daaki-message 0.2.0

#![allow(clippy::unwrap_used, clippy::expect_used)]

use super::*;

/// Test-only helper that folds before an oversized token without splitting it.
///
/// RFC 5322 Section 2.2.3 only permits folding at existing FWS boundaries, so
/// any internal splitting must stay outside the token itself.
fn force_fold_word(output: &mut Vec<u8>, bytes: &[u8], mut line_len: usize) -> usize {
    if line_len > 1 {
        output.extend_from_slice(b"\r\n ");
        line_len = 1;
    }
    output.extend_from_slice(bytes);
    line_len += bytes.len();
    line_len
}

/// Test-only infallible wrapper for focused header-folding unit tests.
fn write_header(output: &mut Vec<u8>, name: &str, value: &str) {
    try_write_header(output, name, value)
        .expect("test header values must satisfy RFC 5322 line-length limits");
}

/// Helper: create a `HeaderName` in test code (unchecked).
fn hdr(s: &str) -> HeaderName {
    HeaderName::new_unchecked(s)
}

/// Helper: create a message-ID string in test code.
fn mid(s: &str) -> String {
    s.to_owned()
}

fn make_email() -> OutgoingEmail {
    OutgoingEmail {
        from: vec![Address {
            name: Some("Sender".into()),
            email: "sender@example.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "to@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Test Subject".into(),
        body_text: None,
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    }
}

/// Helper: convert raw bytes to string for assertion.
fn raw_str(built: &BuiltMessage) -> String {
    String::from_utf8_lossy(&built.raw).into_owned()
}

#[test]
fn build_text_only() {
    let mut email = make_email();
    email.body_text = Some("Hello, World!".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("Content-Type: text/plain; charset=utf-8"));
    assert!(s.contains("Hello, World!"));
    assert!(s.contains("From: Sender <sender@example.com>"));
    assert!(s.contains("To: to@example.com"));
    assert!(s.contains("Subject: Test Subject"));
    assert!(s.contains("MIME-Version: 1.0"));
    assert!(s.contains("Date: "));
    assert!(s.contains("Message-ID: <"));
}

#[test]
fn build_html_only() {
    let mut email = make_email();
    email.body_html = Some("<h1>Hello</h1>".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("Content-Type: text/html; charset=utf-8"));
    assert!(s.contains("<h1>Hello</h1>"));
}

#[test]
fn build_text_and_html() {
    let mut email = make_email();
    email.body_text = Some("Plain text".into());
    email.body_html = Some("<p>HTML</p>".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("multipart/alternative"));
    assert!(s.contains("text/plain; charset=utf-8"));
    assert!(s.contains("text/html; charset=utf-8"));
    assert!(s.contains("Plain text"));
    assert!(s.contains("<p>HTML</p>"));
    // text/plain should come before text/html (RFC 2046 Section 5.1.4)
    let plain_pos = s.find("text/plain").unwrap();
    let html_pos = s.find("text/html").unwrap();
    assert!(plain_pos < html_pos);
}

#[test]
fn build_with_attachment() {
    let mut email = make_email();
    email.body_text = Some("See attached".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "test.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"fake pdf data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("multipart/mixed"));
    assert!(s.contains("Content-Type: application/pdf"));
    assert!(s.contains("Content-Disposition: attachment; filename=\"test.pdf\""));
    assert!(s.contains("Content-Transfer-Encoding: base64"));
}

/// RFC 2387: inline attachments with Content-ID must be wrapped in
/// `multipart/related` with the HTML body they reference, not placed
/// as siblings in `multipart/mixed`.
#[test]
fn build_inline_image_uses_multipart_related() {
    let mut email = make_email();
    email.body_html = Some("<img src=\"cid:logo@example.com\">".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "logo.png".into(),
        content_type: "image/png".into(),
        data: b"PNG data".to_vec(),
        is_inline: true,
        content_id: Some("logo@example.com".into()),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("multipart/related"),
        "inline images with Content-ID must be in multipart/related (RFC 2387): {s}"
    );
}

/// RFC 2387: when inline and regular attachments coexist, the structure
/// must be multipart/mixed containing a multipart/related (with HTML +
/// inline images) and the regular attachment as a sibling.
#[test]
fn build_mixed_inline_and_regular_attachments() {
    let mut email = make_email();
    email.body_html = Some("<img src=\"cid:logo@example.com\">".into());
    email.attachments = vec![
        OutgoingAttachment {
            filename: "logo.png".into(),
            content_type: "image/png".into(),
            data: b"PNG data".to_vec(),
            is_inline: true,
            content_id: Some("logo@example.com".into()),
        },
        OutgoingAttachment {
            filename: "report.pdf".into(),
            content_type: "application/pdf".into(),
            data: b"PDF data".to_vec(),
            is_inline: false,
            content_id: None,
        },
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("multipart/mixed"),
        "mixed inline + regular attachments needs multipart/mixed: {s}"
    );
    assert!(
        s.contains("multipart/related"),
        "inline images must be in multipart/related (RFC 2387): {s}"
    );
}

/// RFC 2183 Section 2 / RFC 2392: inline attachments must emit
/// `Content-Disposition: inline` and a `Content-ID` header wrapped in
/// angle brackets.
#[test]
fn build_inline_attachment_with_content_id() {
    let mut email = make_email();
    email.body_html = Some("<img src=\"cid:img001@example.com\">".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "logo.png".into(),
        content_type: "image/png".into(),
        data: b"fake png data".to_vec(),
        is_inline: true,
        content_id: Some("img001@example.com".into()),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Disposition: inline; filename=\"logo.png\""),
        "inline disposition missing: {s}"
    );
    assert!(
        s.contains("Content-ID: <img001@example.com>"),
        "Content-ID header missing or not wrapped in angle brackets: {s}"
    );
}

/// RFC 2392 / RFC 5322 Section 3.6.4: caller input that already includes
/// angle brackets must be normalized to a single on-wire `Content-ID:
/// <...>` header, not double-wrapped as `<<...>>`.
#[test]
fn build_inline_attachment_normalizes_bracketed_content_id() {
    let mut email = make_email();
    email.body_html = Some("<img src=\"cid:img001@example.com\">".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "logo.png".into(),
        content_type: "image/png".into(),
        data: b"fake png data".to_vec(),
        is_inline: true,
        content_id: Some("<img001@example.com>".into()),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-ID: <img001@example.com>\r\n"),
        "Content-ID must be normalized to a single bracketed msg-id: {s}"
    );
    assert!(
        !s.contains("Content-ID: <<img001@example.com>>"),
        "Content-ID must not be double-wrapped: {s}"
    );
}

#[test]
fn build_text_html_attachments() {
    let mut email = make_email();
    email.body_text = Some("Text".into());
    email.body_html = Some("<b>HTML</b>".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "file.txt".into(),
        content_type: "text/plain".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Should have outer multipart/mixed and inner multipart/alternative
    assert!(s.contains("multipart/mixed"));
    assert!(s.contains("multipart/alternative"));
}

#[test]
fn build_no_body() {
    let email = make_email();
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Should still have a text/plain content type
    assert!(s.contains("Content-Type: text/plain; charset=utf-8"));
}

#[test]
fn build_bcc_not_in_headers() {
    let mut email = make_email();
    email.bcc = vec![Address {
        name: None,
        email: "hidden@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // BCC must NOT appear in headers (RFC 5322 Section 3.6.3)
    assert!(!s.contains("Bcc:"));
    assert!(!s.contains("hidden@example.com"));
}

#[test]
fn build_bcc_in_envelope() {
    let mut email = make_email();
    email.bcc = vec![Address {
        name: None,
        email: "hidden@example.com".into(),
    }];

    let built = build_message(&email).unwrap();

    // BCC must be in envelope recipients
    assert!(built
        .envelope_recipients
        .contains(&"hidden@example.com".to_string()));
    assert!(built
        .envelope_recipients
        .contains(&"to@example.com".to_string()));
}

#[test]
fn build_message_id_format() {
    let email = make_email();
    let built = build_message(&email).unwrap();

    // Message-ID should be hex@domain
    assert!(built.message_id.contains('@'));
    assert!(built.message_id.ends_with("example.com"));

    // Should appear in headers with angle brackets
    let s = raw_str(&built);
    assert!(s.contains(&format!("Message-ID: <{}>", built.message_id)));
}

#[test]
fn build_threading_headers() {
    let mut email = make_email();
    email.in_reply_to = vec![mid("parent@host.com")];
    email.references = vec![mid("root@host.com"), mid("parent@host.com")];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("In-Reply-To: <parent@host.com>"));
    assert!(s.contains("References: <root@host.com> <parent@host.com>"));
}

/// If the caller accidentally passes already-bracketed message-IDs,
/// the builder must strip them before wrapping — not produce `<<id>>` which
/// violates RFC 5322 Section 3.6.4 (msg-id = "<" addr-spec ">").
#[test]
fn build_threading_headers_already_bracketed() {
    let mut email = make_email();
    email.in_reply_to = vec![mid("<parent@host.com>")];
    email.references = vec![mid("<root@host.com>"), mid("<parent@host.com>")];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must NOT double-wrap
    assert!(
        !s.contains("<<"),
        "Double angle brackets found in headers: {s}"
    );
    assert!(s.contains("In-Reply-To: <parent@host.com>"));
    assert!(s.contains("References: <root@host.com> <parent@host.com>"));
}

#[test]
fn build_invalid_address_error() {
    let mut email = make_email();
    email.from[0].email = "not-an-email".into();

    let result = build_message(&email);
    assert!(matches!(result, Err(Error::InvalidAddress(_))));
}

#[test]
fn build_empty_address_error() {
    let mut email = make_email();
    email.from[0].email = String::new();

    let result = build_message(&email);
    assert!(matches!(result, Err(Error::InvalidAddress(_))));
}

#[test]
fn build_invalid_mime_fallback() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "file.bin".into(),
        content_type: "not_a_valid_mime".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Should fall back to application/octet-stream
    assert!(s.contains("Content-Type: application/octet-stream"));
}

#[test]
fn build_reply_to() {
    let mut email = make_email();
    email.reply_to = vec![Address {
        name: Some("Reply".into()),
        email: "reply@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("Reply-To: Reply <reply@example.com>"));
}

/// RFC 5322 Section 3.6 field occurrence table: destination fields are
/// optional, so a draft-like message with no `To`, `Cc`, or `Bcc` is
/// still syntactically valid.
#[test]
fn build_no_destination_headers_is_valid() {
    let mut email = make_email();
    email.to.clear();
    email.body_text = Some("draft body".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(!s.contains("\r\nTo:"));
    assert!(!s.contains("\r\nCc:"));
    assert!(!s.contains("\r\nBcc:"));
    assert!(built.envelope_recipients.is_empty());
}

#[test]
fn build_cc_in_headers_and_envelope() {
    let mut email = make_email();
    email.cc = vec![Address {
        name: None,
        email: "cc@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("Cc: cc@example.com"));
    assert!(built
        .envelope_recipients
        .contains(&"cc@example.com".to_string()));
}

#[test]
fn build_attachment_base64_line_wrapping() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    // Create data that produces base64 longer than 76 chars
    email.attachments = vec![OutgoingAttachment {
        filename: "big.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![0xAB; 100],
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Find base64 lines after Content-Transfer-Encoding: base64
    let after_b64_header = s.find("Content-Transfer-Encoding: base64").unwrap();
    let body_section = &s[after_b64_header..];
    // Check that no line exceeds 78 chars (76 + \r\n)
    for line in body_section.split("\r\n") {
        if !line.is_empty() && !line.starts_with("--") && !line.contains(':') {
            assert!(
                line.len() <= 76,
                "Base64 line too long ({} chars): {line}",
                line.len()
            );
        }
    }
}

#[test]
fn message_id_domain_fallback() {
    let mut email = make_email();
    email.from[0].email = "local-only@".into();
    // Should fail validation due to empty domain
    assert!(build_message(&email).is_err());
}

#[test]
fn round_trip_build_then_parse() {
    let mut email = make_email();
    email.body_text = Some("Round-trip test body".into());
    email.body_html = Some("<p>Round-trip HTML</p>".into());
    email.in_reply_to = vec![mid("parent@host.com")];
    email.references = vec![mid("root@host.com"), mid("parent@host.com")];
    email.cc = vec![Address {
        name: Some("CC User".into()),
        email: "cc@example.com".into(),
    }];

    let built = build_message(&email).unwrap();

    // Parse the built message
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.from[0].email, "sender@example.com");
    assert_eq!(parsed.from[0].name.as_deref(), Some("Sender"));
    assert_eq!(parsed.to.len(), 1);
    assert_eq!(parsed.to[0].email, "to@example.com");
    assert_eq!(parsed.cc.len(), 1);
    assert_eq!(parsed.cc[0].email, "cc@example.com");
    assert_eq!(parsed.subject.as_deref(), Some("Test Subject"));
    assert_eq!(
        parsed.message_id.as_deref(),
        Some(built.message_id.as_str())
    );
    assert_eq!(parsed.in_reply_to, vec!["parent@host.com"]);
    assert_eq!(parsed.references, vec!["root@host.com", "parent@host.com"]);
    assert_eq!(parsed.body_text.as_deref(), Some("Round-trip test body"));
    assert_eq!(parsed.body_html.as_deref(), Some("<p>Round-trip HTML</p>"));
    assert!(parsed.date.is_some());
}

#[test]
fn message_id_is_crypto_random() {
    // Generate two Message-IDs and verify they're different (crypto-random)
    let email = make_email();
    let built1 = build_message(&email).unwrap();
    let built2 = build_message(&email).unwrap();
    assert_ne!(built1.message_id, built2.message_id);

    // Verify hex format: should be 32 hex chars + @ + domain
    let at_pos = built1.message_id.find('@').unwrap();
    let hex_part = &built1.message_id[..at_pos];
    assert_eq!(hex_part.len(), 32);
    assert!(hex_part.chars().all(|c| c.is_ascii_hexdigit()));
}

#[test]
fn build_bcc_only_recipients() {
    // BCC-only: no To/Cc — should succeed with bcc in envelope only
    let mut email = make_email();
    email.to.clear();
    email.bcc = vec![Address {
        name: None,
        email: "hidden@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // No To header
    assert!(!s.contains("\r\nTo:"));
    // BCC must NOT appear in headers
    assert!(!s.contains("Bcc:"));
    assert!(!s.contains("hidden@example.com"));
    // But must be in envelope
    assert_eq!(built.envelope_recipients, vec!["hidden@example.com"]);
}

#[test]
fn build_round_trip_with_attachments() {
    let mut email = make_email();
    email.body_text = Some("Text body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "test.txt".into(),
        content_type: "text/plain".into(),
        data: b"attachment data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.body_text.as_deref(), Some("Text body"));
    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(parsed.attachments[0].filename.as_deref(), Some("test.txt"));
}

#[test]
fn build_html_only_with_attachments() {
    let mut email = make_email();
    email.body_html = Some("<p>Hello</p>".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "data.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![1, 2, 3],
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Should have outer multipart/mixed
    assert!(s.contains("multipart/mixed"));
    assert!(s.contains("text/html; charset=utf-8"));
    assert!(s.contains("<p>Hello</p>"));
    assert!(s.contains("Content-Disposition: attachment; filename=\"data.bin\""));
}

#[test]
fn build_whitespace_in_address_rejected() {
    let mut email = make_email();
    email.to = vec![Address {
        name: None,
        email: "bad user@example.com".into(),
    }];

    let result = build_message(&email);
    assert!(matches!(result, Err(Error::InvalidAddress(_))));
}

#[test]
fn build_control_char_in_address_rejected() {
    let mut email = make_email();
    email.to = vec![Address {
        name: None,
        email: "user\x00@example.com".into(),
    }];

    let result = build_message(&email);
    assert!(matches!(result, Err(Error::InvalidAddress(_))));
}

#[test]
fn build_envelope_contains_all_recipients() {
    let mut email = make_email();
    email.to = vec![Address {
        name: None,
        email: "to@x.com".into(),
    }];
    email.cc = vec![Address {
        name: None,
        email: "cc@x.com".into(),
    }];
    email.bcc = vec![Address {
        name: None,
        email: "bcc@x.com".into(),
    }];

    let built = build_message(&email).unwrap();
    assert_eq!(built.envelope_recipients.len(), 3);
    assert!(built.envelope_recipients.contains(&"to@x.com".to_string()));
    assert!(built.envelope_recipients.contains(&"cc@x.com".to_string()));
    assert!(built.envelope_recipients.contains(&"bcc@x.com".to_string()));
}

#[test]
fn build_message_has_crlf_line_endings() {
    let mut email = make_email();
    email.body_text = Some("Hello".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // All header lines should end with \r\n
    for line in s.split("\r\n") {
        assert!(
            !line.contains('\n') || line.is_empty(),
            "bare LF found in line: {line:?}"
        );
    }
}

/// Body text containing bare LF (`\n`) must be normalized
/// to CRLF (`\r\n`) per RFC 5322 Section 2.1.
#[test]
fn build_body_bare_lf_normalized_to_crlf() {
    let mut email = make_email();
    email.body_text = Some("Line 1\nLine 2\nLine 3".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The body must not contain bare LF — all newlines should be CRLF
    for line in s.split("\r\n") {
        assert!(
            !line.contains('\n') || line.is_empty(),
            "bare LF found in output: {line:?}"
        );
    }
    // Verify the content is preserved
    assert!(s.contains("Line 1\r\nLine 2\r\nLine 3"));
}

/// HTML body with bare LF must also be normalized to CRLF.
#[test]
fn build_html_body_bare_lf_normalized_to_crlf() {
    let mut email = make_email();
    email.body_html = Some("<p>Line 1</p>\n<p>Line 2</p>".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    for line in s.split("\r\n") {
        assert!(
            !line.contains('\n') || line.is_empty(),
            "bare LF found in HTML output: {line:?}"
        );
    }
}

/// Body with mixed line endings (\r\n and \n) must normalize all.
#[test]
fn build_body_mixed_line_endings_normalized() {
    let mut email = make_email();
    email.body_text = Some("CRLF line\r\nLF line\nAnother LF\n".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    for line in s.split("\r\n") {
        assert!(
            !line.contains('\n') || line.is_empty(),
            "bare LF in mixed-endings output: {line:?}"
        );
    }
}

#[test]
fn build_empty_attachment_data() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "empty.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![],
        is_inline: false,
        content_id: None,
    }];

    // Should succeed even with empty attachment data
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(s.contains("Content-Disposition: attachment; filename=\"empty.bin\""));
}

#[test]
fn build_multiple_attachments() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![
        OutgoingAttachment {
            filename: "a.pdf".into(),
            content_type: "application/pdf".into(),
            data: b"pdf data".to_vec(),
            is_inline: false,
            content_id: None,
        },
        OutgoingAttachment {
            filename: "b.png".into(),
            content_type: "image/png".into(),
            data: b"png data".to_vec(),
            is_inline: false,
            content_id: None,
        },
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("filename=\"a.pdf\""));
    assert!(s.contains("filename=\"b.png\""));
    assert!(s.contains("Content-Type: application/pdf"));
    assert!(s.contains("Content-Type: image/png"));
}

#[test]
fn build_date_header_rfc5322_format() {
    let email = make_email();
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Find the Date header and verify format
    let date_line = s
        .lines()
        .find(|l| l.starts_with("Date: "))
        .expect("Date header missing");
    // Should contain day-of-week abbreviation
    let dow_names = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
    assert!(
        dow_names.iter().any(|d| date_line.contains(d)),
        "Date header missing day-of-week: {date_line}"
    );
    // Should end with timezone offset
    assert!(
        date_line.contains("+0000"),
        "Date header missing timezone: {date_line}"
    );
}

/// RFC 5322 Section 3.6.1: when `OutgoingEmail.date` is `Some(...)`,
/// the builder must use that exact date instead of `DateTime::now()`.
#[test]
fn build_custom_date_honored() {
    let mut email = make_email();
    email.date = Some(crate::types::DateTime {
        year: 2020,
        month: 6,
        day: 15,
        hour: 10,
        minute: 30,
        second: 0,
        tz_offset_minutes: -300, // -0500
    });
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    let date_line = s
        .lines()
        .find(|l| l.starts_with("Date: "))
        .expect("Date header missing");
    assert_eq!(
        date_line, "Date: Mon, 15 Jun 2020 10:30:00 -0500",
        "builder must use the caller-supplied date"
    );
}

// -----------------------------------------------------------------------
// Additional edge case tests
// -----------------------------------------------------------------------

#[test]
fn build_unicode_subject() {
    let mut email = make_email();
    email.subject = "Héllo Wörld 你好 🌍".into();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Subject must be RFC 2047 encoded, not raw UTF-8 (RFC 5322 Section 2.2)
    let header_section = s.split("\r\n\r\n").next().unwrap();
    assert!(
        header_section.is_ascii(),
        "Headers must be pure ASCII per RFC 5322 Section 2.2"
    );
    assert!(s.contains("=?UTF-8?B?"));

    // Must round-trip through parse
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(parsed.subject.as_deref(), Some("Héllo Wörld 你好 🌍"));
}

#[test]
/// Non-ASCII display names must be RFC 2047 encoded in the raw
/// message headers (RFC 5322 Section 2.2, RFC 2047 Section 5). The parser
/// must decode them back to the original name.
fn build_unicode_display_name() {
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("José García".into()),
        email: "jose@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Raw headers must be pure ASCII (RFC 5322 Section 2.2)
    let header_section = s.split("\r\n\r\n").next().unwrap();
    assert!(
        header_section.is_ascii(),
        "Headers must be pure ASCII per RFC 5322 Section 2.2, \
         but found non-ASCII in: {header_section}"
    );

    // Round-trip: parser must decode the display name back
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(parsed.from[0].name.as_deref(), Some("José García"));
    assert_eq!(parsed.from[0].email, "jose@example.com");
}

#[test]
fn build_empty_subject() {
    let mut email = make_email();
    email.subject = String::new();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("Subject: \r\n"));
}

#[test]
fn build_special_chars_in_filename() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "my file (1).pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("filename=\"my file (1).pdf\""));
}

/// Non-ASCII filenames must be encoded using RFC 2231
/// parameter encoding (`filename*=UTF-8''percent-encoded`), not raw
/// UTF-8 bytes in a quoted-string. The parser must round-trip the
/// encoded filename back to the original.
#[test]
fn build_non_ascii_filename_rfc2231_encoded() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "résumé.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must use RFC 2231 encoding for non-ASCII filename
    assert!(
        s.contains("filename*=UTF-8''"),
        "Non-ASCII filename must use RFC 2231 encoding, got: {s}"
    );

    // Round-trip: parser should decode the RFC 2231 filename back
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some("résumé.pdf")
    );
}

/// Non-ASCII filenames must include a legacy `filename`
/// parameter alongside `filename*` for backward compatibility with older
/// email clients that don't support RFC 2231 (RFC 2231 Section 5).
#[test]
fn build_non_ascii_filename_includes_legacy_fallback() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "résumé.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must have RFC 2231 encoded filename*
    assert!(
        s.contains("filename*=UTF-8''"),
        "Missing RFC 2231 filename*: {s}"
    );

    // Must ALSO have legacy filename= fallback for older clients
    // (RFC 2231 Section 5 — dual parameter approach)
    assert!(
        s.contains("filename=\""),
        "Missing legacy filename fallback for non-ASCII attachment: {s}"
    );
}

#[test]
fn build_multiple_bcc_all_excluded() {
    let mut email = make_email();
    email.bcc = vec![
        Address {
            name: None,
            email: "bcc1@example.com".into(),
        },
        Address {
            name: None,
            email: "bcc2@example.com".into(),
        },
        Address {
            name: Some("BCC Three".into()),
            email: "bcc3@example.com".into(),
        },
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // None of the BCC addresses should appear in headers (RFC 5322 Section 3.6.3)
    assert!(!s.contains("bcc1@example.com"));
    assert!(!s.contains("bcc2@example.com"));
    assert!(!s.contains("bcc3@example.com"));
    assert!(!s.contains("BCC Three"));
    assert!(!s.contains("Bcc:"));

    // But all should be in envelope
    assert_eq!(built.envelope_recipients.len(), 4); // 1 To + 3 BCC
    assert!(built
        .envelope_recipients
        .contains(&"bcc1@example.com".to_string()));
    assert!(built
        .envelope_recipients
        .contains(&"bcc2@example.com".to_string()));
    assert!(built
        .envelope_recipients
        .contains(&"bcc3@example.com".to_string()));
}

#[test]
fn build_from_without_display_name() {
    let mut email = make_email();
    email.from = vec![Address {
        name: None,
        email: "plain@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Should be bare email without angle brackets
    assert!(s.contains("From: plain@example.com\r\n"));
}

#[test]
fn build_all_recipient_types_together() {
    let mut email = make_email();
    email.to = vec![
        Address {
            name: Some("To One".into()),
            email: "to1@x.com".into(),
        },
        Address {
            name: None,
            email: "to2@x.com".into(),
        },
    ];
    email.cc = vec![Address {
        name: Some("CC One".into()),
        email: "cc1@x.com".into(),
    }];
    email.bcc = vec![Address {
        name: None,
        email: "bcc1@x.com".into(),
    }];
    email.reply_to = vec![Address {
        name: None,
        email: "reply@x.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("To: To One <to1@x.com>, to2@x.com"));
    assert!(s.contains("Cc: CC One <cc1@x.com>"));
    assert!(s.contains("Reply-To: reply@x.com"));
    assert!(!s.contains("Bcc:"));
    assert_eq!(built.envelope_recipients.len(), 4);
}

#[test]
fn build_large_attachment_base64() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    // 1000 bytes of data → base64 should be properly line-wrapped
    email.attachments = vec![OutgoingAttachment {
        filename: "large.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![0x42; 1000],
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Find base64 content and check all lines are ≤76 chars
    let b64_header = "Content-Transfer-Encoding: base64\r\n\r\n";
    let b64_start = s.find(b64_header).unwrap() + b64_header.len();
    let b64_end = s[b64_start..].find("\r\n--").unwrap_or(s.len() - b64_start);
    let b64_block = &s[b64_start..b64_start + b64_end];

    for line in b64_block.split("\r\n") {
        if !line.is_empty() {
            assert!(
                line.len() <= 76,
                "Base64 line exceeds 76 chars ({} chars): {}",
                line.len(),
                line
            );
        }
    }
}

