package check

import (
	"bytes"
	"encoding/json"
	"fmt"
	"regexp"
	"slices"
	"strings"
	"testing"

	"amadan.net/rastrillo/fiesta"
	"amadan.net/rastrillo/fiesta/internal/nodetest"
)

// fiestaJS is js/fiesta.js as the tree ships it.
func fiestaJS(t *testing.T) []byte {
	t.Helper()
	js, ok := fiesta.Script("fiesta.js")
	if !ok {
		t.Fatal("fiesta.js is not shipped")
	}
	return js
}

// The shim's behaviour is driven in a browser (scheme_browser_test.go)
// and in Node (fiesta_node.mjs, below). What a Go test can hold honest
// is the contract the docs promise: the vocabulary the file answers to,
// its inert-by-default IIFE shape, and the absence of anything a CSP
// would reject. Ported from rastrillo's ui/shim_test.go at the seed
// commit: the polling strings are gone with the polling, and the cookie
// strings are replaced by Fiesta's own contract, the event, the storage
// key, the ownership attribute and the store.
func TestShimContract(t *testing.T) {
	js := string(fiestaJS(t))
	for _, want := range []string{
		// Light dismiss: the menu classes it answers to, the nested
		// rst-menu-group among them, so a submenu is never left open
		// behind its closing parent, the containment test that keeps the
		// menu being used open, the Escape key, and the focus hand-back to
		// the summary. Delegated on the document, so the count of
		// addEventListener calls stays at two however many menus a page
		// renders.
		"rst-dropdown", "rst-menu-group", "rst-row-menu",
		"closeMenus", "contains", "Escape", "summary.focus()",
		// Both spellings. tokens.css pairs them for the window between
		// upgrading the module and running `rastrillo markup`, and the
		// shim has to pair them for the same window or an app's menus
		// stop dismissing halfway through the upgrade we hand it.
		`MENUS.replace(`,
		// The topbar's and console's narrow Menu is a card over the page,
		// so it is in the light-dismiss list, in both spellings written
		// out (the rewrite above would give .rst-shell-menu, and the
		// class is .rst-shell__menu), with its tail counted as inside it
		// only while its summary is rendered. Scoped to a topbar or a
		// console that names its view: an old console's Menu also
		// reveals its rail, which must not close on a tap at a group
		// label.
		`[rst-shell-topbar] [rst-shell-menu][open],[rst-shell-console~=page] [rst-shell-menu][open],[rst-shell-console~=index] [rst-shell-menu][open]`,
		`.rst-shell-topbar .rst-shell__menu[open],.rst-shell-console--page .rst-shell__menu[open],.rst-shell-console--index .rst-shell__menu[open]`,
		`TAIL = "[rst-shell-tail],.rst-shell__tail"`, "menuAround", "getClientRects().length",
		// The colour-scheme switch: the menu it answers to in both
		// spellings, the attribute the themes read, the event a choice
		// dispatches, the key it is remembered under, the attribute that
		// says the page remembers, and the store it remembers in.
		`"[rst-scheme],.rst-scheme"`, "data-theme",
		`"rst-scheme"`, `"fiesta-scheme"`, "data-rst-scheme-store", "localStorage",
		// The iOS touch listener: :active lands on a tap only when
		// a touchstart listener exists, and this file owns it so an app
		// that deletes light.js keeps its pressed states.
		`addEventListener("touchstart", function () {}, { passive: true })`,
	} {
		if !strings.Contains(js, want) {
			t.Errorf("shim does not mention %q", want)
		}
	}
	if !strings.HasPrefix(strings.TrimSpace(strings.SplitN(js, "\n(function", 2)[0]), "/*") {
		t.Error("shim should open with its contract comment")
	}
	if !strings.Contains(js, "(function () {") || !strings.Contains(js, "})();") {
		t.Error("shim should be a single IIFE")
	}
	if strings.Contains(js, "eval(") || strings.Contains(js, "new Function") {
		t.Error("shim must stay CSP-clean")
	}
	// Light dismiss is delegated, not bound per element: a menu that
	// arrives after load has to be covered the moment it lands, and
	// re-scanning must never double-bind. A querySelectorAll over the
	// menus at load would be exactly that bug, so pin the listeners to
	// the document.
	if !strings.Contains(js, `document.addEventListener("click", dismissMenus, true)`) ||
		!strings.Contains(js, `document.addEventListener("keydown", dismissMenus, true)`) {
		t.Error("light dismiss is not two delegated document listeners")
	}
	// Three mentions and no more: the definition and the two listeners.
	// A fourth would mean someone started binding it per element again.
	if n := strings.Count(js, "dismissMenus"); n != 3 {
		t.Errorf("dismissMenus appears %d times, want 3 (one definition, two document listeners)", n)
	}
	// The old sidebar drawer and the toggle-block stay out of it: neither
	// is a menu, and dismissing them on an outside click would fight the
	// user. (The topbar's Menu is in, above: it is a card that overlays
	// the page now, which is what light dismiss is for.) The check reads
	// the light-dismiss code, closeMenus through the two listeners: the
	// switch's drag names the toggle block's head, which drags like a
	// switch, and that is not light dismiss.
	reach, err := lightDismissReach(js)
	if err != nil {
		t.Fatal(err)
	}
	for _, bad := range reach {
		t.Errorf("light dismiss reaches for %q; it covers menus only", bad)
	}
}

