding the DSL lowering
        // emits and the consumer reads; it was previously unasserted.
        use crate::UriConfig;
        let cfg =
            HttpServerConfig::from_uri("http://0.0.0.0:8080/users/{id}?httpMethod=GET").unwrap();
        assert_eq!(cfg.host, "0.0.0.0");
        assert_eq!(cfg.port, 8080);
        assert_eq!(cfg.path, "/users/{id}");
        assert_eq!(cfg.method.as_deref(), Some("GET"));

        // Lower-case httpMethod is uppercased (review I5).
        let cfg_lc =
            HttpServerConfig::from_uri("http://0.0.0.0:8080/orders?httpMethod=post").unwrap();
        assert_eq!(cfg_lc.method.as_deref(), Some("POST"));
        assert_eq!(cfg_lc.path, "/orders");
    }

    // -----------------------------------------------------------------------
    // rc-1dk4: TypeConversionFailed → 400 Bad Request
    // -----------------------------------------------------------------------

    #[test]
    fn type_conversion_failed_maps_to_400() {
        let reply = pipeline_error_to_reply(
            CamelError::TypeConversionFailed("invalid JSON at line 1".to_string()),
            "/api/users",
        );
        assert_eq!(reply.status, 400);
        // Exactly one Content-Type header, application/json
        let json_ct = reply
            .headers
            .iter()
            .filter(|(k, v)| k == "Content-Type" && v == "application/json")
            .count();
        assert_eq!(json_ct, 1);
        // Body must be structured error JSON with the expected fields
        let body = match &reply.body {
            HttpReplyBody::Bytes(b) => String::from_utf8_lossy(b).to_string(),
            _ => panic!("expected bytes body"),
        };
        let parsed: serde_json::Value =
            serde_json::from_str(&body).expect("body must be valid JSON");
        assert_eq!(parsed["error"], "bad_request");
        assert_eq!(parsed["message"], "invalid JSON at line 1");
    }

    #[test]
    fn other_error_still_maps_to_500() {
        let reply =
            pipeline_error_to_reply(CamelError::RouteError("boom".to_string()), "/api/users");
        assert_eq!(reply.status, 500);
    }

    #[test]
    fn unauthenticated_maps_to_401() {
        let reply = pipeline_error_to_reply(
            CamelError::Unauthenticated("no token".to_string()),
            "/api/users",
        );
        assert_eq!(reply.status, 401);
    }

    #[test]
    fn unauthorized_maps_to_403() {
        let reply = pipeline_error_to_reply(
            CamelError::Unauthorized("forbidden".to_string()),
            "/api/users",
        );
        assert_eq!(reply.status, 403);
    }

    #[test]
    fn validation_error_maps_to_400() {
        let reply = pipeline_error_to_reply(
            CamelError::ValidationError("body does not match schema".to_string()),
            "/api/users",
        );
        assert_eq!(reply.status, 400);
        let json_ct = reply
            .headers
            .iter()
            .filter(|(k, v)| k == "Content-Type" && v == "application/json")
            .count();
        assert_eq!(json_ct, 1);
        let body = match &reply.body {
            HttpReplyBody::Bytes(b) => String::from_utf8_lossy(b).to_string(),
            _ => panic!("expected bytes body"),
        };
        let parsed: serde_json::Value =
            serde_json::from_str(&body).expect("body must be valid JSON");
        assert_eq!(parsed["error"], "validation_error");
        assert_eq!(parsed["message"], "body does not match schema");
    }

    // -----------------------------------------------------------------------
    // rc-hlb1q: media negotiation errors → 415 / 406
    // -----------------------------------------------------------------------

    #[test]
    fn finalizer_maps_unsupported_media_type() {
        let reply = pipeline_error_to_reply(
            CamelError::UnsupportedMediaType {
                consumed: "text/plain".to_string(),
                declared: "application/json".to_string(),
            },
            "/x",
        );
        assert_eq!(reply.status, 415);
        let json_ct = reply
            .headers
            .iter()
            .filter(|(k, v)| k == "Content-Type" && v == "application/json")
            .count();
        assert_eq!(json_ct, 1);
        let body = match &reply.body {
            HttpReplyBody::Bytes(b) => String::from_utf8_lossy(b).to_string(),
            _ => panic!("expected bytes body"),
        };
        let parsed: serde_json::Value =
            serde_json::from_str(&body).expect("body must be valid JSON");
        assert_eq!(parsed["error"], "unsupported_media_type");
        assert_eq!(
            parsed["message"],
            "consumed text/plain, declared application/json"
        );
    }

    #[test]
    fn finalizer_maps_not_acceptable() {
        let reply = pipeline_error_to_reply(
            CamelError::NotAcceptable {
                accept: "application/xml".to_string(),
                produced: "application/json".to_string(),
            },
            "/x",
        );
        assert_eq!(reply.status, 406);
        let json_ct = reply
            .headers
            .iter()
            .filter(|(k, v)| k == "Content-Type" && v == "application/json")
            .count();
        assert_eq!(json_ct, 1);
        let body = match &reply.body {
            HttpReplyBody::Bytes(b) => String::from_utf8_lossy(b).to_string(),
            _ => panic!("expected bytes body"),
        };
        let parsed: serde_json::Value =
            serde_json::from_str(&body).expect("body must be valid JSON");
        assert_eq!(parsed["error"], "not_acceptable");
        assert_eq!(
            parsed["message"],
            "accept application/xml, produced application/json"
        );
    }

    #[test]
    fn json_error_reply_preserves_empty_message() {
        let reply = json_error_reply(400, "bad_request", "".to_string());
        assert_eq!(reply.status, 400);
        let json_ct = reply
            .headers
            .iter()
            .filter(|(k, v)| k == "Content-Type" && v == "application/json")
            .count();
        assert_eq!(json_ct, 1);
        let body = match &reply.body {
            HttpReplyBody::Bytes(b) => String::from_utf8_lossy(b).to_string(),
            _ => panic!("expected bytes body"),
        };
        let parsed: serde_json::Value =
            serde_json::from_str(&body).expect("body must be valid JSON");
        assert_eq!(parsed["error"], "bad_request");
        assert_eq!(parsed["message"], "");
    }

    #[test]
    fn https_consumer_without_tls_cert_errors() {
        let endpoint = HttpEndpoint {
            uri: "https://0.0.0.0:8443/api".to_string(),
            config: HttpEndpointConfig::from_uri("https://0.0.0.0:8443/api").unwrap(),
            server_config: HttpServerConfig::from_uri("https://0.0.0.0:8443/api").unwrap(),
            client: plain_http_test_client(),
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            http_config: HttpConfig::default(),
        };
        let rt: Arc<dyn RuntimeObservability> = Arc::new(NoopRuntimeObservability);
        let result = endpoint.create_consumer(rt);
        assert!(result.is_err(), "expected error for https without tls cert");
        if let Err(e) = result {
            let msg = e.to_string();
            assert!(msg.contains("tlsCert"), "error must mention tlsCert: {msg}");
        }
    }

    #[test]
    fn http_consumer_with_tls_config_errors() {
        let endpoint = HttpEndpoint {
            uri: "http://0.0.0.0:8080/api".to_string(),
            config: HttpEndpointConfig::from_uri("http://0.0.0.0:8080/api").unwrap(),
            server_config: HttpServerConfig::from_uri(
                "http://0.0.0.0:8080/api?tlsCert=/x.pem&tlsKey=/y.pem",
            )
            .unwrap(),
            client: plain_http_test_client(),
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            http_config: HttpConfig::default(),
        };
        let rt: Arc<dyn RuntimeObservability> = Arc::new(NoopRuntimeObservability);
        let result = endpoint.create_consumer(rt);
        assert!(result.is_err(), "expected error for http with tls config");
        if let Err(e) = result {
            let msg = e.to_string();
            assert!(msg.contains("https"), "error must mention https: {msg}");
        }
    }

    #[test]
    fn https_consumer_with_partial_tls_cert_only_errors() {
        // tlsCert without tlsKey → tls_config is None at parse time
        // → create_consumer sees https:// + no TLS → must error
        let server_config =
            HttpServerConfig::from_uri("https://0.0.0.0:8443/api?tlsCert=/x.pem").unwrap();
        assert!(
            server_config.tls_config.is_none(),
            "partial tlsCert must not create ServerTlsConfig"
        );
        let endpoint = HttpEndpoint {
            uri: "https://0.0.0.0:8443/api?tlsCert=/x.pem".to_string(),
            config: HttpEndpointConfig::from_uri("https://0.0.0.0:8443/api?tlsCert=/x.pem")
                .unwrap(),
            server_config,
            client: plain_http_test_client(),
            pinned_cache: std::sync::Arc::new(PinnedClientCache::new(
                PINNED_CLIENT_TTL,
                PINNED_CLIENT_MAX_ENTRIES,
            )),
            http_config: HttpConfig::default(),
        };
        let rt: Arc<dyn RuntimeObservability> = Arc::new(NoopRuntimeObservability);
        let result = endpoint.create_consumer(rt);
        assert!(
            result.is_err(),
            "must error: https:// requires both tlsCert and tlsKey"
        );
    }

    #[test]
    fn load_tls_config_parses_valid_pem() {
        // Install rustls crypto provider (aws-lc-rs — matches reqwest/hyper-rustls tree)
        let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();
        use camel_component_api::test_support::tls;
        let (_, cert_pem, key_pem) = tls::gen_server_cert();
        let cert_path = tls::write_pem_tmp("http-load-cert.pem", &cert_pem);
        let key_path = tls::write_pem_tmp("http-load-key.pem", &key_pem);

        let config = load_tls_config(cert_path.to_str().unwrap(), key_path.to_str().unwrap());
        assert!(config.is_ok(), "must parse valid PEM: {:?}", config.err());
    }

    #[tokio::test(flavor = "multi_thread")]
    #[allow(clippy::await_holding_lock)]
    async fn consumer_tls_handshake_roundtrip() {
        use camel_component_api::test_support::tls;
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        // Install rustls crypto provider (aws-lc-rs)
        let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();

        // Serialize against global ServerRegistry singleton
        let _guard = lock_registry_test_mutex();

        // Generate CA + server cert
        let (ca_pem, cert_pem, key_pem) = tls::gen_server_cert();
        let cert_path = tls::write_pem_tmp("http-tls-handshake-cert.pem", &cert_pem);
        let key_path = tls::write_pem_tmp("http-tls-handshake-key.pem", &key_pem);
        let ca_path = tls::write_pem_tmp("http-tls-handshake-ca.pem", &ca_pem);

        // Get ephemeral port
        let probe = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = probe.local_addr().unwrap().port();
        drop(probe);

        ServerRegistry::reset();

        // Create real HttpComponent + endpoint with TLS URI
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let uri = format!(
            "https://127.0.0.1:{port}/test?tlsCert={}&tlsKey={}",
            cert_path.to_string_lossy(),
            key_path.to_string_lossy(),
        );
        let endpoint = component
            .create_endpoint(&uri, &endpoint_ctx)
            .expect("create TLS endpoint");
        let mut consumer = endpoint.create_consumer(rt()).expect("create consumer");

        // Start consumer — this calls get_or_spawn with tls_config
        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "tls-handshake-test".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });

        // Give server time to start
        tokio::time::sleep(std::time::Duration::from_millis(100)).await;

        // Client with CA cert — REAL verification (no danger_accept_invalid)
        let ca_bytes = std::fs::read(&ca_path).unwrap();
        let client = reqwest::Client::builder()
            .add_root_certificate(reqwest::Certificate::from_pem(&ca_bytes).unwrap())
            .build()
            .unwrap();

        let send_fut = client
            .post(format!("https://localhost:{port}/test"))
            .body("ping")
            .send();

        // Handler: receive envelope, reply 200 with "pong" body
        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope.exchange.input.body = camel_component_api::Body::Text("pong".to_string());
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.expect("TLS handshake + request must succeed");

        assert_eq!(resp.status().as_u16(), 200, "must get 200 through TLS");
        let body = resp.text().await.unwrap();
        assert_eq!(body, "pong");

        token.cancel();
    }

    #[tokio::test(flavor = "multi_thread")]
    #[allow(clippy::await_holding_lock)]
    async fn consumer_tls_rejects_client_without_ca() {
        use camel_component_api::test_support::tls;
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();

        // Serialize against global ServerRegistry singleton
        let _guard = lock_registry_test_mutex();

        let (_, cert_pem, key_pem) = tls::gen_server_cert();
        let cert_path = tls::write_pem_tmp("http-neg-cert.pem", &cert_pem);
        let key_path = tls::write_pem_tmp("http-neg-key.pem", &key_pem);

        let probe = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = probe.local_addr().unwrap().port();
        drop(probe);

        ServerRegistry::reset();