#[test]
fn build_round_trip_text_html_attachments() {
    // Full round-trip: build a complex message and verify it parses back
    let mut email = make_email();
    email.subject = "Complex message".into();
    email.body_text = Some("Plain text part".into());
    email.body_html = Some("<h1>HTML part</h1>".into());
    email.in_reply_to = vec![mid("parent-id@example.com")];
    email.references = vec![mid("root@example.com"), mid("parent-id@example.com")];
    email.cc = vec![Address {
        name: Some("CC User".into()),
        email: "cc@example.com".into(),
    }];
    email.attachments = vec![
        OutgoingAttachment {
            filename: "doc.pdf".into(),
            content_type: "application/pdf".into(),
            data: b"pdf content".to_vec(),
            is_inline: false,
            content_id: None,
        },
        OutgoingAttachment {
            filename: "img.png".into(),
            content_type: "image/png".into(),
            data: b"png content".to_vec(),
            is_inline: false,
            content_id: None,
        },
    ];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.subject.as_deref(), Some("Complex message"));
    assert_eq!(parsed.from[0].email, "sender@example.com");
    assert_eq!(parsed.to.len(), 1);
    assert_eq!(parsed.cc.len(), 1);
    assert_eq!(
        parsed.message_id.as_deref(),
        Some(built.message_id.as_str())
    );
    assert_eq!(parsed.in_reply_to, vec!["parent-id@example.com"]);
    assert_eq!(
        parsed.references,
        vec!["root@example.com", "parent-id@example.com"]
    );
    assert_eq!(parsed.body_text.as_deref(), Some("Plain text part"));
    assert_eq!(parsed.body_html.as_deref(), Some("<h1>HTML part</h1>"));
    assert_eq!(parsed.attachments.len(), 2);
    assert_eq!(parsed.attachments[0].filename.as_deref(), Some("doc.pdf"));
    assert_eq!(parsed.attachments[1].filename.as_deref(), Some("img.png"));
}

#[test]
fn build_message_id_fallback_domain() {
    // Test that domain extraction works correctly
    assert_eq!(extract_domain("user@example.com"), Some("example.com"));
    assert_eq!(
        extract_domain("user@sub.domain.org"),
        Some("sub.domain.org")
    );
    assert_eq!(extract_domain("user@"), None);
    assert_eq!(extract_domain("no-at-sign"), None);
}

#[test]
fn build_no_body_with_attachments() {
    // No body text/html but has attachments — should get empty text/plain + attachment
    let mut email = make_email();
    email.attachments = vec![OutgoingAttachment {
        filename: "data.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![1, 2, 3],
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(s.contains("multipart/mixed"));
    assert!(s.contains("text/plain; charset=utf-8"));
    assert!(s.contains("Content-Disposition: attachment; filename=\"data.bin\""));
}

#[test]
fn build_multiple_mime_type_fallbacks() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![
        OutgoingAttachment {
            filename: "a.bin".into(),
            content_type: String::new(), // empty
            data: b"data".to_vec(),
            is_inline: false,
            content_id: None,
        },
        OutgoingAttachment {
            filename: "b.bin".into(),
            content_type: "no-slash".into(), // no slash
            data: b"data".to_vec(),
            is_inline: false,
            content_id: None,
        },
        OutgoingAttachment {
            filename: "c.bin".into(),
            content_type: "/subtype".into(), // empty type
            data: b"data".to_vec(),
            is_inline: false,
            content_id: None,
        },
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // All should fall back to application/octet-stream
    let count = s.matches("Content-Type: application/octet-stream").count();
    assert_eq!(count, 3, "Expected 3 fallback MIME types, got {count}");
}

#[test]
fn build_address_at_boundary_rejected() {
    // Address with @ at start or end
    let mut email = make_email();
    email.to = vec![Address {
        name: None,
        email: "@domain.com".into(),
    }];

    let result = build_message(&email);
    assert!(matches!(result, Err(Error::InvalidAddress(_))));

    let mut email2 = make_email();
    email2.to = vec![Address {
        name: None,
        email: "user@".into(),
    }];

    let result2 = build_message(&email2);
    assert!(matches!(result2, Err(Error::InvalidAddress(_))));
}

#[test]
fn mime_type_validation_subtype_chars() {
    // Valid MIME types
    assert!(is_valid_mime_type("application/pdf"));
    assert!(is_valid_mime_type("image/svg+xml"));
    assert!(is_valid_mime_type("application/vnd.ms-excel"));

    // RFC 2045 Section 5.1: token allows any ASCII char except SPACE, CTLs,
    // and tspecials. Underscore, bang, hash, etc. are valid token chars.
    assert!(
        is_valid_mime_type("application/x-my_type"),
        "underscore is a valid token char per RFC 2045 Section 5.1"
    );
    assert!(
        is_valid_mime_type("application/x-custom!type"),
        "bang is a valid token char per RFC 2045 Section 5.1"
    );

    // Invalid: tspecials in subtype (RFC 2045 Section 5.1)
    assert!(!is_valid_mime_type("text/plain; charset=utf-8"));
    assert!(!is_valid_mime_type("text/html@bad"));
    assert!(!is_valid_mime_type("text/html(bad)"));
}

#[test]
fn build_parameterized_mime_type_preserved() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "file.bin".into(),
        content_type: "application/pdf; extra=bad".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Type: application/pdf; extra=bad; name=\"file.bin\""),
        "valid Content-Type parameters must be preserved on attachment parts: {s}"
    );
    assert!(
        !s.contains("Content-Type: application/octet-stream"),
        "valid Content-Type parameters must not trigger octet-stream fallback: {s}"
    );
}

#[test]
fn build_invalid_parameterized_mime_fallback() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "file.bin".into(),
        content_type: "application/pdf; extra".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Type: application/octet-stream"),
        "malformed Content-Type parameters must still fall back safely: {s}"
    );
}

#[test]
fn build_display_name_with_comma_is_quoted() {
    // Display names with commas must be quoted (RFC 5322 Section 3.4)
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("Doe, John".into()),
        email: "john@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("From: \"Doe, John\" <john@example.com>"),
        "From header should quote display name with comma: {s}"
    );
}

#[test]
fn build_display_name_with_special_chars_is_quoted() {
    // Display names with RFC 5322 specials are quoted
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("O'Brien (test)".into()),
        email: "ob@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("\"O'Brien (test)\" <ob@example.com>"),
        "From header should quote display name with parens: {s}"
    );
}

#[test]
fn build_display_name_with_quotes_escaped() {
    // Double-quotes in display names must be backslash-escaped (RFC 5322 Section 3.2.4)
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("John \"Doc\" Doe".into()),
        email: "john@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("\"John \\\"Doc\\\" Doe\" <john@example.com>"),
        "From header should escape quotes in display name: {s}"
    );
}

#[test]
fn build_display_name_plain_not_quoted() {
    // Simple display names without specials should NOT be quoted
    let email = make_email();
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // "Sender" has no specials — should not be quoted
    assert!(
        s.contains("From: Sender <sender@example.com>"),
        "Simple display name should not be quoted: {s}"
    );
}

#[test]
fn build_round_trip_display_name_with_comma() {
    // Round-trip: build with comma in display name, parse it back
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("Doe, John".into()),
        email: "john@example.com".into(),
    }];
    email.body_text = Some("Body".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.from[0].name.as_deref(), Some("Doe, John"));
    assert_eq!(parsed.from[0].email, "john@example.com");
}

#[test]
fn build_round_trip_display_name_with_escaped_quotes() {
    // Round-trip: build with quotes in display name, parse it back
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("John \"Doc\" Doe".into()),
        email: "john@example.com".into(),
    }];
    email.body_text = Some("Body".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.from[0].name.as_deref(), Some("John \"Doc\" Doe"));
    assert_eq!(parsed.from[0].email, "john@example.com");
}

#[test]
fn build_attachment_filename_with_quotes_escaped() {
    // RFC 2183 Section 2 / RFC 5322 Section 3.2.4: quotes and backslashes
    // in filenames must be escaped within the quoted-string.
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "file\"name.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The quote inside the filename must be backslash-escaped
    assert!(
        s.contains(r#"filename="file\"name.pdf""#),
        "Filename with quote not properly escaped: {s}"
    );
}

#[test]
fn build_attachment_filename_with_backslash_escaped() {
    // RFC 5322 Section 3.2.4: backslash in quoted-string must be escaped
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "path\\file.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains(r#"filename="path\\file.pdf""#),
        "Filename with backslash not properly escaped: {s}"
    );
}

#[test]
fn build_long_subject_is_folded() {
    // RFC 5322 Section 2.2.3: folding is only permitted where FWS
    // appears in the grammar. A single 1000-char word has no internal
    // FWS, so it must be emitted as-is (possibly exceeding the 998-char
    // hard limit) rather than inserting spaces that would corrupt the
    // value. Receivers tolerate long lines per Postel's law
    // (RFC 1122 Section 1.2.2).
    let mut email = make_email();
    email.subject = "A".repeat(1000);

    let built = build_message(&email).unwrap();

    // The subject must round-trip without corruption.
    let parsed = crate::parse_email(&built.raw).unwrap();
    let parsed_subject = parsed.subject.unwrap();
    assert_eq!(
        parsed_subject, email.subject,
        "Single-word subject must round-trip without inserted spaces"
    );
}

#[test]
fn build_long_references_header_is_folded() {
    // Long References header with many message-ids
    let mut email = make_email();
    let ids: Vec<String> = (0..30)
        .map(|i| {
            mid(&format!(
                "id{i:04}@very-long-domain-name-for-testing.example.com"
            ))
        })
        .collect();
    email.references = ids;

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    for line in s.split("\r\n") {
        assert!(
            line.len() <= 998,
            "Line exceeds 998 chars ({} chars)",
            line.len()
        );
    }

    // The References header should still be parseable after folding
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(parsed.references.len(), 30);
}

// -----------------------------------------------------------------------
// UTF-8-safe long-subject encoding
// -----------------------------------------------------------------------

#[test]
fn build_force_fold_preserves_utf8_boundaries() {
    // A single word of 300 emoji (1200 bytes) exceeds the RFC 5322
    // Section 2.1.1 line limit, so the builder must switch to RFC 2047
    // encoded-words instead of splitting inside a UTF-8 code point.
    let mut email = make_email();
    // 300 emoji * 4 bytes = 1200 bytes.
    email.subject = "🌍".repeat(300);

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Every line must be valid UTF-8 on its own
    for (i, line) in s.split("\r\n").enumerate() {
        // Verify it's valid UTF-8 (raw_str already converted, but check
        // that no replacement characters were introduced by mid-char splits)
        assert!(
            !line.contains('\u{FFFD}'),
            "Line {i} contains UTF-8 replacement character from mid-char split: {line:?}"
        );
    }

    // The subject must round-trip exactly after RFC 2047 decoding.
    let parsed = crate::parse_email(&built.raw).unwrap();
    let parsed_subject = parsed.subject.unwrap();
    assert_eq!(
        parsed_subject, email.subject,
        "UTF-8 subject must round-trip exactly without inserted spaces"
    );
}

#[test]
fn split_header_words_handles_escaped_quotes() {
    // RFC 5322 Section 3.2.4: a backslash-escaped quote `\"` inside a
    // quoted-string must NOT toggle the in_quotes state. Without this
    // fix, `"A\" B" <a@b.com>` is split into `["\"A\\\"", "B\"",
    // "<a@b.com>"]` — breaking the quoted-string across words.
    let value = r#""A\" B" <a@b.com>"#;
    let words = split_header_words(value);
    // The entire display-name + angle-addr should produce exactly two
    // tokens: the quoted-string name and the angle-bracketed email.
    assert_eq!(
        words,
        (vec![(r#""A\" B""#, None), ("<a@b.com>", Some(" "))], None),
        "split_header_words must skip escaped quotes inside quoted-strings \
         per RFC 5322 Section 3.2.4"
    );
}

#[test]
fn spec_audit_split_header_words_backslash_multibyte_utf8() {
    // RFC 5322 Section 3.2.4: quoted-pair = "\" (VCHAR / WSP).
    // While the RFC only defines escaping for ASCII, user strings may
    // contain a backslash followed by a multi-byte UTF-8 character.
    // The old code did `i += 2` which only skips 2 bytes — but a 4-byte
    // emoji after the backslash means 3 bytes are left dangling, causing
    // byte-level misalignment and potential panics or incorrect splits.
    let value = r#""test\🌍 rest" after"#;
    let words = split_header_words(value);
    // The quoted string `"test\🌍 rest"` must stay as one token, and
    // `after` must be a separate token.
    assert_eq!(
        words,
        (
            vec![(r#""test\🌍 rest""#, None), ("after", Some(" "))],
            None
        ),
        "split_header_words must skip the full multi-byte UTF-8 character \
         after a backslash, not just 2 bytes (RFC 5322 Section 3.2.4)"
    );
}

#[test]
fn spec_audit_split_header_words_backslash_ascii_still_works() {
    // RFC 5322 Section 3.2.4: quoted-pair with ASCII character after
    // backslash — the normal case must continue to work after the fix.
    let value = r#""hello\" world" next"#;
    let words = split_header_words(value);
    assert_eq!(
        words,
        (
            vec![(r#""hello\" world""#, None), ("next", Some(" "))],
            None
        ),
        "split_header_words must handle backslash + ASCII in quoted-string \
         (RFC 5322 Section 3.2.4)"
    );
}

#[test]
fn spec_audit_split_header_words_backslash_2byte_utf8() {
    // RFC 5322 Section 3.2.4: backslash followed by a 2-byte UTF-8
    // character (e.g., U+00E9 'é' = 0xC3 0xA9). The old `i += 2` code
    // happens to work here by accident, but the fix should handle it
    // correctly via proper char-length detection.
    let value = "\"test\\é more\" end";
    let words = split_header_words(value);
    assert_eq!(
        words,
        (vec![("\"test\\é more\"", None), ("end", Some(" "))], None),
        "split_header_words must handle backslash + 2-byte UTF-8 char \
         (RFC 5322 Section 3.2.4)"
    );
}

#[test]
fn spec_audit_split_header_words_backslash_3byte_utf8() {
    // RFC 5322 Section 3.2.4: backslash followed by a 3-byte UTF-8
    // character (e.g., U+4E16 '世' = 0xE4 0xB8 0x96). The old `i += 2`
    // skips only 2 of 3 bytes, causing misalignment.
    let value = "\"test\\世 more\" end";
    let words = split_header_words(value);
    assert_eq!(
        words,
        (vec![("\"test\\世 more\"", None), ("end", Some(" "))], None),
        "split_header_words must handle backslash + 3-byte UTF-8 char \
         (RFC 5322 Section 3.2.4)"
    );
}

#[test]
fn build_crlf_in_display_name_stripped() {
    // CRLF in a display name must not inject headers
    // (RFC 5322 Section 2.1/2.2 — header injection prevention).
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("evil\r\nBcc: injected@evil.com".into()),
        email: "sender@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The CRLF must be stripped — no injected header line starting with "Bcc:"
    assert!(
        !s.contains("\r\nBcc:"),
        "CRLF in display name must not inject headers: {s}"
    );
    // The injected address must not appear in envelope recipients
    assert!(
        !built
            .envelope_recipients
            .contains(&"injected@evil.com".to_string()),
        "Injected address must not appear in envelope"
    );
}

#[test]
fn build_crlf_in_subject_stripped() {
    // CRLF in subject must not inject headers.
    let mut email = make_email();
    email.subject = "Test\r\nBcc: injected@evil.com".into();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The CRLF must be stripped — no injected header line
    assert!(
        !s.contains("\r\nBcc:"),
        "CRLF in subject must not inject headers: {s}"
    );
}

#[test]
fn build_bare_lf_in_display_name_stripped() {
    // bare LF in a display name must not inject headers
    // (some servers treat bare LF as line ending).
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("evil\nBcc: injected@evil.com".into()),
        email: "sender@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // No bare-LF-injected header line
    assert!(
        !s.contains("\nBcc:"),
        "Bare LF in display name must not inject headers: {s}"
    );
}

#[test]
fn build_crlf_in_references_stripped() {
    // CRLF in references must not inject headers.
    let mut email = make_email();
    email.references = vec![mid("root@host.com\r\nBcc: injected@evil.com")];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // No CRLF-injected header line
    assert!(
        !s.contains("\r\nBcc:"),
        "CRLF in references must not inject headers: {s}"
    );
}

#[test]
fn build_round_trip_escaped_quote_name_long_header() {
    // Build a message with an escaped-quote display name long enough to
    // trigger header folding, then parse it back. The fold must not
    // split inside the quoted-string.
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("A\" B".into()),
        email: "user@very-long-domain-name-that-pushes-header-over-78-chars.example.com".into(),
    }];
    email.body_text = Some("Body".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(
        parsed.from[0].name.as_deref(),
        Some("A\" B"),
        "Display name with escaped quote must survive folding round-trip"
    );
}

/// `normalize_line_endings` was processing bytes individually
/// with `bytes[i] as char`, which treats each byte of a multi-byte UTF-8
/// sequence as a separate Latin-1 character. This corrupts any non-ASCII
/// text in the email body (e.g., "é" → "é").
///
/// RFC 5322 Section 2.1 requires CRLF line endings, but the normalization
/// must preserve UTF-8 character integrity (RFC 6532). The builder now
/// uses quoted-printable for non-ASCII bodies, so we verify the original
/// text survives a build -> parse round-trip.
#[test]
fn build_non_ascii_body_preserved() {
    let mut email = make_email();
    let body = "Héllo, José! Ñoño. 日本語テスト";
    email.body_text = Some(body.into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(body),
        "Non-ASCII UTF-8 body text must round-trip through QP encoding"
    );
}

/// Non-ASCII characters in HTML bodies must also survive
/// quoted-printable encoding without corruption.
#[test]
fn build_non_ascii_html_body_preserved() {
    let mut email = make_email();
    let html = "<p>Ünïcödé résumé</p>";
    email.body_html = Some(html.into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_html.as_deref(),
        Some(html),
        "Non-ASCII UTF-8 HTML body must round-trip through QP encoding"
    );
}

/// Non-ASCII in multipart text parts (text+html+attachments)
/// must survive quoted-printable encoding.
#[test]
fn build_non_ascii_multipart_body_preserved() {
    let mut email = make_email();
    let text = "Café";
    let html = "<b>Café</b>";
    email.body_text = Some(text.into());
    email.body_html = Some(html.into());
    email.attachments = vec![OutgoingAttachment {
        filename: "test.txt".into(),
        content_type: "text/plain".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(text),
        "Non-ASCII in multipart text must round-trip through QP encoding"
    );
    assert_eq!(
        parsed.body_html.as_deref(),
        Some(html),
        "Non-ASCII in multipart HTML must round-trip through QP encoding"
    );
}

/// Non-ASCII Subject must be RFC 2047 encoded in the raw
/// message headers (RFC 5322 Section 2.2 — field bodies must be US-ASCII;
/// RFC 2047 provides the encoding mechanism for non-ASCII text).
/// The parser must decode it back to the original text.
#[test]
fn build_non_ascii_subject_rfc2047_round_trip() {
    let mut email = make_email();
    email.subject = "Héllo Wörld".into();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Raw headers must NOT contain raw non-ASCII bytes — they must be
    // RFC 2047 encoded (RFC 5322 Section 2.2).
    let header_section = s.split("\r\n\r\n").next().unwrap();
    assert!(
        header_section.is_ascii(),
        "Headers must be pure ASCII per RFC 5322 Section 2.2, \
         but found non-ASCII in: {header_section}"
    );

    // The Subject header must contain RFC 2047 encoded word(s)
    assert!(
        s.contains("=?UTF-8?B?"),
        "Subject must be RFC 2047 B-encoded, got: {s}"
    );

    // Round-trip: parser must decode it back
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.subject.as_deref(),
        Some("Héllo Wörld"),
        "Subject must round-trip through RFC 2047 encoding"
    );
}

/// body text with lines exceeding 998 characters must use
/// `Content-Transfer-Encoding: quoted-printable` instead of `8bit` to
/// comply with RFC 2045 Section 2.8 and RFC 5322 Section 2.1.1.
#[test]
fn build_long_body_line_uses_quoted_printable() {
    let mut email = make_email();
    // Single line > 998 characters — violates RFC 5322 Section 2.1.1
    let long_line = "A".repeat(1200);
    email.body_text = Some(long_line.clone());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must use quoted-printable, not 8bit
    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Long body lines must trigger quoted-printable encoding \
         (RFC 2045 Section 2.8), but got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 8bit"),
        "8bit encoding must not be used when body has lines > 998 chars"
    );

    // No line in the output should exceed 998 characters
    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998 chars ({} chars): {}...",
            line.len(),
            &line[..80.min(line.len())]
        );
    }

    // Round-trip: parse the built message and verify body text matches
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(long_line.as_str()),
        "Body text must round-trip through quoted-printable encoding"
    );
}

/// Verify that short pure-ASCII body lines use `7bit` encoding (no
/// unnecessary overhead from quoted-printable).
#[test]
fn build_normal_body_line_uses_7bit() {
    let mut email = make_email();
    email.body_text = Some("Short line, well under 998 chars.".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "Short body lines should use 7bit encoding, got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Short body lines should not use quoted-printable"
    );
}

/// A body line of exactly 998 characters is at the RFC 5322 Section 2.1.1
/// hard limit. Pure ASCII with lines <= 998 uses `7bit` CTE — no need for
/// quoted-printable overhead.
///
/// RFC 2045 Section 2.7, RFC 5322 Section 2.1.1
#[test]
fn build_body_line_exactly_998_chars_uses_7bit() {
    let mut email = make_email();
    // Exactly 998 characters — right at the HARD_LINE_LIMIT boundary
    let boundary_line = "B".repeat(998);
    email.body_text = Some(boundary_line.clone());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "A 998-char pure ASCII line is within the RFC 5322 Section 2.1.1 limit \
         and must use 7bit encoding, got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: quoted-printable"),
        "A 998-char line must not trigger quoted-printable encoding"
    );

    // No output line should exceed 998 characters
    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998 chars ({} chars): {}...",
            line.len(),
            &line[..80.min(line.len())]
        );
    }

    // Round-trip: parse and verify body text preserved
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(boundary_line.as_str()),
        "Body text must round-trip through 7bit encoding"
    );
}

/// A body line of exactly 999 characters exceeds the RFC 5322 Section 2.1.1
/// hard limit of 998 and must use `Content-Transfer-Encoding: quoted-printable`
/// to ensure all output lines comply with RFC 2045 Section 2.8.
#[test]
fn build_body_line_exactly_999_chars_uses_quoted_printable() {
    let mut email = make_email();
    // 999 characters — one past the HARD_LINE_LIMIT boundary
    let over_line = "C".repeat(999);
    email.body_text = Some(over_line.clone());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must use quoted-printable, not 8bit
    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "A 999-char line exceeds the RFC 5322 Section 2.1.1 limit \
         and must trigger quoted-printable encoding, got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 8bit"),
        "8bit encoding must not be used when a body line exceeds 998 chars"
    );

    // No output line should exceed 998 characters
    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998 chars ({} chars): {}...",
            line.len(),
            &line[..80.min(line.len())]
        );
    }

    // Round-trip: parse and verify body text preserved
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(over_line.as_str()),
        "Body text must round-trip through quoted-printable encoding"
    );
}

/// `generate_boundary_not_in` must return a boundary that does
/// not appear in the supplied content. RFC 2046 Section 5.1.1 says:
/// "The boundary delimiter MUST NOT appear within the encapsulated material."
#[test]
fn generate_boundary_not_in_avoids_collision() {
    // Generate a boundary and embed it in "content"
    let first = generate_boundary();
    let content = format!("Some text before\r\n--{first}\r\nSome text after");

    // generate_boundary_not_in must return a boundary different from `first`
    let second = generate_boundary_not_in(content.as_bytes());
    assert_ne!(
        first, second,
        "generate_boundary_not_in must produce a boundary that \
         differs from one already present in the content"
    );
    // The returned boundary must NOT appear anywhere in the content
    assert!(
        !content.contains(&second),
        "Returned boundary must not appear in the content, but \
         found '{second}' in '{content}'"
    );
}

/// the builder must generate boundaries that do not collide
/// with body text. Verifies that a multipart message whose body text
/// contains the boundary prefix `----=_Part_` round-trips correctly.
///
/// RFC 2046 Section 5.1.1
#[test]
fn build_boundary_not_in_body() {
    let mut email = make_email();
    // Body text intentionally contains the boundary prefix used by
    // generate_boundary(). The full boundary (with 32 random hex chars)
    // must not collide.
    email.body_text =
        Some("Line 1\r\n----=_Part_00000000000000000000000000000000\r\nLine 2".into());
    email.body_html = Some("<p>HTML body</p>".into());

    let built = build_message(&email).unwrap();

    // Parse the built message back
    let parsed = crate::parse_email(&built.raw).unwrap();

    // The body text must round-trip exactly
    assert_eq!(
        parsed.body_text.as_deref(),
        Some("Line 1\r\n----=_Part_00000000000000000000000000000000\r\nLine 2"),
        "Body text containing boundary prefix must round-trip correctly"
    );
    assert_eq!(
        parsed.body_html.as_deref(),
        Some("<p>HTML body</p>"),
        "HTML body must round-trip correctly"
    );
}

/// RFC 2046 Section 5.1.1: boundary parameter values for nested multipart
/// levels within the same message MUST be distinct. When building a
/// text+html+attachments message, the outer multipart/mixed and inner
/// multipart/alternative boundaries must differ.
#[test]
fn build_nested_multipart_boundaries_are_distinct() {
    let mut email = make_email();
    email.body_text = Some("Plain text".into());
    email.body_html = Some("<p>HTML</p>".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "data.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![1, 2, 3],
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Extract all boundary values — search the raw string for boundary=
    // patterns since Content-Type headers may be folded across lines.
    let mut boundaries: Vec<String> = Vec::new();
    let lower = s.to_lowercase();
    let mut search_from = 0;
    while let Some(pos) = lower[search_from..].find("boundary=\"") {
        let abs = search_from + pos;
        let rest = &s[abs + 10..]; // skip 'boundary="'
        let end = rest.find('"').unwrap_or(rest.len());
        boundaries.push(rest[..end].to_string());
        search_from = abs + 10 + end;
    }

    assert_eq!(
        boundaries.len(),
        2,
        "Expected 2 boundary values (mixed + alternative), got {boundaries:?}"
    );
    assert_ne!(
        boundaries[0], boundaries[1],
        "Nested multipart boundaries must be distinct per RFC 2046 Section 5.1.1"
    );
}

/// attachment filenames containing CRLF must not inject
/// arbitrary headers into the built message. RFC 5322 Section 2.1
/// defines header fields as terminated by CRLF, so bare CRLF in
/// user-provided values is a header injection vector.
#[test]
fn build_attachment_filename_crlf_sanitized() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "evil\r\nBcc: attacker@evil.com\r\nX-Injected: yes".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The injected Bcc header must NOT appear as a real header
    assert!(
        !s.contains("\r\nBcc: attacker@evil.com"),
        "CRLF in filename must be stripped to prevent header injection \
         (RFC 5322 Section 2.1)"
    );
    assert!(
        !s.contains("\r\nX-Injected:"),
        "CRLF in filename must be stripped to prevent header injection"
    );
    // The filename should still be present (minus the CRLF)
    assert!(
        s.contains("Content-Disposition: attachment"),
        "Content-Disposition header must still be present"
    );
}

/// non-ASCII attachment filenames with CRLF must also be
/// sanitized. The RFC 2231 encoding path percent-encodes CRLF in the
/// `filename*` parameter, but the legacy `filename` fallback must
/// also be safe.
#[test]
fn build_non_ascii_attachment_filename_crlf_sanitized() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "résumé\r\nBcc: attacker@evil.com".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The injected Bcc header must NOT appear as a real header
    assert!(
        !s.contains("\r\nBcc: attacker@evil.com"),
        "CRLF in non-ASCII filename must be stripped to prevent header injection"
    );
}