// lightDismissReach returns which of the names light dismiss must never
// touch appear in its code, which runs from the menu list, MENUS, with
// its extensions, through menuAround and closeMenus to the two document
// listeners; an error when that code is not where it expects.
func lightDismissReach(js string) ([]string, error) {
	from, to := strings.Index(js, "var MENUS"), strings.Index(js, `document.addEventListener("keydown", dismissMenus, true)`)
	if from < 0 || to < from {
		return nil, fmt.Errorf("the light-dismiss code is not where this check expects it")
	}
	var out []string
	for _, bad := range []string{"rst-shell-chrome", "rst-tblock"} {
		if strings.Contains(js[from:to], bad) {
			out = append(out, bad)
		}
	}
	return out, nil
}

// TestTheLightDismissGateReadsTheMenuList (switch review 5): the gate
// has to read the menu list, not only the functions after it. A drawer
// or a toggle block spliced into MENUS makes closeMenus(null) close it,
// and the functions' own text would never say so. The shipped shim is
// the control.
func TestTheLightDismissGateReadsTheMenuList(t *testing.T) {
	js := string(fiestaJS(t))
	if reach, err := lightDismissReach(js); err != nil || len(reach) != 0 {
		t.Fatalf("the shipped shim: reach %v, err %v; want none", reach, err)
	}
	for _, m := range []struct{ name, bad string }{{"the drawer spliced into MENUS", "rst-shell-chrome"}, {"the toggle block spliced into MENUS", "rst-tblock"}} {
		mutant := strings.Replace(js, `var MENUS = "`, `var MENUS = "[`+m.bad+`][open],`, 1)
		if mutant == js {
			t.Fatal("MENUS is not where this test expects it")
		}
		reach, err := lightDismissReach(mutant)
		if err != nil {
			t.Fatal(err)
		}
		if len(reach) != 1 || reach[0] != m.bad {
			t.Errorf("%s: the gate reports %v; want %q, which closeMenus(null) would now close", m.name, reach, m.bad)
		}
	}
}

// fiesta.js is the plain-browser half of rastrillo.js: nothing in it
// talks to a server. Polling, its push channel, the request headers
// that marked a poll, the scheme cookie and any fetch stay in
// rastrillo.
func TestFiestaJSHasNoServerBehaviour(t *testing.T) {
	js := string(fiestaJS(t))
	for _, bad := range []string{"data-poll", "EventSource", "Rastrillo-", "document.cookie", "fetch("} {
		if strings.Contains(js, bad) {
			t.Errorf("fiesta.js mentions %q; the server half stays in rastrillo", bad)
		}
	}
}

// 12 KiB: what is left of rastrillo.js once polling, its header and
// the cookie are gone, with the scheme memory added (measured 12,144
// bytes: 6.4 KB of code, the rest comment). The point of the cap is the
// same as rastrillo's: whoever links this file can read the whole of
// it in one sitting. Past it, trim a comment before raising the cap.
func TestFiestaJSIsSmall(t *testing.T) {
	js := fiestaJS(t)
	if n := len(js); n > 12*1024 {
		t.Fatalf("fiesta.js is %d bytes; the point is that a reader can take it in one sitting, trim it", n)
	}
	if bytes.Contains(js, []byte("\t")) {
		t.Error("fiesta.js uses two-space indentation, not tabs")
	}
}

// schemeRun is what one scenario in fiesta_node.mjs reports after
// fiesta.js ran against its stub page and, where the scenario submits,
// after the submit.
type schemeRun struct {
	Theme        string   // data-theme on <html>, "" for none
	Prevented    bool     // the submit's default was prevented
	Stored       string   // localStorage["fiesta-scheme"], "" for none
	Keys         int      // keys in localStorage
	StorageCalls int      // calls on localStorage's methods
	Cookies      int      // writes to document.cookie
	Events       []string // detail.scheme of each rst-scheme event dispatched
	Current      string   // the scheme whose button is aria-current
	Open         bool     // the menu is still open
	Error        string   // what the submit threw, "" for nothing
	Ran          bool     // the scenario wrote this report at all
}