        // Spawn TLS server via real HttpComponent path
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let uri = format!(
            "https://127.0.0.1:{port}/test?tlsCert={}&tlsKey={}",
            cert_path.to_string_lossy(),
            key_path.to_string_lossy(),
        );
        let endpoint = component.create_endpoint(&uri, &endpoint_ctx).unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();
        let (tx, _rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "tls-neg-test".to_string());
        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });

        tokio::time::sleep(std::time::Duration::from_millis(100)).await;

        // Client WITHOUT CA cert — must fail TLS verification
        let client = plain_http_test_client();

        let result = client
            .get(format!("https://localhost:{port}/test"))
            .send()
            .await;

        assert!(
            result.is_err(),
            "must reject without CA — proves real verification"
        );

        token.cancel();
    }

    #[test]
    fn server_config_partial_tls_cert_without_key() {
        // Parse URI with only tlsCert (no tlsKey)
        let cfg = HttpServerConfig::from_uri("https://0.0.0.0:8443/api?tlsCert=/x.pem").unwrap();
        // Partial params → tls_config must be None
        assert!(cfg.tls_config.is_none());
    }

    #[test]
    fn endpoint_uri_options_count_parity() {
        // Mirror struct must stay in sync with bespoke from_components parser.
        assert_eq!(
            HttpEndpointConfig::uri_options().len(),
            23,
            "HttpEndpointUriConfig #[uri_param] count drifted from parser"
        );
    }

    fn make_headers(pairs: &[(&str, &str)]) -> HashMap<String, serde_json::Value> {
        pairs
            .iter()
            .map(|(k, v)| {
                (
                    (*k).to_string(),
                    serde_json::Value::String((*v).to_string()),
                )
            })
            .collect()
    }

    #[test]
    fn response_emits_cache_control_via_pragma_warning() {
        let headers = make_headers(&[
            ("Cache-Control", "public, max-age=3600"),
            ("Via", "1.1 myproxy"),
            ("Pragma", "no-cache"),
            ("Warning", "199 misc"),
        ]);
        let selected = select_response_headers(&headers, None, None);
        let names: Vec<&str> = selected.iter().map(|(k, _)| k.as_str()).collect();
        for expected in ["Cache-Control", "Via", "Pragma", "Warning"] {
            assert!(
                names.contains(&expected),
                "{expected} should pass through to the response"
            );
        }
    }

    #[test]
    fn response_excludes_request_only_and_server_owned() {
        let headers = make_headers(&[
            ("User-Agent", "x"),
            ("Accept", "*/*"),
            ("Date", "Thu, 01 Jan 2026 00:00:00 GMT"),
        ]);
        let selected = select_response_headers(&headers, None, None);
        let names: Vec<&str> = selected.iter().map(|(k, _)| k.as_str()).collect();
        for excluded in ["User-Agent", "Accept", "Date"] {
            assert!(
                !names.contains(&excluded),
                "{excluded} should NOT appear in the response"
            );
        }
    }

    #[test]
    fn response_re_derives_content_type() {
        let headers = make_headers(&[("Content-Type", "text/plain")]);
        let selected = select_response_headers(&headers, Some("application/json".into()), None);
        let ct_entries: Vec<&str> = selected
            .iter()
            .filter(|(k, _)| k == "Content-Type")
            .map(|(_, v)| v.as_str())
            .collect();
        assert_eq!(
            ct_entries,
            ["application/json"],
            "exactly one Content-Type entry, re-derived from user_content_type"
        );
    }

    #[test]
    fn response_excludes_camel_headers() {
        let headers = make_headers(&[("CamelHttpPath", "/foo"), ("Cache-Control", "public")]);
        let selected = select_response_headers(&headers, None, None);
        let names: Vec<&str> = selected.iter().map(|(k, _)| k.as_str()).collect();
        assert!(
            !names.contains(&"CamelHttpPath"),
            "Camel-namespace headers must be excluded"
        );
        assert!(
            names.contains(&"Cache-Control"),
            "Cache-Control must pass through"
        );
    }

    #[test]
    fn response_stringifies_scalar_header_values() {
        let mut headers = make_headers(&[("X-Label", "keep")]);
        headers.insert("X-Retries".to_string(), serde_json::json!(3));
        headers.insert("X-Ratio".to_string(), serde_json::json!(3.5));
        headers.insert("X-Enabled".to_string(), serde_json::json!(true));
        let selected = select_response_headers(&headers, None, None);
        let get = |name: &str| -> Option<&str> {
            selected
                .iter()
                .find(|(k, _)| k == name)
                .map(|(_, v)| v.as_str())
        };
        assert_eq!(
            get("X-Retries"),
            Some("3"),
            "integer header must be stringified"
        );
        assert_eq!(
            get("X-Ratio"),
            Some("3.5"),
            "float header must be stringified"
        );
        assert_eq!(
            get("X-Enabled"),
            Some("true"),
            "bool header must be stringified"
        );
        assert_eq!(
            get("X-Label"),
            Some("keep"),
            "string header must pass through"
        );
    }

    #[test]
    fn response_drops_null_and_structured_header_values() {
        let mut headers = make_headers(&[("X-Keep", "yes")]);
        headers.insert("X-Null".to_string(), serde_json::Value::Null);
        headers.insert("X-Obj".to_string(), serde_json::json!({"a": 1}));
        headers.insert("X-Arr".to_string(), serde_json::json!([1, 2]));
        let selected = select_response_headers(&headers, None, None);
        let names: Vec<&str> = selected.iter().map(|(k, _)| k.as_str()).collect();
        for dropped in ["X-Null", "X-Obj", "X-Arr"] {
            assert!(
                !names.contains(&dropped),
                "{dropped} must not be emitted: no single-value form"
            );
        }
        assert!(names.contains(&"X-Keep"), "scalar headers must survive");
    }

    #[test]
    fn response_stringifies_scalars_despite_excluded_names() {
        // Excluded names stay excluded regardless of value type: the policy
        // filter runs before stringification, so numeric values cannot smuggle
        // content-length or server-owned headers into the reply.
        let mut headers = HashMap::new();
        headers.insert("Content-Length".to_string(), serde_json::json!(999));
        headers.insert("Date".to_string(), serde_json::json!(12345));
        let selected = select_response_headers(&headers, None, None);
        let names: Vec<&str> = selected.iter().map(|(k, _)| k.as_str()).collect();
        assert!(
            !names.contains(&"Content-Length"),
            "content-length is re-derived by the server"
        );
        assert!(!names.contains(&"Date"), "date is server-owned");
    }

    #[test]
    fn outbound_stringifies_scalar_header_values() {
        let mut headers = make_headers(&[("X-Label", "keep")]);
        headers.insert("X-Retries".to_string(), serde_json::json!(3));
        headers.insert("X-Ratio".to_string(), serde_json::json!(3.5));
        headers.insert("X-Enabled".to_string(), serde_json::json!(true));
        let outbound = select_outbound_headers(&headers, &[], &[]);
        // HeaderName construction lowercases; lookups compare case-blind.
        let get = |name: &str| -> Option<String> {
            outbound
                .accepted
                .iter()
                .find(|(k, _)| k.as_str().eq_ignore_ascii_case(name))
                .map(|(_, v)| v.to_str().unwrap().to_string())
        };
        assert_eq!(
            get("X-Retries").as_deref(),
            Some("3"),
            "integer header must be stringified"
        );
        assert_eq!(
            get("X-Ratio").as_deref(),
            Some("3.5"),
            "float header must be stringified"
        );
        assert_eq!(
            get("X-Enabled").as_deref(),
            Some("true"),
            "bool header must be stringified"
        );
        assert_eq!(
            get("X-Label").as_deref(),
            Some("keep"),
            "string header must pass through"
        );
        assert!(outbound.drops.is_empty(), "scalar headers must not drop");
    }

    #[test]
    fn outbound_drops_null_and_structured_header_values() {
        let mut headers = make_headers(&[("X-Keep", "yes")]);
        headers.insert("X-Null".to_string(), serde_json::Value::Null);
        headers.insert("X-Obj".to_string(), serde_json::json!({"a": 1}));
        headers.insert("X-Arr".to_string(), serde_json::json!([1, 2]));
        let outbound = select_outbound_headers(&headers, &[], &[]);
        let has = |name: &str| {
            outbound
                .accepted
                .iter()
                .any(|(k, _)| k.as_str().eq_ignore_ascii_case(name))
        };
        assert!(has("X-Keep"), "scalar headers must survive");
        for (name, kind) in [("X-Null", "null"), ("X-Obj", "object"), ("X-Arr", "array")] {
            let dropped = outbound
                .drops
                .iter()
                .find(|d| d.name == name)
                .unwrap_or_else(|| panic!("{name} must have a drop record: {:?}", outbound.drops));
            assert_eq!(
                dropped.reason, "no scalar string form",
                "{name} drop reason must name the value kind absence"
            );
            assert_eq!(dropped.value_kind, Some(kind), "{name} kind recorded");
        }
    }

    #[test]
    fn outbound_stringifies_scalars_despite_excluded_names() {
        // Excluded names stay excluded regardless of value type: the policy
        // filter runs before stringification, so numeric values cannot smuggle
        // hop-by-hop or client-derived headers onto the wire.
        let mut headers = HashMap::new();
        headers.insert("Transfer-Encoding".to_string(), serde_json::json!(7));
        headers.insert("Host".to_string(), serde_json::json!(12345));
        headers.insert("X-Ok".to_string(), serde_json::json!(7));
        let outbound = select_outbound_headers(&headers, &[], &[]);
        let has = |name: &str| {
            outbound
                .accepted
                .iter()
                .any(|(k, _)| k.as_str().eq_ignore_ascii_case(name))
        };
        assert!(
            !has("Transfer-Encoding"),
            "hop-by-hop header must stay excluded"
        );
        assert!(!has("Host"), "host is destination-derived");
        assert!(has("X-Ok"), "non-excluded scalar must be stringified");
        assert!(
            outbound
                .drops
                .iter()
                .any(|d| d.name == "Transfer-Encoding" && d.reason == "outbound emission policy"),
            "policy drop must be recorded before coercion"
        );
    }

    #[test]
    fn outbound_drops_invalid_names_values_and_skip_config() {
        let mut headers = make_headers(&[("X-Good", "fine")]);
        headers.insert("X Bad Name".to_string(), serde_json::json!("v"));
        headers.insert(
            "X-Control-Value".to_string(),
            serde_json::json!("line1\nline2"),
        );
        headers.insert("X-Secret".to_string(), serde_json::json!("s3cr3t"));
        headers.insert("CamelHttpQuery".to_string(), serde_json::json!("q=1"));
        let skip = vec!["x-secret".to_string()];
        let outbound = select_outbound_headers(&headers, &skip, &[]);
        let has = |name: &str| {
            outbound
                .accepted
                .iter()
                .any(|(k, _)| k.as_str().eq_ignore_ascii_case(name))
        };
        assert!(has("X-Good"), "valid header must survive");
        assert!(!has("X Bad Name"), "invalid header name must drop");
        assert!(!has("X-Control-Value"), "control-char value must drop");
        assert!(!has("X-Secret"), "skipped header must drop");
        assert!(!has("CamelHttpQuery"), "Camel-namespace header must drop");
        let reason = |n: &str| {
            outbound
                .drops
                .iter()
                .find(|d| d.name == n)
                .map(|d| d.reason)
        };
        assert_eq!(reason("X Bad Name"), Some("invalid header name"));
        assert_eq!(reason("X-Control-Value"), Some("invalid header value"));
        assert_eq!(reason("X-Secret"), Some("skip_request_headers"));
        assert_eq!(reason("CamelHttpQuery"), Some("Camel namespace"));
    }

    #[test]
    fn constructed_header_invalid_value_returns_drop_record() {
        let result = constructed_header("user-agent", "bad\r\ns3nt1nel");
        let Err(record) = result else {
            panic!("invalid value must produce a drop record");
        };
        assert_eq!(record.reason, "invalid header value");
        assert_eq!(record.name, "user-agent");
        assert!(record.value_kind.is_none());
        let debug = format!("{record:?}");
        assert!(
            !debug.contains("bad\r\n") && !debug.contains("s3nt1nel"),
            "drop record debug must not leak the value"
        );
    }

    #[test]
    fn constructed_header_invalid_name_returns_drop_record() {
        let result = constructed_header("bad name", "ok");
        let Err(record) = result else {
            panic!("invalid name must produce a drop record");
        };
        assert_eq!(record.reason, "invalid header name");
        assert_eq!(record.name, "bad name");
        let debug = format!("{record:?}");
        assert!(
            !debug.contains("ok"),
            "drop record debug must not leak the value"
        );
    }

    #[test]
    fn constructed_header_valid_pair_roundtrip() {
        let result = constructed_header("authorization", "Bearer abc123");
        let Ok((name, val)) = result else {
            panic!("valid pair must construct");
        };
        assert_eq!(name.as_str(), "authorization");
        let Ok(roundtrip) = val.to_str() else {
            panic!("valid value must roundtrip to str");
        };
        assert_eq!(roundtrip, "Bearer abc123");
    }