#[test]
fn build_attachment_filename_with_backslash_and_quote_escaped() {
    // Both backslash and double-quote in the same filename must be escaped
    // independently. Order matters: backslash first, then quote
    // (RFC 5322 Section 3.2.4).
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "path\\file\"name.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains(r#"filename="path\\file\"name.pdf""#),
        "Filename with both backslash and quote not properly escaped: {s}"
    );
}

#[test]
fn build_display_name_with_backslash_escaped() {
    // Backslash in a display name must be escaped in the quoted-string
    // (RFC 5322 Section 3.2.4).
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("Back\\Slash".into()),
        email: "bs@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains(r#""Back\\Slash" <bs@example.com>"#),
        "Display name with backslash not properly escaped: {s}"
    );
}

#[test]
fn build_then_parse_filename_with_backslash_and_quote_round_trip() {
    // Round-trip: filename with both backslash and double-quote must survive
    // build → parse without corruption (RFC 5322 Section 3.2.4).
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "path\\file\"name.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some("path\\file\"name.pdf"),
        "Round-trip filename with backslash and quote must be preserved"
    );
}

// -----------------------------------------------------------------------
// Coverage: generate_boundary_not_in fallback path (L529, L534-535, L538)
// -----------------------------------------------------------------------

/// `generate_boundary_not_in` falls back to a counter-based boundary
/// when all random attempts collide with content. This is astronomically
/// unlikely in production (32 hex chars of randomness), but the fallback
/// path must work correctly.
///
/// We cannot easily force the random generator to collide, so we test
/// the fallback indirectly by verifying that the function always returns
/// a boundary not present in the content, even when the content contains
/// the boundary prefix.
///
/// RFC 2046 Section 5.1.1
#[test]
fn generate_boundary_not_in_with_prefix_in_content() {
    // Content that contains many boundary-like strings. The function
    // should still return a boundary that does NOT collide.
    let mut content = String::new();
    for i in 0..20 {
        use std::fmt::Write;
        let _ = write!(content, "----=_Part_{i:032x}\r\n");
    }
    let boundary = generate_boundary_not_in(content.as_bytes());
    assert!(
        !content.contains(&boundary),
        "Returned boundary must not appear in content containing \
         many boundary-like strings (RFC 2046 Section 5.1.1)"
    );
}

// -----------------------------------------------------------------------
// Coverage: generate_message_id (L573, L577-583)
// -----------------------------------------------------------------------

/// `generate_message_id` produces a string in `{hex}@{domain}` format
/// per RFC 5322 Section 3.6.4. Verify format and uniqueness.
#[test]
fn generate_message_id_format_and_uniqueness() {
    let id1 = generate_message_id("example.com");
    let id2 = generate_message_id("example.com");

    // Each ID must contain exactly one '@'
    assert_eq!(
        id1.matches('@').count(),
        1,
        "Message-ID must contain exactly one '@' (RFC 5322 Section 3.6.4)"
    );
    // Domain must match
    assert!(
        id1.ends_with("@example.com"),
        "Message-ID must end with @domain: {id1}"
    );
    // Two consecutive IDs must differ (crypto-random)
    assert_ne!(
        id1, id2,
        "Message-IDs must be unique (RFC 5322 Section 3.6.4)"
    );
    // The local part (before @) must be 32 hex chars
    let local = id1.split('@').next().unwrap();
    assert_eq!(local.len(), 32, "Local part must be 32 hex chars: {local}");
    assert!(
        local.chars().all(|c| c.is_ascii_hexdigit()),
        "Local part must be hex digits: {local}"
    );
}

// -----------------------------------------------------------------------
// Coverage: quoted-printable encoding (L746-784)
// -----------------------------------------------------------------------

/// CRLF passthrough in quoted-printable encoding (Rule #4):
/// CRLF sequences must pass through unchanged as hard line breaks.
///
/// RFC 2045 Section 6.7 Rule #4
#[test]
fn qp_crlf_passthrough() {
    let input = b"Line one\r\nLine two\r\n";
    let encoded = encode_quoted_printable(input);
    assert_eq!(
        encoded, b"Line one\r\nLine two\r\n",
        "CRLF must pass through unchanged in QP encoding \
         (RFC 2045 Section 6.7 Rule #4)"
    );
}

/// Trailing whitespace before CRLF must be encoded in QP (Rule #3).
/// Space and TAB at end of a line must become =20 and =09.
///
/// RFC 2045 Section 6.7 Rule #3
#[test]
fn qp_trailing_whitespace_encoded() {
    // Space before CRLF
    let input = b"trailing space \r\nnext line";
    let encoded = encode_quoted_printable(input);
    let encoded_str = String::from_utf8_lossy(&encoded);
    assert!(
        encoded_str.contains("trailing space=20\r\n"),
        "Trailing space before CRLF must be encoded as =20 \
         (RFC 2045 Section 6.7 Rule #3), got: {encoded_str}"
    );

    // TAB before CRLF
    let input_tab = b"trailing tab\t\r\nnext line";
    let encoded_tab = encode_quoted_printable(input_tab);
    let encoded_tab_str = String::from_utf8_lossy(&encoded_tab);
    assert!(
        encoded_tab_str.contains("trailing tab=09\r\n"),
        "Trailing TAB before CRLF must be encoded as =09 \
         (RFC 2045 Section 6.7 Rule #3), got: {encoded_tab_str}"
    );
}

/// Trailing whitespace at end of data (no CRLF following) must also
/// be encoded (RFC 2045 Section 6.7 Rule #3).
#[test]
fn qp_trailing_whitespace_at_eof_encoded() {
    let input = b"end with space ";
    let encoded = encode_quoted_printable(input);
    let encoded_str = String::from_utf8_lossy(&encoded);
    assert!(
        encoded_str.ends_with("=20"),
        "Trailing space at EOF must be encoded as =20 \
         (RFC 2045 Section 6.7 Rule #3), got: {encoded_str}"
    );
}

/// Non-trailing whitespace (space/TAB followed by non-whitespace before
/// next CRLF) should pass through unchanged (RFC 2045 Section 6.7 Rule #2).
#[test]
fn qp_non_trailing_whitespace_passthrough() {
    let input = b"hello world";
    let encoded = encode_quoted_printable(input);
    assert_eq!(
        encoded, b"hello world",
        "Non-trailing space must pass through unchanged \
         (RFC 2045 Section 6.7 Rule #2)"
    );
}

/// The `=` character must always be encoded as `=3D` in QP
/// (RFC 2045 Section 6.7 Rule #1).
#[test]
fn qp_equals_sign_encoded() {
    let input = b"a=b";
    let encoded = encode_quoted_printable(input);
    assert_eq!(
        encoded, b"a=3Db",
        "`=` must be encoded as =3D (RFC 2045 Section 6.7 Rule #1)"
    );
}

/// Non-printable bytes must be encoded as `=XX` with uppercase hex
/// (RFC 2045 Section 6.7 Rule #1).
#[test]
fn qp_non_printable_bytes_encoded() {
    // NUL byte
    let input = &[0x00u8];
    let encoded = encode_quoted_printable(input);
    assert_eq!(
        encoded, b"=00",
        "NUL byte must be encoded as =00 (RFC 2045 Section 6.7 Rule #1)"
    );

    // High byte (0xFF)
    let input_hi = &[0xFFu8];
    let encoded_hi = encode_quoted_printable(input_hi);
    assert_eq!(
        encoded_hi, b"=FF",
        "0xFF must be encoded as =FF (RFC 2045 Section 6.7 Rule #1)"
    );

    // DEL (0x7F)
    let input_del = &[0x7Fu8];
    let encoded_del = encode_quoted_printable(input_del);
    assert_eq!(
        encoded_del, b"=7F",
        "DEL must be encoded as =7F (RFC 2045 Section 6.7 Rule #1)"
    );
}

/// Lines in QP encoding must not exceed 76 characters. When encoding
/// bytes that push past the limit, a soft line break (`=\r\n`) must
/// be inserted (RFC 2045 Section 6.7 Rule #5).
#[test]
fn qp_soft_line_break_on_long_encoded_data() {
    // 100 bytes of 0xFF → each becomes =FF (3 chars). 100 * 3 = 300 chars.
    // Should be split across multiple lines of ≤76 chars each.
    let input: Vec<u8> = vec![0xFF; 100];
    let encoded = encode_quoted_printable(&input);
    let encoded_str = String::from_utf8_lossy(&encoded);
    for line in encoded_str.split("\r\n") {
        assert!(
            line.len() <= 76,
            "QP line exceeds 76-char limit ({} chars): {line} \
             (RFC 2045 Section 6.7 Rule #5)",
            line.len()
        );
    }
    // Verify content round-trips: count the =FF occurrences
    let ff_count = encoded_str.matches("=FF").count();
    assert_eq!(
        ff_count, 100,
        "All 100 bytes must be encoded as =FF, got {ff_count}"
    );
}

/// Soft line breaks for literal (non-encoded) characters that would
/// push past the 76-char line limit (RFC 2045 Section 6.7 Rule #5).
#[test]
fn qp_soft_line_break_on_long_literal_data() {
    // 200 'A' characters on one line — all printable, pass through as-is,
    // but must be wrapped with soft breaks at 76-char boundaries.
    let input: Vec<u8> = vec![b'A'; 200];
    let encoded = encode_quoted_printable(&input);
    let encoded_str = String::from_utf8_lossy(&encoded);
    for line in encoded_str.split("\r\n") {
        assert!(
            line.len() <= 76,
            "QP line exceeds 76-char limit ({} chars): {line}",
            line.len()
        );
    }
    // Verify all 'A' characters are preserved (soft breaks stripped)
    let reassembled: String = encoded_str.replace("=\r\n", "");
    let a_count = reassembled.chars().filter(|&c| c == 'A').count();
    assert_eq!(a_count, 200, "All 200 'A' chars must be preserved");
}

/// Mixed content: printable ASCII, CRLF, trailing whitespace, and
/// non-printable bytes in a single QP encoding pass.
#[test]
fn qp_mixed_content_round_trip() {
    let mut email = make_email();
    // Body with a very long line (>998 chars) that includes special chars
    let mut long_line = String::new();
    long_line.push_str("Start ");
    for _ in 0..200 {
        long_line.push_str("abcde");
    }
    long_line.push_str(" \t end"); // trailing whitespace
    long_line.push_str("\r\n");
    long_line.push_str("Line with = sign and \x01 control char\r\n");
    email.body_text = Some(long_line.clone());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must use quoted-printable due to the long line
    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Long body line must trigger QP encoding (RFC 2045 Section 2.8)"
    );

    // No line in the output should exceed 998 characters
    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998 chars ({} chars)",
            line.len()
        );
    }
}

// -----------------------------------------------------------------------
// Coverage: is_trailing_whitespace helper (L810-821)
// -----------------------------------------------------------------------

/// `is_trailing_whitespace` returns `true` when whitespace is followed
/// only by more whitespace before CRLF.
///
/// RFC 2045 Section 6.7 Rule #3
#[test]
fn is_trailing_whitespace_before_crlf() {
    // Space followed by CRLF
    let data = b"abc \r\n";
    assert!(
        is_trailing_whitespace(data, 3),
        "Space directly before CRLF is trailing"
    );

    // Space followed by more spaces then CRLF
    let data2 = b"abc   \r\n";
    assert!(
        is_trailing_whitespace(data2, 3),
        "Space followed by spaces before CRLF is trailing"
    );

    // TAB followed by CRLF
    let data3 = b"abc\t\r\n";
    assert!(
        is_trailing_whitespace(data3, 3),
        "TAB directly before CRLF is trailing"
    );
}

/// `is_trailing_whitespace` returns `true` when whitespace is at
/// end of data (no CRLF following).
///
/// RFC 2045 Section 6.7 Rule #3
#[test]
fn is_trailing_whitespace_at_eof() {
    let data = b"abc ";
    assert!(
        is_trailing_whitespace(data, 3),
        "Space at end of data is trailing"
    );

    let data2 = b"abc\t";
    assert!(
        is_trailing_whitespace(data2, 3),
        "TAB at end of data is trailing"
    );
}

/// `is_trailing_whitespace` returns `false` when whitespace is
/// followed by non-whitespace before the next CRLF.
///
/// RFC 2045 Section 6.7 Rule #3
#[test]
fn is_trailing_whitespace_not_trailing() {
    let data = b"abc def";
    assert!(
        !is_trailing_whitespace(data, 3),
        "Space followed by non-whitespace is NOT trailing"
    );

    // TAB followed by text
    let data2 = b"abc\tdef";
    assert!(
        !is_trailing_whitespace(data2, 3),
        "TAB followed by non-whitespace is NOT trailing"
    );
}

// -----------------------------------------------------------------------
// Coverage: utf8_char_len (L1025-1035)
// -----------------------------------------------------------------------

/// `utf8_char_len` returns the expected byte length for each class
/// of UTF-8 lead byte.
#[test]
fn utf8_char_len_all_classes() {
    // ASCII (0x00..0x7F) → 1 byte
    assert_eq!(utf8_char_len(b'A'), 1, "ASCII 'A' is 1 byte");
    assert_eq!(utf8_char_len(0x00), 1, "NUL is 1 byte");
    assert_eq!(utf8_char_len(0x7F), 1, "DEL is 1 byte");

    // 2-byte lead (0x80..0xDF) → 2 bytes
    // 'é' = 0xC3 0xA9
    assert_eq!(utf8_char_len(0xC3), 2, "0xC3 (é lead) is 2-byte char");
    assert_eq!(utf8_char_len(0xC0), 2, "0xC0 is 2-byte lead");
    assert_eq!(utf8_char_len(0xDF), 2, "0xDF is 2-byte lead");

    // 3-byte lead (0xE0..0xEF) → 3 bytes
    // '你' = 0xE4 0xBD 0xA0
    assert_eq!(utf8_char_len(0xE4), 3, "0xE4 (CJK lead) is 3-byte char");
    assert_eq!(utf8_char_len(0xE0), 3, "0xE0 is 3-byte lead");
    assert_eq!(utf8_char_len(0xEF), 3, "0xEF is 3-byte lead");

    // 4-byte lead (0xF0..0xFF) → 4 bytes
    // '🌍' = 0xF0 0x9F 0x8C 0x8D
    assert_eq!(utf8_char_len(0xF0), 4, "0xF0 (emoji lead) is 4-byte char");
    assert_eq!(utf8_char_len(0xF4), 4, "0xF4 is 4-byte lead");
    assert_eq!(utf8_char_len(0xFF), 4, "0xFF is 4-byte lead");
}

// -----------------------------------------------------------------------
// Coverage: snap_utf8_chunk_end for multi-byte characters (L1010-1011)
// -----------------------------------------------------------------------

/// `snap_utf8_chunk_end` must not split multi-byte UTF-8 characters.
/// When the budget is too small for even one complete character, it
/// must advance past the full character to avoid an infinite loop.
#[test]
fn snap_utf8_chunk_end_undersized_budget() {
    // '🌍' is 4 bytes (0xF0 0x9F 0x8C 0x8D). If max_bytes is 1-3,
    // the function cannot fit any character, so it must advance past
    // the entire 4-byte sequence to avoid an infinite loop.
    let emoji = "🌍".as_bytes();
    assert_eq!(emoji.len(), 4);

    // Budget of 1 byte — can't fit the 4-byte char, must advance past it
    let end = snap_utf8_chunk_end(emoji, 0, 1);
    assert_eq!(end, 4, "Budget too small for one char must advance past it");

    // Budget of 2 bytes — still can't fit
    let end = snap_utf8_chunk_end(emoji, 0, 2);
    assert_eq!(end, 4);

    // Budget of 3 bytes — still can't fit
    let end = snap_utf8_chunk_end(emoji, 0, 3);
    assert_eq!(end, 4);

    // Budget of 4 bytes — exactly fits
    let end = snap_utf8_chunk_end(emoji, 0, 4);
    assert_eq!(end, 4);

    // 3-byte char '你' (0xE4 0xBD 0xA0) with budget of 2
    let cjk = "你".as_bytes();
    assert_eq!(cjk.len(), 3);
    let end = snap_utf8_chunk_end(cjk, 0, 2);
    assert_eq!(
        end, 3,
        "Budget of 2 can't fit 3-byte char, must advance past it"
    );

    // 2-byte char 'é' (0xC3 0xA9) with budget of 1
    let accent = "é".as_bytes();
    assert_eq!(accent.len(), 2);
    let end = snap_utf8_chunk_end(accent, 0, 1);
    assert_eq!(
        end, 2,
        "Budget of 1 can't fit 2-byte char, must advance past it"
    );
}

/// `snap_utf8_chunk_end` correctly snaps back to character boundaries
/// when the budget lands in the middle of a multi-byte sequence.
#[test]
fn snap_utf8_chunk_end_snaps_to_boundary() {
    // "Aé" = [0x41, 0xC3, 0xA9] — 'A' (1 byte) + 'é' (2 bytes)
    let data = "Aé".as_bytes();
    assert_eq!(data.len(), 3);

    // Budget of 2: lands at byte 2 (0xA9, continuation byte of 'é').
    // Must snap back to byte 1 (start of 'é'), so chunk is just 'A'.
    let end = snap_utf8_chunk_end(data, 0, 2);
    assert_eq!(
        end, 1,
        "Must snap back to char boundary, excluding incomplete 'é'"
    );

    // Budget of 3: exactly fits both characters
    let end = snap_utf8_chunk_end(data, 0, 3);
    assert_eq!(end, 3, "Budget of 3 fits both 'A' and 'é'");
}

// -----------------------------------------------------------------------
// Coverage: very long single-word subjects
// -----------------------------------------------------------------------

/// A subject consisting of a single very long word (no spaces) must
/// still round-trip without inserted spaces. The builder satisfies RFC
/// 5322 Section 2.1.1 by switching unstructured long words onto RFC 2047
/// encoded-words instead of emitting an overlong line.
#[test]
fn build_very_long_single_word_subject_preserved() {
    let mut email = make_email();
    // 1100 ASCII chars with no spaces — too long for a single unfolded
    // header line, so the builder must encode rather than split it.
    email.subject = "X".repeat(1100);

    let built = build_message(&email).unwrap();

    // The subject must round-trip without corruption.
    let parsed = crate::parse_email(&built.raw).unwrap();
    let parsed_subject = parsed.subject.unwrap();
    assert_eq!(
        parsed_subject, email.subject,
        "Single-word subject must round-trip without inserted spaces"
    );
}

/// A very long address list should be folded at word boundaries
/// per RFC 5322 Section 2.2.3. Lines should stay under 78 chars
/// where possible (SHOULD limit) and never exceed 998 (MUST limit).
#[test]
fn build_very_long_address_list_folded() {
    let mut email = make_email();
    // 20 recipients with long addresses — the To header will be very long
    email.to = (0..20)
        .map(|i| Address {
            name: Some(format!("User Number {i:03}")),
            email: format!("user{i:03}@very-long-domain-name.example.com"),
        })
        .collect();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998-char hard limit ({} chars) in long address list",
            line.len()
        );
    }

    // Verify all recipients made it into the envelope
    assert_eq!(built.envelope_recipients.len(), 20);
}

/// An encoded-word subject (RFC 2047) that is very long should be
/// folded correctly. Each `=?UTF-8?B?...?=` word is separated by
/// a space, and `write_header` should fold at those spaces.
///
/// RFC 2047 Section 2, RFC 5322 Section 2.2.3
#[test]
fn build_long_rfc2047_subject_folded() {
    let mut email = make_email();
    // Long non-ASCII subject — will be split into multiple encoded words,
    // and the header should be folded at encoded-word boundaries.
    email.subject = "日本語テスト ".repeat(50);

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998-char limit for RFC 2047 subject ({} chars)",
            line.len()
        );
    }

    // Verify the subject round-trips
    let parsed = crate::parse_email(&built.raw).unwrap();
    let original = email.subject.trim();
    let parsed_subject = parsed.subject.unwrap();
    assert_eq!(
        parsed_subject.trim(),
        original,
        "Long RFC 2047 subject must round-trip"
    );
}

/// RFC 2047 Section 2: "each line of a header field that contains one
/// or more 'encoded-word's is limited to 76 characters." The builder
/// must fold encoded-word headers at 76 chars, not the usual 78.
#[test]
fn rfc2047_encoded_word_lines_must_not_exceed_76_chars() {
    // Subject with non-ASCII forces RFC 2047 encoding.
    let mut email = make_email();
    email.subject = "日本語テスト ".repeat(30);

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Check every line that contains an encoded-word.
    for (i, line) in s.split("\r\n").enumerate() {
        if line.contains("=?") && line.contains("?=") {
            assert!(
                line.len() <= 76,
                "RFC 2047 Section 2: line {i} with encoded-word exceeds \
                 76 chars ({} chars): {line}",
                line.len()
            );
        }
    }

    // Round-trip the subject to ensure folding doesn't corrupt it.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.subject.unwrap().trim(),
        email.subject.trim(),
        "Subject must survive RFC 2047 encode → fold → decode round-trip"
    );
}

/// RFC 2047 Section 2: encoded-word line limit also applies to
/// address headers with non-ASCII display names. "Reply-To: " is
/// 10 chars, so even a single encoded-word can push past 76.
#[test]
fn rfc2047_encoded_word_address_lines_must_not_exceed_76_chars() {
    let mut email = make_email();
    email.reply_to = vec![Address {
        name: Some("日本太郎さんの長い名前テスト用の表示名".into()),
        email: "taro@example.com".into(),
    }];
    email.body_text = Some("test".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    for (i, line) in s.split("\r\n").enumerate() {
        if line.contains("=?") && line.contains("?=") {
            assert!(
                line.len() <= 76,
                "RFC 2047 Section 2: line {i} with encoded-word exceeds \
                 76 chars ({} chars): {line}",
                line.len()
            );
        }
    }
}

// -----------------------------------------------------------------------
// Coverage: encode_rfc2047_if_needed with multi-byte characters
// -----------------------------------------------------------------------

/// `encode_rfc2047_if_needed` must handle 2-byte, 3-byte, and 4-byte
/// UTF-8 characters correctly, splitting at character boundaries when
/// the encoded-word exceeds 75 chars (RFC 2047 Section 2).
#[test]
fn encode_rfc2047_multibyte_chars() {
    // 2-byte characters: 'é' (U+00E9)
    let two_byte = "é".repeat(100);
    let encoded = encode_rfc2047_if_needed(&two_byte);
    assert!(
        encoded.contains("=?UTF-8?B?"),
        "Non-ASCII text must be RFC 2047 encoded"
    );
    // Each encoded word must be ≤75 chars (RFC 2047 Section 2)
    for word in encoded.split(' ') {
        if word.starts_with("=?") {
            assert!(
                word.len() <= 75,
                "Encoded word exceeds 75 chars ({} chars): {word}",
                word.len()
            );
        }
    }

    // 3-byte characters: '日' (U+65E5)
    let three_byte = "日".repeat(100);
    let encoded = encode_rfc2047_if_needed(&three_byte);
    for word in encoded.split(' ') {
        if word.starts_with("=?") {
            assert!(
                word.len() <= 75,
                "3-byte char encoded word exceeds 75 chars ({} chars): {word}",
                word.len()
            );
        }
    }

    // 4-byte characters: '🌍' (U+1F30D)
    let four_byte = "🌍".repeat(100);
    let encoded = encode_rfc2047_if_needed(&four_byte);
    for word in encoded.split(' ') {
        if word.starts_with("=?") {
            assert!(
                word.len() <= 75,
                "4-byte char encoded word exceeds 75 chars ({} chars): {word}",
                word.len()
            );
        }
    }

    // Pure ASCII should pass through unchanged
    let ascii = "Hello World";
    assert_eq!(
        encode_rfc2047_if_needed(ascii),
        "Hello World",
        "Pure ASCII must not be encoded (RFC 2047 Section 5)"
    );
}

// -----------------------------------------------------------------------
// Coverage: body with QP encoding and CRLF, trailing whitespace
// integrated through build_message
// -----------------------------------------------------------------------

/// Full integration test: body text with lines >998 chars that also
/// contains CRLF sequences, trailing whitespace, and special chars.
/// Exercises the QP encoder's CRLF passthrough (L746-749), trailing
/// whitespace detection (L758), and hex encoding paths (L773-784).
///
/// RFC 2045 Section 6.7
#[test]
fn build_qp_body_with_crlf_and_trailing_whitespace() {
    let mut email = make_email();
    // Build a body that triggers QP encoding (>998 chars on one line)
    // and includes CRLF, trailing whitespace, and special chars.
    let mut body = String::new();
    // Very long first line to trigger QP
    body.push_str(&"B".repeat(1100));
    body.push_str("\r\n");
    // Line with trailing space before CRLF
    body.push_str("trailing space \r\n");
    // Line with trailing tab before CRLF
    body.push_str("trailing tab\t\r\n");
    // Line with = sign
    body.push_str("equals = sign\r\n");
    // Line with non-ASCII
    body.push_str("café résumé\r\n");
    email.body_text = Some(body);

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Must use QP encoding for body with >998-char lines"
    );

    // No line should exceed 998 chars
    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Line {i} exceeds 998-char limit ({} chars)",
            line.len()
        );
    }
}

/// HTML body with lines >998 chars must also use quoted-printable.
///
/// RFC 2045 Section 2.8
#[test]
fn build_long_html_body_uses_quoted_printable() {
    let mut email = make_email();
    // Single long HTML line
    let long_html = format!("<p>{}</p>", "x".repeat(1100));
    email.body_html = Some(long_html);

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Long HTML body lines must trigger QP encoding"
    );

    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "HTML QP line {i} exceeds 998-char limit ({} chars)",
            line.len()
        );
    }
}

/// Multipart message (text + html + attachments) where both text parts
/// have long lines must use quoted-printable for both.
///
/// RFC 2045 Section 2.8, RFC 2046 Section 5.1.4
#[test]
fn build_multipart_with_long_lines_uses_qp() {
    let mut email = make_email();
    email.body_text = Some("T".repeat(1100));
    email.body_html = Some("H".repeat(1100));
    email.attachments = vec![OutgoingAttachment {
        filename: "file.bin".into(),
        content_type: "application/octet-stream".into(),
        data: vec![1, 2, 3],
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Count QP headers — should have 2 (one for text, one for html)
    let qp_count = s
        .matches("Content-Transfer-Encoding: quoted-printable")
        .count();
    assert_eq!(
        qp_count, 2,
        "Both text and HTML parts with long lines must use QP, got {qp_count}"
    );

    for (i, line) in s.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "Multipart QP line {i} exceeds 998-char limit ({} chars)",
            line.len()
        );
    }
}

/// Pure ASCII short lines uses `7bit` CTE
/// (RFC 2045 Section 2.7) — no need for quoted-printable overhead.
///
/// RFC 5321 Section 2.3.1: 7-bit US-ASCII is the baseline.
#[test]
fn build_seven_bit_ascii_uses_7bit_cte() {
    let mut email = make_email();
    email.body_text = Some("Short ASCII line".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "SevenBit with pure ASCII must use 7bit CTE, got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 8bit"),
        "SevenBit must not produce 8bit encoding"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: quoted-printable"),
        "SevenBit with pure ASCII should not use quoted-printable"
    );
}