// fiestaReport is fiesta_node.mjs's whole report, a scenario per field.
type fiestaReport struct {
	Idempotent                                                            struct{ Once, Twice int }
	Standalone, System, Broken, Server, StoredOnLoad, ServerIgnoresStored schemeRun
}

// fiestaNode runs fiesta_node.mjs and decodes its report.
func fiestaNode(t *testing.T) fiestaReport {
	t.Helper()
	var out fiestaReport
	if err := json.Unmarshal(nodetest.Run(t, nodetest.Cmd{Args: []string{"node/fiesta_node.mjs"}}), &out); err != nil {
		t.Fatal(err)
	}
	return out
}

// A second copy of fiesta.js on a page does nothing: the guard at the
// top returns before a listener is added. Two evaluations in one
// context register as many listeners as one, and one registers some.
func TestFiestaJSIsIdempotent(t *testing.T) {
	got := fiestaNode(t).Idempotent
	if got.Once == 0 {
		t.Fatal("one evaluation registered no listeners")
	}
	if got.Twice != got.Once {
		t.Errorf("two evaluations registered %d listeners, one registered %d; the second copy is not inert", got.Twice, got.Once)
	}
}

// On a page that says it remembers, choosing Dark applies it, stores
// it, writes no cookie, and tells the page once.
func TestAStandaloneSubmitStoresTheScheme(t *testing.T) {
	got := fiestaNode(t).Standalone
	if got.Error != "" {
		t.Fatalf("the submit threw: %s", got.Error)
	}
	if got.Theme != "dark" || !got.Prevented || got.Stored != "dark" || got.Cookies != 0 {
		t.Errorf("after Dark: theme %q, prevented %v, stored %q, cookie writes %d; want dark, true, dark, 0", got.Theme, got.Prevented, got.Stored, got.Cookies)
	}
	if len(got.Events) != 1 || got.Events[0] != "dark" {
		t.Errorf("rst-scheme events %q, want one with detail.scheme dark", got.Events)
	}
	if got.Current != "dark" || got.Open {
		t.Errorf("after Dark: aria-current on %q and the menu open is %v; want dark and closed", got.Current, got.Open)
	}
}

// System is no attribute and no key: a stored Dark is removed, not
// overwritten with "system".
func TestSystemClearsTheStoredScheme(t *testing.T) {
	got := fiestaNode(t).System
	if got.Error != "" {
		t.Fatalf("the submit threw: %s", got.Error)
	}
	if got.Theme != "" || got.Keys != 0 || got.Stored != "" {
		t.Errorf("after System: theme %q, %d keys in storage, stored %q; want none, 0, none", got.Theme, got.Keys, got.Stored)
	}
	if len(got.Events) != 1 || got.Events[0] != "system" {
		t.Errorf("rst-scheme events %q, want one with detail.scheme system", got.Events)
	}
	if got.Current != "system" {
		t.Errorf("aria-current is on %q, want system", got.Current)
	}
}

// A browser with storage switched off throws on the first touch. The
// switch still switches, and the page still hears about it.
func TestABrokenStorageStillSwitches(t *testing.T) {
	got := fiestaNode(t).Broken
	if got.Error != "" {
		t.Fatalf("a storage that throws escaped the submit: %s", got.Error)
	}
	if got.Theme != "dark" || !got.Prevented || len(got.Events) != 1 {
		t.Errorf("after Dark on broken storage: theme %q, prevented %v, events %q; want dark, true, one", got.Theme, got.Prevented, got.Events)
	}
}

// Without the attribute the page is the server's, or has no memory:
// the same attribute and event as standalone, and storage untouched.
func TestAServerOwnedSubmitStoresNothing(t *testing.T) {
	got := fiestaNode(t).Server
	if got.Error != "" {
		t.Fatalf("the submit threw: %s", got.Error)
	}
	if got.Theme != "dark" || !got.Prevented || len(got.Events) != 1 || got.Events[0] != "dark" {
		t.Errorf("after Dark: theme %q, prevented %v, events %q; want dark, true, one dark", got.Theme, got.Prevented, got.Events)
	}
	if got.StorageCalls != 0 || got.Keys != 0 || got.Cookies != 0 {
		t.Errorf("a server-owned submit made %d storage calls, left %d keys and wrote %d cookies; want none", got.StorageCalls, got.Keys, got.Cookies)
	}
}

// With the attribute, a stored Dark and no data-theme, evaluating the
// script sets data-theme synchronously, so a copy in <head> without
// defer restores before first paint; once the DOM is ready the Dark
// button is current.
func TestTheStoredSchemeIsAppliedOnLoad(t *testing.T) {
	got := fiestaNode(t).StoredOnLoad
	if got.Theme != "dark" {
		t.Errorf("after evaluating the script, data-theme is %q, want dark", got.Theme)
	}
	if got.Current != "dark" {
		t.Errorf("once the DOM is ready, aria-current is on %q, want dark", got.Current)
	}
}