    // -----------------------------------------------------------------------
    // Bridge proxy end-to-end integration tests (Task 4.1)
    // Fully local + deterministic: raw TCP / in-process consumer / reqwest
    // to 127.0.0.1. No public CDN, no httpbin, no network egress.
    // -----------------------------------------------------------------------

    /// Destination server that captures the outbound request line and the
    /// `Host:` header the producer actually sent on the wire. Returns
    /// `(host_value, request_line)` so a bridge-proxy test can assert that
    /// the producer derived `Host` from the destination (not the exchange)
    /// and honoured bridging semantics for the path.
    async fn start_host_capturing_destination() -> (
        String,
        Arc<std::sync::Mutex<Option<(String, String)>>>,
        tokio::task::JoinHandle<()>,
    ) {
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        let url = format!("http://127.0.0.1:{port}");
        let captured: Arc<std::sync::Mutex<Option<(String, String)>>> =
            Arc::new(std::sync::Mutex::new(None));
        let captured_clone = Arc::clone(&captured);
        let handle = tokio::spawn(async move {
            use tokio::io::{AsyncReadExt, AsyncWriteExt};
            if let Ok((mut stream, _)) = listener.accept().await {
                let mut buf = vec![0u8; 16384];
                let n = stream.read(&mut buf).await.unwrap_or(0);
                let request = String::from_utf8_lossy(&buf[..n]).to_string();
                if request.contains("\r\n\r\n") {
                    let request_line = request.lines().next().unwrap_or("").to_string();
                    let host_value = request
                        .lines()
                        .find(|l| l.to_lowercase().starts_with("host:"))
                        .and_then(|l| l.split_once(':'))
                        .map(|(_, v)| v.trim().to_string())
                        .unwrap_or_default();
                    *captured_clone.lock().unwrap() = Some((host_value, request_line));
                }
                let body = r#"{"echo":"ok"}"#;
                let resp = format!(
                    "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
                    body.len(),
                    body
                );
                let _ = stream.write_all(resp.as_bytes()).await;
            }
        });
        (url, captured, handle)
    }

    /// A bridging producer must derive `Host` from the destination URL and
    /// ignore the exchange `CamelHttpPath`, matching Apache Camel bridging
    /// semantics. The wire-level proof is the raw `Host:` header and request
    /// line captured at the destination TCP socket.
    #[tokio::test]
    async fn bridge_proxy_outbound_host_matches_destination() {
        use tower::ServiceExt;

        let (url, captured, _handle) = start_host_capturing_destination().await;
        // The Host header reqwest derives for http://127.0.0.1:{port} is the
        // authority, scheme-stripped: "127.0.0.1:{port}".
        let expected_host = url.strip_prefix("http://").unwrap();

        let ctx = test_producer_ctx();
        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(
                &format!("{url}?bridgeEndpoint=true&allowInternal=true"),
                &endpoint_ctx,
            )
            .unwrap();
        let producer = endpoint.create_producer(rt(), &ctx).unwrap();

        // Exchange carries a stale Host and a CamelHttpPath that bridging
        // must drop.
        let mut exchange = Exchange::new(Message::default());
        exchange.input.set_header("Host", "localhost");
        exchange.input.set_header("CamelHttpPath", "/foo");

        let result = producer.oneshot(exchange).await;
        assert!(result.is_ok(), "producer call failed: {:?}", result);

        tokio::time::sleep(Duration::from_millis(100)).await;
        let (host_value, request_line) = captured
            .lock()
            .unwrap()
            .take()
            .expect("destination capture mutex empty — producer did not reach the destination");

        assert_ne!(
            host_value, "localhost",
            "bridge producer must not forward the exchange Host: localhost"
        );
        assert_eq!(
            host_value, expected_host,
            "Host must be derived from the destination authority (no scheme)"
        );
        assert!(
            !request_line.contains("/foo"),
            "bridge_endpoint must drop CamelHttpPath; request line was: {request_line}"
        );
    }

    /// A response header set by the route (`Cache-Control`) must survive to
    /// the wire. The assertion is on the reqwest HTTP response — not an
    /// in-process HttpReply struct — so it proves the consumer's reply
    /// finaliser emitted the header over the socket.
    #[tokio::test]
    async fn bridge_proxy_route_set_response_header_survives() {
        use camel_component_api::{ConsumerContext, ExchangeEnvelope};

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
        drop(listener);

        let component = HttpComponent::new();
        let endpoint_ctx = NoOpComponentContext;
        let endpoint = component
            .create_endpoint(&format!("http://127.0.0.1:{port}/cache"), &endpoint_ctx)
            .unwrap();
        let mut consumer = endpoint.create_consumer(rt()).unwrap();

        let (tx, mut rx) = tokio::sync::mpsc::channel::<ExchangeEnvelope>(16);
        let token = tokio_util::sync::CancellationToken::new();
        let ctx = ConsumerContext::new(tx, token.clone(), "http-test-route".to_string());

        tokio::spawn(async move { consumer.start(ctx).await.unwrap() });
        tokio::time::sleep(Duration::from_millis(50)).await;

        let client = plain_http_test_client();
        let send_fut = client.get(format!("http://127.0.0.1:{port}/cache")).send();

        // Route sets Cache-Control on the outbound reply (exchange.input is
        // the message the reply finaliser reads — see select_response_headers
        // at the dispatch site).
        let (http_result, _) = tokio::join!(send_fut, async {
            if let Some(mut envelope) = rx.recv().await {
                envelope
                    .exchange
                    .input
                    .set_header("Cache-Control", "public, max-age=3600");
                if let Some(reply_tx) = envelope.reply_tx {
                    let _ = reply_tx.send(Ok(envelope.exchange));
                }
            }
        });

        let resp = http_result.unwrap();
        assert_eq!(resp.status().as_u16(), 200);

        let cache_control = resp.headers().get("cache-control");
        assert!(
            cache_control.is_some(),
            "Cache-Control header must survive to the wire response"
        );
        assert_eq!(
            cache_control.unwrap().to_str().unwrap(),
            "public, max-age=3600"
        );

        token.cancel();
    }

    // -----------------------------------------------------------------------
    // credential-sources task 2.3: credential values stay out of diagnostics
    // -----------------------------------------------------------------------
    //
    // camel-http has no request access log (design.md "Redaction sinks",
    // ADR-0051). The only diagnostic sink on the failed-auth path is
    // `pipeline_error_to_reply`, which renders the (generic) error message and
    // the *configured* route path — never the request URI, query string, or
    // extracted credential. These tests pin that redact-by-construction
    // contract: a sentinel credential presented in a declared source must not
    // appear in the reply body nor in any tracing record emitted while the
    // request is handled.
    //
    // Capture scope: `#[traced_test]` installs a per-crate env filter
    // (`camel_component_http=trace`), so records from OTHER targets
    // (`camel_auth`, `camel_processor`, etc.) are NOT captured here. The
    // redaction contract for those crates is guarded by their own tests.
    // Revisit this capture scope if camel-auth ever logs on the auth path.
    use camel_api::security_policy::CredentialSource;
    use camel_auth::credential_source::extract_token_from_exchange;
    use camel_auth::native_auth::NativeCredentialStore;
    use camel_auth::{StaticTokenAuthenticator, TokenAuthenticator};

    // Sentinel credential values — test fixtures only, not real secrets.
    const SENTINEL_QRY_42: &str = "SENTINEL_QRY_42"; // allow-secret
    const SENTINEL_CKY_7: &str = "SENTINEL_CKY_7"; // allow-secret
    const SENTINEL_BAD_1: &str = "SENTINEL_BAD_1"; // allow-secret

    /// Build the exchange the consumer would build for a request envelope:
    /// standard Camel HTTP headers plus title-cased forwarded request headers.
    fn envelope_to_exchange(envelope: &RequestEnvelope) -> Exchange {
        let mut msg = Message::default();
        msg.set_header(
            "CamelHttpMethod",
            serde_json::Value::String(envelope.method.clone()),
        );
        msg.set_header(
            "CamelHttpPath",
            serde_json::Value::String(envelope.path.clone()),
        );
        msg.set_header(
            "CamelHttpQuery",
            serde_json::Value::String(envelope.query.clone()),
        );
        for (k, v) in &envelope.headers {
            if let Ok(val_str) = v.to_str() {
                msg.set_header(
                    title_case_header(k.as_str()),
                    serde_json::Value::String(val_str.to_string()),
                );
            }
        }
        Exchange::new(msg)
    }

    /// Register a route whose responder authenticates each request against an
    /// empty native store, so every presented credential fails lookup with
    /// `Unauthenticated` (401). Restores the pre-AuthContext `RolePolicy`
    /// authentication step (extract per `sources` → authenticate → deny) so the
    /// credential-extraction redaction contract is exercised on a real
    /// authentication failure.
    async fn spawn_failing_auth_route(
        registry: &HttpRouteRegistry,
        path: &str,
        sources: Vec<CredentialSource>,
    ) {
        let authenticator: Arc<dyn TokenAuthenticator> = Arc::new(StaticTokenAuthenticator::new(
            NativeCredentialStore::try_new(vec![]).unwrap(),
        ));
        let (tx, mut rx) = tokio::sync::mpsc::channel::<RequestEnvelope>(8);
        registry.register_api_route(path.to_string(), tx).await;
        let path_owned = path.to_string();
        tokio::spawn(async move {
            loop {
                // Per-iteration deadline (lintwiden D4.2): each recv
                // await is bounded; a stall panics the task instead of
                // parking it. Channel close still ends the loop.
                match tokio::time::timeout(Duration::from_secs(10), rx.recv()).await {
                    Ok(Some(envelope)) => {
                        let exchange = envelope_to_exchange(&envelope);
                        let reply_tx = envelope.reply_tx;
                        // Per-request deadline (lintwiden D4.2): a wedged
                        // authenticator must fail the request instead of
                        // pinning the route task.
                        let reply = match extract_token_from_exchange(&exchange, &sources)
                            .map(|extracted| extracted.token)
                        {
                            Some(token) => {
                                match tokio::time::timeout(
                                    Duration::from_secs(10),
                                    authenticator.authenticate_bearer(&token),
                                )
                                .await
                                {
                                    Ok(Ok(_)) => HttpReply {
                                        status: 200,
                                        headers: vec![],
                                        body: HttpReplyBody::Bytes(bytes::Bytes::from("ok")),
                                    },
                                    Ok(Err(e)) => pipeline_error_to_reply(e, &path_owned),
                                    Err(_) => pipeline_error_to_reply(
                                        CamelError::ProcessorError(
                                            "authenticator stalled beyond 10s".into(),
                                        ),
                                        &path_owned,
                                    ),
                                }
                            }
                            None => pipeline_error_to_reply(
                                CamelError::Unauthenticated("no credential in any source".into()),
                                &path_owned,
                            ),
                        };
                        let _ = reply_tx.send(reply);
                    }
                    Ok(None) => break,
                    Err(_) => {
                        panic!("spawn_failing_auth_route: no request arrived within 10s")
                    }
                }
            }
        });
    }

    /// Whether any tracing record captured so far (process-wide) contains
    /// `needle`. `#[traced_test]` installs a global subscriber writing to a
    /// shared buffer, so logs from spawned request-handling tasks are included.
    fn captured_logs_contain(needle: &str) -> bool {
        let buf = tracing_test::internal::global_buf().lock().unwrap();
        String::from_utf8_lossy(&buf).contains(needle)
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn error_context_redacts_query_sentinel() {
        let (port, registry) = spawn_test_server().await;
        spawn_failing_auth_route(
            &registry,
            "/secure-query",
            vec![CredentialSource::QueryParam {
                param: "token".to_string(),
            }],
        )
        .await;

        let client = plain_http_test_client();
        let resp = client
            // allow-secret: `token` is the declared query-source param name, not a credential
            .get(format!(
                "http://127.0.0.1:{port}/secure-query?token={SENTINEL_QRY_42}"
            ))
            .send()
            .await
            .unwrap();

        assert_eq!(resp.status().as_u16(), 401);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "Unauthorized");
        assert!(
            !body.contains(SENTINEL_QRY_42),
            "reply body must not contain the query credential"
        );
        assert!(
            !captured_logs_contain(SENTINEL_QRY_42),
            "no tracing record during request handling may render the query credential"
        );
        // Permanent positive control: the failed-auth warn! must be captured.
        // If the per-crate env filter ever stops matching, this fails loudly
        // instead of letting the sentinel assertions pass vacuously.
        assert!(
            captured_logs_contain("Authentication failed"),
            "positive control: the failed-auth warn! must be captured by the test subscriber"
        );
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn error_context_redacts_cookie_sentinel() {
        let (port, registry) = spawn_test_server().await;
        spawn_failing_auth_route(
            &registry,
            "/secure-cookie",
            vec![CredentialSource::Cookie {
                name: "session".to_string(),
            }],
        )
        .await;