/// Non-ASCII body must produce QP-encoded content that round-trips
/// through `parse_email`.
///
/// RFC 2045 Section 6.7: quoted-printable encodes non-ASCII octets as
/// `=XX` so the transfer is 7-bit safe.
#[test]
fn build_seven_bit_encodes_non_ascii_body_round_trips() {
    let mut email = make_email();
    let body = "Héllo, José! 日本語テスト";
    email.body_text = Some(body.into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "SevenBit must use quoted-printable for non-ASCII body"
    );

    // All raw bytes after the CTE header must be 7-bit safe. We search
    // for the CTE header rather than the first \r\n\r\n separator so this
    // works correctly for multipart messages where the outer headers'
    // blank line precedes the first boundary, not the actual body content.
    let raw = &built.raw;
    let cte_needle = b"Content-Transfer-Encoding: quoted-printable\r\n\r\n";
    let body_start = raw
        .windows(cte_needle.len())
        .position(|w| w == cte_needle.as_slice())
        .expect("must contain CTE: quoted-printable header")
        + cte_needle.len();
    for (i, &byte) in raw[body_start..].iter().enumerate() {
        assert!(
            byte <= 127,
            "SevenBit body byte at offset {i} is non-ASCII: 0x{byte:02x}"
        );
    }

    // Round-trip: parse back and verify body text is recovered.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(body),
        "Non-ASCII body must round-trip through SevenBit QP encoding"
    );
}

/// Multipart/alternative message with pure ASCII parts must use `7bit`
/// CTE for both parts (RFC 2045 Section 2.7).
///
/// RFC 2045 Section 2.7, RFC 5321 Section 2.3.1
#[test]
fn build_seven_bit_multipart_ascii_both_parts_use_7bit() {
    let mut email = make_email();
    email.body_text = Some("Plain text".into());
    email.body_html = Some("<p>HTML</p>".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    let seven_bit_count = s.matches("Content-Transfer-Encoding: 7bit").count();
    assert_eq!(
        seven_bit_count, 2,
        "SevenBit multipart with ASCII must use 7bit for both parts, got {seven_bit_count}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 8bit"),
        "SevenBit must not produce any 8bit encoding"
    );
}

/// Non-ASCII multipart must QP-encode both text and HTML parts.
///
/// RFC 2045 Section 6.7, RFC 5321 Section 2.3.1
#[test]
fn build_seven_bit_multipart_non_ascii_both_parts_use_qp() {
    let mut email = make_email();
    email.body_text = Some("Héllo café".into());
    email.body_html = Some("<p>résumé</p>".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    let qp_count = s
        .matches("Content-Transfer-Encoding: quoted-printable")
        .count();
    assert_eq!(
        qp_count, 2,
        "SevenBit multipart with non-ASCII must QP-encode both parts, got {qp_count}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 8bit"),
        "SevenBit must not produce any 8bit encoding"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 7bit"),
        "Non-ASCII content must not use 7bit CTE"
    );

    // Round-trip
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(parsed.body_text.as_deref(), Some("Héllo café"));
    assert_eq!(parsed.body_html.as_deref(), Some("<p>résumé</p>"));
}

/// Pure ASCII but long lines must use quoted-printable
/// (RFC 2045 Section 2.8 — line length limit).
#[test]
fn build_seven_bit_ascii_long_lines_uses_qp() {
    let mut email = make_email();
    let long_line = "A".repeat(1200);
    email.body_text = Some(long_line);

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "SevenBit with long ASCII lines must use QP, got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 7bit"),
        "Long lines cannot use 7bit CTE"
    );
}

/// Pure ASCII short lines use `7bit` CTE — the builder always produces
/// 7-bit safe output.
///
/// RFC 2045 Section 2.7
#[test]
fn build_ascii_uses_7bit_cte() {
    let mut email = make_email();
    email.body_text = Some("Pure ASCII".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "Pure ASCII must use 7bit CTE, got:\n{s}"
    );
}

/// RFC 2045 Section 2.7 forbids NUL octets in `7bit` data, so text
/// containing NUL must be transfer-encoded via quoted-printable.
#[test]
fn build_text_with_nul_uses_quoted_printable() {
    let mut email = make_email();
    let body = "nul\0byte";
    email.body_text = Some(body.into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Text containing NUL must not be emitted as raw 8bit: {s:?}"
    );
    assert!(
        !built.raw.contains(&0x00),
        "quoted-printable output must not contain raw NUL octets"
    );

    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(body),
        "NUL-containing body must round-trip through quoted-printable"
    );
}

/// RFC 2045 Section 2.7 forbids NUL octets in raw `7bit` data — NUL
/// bytes in text must be QP-encoded.
#[test]
fn build_seven_bit_text_with_nul_uses_quoted_printable() {
    let mut email = make_email();
    let body = "nul\0byte";
    email.body_text = Some(body.into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "SevenBit text containing NUL must use quoted-printable: {s:?}"
    );
    assert!(
        !built.raw.contains(&0x00),
        "quoted-printable output must not contain raw NUL octets"
    );

    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some(body),
        "NUL-containing body must round-trip through quoted-printable"
    );
}

/// No body produces an empty text/plain part with `7bit` CTE — an
/// empty string is trivially ASCII-safe.
///
/// RFC 2045 Section 2.7, RFC 5321 Section 2.3.1
#[test]
fn build_seven_bit_empty_body_uses_7bit_cte() {
    let email = make_email();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "SevenBit with empty body must use 7bit CTE, got:\n{s}"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: 8bit"),
        "SevenBit must not produce 8bit encoding"
    );
    assert!(
        !s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Empty body should not need quoted-printable"
    );
}

/// RFC 5322 Section 3.6.2: `reply-to = "Reply-To:" address-list CRLF`
/// — Reply-To allows multiple addresses. `OutgoingEmail` must support
/// building messages with more than one Reply-To address.
#[test]
fn build_message_multiple_reply_to() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: Some("Sender".into()),
            email: "sender@example.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "to@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![
            Address {
                name: Some("Reply One".into()),
                email: "reply1@example.com".into(),
            },
            Address {
                name: Some("Reply Two".into()),
                email: "reply2@example.com".into(),
            },
        ],
        date: None,
        subject: "Test multiple Reply-To".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = String::from_utf8_lossy(&built.raw);
    // Both Reply-To addresses must appear in the header
    assert!(
        raw.contains("reply1@example.com"),
        "First Reply-To address must appear in message: {raw}"
    );
    assert!(
        raw.contains("reply2@example.com"),
        "Second Reply-To address must appear in message: {raw}"
    );
    // Verify round-trip: parsed message must have both Reply-To addresses
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.reply_to.len(),
        2,
        "Parsed message must have 2 Reply-To addresses, got {:?}",
        parsed.reply_to
    );
}

/// RFC 5322 Section 3.6.8: optional-field = field-name ":" unstructured CRLF
/// — `OutgoingEmail` must support arbitrary extra headers for fields like
/// `List-Unsubscribe`, `X-Mailer`, etc.
#[test]
fn build_message_with_extra_headers() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "sender@example.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "to@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Test extra headers".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![
            (hdr("X-Mailer"), "TestMailer/1.0".into()),
            (hdr("List-Unsubscribe"), "<mailto:unsub@example.com>".into()),
        ],
    };
    let built = build_message(&email).unwrap();
    let raw = String::from_utf8_lossy(&built.raw);
    assert!(
        raw.contains("X-Mailer: TestMailer/1.0"),
        "X-Mailer header must appear in message: {raw}"
    );
    assert!(
        raw.contains("List-Unsubscribe:"),
        "List-Unsubscribe header must appear in message: {raw}"
    );
    assert!(
        raw.contains("mailto:unsub@example.com"),
        "List-Unsubscribe value must appear in message: {raw}"
    );
}

/// RFC 5322 Section 2.2: field-name = 1*ftext, where ftext = %d33-57 /
/// %d59-126 (printable ASCII excluding colon). Header names containing
/// colons, spaces, or control characters must be rejected at
/// construction time by [`HeaderName::new`].
#[test]
fn header_name_rejects_invalid_ftext() {
    // Colon in header name
    assert!(
        HeaderName::new("Invalid: Name").is_err(),
        "Header name with colon must be rejected (RFC 5322 Section 2.2)"
    );

    // Space in header name
    assert!(
        HeaderName::new("X Bad").is_err(),
        "Header name with space must be rejected (RFC 5322 Section 2.2)"
    );

    // Empty header name
    assert!(
        HeaderName::new("").is_err(),
        "Empty header name must be rejected (RFC 5322 Section 2.2)"
    );
}

/// RFC 5322 Section 3.4.1: addr-spec = local-part "@" domain — exactly
/// one `@`. An email like `user@domain@extra` must be rejected by the
/// builder to produce strictly conformant output.
#[test]
fn validate_address_rejects_multiple_at_signs() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "user@@domain.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "recipient@example.com".into(),
        }],
        cc: Vec::new(),
        bcc: Vec::new(),
        reply_to: Vec::new(),
        date: None,
        subject: "test".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: Vec::new(),
        extra_headers: Vec::new(),
    };
    assert!(
        build_message(&email).is_err(),
        "address with multiple '@' must be rejected (RFC 5322 Section 3.4.1)"
    );
}

/// RFC 5321 Section 4.1.2: domain must not start or end with a dot.
#[test]
fn validate_address_rejects_leading_trailing_dot_in_domain() {
    let make_email = |addr: &str| OutgoingEmail {
        from: vec![Address {
            name: None,
            email: addr.into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "recipient@example.com".into(),
        }],
        cc: Vec::new(),
        bcc: Vec::new(),
        reply_to: Vec::new(),
        date: None,
        subject: "test".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: Vec::new(),
        extra_headers: Vec::new(),
    };
    assert!(
        build_message(&make_email("user@.domain.com")).is_err(),
        "leading dot in domain must be rejected (RFC 5321 Section 4.1.2)"
    );
    assert!(
        build_message(&make_email("user@domain.com.")).is_err(),
        "trailing dot in domain must be rejected (RFC 5321 Section 4.1.2)"
    );
}

#[test]
fn spec_audit_extra_header_non_ascii_encoded() {
    // RFC 5322 Section 2.2: header field bodies must be US-ASCII.
    // Non-ASCII extra header values must be RFC 2047 encoded.
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Test".into(),
        body_text: Some("Body".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![(hdr("X-Custom"), "Héllo Wörld".into())],
    };
    let built = build_message(&email).unwrap();
    let raw_str = String::from_utf8_lossy(&built.raw);
    let header_section = raw_str.split("\r\n\r\n").next().unwrap();
    assert!(
        header_section.is_ascii(),
        "All header field bodies must be US-ASCII per RFC 5322 Section 2.2; \
         non-ASCII extra header value was not RFC 2047 encoded"
    );
}

/// Whitespace-only display names are not valid phrases under RFC 5322
/// Section 3.4 (`phrase = 1*word`, where `word = atom / quoted-string`).
/// `format_address` must treat them as absent and emit a bare email.
#[test]
fn format_address_whitespace_only_name_treated_as_absent() {
    let addr = Address {
        name: Some("   ".to_string()),
        email: "test@example.com".into(),
    };
    assert_eq!(format_address(&addr), "test@example.com");
}

/// RFC 5322 Section 2.2.3: `sanitize_header_value` must replace CR/LF with
/// spaces instead of stripping them, to avoid joining words without
/// separation (e.g., "Line1\nLine2" should become "Line1 Line2", not
/// "`Line1Line2`"). Legitimate spaces already present in the field body
/// must be preserved.
#[test]
fn sanitize_header_value_replaces_crlf_with_space() {
    // Bare LF between words
    assert_eq!(sanitize_header_value("Line1\nLine2"), "Line1 Line2");
    // Bare CR between words
    assert_eq!(sanitize_header_value("Line1\rLine2"), "Line1 Line2");
    // CRLF between words
    assert_eq!(sanitize_header_value("Line1\r\nLine2"), "Line1 Line2");
    // Multiple consecutive newlines should collapse to a single space
    assert_eq!(sanitize_header_value("A\n\n\nB"), "A B");
    // Existing spaces are preserved; only the control bytes are coalesced
    assert_eq!(sanitize_header_value("A\r\n \r\nB"), "A  B");
    // No CR/LF — should be unchanged
    assert_eq!(sanitize_header_value("Hello World"), "Hello World");
}

/// RFC 5322 Section 2.2.3: HTAB is valid WSP and must be preserved.
/// CR/LF are replaced with spaces, but existing SP/HTAB sequences pass
/// through unchanged.
#[test]
fn sanitize_header_value_preserves_tabs_strips_crlf() {
    // Multiple consecutive tabs are preserved (HTAB is valid WSP)
    assert_eq!(
        sanitize_header_value("Hello\t\t\tWorld"),
        "Hello\t\t\tWorld"
    );
    // CRLF is replaced with space, but following tabs are preserved
    assert_eq!(sanitize_header_value("A\r\n\t\tB"), "A \t\tB");
    // Mixed spaces and tabs are preserved exactly
    assert_eq!(sanitize_header_value("A\t \t B"), "A\t \t B");
}

/// RFC 5322 Section 2.2: header field bodies must contain only printable
/// US-ASCII characters (0x20–0x7E), SP, and HTAB.  ASCII control characters
/// (NUL 0x00, 0x01–0x08, 0x0B, 0x0C, 0x0E–0x1F, and DEL 0x7F) must be
/// replaced with spaces, just like CR/LF. Non-ASCII
/// characters (>= 0x80) must be preserved for RFC 6532 / RFC 2047 support.
#[test]
fn sanitize_header_value_strips_control_characters() {
    // NUL in the middle of a word
    assert_eq!(sanitize_header_value("Hello\x00World"), "Hello World");
    // Mixed control characters (SOH and DEL)
    assert_eq!(sanitize_header_value("A\x01B\x7FC"), "A B C");
    // VT (0x0B) and FF (0x0C)
    assert_eq!(sanitize_header_value("A\x0B\x0CB"), "A B");
    // Non-ASCII must be preserved (RFC 6532 / RFC 2047)
    assert_eq!(sanitize_header_value("Café"), "Café");
    // All low control characters (0x01–0x08, 0x0E–0x1F) should be replaced
    assert_eq!(sanitize_header_value("X\x02\x03\x04Y"), "X Y");
    // DEL (0x7F) alone
    assert_eq!(sanitize_header_value("A\x7FB"), "A B");
}

/// RFC 5322 Section 2.2.3: WSP is defined as SP or HTAB, so HTAB (0x09)
/// is a valid whitespace character in header field bodies and must be
/// preserved, not replaced with a space.  Only non-WSP control characters
/// should be stripped.
#[test]
fn sanitize_header_preserves_htab() {
    // A single HTAB between words must survive unchanged
    assert_eq!(sanitize_header_value("Hello\tWorld"), "Hello\tWorld");
    // HTAB at the start must survive
    assert_eq!(sanitize_header_value("\tIndented"), "\tIndented");
    // Mixed SP and HTAB must each be preserved (no collapsing HTAB into SP)
    assert_eq!(sanitize_header_value("A \tB"), "A \tB");
}

/// RFC 2045 Section 5 and RFC 2183 Section 2: attachment Content-Type
/// headers should include a `name` parameter as a fallback for email
/// clients that don't support Content-Disposition `filename`.
#[test]
fn attachment_content_type_includes_name_parameter() {
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.attachments.push(OutgoingAttachment {
        filename: "report.pdf".into(),
        content_type: "application/pdf".into(),
        data: vec![0x25, 0x50, 0x44, 0x46], // %PDF
        is_inline: false,
        content_id: None,
    });

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        s.contains("Content-Type: application/pdf; name=\"report.pdf\""),
        "Content-Type header must include name parameter for attachments \
         (RFC 2045 Section 5). Got:\n{s}"
    );
}

/// RFC 5322 Section 3.4.1: local-part = dot-atom / quoted-string.
/// Addresses with quoted local parts like `"user name"@example.com`
/// must be accepted by `validate_address`.
#[test]
fn validate_address_accepts_quoted_local_part() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "\"user name\"@example.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "recipient@example.com".into(),
        }],
        cc: Vec::new(),
        bcc: Vec::new(),
        reply_to: Vec::new(),
        date: None,
        subject: "test".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: Vec::new(),
        extra_headers: Vec::new(),
    };
    assert!(
        build_message(&email).is_ok(),
        "address with quoted local part must be accepted (RFC 5322 Section 3.4.1)"
    );
}

/// Quoted local parts with special characters must also be accepted.
#[test]
fn validate_address_accepts_quoted_local_part_with_specials() {
    let addr = Address {
        name: None,
        email: "\"john..doe\"@example.com".into(),
    };
    assert!(
        validate_address(&addr).is_ok(),
        "quoted local part with consecutive dots must be accepted (RFC 5322 Section 3.4.1)"
    );
}

/// RFC 5322 Section 3.4.1 defines `domain-literal` for header addresses
/// independently of SMTP's RFC 5321 `address-literal` grammar.
/// A liberal header-domain like `[10,0,0,1]` must therefore parse and
/// build successfully in the message crate.
#[test]
fn validate_address_accepts_rfc5322_domain_literal() {
    let addr: Address = "user@[10,0,0,1]"
        .parse()
        .expect("RFC 5322 domain-literal must parse");

    let email = OutgoingEmail {
        from: vec![addr],
        sender: None,
        to: vec![Address {
            name: None,
            email: "recipient@example.com".into(),
        }],
        cc: Vec::new(),
        bcc: Vec::new(),
        reply_to: Vec::new(),
        date: None,
        subject: "test".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: Vec::new(),
        extra_headers: Vec::new(),
    };

    assert!(
        build_message(&email).is_ok(),
        "message builder must accept RFC 5322 domain-literals in header addresses"
    );
}

/// RFC 6532 Section 3.2 extends RFC 5322 `dtext` with UTF-8, so
/// internationalized domain-literals are valid in message header
/// addresses even though SMTP envelope paths remain stricter.
#[test]
fn validate_address_accepts_utf8_domain_literal() {
    let addr: Address = "user@[例え]"
        .parse()
        .expect("RFC 6532 UTF-8 domain-literal must parse");

    let email = OutgoingEmail {
        from: vec![addr],
        sender: None,
        to: vec![Address {
            name: None,
            email: "recipient@example.com".into(),
        }],
        cc: Vec::new(),
        bcc: Vec::new(),
        reply_to: Vec::new(),
        date: None,
        subject: "test".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: Vec::new(),
        extra_headers: Vec::new(),
    };

    assert!(
        build_message(&email).is_ok(),
        "message builder must accept UTF-8 domain-literals per RFC 6532 Section 3.2"
    );
}

/// Unquoted local parts with whitespace must still be rejected.
#[test]
fn validate_address_rejects_unquoted_local_with_whitespace() {
    let addr = Address {
        name: None,
        email: "user name@example.com".into(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "unquoted local part with whitespace must be rejected"
    );
}

/// RFC 5322 Section 2.2: header field bodies must be US-ASCII.
/// The Content-Type `name` parameter for non-ASCII attachment filenames
/// must use an ASCII-safe value, not raw UTF-8 bytes. This applies to
/// MIME part headers inside multipart messages as well — RFC 2045
/// Section 4 inherits the US-ASCII requirement for all header fields.
#[test]
fn build_non_ascii_filename_content_type_name_is_ascii() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "résumé.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Find every Content-Type header line (including in MIME part headers)
    // and verify it contains only ASCII characters.
    for line in s.split("\r\n") {
        if line.starts_with("Content-Type:") && line.contains("name=") {
            assert!(
                line.is_ascii(),
                "Content-Type name parameter must be ASCII per RFC 5322 Section 2.2, \
                 but found non-ASCII: {line}"
            );
        }
    }
}

/// RFC 2231 Section 4: Content-Type `name*` must convey the full non-ASCII
/// filename for RFC 2231-aware clients, alongside the legacy ASCII `name`
/// fallback. Without `name*`, clients that read Content-Type but not
/// Content-Disposition lose the original filename.
#[test]
fn build_non_ascii_filename_content_type_has_name_star() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "résumé.pdf".into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Unfold headers for easier inspection.
    let unfolded = s.replace("\r\n ", " ").replace("\r\n\t", "\t");

    // Find the Content-Type header for the attachment part.
    let ct_line = unfolded
        .lines()
        .find(|l| l.starts_with("Content-Type: application/pdf"))
        .expect("Should have Content-Type for PDF attachment");

    // Must include name*=UTF-8'' with the full percent-encoded filename.
    assert!(
        ct_line.contains("name*=UTF-8''"),
        "RFC 2231 Section 4: Content-Type must include name* for non-ASCII \
         filenames, got: {ct_line}"
    );

    // The full filename must roundtrip through parse.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some("résumé.pdf"),
        "Non-ASCII filename must roundtrip via Content-Type name*"
    );
}

/// RFC 2231 Section 3: very long non-ASCII filenames in Content-Type
/// must use continuation parameters (name*0*, name*1*, ...) to keep
/// lines within the 78-character recommendation.
#[test]
fn build_long_non_ascii_filename_content_type_has_name_star_continuation() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    let filename = "これはとても長いファイル名です_日本語のテスト_2024年度報告書_最終版.pdf";
    email.attachments = vec![OutgoingAttachment {
        filename: filename.into(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Unfold for inspection.
    let unfolded = s.replace("\r\n ", " ").replace("\r\n\t", "\t");

    // Must include continuation parameters for long filenames.
    let ct_line = unfolded
        .lines()
        .find(|l| l.starts_with("Content-Type: application/pdf"))
        .expect("Should have Content-Type for PDF attachment");

    // Either single name* or continuation name*0*
    assert!(
        ct_line.contains("name*=UTF-8''") || ct_line.contains("name*0*=UTF-8''"),
        "RFC 2231 Section 3-4: Content-Type must include name* or name*0* \
         for non-ASCII filenames, got: {ct_line}"
    );

    // Full filename must roundtrip.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some(filename),
        "Long non-ASCII filename must roundtrip"
    );
}

/// Regression test: with `max_raw_bytes = 42`, every encoded word must stay
/// within 75 characters (RFC 2047 Section 2) even after `snap_utf8_chunk_end`
/// adjusts the chunk boundary for multi-byte UTF-8 characters.
///
/// The conservative limit of 42 raw bytes ensures that even if snap expands
/// a chunk by up to 3 bytes (to complete a 4-byte UTF-8 character), the
/// result (45 bytes max) still encodes to at most 60 base64 chars + 12
/// overhead = 72 chars, safely within the 75-char limit.
///
/// With the old `max_raw_bytes = 45`, chunks of 43-45 bytes produce 60
/// base64 chars + 12 overhead = 72 chars — which is within 75 but leaves
/// only a 3-char margin. This test enforces the tighter bound (max 68
/// chars per word with aligned chunks) to verify the conservative limit.
#[test]
fn encode_rfc2047_four_byte_boundary_length() {
    // 42 raw bytes → ceil(42/3)*4 = 56 base64 chars + 12 overhead = 68.
    // With snap backing up to a character boundary, the chunk can be
    // 40-42 bytes, all of which encode to at most 56 base64 chars.
    // The strict bound is 68 chars per encoded word.
    let max_expected_word_len = 68;

    // Try every alignment of 4-byte characters relative to the chunk
    // boundary. With N ASCII bytes followed by 4-byte emoji, the snap
    // function produces chunks of varying sizes depending on alignment.
    for ascii_prefix_len in 0..48 {
        // Build: N ASCII bytes + enough 4-byte emoji to exceed one chunk
        let mut input = "x".repeat(ascii_prefix_len);
        // Append 30 copies of U+1F30D (🌍, 4 bytes each = 120 bytes)
        for _ in 0..30 {
            input.push('\u{1F30D}');
        }

        let encoded = encode_rfc2047_if_needed(&input);

        for word in encoded.split(' ') {
            if word.starts_with("=?") {
                assert!(
                    word.len() <= max_expected_word_len,
                    "RFC 2047 Section 2: encoded word is {} chars (max {max_expected_word_len}) \
                     with ascii_prefix_len={ascii_prefix_len}: {word}",
                    word.len()
                );
            }
        }
    }
}

/// RFC 5322 Section 3.6: standard headers have specific occurrence limits.
/// `extra_headers` must not duplicate headers the builder already emits.
#[test]
fn extra_headers_rejects_standard_header_names() {
    let standard_names = [
        "From",
        "To",
        "Cc",
        "Bcc",
        "Reply-To",
        "Subject",
        "Date",
        "Message-ID",
        "MIME-Version",
        "Content-Type",
        "Content-Transfer-Encoding",
        "In-Reply-To",
        "References",
    ];

    for name in &standard_names {
        let mut email = make_email();
        email.body_text = Some("body".into());
        email.extra_headers = vec![(hdr(name), "duplicate".into())];

        let result = build_message(&email);
        assert!(
            result.is_err(),
            "extra_headers should reject standard header '{name}' (RFC 5322 Section 3.6)"
        );
    }
}

/// RFC 5322 Section 3.6: case-insensitive check — "from" == "From".
#[test]
fn extra_headers_rejects_standard_names_case_insensitive() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("from"), "dup".into())];

    let result = build_message(&email);
    assert!(
        result.is_err(),
        "extra_headers should reject 'from' case-insensitively (RFC 5322 Section 3.6)"
    );
}

/// Non-standard headers in `extra_headers` should still be accepted.
#[test]
fn extra_headers_accepts_custom_headers() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("X-Custom"), "value".into())];

    let result = build_message(&email);
    assert!(result.is_ok(), "custom headers should be accepted");
    let s = raw_str(&result.unwrap());
    assert!(s.contains("X-Custom: value"));
}

/// Content-ID values containing CRLF or other garbage must be rejected
/// rather than emitted as malformed msg-id syntax.
///
/// RFC 2392 uses the RFC 5322 `msg-id` syntax, so a caller-provided
/// `Content-ID` that is no longer a valid msg-id body after trimming must
/// fail fast instead of being sanitized into an invalid header value.
#[test]
fn content_id_crlf_injection_rejected() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        subject: "test".into(),
        body_html: Some("<img src=\"cid:img@ex.com\">".into()),
        body_text: None,
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        in_reply_to: vec![],
        references: vec![],
        extra_headers: vec![],
        attachments: vec![OutgoingAttachment {
            filename: "logo.png".into(),
            content_type: "image/png".into(),
            data: b"PNG".to_vec(),
            is_inline: true,
            content_id: Some("img@ex.com>\r\nBcc: attacker@evil.com".into()),
        }],
    };
    let err = build_message(&email).unwrap_err();
    assert!(
        err.to_string().contains("Content-ID"),
        "invalid Content-ID must be rejected with a Content-ID-specific error: {err}"
    );
}

/// multipart/related Content-Type must include the `type` parameter
/// per RFC 2387 Section 3.1.
#[test]
fn multipart_related_includes_type_parameter() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        subject: "test".into(),
        body_html: Some("<img src=\"cid:logo@ex.com\">".into()),
        body_text: None,
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        in_reply_to: vec![],
        references: vec![],
        extra_headers: vec![],
        attachments: vec![OutgoingAttachment {
            filename: "logo.png".into(),
            content_type: "image/png".into(),
            data: b"PNG".to_vec(),
            is_inline: true,
            content_id: Some("logo@ex.com".into()),
        }],
    };
    let built = build_message(&email).unwrap();
    let s = String::from_utf8_lossy(&built.raw);
    assert!(
        s.contains("type=\"text/html\"") || s.contains("type=\"multipart/alternative\""),
        "multipart/related must include type parameter per RFC 2387 Section 3.1: {s}"
    );
}

/// In-Reply-To must support multiple message-ids, wrapping each one
/// individually in angle brackets (RFC 5322 Section 3.6.4).
#[test]
fn in_reply_to_multiple_message_ids() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        subject: "test".into(),
        body_text: Some("body".into()),
        body_html: None,
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        in_reply_to: vec![mid("id1@host.com"), mid("id2@host.com")],
        references: vec![],
        extra_headers: vec![],
        attachments: vec![],
    };
    let built = build_message(&email).unwrap();
    let s = String::from_utf8_lossy(&built.raw);
    assert!(
        s.contains("<id1@host.com> <id2@host.com>"),
        "In-Reply-To must support multiple msg-ids per RFC 5322 Section 3.6.4: {s}"
    );
}

/// RFC 5322 Section 3.6.4 limits generated `msg-id` values to
/// `dot-atom-text` on the left-hand side. RFC 5322 Appendix A notes that
/// `no-fold-quote` was removed from modern `msg-id` syntax, so the builder
/// must not emit quoted `id-left` values even if a caller injects them via
/// `MessageId::new_unchecked`.
#[test]
fn in_reply_to_quoted_id_left_skipped() {
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.in_reply_to = vec![mid("\"user@inner\"@example.com")];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(
        !s.contains("In-Reply-To:"),
        "quoted obsolete msg-id must be dropped from In-Reply-To per RFC 5322 Section 3.6.4: {s}"
    );
}

// --- RFC 5322 Section 3.6.4: msg-id requires "@" ---
// msg-id = [CFWS] "<" id-left "@" id-right ">" [CFWS]
// Tokens without "@" are not valid message-ids and must be skipped
// by the encoder (Postel's law: be conservative in what you send).