// Without the attribute, a stored Dark means nothing: the root stays
// without data-theme, since a missing data-theme is the server's
// System.
func TestAServerOwnedPageIgnoresTheStoredScheme(t *testing.T) {
	got := fiestaNode(t).ServerIgnoresStored
	// Every field this test wants is a zero value, which is also what
	// a scenario that went missing from the report decodes to.
	if !got.Ran {
		t.Fatal("the serverIgnoresStored scenario is not in fiesta_node.mjs's report")
	}
	if got.Theme != "" {
		t.Errorf("a server-owned page took data-theme %q from storage; want none", got.Theme)
	}
	if got.StorageCalls != 0 {
		t.Errorf("a server-owned page read storage %d times on load; want never", got.StorageCalls)
	}
}

// ── The other scripts' contracts (ui/shim_test.go) ──────────────────

// The busy rule is a DEFAULT, and this is the assertion that says so in
// Go rather than in a browser: one delegated submit listener on the
// document, no scan over forms carrying an attribute, and the only
// thing data-busy can now say is "false".
//
// The bug this catches is a quiet regression, not a crash: someone
// restores the old `document.querySelectorAll("form[data-busy]")` scan,
// every drive that plants data-busy on its form keeps passing, and every
// app that never wrote the attribute silently loses the rule.
func TestBusyRuleIsTheDefault(t *testing.T) {
	js := string(shippedScript(t, "busy.js"))
	if !strings.Contains(js, `document.addEventListener("submit", busySubmit, true)`) {
		t.Error("the busy rule is not one delegated capture-phase submit listener on the document")
	}
	// Three mentions and no more: the definition, the one listener, and
	// the window listener's late call for a data-live-form form its
	// server's script left to the browser (armed there because only then
	// is it known whether the script took it). A fourth would mean
	// someone started binding it per form again.
	if n := strings.Count(js, "busySubmit"); n != 3 {
		t.Errorf("busySubmit appears %d times, want 3 (one definition, one document listener, one late call for a data-live-form)", n)
	}
	if !strings.Contains(js, "busySubmit(e, true)") {
		t.Error("busy.js no longer arms a data-live-form form its server's script left to the browser")
	}
	// The opt-in scan is gone. Any querySelectorAll over a data-busy
	// selector is the old shape coming back.
	for _, bad := range []string{`"form[data-busy]"`, `"[data-busy]"`, "busyForm"} {
		if strings.Contains(js, bad) {
			t.Errorf("busy.js scans for %s; the busy rule is on by default, not opted into", bad)
		}
	}
	// data-busy survives only as an opt-out, on the form and on the
	// button. Both readings have to be there: a rule you can only turn
	// off for a whole form is not the rule the docs describe.
	if n := strings.Count(js, `getAttribute("data-busy") === "false"`); n != 2 {
		t.Errorf(`data-busy=="false" is tested %d times, want 2 (the form's opt-out and the button's)`, n)
	}
	// A form is [LegacyOverrideBuiltIns], so a control named "target"
	// shadows form.target with the input element — truthy, not "_self",
	// and the property form would silently switch the rule off for that
	// form. Every attribute the handler reads goes through getAttribute,
	// and the guard is the form's own aria-busy rather than an expando a
	// control could shadow (or, under strict mode, throw on).
	// Comments stripped first, or this gate would fire on the very
	// sentence in the shim that explains why the property read is wrong.
	code := js[strings.Index(js, "(function () {"):]
	var b strings.Builder
	for _, line := range strings.Split(code, "\n") {
		if strings.HasPrefix(strings.TrimSpace(line), "//") {
			continue
		}
		b.WriteString(line)
		b.WriteByte('\n')
	}
	code = b.String()
	for _, bad := range []string{"form.target", "form.method", ".formMethod", "form.rstBusy", ".rstBusy ="} {
		if strings.Contains(code, bad) {
			t.Errorf("the shim reads %s as a property; a control of that name shadows it — switching the rule off, or, for an assignment under strict mode, throwing", bad)
		}
	}
	if !strings.Contains(js, `form.getAttribute("target")`) {
		t.Error("the shim does not read the form's target through getAttribute")
	}
	if !strings.Contains(js, `if (form.getAttribute("aria-busy") === "true") { e.preventDefault(); return; }`) {
		t.Error("the double-submit guard is not the form's own aria-busy attribute")
	}
	// A submit that goes NOWHERE must not be guarded, and there are
	// three shapes of it. target="_blank" leaves this page where it is;
	// so does <form method="dialog">, the standard close button inside a
	// <dialog>; and so does <button formmethod="dialog"> in an ordinary
	// form, the same close reached through the submitter's own
	// attribute. The dialog shapes are the worse: nothing ever navigates
	// or reloads afterwards, so a guard armed there is never cleared —
	// the close button ends up disabled and the dialog cannot be closed
	// through that form again, ever.
	//
	// One effective method, computed once, with the submitter's
	// formmethod beating the form's method the way HTML says it does.
	// Both read through getAttribute — never form.method or
	// btn.formMethod — for the [LegacyOverrideBuiltIns] reason above,
	// and matched case-insensitively because method is an enumerated
	// attribute.
	for _, want := range []string{
		`if (/^dialog$/i.test(btn && btn.getAttribute("formmethod") ||`,
		`      form.getAttribute("method"))) return;`,
	} {
		if !strings.Contains(js, want) {
			t.Errorf(`the busy rule does not bail out of an effective method of "dialog" (%s missing); a dialog's close form — or a button's formmethod="dialog" — arms a guard nothing will ever clear`, want)
		}
	}
	// The submitter has to be in hand BEFORE the guard runs, or the
	// effective method cannot see it and the bail reads the form's
	// method alone.
	if strings.Index(js, "    var btn = e.submitter;") > strings.Index(js, `    if (/^dialog$/i.test(`) {
		t.Error("the submitter is read after the dialog bail; the bail cannot see formmethod")
	}
	// The reset has to reach a submit button that belongs to the form
	// through form="id" while living somewhere else in the document — a
	// sticky header's Save. busySubmit busies it (it is the submit
	// event's submitter, wherever it sits), so a reset that swept the
	// form's own subtree left it disabled and spinning after every
	// bfcache restore, for good. Sweep the document and test ownership.
	if strings.Contains(js, `form.querySelectorAll('[aria-busy="true"]')`) {
		t.Error(`busyOff sweeps the form's descendants; a submit button associated through form="id" is not one, and never comes back`)
	}
	if !strings.Contains(js, `if (b.form !== form && !form.contains(b)) return;`) {
		t.Error("busyOff does not test ownership, so it would clear busy state belonging to another form")
	}
	// The payload trap, pinned where a reader will trip over it: the
	// two mutations that can change what the server receives — disabled
	// and an <input type="submit">'s value — happen inside the deferred
	// callback, never in the synchronous part of the handler.
	sync, deferred, ok := strings.Cut(js, "    setTimeout(function () {")
	if !ok {
		t.Fatal("the busy handler no longer defers anything; disabled must not be set during the submit event")
	}
	sync = sync[strings.Index(sync, "function busySubmit"):]
	for _, bad := range []string{"btn.disabled", "btn.value ="} {
		if strings.Contains(sync, bad) {
			t.Errorf("%s runs synchronously in the submit handler; it drops the button's name/value from the payload", bad)
		}
		if !strings.Contains(deferred, bad) {
			t.Errorf("%s is not in the deferred callback; the busy state never hardens", bad)
		}
	}
}