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/secure-cookie"))
            .header("Cookie", format!("session={SENTINEL_CKY_7}"))
            .send()
            .await
            .unwrap();

        assert_eq!(resp.status().as_u16(), 401);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "Unauthorized");
        assert!(
            !body.contains(SENTINEL_CKY_7),
            "reply body must not contain the cookie credential"
        );
        assert!(
            !captured_logs_contain(SENTINEL_CKY_7),
            "no tracing record during request handling may render the cookie credential"
        );
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn error_reply_no_credential_value() {
        let (port, registry) = spawn_test_server().await;
        spawn_failing_auth_route(
            &registry,
            "/secure-bad",
            vec![CredentialSource::Cookie {
                name: "session".to_string(),
            }],
        )
        .await;

        let client = plain_http_test_client();
        let resp = client
            .get(format!("http://127.0.0.1:{port}/secure-bad"))
            .header("Cookie", format!("session={SENTINEL_BAD_1}"))
            .send()
            .await
            .unwrap();

        assert_eq!(resp.status().as_u16(), 401);
        let body = resp.text().await.unwrap();
        assert_eq!(body, "Unauthorized");
        assert!(
            !body.contains(SENTINEL_BAD_1),
            "reply body must not contain the credential value"
        );
        assert!(
            !captured_logs_contain(SENTINEL_BAD_1),
            "error logs must not render the credential value"
        );
    }

    // -----------------------------------------------------------------------
    // Pinned-client-cache producer-path behavioral tests
    // (openspec/changes/http-pinned-client-cache — scenarios: producers share
    // the endpoint cache, hostname requests build one client while the entry
    // stays retrievable, IP-literal requests bypass the cache)
    // -----------------------------------------------------------------------

    /// Local responder that accepts any number of HTTP/1.1 connections on an
    /// ephemeral 127.0.0.1 port and answers each with a fixed 200 response.
    /// Unlike [`start_host_capturing_destination`], which serves exactly one
    /// connection, this loop keeps accepting so cache-reuse tests can drive
    /// several requests through one destination. Returns
    /// `(base_url, JoinHandle)`.
    async fn spawn_multi_accept_200() -> (String, tokio::task::JoinHandle<()>) {
        use tokio::io::AsyncWriteExt;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
            .await
            .expect("bind ephemeral 127.0.0.1 listener");
        let port = listener.local_addr().expect("local addr").port();
        let base_url = format!("http://localhost:{port}");
        let handle = tokio::spawn(async move {
            while let Ok((mut conn, _)) = listener.accept().await {
                let _ = conn
                    .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok")
                    .await;
                let _ = conn.shutdown().await;
            }
        });
        (base_url, handle)
    }

    /// rc-0li3: local HTTPS responder — the TLS twin of
    /// [`spawn_multi_accept_200`]. Accepts any number of TLS connections on
    /// an ephemeral 127.0.0.1 port and answers each with a fixed 200. The
    /// certificate comes from `camel_component_api::test_support`
    /// (SANs: localhost, 127.0.0.1, ::1); clients run with
    /// `tls.insecure = true`.
    async fn spawn_tls_multi_accept_200() -> (String, tokio::task::JoinHandle<()>) {
        use tokio::io::AsyncWriteExt;

        let (_ca_pem, cert_pem, key_pem) =
            camel_component_api::test_support::tls::gen_server_cert();
        let certs: Vec<_> = rustls_pemfile::certs(&mut cert_pem.as_bytes())
            .collect::<Result<_, _>>()
            .expect("parse server cert pem");
        let key = rustls_pemfile::private_key(&mut key_pem.as_bytes())
            .expect("parse server key pem")
            .expect("server key present");
        // Explicit provider: the process default is ambiguous when multiple
        // crates pull rustls feature sets; the graph enables aws-lc-rs.
        let provider =
            std::sync::Arc::new(tokio_rustls::rustls::crypto::aws_lc_rs::default_provider());
        let tls_cfg = tokio_rustls::rustls::ServerConfig::builder_with_provider(provider)
            .with_safe_default_protocol_versions()
            .expect("safe default protocol versions")
            .with_no_client_auth()
            .with_single_cert(certs, key)
            .expect("build rustls server config");
        let acceptor = tokio_rustls::TlsAcceptor::from(std::sync::Arc::new(tls_cfg));

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
            .await
            .expect("bind ephemeral 127.0.0.1 listener");
        let port = listener.local_addr().expect("local addr").port();
        let base_url = format!("https://localhost:{port}");
        let handle = tokio::spawn(async move {
            while let Ok((conn, _)) = listener.accept().await {
                let acceptor = acceptor.clone();
                tokio::spawn(async move {
                    if let Ok(mut tls) = acceptor.accept(conn).await {
                        let _ = tls
                            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok")
                            .await;
                        let _ = tls.shutdown().await;
                    }
                });
            }
        });
        (base_url, handle)
    }

    /// Port of a [`spawn_multi_accept_200`] base URL, for tests that must
    /// target a different authority (the 127.0.0.1 literal) on the same
    /// listener.
    fn responder_port(base_url: &str) -> u16 {
        url::Url::parse(base_url)
            .expect("responder base URL parses")
            .port()
            .expect("responder base URL carries an explicit port")
    }

    /// Build an endpoint literal whose outbound config points at
    /// `base_url` (with `allowInternal=true` so the SSRF resolver permits
    /// loopback) and whose pinned-client cache is the caller-owned Arc, so
    /// build counts stay observable across producers.
    fn endpoint_with_shared_cache(
        base_url: &str,
        pinned_cache: &Arc<PinnedClientCache>,
    ) -> HttpEndpoint {
        let uri = format!("{base_url}?allowInternal=true");
        HttpEndpoint {
            uri: uri.clone(),
            config: HttpEndpointConfig::from_uri(&uri).expect("producer endpoint config parses"),
            server_config: HttpServerConfig::from_uri(&uri).expect("server config parses"),
            client: plain_http_test_client(),
            pinned_cache: Arc::clone(pinned_cache),
            http_config: HttpConfig::default(),
        }
    }

    #[tokio::test]
    async fn producers_share_endpoint_cache() {
        use tower::ServiceExt;

        let (base_url, _handle) = spawn_multi_accept_200().await;
        let pinned_cache = Arc::new(PinnedClientCache::new(
            PINNED_CLIENT_TTL,
            PINNED_CLIENT_MAX_ENTRIES,
        ));

        let ctx = test_producer_ctx();
        let endpoint = endpoint_with_shared_cache(&format!("{base_url}/"), &pinned_cache);
        let producer_a = endpoint.create_producer(rt(), &ctx);
        let producer_b = endpoint.create_producer(rt(), &ctx);

        // Each producer sends one exchange whose resolved URL is the
        // endpoint's localhost base URL (a domain name → pinned-client path).
        for producer in [producer_a, producer_b] {
            let producer = producer.expect("create producer");
            let exchange = Exchange::new(Message::default());
            let reply = producer.oneshot(exchange).await;
            assert!(reply.is_ok(), "producer call failed: {:?}", reply);
        }

        assert_eq!(
            pinned_cache.build_count(),
            1,
            "both producers must hit the same shared cache entry; a second \
             build means sharing is broken"
        );
    }

    #[tokio::test]
    async fn producer_repeated_hostname_requests_build_one_client() {
        use tower::ServiceExt;

        let (base_url, _handle) = spawn_multi_accept_200().await;
        let pinned_cache = Arc::new(PinnedClientCache::new(
            PINNED_CLIENT_TTL,
            PINNED_CLIENT_MAX_ENTRIES,
        ));
        let ctx = test_producer_ctx();
        let endpoint = endpoint_with_shared_cache(&format!("{base_url}/"), &pinned_cache);
        let producer = endpoint
            .create_producer(rt(), &ctx)
            .expect("create producer");

        // Two sequential hostname requests — the cached pinned client stays
        // retrievable between them, so no second build may happen.
        for i in 0..2 {
            let exchange = Exchange::new(Message::default());
            let reply = producer.clone().oneshot(exchange).await;
            assert!(reply.is_ok(), "request {i} failed: {:?}", reply);
        }

        assert_eq!(
            pinned_cache.build_count(),
            1,
            "repeated hostname requests must reuse the one pinned client; \
             0 builds means the producer bypassed the cache, more than 1 \
             means the entry was dropped"
        );
    }

    #[tokio::test]
    async fn ip_literal_request_never_enters_cache() {
        use tower::ServiceExt;

        let (base_url, _handle) = spawn_multi_accept_200().await;
        let pinned_cache = Arc::new(PinnedClientCache::new(
            PINNED_CLIENT_TTL,
            PINNED_CLIENT_MAX_ENTRIES,
        ));

        let ctx = test_producer_ctx();
        let destination = format!("http://127.0.0.1:{}/ping", responder_port(&base_url));
        let endpoint = endpoint_with_shared_cache(&destination, &pinned_cache);
        let producer = endpoint
            .create_producer(rt(), &ctx)
            .expect("create producer");

        let exchange = Exchange::new(Message::default());
        let reply = producer.oneshot(exchange).await;
        assert!(reply.is_ok(), "producer call failed: {:?}", reply);

        assert_eq!(
            pinned_cache.build_count(),
            0,
            "an IP-literal URL must use the shared unpinned client and \
             never enter the pinned cache"
        );
    }

    #[tokio::test]
    async fn test_component_endpoints_share_pinned_cache() {
        use tower::ServiceExt;

        let component = HttpComponent::new();
        let (base_url, _handle) = spawn_multi_accept_200().await;
        let baseline = component.pinned_cache.build_count();

        let ctx = test_producer_ctx();
        let endpoint_ctx = NoOpComponentContext;
        for uri in [
            format!("{base_url}/a?allowInternal=true&k=a"),
            format!("{base_url}/b?allowInternal=true&k=b"),
        ] {
            let endpoint = component
                .create_endpoint(&uri, &endpoint_ctx)
                .expect("create endpoint");
            let producer = endpoint
                .create_producer(rt(), &ctx)
                .expect("create producer");
            let exchange = Exchange::new(Message::default());
            let reply = producer.oneshot(exchange).await;
            assert!(reply.is_ok(), "producer call failed: {:?}", reply);
        }

        assert_eq!(
            component.pinned_cache.build_count() - baseline,
            1,
            "endpoints created by one component must share its pinned cache; \
             0 builds means the endpoints bypassed it, more than 1 means \
             per-endpoint caches came back"
        );
    }

    #[tokio::test]
    async fn test_dynamic_resolution_sequence_hits_shared_cache() {
        use tower::ServiceExt;

        let component = HttpComponent::new();
        let (base_url, _handle) = spawn_multi_accept_200().await;
        let baseline = component.pinned_cache.build_count();

        let ctx = test_producer_ctx();
        let endpoint_ctx = NoOpComponentContext;
        for i in 0..3 {
            let endpoint = component
                .create_endpoint(
                    &format!("{base_url}/r{i}?allowInternal=true&k={i}"),
                    &endpoint_ctx,
                )
                .expect("create endpoint");
            let producer = endpoint
                .create_producer(rt(), &ctx)
                .expect("create producer");
            let exchange = Exchange::new(Message::default());
            let reply = producer.oneshot(exchange).await;
            assert!(reply.is_ok(), "request {i} failed: {:?}", reply);
        }

        assert_eq!(
            component.pinned_cache.build_count() - baseline,
            1,
            "a dynamic-resolution sequence (fresh endpoint+producer per URI) \
             must reuse the component's one pinned cache entry; 0 builds \
             means the endpoints bypassed it, more than 1 means \
             per-endpoint caches came back"
        );
    }

    /// rc-0li3: BEHAVIORAL https sharing pin — two https endpoints created
    /// through one `HttpsComponent` drive real TLS requests through the
    /// component's single pinned cache. A regression that reintroduces
    /// per-endpoint `PinnedClientCache::new` inside
    /// `HttpsComponent::create_endpoint` leaves the component cache at
    /// delta 0 and fails this test (the structural ptr_eq test cannot see
    /// that).
    #[tokio::test]
    async fn test_https_component_endpoints_share_pinned_cache_behaviorally() {
        use tower::ServiceExt;

        let http_config = HttpConfig {
            tls: Some(crate::config::TlsConfig {
                enabled: true,
                insecure: true,
                ..Default::default()
            }),
            ..Default::default()
        };
        let component = HttpsComponent::with_config(http_config);
        let (base_url, _handle) = spawn_tls_multi_accept_200().await;
        let baseline = component.pinned_cache.build_count();

        let ctx = test_producer_ctx();
        let endpoint_ctx = NoOpComponentContext;
        for uri in [
            format!("{base_url}/a?allowInternal=true&k=a"),
            format!("{base_url}/b?allowInternal=true&k=b"),
        ] {
            let endpoint = component
                .create_endpoint(&uri, &endpoint_ctx)
                .expect("create https endpoint");
            let producer = endpoint
                .create_producer(rt(), &ctx)
                .expect("create producer");
            let exchange = Exchange::new(Message::default());
            let reply = producer.oneshot(exchange).await;
            assert!(reply.is_ok(), "https request failed: {reply:?}");
        }

        assert_eq!(
            component.pinned_cache.build_count() - baseline,
            1,
            "endpoints of one HttpsComponent must share its pinned cache over \
             real https requests; 0 builds means the endpoints bypassed it \
             (per-endpoint cache regression), more than 1 means \
             per-endpoint caches came back"
        );
    }