#[test]
fn spec_audit_in_reply_to_valid_msgid() {
    // Baseline: a valid message-id (contains @) is emitted correctly.
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.in_reply_to = vec![mid("abc@example.com")];
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(
        s.contains("In-Reply-To: <abc@example.com>"),
        "Valid message-id must be emitted in angle brackets: {s}"
    );
}

#[test]
fn spec_audit_in_reply_to_invalid_msgid_skipped() {
    // A token without "@" is not a valid msg-id per RFC 5322 Section 3.6.4
    // and must be silently skipped.
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.in_reply_to = vec![mid("invalid-no-at")];
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(
        !s.contains("In-Reply-To:"),
        "In-Reply-To with no valid msg-ids must not be emitted: {s}"
    );
}

#[test]
fn spec_audit_references_mixed_valid_invalid() {
    // Only valid message-ids (containing @) should appear in References.
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.references = vec![
        mid("good@example.com"),
        mid("invalid-no-at"),
        mid("also-bad"),
        mid("better@host.org"),
    ];
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(
        s.contains("<good@example.com>"),
        "Valid msg-id must be emitted: {s}"
    );
    assert!(
        s.contains("<better@host.org>"),
        "Valid msg-id must be emitted: {s}"
    );
    assert!(
        !s.contains("invalid-no-at"),
        "Invalid token without @ must be skipped: {s}"
    );
    assert!(
        !s.contains("also-bad"),
        "Invalid token without @ must be skipped: {s}"
    );
}

#[test]
fn spec_audit_in_reply_to_all_invalid_omits_header() {
    // When ALL tokens lack "@", no In-Reply-To header should be emitted.
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.in_reply_to = vec![mid("no-at-one"), mid("no-at-two")];
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(
        !s.contains("In-Reply-To:"),
        "In-Reply-To must be omitted when all tokens are invalid: {s}"
    );
}

/// RFC 5322 Section 3.6.4: `msg-id = "<" id-left "@" id-right ">"`.
/// Both `id-left` and `id-right` must be non-empty. Message-IDs like
/// `foo@` (empty id-right) or `@bar` (empty id-left) are malformed
/// and must be skipped by the builder.
#[test]
fn spec_audit_msgid_empty_id_left_or_right_skipped() {
    // Empty id-right: "foo@"
    let mut email = make_email();
    email.body_text = Some("text".into());
    email.in_reply_to = vec![mid("foo@")];
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    assert!(
        !s.contains("In-Reply-To:"),
        "msg-id with empty id-right must be skipped \
         (RFC 5322 Section 3.6.4): {s}"
    );

    // Empty id-left: "@bar.com"
    let mut email2 = make_email();
    email2.body_text = Some("text".into());
    email2.references = vec![mid("@bar.com")];
    let built2 = build_message(&email2).unwrap();
    let s2 = raw_str(&built2);
    assert!(
        !s2.contains("References:"),
        "msg-id with empty id-left must be skipped \
         (RFC 5322 Section 3.6.4): {s2}"
    );
}

// --- RFC 2046 Section 5.2.1: message/* encoding restrictions ---
// message/rfc822 (and message/* in general) MUST NOT use content-transfer-
// encodings other than 7bit, 8bit, or binary. The builder must not
// base64-encode these parts.

#[test]
fn spec_audit_message_rfc822_attachment_uses_7bit_encoding() {
    // RFC 2046 Section 5.2.1: message/rfc822 parts MUST NOT be encoded
    // with base64 or quoted-printable. The builder must use 7bit (or 8bit
    // for non-ASCII data) and write the attachment data verbatim.
    let rfc822_body = b"From: nested@example.com\r\nTo: other@example.com\r\nSubject: inner\r\n\r\nInner body\r\n";
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: rfc822_body.to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Must NOT use base64 encoding
    assert!(
        !s.contains("Content-Transfer-Encoding: base64"),
        "message/rfc822 MUST NOT use base64 per RFC 2046 Section 5.2.1: {s}"
    );
    // Must use 7bit encoding (all bytes are ASCII)
    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "message/rfc822 with ASCII data must use 7bit encoding: {s}"
    );
    // Data must appear verbatim (not base64-encoded)
    assert!(
        s.contains("From: nested@example.com"),
        "message/rfc822 data must be written verbatim: {s}"
    );
    assert!(
        s.contains("Inner body"),
        "message/rfc822 body must be written verbatim: {s}"
    );
}

#[test]
fn spec_audit_message_rfc822_non_ascii_uses_8bit_encoding() {
    // RFC 2046 Section 5.2.1: when message/rfc822 data contains non-ASCII
    // bytes, the encoding must be 8bit (not base64).
    let rfc822_body = "From: nested@example.com\r\nTo: other@example.com\r\nSubject: =?UTF-8?B?w7xiZXI=?=\r\n\r\nK\u{f6}rper\r\n";
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: rfc822_body.as_bytes().to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        !s.contains("Content-Transfer-Encoding: base64"),
        "message/rfc822 MUST NOT use base64 per RFC 2046 Section 5.2.1: {s}"
    );
    assert!(
        s.contains("Content-Transfer-Encoding: 8bit"),
        "message/rfc822 with non-ASCII data must use 8bit encoding: {s}"
    );
    // Data must appear verbatim
    assert!(
        s.contains("K\u{f6}rper"),
        "message/rfc822 data must be written verbatim: {s}"
    );
}

#[test]
fn spec_audit_message_rfc822_rejects_utf8_headers() {
    // RFC 2046 Section 5.2.1 requires message/rfc822 header fields to
    // remain US-ASCII, with RFC 2047 used for non-ASCII text. RFC 6532
    // Section 3.7 defines message/global for encapsulated messages with
    // raw UTF-8 header values.
    let rfc822_body = "From: nested@example.com\r\nSubject: caf\u{00E9}\r\n\r\nASCII body\r\n";
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: rfc822_body.as_bytes().to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let err =
        build_message(&email).expect_err("message/rfc822 with raw UTF-8 headers must be rejected");
    match err {
        Error::InvalidAttachment(msg) => {
            assert!(
                msg.contains("message/global"),
                "error should direct callers to message/global, got: {msg}"
            );
        }
        other => panic!("expected InvalidAttachment error, got {other:?}"),
    }
}

#[test]
fn spec_audit_message_rfc822_requires_from_subject_or_date() {
    // RFC 2046 Section 5.2.1 relaxes top-level message requirements for
    // encapsulated message/rfc822 bodies, but still requires at least one
    // of From, Subject, or Date to be present in the embedded header block.
    let rfc822_body = b"To: other@example.com\r\n\r\nInner body\r\n";
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: rfc822_body.to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let err = build_message(&email).expect_err(
        "message/rfc822 without From, Subject, or Date must be rejected per RFC 2046 Section 5.2.1",
    );
    match err {
        Error::InvalidAttachment(msg) => {
            assert!(
                msg.contains("From") && msg.contains("Subject") && msg.contains("Date"),
                "error should mention the required header set, got: {msg}"
            );
        }
        other => panic!("expected InvalidAttachment error, got {other:?}"),
    }
}

#[test]
fn spec_audit_message_rfc822_rejects_bare_lf_body() {
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: b"From: nested@example.com\nSubject: inner\n\nInner body\n".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let err = build_message(&email)
        .expect_err("message/rfc822 with bare LF must be rejected before emitting 7bit/8bit");
    match err {
        Error::InvalidAttachment(msg) => {
            assert!(
                msg.contains("bare LF"),
                "error should explain the CRLF violation, got: {msg}"
            );
        }
        other => panic!("expected InvalidAttachment error, got {other:?}"),
    }
}

#[test]
fn spec_audit_message_rfc822_rejects_nul_bytes() {
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: b"From: nested@example.com\r\nSubject: inner\r\n\r\nbody\x00\r\n".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let err = build_message(&email)
        .expect_err("message/rfc822 with NUL bytes must be rejected before emitting 8bit");
    match err {
        Error::InvalidAttachment(msg) => {
            assert!(
                msg.contains("NUL"),
                "error should explain the NUL violation, got: {msg}"
            );
        }
        other => panic!("expected InvalidAttachment error, got {other:?}"),
    }
}

#[test]
fn spec_audit_message_partial_rejects_non_ascii_bytes() {
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "fragment.eml".into(),
        content_type: "message/partial; id=\"frag-1\"; number=1; total=2".into(),
        data: b"From: nested@example.com\r\nSubject: inner\r\n\r\nK\xc3\xb6rper\r\n".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let err = build_message(&email).expect_err(
        "message/partial must reject non-ASCII bytes because RFC 2046 Section 5.2.2 requires 7bit only",
    );
    match err {
        Error::InvalidAttachment(msg) => {
            assert!(
                msg.contains("7bit"),
                "error should explain the 7bit-only rule, got: {msg}"
            );
        }
        other => panic!("expected InvalidAttachment error, got {other:?}"),
    }
}

#[test]
fn spec_audit_message_external_body_rejects_non_ascii_bytes() {
    let mut email = make_email();
    email.body_text = Some("outer body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "external-body.eml".into(),
        content_type: "message/external-body; access-type=URL; URL=\"https://example.test/ref\""
            .into(),
        data: b"Content-Type: text/plain; charset=UTF-8\r\n\r\nK\xc3\xb6rper\r\n".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let err = build_message(&email).expect_err(
        "message/external-body must reject non-ASCII bytes because RFC 2046 Section 5.2.3 requires 7bit only",
    );
    match err {
        Error::InvalidAttachment(msg) => {
            assert!(
                msg.contains("7bit"),
                "error should explain the 7bit-only rule, got: {msg}"
            );
        }
        other => panic!("expected InvalidAttachment error, got {other:?}"),
    }
}

#[test]
fn spec_audit_message_type_case_insensitive() {
    // The content type check for message/* must be case-insensitive
    // per RFC 2045 Section 5.1.
    let rfc822_body = b"From: a@b.com\r\nSubject: test\r\n\r\nbody\r\n";
    let mut email = make_email();
    email.body_text = Some("outer".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "msg.eml".into(),
        content_type: "Message/RFC822".into(),
        data: rfc822_body.to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    assert!(
        !s.contains("Content-Transfer-Encoding: base64"),
        "Message/RFC822 (mixed case) MUST NOT use base64: {s}"
    );
}

/// RFC 5321 Section 4.1.2: Domain = sub-domain *("." sub-domain) — each
/// sub-domain must be non-empty, so consecutive dots ("..") in the domain
/// indicate an empty label and must be rejected.
#[test]
fn test_validate_address_rejects_consecutive_dots_in_domain() {
    let cases = [
        "user@exam..ple.com",
        "user@..example.com",
        "user@example..com",
        "user@a..b..c.com",
    ];
    for email in &cases {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        let result = validate_address(&addr);
        assert!(
            result.is_err(),
            "expected rejection for consecutive dots in domain: {email}"
        );
    }
}

/// RFC 5321 domain labels inherit the DNS 63-octet per-label limit.
/// The builder already enforces SMTP-style mailbox validation, so it must
/// reject addresses whose domain contains an overlong label instead of
/// emitting an undeliverable addr-spec.
#[test]
fn test_validate_address_rejects_overlong_domain_label() {
    let overlong = format!("user@{}.example", "a".repeat(64));
    let addr = Address {
        name: None,
        email: overlong,
    };

    let err = validate_address(&addr).expect_err(
        "domain labels longer than 63 octets must be rejected during builder validation",
    );
    match err {
        Error::InvalidAddress(msg) => assert!(
            msg.contains("63-octet") || msg.contains("63 octet"),
            "error should explain the 63-octet domain label limit, got: {msg}"
        ),
        other => panic!("expected InvalidAddress for overlong label, got {other:?}"),
    }
}

/// RFC 5321 Section 4.1.2: `Dot-string = Atom *("." Atom)` — each atom
/// between dots must be non-empty, so consecutive dots (`..`), leading
/// dots, and trailing dots are invalid in unquoted local-parts.
/// Quoted local-parts (`"..."`) have different rules and must still allow
/// consecutive dots.
#[test]
fn test_validate_address_rejects_consecutive_dots_in_local_part() {
    // Unquoted local-parts with consecutive dots must be rejected.
    let cases = vec![
        "us..er@example.com",
        "user..@example.com",
        "..user@example.com",
    ];
    for email in &cases {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_err(),
            "expected rejection for unquoted local-part with consecutive dots: {email}"
        );
    }

    // Quoted local-part with consecutive dots is valid per RFC 5322 Section 3.2.4.
    let quoted_addr = Address {
        name: None,
        email: "\"us..er\"@example.com".to_string(),
    };
    assert!(
        validate_address(&quoted_addr).is_ok(),
        "quoted local-part with consecutive dots should be accepted"
    );
}

/// Regression: quoted local-parts with unescaped inner double-quotes
/// must be rejected per RFC 5322 Section 3.2.4.
///
/// `quoted-string = DQUOTE *( qtext / quoted-pair ) DQUOTE`
/// where `qtext` excludes `"` and `\`, and `quoted-pair = "\" (VCHAR / WSP)`.
/// An unescaped `"` inside the quoted-string is a syntax error.
#[test]
fn validate_address_rejects_malformed_quoted_local() {
    // Unescaped inner quote: `"a"b"@example.com`
    let addr = Address {
        name: None,
        email: "\"a\"b\"@example.com".into(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "quoted local-part with unescaped inner double-quote must be rejected \
         (RFC 5322 Section 3.2.4)"
    );
}

/// Properly escaped quoted local-parts must still be accepted.
#[test]
fn validate_address_accepts_properly_escaped_quoted_local() {
    // Escaped inner quote: `"a\"b"@example.com`
    let addr = Address {
        name: None,
        email: r#""a\"b"@example.com"#.into(),
    };
    assert!(
        validate_address(&addr).is_ok(),
        "quoted local-part with properly escaped inner quote must be accepted \
         (RFC 5322 Section 3.2.4)"
    );
}

/// Quoted local-parts with bare backslash (not followed by VCHAR/WSP)
/// must be rejected per RFC 5322 Section 3.2.4.
#[test]
fn validate_address_rejects_trailing_backslash_in_quoted_local() {
    // Trailing backslash: `"abc\"@example.com` — the backslash escapes
    // the closing quote, so there's no real closing quote.
    let addr = Address {
        name: None,
        email: "\"abc\\\"@example.com".into(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "quoted local-part with backslash escaping the closing quote must be rejected \
         (RFC 5322 Section 3.2.4)"
    );
}

// ===== Edge-case bug-hunting tests =====

/// RFC 5322 Section 3.4: an all-whitespace display name is not a valid
/// `phrase` (`1*word`), so it must be treated as absent. The Display
/// impl should output just the email, not `"   " <a@b.com>`.
#[test]
fn edge_address_all_whitespace_display_name() {
    let addr = Address {
        name: Some("   ".to_string()),
        email: "a@b.com".to_string(),
    };
    let formatted = format!("{addr}");
    assert_eq!(
        formatted, "a@b.com",
        "All-whitespace display name must be treated as absent \
         per RFC 5322 Section 3.4"
    );
}

/// RFC 5322 Section 2.1: subject containing CR/LF must be sanitized
/// to prevent header injection. A subject like "Hello\r\nBcc: evil"
/// must NOT produce a separate Bcc header line in the output.
#[test]
fn edge_subject_crlf_injection_sanitized() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Hello\r\nBcc: evil@hacker.com".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = String::from_utf8_lossy(&built.raw);
    // The CRLF must be stripped so "Bcc:" does NOT appear as a
    // separate header line (i.e. preceded by CRLF).
    assert!(
        !raw.contains("\r\nBcc:"),
        "CR/LF in subject must be sanitized to prevent header injection \
         (RFC 5322 Section 2.1). Got:\n{raw}"
    );
}

/// RFC 5322 Section 2.1: `extra_headers` containing CR/LF must also be
/// sanitized. An extra header with an injected CRLF must not produce
/// additional headers.
#[test]
fn edge_extra_header_crlf_injection() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Normal".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![(hdr("X-Custom"), "value\r\nBcc: evil@hacker.com".into())],
    };
    let built = build_message(&email).unwrap();
    let raw = String::from_utf8_lossy(&built.raw);
    // The injected CRLF must be stripped so "Bcc:" does NOT appear
    // as a separate header line.
    assert!(
        !raw.contains("\r\nBcc:"),
        "CR/LF in extra_headers must be sanitized (RFC 5322 Section 2.1). \
         Got:\n{raw}"
    );
}

/// RFC 5322 Section 3.4: a display name that consists only of a tab
/// character should be treated as absent.
#[test]
fn edge_address_tab_only_display_name() {
    let addr = Address {
        name: Some("\t".to_string()),
        email: "a@b.com".to_string(),
    };
    let formatted = format!("{addr}");
    assert_eq!(
        formatted, "a@b.com",
        "Tab-only display name must be treated as absent"
    );
}

/// RFC 5322 Section 2.1: display name containing CRLF must be
/// sanitized in the built message to prevent header injection.
#[test]
fn edge_display_name_crlf_injection() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: Some("Alice\r\nBcc: evil@hacker.com".into()),
            email: "a@b.com".into(),
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "c@d.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Test".into(),
        body_text: Some("test".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = String::from_utf8_lossy(&built.raw);
    // The CRLF in the display name must be stripped so "Bcc:" does NOT
    // appear as a separate header line.
    assert!(
        !raw.contains("\r\nBcc:"),
        "CR/LF in display name must be sanitized (RFC 5322 Section 2.1). \
         Got:\n{raw}"
    );
}

/// RFC 5322 Section 3.2.4: `qtext = %d33 / %d35-91 / %d93-126`.
/// Control characters (0x00-0x08, 0x0A-0x1F) and DEL (0x7F) are NOT
/// valid qtext. Generators MUST NOT produce obsolete constructs
/// (RFC 5322 Section 4). The builder must reject these bytes in
/// quoted local-parts to produce strictly conformant output.
#[test]
fn validate_address_rejects_control_chars_in_quoted_local() {
    // NUL (0x00) in quoted local-part
    let addr = Address {
        name: None,
        email: "\"\x00user\"@example.com".to_string(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "quoted local-part with NUL (0x00) must be rejected \
         (RFC 5322 Section 3.2.4: qtext does not include control characters)"
    );

    // BEL (0x07) in quoted local-part
    let addr = Address {
        name: None,
        email: "\"\x07bell\"@example.com".to_string(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "quoted local-part with BEL (0x07) must be rejected \
         (RFC 5322 Section 3.2.4)"
    );

    // LF (0x0A) in quoted local-part
    let addr = Address {
        name: None,
        email: "\"line\nfeed\"@example.com".into(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "quoted local-part with LF (0x0A) must be rejected \
         (RFC 5322 Section 3.2.4)"
    );

    // DEL (0x7F) in quoted local-part
    let addr = Address {
        name: None,
        email: "\"del\x7F\"@example.com".to_string(),
    };
    assert!(
        validate_address(&addr).is_err(),
        "quoted local-part with DEL (0x7F) must be rejected \
         (RFC 5322 Section 3.2.4)"
    );
}

/// RFC 5322 Section 3.2.3 / Section 3.4.1: an unquoted local-part is
/// a `dot-atom`, and each atom must contain only `atext` characters:
///
/// ```text
/// atext = ALPHA / DIGIT / "!" / "#" / "$" / "%" / "&" / "'" /
///         "*" / "+" / "-" / "/" / "=" / "?" / "^" / "_" /
///         "`" / "{" / "|" / "}" / "~"
/// ```
///
/// Characters like `(`, `)`, `<`, `>`, `,`, `;`, `:`, `\`, `"`,
/// `[`, `]` are NOT valid in unquoted local-parts and must be
/// rejected by the builder (conservative in what we send).
#[test]
fn validate_address_rejects_non_atext_in_unquoted_local() {
    let specials = vec![
        ("user(comment)@example.com", '('),
        ("user)bad@example.com", ')'),
        ("user<admin>@example.com", '<'),
        ("user>test@example.com", '>'),
        ("user,name@example.com", ','),
        ("user;name@example.com", ';'),
        ("user:name@example.com", ':'),
        ("user\\name@example.com", '\\'),
        ("user\"name@example.com", '"'),
        ("user[name@example.com", '['),
        ("user]name@example.com", ']'),
        ("user name@example.com", ' '),
    ];
    for (email, ch) in &specials {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_err(),
            "unquoted local-part with '{ch}' must be rejected \
             per RFC 5322 Section 3.2.3 (atext): {email}"
        );
    }
}

/// RFC 5322 Section 3.2.3: valid `atext` characters in unquoted
/// local-parts must continue to be accepted after adding the
/// atext validation.
#[test]
fn validate_address_accepts_valid_atext_local() {
    let cases = vec![
        "user@example.com",
        "user.name@example.com",
        "user+tag@example.com",
        "user-name@example.com",
        "user_name@example.com",
        "user!name@example.com",
        "user#name@example.com",
        "user$name@example.com",
        "user%name@example.com",
        "user&name@example.com",
        "user'name@example.com",
        "user*name@example.com",
        "user/name@example.com",
        "user=name@example.com",
        "user?name@example.com",
        "user^name@example.com",
        "user`name@example.com",
        "user{name@example.com",
        "user|name@example.com",
        "user}name@example.com",
        "user~name@example.com",
    ];
    for email in &cases {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_ok(),
            "valid atext local-part must be accepted: {email}"
        );
    }
}

/// RFC 5322 Section 3.4.1 `domain-literal` is liberal enough that the
/// familiar RFC 5321-style IPv4/IPv6 address-literals are a valid subset.
/// The message validator must therefore continue to accept them.
#[test]
fn validate_address_accepts_address_literals() {
    let cases = vec![
        "user@[127.0.0.1]",
        "user@[192.168.1.1]",
        "user@[IPv6:::1]",
        "user@[IPv6:2001:db8::1]",
    ];
    for email in &cases {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_ok(),
            "RFC 5321-style address-literal must be accepted as a valid \
             RFC 5322 domain-literal: {email}"
        );
    }
}

/// RFC 5322 Section 3.4.1 / RFC 6532 Section 3.2: malformed
/// `domain-literal` syntax must still be rejected. The liberal grammar
/// allows many bracketed forms that SMTP would reject, but it still does
/// not allow unbalanced brackets, whitespace, or backslash in `dtext`.
#[test]
fn validate_address_rejects_invalid_address_literals() {
    let cases = vec![
        "user@[127.0.0.1",
        "user@[127.0.0.1]]",
        "user@[bad literal]",
        "user@[bad\\literal]",
        "user@[tag:bad value]",
    ];
    for email in &cases {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_err(),
            "invalid RFC 5322 domain-literal syntax must be rejected: {email}"
        );
    }
}

/// RFC 5322 Section 2.2.3: `force_fold_word` must not insert folds
/// inside an unbreakable token. When `line_len` is already 995 (near
/// the limit) and a word is appended, the function should fold BEFORE
/// the word so it starts on a fresh line, preserving the token intact.
///
/// This test calls `force_fold_word` directly with `line_len = 995`,
/// simulating a line with only 3 bytes of remaining capacity. The word
/// is 104 bytes (4-byte emoji + 100 ASCII chars). The function inserts
/// a fold before the word, then emits it as-is on the new line.
#[test]
fn force_fold_preserves_word_integrity_with_multibyte_utf8() {
    let word = "\u{1F389}".to_string() + &"a".repeat(100);
    let bytes = word.as_bytes();
    let mut output = Vec::new();

    // Simulate existing line content: 995 bytes already on the line.
    output.extend_from_slice(&vec![b'X'; 995]);

    let final_line_len = force_fold_word(&mut output, bytes, 995);

    let result = String::from_utf8(output).expect("output should be valid UTF-8");
    let lines: Vec<&str> = result.split("\r\n").collect();
    // The word must appear intact on the second line (after folding).
    assert_eq!(lines.len(), 2, "must fold once: before the word");
    assert_eq!(lines[0].len(), 995, "first line retains original content");
    // Second line: leading space + the full word.
    assert_eq!(
        &lines[1][1..],
        word,
        "word must appear intact without internal folds"
    );
    assert_eq!(
        final_line_len,
        1 + bytes.len(),
        "line_len must track the new line correctly"
    );
}

// ── RFC 5321 Section 4.1.2: domain character validation ──

/// RFC 5321 Section 4.1.2: Domain = sub-domain *("." sub-domain),
/// sub-domain = Let-dig [Ldh-str]. Characters that are not
/// alphanumeric or hyphens must be rejected in non-literal domains.
/// Specials like `(`, `)`, `<`, `>`, `,`, `;`, `@`, `"`, `\` are
/// NOT valid in domains and must be rejected by the validator.
#[test]
fn validate_address_rejects_invalid_domain_characters() {
    let invalid_domains = vec![
        "user@exam(ple.com",
        "user@exam)ple.com",
        "user@exam<ple.com",
        "user@exam>ple.com",
        "user@exam,ple.com",
        "user@exam;ple.com",
        "user@exam@ple.com", // caught by multiple-@ check, but included for completeness
        "user@exam\"ple.com",
        "user@exam\\ple.com",
        "user@exam ple.com",  // space (already caught, but included)
        "user@exam\tple.com", // tab (already caught, but included)
    ];
    for email in &invalid_domains {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_err(),
            "domain with invalid character must be rejected per RFC 5321 Section 4.1.2: {email}"
        );
    }
}