// select.js holds to the same contract as the shim, and to the same
// reason for existing: small enough that the app owner who now owns it
// can read the whole thing.
func TestSelectContract(t *testing.T) {
	js := string(shippedScript(t, "select.js"))
	for _, want := range []string{
		"data-rst-select", "data-rst-select-filter",
		"data-rst-select-results", "data-rst-select-result-one",
		// The convention, pinned: an ARIA combobox that mirrors rather
		// than replaces, announced to assistive tech.
		"combobox", "aria-activedescendant", "aria-expanded", "aria-live",
		"rst-sr-only",
	} {
		if !strings.Contains(js, want) {
			t.Errorf("select.js does not mention %q", want)
		}
	}
	// The whole point: the native control survives enhancement, because
	// it is what the form submits. The one thing select.js does remove is
	// a row it drew itself (a page's extra suggestions, replaced), so the
	// fence is on the native select and the markup around it.
	for _, bad := range []string{"native.remove()", "removeChild(native", "outerHTML =", "innerHTML ="} {
		if strings.Contains(js, bad) {
			t.Errorf("select.js destroys DOM (%q); the native select must survive", bad)
		}
	}
	// Inert by default, and re-scannable.
	if !strings.Contains(js, "rstEnhanced") {
		t.Error("select.js is not idempotent; re-scanning would double-enhance")
	}
	// The markup-side opt-out, and the groups.
	if !strings.Contains(js, `!== "false"`) {
		t.Error(`select.js does not honour data-rst-select="false"; a hand-written select cannot opt out`)
	}
	for _, want := range []string{"OPTGROUP", `"group"`, "rst-select-group"} {
		if !strings.Contains(js, want) {
			t.Errorf("select.js does not mention %q; a grouped select would be flattened", want)
		}
	}
	// Raised from 8KB to 12KB, once, by optgroups and the markup
	// opt-out. Flattening native.options was a line shorter and silently
	// threw away the headings an author wrote to make a long list
	// readable; rendering the groups costs a nested list, an ARIA group
	// per optgroup, and a filter that hides a heading when its rows all
	// go. That is the trade, and it is a decision, not a drift.
	//
	// Raised again, to 37KB (measured 36,296 bytes), by the convergence
	// with Tito Go's searchselect (2026-09-26): ranking that puts the row
	// someone meant first (accents folded, ISO and calling codes as
	// terms), prompts that are never picks, a list that keeps pace with
	// fast typing by moving only what a search shows, settle-on-leave,
	// dividers, compact boxes and borrowed validity. Splitting the pure
	// ranking into its own file was tried and rejected: importing it makes
	// this an ES module, which every app's classic <script defer> tag and
	// the design system's preview files would have to change for, and an
	// app that re-vendored without editing its layout would lose the
	// enhancement silently. Most of the growth is the why-comments, which
	// are what let the app owner who now owns it read it in one sitting.
	// The headroom is about what the old 12KB ceiling had: room for a fix
	// and its why, not for a feature.
	//
	// Then to 47KB by the alignment with Tito's final searchselect (titogo
	// 9d21ce1): the box steps aside when a page replaces the select
	// outright, and rebuilds itself when a page changes the options —
	// without both it showed one pick while the form posted another — and,
	// from Paul's iPhone, the list opens upward when the keyboard leaves no
	// room below, with layout read once a frame. Measured 48,035 bytes after
	// rows moved from the hidden attribute to inline display (titogo
	// #3145); comments were trimmed to stay inside rather than raise it.
	//
	// Then to 48KB (measured 48,573 bytes) by rst:select-scan, the one way
	// a page that adds content after load gets its selects enhanced (Tito's
	// modal forms need it). The header was trimmed first; the ranking
	// comments were not, because they are kept in step with Tito's.
	//
	// Then to 50KB (measured 51,096 bytes) by placement in frames: a band a
	// host tells the frame (rst:select-viewport), floors under sticky bars
	// (data-rst-select-floor), the list's padding and borders counted
	// against the room, and the gap re-read — Tito Go #3146's rule, which
	// the checkout widget's iPhone keyboard needed.
	//
	// Then to 51KB (measured 52,098 bytes) by data-rst-class, a row and the
	// closed box styled per option: Tito Go's font menus set each name in
	// its own face. Comments were trimmed to the one that says why typing
	// takes the classes off.
	//
	// Then to 52KB (measured 53,128 bytes) by selecting the pick on a
	// focusing click as well as on focus: WebKit put the caret where a
	// click landed after focus, so clearing "Dublin" took a double-click.
	// The comment is the one that says why each pointer selects when.
	//
	// Then to 54KB (measured 54,601 bytes) by the string tables: the
	// file sat 120 bytes under the cap, and fiestaPickLang and
	// fiestaWord, the lookup that reads a label off the attribute, then
	// the page's table, then the fallback, added 1,473 net. The same
	// bytes went into datetime.js, whose cap moved with them; see
	// TestTheTwoLookupsAreTheSame. 53KB does not hold it; 54KB does,
	// with 695 to spare.
	//
	// Then to 57KB (measured 57,787 bytes) by the placement fix synced
	// from rastrillo: the room is cut only by the ancestors that can
	// clip the list, its chain of containing blocks, held to CSS's own
	// rules (paint containment and content-visibility, will-change's
	// triggers by each property's rule, the top layer, slots, table
	// rows and ruby skipped, aliases only where the engine has them),
	// and data-rst-select-ceiling, floor's twin for a sticky header. A
	// list fixed or anchored out of a bar that scrolls sideways had
	// opened 0px tall. Rastrillo holds the same code at 55KB; the
	// string tables above are the 1,473 bytes between the two caps.
	//
	// Then to 59KB (measured 59,673 bytes, +1,886) by the native
	// state: a disabled select's box is disabled with it and refuses
	// every row, an option under a disabled <optgroup> is off limits,
	// a disabled <fieldset> is read at each choice, and a form reset
	// repaints the box a task later. 58KB (59,392) does not hold it;
	// 59KB (60,416) does, with 743 to spare.
	if n := len(js); n > 59*1024 {
		t.Fatalf("select.js is %d bytes; it is split out of the shim precisely to stay readable — trim it", n)
	}
	if strings.Contains(js, "\t") {
		t.Error("select.js uses two-space indentation, not tabs")
	}
}

