/**
 * packages/shared — minimal, XSS-safe markdown → HTML renderer.
 *
 * Used by the SEND_EMAIL automation action (TASK-0112 §7) to render the
 * (interpolated) markdown body to HTML. Deliberately small + safe: ALL input
 * is HTML-escaped FIRST, then a fixed set of inline/block transforms is
 * applied on the escaped text, so no raw HTML from the body can survive.
 *
 * Supported: #/##/### headings, **bold**, *italic*, `code`, [text](url),
 * unordered lists (- / *), ordered lists (1.), paragraphs + line breaks.
 * Everything else passes through as plain text (escaped).
 */

function esc(s: string): string {
  return s
    .replace(/&/g, "&")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;");
}

/** Only allow http(s) link targets (defang javascript: etc.). */
function safeHref(href: string): string {
  const h = href.trim();
  return /^https?:\/\//i.test(h) ? h : "#";
}

/**
 * Render markdown to HTML. Pure + total — any string in, a safe string out.
 */
export function renderMarkdown(md: string): string {
  const src = md.replace(/\r\n/g, "\n");
  const lines = src.split("\n");
  const out: string[] = [];
  let inUl = false;
  let inOl = false;
  let para: string[] = [];

  const closeLists = () => {
    if (inUl) out.push("</ul>");
    if (inOl) out.push("</ol>");
    inUl = inOl = false;
  };
  const flushPara = () => {
    if (para.length) {
      out.push(`<p>${para.map(inline).join("<br>")}</p>`);
      para = [];
    }
  };

  const inline = (s: string): string => {
    let t = esc(s);
    // inline code (protect from further transforms)
    t = t.replace(/`([^`]+)`/g, (_m, c) => `<code>${c}</code>`);
    // bold then italic
    t = t.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>");
    t = t.replace(/(^|[^*])\*([^*\n]+)\*/g, "$1<em>$2</em>");
    // links
    t = t.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_m, text, href) => `<a href="${esc(safeHref(String(href)))}" rel="noopener noreferrer">${text}</a>`);
    return t;
  };

  for (const raw of lines) {
    const line = raw;
    const h = /^(#{1,3})\s+(.*)$/.exec(line);
    if (h) {
      flushPara();
      closeLists();
      const level = h[1]!.length;
      out.push(`<h${level}>${inline(h[2]!)}</h${level}>`);
      continue;
    }
    const ul = /^\s*[-*]\s+(.*)$/.exec(line);
    if (ul) {
      flushPara();
      if (inOl) closeLists();
      if (!inUl) {
        out.push("<ul>");
        inUl = true;
      }
      out.push(`<li>${inline(ul[1]!)}</li>`);
      continue;
    }
    const ol = /^\s*\d+\.\s+(.*)$/.exec(line);
    if (ol) {
      flushPara();
      if (inUl) closeLists();
      if (!inOl) {
        out.push("<ol>");
        inOl = true;
      }
      out.push(`<li>${inline(ol[1]!)}</li>`);
      continue;
    }
    if (line.trim() === "") {
      flushPara();
      closeLists();
      continue;
    }
    para.push(line);
  }
  flushPara();
  closeLists();
  return out.join("\n");
}