/// Same as above but for quoted local-part branch: the domain
/// validation must also reject invalid domain characters when the
/// local-part is a quoted-string.
#[test]
fn validate_address_rejects_invalid_domain_characters_quoted_local() {
    let invalid_domains = vec![
        r#""user"@exam(ple.com"#,
        r#""user"@exam)ple.com"#,
        r#""user"@exam<ple.com"#,
        r#""user"@exam>ple.com"#,
        r#""user"@exam,ple.com"#,
        r#""user"@exam;ple.com"#,
    ];
    for email in &invalid_domains {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_err(),
            "domain with invalid character must be rejected per RFC 5321 Section 4.1.2 \
             (quoted local-part branch): {email}"
        );
    }
}

/// Valid domains must continue to be accepted after the fix.
#[test]
fn validate_address_accepts_valid_domains() {
    let valid_emails = vec![
        "user@example.com",
        "user@sub.example.com",
        "user@example-host.com",
        "user@a.b.c.d",
        "user@host123.example.org",
        "user@123.456",
        // RFC 6531 Section 3.3: internationalized domain names (U-labels)
        "usuario@domínio.com",
        "user@münchen.de",
        "user@例え.jp",
    ];
    for email in &valid_emails {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_ok(),
            "valid domain must be accepted per RFC 5321 Section 4.1.2: {email}"
        );
    }
}

/// RFC 5322 Section 3.4.1: dot-atom and domain-literal forms coexist, so
/// bracketed domains without whitespace or backslashes must remain valid
/// after the header-address fix.
#[test]
fn validate_address_accepts_domain_literals_after_fix() {
    let valid_emails = vec![
        "user@[127.0.0.1]",
        "user@[192.168.1.1]",
        "user@[IPv6:::1]",
        "user@[IPv6:2001:db8::1]",
        "user@[IPv6:not-an-ip]",
        "user@[IPv6:]",
    ];
    for email in &valid_emails {
        let addr = Address {
            name: None,
            email: (*email).to_string(),
        };
        assert!(
            validate_address(&addr).is_ok(),
            "domain-literal must be accepted per RFC 5322 Section 3.4.1: {email}"
        );
    }
}

// ── RFC 5322 Section 3.6.2: Sender header support for multi-From ──

/// RFC 5322 Section 3.6.2: when From contains multiple mailboxes, the
/// Sender header MUST be present. Building without it must return
/// `Error::MissingSender`.
#[test]
fn build_multi_from_without_sender_returns_error() {
    let email = OutgoingEmail {
        from: vec![
            Address {
                name: Some("Alice".into()),
                email: "alice@example.com".into(),
            },
            Address {
                name: Some("Bob".into()),
                email: "bob@example.com".into(),
            },
        ],
        sender: None,
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Multi from".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let result = build_message(&email);
    assert!(
        matches!(result, Err(Error::MissingSender)),
        "multi-From without Sender must return MissingSender \
         (RFC 5322 Section 3.6.2), got: {result:?}"
    );
}

/// RFC 5322 Section 3.6.2: when From contains multiple mailboxes and
/// Sender is provided, the built message must contain both From and
/// Sender headers. From must list all addresses; Sender must list
/// exactly one.
#[test]
fn build_multi_from_with_sender_emits_both_headers() {
    let email = OutgoingEmail {
        from: vec![
            Address {
                name: Some("Alice".into()),
                email: "alice@example.com".into(),
            },
            Address {
                name: Some("Bob".into()),
                email: "bob@example.com".into(),
            },
        ],
        sender: Some(Address {
            name: Some("Alice".into()),
            email: "alice@example.com".into(),
        }),
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Multi from with sender".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = raw_str(&built);

    // From header must list both addresses
    assert!(
        raw.contains("alice@example.com") && raw.contains("bob@example.com"),
        "From header must contain both addresses: {raw}"
    );
    // Sender header must be present
    assert!(
        raw.contains("Sender: Alice <alice@example.com>"),
        "Sender header must be emitted for multi-From \
         (RFC 5322 Section 3.6.2): {raw}"
    );
}

/// RFC 5322 Section 3.6.2: when From contains a single address,
/// Sender SHOULD NOT be present. If provided and identical to From,
/// we omit it. If different, we emit it.
#[test]
fn build_single_from_with_same_sender_omits_sender() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: Some("Alice".into()),
            email: "alice@example.com".into(),
        }],
        sender: Some(Address {
            name: Some("Alice".into()),
            email: "alice@example.com".into(),
        }),
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Single from same sender".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = raw_str(&built);

    // Sender header must NOT appear when it matches the single From
    // (RFC 5322 Section 3.6.2: "the sender field SHOULD NOT be present")
    assert!(
        !raw.contains("\r\nSender:"),
        "Sender header should be omitted when identical to single From \
         (RFC 5322 Section 3.6.2): {raw}"
    );
}

/// RFC 5322 Section 3.6.2: `Sender` should only be omitted when the
/// single `From` mailbox specification and the `Sender` mailbox
/// specification are identical. A changed display-name makes them
/// different mailbox specifications even if the addr-spec matches.
#[test]
fn build_single_from_with_same_addr_spec_but_different_sender_name_emits_sender() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: Some("Alice Example".into()),
            email: "alice@example.com".into(),
        }],
        sender: Some(Address {
            name: Some("Alice via Assistant".into()),
            email: "alice@example.com".into(),
        }),
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Single from sender display-name differs".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = raw_str(&built);

    assert!(
        raw.contains("Sender: Alice via Assistant <alice@example.com>"),
        "Sender header must be emitted when the mailbox specification differs \
         even if the addr-spec matches (RFC 5322 Section 3.6.2): {raw}"
    );
}

/// RFC 5322 Section 3.6.2: single From with a different Sender must
/// emit the Sender header.
#[test]
fn build_single_from_with_different_sender_emits_sender() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: Some("Alice".into()),
            email: "alice@example.com".into(),
        }],
        sender: Some(Address {
            name: Some("Secretary".into()),
            email: "secretary@example.com".into(),
        }),
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Single from different sender".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = raw_str(&built);

    assert!(
        raw.contains("Sender: Secretary <secretary@example.com>"),
        "Sender header must be emitted when different from single From \
         (RFC 5322 Section 3.6.2): {raw}"
    );
}

/// RFC 5322 Section 3.6.2: empty From (no addresses) must return
/// `Error::MissingFrom`.
#[test]
fn build_empty_from_returns_error() {
    let email = OutgoingEmail {
        from: vec![],
        sender: None,
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "No from".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let result = build_message(&email);
    assert!(
        matches!(result, Err(Error::MissingFrom)),
        "empty From must return MissingFrom (RFC 5322 Section 3.6.2), \
         got: {result:?}"
    );
}

/// RFC 5322 Section 3.6.2: multi-From round-trip — build and parse back,
/// verifying both From addresses and the Sender are preserved.
#[test]
fn build_multi_from_round_trip() {
    let email = OutgoingEmail {
        from: vec![
            Address {
                name: Some("Alice".into()),
                email: "alice@example.com".into(),
            },
            Address {
                name: Some("Bob".into()),
                email: "bob@example.com".into(),
            },
        ],
        sender: Some(Address {
            name: Some("Alice".into()),
            email: "alice@example.com".into(),
        }),
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "Multi from round-trip".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    // Both From addresses must be parsed back
    assert_eq!(parsed.from.len(), 2, "parsed From must contain 2 addresses");
    assert_eq!(parsed.from[0].email, "alice@example.com");
    assert_eq!(parsed.from[1].email, "bob@example.com");

    // Sender must be parsed back
    assert!(
        parsed.sender.is_some(),
        "parsed Sender must be present for multi-From"
    );
    assert_eq!(parsed.sender.as_ref().unwrap().email, "alice@example.com");
}

/// RFC 5322 Section 3.6.2: Sender address must be validated.
#[test]
fn build_invalid_sender_address_returns_error() {
    let email = OutgoingEmail {
        from: vec![
            Address {
                name: None,
                email: "alice@example.com".into(),
            },
            Address {
                name: None,
                email: "bob@example.com".into(),
            },
        ],
        sender: Some(Address {
            name: None,
            email: "not-valid".into(),
        }),
        to: vec![Address {
            name: None,
            email: "rcpt@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "test".into(),
        body_text: Some("Hello".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };
    let result = build_message(&email);
    assert!(
        matches!(result, Err(Error::InvalidAddress(_))),
        "invalid Sender address must return InvalidAddress, got: {result:?}"
    );
}

/// RFC 2046 Section 5.1.1: boundary MUST NOT appear within the
/// encapsulated material. The fallback path in `generate_boundary_not_in`
/// must check the counter-based boundary against content, not blindly
/// return it.
#[test]
fn generate_boundary_not_in_never_returns_boundary_present_in_content() {
    use std::fmt::Write;

    // Build content that contains a range of fallback boundaries.
    // We embed the exact fallback pattern for many counter values so that
    // if the function returns any of them unchecked, the assertion fails.
    let current = MSG_ID_COUNTER.load(Ordering::Relaxed);
    let mut content = String::new();
    // Cover a wide range around the current counter value so we catch
    // both the random-path boundaries and fallback-path boundaries.
    for i in current..current + 200 {
        let _ = writeln!(content, "----=_Part_fallback_{i:016x}");
    }
    let content_bytes = content.as_bytes();

    let boundary = generate_boundary_not_in(content_bytes);
    assert!(
        !contains_boundary(content_bytes, &boundary),
        "generate_boundary_not_in returned a boundary that appears in the content: {boundary}"
    );
}

/// RFC 5322 Section 3.6: Sender must appear at most once.
/// Adding "Sender" via `extra_headers` when `OutgoingEmail.sender` is set
/// must be rejected to prevent duplicate Sender headers.
#[test]
fn extra_headers_rejects_sender_header() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    // Set the sender field so the builder emits a Sender header automatically.
    email.sender = Some(Address {
        name: Some("Secretary".into()),
        email: "secretary@example.com".into(),
    });
    // Also smuggle a Sender via extra_headers — this must be rejected.
    email.extra_headers = vec![(hdr("Sender"), "evil@example.com".into())];

    let result = build_message(&email);
    assert!(
        result.is_err(),
        "extra_headers must reject 'Sender' because it is a standard header \
         managed by the builder (RFC 5322 Section 3.6)"
    );
}

/// Regression test: when all attachments are inline (`is_inline=true`,
/// `content_id=Some`) but there is no HTML body, the attachments must
/// still appear in the built message. Previously, `has_inline` was
/// gated on `has_html`, and `has_regular` was empty (all went to the
/// inline partition), so `has_attachments` was false and attachments
/// were silently dropped.
#[test]
fn inline_attachment_without_html_not_dropped() {
    let mut email = make_email();
    email.body_text = Some("Plain text body".into());
    email.body_html = None; // no HTML

    email.attachments = vec![OutgoingAttachment {
        filename: "logo.png".into(),
        content_type: "image/png".into(),
        data: vec![0x89, 0x50, 0x4E, 0x47], // PNG magic bytes
        is_inline: true,
        content_id: Some("logo001@example.com".into()),
    }];

    let built = build_message(&email).unwrap();
    let raw = raw_str(&built);

    // The attachment must be present in the built message
    assert!(
        raw.contains("logo.png"),
        "inline attachment filename must appear in the message even without HTML body"
    );

    // Parse it back and verify the attachment is present
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.attachments.len(),
        1,
        "parsed message must contain the inline attachment"
    );
    assert_eq!(parsed.attachments[0].filename.as_deref(), Some("logo.png"));
}

/// Regression test: a non-ASCII subject whose RFC 2047 encoded-word is
/// long enough to force a fold before the first token must not acquire
/// a spurious leading space after round-tripping through build + parse.
///
/// The builder folds `Subject:\r\n =?UTF-8?B?...?=` and the parser's
/// continuation-line handling was preserving the leading whitespace as
/// part of the decoded value. RFC 5322 Section 2.2 says the field body
/// starts after optional whitespace following the colon, so the leading
/// space must be stripped.
#[test]
fn rfc2047_subject_no_spurious_leading_space_after_fold() {
    let mut email = make_email();
    // Non-ASCII subject long enough that "Subject: " (9 chars) +
    // encoded word exceeds the RFC 2047 76-char limit, forcing a fold.
    // Each UTF-8 character is 3 bytes, base64 expands ~4/3, plus 12
    // chars overhead for =?UTF-8?B?...?=. 20 CJK chars should do it:
    // 20 * 3 = 60 bytes -> 80 base64 chars + 12 overhead = 92 chars > 76.
    let subject = "\u{4F60}\u{597D}\u{4E16}\u{754C}\u{4F60}\u{597D}\
                    \u{4E16}\u{754C}\u{4F60}\u{597D}\u{4E16}\u{754C}\
                    \u{4F60}\u{597D}\u{4E16}\u{754C}\u{4F60}\u{597D}\
                    \u{4E16}\u{754C}";
    email.subject = subject.to_string();
    email.body_text = Some("body".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    let parsed_subject = parsed.subject.unwrap();
    assert!(
        !parsed_subject.starts_with(' '),
        "parsed subject must not have a leading space; got: {parsed_subject:?}"
    );
    assert_eq!(
        parsed_subject, subject,
        "round-tripped subject must match original"
    );
}

/// Long non-ASCII filenames must use RFC 2231 continuation parameters
/// to avoid producing header lines that exceed the 998-character hard
/// limit (RFC 5322 Section 2.1.1). Without continuation, the
/// `filename*=UTF-8''<percent-encoded>` parameter can become a single
/// word exceeding 998 chars, and `force_fold_word` inserts `\r\n ` that
/// corrupts the parameter value (the space becomes part of the decoded
/// filename after RFC 5322 Section 2.2.3 unfolding).
///
/// RFC 2231 Section 3: "Long MIME media type or disposition parameter
/// values [...] can be split into smaller segments".
#[test]
fn build_long_non_ascii_filename_lines_within_limit() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    // 400 CJK characters → each is 3 UTF-8 bytes → 1200 bytes.
    // Each byte percent-encodes to 3 chars → up to 3600 chars encoded.
    // filename*=UTF-8''<3600 chars> far exceeds the 998-char hard limit.
    let long_name: String = "日".repeat(400);
    let filename = format!("{long_name}.txt");
    email.attachments = vec![OutgoingAttachment {
        filename: filename.clone(),
        content_type: "application/octet-stream".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).expect("build must succeed");

    // Every line in the output must be ≤ 998 characters (excluding CRLF).
    // RFC 5322 Section 2.1.1: "Each line of characters MUST be no more
    // than 998 characters [...] excluding the CRLF."
    let raw = raw_str(&built);
    for (i, line) in raw.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "line {} is {} chars (max 998): {:?}",
            i + 1,
            line.len(),
            &line[..line.len().min(120)],
        );
    }

    // The encoded filename must round-trip through the parser.
    let parsed = crate::parse_email(&built.raw).expect("parse must succeed");
    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some(filename.as_str()),
        "Long non-ASCII filename must round-trip through RFC 2231 \
         continuation parameters"
    );
}

/// RFC 2231 Section 3 continuation parameters: the builder must split
/// long encoded filenames into numbered sections (`filename*0*=`,
/// `filename*1*=`, etc.) and the parser must reassemble them.
#[test]
fn build_long_non_ascii_filename_uses_continuation() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    let long_name: String = "é".repeat(200);
    let filename = format!("{long_name}.pdf");
    email.attachments = vec![OutgoingAttachment {
        filename: filename.clone(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).expect("build must succeed");
    let raw = raw_str(&built);

    // With 200 'é' chars (each → %C3%A9 = 6 chars = 1200 chars encoded),
    // the encoded filename far exceeds a single parameter's capacity.
    // The builder must use continuation parameters.
    assert!(
        raw.contains("filename*0*=UTF-8''"),
        "Long filename must use RFC 2231 continuation (filename*0*=), got: \
         {raw}",
    );

    // Round-trip
    let parsed = crate::parse_email(&built.raw).expect("parse must succeed");
    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some(filename.as_str()),
    );
}

/// RFC 2183 page 3 says disposition parameter values longer than 78
/// characters "MUST be encoded" using the RFC 2231 continuation
/// mechanism. A long ASCII filename that still fits under the RFC 5322
/// 998-octet hard line limit must therefore use `filename*0*=...`,
/// not a plain `filename="..."` quoted-string.
#[test]
fn build_medium_long_ascii_filename_uses_rfc2231_in_content_disposition() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    let filename = format!("{}.txt", "a".repeat(90));
    email.attachments = vec![OutgoingAttachment {
        filename: filename.clone(),
        content_type: "application/octet-stream".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).expect("build must succeed");
    let raw = raw_str(&built);

    assert!(
        raw.contains("Content-Disposition: attachment;\r\n filename*0*=UTF-8''")
            || raw.contains("Content-Disposition: attachment; filename*0*=UTF-8''"),
        "long ASCII Content-Disposition filename must use RFC 2231 continuation: {raw}"
    );
    assert!(
        !raw.contains(&format!(
            "Content-Disposition: attachment; filename=\"{filename}\""
        )),
        "long ASCII Content-Disposition filename must not use plain quoted-string: {raw}"
    );

    let parsed = crate::parse_email(&built.raw).expect("parse must succeed");
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some(filename.as_str())
    );
}

/// RFC 2231 Section 3 applies equally to media type parameters.
/// `Content-Type: ...; name="..."` must switch to `name*0*=...` when the
/// ASCII filename exceeds the 78-character limit from RFC 2183.
#[test]
fn build_medium_long_ascii_filename_uses_rfc2231_in_content_type_name() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    let filename = format!("{}.pdf", "b".repeat(90));
    email.attachments = vec![OutgoingAttachment {
        filename: filename.clone(),
        content_type: "application/pdf".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).expect("build must succeed");
    let raw = raw_str(&built);

    assert!(
        raw.contains("Content-Type: application/pdf;\r\n name*0*=UTF-8''")
            || raw.contains("Content-Type: application/pdf; name*0*=UTF-8''"),
        "long ASCII Content-Type name parameter must use RFC 2231 continuation: {raw}"
    );
    assert!(
        !raw.contains(&format!(
            "Content-Type: application/pdf; name=\"{filename}\""
        )),
        "long ASCII Content-Type name parameter must not use plain quoted-string: {raw}"
    );
}

/// Long ASCII filenames must also switch to RFC 2231 continuation syntax
/// when a single `filename="..."` parameter would exceed the RFC 5322
/// hard line limit. RFC 2231 Section 3 applies to long parameter values
/// regardless of whether they contain non-ASCII octets.
#[test]
fn build_long_ascii_filename_lines_within_limit() {
    let mut email = make_email();
    email.body_text = Some("Body".into());
    let long_name = "a".repeat(1200);
    let filename = format!("{long_name}.txt");
    email.attachments = vec![OutgoingAttachment {
        filename: filename.clone(),
        content_type: "application/octet-stream".into(),
        data: b"data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).expect("build must succeed");

    let raw = raw_str(&built);
    for (i, line) in raw.split("\r\n").enumerate() {
        assert!(
            line.len() <= 998,
            "line {} is {} chars (max 998): {:?}",
            i + 1,
            line.len(),
            &line[..line.len().min(120)],
        );
    }

    let parsed = crate::parse_email(&built.raw).expect("parse must succeed");
    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some(filename.as_str()),
        "Long ASCII filename must round-trip through RFC 2231 \
         continuation parameters"
    );
}

/// Regression test: `is_valid_msg_id` must reject message-IDs containing
/// whitespace, control characters, or angle brackets, which would break
/// the `<msg-id>` wire syntax per RFC 5322 Section 3.6.4.
#[test]
fn test_msg_id_validation_rejects_bad_chars() {
    let mut email = make_email();
    email.body_text = Some("test".into());

    // Mix of invalid and valid message-IDs supplied via in_reply_to.
    email.in_reply_to = vec![
        mid("hello world@example.com"), // space in id-left
        mid("test@exam ple.com"),       // space in id-right
        mid("test\x01@domain.com"),     // control char in id-left
        mid("a<b@domain.com"),          // angle bracket in id-left
        mid("unique123@domain.com"),    // valid
        mid("abc.def@example.org"),     // valid
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Only the two valid IDs should survive.
    assert!(
        s.contains("<unique123@domain.com>"),
        "valid msg-id must be present"
    );
    assert!(
        s.contains("<abc.def@example.org>"),
        "valid msg-id must be present"
    );

    // Invalid IDs must NOT appear in the output.
    assert!(
        !s.contains("hello world@example.com"),
        "msg-id with space in id-left must be rejected"
    );
    assert!(
        !s.contains("exam ple.com"),
        "msg-id with space in id-right must be rejected"
    );
    assert!(
        !s.contains("test\x01@domain.com"),
        "msg-id with control char must be rejected"
    );
    assert!(
        !s.contains("a<b@domain.com"),
        "msg-id with angle bracket must be rejected"
    );
}

/// RFC 2047 Section 2: the 76-character line limit applies only to lines
/// that contain actual encoded-words (`=?charset?encoding?text?=`).
/// Plain text that coincidentally contains the substrings `=?` and `?=`
/// is NOT an encoded-word and must use the standard 78-char fold limit
/// (RFC 5322 Section 2.1.1).
///
/// Regression: `write_header` previously used a loose heuristic
/// (`value.contains("=?") && value.contains("?=")`) which triggered
/// false positives on ordinary text, folding at 76 instead of 78.
#[test]
fn write_header_no_false_positive_encoded_word_detection() {
    // Value with literal "=?" and "?=" that are NOT RFC 2047 encoded-words.
    // Carefully constructed so that "Subject: " (9) + words up to "?="
    // produces line_len = 73, then the next word "bbb" (sep+len = 4)
    // gives 77: exceeds the 76-char limit but fits within 78.
    let plain_value = "aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii jjjj kkkk =? lll ?= bbb pppp";

    let mut output = Vec::new();
    write_header(&mut output, "Subject", plain_value);
    let header = String::from_utf8(output).unwrap();

    let first_line = header.split("\r\n").next().unwrap();
    assert!(
        first_line.len() == 77,
        "RFC 2047 Section 2: plain text with literal '=?' and '?=' must \
         fold at 78, not 76. First line should be 77 chars but is {} chars: {:?}",
        first_line.len(),
        first_line,
    );

    // Sanity: a real encoded-word SHOULD use the 76-char limit.
    // Same structure but with a valid =?UTF-8?B?...?= token.
    let encoded_value =
        "aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii =?UTF-8?B?dGVzdA==?= jj kkkk llll";

    let mut output2 = Vec::new();
    write_header(&mut output2, "Subject", encoded_value);
    let header2 = String::from_utf8(output2).unwrap();
    let first_line_enc = header2.split("\r\n").next().unwrap();
    assert!(
        first_line_enc.len() <= 76,
        "RFC 2047 Section 2: lines with real encoded-words must fold at ≤76. \
         First line is {} chars: {:?}",
        first_line_enc.len(),
        first_line_enc,
    );
}

/// RFC 2046 Section 5.1.1: "The boundary delimiter MUST NOT appear within
/// the encapsulated material." `generate_boundary_not_in` must always
/// return a boundary that does not collide with the content, even when
/// the content contains boundary-like patterns.
///
/// Regression: the final fallback path previously returned a counter-based
/// boundary without verifying it against the content.
#[test]
fn generate_boundary_not_in_never_collides() {
    // Content with several boundary-like patterns embedded
    let content = b"Here is some text with ----=_Part_fallback_0000000000000001 \
        and ----=_Part_ mixed in for good measure";
    let boundary = generate_boundary_not_in(content);
    assert!(
        !contains_boundary(content, &boundary),
        "RFC 2046 Section 5.1.1: generated boundary must not appear in \
         the content. Got: {boundary:?}"
    );
}

/// RFC 2046 Section 5.1.1: when content happens to contain the exact
/// boundary string that would have been generated, the function must
/// generate a different one.
#[test]
fn generate_boundary_not_in_avoids_existing_boundary() {
    // Generate a boundary first, then embed it in content and regenerate.
    let first = generate_boundary_not_in(b"");
    let content = format!("Body text contains {first} in the middle");
    let second = generate_boundary_not_in(content.as_bytes());
    assert_ne!(
        first, second,
        "must generate a different boundary when the first collides"
    );
    assert!(
        !contains_boundary(content.as_bytes(), &second),
        "RFC 2046 Section 5.1.1: regenerated boundary must not appear in content"
    );
}

#[test]
fn msg_id_rejects_specials_rfc5322_section_3_6_4() {
    // RFC 5322 Section 3.6.4: msg-id = "<" id-left "@" id-right ">"
    // id-left must be dot-atom-text; id-right may be dot-atom-text or
    // no-fold-literal. Characters like (, ), :, ;, ,, SP, DQUOTE, and
    // "\" are not valid in dot-atom-text and must be rejected.