// transition.js is the one script a page loads before its stylesheets,
// so it holds to the others' shape and stays small, and it puts nothing
// on screen: no words to look up, no attribute or text written. It
// listens for the two events a view transition arrives on and nothing
// else.
func TestTransitionContract(t *testing.T) {
	js := string(shippedScript(t, "transition.js"))
	if !strings.HasPrefix(strings.TrimSpace(js), "/*") || !strings.Contains(js, "(function () {") || !strings.HasSuffix(strings.TrimSpace(js), "})();") {
		t.Error("transition.js should be its contract comment and a single IIFE")
	}
	if strings.Contains(js, "eval(") || strings.Contains(js, "new Function") || strings.Contains(js, "\t") {
		t.Error("transition.js must stay CSP-clean and use two-space indentation")
	}
	for _, screen := range []string{"fiestaWord", "fiestaStrings", "data-rst-", "textContent", "setAttribute", "innerHTML"} {
		if strings.Contains(js, screen) {
			t.Errorf("transition.js mentions %s; it puts nothing on screen", screen)
		}
	}
	listens := regexp.MustCompile(`addEventListener\("([a-z]+)"`).FindAllStringSubmatch(js, -1)
	var events []string
	for _, m := range listens {
		events = append(events, m[1])
	}
	if !slices.Equal(events, []string{"pageswap", "pagereveal"}) {
		t.Errorf("transition.js listens for %v, want pageswap and pagereveal only", events)
	}
	if n := len(js); n > 1024 {
		t.Errorf("transition.js is %d bytes; it blocks the first render, so keep it under 1 KiB", n)
	}
}