    #[test]
    fn test_https_component_owns_distinct_cache() {
        let http = HttpComponent::new();
        let https = HttpsComponent::new();

        assert!(
            !Arc::ptr_eq(&http.pinned_cache, &https.pinned_cache),
            "http and https components must each own their own pinned cache"
        );

        let endpoint_ctx = NoOpComponentContext;
        let _ = http
            .create_endpoint("http://localhost:1/?allowInternal=true", &endpoint_ctx)
            .expect("http endpoint");
        let _ = https
            .create_endpoint("https://localhost:1/?allowInternal=true", &endpoint_ctx)
            .expect("https endpoint");

        assert_eq!(
            http.pinned_cache.build_count(),
            0,
            "endpoint creation must not build a pinned client"
        );
        assert_eq!(
            https.pinned_cache.build_count(),
            0,
            "endpoint creation must not build a pinned client"
        );
    }

    #[test]
    fn test_component_constructor_builds_one_unpinned_client() {
        let baseline = build_client_call_count();

        let _http = HttpComponent::new();
        assert_eq!(
            build_client_call_count() - baseline,
            1,
            "HttpComponent::new() must build exactly one shared unpinned client"
        );

        let _https = HttpsComponent::new();
        assert_eq!(
            build_client_call_count() - baseline,
            2,
            "HttpsComponent::new() must build exactly one more shared unpinned client"
        );
    }

    #[test]
    fn test_component_endpoints_share_unpinned_client() {
        let component = HttpComponent::new();
        let baseline = build_client_call_count();

        let endpoint_ctx = NoOpComponentContext;
        for uri in [
            "http://localhost:1/a?allowInternal=true",
            "http://localhost:1/b?allowInternal=true",
        ] {
            let _endpoint = component
                .create_endpoint(uri, &endpoint_ctx)
                .expect("create endpoint");
        }

        assert_eq!(
            build_client_call_count() - baseline,
            0,
            "create_endpoint must clone the component's shared unpinned client, \
             never build a fresh one"
        );
    }

    #[test]
    fn test_dynamic_resolution_adds_no_unpinned_client_builds() {
        let component = HttpComponent::new();
        let baseline = build_client_call_count();

        let ctx = test_producer_ctx();
        let endpoint_ctx = NoOpComponentContext;
        for i in 0..3 {
            let endpoint = component
                .create_endpoint(
                    &format!("http://localhost:1/r{i}?allowInternal=true&k={i}"),
                    &endpoint_ctx,
                )
                .expect("create endpoint");
            let _producer = endpoint
                .create_producer(rt(), &ctx)
                .expect("create producer");
        }

        assert_eq!(
            build_client_call_count() - baseline,
            0,
            "a dynamic-resolution sequence (fresh endpoint+producer per URI) \
             must reuse the component's shared unpinned client and build \
             no additional clients"
        );
    }

    #[test]
    fn test_webpki_fallback_config_builds_client() {
        // The fallback backend must construct a client on ANY platform —
        // it reads no platform state. This is the exact TLS configuration
        // Termux executes when the primary (platform-verifier) build
        // fails (rc-3j4mq).
        let client = reqwest::Client::builder()
            .tls_backend_preconfigured(webpki_root_client_config())
            .build()
            .expect("webpki-rooted client must build"); // allow-unwrap(test)
        // A built client is usable (internal state initialized); assert
        // via the debug render rather than a network round-trip.
        let rendered = format!("{client:?}");
        assert!(
            !rendered.is_empty(),
            "client must render a debug representation"
        );
    }

    /// rcgen self-signed one-root CA, written to `ca.pem` inside a fresh
    /// tempdir (rcgen 0.14 shapes per camel-component-api test_support).
    fn fallback_test_ca() -> (tempfile::TempDir, String) {
        let ca_key = rcgen::KeyPair::generate().expect("ca keygen"); // allow-unwrap(test)
        let mut ca_params = rcgen::CertificateParams::default();
        ca_params
            .distinguished_name
            .push(rcgen::DnType::CommonName, "Fallback test CA");
        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
        let ca_cert = ca_params.self_signed(&ca_key).expect("ca self-sign"); // allow-unwrap(test)
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca_cert.pem()).expect("write ca pem"); // allow-unwrap(test)
        (dir, ca_path.display().to_string())
    }

    /// Valid strict TLS material fixtures (rc-3x5qj): a rcgen one-root
    /// CA written to `ca.pem` plus a CA-signed client identity written
    /// to `client-cert.pem`/`client-key.pem`, all inside a fresh
    /// tempdir. The CA itself is returned too, so handshake tests can
    /// sign a server leaf from the SAME CA the config carries — the
    /// rebuild-failure tests' precondition (VALID material throughout,
    /// so no material error can precede the terminal under test).
    /// Named fields for the strict TLS material fixtures (rc-3x5qj):
    /// position-only PathBufs in a tuple invited silent cert/key swaps.
    struct StrictMaterial {
        dir: tempfile::TempDir,
        ca: TestCa,
        ca_path: std::path::PathBuf,
        cert_path: std::path::PathBuf,
        key_path: std::path::PathBuf,
    }

    fn strict_material_fixtures() -> StrictMaterial {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca.ca_pem.as_bytes()).expect("write ca pem"); // allow-unwrap(test)
        let (client_cert_pem, client_key_pem) = gen_client_identity(&ca);
        let cert_path = dir.path().join("client-cert.pem");
        std::fs::write(&cert_path, client_cert_pem.as_bytes()).expect("write client cert"); // allow-unwrap(test)
        let key_path = dir.path().join("client-key.pem");
        std::fs::write(&key_path, client_key_pem.as_bytes()).expect("write client key"); // allow-unwrap(test)
        StrictMaterial {
            dir,
            ca,
            ca_path,
            cert_path,
            key_path,
        }
    }

    /// Assert `err` is `EndpointCreationFailed` whose message contains
    /// every `fragment`.
    fn assert_strict_fallback_error(err: CamelError, fragments: &[&str]) {
        match err {
            CamelError::EndpointCreationFailed(msg) => {
                for fragment in fragments {
                    assert!(msg.contains(fragment), "message: {msg}");
                }
            }
            other => panic!("expected EndpointCreationFailed, got {other:?}"),
        }
    }

    /// Order is hygiene-only for verification, not load-bearing:
    /// rustls 0.23.45 `src/webpki/verify.rs:245-263` passes
    /// `&roots.roots` to webpki in store order, and rustls-webpki
    /// 0.103.15 `src/verify_cert.rs:66-73` +
    /// `loop_while_non_fatal_error` (`:757-774`) returns on the FIRST
    /// anchor that validates and continues past non-fatal misses, so
    /// accept/reject cannot depend on order. Custom-first is pinned
    /// anyway for parity with the primary path
    /// (rustls-platform-verifier 0.7.0
    /// `src/verification/others.rs:81-93` adds extra roots before
    /// native certs).
    #[test]
    fn test_fallback_root_store_union_custom_and_mozilla() {
        let (_dir, ca_path) = fallback_test_ca();
        let store = fallback_root_store(Some(&ca_path), true).expect("union root store must build"); // allow-unwrap(test)
        assert_eq!(
            store.roots.len(),
            webpki_roots::TLS_SERVER_ROOTS.len() + 1,
            "custom CA must UNION with the Mozilla anchors, not replace them"
        );
        let ca_pem = std::fs::read_to_string(&ca_path).expect("read ca pem back"); // allow-unwrap(test)
        let der = rustls_pemfile::certs(&mut std::io::Cursor::new(ca_pem.as_bytes()))
            .next()
            .expect("exactly one CERTIFICATE section in test CA") // allow-unwrap(test)
            .expect("parse test CA pem"); // allow-unwrap(test)
        // Rebuild the expected anchor the same way the production store
        // accepts it, so the equality below is construction-identical.
        let mut scratch = rustls::RootCertStore::empty();
        let (added, _ignored) = scratch.add_parsable_certificates(vec![der]);
        assert_eq!(added, 1, "scratch root store must accept the test CA");
        let expected_anchor = scratch.roots[0].clone();
        assert_eq!(
            store.roots.first(),
            Some(&expected_anchor),
            "custom anchor must sit at index 0 — parity with the primary path's \
             extra-roots-before-platform-roots order"
        );
        assert_eq!(
            store.roots[1..],
            *webpki_roots::TLS_SERVER_ROOTS,
            "everything after the custom anchor must be exactly the bundled Mozilla anchors"
        );
        let first_custom = store
            .roots
            .iter()
            .position(|anchor| anchor == &expected_anchor)
            .expect("custom anchor present in store"); // allow-unwrap(test)
        let first_mozilla = store
            .roots
            .iter()
            .position(|anchor| webpki_roots::TLS_SERVER_ROOTS.contains(anchor))
            .expect("Mozilla anchors present in store"); // allow-unwrap(test)
        assert!(
            first_custom < first_mozilla,
            "first custom anchor (index {first_custom}) must precede the first \
             Mozilla anchor (index {first_mozilla})"
        );
    }

    #[test]
    fn test_fallback_root_store_no_ca_is_mozilla_only() {
        let store = fallback_root_store(None, true).expect("mozilla-only store must build"); // allow-unwrap(test)
        assert_eq!(
            store.roots.len(),
            webpki_roots::TLS_SERVER_ROOTS.len(),
            "no configured CA must leave the bundled Mozilla anchors untouched"
        );
        assert_eq!(
            store.roots,
            *webpki_roots::TLS_SERVER_ROOTS,
            "with no configured CA the whole store IS the bundled Mozilla anchors, \
             byte-for-byte"
        );
    }

    #[test]
    fn test_fallback_root_store_strict_unreadable_ca_fails_closed() {
        let err = match fallback_root_store(Some("/nonexistent/ca-bundle.pem"), true) {
            Err(e) => e,
            Ok(_) => panic!("strict mode must fail closed on an unreadable CA file"),
        };
        assert_strict_fallback_error(err, &["tls.strict/webpki-fallback", "unreadable"]);
    }

    #[test]
    fn test_fallback_root_store_strict_zero_pem_sections_fails_closed() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("key-only.pem");
        std::fs::write(
            &ca_path,
            "-----BEGIN PRIVATE KEY-----\nAAAA\n-----END PRIVATE KEY-----\n",
        )
        .expect("write key-only pem"); // allow-unwrap(test)
        let path = ca_path.display().to_string();
        let err = match fallback_root_store(Some(&path), true) {
            Err(e) => e,
            Ok(_) => panic!("strict mode must fail closed on a CA with no CERTIFICATE section"),
        };
        assert_strict_fallback_error(err, &["no parseable PEM CERTIFICATE"]);
    }

    #[test]
    fn test_fallback_root_store_strict_zero_roots_accepted_fails_closed() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("garbage-cert.pem");
        std::fs::write(
            &ca_path,
            "-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----\n",
        )
        .expect("write garbage cert pem"); // allow-unwrap(test)
        let path = ca_path.display().to_string();
        let err = match fallback_root_store(Some(&path), true) {
            Err(e) => e,
            Ok(_) => panic!("strict mode must fail closed when the root store rejects the CA"),
        };
        assert_strict_fallback_error(err, &["rejected by the TLS root store"]);
    }

    #[test]
    fn test_fallback_root_store_nonstrict_bad_ca_degrades_to_mozilla() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("garbage.pem");
        std::fs::write(&ca_path, "this is not a certificate\n").expect("write garbage pem"); // allow-unwrap(test)
        let path = ca_path.display().to_string();
        let store = fallback_root_store(Some(&path), false)
            .expect("non-strict garbage CA must degrade to Mozilla-only"); // allow-unwrap(test)
        assert_eq!(
            store.roots.len(),
            webpki_roots::TLS_SERVER_ROOTS.len(),
            "non-strict bad CA must degrade to the bundled Mozilla anchors"
        );
    }

    #[test]
    fn test_fallback_client_config_disabled_tls_returns_none() {
        let tls = TlsConfig {
            enabled: false,
            ..Default::default()
        };
        assert!(
            fallback_client_config(&tls)
                .expect("disabled TLS is infallible") // allow-unwrap(test)
                .is_none()
        );
    }

    #[test]
    fn test_fallback_client_config_no_material_verifying_returns_none() {
        let tls = TlsConfig {
            enabled: true,
            ..Default::default()
        };
        assert!(
            fallback_client_config(&tls)
                .expect("plain verifying TLS is infallible") // allow-unwrap(test)
                .is_none()
        );
    }