    // These should be rejected (contain specials not in atext):
    assert!(
        !is_valid_msg_id("user(comment)@example.com"),
        "parentheses are specials"
    );
    assert!(
        !is_valid_msg_id("user:name@example.com"),
        "colon is a special"
    );
    assert!(
        !is_valid_msg_id("user;name@example.com"),
        "semicolon is a special"
    );
    assert!(
        !is_valid_msg_id("user,name@example.com"),
        "comma is a special"
    );
    assert!(
        !is_valid_msg_id("user name@example.com"),
        "space not allowed"
    );
    assert!(
        !is_valid_msg_id("user\"name@example.com"),
        "double-quote is a special"
    );
    assert!(
        !is_valid_msg_id("user\\name@example.com"),
        "backslash is a special"
    );

    // dot-atom-text: no leading, trailing, or consecutive dots
    assert!(!is_valid_msg_id(".user@example.com"), "leading dot");
    assert!(
        !is_valid_msg_id("user.@example.com"),
        "trailing dot in id-left"
    );
    assert!(
        !is_valid_msg_id("user@.example.com"),
        "leading dot in id-right"
    );
    assert!(
        !is_valid_msg_id("user@example.com."),
        "trailing dot in id-right"
    );
    assert!(
        !is_valid_msg_id("user..name@example.com"),
        "consecutive dots"
    );
    assert!(
        !is_valid_msg_id("user@example..com"),
        "consecutive dots in id-right"
    );

    // These should be accepted (valid atext + dots):
    assert!(is_valid_msg_id("user@example.com"));
    assert!(is_valid_msg_id("user.name@example.com"));
    assert!(is_valid_msg_id("abc123+def@host.example.org"));
    assert!(is_valid_msg_id("a!b#c$d%e&f@g.h"));
    assert!(is_valid_msg_id("user@[127.0.0.1]"));
    assert!(is_valid_msg_id("user@[IPv6:2001:db8::1]"));
}

/// RFC 6531 Section 3.3: internationalized local-parts containing
/// non-ASCII (UTF-8) characters must be accepted by `validate_address`.
#[test]
fn test_validate_address_allows_non_ascii_local_part_rfc6531() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "josé@example.com".into(),
        }],
        to: vec![Address {
            name: None,
            email: "user@example.com".into(),
        }],
        subject: "test".into(),
        body_text: Some("hello".into()),
        body_html: None,
        attachments: vec![],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        sender: None,
        date: None,
        in_reply_to: vec![],
        references: vec![],
        extra_headers: vec![],
    };
    // Must not return InvalidAddress for non-ASCII local-part
    assert!(
        build_message(&email).is_ok(),
        "RFC 6531 Section 3.3: non-ASCII local-part should be accepted"
    );
}

#[test]
fn test_format_address_quotes_encoded_word_lookalike() {
    // RFC 2047 Section 5: a display name that literally looks like an
    // encoded-word must be quoted to prevent the parser from decoding it.
    let addr = Address {
        name: Some("=?UTF-8?B?SGVsbG8=?=".into()),
        email: "user@example.com".into(),
    };
    let email = OutgoingEmail {
        from: vec![addr],
        to: vec![Address {
            name: None,
            email: "dest@example.com".into(),
        }],
        subject: "test".into(),
        body_text: Some("hello".into()),
        body_html: None,
        attachments: vec![],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        sender: None,
        date: None,
        in_reply_to: vec![],
        references: vec![],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();
    // Round-trip must preserve the literal display name
    assert_eq!(
        parsed.from[0].name.as_deref(),
        Some("=?UTF-8?B?SGVsbG8=?="),
        "display name containing encoded-word syntax must round-trip unchanged"
    );
}

/// RFC 6532 Section 3.5: msg-id allows UTF-8 characters in
/// internationalized messages. Non-ASCII message-IDs must not be
/// silently dropped from In-Reply-To or References headers.
#[test]
fn test_non_ascii_message_id_in_reply_to_rfc6532() {
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: "user@example.com".into(),
        }],
        to: vec![Address {
            name: None,
            email: "dest@example.com".into(),
        }],
        subject: "test".into(),
        body_text: Some("hello".into()),
        body_html: None,
        attachments: vec![],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        sender: None,
        date: None,
        in_reply_to: vec![mid("réponse@example.com")],
        references: vec![mid("référence@example.com")],
        extra_headers: vec![],
    };
    let built = build_message(&email).unwrap();
    let raw = String::from_utf8_lossy(&built.raw);
    // Non-ASCII message-IDs must not be silently dropped
    assert!(
        raw.contains("<réponse@example.com>"),
        "In-Reply-To must include non-ASCII message-ID per RFC 6532 Section 3.5"
    );
    assert!(
        raw.contains("<référence@example.com>"),
        "References must include non-ASCII message-ID per RFC 6532 Section 3.5"
    );
}

/// RFC 2047 Section 5: a Subject (or extra header) whose value is pure
/// ASCII but contains a pattern that looks like an encoded-word
/// (`=?charset?encoding?text?=`) must not be emitted verbatim. If it
/// is, the parser will decode the encoded-word on read-back, causing
/// round-trip data loss. The builder must RFC 2047-encode such values
/// so the literal text survives parsing.
#[test]
fn subject_with_encoded_word_lookalike_round_trips() {
    let mut email = make_email();
    email.subject = "=?UTF-8?Q?test?= literal".into();
    email.body_text = Some("body".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(
        parsed.subject.as_deref(),
        Some("=?UTF-8?Q?test?= literal"),
        "Subject containing encoded-word syntax must round-trip unchanged \
         (RFC 2047 Section 5)"
    );
}

/// Same as above but for extra headers: an extra header value that
/// contains encoded-word syntax must be protected by RFC 2047 encoding
/// so the literal text survives a build-then-parse round-trip.
#[test]
fn extra_header_with_encoded_word_lookalike_round_trips() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("X-Custom"), "=?UTF-8?B?SGVsbG8=?= world".into())];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    // Parser lowercases header names (RFC 5322 Section 2.2: field
    // names are case-insensitive).
    let custom = parsed
        .extra_headers
        .iter()
        .find(|(k, _)| k.eq_ignore_ascii_case("X-Custom"))
        .map(|(_, v)| v.as_str());
    assert_eq!(
        custom,
        Some("=?UTF-8?B?SGVsbG8=?= world"),
        "Extra header containing encoded-word syntax must round-trip unchanged \
         (RFC 2047 Section 5)"
    );
}

// =================================================================
// Workspace audit: edge-case probe tests
// =================================================================

/// RFC 2231 Section 3-4: build a message with a long non-ASCII filename,
/// then parse it back. The filename uses RFC 2231 continuation parameters
/// during encoding and must survive the round-trip intact.
#[test]
fn audit_rfc2231_round_trip_long_non_ascii_filename() {
    let long_name = "файл_с_очень_длинным_именем_который_будет_закодирован_через_rfc2231.pdf";
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.attachments = vec![OutgoingAttachment {
        filename: long_name.into(),
        content_type: "application/pdf".into(),
        data: b"fake pdf".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some(long_name),
        "RFC 2231 filename round-trip failed"
    );
}

/// RFC 2047 Section 2: build a message with a non-ASCII subject requiring
/// RFC 2047 Base64 encoding, then parse it back. The subject must
/// survive the round-trip intact.
#[test]
fn audit_rfc2047_round_trip_non_ascii_subject() {
    let subject = "日本語のテスト件名: Ärger mit Ümlauten";
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.subject = subject.into();

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.subject.as_deref(),
        Some(subject),
        "RFC 2047 subject round-trip failed"
    );
}

/// RFC 5322 Section 3.6.3: a message with only BCC recipients (no To
/// or Cc) is valid. BCC must appear in the envelope but NOT in headers.
#[test]
fn audit_bcc_only_message_valid() {
    let mut email = make_email();
    email.to.clear();
    email.bcc = vec![Address {
        name: None,
        email: "hidden@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = String::from_utf8_lossy(&built.raw);

    assert!(!s.contains("Bcc:"), "BCC header must not appear in message");
    assert!(
        !s.contains("hidden@example.com"),
        "BCC address must not appear in headers"
    );
    assert!(
        built
            .envelope_recipients
            .contains(&"hidden@example.com".to_string()),
        "BCC must be in envelope recipients"
    );
}

/// RFC 5322 Section 3.6.3: a message with only CC recipients (no To)
/// is valid. The Cc header should be present, and no To header should
/// appear.
#[test]
fn audit_cc_only_message_valid() {
    let mut email = make_email();
    email.to.clear();
    email.cc = vec![Address {
        name: None,
        email: "cc@example.com".into(),
    }];

    let built = build_message(&email).unwrap();
    let s = String::from_utf8_lossy(&built.raw);

    assert!(s.contains("Cc: cc@example.com"), "Cc header missing");
    assert!(
        !s.contains("\r\nTo:"),
        "To header should not appear when no To recipients"
    );
}

/// RFC 2045 Section 2.7: pure ASCII text must produce
/// `Content-Transfer-Encoding: 7bit`.
#[test]
fn audit_seven_bit_encoding_ascii_uses_7bit() {
    let mut email = make_email();
    email.body_text = Some("Pure ASCII text here".into());

    let built = build_message(&email).unwrap();
    let s = String::from_utf8_lossy(&built.raw);
    assert!(
        s.contains("Content-Transfer-Encoding: 7bit"),
        "Pure ASCII with SevenBit should use 7bit CTE, got: {s}"
    );
}

/// RFC 2045 Section 6.7: non-ASCII text must produce
/// `Content-Transfer-Encoding: quoted-printable`.
#[test]
fn audit_seven_bit_encoding_non_ascii_uses_qp() {
    let mut email = make_email();
    email.body_text = Some("Héllo Wörld with non-ASCII".into());

    let built = build_message(&email).unwrap();
    let s = String::from_utf8_lossy(&built.raw);
    assert!(
        s.contains("Content-Transfer-Encoding: quoted-printable"),
        "Non-ASCII with SevenBit should use quoted-printable CTE, got: {s}"
    );
}

/// Comprehensive round-trip: build a complex message with non-ASCII
/// subject (RFC 2047), non-ASCII display names (RFC 2047), text + HTML
/// bodies, threading headers (RFC 5322 Section 3.6.4), and a non-ASCII
/// attachment filename (RFC 2231). Parse it back and verify all fields.
#[test]
fn audit_full_complex_round_trip() {
    let mut email = make_email();
    email.from = vec![Address {
        name: Some("José García".into()),
        email: "jose@example.com".into(),
    }];
    email.to = vec![Address {
        name: Some("Müller".into()),
        email: "muller@example.com".into(),
    }];
    email.subject = "Ärger mit Ümlauten — a test".into();
    email.body_text = Some("Plain text body with UTF-8: café".into());
    email.body_html = Some("<p>HTML body with UTF-8: café</p>".into());
    email.in_reply_to = vec![mid("parent@example.com")];
    email.references = vec![mid("root@example.com"), mid("parent@example.com")];
    email.attachments = vec![OutgoingAttachment {
        filename: "données.txt".into(),
        content_type: "text/plain".into(),
        data: b"file data".to_vec(),
        is_inline: false,
        content_id: None,
    }];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    // Subject
    assert_eq!(
        parsed.subject.as_deref(),
        Some("Ärger mit Ümlauten — a test"),
        "Subject round-trip failed"
    );
    // Bodies
    assert_eq!(
        parsed.body_text.as_deref(),
        Some("Plain text body with UTF-8: café"),
        "body_text round-trip failed"
    );
    assert_eq!(
        parsed.body_html.as_deref(),
        Some("<p>HTML body with UTF-8: café</p>"),
        "body_html round-trip failed"
    );
    // Addresses
    assert_eq!(parsed.from[0].email, "jose@example.com");
    assert_eq!(
        parsed.from[0].name.as_deref(),
        Some("José García"),
        "From display name round-trip failed"
    );
    assert_eq!(parsed.to[0].email, "muller@example.com");
    // Threading
    assert_eq!(parsed.in_reply_to, vec!["parent@example.com"]);
    assert_eq!(
        parsed.references,
        vec!["root@example.com", "parent@example.com"]
    );
    // Attachment
    assert_eq!(parsed.attachments.len(), 1);
    assert_eq!(
        parsed.attachments[0].filename.as_deref(),
        Some("données.txt"),
        "Attachment filename round-trip failed"
    );
}

/// Boundary strings containing RFC 2045 special characters (`+`, `/`,
/// `.`, `=`) must be correctly handled by the parser's boundary
/// detection (RFC 2046 Section 5.1.1).
#[test]
fn audit_boundary_with_special_chars() {
    let raw = b"From: a@b.com\r\n\
                 Content-Type: multipart/mixed; boundary=\"=_Part+/test.boundary\"\r\n\
                 \r\n\
                 --=_Part+/test.boundary\r\n\
                 Content-Type: text/plain\r\n\
                 \r\n\
                 Hello\r\n\
                 --=_Part+/test.boundary--";
    let parsed = crate::parse_email(raw).unwrap();
    assert_eq!(parsed.body_text.as_deref(), Some("Hello"));
}

/// Body text containing literal `=?charset?encoding?text?=` syntax must
/// be preserved as-is — RFC 2047 encoded-words only apply to header
/// field bodies, not message body content (RFC 2047 Section 1).
#[test]
fn audit_body_with_encoded_word_syntax_preserved() {
    let mut email = make_email();
    email.body_text = Some("The value is =?UTF-8?B?dGVzdA==?= literally".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.body_text.as_deref(),
        Some("The value is =?UTF-8?B?dGVzdA==?= literally"),
        "Body with =? syntax should be preserved literally"
    );
}

/// RFC 5322 Section 3.6.2: when From has multiple addresses, Sender
/// must be present. Both From addresses and the Sender must survive
/// the build→parse round trip.
#[test]
fn audit_multiple_from_with_sender_round_trip() {
    let mut email = make_email();
    email.from = vec![
        Address {
            name: Some("Alice".into()),
            email: "alice@example.com".into(),
        },
        Address {
            name: Some("Bob".into()),
            email: "bob@example.com".into(),
        },
    ];
    email.sender = Some(Address {
        name: None,
        email: "alice@example.com".into(),
    });
    email.body_text = Some("body".into());

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    assert_eq!(
        parsed.from.len(),
        2,
        "Both From addresses must be preserved"
    );
    assert_eq!(parsed.from[0].email, "alice@example.com");
    assert_eq!(parsed.from[1].email, "bob@example.com");
    assert!(parsed.sender.is_some(), "Sender must be present");
    assert_eq!(parsed.sender.as_ref().unwrap().email, "alice@example.com");
}

/// RFC 5322 Section 2.2.3: header folding with HTAB continuation must
/// be correctly unfolded by the parser.
#[test]
fn audit_header_folding_with_htab_continuation() {
    let raw = b"From: sender@example.com\r\n\
                 Subject: Hello\r\n\t World\r\n\
                 Date: Thu, 13 Feb 2025 15:47:33 +0000\r\n\
                 \r\n\
                 body";
    let parsed = crate::parse_email(raw).unwrap();
    assert!(
        parsed.subject.as_deref().unwrap().contains("World"),
        "Subject must include continuation value after HTAB fold"
    );
}

/// RFC 2047 Section 5 / RFC 5322 Section 2.2: extra header values
/// containing non-ASCII characters must be RFC 2047 encoded in the
/// raw output, since header field bodies must be US-ASCII.
#[test]
fn build_extra_header_non_ascii_is_rfc2047_encoded() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("X-Custom"), "Caf\u{e9} r\u{e9}sum\u{e9}".into())];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The raw output must contain RFC 2047 encoded-word syntax
    // (RFC 2047 Section 2: encoded-word = "=?" charset "?" encoding "?" encoded-text "?=")
    assert!(
        s.contains("X-Custom: =?UTF-8?B?"),
        "Non-ASCII extra header value must be RFC 2047 Base64 encoded \
         (RFC 2047 Section 5, RFC 5322 Section 2.2): {s}"
    );
    assert!(
        s.contains("?="),
        "RFC 2047 encoded word must have closing delimiter: {s}"
    );
    // The raw output must NOT contain the literal non-ASCII bytes
    // in the header line (they would violate RFC 5322 Section 2.2).
    let header_line = s
        .lines()
        .find(|l| l.starts_with("X-Custom:"))
        .expect("X-Custom header must be present");
    assert!(
        header_line.is_ascii(),
        "Extra header line must be pure ASCII after RFC 2047 encoding \
         (RFC 5322 Section 2.2): {header_line}"
    );
}

/// RFC 2047 Section 5 / RFC 5322 Section 2.2: extra headers with
/// non-ASCII values must round-trip through build -> parse correctly.
/// The builder RFC 2047-encodes, and the parser decodes back to the
/// original Unicode text.
#[test]
fn build_extra_header_non_ascii_round_trip() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    let original_value = "Caf\u{e9} r\u{e9}sum\u{e9}";
    email.extra_headers = vec![(hdr("X-Custom"), original_value.into())];

    let built = build_message(&email).unwrap();
    let parsed = crate::parse_email(&built.raw).unwrap();

    // The parser must decode the RFC 2047 encoded-word back to the
    // original Unicode value (RFC 2047 Section 6.1).
    let custom = parsed
        .extra_headers
        .iter()
        .find(|(k, _)| k == "x-custom")
        .expect("x-custom header must be present in parsed extra_headers");
    assert_eq!(
        custom.1, original_value,
        "Non-ASCII extra header must round-trip through RFC 2047 encode/decode: \
         expected {original_value:?}, got {:?}",
        custom.1
    );
}

/// RFC 2047 Section 5 forbids encoded-words in structured field bodies
/// such as `Return-Path`; RFC 6532 Sections 3.2 and 3.6 permit direct
/// UTF-8 instead for internationalized headers.
#[test]
fn build_structured_extra_header_preserves_utf8_without_rfc2047() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Return-Path"), "<us\u{00E9}r@example.com>".into()),
        (
            hdr("Received"),
            "from mx.example by inbox.example; Fri, 21 Nov 1997 09:55:06 -0600".into(),
        ),
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    let header_line = s
        .lines()
        .find(|l| l.starts_with("Return-Path:"))
        .expect("Return-Path header must be present");
    assert!(
        header_line.contains("<us\u{00E9}r@example.com>"),
        "Structured Return-Path must preserve raw UTF-8, not rewrite the field body: {header_line}"
    );
    assert!(
        !header_line.contains("=?UTF-8?"),
        "Structured Return-Path must not use RFC 2047 encoded-words (RFC 2047 Section 5): {header_line}"
    );
}

/// RFC 2047 Section 5 forbids encoded-words in address-field bodies such
/// as `Resent-From`; RFC 6532 Sections 3.2 and 3.6 permit direct UTF-8
/// instead. The builder must not RFC 2047-encode the entire field body.
#[test]
fn build_structured_resent_from_extra_header_preserves_utf8_without_rfc2047() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Jos\u{00E9} <jose@example.com>".into()),
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    let header_line = s
        .lines()
        .find(|l| l.starts_with("Resent-From:"))
        .expect("Resent-From header must be present");
    assert!(
        header_line.contains("Jos\u{00E9} <jose@example.com>"),
        "Structured Resent-From must preserve raw UTF-8 address syntax, not rewrite the field body: {header_line}"
    );
    assert!(
        !header_line.contains("=?UTF-8?"),
        "Structured Resent-From must not use RFC 2047 encoded-words (RFC 2047 Section 5): {header_line}"
    );
}

/// RFC 5322 Section 3.6.7 / RFC 5321 Section 4.4: trace fields are a
/// `[Return-Path] 1*Received` block prepended to the message, with
/// `Return-Path` at the beginning of the trace block.
#[test]
fn return_path_extra_header_is_prepended_before_generated_headers() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Return-Path"), "<bounce@example.com>".into()),
        (
            hdr("Received"),
            "from mx.example by inbox.example; Fri, 21 Nov 1997 09:55:06 -0600".into(),
        ),
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    let header_lines: Vec<&str> = s
        .split("\r\n")
        .take_while(|line| !line.is_empty())
        .collect();

    assert_eq!(
        header_lines.first().copied(),
        Some("Return-Path: <bounce@example.com>"),
        "Return-Path must be emitted before From/Date/Message-ID per RFC 5321 Section 4.4: {header_lines:?}"
    );
    assert!(
        header_lines
            .get(1)
            .is_some_and(|line| line.starts_with("Received: from mx.example by inbox.example;")),
        "Received must immediately follow Return-Path in the prepended trace block: {header_lines:?}"
    );
}

/// RFC 5322 Section 3.6.7 defines trace as `[Return-Path] 1*Received`,
/// so a standalone `Return-Path` header is invalid.
#[test]
fn return_path_extra_header_requires_received_header() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("Return-Path"), "<bounce@example.com>".into())];

    let err = build_message(&email)
        .expect_err("Return-Path without Received must be rejected per RFC 5322 Section 3.6.7");

    assert!(
        matches!(err, Error::InvalidTraceHeader(ref message) if message.contains("Return-Path") && message.contains("Received")),
        "expected InvalidTraceHeader error mentioning Return-Path and Received, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.7 allows at most one optional `Return-Path`
/// field in the trace block.
#[test]
fn return_path_extra_header_rejects_duplicates() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Return-Path"), "<bounce-1@example.com>".into()),
        (
            hdr("Received"),
            "from mx.example by inbox.example; Fri, 21 Nov 1997 09:55:06 -0600".into(),
        ),
        (hdr("Return-Path"), "<bounce-2@example.com>".into()),
    ];

    let err = build_message(&email)
        .expect_err("duplicate Return-Path headers must be rejected per RFC 5322 Section 3.6.7");

    assert!(
        matches!(err, Error::InvalidTraceHeader(ref message) if message.contains("at most one Return-Path")),
        "expected InvalidTraceHeader error mentioning duplicate Return-Path, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.7 defines `path` as an angle-addr (or null path),
/// so `Return-Path` must not accept arbitrary unbracketed text.
#[test]
fn return_path_extra_header_rejects_invalid_path() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Return-Path"), "not-an-angle-addr".into()),
        (
            hdr("Received"),
            "from mx.example by inbox.example; Fri, 21 Nov 1997 09:55:06 -0600".into(),
        ),
    ];

    let err = build_message(&email)
        .expect_err("invalid Return-Path path must be rejected per RFC 5322 Section 3.6.7");

    assert!(
        matches!(err, Error::InvalidTraceHeader(ref message) if message.contains("Return-Path")),
        "expected InvalidTraceHeader error mentioning Return-Path, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.7 requires every `Received` field to end with a
/// semicolon plus `date-time`.
#[test]
fn received_extra_header_requires_semicolon_date_time() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("Received"), "from mx.example by inbox.example".into())];

    let err = build_message(&email)
        .expect_err("Received without '; date-time' must be rejected per RFC 5322 Section 3.6.7");

    assert!(
        matches!(err, Error::InvalidTraceHeader(ref message) if message.contains("Received")),
        "expected InvalidTraceHeader error mentioning Received, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.7 requires the `Received` tail after the final
/// semicolon to be a syntactically valid `date-time`.
#[test]
fn received_extra_header_rejects_invalid_date_time() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(
        hdr("Received"),
        "from mx.example by inbox.example; not-a-date".into(),
    )];

    let err = build_message(&email)
        .expect_err("Received with invalid date-time must be rejected per RFC 5322 Section 3.6.7");

    assert!(
        matches!(err, Error::InvalidTraceHeader(ref message) if message.contains("Received")),
        "expected InvalidTraceHeader error mentioning Received, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: when resent fields are present, the resent
/// block must be prepended ahead of the original header block.
#[test]
fn resent_extra_headers_are_prepended_before_original_headers() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Jos\u{00E9} <jose@example.com>".into()),
    ];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);
    let header_lines: Vec<&str> = s
        .split("\r\n")
        .take_while(|line| !line.is_empty())
        .collect();

    let resent_date_pos = header_lines
        .iter()
        .position(|line| line.starts_with("Resent-Date:"))
        .expect("Resent-Date header must be present");
    let resent_from_pos = header_lines
        .iter()
        .position(|line| line.starts_with("Resent-From:"))
        .expect("Resent-From header must be present");
    let from_pos = header_lines
        .iter()
        .position(|line| line.starts_with("From:"))
        .expect("From header must be present");
    let date_pos = header_lines
        .iter()
        .position(|line| line.starts_with("Date:"))
        .expect("Date header must be present");

    assert!(
        resent_date_pos < from_pos && resent_from_pos < date_pos,
        "Resent block must be prepended before the original headers per RFC 5322 Section 3.6.6: {header_lines:?}"
    );
}

/// RFC 5322 Section 4.5.6 treats obsolete `Resent-Reply-To` as resent
/// trace information, so it belongs in the prepended resent block rather
/// than the ordinary optional-field section. RFC 2047 Section 5 also
/// forbids encoded-words in this structured address field.
#[test]
fn resent_reply_to_extra_header_is_grouped_and_preserves_raw_utf8() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
        (
            hdr("Resent-Reply-To"),
            "Rel\u{00E9} Desk <relay@example.com>".into(),
        ),
    ];

    let built = build_message(&email)
        .expect("obsolete Resent-Reply-To should be accepted as part of the resent block");
    let s = raw_str(&built);
    let header_lines: Vec<&str> = s
        .split("\r\n")
        .take_while(|line| !line.is_empty())
        .collect();

    let resent_reply_to_pos = header_lines
        .iter()
        .position(|line| line.starts_with("Resent-Reply-To:"))
        .expect("Resent-Reply-To header must be present");
    let from_pos = header_lines
        .iter()
        .position(|line| line.starts_with("From:"))
        .expect("From header must be present");
    let resent_reply_to_line = header_lines[resent_reply_to_pos];

    assert!(
        resent_reply_to_pos < from_pos,
        "Resent-Reply-To must be prepended with the resent block per RFC 5322 Section 4.5.6: {header_lines:?}"
    );
    assert!(
        resent_reply_to_line.contains("Rel\u{00E9} Desk <relay@example.com>"),
        "Resent-Reply-To must preserve raw UTF-8 address syntax instead of rewriting the field body: {resent_reply_to_line}"
    );
    assert!(
        !resent_reply_to_line.contains("=?UTF-8?"),
        "Resent-Reply-To must not use RFC 2047 encoded-words in a structured address field: {resent_reply_to_line}"
    );
}

/// RFC 5322 Section 3.6.6: if any resent field is present, `Resent-Date`
/// and `Resent-From` are both required.
#[test]
fn resent_extra_headers_require_resent_date_and_from() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("Resent-From"), "Jos\u{00E9} <jose@example.com>".into())];

    let err = build_message(&email)
        .expect_err("partial resent blocks must be rejected per RFC 5322 Section 3.6.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Date") && message.contains("Resent-From")),
        "expected InvalidResentHeader error mentioning required resent fields, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6 / field occurrence table: when `Resent-From`
/// contains more than one mailbox, `Resent-Sender` becomes mandatory,
/// just like `Sender` for a multi-mailbox `From` field.
#[test]
fn resent_extra_headers_with_multiple_from_mailboxes_require_resent_sender() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (
            hdr("Resent-From"),
            "Alice <alice@example.com>, Bob <bob@example.com>".into(),
        ),
    ];

    let err = build_message(&email).expect_err(
        "multi-mailbox Resent-From must require Resent-Sender per RFC 5322 Section 3.6.6",
    );

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Sender")),
        "expected InvalidResentHeader error mentioning Resent-Sender, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: each resent block corresponds to one resending
/// event, so later `Resent-Date` fields start a new block that must carry
/// its own required `Resent-From`.
#[test]
fn resent_extra_headers_validate_each_block_for_required_fields() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
        (hdr("Resent-Date"), "Sat, 22 Nov 1997 10:00:00 -0600".into()),
        (hdr("Resent-To"), "Bob <bob@example.com>".into()),
    ];

    let err = build_message(&email).expect_err(
        "each resent block must include both Resent-Date and Resent-From per RFC 5322 Section 3.6.6",
    );

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Date") && message.contains("Resent-From")),
        "expected InvalidResentHeader error mentioning required per-block resent fields, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: the `Resent-Sender` requirement is evaluated
/// per resent block, not against only the last `Resent-From` field seen.
#[test]
fn resent_extra_headers_validate_each_block_for_resent_sender() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (
            hdr("Resent-From"),
            "Alice <alice@example.com>, Bob <bob@example.com>".into(),
        ),
        (hdr("Resent-Date"), "Sat, 22 Nov 1997 10:00:00 -0600".into()),
        (hdr("Resent-From"), "Carol <carol@example.com>".into()),
    ];

    let err = build_message(&email).expect_err(
        "multi-mailbox Resent-From in any resent block must require Resent-Sender per RFC 5322 Section 3.6.6",
    );

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Sender")),
        "expected InvalidResentHeader error mentioning per-block Resent-Sender, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: `Resent-Date` uses the `date-time` syntax
/// and must not be emitted with an invalid field body.
#[test]
fn resent_extra_headers_reject_invalid_resent_date() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "not-a-date".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
    ];

    let err = build_message(&email)
        .expect_err("invalid Resent-Date must be rejected per RFC 5322 Section 3.6.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Date")),
        "expected InvalidResentHeader error mentioning Resent-Date, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: `Resent-From` uses `mailbox-list` syntax and
/// must contain at least one mailbox.
#[test]
fn resent_extra_headers_reject_invalid_resent_from() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "not-an-address".into()),
    ];

    let err = build_message(&email)
        .expect_err("invalid Resent-From must be rejected per RFC 5322 Section 3.6.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-From")),
        "expected InvalidResentHeader error mentioning Resent-From, got {err:?}"
    );
}