// No shipped script may reach off-origin: every one fiesta.ScriptNames
// lists is vendored, first-party and dependency-free. The count is
// pinned so a list that lost its names could not pass by naming none.
func TestScriptsAreSelfContained(t *testing.T) {
	names := fiesta.ScriptNames()
	if len(names) != 10 {
		t.Fatalf("fiesta.ScriptNames() lists %d scripts, want 10: %v", len(names), names)
	}
	for _, name := range names {
		js := string(shippedScript(t, name))
		for _, bad := range []string{"http://", "https://", "import ", "require(", "//cdn"} {
			if strings.Contains(js, bad) {
				t.Errorf("%s reaches outside the page (%q)", name, bad)
			}
		}
	}
}

// anchor.js is the one script an app is told to delete in time, so its
// contract is that it is inert where it is not needed: the feature test
// returns before any listener is added, and the class it writes is the
// one tokens.css opens a menu from. Small, like the others.
func TestAnchorContract(t *testing.T) {
	js := string(shippedScript(t, "anchor.js"))
	test, listen := strings.Index(js, `CSS.supports("position-area: block-end")`), strings.Index(js, "addEventListener")
	if test < 0 || listen < 0 || test > listen {
		t.Error("anchor.js must test for anchor positioning, and return, before it listens for anything")
	}
	if !strings.Contains(js, "is-flip-inline") || !slices.Contains(ruleSelectors(t, string(fiesta.TokensCSS())), "[rst-dropdown].is-flip-inline > [rst-dropdown-menu]") {
		t.Error("anchor.js and tokens.css no longer agree on .is-flip-inline")
	}
	if n := len(js); n > 4*1024 {
		t.Errorf("anchor.js is %d bytes; it does one thing, keep it small", n)
	}
	if strings.Contains(js, "\t") {
		t.Error("anchor.js uses two-space indentation, not tabs")
	}
}

// busy.js was split out of the shim when the hold was added (the shim
// sat 20 bytes under its cap). Its contract, held the same way: the
// vocabulary, the spinner and submitter, the cancelled-submit hand-back,
// the hold (its duration, the window listener that runs last, the
// re-submit that keeps the submitter), and Back in both directions.
func TestBusyContract(t *testing.T) {
	js := string(shippedScript(t, "busy.js"))
	for _, want := range []string{
		"data-busy", "data-busy-label",
		`spin.setAttribute("rst-spin", "")`, "e.submitter", "defaultPrevented",
		"HOLD_MS = 650", `window.addEventListener("submit"`, "requestSubmit(btn || undefined)",
		"held.has(e)", "form === releasing", "checkValidity()",
		"pagehide", "clearTimeout", "pageshow", "e.persisted",
		// Review fixes: an opted-out button is never left disabled, and a
		// submitter that left the form during the hold hands the form back.
		"btn.disabled = wasDisabled", "btn.form !== form", `getAttribute("formtarget")`,
		// Only a submit with a spinner showing is held.
		`btn.getAttribute("aria-busy") !== "true") return;`,
		// A data-live-form form is its server's script's when the script
		// sends it, so it is armed late, and only if the script did not
		// claim it (e.liveForm) in either script order
		// (TestBusyLeavesALiveFormItsScriptClaimed drives it).
		`form.hasAttribute("data-live-form") && !late`,
		`e.defaultPrevented || e.liveForm) return;`,
	} {
		if !strings.Contains(js, want) {
			t.Errorf("busy.js does not mention %q", want)
		}
	}
	if !strings.HasPrefix(strings.TrimSpace(js), "/*") || !strings.Contains(js, "(function () {") || !strings.HasSuffix(strings.TrimSpace(js), "})();") {
		t.Error("busy.js should be its contract comment and a single IIFE")
	}
	if strings.Contains(js, "eval(") || strings.Contains(js, "new Function") || strings.Contains(js, "\t") {
		t.Error("busy.js must stay CSP-clean and use two-space indentation")
	}
	if n := len(js); n > 16*1024 {
		t.Fatalf("busy.js is %d bytes; keep it readable in one sitting", n)
	}
}