    #[test]
    fn test_fallback_client_config_strict_identity_garbage_key_fails_closed() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let client_key = rcgen::KeyPair::generate().expect("client keygen"); // allow-unwrap(test)
        let client_params = rcgen::CertificateParams::default();
        let client_cert = client_params
            .self_signed(&client_key)
            .expect("client cert self-sign"); // allow-unwrap(test)
        let cert_path = dir.path().join("client.pem");
        std::fs::write(&cert_path, client_cert.pem()).expect("write client pem"); // allow-unwrap(test)
        let key_path = dir.path().join("key.pem");
        std::fs::write(&key_path, "garbage not a key at all\n").expect("write garbage key"); // allow-unwrap(test)
        let tls = TlsConfig {
            enabled: true,
            strict: true,
            client_cert_path: Some(cert_path.display().to_string()),
            client_key_path: Some(key_path.display().to_string()),
            ..Default::default()
        };
        let err = match fallback_client_config(&tls) {
            Err(e) => e,
            Ok(_) => panic!("strict mode must fail closed on a garbage client key"),
        };
        assert_strict_fallback_error(err, &["no parseable private key"]);
    }

    #[test]
    fn test_fallback_client_config_strict_rustls_rejected_key_fails_closed() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let client_key = rcgen::KeyPair::generate().expect("client keygen"); // allow-unwrap(test)
        let client_params = rcgen::CertificateParams::default();
        let client_cert = client_params
            .self_signed(&client_key)
            .expect("client cert self-sign"); // allow-unwrap(test)
        let cert_path = dir.path().join("client.pem");
        std::fs::write(&cert_path, client_cert.pem()).expect("write client pem"); // allow-unwrap(test)
        let key_path = dir.path().join("key.pem");
        std::fs::write(
            &key_path,
            "-----BEGIN PRIVATE KEY-----\nAAAA\n-----END PRIVATE KEY-----\n",
        )
        .expect("write pkcs8-framed garbage key"); // allow-unwrap(test)
        let tls = TlsConfig {
            enabled: true,
            strict: true,
            client_cert_path: Some(cert_path.display().to_string()),
            client_key_path: Some(key_path.display().to_string()),
            ..Default::default()
        };
        let err = match fallback_client_config(&tls) {
            Err(e) => e,
            Ok(_) => panic!("strict mode must fail closed when rustls rejects the identity"),
        };
        assert_strict_fallback_error(err, &["rejected by the TLS backend"]);
    }

    #[test]
    fn test_fallback_client_config_half_mtls_pair_strict_fails_nonstrict_no_auth() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let cert_path = dir.path().join("client.pem");
        std::fs::write(&cert_path, "cert-only, key missing\n").expect("write placeholder pem"); // allow-unwrap(test)
        let tls_strict = TlsConfig {
            enabled: true,
            strict: true,
            client_cert_path: Some(cert_path.display().to_string()),
            ..Default::default()
        };
        let err = match fallback_client_config(&tls_strict) {
            Err(e) => e,
            Ok(_) => panic!("strict mode must fail closed on a half-configured mTLS pair"),
        };
        assert_strict_fallback_error(err, &["BOTH client_cert_path"]);
        let tls_permissive = TlsConfig {
            enabled: true,
            client_cert_path: Some(cert_path.display().to_string()),
            ..Default::default()
        };
        assert!(
            fallback_client_config(&tls_permissive)
                .expect("non-strict half pair degrades to no-auth") // allow-unwrap(test)
                .is_some()
        );
    }

    #[test]
    fn test_no_verify_verifier_accepts_any_certificate() {
        use rustls::client::danger::ServerCertVerifier;

        let verifier = NoVerifyServerCertVerifier;
        let garbage = rustls::pki_types::CertificateDer::from(vec![0xDE, 0xAD, 0xBE, 0xEF]);
        let server_name =
            rustls::pki_types::ServerName::try_from("localhost").expect("localhost dns name"); // allow-unwrap(test)
        assert!(
            verifier
                .verify_server_cert(
                    &garbage,
                    &[],
                    &server_name,
                    &[],
                    rustls::pki_types::UnixTime::now()
                )
                .is_ok(),
            "no-verify verifier must accept any certificate without validation"
        );
    }

    #[test]
    fn test_build_client_falls_back_on_empty_platform_ca_store() {
        // Serialize against the primary-path test: the env window below
        // is process-visible and would force its build through the
        // fallback too.
        let _ca_guard = lock_ca_store_test_mutex();
        // Simulate a CA-less platform (Android/Termux, rc-3j4mq):
        // openssl-probe honors SSL_CERT_FILE/SSL_CERT_DIR only when the
        // paths EXIST, so an existing-but-empty file plus an
        // existing-but-empty directory make rustls-native-certs load zero
        // roots — the exact condition that made the platform verifier
        // (and pre-fix startup) fail on Termux. The env window is
        // process-visible: concurrent client builds in other tests also
        // take the fallback, which still builds a working client — no
        // assertion outside this test can distinguish the two paths
        // except via this thread's BUILD_CLIENT_FALLBACKS counter.
        let empty_ca_dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let empty_ca_file = empty_ca_dir.path().join("empty-ca-bundle.pem");
        std::fs::write(&empty_ca_file, b"").expect("write empty CA file"); // allow-unwrap(test)

        // Safety: test-only mutation of process env vars. This test does
        // not spawn threads that read these vars outside the guarded
        // window below; the guard restores previous values before return.
        let (prev_file, prev_dir) = unsafe {
            let prev = (
                std::env::var_os("SSL_CERT_FILE"),
                std::env::var_os("SSL_CERT_DIR"),
            );
            std::env::set_var("SSL_CERT_FILE", &empty_ca_file);
            std::env::set_var("SSL_CERT_DIR", empty_ca_dir.path());
            prev
        };

        let result = std::panic::catch_unwind(|| {
            let fallbacks_before = build_client_fallback_count();
            let _client = build_client(&HttpConfig::default(), None).expect("client must build"); // allow-unwrap(test)
            build_client_fallback_count() - fallbacks_before
        });

        // Restore FIRST so the guard holds even if assertions fail.
        // Safety: restoring the previously-captured values.
        unsafe {
            match prev_file {
                Some(v) => std::env::set_var("SSL_CERT_FILE", v),
                None => std::env::remove_var("SSL_CERT_FILE"),
            }
            match prev_dir {
                Some(v) => std::env::set_var("SSL_CERT_DIR", v),
                None => std::env::remove_var("SSL_CERT_DIR"),
            }
        }

        let fallbacks_taken = result.expect("build_client must not panic on an empty CA store"); // allow-unwrap(test)
        assert_eq!(
            fallbacks_taken, 1,
            "an empty platform CA store must route exactly one build through \
             the webpki fallback (primary build failed, fallback succeeded)"
        );
    }

    /// Throwaway self-signed root used ONLY to make the native-root
    /// store non-empty hermetically (tests need a parseable PEM
    /// CERTIFICATE section, nothing more — the private key was discarded
    /// at generation and the root signs/trusts nothing). Generated
    /// 2026-09-21, self-expiring 2126.
    const HERMETIC_TEST_ROOT_PEM: &str = "-----BEGIN CERTIFICATE-----\n\
        MIIDVzCCAj+gAwIBAgIUQ+hB0JPFtHpUKaNwcTB8ijGqEW0wDQYJKoZIhvcNAQEL\n\
        BQAwOjEdMBsGA1UEAwwUY2FtZWwtaHR0cCB0ZXN0IHJvb3QxGTAXBgNVBAoMEGNh\n\
        bWVsLWh0dHAgdGVzdHMwIBcNMjYwOTIxMTEyMzUwWhgPMjEyNjA4MjgxMTIzNTBa\n\
        MDoxHTAbBgNVBAMMFGNhbWVsLWh0dHAgdGVzdCByb290MRkwFwYDVQQKDBBjYW1l\n\
        bC1odHRwIHRlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAolnF\n\
        SiT/bK8pMl9n50HTQj4oxPZGXK34Q/OSq8TMUEcmhUFzBjzwZKoFqvDIt/e0mSi/\n\
        h8WQlnrHAvYOnsRlpDsfs4yder+lpEYE84OooJjQvj/kREj7ncK6WQKDY1NTGikx\n\
        lF8kIaCrNHNIlUgoSWMR4E6UshLFwSu5lKtcWCeN6FNzGVQ9jxYJSFsmVk+wFyHI\n\
        edvpPbnFkD3M1/GKNVuxCCR50sO+cQeB7w9FCyFdHvoTWWuwPV4Qq2LBM2n4eedG\n\
        pCXkqmuARtFuOKjpYIRryGybic9u9ZW59FbTbgHSj6rcOXNtBUVV/KnWRDRWo7ZC\n\
        cR5SmO2YwtfpISjbmwIDAQABo1MwUTAdBgNVHQ4EFgQUkhwU0Q5JYNLrs7yOqbXE\n\
        szzn2/cwHwYDVR0jBBgwFoAUkhwU0Q5JYNLrs7yOqbXEszzn2/cwDwYDVR0TAQH/\n\
        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAXLqN7poLyxlpxN9vY1jISs403P2I\n\
        edwgX3eWyJgXQfc/+dhnig8Pi7SkJKNM9PM27qain3+e2/HeetNYGBD8xnzQo5ga\n\
        1ScPvm7u2DWIWc5y0bpm5JuCPqXoDl/7kBcaelA2lZRrPJzQuu6uPnH1ubjUPFJj\n\
        9SxWhR+QgJW3cFc17C179WSVSJSPLozxX1ODABSyxNXnz14Rq+MOJi2tEsDggyMm\n\
        txh6GwgVbiSey9c9bvu3B28iPfNpULuxBzxSLHcRrSSoII+46foY0G63V/jx7huY\n\
        Fc2DPwOcO2Ni8fLssMaAnEdWPZaIN/DdjmUFw9XgHE9Eld6aKEXBcRFPzA==\n\
        -----END CERTIFICATE-----";

    #[test]
    fn test_build_client_primary_path_when_platform_store_non_empty() {
        // The webpki set is a FALLBACK, never a replacement for platform
        // roots (managed fleets keep OS root-program control). Hermetic:
        // SSL_CERT_FILE pinned to a parseable fixture root makes the
        // native store non-empty on ANY host — including genuinely
        // CA-less ones — so the no-fallback assertion cannot depend on
        // the build machine. Serialized against the CA-less sibling test
        // by the CA-store mutex (its env window forces the fallback).
        let _ca_guard = lock_ca_store_test_mutex();
        let ca_dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_file = ca_dir.path().join("hermetic-root.pem");
        std::fs::write(&ca_file, HERMETIC_TEST_ROOT_PEM).expect("write fixture root"); // allow-unwrap(test)

        // Safety: test-only mutation of process env vars, restored
        // before any assertion below.
        let (prev_file, prev_dir) = unsafe {
            let prev = (
                std::env::var_os("SSL_CERT_FILE"),
                std::env::var_os("SSL_CERT_DIR"),
            );
            std::env::set_var("SSL_CERT_FILE", &ca_file);
            std::env::set_var("SSL_CERT_DIR", ca_dir.path());
            prev
        };

        let fallbacks_before = build_client_fallback_count();
        let _client = build_client(&HttpConfig::default(), None).expect("client must build"); // allow-unwrap(test)
        let fallbacks_taken = build_client_fallback_count() - fallbacks_before;

        // Safety: restoring the previously-captured values.
        unsafe {
            match prev_file {
                Some(v) => std::env::set_var("SSL_CERT_FILE", v),
                None => std::env::remove_var("SSL_CERT_FILE"),
            }
            match prev_dir {
                Some(v) => std::env::set_var("SSL_CERT_DIR", v),
                None => std::env::remove_var("SSL_CERT_DIR"),
            }
        }

        assert_eq!(
            fallbacks_taken, 0,
            "with at least one platform root loadable, build_client must \
             use the platform-verifier primary path, never the webpki \
             fallback"
        );
    }

    #[test]
    fn test_build_client_forced_fallback_strict_store_rejected_ca_returns_typed_error() {
        // pemfile-ok / store-rejected CA: the PEM section base64-decodes
        // (rustls-pemfile does not validate DER), so only the root store
        // rejects it — the store-rejection class through the full
        // build_client fallback path.
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("garbage-cert.pem");
        std::fs::write(
            &ca_path,
            "-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----\n",
        )
        .expect("write garbage cert pem"); // allow-unwrap(test)
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };

        let (err, fallbacks_taken) = forced_fallback_env(|| {
            let fallbacks_before = build_client_fallback_count();
            let err = match build_client(&config, None) {
                Err(e) => e,
                Ok(_) => panic!("strict mode must fail closed when the root store rejects the CA"),
            };
            (err, build_client_fallback_count() - fallbacks_before)
        });

        assert_strict_fallback_error(
            err,
            &[
                "tls.strict/webpki-fallback",
                "rejected by the TLS root store",
            ],
        );
        assert_eq!(
            fallbacks_taken, 1,
            "the typed error must come from exactly one webpki fallback entry"
        );
    }