/// RFC 5322 Section 4.5.6 defines obsolete `Resent-Reply-To` as an
/// `address-list`, so malformed values must be rejected instead of being
/// emitted as arbitrary unstructured text.
#[test]
fn resent_extra_headers_reject_invalid_resent_reply_to() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
        (hdr("Resent-Reply-To"), "not-an-address".into()),
    ];

    let err = build_message(&email)
        .expect_err("invalid Resent-Reply-To must be rejected per RFC 5322 Section 4.5.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Reply-To")),
        "expected InvalidResentHeader error mentioning Resent-Reply-To, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: `Resent-Sender` uses `mailbox` syntax and
/// therefore must contain exactly one mailbox.
#[test]
fn resent_extra_headers_reject_invalid_resent_sender() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (
            hdr("Resent-From"),
            "Alice <alice@example.com>, Bob <bob@example.com>".into(),
        ),
        (
            hdr("Resent-Sender"),
            "Carol <carol@example.com>, Dave <dave@example.com>".into(),
        ),
    ];

    let err = build_message(&email)
        .expect_err("invalid Resent-Sender must be rejected per RFC 5322 Section 3.6.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Sender")),
        "expected InvalidResentHeader error mentioning Resent-Sender, got {err:?}"
    );
}

/// RFC 5322 Sections 3.6.3 and 3.6.6: `Resent-Bcc` reuses `Bcc` syntax,
/// so a non-empty field body must be an `address-list` rather than
/// arbitrary text.
#[test]
fn resent_extra_headers_reject_invalid_resent_bcc() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
        (hdr("Resent-Bcc"), "not-an-address".into()),
    ];

    let err = build_message(&email)
        .expect_err("invalid Resent-Bcc must be rejected per RFC 5322 Section 3.6.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Bcc")),
        "expected InvalidResentHeader error mentioning Resent-Bcc, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6: `Resent-Message-ID` uses `msg-id` syntax and
/// must not be emitted with malformed content.
#[test]
fn resent_extra_headers_reject_invalid_resent_message_id() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
        (hdr("Resent-Message-ID"), "<missing-at-sign>".into()),
    ];

    let err = build_message(&email)
        .expect_err("invalid Resent-Message-ID must be rejected per RFC 5322 Section 3.6.6");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Message-ID")),
        "expected InvalidResentHeader error mentioning Resent-Message-ID, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6 requires each contiguous resent block to be
/// grouped as one resending event. A `Resent-Sender` that appears before a
/// later `Resent-Date` belongs to the earlier block and must not satisfy a
/// later multi-mailbox `Resent-From`.
#[test]
fn resent_extra_headers_do_not_let_earlier_sender_satisfy_later_block() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
        (hdr("Resent-Sender"), "Relay <relay@example.com>".into()),
        (hdr("Resent-Date"), "Sat, 22 Nov 1997 10:00:00 -0600".into()),
        (
            hdr("Resent-From"),
            "Bob <bob@example.com>, Carol <carol@example.com>".into(),
        ),
    ];

    let err = build_message(&email)
        .expect_err("a later multi-mailbox Resent-From must not borrow an earlier Resent-Sender");

    assert!(
        matches!(err, Error::InvalidResentHeader(ref message) if message.contains("Resent-Sender")),
        "expected InvalidResentHeader error mentioning later-block Resent-Sender, got {err:?}"
    );
}

/// RFC 5322 Section 3.6.6 does not require `Resent-Date` to appear first
/// within a resent block, so a grouped block with a later `Resent-Date`
/// is still valid as long as the block contains the required fields.
#[test]
fn resent_extra_headers_allow_valid_noncanonical_field_order_within_block() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![
        (hdr("Resent-To"), "Bob <bob@example.com>".into()),
        (hdr("Resent-Date"), "Fri, 21 Nov 1997 09:55:06 -0600".into()),
        (hdr("Resent-From"), "Alice <alice@example.com>".into()),
    ];

    let built = build_message(&email)
        .expect("valid resent block ordering should not require Resent-Date first");
    let text = String::from_utf8_lossy(&built.raw);

    assert!(
        text.contains("Resent-To: Bob <bob@example.com>\r\n"),
        "resent block should preserve the caller-provided field order: {text}"
    );
    assert!(
        text.contains("Resent-Date: Fri, 21 Nov 1997 09:55:06 -0600\r\n"),
        "resent block should emit Resent-Date even when it is not the first field: {text}"
    );
    assert!(
        text.contains("Resent-From: Alice <alice@example.com>\r\n"),
        "resent block should emit Resent-From for a valid noncanonical ordering: {text}"
    );
}

/// RFC 5322 Section 2.2 / builder sanitization: extra header values
/// containing CRLF sequences (potential header injection) must be
/// sanitized so that the CRLF does not appear in the output, preventing
/// injection of additional headers.
#[test]
fn build_extra_header_crlf_injection_sanitized() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    // Attempt CRLF injection: value contains \r\n followed by a
    // fake header that would be interpreted as a separate header
    // if not sanitized.
    email.extra_headers = vec![(hdr("X-Safe"), "value\r\nX-Injected: evil".into())];

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The injected header must not appear as a separate header line.
    assert!(
        !s.contains("\r\nX-Injected:"),
        "CRLF injection must be sanitized — injected header must not appear \
         as a separate line (RFC 5322 Section 2.2): {s}"
    );
    // The X-Safe header must still be present.
    assert!(
        s.contains("X-Safe:"),
        "Original header name must survive sanitization: {s}"
    );
}

/// RFC 5322 Section 3.6.5: a whitespace-only unstructured field body is
/// valid data. The builder must preserve it through a build-parse
/// round-trip instead of collapsing it to empty.
#[test]
fn whitespace_only_subject_round_trip() {
    let mut email = make_email();
    email.subject = "  \t  ".into();

    // Builder must not panic on whitespace-only subject.
    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The raw output must contain a Subject header line.
    assert!(
        s.contains("Subject:"),
        "Builder must emit a Subject header even for whitespace-only input \
         (RFC 5322 Section 3.6.5)"
    );

    // Round-trip: parse the built message and verify subject.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.subject.as_deref(),
        Some("  \t  "),
        "Whitespace-only subject must preserve legal WSP exactly \
         (RFC 5322 Section 3.6.5)"
    );
}

/// RFC 5322 Section 3.6.5: leading WSP in an unstructured field body is
/// part of the field body and must survive a build-parse round-trip.
#[test]
fn leading_whitespace_subject_preserves_content() {
    let mut email = make_email();
    email.subject = "  Hello".into();

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // The raw output must contain the Subject header with the content.
    assert!(
        s.contains("Subject:"),
        "Builder must emit a Subject header (RFC 5322 Section 3.6.5)"
    );
    assert!(
        s.contains("Hello"),
        "Subject content must appear in the raw output"
    );

    // Round-trip: parse the built message.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert_eq!(
        parsed.subject.as_deref(),
        Some("  Hello"),
        "Leading whitespace is part of the Subject field body and must be \
         preserved through the round-trip (RFC 5322 Section 3.6.5)"
    );
}

/// RFC 2047 Section 2: "Each line of a header field that contains one or
/// more 'encoded-word's is limited to 76 characters."
///
/// A very long non-ASCII display name in the From header produces many
/// encoded-words. The builder must fold them so that no output line
/// containing an encoded-word exceeds 76 characters.
///
/// This also verifies the round-trip: `parse_email` must recover the
/// original display name from the folded RFC 2047 encoded header.
#[test]
fn rfc2047_very_long_non_ascii_from_display_name_lines_within_76_chars() {
    let long_name = "日".repeat(120);
    let mut email = make_email();
    email.from = vec![Address {
        name: Some(long_name.clone()),
        email: "sender@example.com".into(),
    }];
    email.body_text = Some("test body".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Every line containing an encoded-word must be ≤76 chars
    // (RFC 2047 Section 2).
    for (i, line) in s.split("\r\n").enumerate() {
        if line.contains("=?") && line.contains("?=") {
            assert!(
                line.len() <= 76,
                "RFC 2047 Section 2: From header line {i} with encoded-word \
                 exceeds 76 chars ({} chars): {line}",
                line.len()
            );
        }
    }

    // Round-trip: parse_email must recover the original display name.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert!(
        !parsed.from.is_empty(),
        "Parsed message must have at least one From address"
    );
    assert_eq!(
        parsed.from[0].name.as_deref().unwrap(),
        long_name,
        "From display name must survive RFC 2047 encode → fold → decode round-trip"
    );
    assert_eq!(parsed.from[0].email, "sender@example.com");
}

/// RFC 2047 Section 2: encoded-word line limit applies to Reply-To
/// headers as well. "Reply-To: " is 10 chars of prefix, which leaves
/// only 66 chars for the first encoded-word token on that line.
///
/// A very long non-ASCII display name must be folded so that every
/// output line with an encoded-word is ≤76 characters.
#[test]
fn rfc2047_very_long_non_ascii_reply_to_display_name_lines_within_76_chars() {
    let long_name = "日".repeat(120);
    let mut email = make_email();
    email.reply_to = vec![Address {
        name: Some(long_name.clone()),
        email: "reply@example.com".into(),
    }];
    email.body_text = Some("test body".into());

    let built = build_message(&email).unwrap();
    let s = raw_str(&built);

    // Every line containing an encoded-word must be ≤76 chars
    // (RFC 2047 Section 2).
    for (i, line) in s.split("\r\n").enumerate() {
        if line.contains("=?") && line.contains("?=") {
            assert!(
                line.len() <= 76,
                "RFC 2047 Section 2: Reply-To header line {i} with \
                 encoded-word exceeds 76 chars ({} chars): {line}",
                line.len()
            );
        }
    }

    // Round-trip: parse_email must recover the original display name.
    let parsed = crate::parse_email(&built.raw).unwrap();
    assert!(
        !parsed.reply_to.is_empty(),
        "Parsed message must have at least one Reply-To address"
    );
    assert_eq!(
        parsed.reply_to[0].name.as_deref().unwrap(),
        long_name,
        "Reply-To display name must survive RFC 2047 encode → fold → decode round-trip"
    );
    assert_eq!(parsed.reply_to[0].email, "reply@example.com");
}

/// RFC 2046 Section 5.2.1: message/* attachments with conforming line
/// lengths (≤998 octets) must be accepted and written with 7bit or 8bit
/// Content-Transfer-Encoding.
#[test]
fn message_rfc822_attachment_valid_lines_accepted() {
    let mut email = make_email();
    email.body_text = Some("test body".into());

    // Build a message/rfc822 attachment with lines within the 998-octet
    // limit (RFC 5322 Section 2.1.1).
    let inner_msg = "From: inner@example.com\r\n\
                     Date: Thu, 13 Feb 2025 15:47:33 +0000\r\n\
                     Subject: Inner\r\n\
                     \r\n\
                     Normal body line\r\n";
    email.attachments.push(OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: inner_msg.as_bytes().to_vec(),
        is_inline: false,
        content_id: None,
    });

    let result = build_message(&email);
    assert!(
        result.is_ok(),
        "message/rfc822 attachment with conforming line lengths must be \
         accepted (RFC 2046 Section 5.2.1): {result:?}"
    );

    // Verify the attachment is encoded as 7bit (all ASCII)
    let raw = raw_str(&result.unwrap());
    assert!(
        raw.contains("Content-Transfer-Encoding: 7bit"),
        "Pure-ASCII message/rfc822 should use 7bit CTE"
    );
}

/// RFC 2046 Section 5.2.1: message/* MUST NOT use base64 or
/// quoted-printable; only 7bit, 8bit, or binary are permitted.
/// RFC 2045 Section 2.8: 8bit content must have lines ≤998 octets.
///
/// When message/* attachment data contains lines exceeding 998 octets,
/// the builder cannot re-encode (base64/QP forbidden) so it must
/// reject the attachment with an error.
#[test]
fn message_rfc822_attachment_overlong_line_rejected() {
    let mut email = make_email();
    email.body_text = Some("test body".into());

    // Build a message/rfc822 attachment whose body contains a line
    // exceeding 998 octets (the hard limit from RFC 5322 Section 2.1.1).
    let overlong_line = "X".repeat(1000);
    let inner_msg = format!(
        "From: inner@example.com\r\n\
         Date: Thu, 13 Feb 2025 15:47:33 +0000\r\n\
         Subject: Inner\r\n\
         \r\n\
         {overlong_line}\r\n"
    );
    email.attachments.push(OutgoingAttachment {
        filename: "forwarded.eml".into(),
        content_type: "message/rfc822".into(),
        data: inner_msg.into_bytes(),
        is_inline: false,
        content_id: None,
    });

    let result = build_message(&email);
    assert!(
        result.is_err(),
        "RFC 2046 Section 5.2.1 / RFC 2045 Section 2.8: message/* \
         attachment with lines >998 octets must be rejected because \
         base64/quoted-printable encoding is forbidden for message/* types"
    );
}

/// RFC 6532 Section 3.7 registers `message/global` with "Any
/// content-transfer-encoding is permitted", unlike RFC 2046
/// Section 5.2.1's restrictions for `message/rfc822`.
///
/// A `message/global` attachment with an overlong encapsulated line
/// should therefore be encoded safely instead of being rejected.
#[test]
fn message_global_attachment_overlong_line_is_base64_encoded() {
    let mut email = make_email();
    email.body_text = Some("test body".into());

    let overlong_line = "é".repeat(600);
    let inner_msg = format!(
        "From: inner@example.com\r\n\
         Subject: café\r\n\
         \r\n\
         {overlong_line}\r\n"
    );
    email.attachments.push(OutgoingAttachment {
        filename: "forwarded.global".into(),
        content_type: "message/global".into(),
        data: inner_msg.into_bytes(),
        is_inline: false,
        content_id: None,
    });

    let built = build_message(&email).expect(
        "message/global attachments may use base64 when the embedded message \
         is not 7bit/8bit-safe (RFC 6532 Section 3.7)",
    );
    let raw = raw_str(&built);

    assert!(
        raw.contains("Content-Type: message/global"),
        "message/global content type must be preserved: {raw}"
    );
    assert!(
        raw.contains("Content-Transfer-Encoding: base64"),
        "message/global with overlong lines should use base64 per RFC 6532 Section 3.7: {raw}"
    );
    assert!(
        !raw.contains(&overlong_line),
        "base64-encoded message/global attachment must not write the overlong line verbatim"
    );
}

// ---- Bug regression tests ----

/// RFC 6531 Section 3.3 extends RFC 5322 Section 3.2.4 to allow UTF-8
/// characters in quoted local-parts of internationalized email addresses.
/// A quoted local-part like `"用户"@example.com` must be accepted.
#[test]
fn validate_address_allows_utf8_in_quoted_local_part() {
    let addr = Address {
        name: None,
        email: "\"用户\"@example.com".into(),
    };
    let result = validate_address(&addr);
    assert!(
        result.is_ok(),
        "RFC 6531 Section 3.3: UTF-8 bytes must be allowed in quoted \
         local-parts, but got: {result:?}"
    );
}

/// RFC 5322 Section 3.4.1: quoted local-parts may contain `@` inside the
/// quotes. The address `"user@company"@example.com` has local-part
/// `"user@company"` and domain `example.com`. The builder must not reject
/// this as "multiple '@' characters".
#[test]
fn validate_address_allows_at_in_quoted_local_part() {
    let addr = Address {
        name: None,
        email: "\"user@company\"@example.com".into(),
    };
    let result = validate_address(&addr);
    assert!(
        result.is_ok(),
        "RFC 5322 Section 3.4.1: '@' is valid qtext inside a quoted \
         local-part, but got: {result:?}"
    );
}

/// RFC 2231 Sections 3-4 extend MIME parameter names beyond plain RFC 2045
/// tokens, allowing attributes such as `title*=` and `title*0*=`.
/// Attachment `Content-Type` validation must preserve these parameters
/// instead of falling back to `application/octet-stream`.
#[test]
fn attachment_content_type_preserves_rfc2231_extended_param_names() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.attachments.push(OutgoingAttachment {
        filename: "report.bin".into(),
        content_type: "application/x-example; title*=UTF-8''caf%C3%A9".into(),
        data: b"payload".to_vec(),
        is_inline: false,
        content_id: None,
    });

    let built = build_message(&email)
        .expect("RFC 2231 extended parameter names on attachment Content-Type must be accepted");
    let raw = raw_str(&built);

    assert!(
        raw.contains("Content-Type: application/x-example; title*=UTF-8''caf%C3%A9;"),
        "attachment Content-Type with RFC 2231 extended parameter names must keep the \
         extended attribute instead of falling back: {raw}"
    );
    assert!(
        raw.contains("name=\"report.bin\""),
        "attachment Content-Type should still add the builder's name= parameter: {raw}"
    );
    assert!(
        !raw.contains("Content-Type: application/octet-stream"),
        "attachment Content-Type must not fall back to application/octet-stream: {raw}"
    );
}

/// RFC 2045 Section 5.1 says MIME structured header fields allow RFC 822
/// comments with no semantic meaning. A valid attachment `Content-Type`
/// that includes comments must therefore still be accepted and preserved,
/// rather than falling back to `application/octet-stream`.
#[test]
fn attachment_content_type_allows_rfc2045_comments() {
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.attachments.push(OutgoingAttachment {
        filename: "report.bin".into(),
        content_type: "application/x-example (audit note); title*=UTF-8''caf%C3%A9 (Plain text)"
            .into(),
        data: b"payload".to_vec(),
        is_inline: false,
        content_id: None,
    });

    let built = build_message(&email)
        .expect("RFC 2045 Section 5.1 commented Content-Type must be accepted for attachments");
    let raw = raw_str(&built);
    let unfolded = raw.replace("\r\n ", " ").replace("\r\n\t", " ");

    assert!(
        unfolded.contains(
            "Content-Type: application/x-example (audit note); title*=UTF-8''caf%C3%A9 (Plain text);"
        ),
        "attachment Content-Type comments must be preserved instead of falling back: {raw}"
    );
    assert!(
        unfolded.contains("name=\"report.bin\""),
        "builder should still append the name= parameter after the commented Content-Type: {raw}"
    );
    assert!(
        !raw.contains("Content-Type: application/octet-stream"),
        "commented attachment Content-Type must not fall back to application/octet-stream: {raw}"
    );
}

#[test]
fn extra_headers_allow_top_level_content_disposition() {
    // RFC 2183 Section 2.10: Content-Disposition is permitted on the
    // main body of an RFC 5322 message, not only on subparts.
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(
        hdr("Content-Disposition"),
        "attachment; filename=\"message.eml\"".into(),
    )];

    let built = build_message(&email).expect("top-level Content-Disposition should be accepted");
    let raw = String::from_utf8(built.raw).expect("message bytes must be valid UTF-8");

    assert!(
        raw.contains("Content-Disposition: attachment; filename=\"message.eml\"\r\n"),
        "top-level Content-Disposition must be preserved on the main message per RFC 2183 Section 2.10: {raw}"
    );
}

#[test]
fn extra_headers_allow_top_level_content_id() {
    // RFC 2045 Section 7 allows Content-ID on MIME entities generally,
    // including the top-level message body.
    let mut email = make_email();
    email.body_text = Some("body".into());
    email.extra_headers = vec![(hdr("Content-ID"), "<test@example.com>".into())];

    let built = build_message(&email).expect("top-level Content-ID should be accepted");
    let raw = String::from_utf8(built.raw).expect("message bytes must be valid UTF-8");

    assert!(
        raw.contains("Content-ID: <test@example.com>\r\n"),
        "top-level Content-ID must be preserved on the main MIME entity per RFC 2045 Section 7: {raw}"
    );
}

/// RFC 5322 Sections 2.1.1, 2.2.3, and 3.6.4: builders must not emit an
/// overlong `In-Reply-To` line when a single `msg-id` token is too large
/// to fold legally. Because `msg-id` contains no FWS, the only correct
/// behavior is to reject the message instead of emitting an invalid line.
#[test]
fn build_rejects_overlong_in_reply_to_msg_id_token() {
    let overlong_msg_id = format!("{}@{}", "a".repeat(400), "b".repeat(600));
    let mut email = make_email();
    email.in_reply_to = vec![mid(&overlong_msg_id)];

    let err = build_message(&email)
        .expect_err("overlong single msg-id token must be rejected before writing");

    assert!(
        matches!(err, Error::HeaderLineTooLong(ref message) if message.contains("In-Reply-To")
            && message.contains("998")
            && message.contains("RFC 5322 Sections 2.1.1 and 2.2.3")),
        "expected HeaderLineTooLong error about impossible-to-fold In-Reply-To token, got {err:?}"
    );
}

/// RFC 5322 Section 2.2.3: WSP is defined as SP / HTAB. Both are legal
/// in header field bodies. `write_header` must preserve HTAB characters
/// rather than silently converting them to spaces during folding.
#[test]
fn write_header_preserves_htab_in_subject() {
    let mut email = make_email();
    email.subject = "Hello\tWorld".into();
    let built = build_message(&email).unwrap();
    let raw = std::str::from_utf8(&built.raw).unwrap();
    // Find the Subject header line (may be folded across multiple lines,
    // so unfold first per RFC 5322 Section 2.2.3).
    let subject_line = raw
        .lines()
        .find(|l| l.starts_with("Subject:"))
        .expect("Subject header must be present");
    assert!(
        subject_line.contains('\t'),
        "HTAB must be preserved in Subject header, got: {subject_line:?}"
    );
}

/// RFC 5322 Sections 2.1.1, 2.2.3, and 3.6.2: builders must not emit an
/// overlong `From` line when a single mailbox token is too large to fold
/// legally. The correct behavior is to reject the message instead of
/// producing invalid output.
#[test]
fn build_rejects_overlong_from_address_token() {
    let long_local = "a".repeat(500);
    let long_domain = vec!["b".repeat(63); 8].join(".") + ".com";
    let email_addr = format!("{long_local}@{long_domain}");
    let email = OutgoingEmail {
        from: vec![Address {
            name: None,
            email: email_addr,
        }],
        sender: None,
        to: vec![Address {
            name: None,
            email: "to@example.com".into(),
        }],
        cc: vec![],
        bcc: vec![],
        reply_to: vec![],
        date: None,
        subject: "test".into(),
        body_text: Some("body".into()),
        body_html: None,
        in_reply_to: vec![],
        references: vec![],
        attachments: vec![],
        extra_headers: vec![],
    };

    let err = build_message(&email)
        .expect_err("overlong single mailbox token must be rejected before writing");

    assert!(
        matches!(err, Error::HeaderLineTooLong(ref message) if message.contains("From")
            && message.contains("998")
            && message.contains("RFC 5322 Sections 2.1.1 and 2.2.3")),
        "expected HeaderLineTooLong error about impossible-to-fold From token, got {err:?}"
    );
}

#[test]
fn extract_domain_quoted_local_part_with_at() {
    // RFC 5322 Section 3.4.1: quoted local-parts may contain @.
    // extract_domain must find the @ after the closing quote.
    assert_eq!(
        extract_domain("\"user@company\"@example.com"),
        Some("example.com")
    );
    // Regular case still works
    assert_eq!(extract_domain("user@example.com"), Some("example.com"));
    // No @
    assert_eq!(extract_domain("noatsign"), None);
    // Empty domain
    assert_eq!(extract_domain("user@"), None);
}

#[test]
fn generate_message_id_preserves_domain_literals() {
    // RFC 5322 Section 3.6.4: id-right = dot-atom-text / no-fold-literal.
    // A domain-literal such as an IPv6 address must stay bracketed rather
    // than being flattened into an invalid dot-atom.
    let id = generate_message_id("[IPv6:2001:db8::1]");
    assert!(
        id.ends_with("@[IPv6:2001:db8::1]"),
        "Message-ID must preserve a no-fold-literal id-right: {id}"
    );

    // Regular dot-atom domains are still preserved unchanged.
    let id2 = generate_message_id("example.com");
    assert!(id2.ends_with("@example.com"));
}

/// RFC 5322 Section 3.6.4 permits `id-right = no-fold-literal`, so
/// threading headers must preserve valid domain-literal message-ids.
#[test]
fn build_in_reply_to_accepts_domain_literal_msg_id() {
    let mut email = make_email();
    email.in_reply_to = vec![mid("reply@[IPv6:2001:db8::1]")];

    let built = build_message(&email).expect("build should accept a valid domain-literal msg-id");
    let raw = String::from_utf8_lossy(&built.raw);
    assert!(
        raw.contains("In-Reply-To: <reply@[IPv6:2001:db8::1]>\r\n"),
        "In-Reply-To must preserve a valid no-fold-literal msg-id: {raw}"
    );
}

/// RFC 2392 uses RFC 5322 `msg-id` syntax for Content-ID, including
/// domain-literal id-right values allowed by RFC 5322 Section 3.6.4.
#[test]
fn build_content_id_accepts_domain_literal_msg_id() {
    let mut email = make_email();
    email.body_html = Some("<img src=\"cid:part@[IPv6:2001:db8::1]\">".into());
    email.attachments = vec![OutgoingAttachment {
        filename: "image.png".into(),
        content_type: "image/png".into(),
        data: vec![0x89, b'P', b'N', b'G'],
        is_inline: true,
        content_id: Some("part@[IPv6:2001:db8::1]".into()),
    }];

    let built =
        build_message(&email).expect("build should accept a valid domain-literal Content-ID");
    let raw = String::from_utf8_lossy(&built.raw);
    assert!(
        raw.contains("Content-ID: <part@[IPv6:2001:db8::1]>\r\n"),
        "Content-ID must preserve a valid no-fold-literal msg-id: {raw}"
    );
}

#[test]
fn format_address_encodes_control_chars_in_display_name() {
    // RFC 5322 Section 2.2: header field bodies must be printable US-ASCII.
    // RFC 5322 Section 3.2.3: atext excludes control characters.
    // HTAB (0x09) is valid WSP per RFC 5322 Section 2.2.
    // Control characters (0x00-0x1F except HTAB, 0x7F) must be RFC 2047
    // encoded. Previously, format_address only checked for non-ASCII bytes,
    // allowing control chars through unencoded.
    let addr = crate::types::Address {
        name: Some("Bell\x07Char".to_string()),
        email: "user@example.com".to_string(),
    };
    let formatted = format_address(&addr);
    // The display name contains a control character (BEL = 0x07),
    // so it must be RFC 2047 encoded, not emitted raw.
    assert!(
        formatted.contains("=?UTF-8?B?"),
        "display name with control chars must be RFC 2047 encoded, got: {formatted}"
    );
    assert!(
        formatted.contains("<user@example.com>"),
        "email must be angle-bracketed: {formatted}"
    );
}

/// Regression: `resent_field_kind()` must not panic on unknown field names.
/// The caller guards with `is_resent_extra_header()`, but the function itself
/// is `pub(super)` and must return an error instead of panicking via
/// `unreachable!()` (workspace rule: errors, not panics).
#[test]
fn resent_field_kind_unknown_field_returns_error() {
    let result = resent_field_kind("X-Not-A-Resent-Field", 0);
    assert!(
        result.is_err(),
        "unknown resent field must return Err, not panic"
    );
}

/// Valid resent field names must still resolve correctly after the
/// `unreachable!()` → `Result` migration.
#[test]
fn resent_field_kind_valid_fields_resolve() {
    assert!(resent_field_kind("Resent-Date", 0).is_ok());
    assert!(resent_field_kind("resent-from", 2).is_ok());
    assert!(resent_field_kind("RESENT-TO", 0).is_ok());
    assert!(resent_field_kind("resent-message-id", 0).is_ok());
}