// shell.js holds to the contract every scaffolded script does, with an
// 8 KiB cap of its own (busy.js's precedent): the three behaviours it
// exists for, named; both spellings of what it reads; the storage guard;
// the prerender and pageswap facts its ordering depends on.
func TestShellContract(t *testing.T) {
	js := string(shippedScript(t, "shell.js"))
	for _, want := range []string{
		// 1. Direction.
		"pagereveal", "viewTransition.types.add", `"back"`, `"forward"`, "navigationType", `"traverse"`,
		// 2. History reuse, only when proven. The Navigation API is read
		// through a local (nav), so the call is spelled nav.entries().
		"history.back()", "nav.entries()", "sameDocument", "e.button !== 0", "defaultPrevented",
		// 3. Focus return, record first, never while prerendering.
		"rst-shell-return", "pageswap", "pagehide", "document.prerendering", "decodeURIComponent", "sessionStorage",
		// Both spellings.
		"[rst-shell-back]", ".rst-shell__back", `[rst-shell-sidebar~="index"]`, ".rst-shell-sidebar--index",
		`[rst-shell-console~="page"]`, ".rst-shell-console--page",
	} {
		if !strings.Contains(js, want) {
			t.Errorf("shell.js does not mention %q", want)
		}
	}
	if !strings.HasPrefix(strings.TrimSpace(js), "/*") || !strings.Contains(js, "(function () {") || !strings.HasSuffix(strings.TrimSpace(js), "})();") {
		t.Error("shell.js should be its contract comment and a single IIFE")
	}
	if strings.Contains(js, "eval(") || strings.Contains(js, "new Function") || strings.Contains(js, "\t") {
		t.Error("shell.js must stay CSP-clean and use two-space indentation")
	}
	if n := len(js); n > 8*1024 {
		t.Fatalf("shell.js is %d bytes; keep it readable in one sitting (8 KiB)", n)
	}
}

// copy.js holds to the contract every scaffolded script does, with the
// promise its header makes: where there is no clipboard API it returns
// before it listens for anything, so the buttons stay hidden rather
// than showing a button that does nothing. It reads the button by its
// attribute and owns one guard on the window, and it carries the string
// lookup select.js carries, byte for byte, so an attribute, a page's
// table and the English fall back in the same order in every script.
func TestCopyContract(t *testing.T) {
	js := string(shippedScript(t, "copy.js"))
	listen := strings.Index(js, "addEventListener")
	test := strings.Index(js, "typeof navigator.clipboard?.writeText")
	if test < 0 {
		test = strings.Index(js, "navigator.clipboard && navigator.clipboard.writeText")
	}
	if test < 0 || listen < 0 || test > listen {
		t.Error("copy.js must test for navigator.clipboard.writeText, and return, before it listens for anything")
	}
	for _, want := range []string{"rst-snippet-copy", "fiestaCopy"} {
		if !strings.Contains(js, want) {
			t.Errorf("copy.js does not mention %q", want)
		}
	}
	sel := string(shippedScript(t, "select.js"))
	for _, name := range []string{"fiestaPickLang", "fiestaWord"} {
		mine, theirs := functionBody(js, name), functionBody(sel, name)
		if mine == "" {
			t.Errorf("copy.js does not carry %s", name)
		} else if mine != theirs {
			t.Errorf("%s differs between copy.js and select.js:\n--- copy.js\n%s\n--- select.js\n%s", name, mine, theirs)
		}
	}
	if !strings.HasPrefix(strings.TrimSpace(js), "/*") || !strings.Contains(js, "(function () {") || !strings.HasSuffix(strings.TrimSpace(js), "})();") {
		t.Error("copy.js should be its contract comment and a single IIFE")
	}
	if strings.Contains(js, "eval(") || strings.Contains(js, "new Function") || strings.Contains(js, "\t") {
		t.Error("copy.js must stay CSP-clean and use two-space indentation")
	}
	if n := len(js); n > 8*1024 {
		t.Fatalf("copy.js is %d bytes; it does one thing, keep it readable in one sitting (8 KiB)", n)
	}
}