    #[test]
    fn test_build_client_forced_fallback_strict_material_rejection_classes() {
        // One fixture set, four strict rejection classes, each routed
        // through the full build_client fallback path.
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)

        // (a) CA material with zero PEM CERTIFICATE sections.
        let plain_text_ca = dir.path().join("plain-text.pem");
        std::fs::write(&plain_text_ca, "this is not a certificate\n").expect("write plain text ca"); // allow-unwrap(test)

        // Valid rcgen client identity shared by the mTLS classes.
        let client_key = rcgen::KeyPair::generate().expect("client keygen"); // allow-unwrap(test)
        let client_cert = rcgen::CertificateParams::default()
            .self_signed(&client_key)
            .expect("client self-sign"); // allow-unwrap(test)
        let cert_path = dir.path().join("client-cert.pem");
        std::fs::write(&cert_path, client_cert.pem()).expect("write client cert"); // allow-unwrap(test)
        let valid_key_path = dir.path().join("client-key.pem");
        std::fs::write(&valid_key_path, client_key.serialize_pem()).expect("write client key"); // allow-unwrap(test)
        let garbage_key_path = dir.path().join("garbage-key.pem");
        std::fs::write(&garbage_key_path, "not a key\n").expect("write garbage key"); // allow-unwrap(test)
        // PEM section parses; rustls rejects the bytes at client-auth
        // configuration.
        let rejected_key_path = dir.path().join("rejected-key.pem");
        std::fs::write(
            &rejected_key_path,
            "-----BEGIN PRIVATE KEY-----\nAAAA\n-----END PRIVATE KEY-----\n",
        )
        .expect("write rejected key"); // allow-unwrap(test)

        struct RejectionCase {
            name: &'static str,
            tls: TlsConfig,
            fragment: &'static str,
        }
        let cases = [
            RejectionCase {
                name: "CA with zero PEM CERTIFICATE sections",
                tls: TlsConfig {
                    enabled: true,
                    strict: true,
                    ca_cert_path: Some(plain_text_ca.display().to_string()),
                    ..Default::default()
                },
                fragment: "no parseable PEM CERTIFICATE section",
            },
            RejectionCase {
                name: "client key with no parseable section",
                tls: TlsConfig {
                    enabled: true,
                    strict: true,
                    client_cert_path: Some(cert_path.display().to_string()),
                    client_key_path: Some(garbage_key_path.display().to_string()),
                    ..Default::default()
                },
                fragment: "no parseable private key section",
            },
            RejectionCase {
                name: "client key rejected by the TLS backend",
                tls: TlsConfig {
                    enabled: true,
                    strict: true,
                    client_cert_path: Some(cert_path.display().to_string()),
                    client_key_path: Some(rejected_key_path.display().to_string()),
                    ..Default::default()
                },
                fragment: "rejected by the TLS backend",
            },
            RejectionCase {
                name: "unreadable client cert",
                tls: TlsConfig {
                    enabled: true,
                    strict: true,
                    client_cert_path: Some("/nonexistent/client-cert.pem".to_string()),
                    client_key_path: Some(valid_key_path.display().to_string()),
                    ..Default::default()
                },
                fragment: "unreadable",
            },
        ];

        for case in cases {
            let config = HttpConfig {
                tls: Some(case.tls),
                ..Default::default()
            };
            let err = forced_fallback_env(|| match build_client(&config, None) {
                Err(e) => e,
                Ok(_) => panic!("strict case '{}' must fail closed", case.name),
            });
            assert_strict_fallback_error(err, &["tls.strict/webpki-fallback", case.fragment]);
        }
    }

    #[test]
    fn test_build_client_forced_fallback_nonstrict_bad_ca_still_builds() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("garbage.pem");
        std::fs::write(&ca_path, "this is not a certificate\n").expect("write garbage pem"); // allow-unwrap(test)
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };

        let (_client, fallbacks_taken) = forced_fallback_env(|| {
            let fallbacks_before = build_client_fallback_count();
            let client = build_client(&config, None)
                .expect("non-strict bad CA must degrade per-item and still build"); // allow-unwrap(test)
            (client, build_client_fallback_count() - fallbacks_before)
        });

        assert_eq!(
            fallbacks_taken, 1,
            "permissive item downgrade still routes exactly one build \
             through the webpki fallback"
        );
    }

    #[test]
    fn test_http_component_with_config_folds_fallback_error_without_panic() {
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("garbage-cert.pem");
        std::fs::write(
            &ca_path,
            "-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----\n",
        )
        .expect("write garbage cert pem"); // allow-unwrap(test)
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };

        let endpoint_err = forced_fallback_env(|| {
            // Construction must complete without panic; the build error
            // folds into strict_tls_error and surfaces at endpoint
            // creation.
            let component = HttpComponent::with_config(config);
            component
                .create_endpoint("http://h/p", &NoOpComponentContext)
                .err()
        });

        let err = endpoint_err.expect("folded fallback error must fail endpoint creation"); // allow-unwrap(test)
        assert!(
            err.to_string().contains("rejected by the TLS root store"),
            "folded error must carry the fallback diagnosis: {err}"
        );
    }

    #[test]
    fn test_http_component_new_no_panic_on_empty_ca_store() {
        let endpoint = forced_fallback_env(|| {
            let component = HttpComponent::new();
            component
                .create_endpoint("http://h/p", &NoOpComponentContext)
                .ok()
        });
        let _endpoint = endpoint.expect("material-free webpki fallback must serve endpoints"); // allow-unwrap(test)
    }

    // ---- Forced-fallback loopback TLS handshake scenarios (castrict 1.3)
    //
    // Real TLS handshakes against a loopback rustls server prove that
    // the configured TLS material is CARRIED into the webpki fallback
    // backend: the strict material-free build demonstrably routes
    // through the forced webpki fallback (its Mozilla roots reject the
    // rcgen CA), while every material-carrying build completes a real
    // handshake against a server certified ONLY by the configured CA.
    //
    // Path forcing (e_glm adjudication, rc-hl9cn — Task 1.3 deviation
    // note in openspec/changes/castrict/tasks.md): rustls-platform-
    // verifier 0.7.0 merges configured extra roots into the platform
    // store FIRST and hard-errors only when the merged store is EMPTY,
    // so on Linux an empty `SSL_CERT_FILE`/`SSL_CERT_DIR` window plus a
    // valid configured CA keeps the PRIMARY build succeeding (extra-
    // roots rescue); the fallback-with-valid-material path is real only
    // on verifier-hard-error platforms (android/apple — the Termux
    // case). The material-carrying tests below therefore run
    // `build_client` under the `force_webpki_fallback` seam (primary
    // skipped, fallback entered directly; the trigger warn's error
    // field reads "forced webpki fallback entry (test)") and prove path
    // control with a `build_client_fallback_count()` delta of exactly
    // one. The material-free test keeps the REAL env window — no extra
    // roots exist to rescue the verifier, so its fallback entry is
    // genuine. Every send is timeout-bounded, so a broken harness
    // fails fast instead of hanging.

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn tls_handshake_strict_custom_ca_carried() {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca.ca_pem.as_bytes()).expect("write ca pem"); // allow-unwrap(test)
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let resp = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("strict webpki fallback must carry the configured CA into the handshake"); // allow-unwrap(test)
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.expect("response body"); // allow-unwrap(test)
        assert_eq!(body, "ok");

        // Path control beyond the counter: the strict material-carried
        // info log fires inside the fallback (scope-filtered
        // `logs_contain`, injected by #[traced_test], so sibling tests'
        // events cannot pollute this assertion).
        assert!(
            logs_contain("carries configured TLS material"),
            "strict webpki fallback with configured material must log the carry"
        );

        server.abort();
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn tls_handshake_strict_material_free_fails_same_server() {
        let ca = gen_test_ca();
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = forced_fallback_env(|| {
            build_client(&config, None).expect("client must build") // allow-unwrap(test)
        });

        let send_result = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout"); // allow-unwrap(test)
        assert!(
            send_result.is_err(),
            "material-free strict fallback trusts only Mozilla roots, which do not \
             trust the rcgen CA — the handshake must fail"
        );

        // No TLS material configured: no per-item degradation warns
        // (spec scenario — material-free strict fallback). Scope-
        // filtered `logs_contain` (injected by #[traced_test]) so
        // sibling tests' mTLS-degrade warns cannot pollute the
        // negations; the positive control proves capture works.
        assert!(
            logs_contain("HTTP client build failed on platform TLS roots"),
            "positive control: this test's own fallback warn must be captured"
        );
        assert!(
            !logs_contain("client certificate NOT used"),
            "no identity was configured — the identity degrade warn must not fire"
        );
        assert!(
            !logs_contain("falling back to bundled Mozilla roots"),
            "no CA was configured — the CA degrade warn must not fire"
        );

        server.abort();
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn tls_handshake_strict_mtls_identity_carried() {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca.ca_pem.as_bytes()).expect("write ca pem"); // allow-unwrap(test)
        let (client_cert_pem, client_key_pem) = gen_client_identity(&ca);
        let client_cert_path = dir.path().join("client-cert.pem");
        std::fs::write(&client_cert_path, client_cert_pem.as_bytes()).expect("write client cert"); // allow-unwrap(test)
        let client_key_path = dir.path().join("client-key.pem");
        std::fs::write(&client_key_path, client_key_pem.as_bytes()).expect("write client key"); // allow-unwrap(test)
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        // The server REQUIRES client certificates verified against the
        // same CA that signed the identity.
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, Some(&ca.ca_pem)).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                client_cert_path: Some(client_cert_path.display().to_string()),
                client_key_path: Some(client_key_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let resp = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("strict webpki fallback must carry the mTLS identity into the handshake"); // allow-unwrap(test)
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.expect("response body"); // allow-unwrap(test)
        assert_eq!(body, "ok");

        // Path control beyond the counter: the strict material-carried
        // info log fires inside the fallback (scope-filtered
        // `logs_contain`, injected by #[traced_test]).
        assert!(
            logs_contain("carries configured TLS material"),
            "strict webpki fallback with configured material must log the carry"
        );

        server.abort();
    }

    #[tokio::test]
    async fn tls_handshake_strict_mtls_less_client_rejected() {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca.ca_pem.as_bytes()).expect("write ca pem"); // allow-unwrap(test)
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, Some(&ca.ca_pem)).await;

        // Same CA-carried strict config but WITHOUT the client
        // identity: the handshake must fail server-side.
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let send_result = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout"); // allow-unwrap(test)
        assert!(
            send_result.is_err(),
            "the server requires client certificates — an identity-less client \
             must be rejected at the handshake"
        );

        server.abort();
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn tls_handshake_nonstrict_valid_ca_carried() {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca.ca_pem.as_bytes()).expect("write ca pem"); // allow-unwrap(test)
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let resp = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("non-strict webpki fallback must carry the valid configured CA into the handshake"); // allow-unwrap(test)
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.expect("response body"); // allow-unwrap(test)
        assert_eq!(body, "ok");

        // Loadable material never degrades: no per-item warns even
        // outside strict mode (spec scenario — valid material carried
        // regardless of strict). Scope-filtered `logs_contain`
        // (injected by #[traced_test]) so sibling tests' mTLS-degrade
        // warns cannot pollute the negations; the counter delta above
        // is the positive path control. The platform warn DOES fire
        // under the seam — that is the Forced-trigger notice, not a
        // material warn; the negations below target the per-item
        // material warns only.
        assert!(
            !logs_contain("client certificate NOT used"),
            "no identity was configured — the identity degrade warn must not fire"
        );
        assert!(
            !logs_contain("falling back to bundled Mozilla roots"),
            "the CA loaded cleanly — the CA degrade warn must not fire"
        );

        server.abort();
    }

    /// Genuine-trigger anchor for the force seam (castrict 1.3-deviation,
    /// Option C, weakened variant): strict mTLS identity WITHOUT
    /// `ca_cert_path`, verification ON, under the REAL env window — no
    /// force seam, and no extra roots exist to rescue the verifier, so
    /// the primary genuinely fails. The prescribed 200-ok variant is
    /// architecturally unreachable: reqwest's `!certs_verification`
    /// branch constructs the NoVerifier verifier and never builds the
    /// platform verifier, so a verify-off config cannot genuinely fail
    /// the primary on ANY platform; and every verify-on genuine fallback
    /// trusts only Mozilla ∪ custom roots, which cannot handshake with a
    /// hermetic rcgen CA. Handshake-level identity proof therefore lives
    /// in the seam tests, which share all downstream code from
    /// `fallback_client_config` onward.
    #[tracing_test::traced_test]
    #[tokio::test]
    async fn tls_handshake_mtls_identity_only_genuine_fallback_anchor() {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let (client_cert_pem, client_key_pem) = gen_client_identity(&ca);
        let client_cert_path = dir.path().join("client-cert.pem");
        std::fs::write(&client_cert_path, client_cert_pem.as_bytes()).expect("write client cert"); // allow-unwrap(test)
        let client_key_path = dir.path().join("client-key.pem");
        std::fs::write(&client_key_path, client_key_pem.as_bytes()).expect("write client key"); // allow-unwrap(test)

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                client_cert_path: Some(client_cert_path.display().to_string()),
                client_key_path: Some(client_key_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let (client, fallbacks_taken) = {
            let fallbacks_before = build_client_fallback_count();
            let client = forced_fallback_env(|| {
                build_client(&config, None).expect("client must build") // allow-unwrap(test)
            });
            (client, build_client_fallback_count() - fallbacks_before)
        };
        assert_eq!(
            fallbacks_taken, 1,
            "the empty-store env window must genuinely fail the platform-verifier primary"
        );

        // The strict identity is carried into the fallback config
        // (`with_client_auth_cert` accepted it) — the build is Ok, not
        // fail-closed. No handshake is attempted: the fallback client
        // trusts only Mozilla roots client-side, which cannot verify the
        // hermetic rcgen CA, so a send would fail by design (see the
        // comment above).
        drop(client);

        // Trigger authenticity: the REAL platform warn (not the Forced
        // seam notice) fires inside the fallback. Scope-filtered
        // `logs_contain` (injected by #[traced_test]) so sibling tests'
        // events cannot pollute the assertion.
        assert!(
            logs_contain("HTTP client build failed on platform TLS roots"),
            "the genuine env-window trigger must emit the real platform warn"
        );
    }

    // Task 1.4 (castrict): verification-parity coverage. The two
    // danger-mode parity tests prove a verify-off fallback config
    // handshakes with a self-signed server the Mozilla/platform roots
    // cannot trust; the remaining three prove strict material failures
    // still fail closed, non-strict degradation stays item-wise, and a
    // verifying fallback rejects the same self-signed server — the
    // control showing the parity tests pass BECAUSE of the danger
    // verifier, not because the harness skips verification. All five
    // build under the FORCE_WEBPKI_FALLBACK seam: danger mode makes
    // reqwest construct the NoVerifier branch and never build the
    // platform verifier, so the primary cannot genuinely fail for
    // verify-off configs on ANY platform (1.3-deviation note in
    // openspec/changes/castrict/tasks.md).

    /// Self-signed (NOT CA-signed) server leaf: signer unrelated to any
    /// configured CA — exactly what the parity scenarios need.
    #[tokio::test]
    async fn tls_parity_insecure_self_signed_succeeds() {
        let (server_cert, server_key) = gen_self_signed_server_cert();
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                insecure: true,
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let resp = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("verify-off (insecure) fallback must handshake with the self-signed server"); // allow-unwrap(test)
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.expect("response body"); // allow-unwrap(test)
        assert_eq!(body, "ok");

        server.abort();
    }

    #[tokio::test]
    async fn tls_parity_verify_peer_false_self_signed_succeeds() {
        let (server_cert, server_key) = gen_self_signed_server_cert();
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                verify_peer: false,
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let resp = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("verify_peer=false fallback must handshake with the self-signed server"); // allow-unwrap(test)
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.expect("response body"); // allow-unwrap(test)
        assert_eq!(body, "ok");

        server.abort();
    }

    #[tokio::test]
    async fn tls_parity_insecure_strict_bad_material_still_fails_closed() {
        // No server needed: the build must fail before any connection.
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        // Store-rejected fixture: a PEM CERTIFICATE section whose body
        // is not base64 — the root store accepts 0 of 1 certs.
        let ca_path = dir.path().join("rejected-ca.pem");
        std::fs::write(
            &ca_path,
            b"-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----\n",
        )
        .expect("write rejected ca fixture"); // allow-unwrap(test)

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                insecure: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        // Raw force-guard + match: build_under_seam expects Ok, and the
        // strict material failure must surface as Err before any send —
        // verification-disable never masks strict material failure.
        let err = match force_webpki_fallback(|| build_client(&config, None)) {
            Err(e) => e,
            Ok(_) => panic!(
                "strict mode must fail closed on store-rejected CA material \
                 even with insecure=true"
            ),
        };
        assert_strict_fallback_error(err, &["tls.strict/webpki-fallback"]);
    }

    #[test]
    fn strict_rebuild_failure_returns_typed_error() {
        let StrictMaterial {
            dir: _dir,
            ca_path,
            cert_path,
            key_path,
            ..
        } = strict_material_fixtures();

        // VALID material throughout: no material error can precede the
        // rebuild terminal, so any typed Err must come from the
        // strict-fail-closed second-error terminal itself.
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                client_cert_path: Some(cert_path.display().to_string()),
                client_key_path: Some(key_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let fallbacks_before = build_client_fallback_count();
        let err = match force_webpki_fallback_rebuild_failure(|| build_client(&config, None)) {
            Err(e) => e,
            Ok(_) => panic!(
                "strict mode must fail closed when the webpki fallback client \
                 rebuild fails — never the material-free emergency client"
            ),
        };
        assert_eq!(
            build_client_fallback_count() - fallbacks_before,
            1,
            "the rebuild-failure call must route through the webpki fallback exactly once"
        );
        assert_strict_fallback_error(
            err,
            &[
                "tls.strict/webpki-fallback:",
                "webpki fallback client rebuild failed",
                "forced webpki fallback rebuild failure",
            ],
        );
    }

    #[test]
    fn non_strict_rebuild_failure_returns_emergency_client() {
        let StrictMaterial {
            dir: _dir,
            ca_path,
            cert_path,
            key_path,
            ..
        } = strict_material_fixtures();

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                ca_cert_path: Some(ca_path.display().to_string()),
                client_cert_path: Some(cert_path.display().to_string()),
                client_key_path: Some(key_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let fallbacks_before = build_client_fallback_count();
        let _client = force_webpki_fallback_rebuild_failure(|| build_client(&config, None))
            .expect("non-strict rebuild failure must degrade to the emergency client"); // allow-unwrap(test)
        assert_eq!(
            build_client_fallback_count() - fallbacks_before,
            1,
            "the rebuild-failure call must route through the webpki fallback exactly once"
        );
    }

    #[test]
    fn strict_rebuild_failure_surfaces_at_endpoint_creation() {
        let StrictMaterial {
            dir: _dir,
            ca_path,
            cert_path,
            key_path,
            ..
        } = strict_material_fixtures();

        // VALID strict config: no material error can precede the
        // rebuild terminal, so any folded Err must come from the
        // strict-fail-closed rebuild terminal itself.
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ca_cert_path: Some(ca_path.display().to_string()),
                client_cert_path: Some(cert_path.display().to_string()),
                client_key_path: Some(key_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };

        let endpoint_err = force_webpki_fallback_rebuild_failure(|| {
            // Construction must complete without panic; the rebuild-
            // failure error folds into strict_tls_error and surfaces at
            // endpoint creation (mirrors the forced-fallback fold test).
            let component = HttpComponent::with_config(config);
            component
                .create_endpoint("http://h/p", &NoOpComponentContext)
                .err()
        });

        let err = endpoint_err.expect("folded rebuild failure must fail endpoint creation"); // allow-unwrap(test)
        assert_strict_fallback_error(
            err,
            &[
                "tls.strict/webpki-fallback:",
                "webpki fallback client rebuild failed",
            ],
        );
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn non_strict_rebuild_failure_drops_custom_trust() {
        let StrictMaterial {
            dir: _dir,
            ca,
            ca_path,
            ..
        } = strict_material_fixtures();

        // Server certified ONLY by the same CA the config carries: a
        // material-carrying fallback build completes this handshake,
        // the emergency client cannot.
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                ca_cert_path: Some(ca_path.display().to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        // Arrange phase — build BOTH clients first, each inside its own
        // seam guard scope (the guards must not nest); requests run
        // AFTER both scopes close, matching the isolation pattern of
        // the parity tests.
        //
        // CONTROL: forced fallback WITHOUT the rebuild-failure seam —
        // the normal fallback build honors ca_cert_path, so this client
        // carries the CA and verifies the server.
        let control = force_webpki_fallback(|| {
            build_client(&config, None).expect("control client must build") // allow-unwrap(test)
        });
        // EMERGENCY: both seams armed — the rebuild-failure
        // substitution drops the custom trust, leaving Mozilla roots
        // only.
        let client = force_webpki_fallback_rebuild_failure(|| {
            build_client(&config, None).expect("emergency client must build") // allow-unwrap(test)
        });

        // Assert phase — same server, and the ONLY delta between the
        // two clients is the rebuild-failure substitution: control
        // succeeds (positive control), emergency fails (causal trust
        // loss, not any incidental network condition).
        let control_resp = tokio::time::timeout(
            Duration::from_secs(15),
            control.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("the control client carries the CA — the CA-signed handshake must succeed"); // allow-unwrap(test)
        assert_eq!(control_resp.status().as_u16(), 200);

        let send_result = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout"); // allow-unwrap(test)
        assert!(
            send_result.is_err(),
            "the emergency client carries Mozilla roots only — the configured \
             CA trust is provably dropped, so the CA-signed handshake must fail"
        );

        // The rebuild terminal's system-broken error line is unchanged
        // by this change. Scope-filtered `logs_contain` (injected by
        // #[traced_test]) so sibling tests' events cannot pollute.
        assert!(
            logs_contain("webpki fallback client build failed — TLS stack broken process-wide"),
            "the rebuild-failure terminal must log the system-broken diagnosis"
        );

        server.abort();
    }

    #[tracing_test::traced_test]
    #[tokio::test]
    async fn tls_parity_nonstrict_itemwise_valid_ca_bad_identity() {
        let ca = gen_test_ca();
        let dir = tempfile::tempdir().expect("tempdir"); // allow-unwrap(test)
        let ca_path = dir.path().join("ca.pem");
        std::fs::write(&ca_path, ca.ca_pem.as_bytes()).expect("write ca pem"); // allow-unwrap(test)
        let (client_cert_pem, _client_key_pem) = gen_client_identity(&ca);
        let client_cert_path = dir.path().join("client-cert.pem");
        std::fs::write(&client_cert_path, client_cert_pem.as_bytes()).expect("write client cert"); // allow-unwrap(test)
        let (server_cert, server_key) =
            gen_leaf_signed_by_ca(&ca, "127.0.0.1".parse().expect("loopback ip")); // allow-unwrap(test)
        // No client-auth requirement: the identity item's fate is
        // client-side only.
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: false,
                ca_cert_path: Some(ca_path.display().to_string()),
                client_cert_path: Some(client_cert_path.display().to_string()),
                // UNREADABLE key path per the spec scenario: the mTLS
                // pair cannot load, so the identity item degrades.
                client_key_path: Some("/nonexistent/key.pem".to_string()),
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let resp = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout") // allow-unwrap(test)
        .expect("the valid CA item must be carried despite the unreadable key"); // allow-unwrap(test)
        assert_eq!(resp.status().as_u16(), 200);
        let body = resp.text().await.expect("response body"); // allow-unwrap(test)
        assert_eq!(body, "ok");

        // Item-wise degradation: the identity item warned and was
        // dropped; the CA item loaded cleanly — no Mozilla-roots
        // downgrade. Scope-filtered `logs_contain` (injected by
        // #[traced_test]) so sibling tests' events cannot pollute.
        assert!(
            logs_contain("client certificate NOT used"),
            "the unreadable key must degrade the identity item with the mTLS warn"
        );
        assert!(
            !logs_contain("falling back to bundled Mozilla roots"),
            "the CA loaded cleanly — the CA degrade warn must not fire"
        );

        server.abort();
    }

    #[tokio::test]
    async fn tls_parity_verifying_client_rejects_self_signed_without_insecure() {
        let (server_cert, server_key) = gen_self_signed_server_cert();
        let (addr, server) = spawn_tls_server(&server_cert, &server_key, None).await;

        // Strict, NO material, verification ON: the fallback trusts
        // only Mozilla roots, which cannot verify the self-signed
        // server — the control proving the two parity tests above pass
        // BECAUSE of the danger verifier, not because the harness
        // skips verification.
        let config = HttpConfig {
            tls: Some(TlsConfig {
                enabled: true,
                strict: true,
                ..Default::default()
            }),
            ..Default::default()
        };
        let client = build_under_seam(&config);

        let send_result = tokio::time::timeout(
            Duration::from_secs(15),
            client.get(format!("https://{addr}/")).send(),
        )
        .await
        .expect("request must complete within the harness timeout"); // allow-unwrap(test)
        assert!(
            send_result.is_err(),
            "a verifying client must reject the self-signed server at the handshake"
        );

        server.abort();
    }
}