#!/usr/bin/env bash

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
APP_PACKS_ROOT="${NEXUSCRM_OFFICIAL_APP_PACKS_ROOT:-$REPO_ROOT/nexuscrm-app-packs}"
FIXTURE_ROOT="$REPO_ROOT/tests/conformance/issue-tracker-runtime/app-packs-fixture"
APP_PACKS_FIXTURE_ROOT="$APP_PACKS_ROOT/tests/conformance/issue-tracker"
SNAPSHOT_MANIFEST="$REPO_ROOT/tests/conformance/issue-tracker-runtime/app-packs-fixture.snapshot.sha256"
SNAPSHOT_REVISION_FILE="$REPO_ROOT/tests/conformance/issue-tracker-runtime/app-packs-revision"
FIXTURE_MODULE="github.com/nexuscrm/app-packs-conformance/issue-tracker"
RETIRED_PACK_TOMBSTONE="$REPO_ROOT/backend/distributions/appsource/source.go"

fail() {
  echo "$*" >&2
  exit 1
}

assert_absent() {
  local path=$1
  [[ ! -e "$path" ]] || fail "retired release-shaped issue-tracker artifact exists: $path"
}

assert_closure_excludes_fixture() {
  local label=$1
  shift
  local dependencies
  dependencies="$("$@")"
  if grep -Fq "$FIXTURE_MODULE" <<<"$dependencies"; then
    fail "$label production closure depends on $FIXTURE_MODULE"
  fi
}

[[ -d "$APP_PACKS_ROOT" ]] || fail "NEXUSCRM_OFFICIAL_APP_PACKS_ROOT is missing: $APP_PACKS_ROOT"
[[ -d "$FIXTURE_ROOT" ]] || fail "reviewed NexusCRM fixture snapshot is missing: $FIXTURE_ROOT"
[[ -d "$APP_PACKS_FIXTURE_ROOT" ]] || fail "sealed app-packs fixture is missing: $APP_PACKS_FIXTURE_ROOT"
SNAPSHOT_REVISION="$(tr -d '[:space:]' < "$SNAPSHOT_REVISION_FILE")"
[[ "$SNAPSHOT_REVISION" =~ ^[0-9a-f]{40}$ ]] || fail "reviewed NexusCRM fixture snapshot revision is invalid: $SNAPSHOT_REVISION"
git -C "$APP_PACKS_ROOT" cat-file -e "$SNAPSHOT_REVISION^{commit}" \
  || fail "app-packs checkout cannot resolve reviewed fixture snapshot revision: $SNAPSHOT_REVISION"

assert_absent "$APP_PACKS_ROOT/issue-tracker-standard"
assert_absent "$APP_PACKS_ROOT/dialects/dialect-issue-tracker"
assert_absent "$REPO_ROOT/backend/distributions/issuetracker"
assert_absent "$REPO_ROOT/backend/distributions/coexistence"
assert_absent "$REPO_ROOT/backend/distributions/cmd/issue-tracker-server"

(cd "$REPO_ROOT" && scripts/ci/verify-sha256-manifest.sh "$SNAPSHOT_MANIFEST")
for relative in go.mod point_read.go point_read_test.go query.go query_test.go record_access.go record_access_test.go testdata/point_read_golden.json; do
  cmp "$FIXTURE_ROOT/$relative" <(git -C "$APP_PACKS_ROOT" show "$SNAPSHOT_REVISION:tests/conformance/issue-tracker/$relative") \
    || fail "sealed app-packs fixture drifted from reviewed source revision $SNAPSHOT_REVISION: $relative"
done
for relative in managed_workflow.go managed_workflow_lifecycle.go managed_workflow_test.go; do
  [[ -f "$APP_PACKS_FIXTURE_ROOT/$relative" ]] \
    || fail "current app-packs checkout is missing managed issue-workflow conformance source: $relative"
done

# Run the fixture-owned boundary tests from the pinned app-packs checkout. The
# temporary module file replaces only the public NexusCRM shared module; it
# does not add the fixture to any production dependency graph. Using ./...
# deliberately includes future fixture subpackages and their test imports.
(
  fixture_mod="$(mktemp "$APP_PACKS_FIXTURE_ROOT/.sealed-boundary.XXXXXX.mod")"
  fixture_sum="${fixture_mod%.mod}.sum"
  cleanup_fixture_mod() {
    rm -f "$fixture_mod" "$fixture_sum"
  }
  trap cleanup_fixture_mod EXIT

  cp "$APP_PACKS_FIXTURE_ROOT/go.mod" "$fixture_mod"
  if [[ -f "$APP_PACKS_FIXTURE_ROOT/go.sum" ]]; then
    cp "$APP_PACKS_FIXTURE_ROOT/go.sum" "$fixture_sum"
  fi
  cd "$APP_PACKS_FIXTURE_ROOT"
  go mod edit -modfile="$fixture_mod" \
    -replace="github.com/nexuscrm/shared=$REPO_ROOT/shared"
  if [[ -n "${NEXUSCRM_CONTRACT_ROOT:-}" ]]; then
    go mod edit -modfile="$fixture_mod" \
      -replace="github.com/pingcap-inc/nexuscrm-contract=$NEXUSCRM_CONTRACT_ROOT"
  else
    go mod edit -modfile="$fixture_mod" \
      -dropreplace="github.com/pingcap-inc/nexuscrm-contract"
  fi
  GOWORK=off GOFLAGS="-modfile=$fixture_mod -mod=mod" go test ./... -count=1
)

assert_closure_excludes_fixture "records including ordinary test dependencies" \
  env GOWORK=off go -C "$REPO_ROOT/nexuscrm-records" list -deps -test ./...
assert_closure_excludes_fixture "app-blind server commands" \
  env GOWORK=off go -C "$REPO_ROOT/backend" list -deps ./cmd/runtime-api ./cmd/runtime-worker ./cmd/integration-service
assert_closure_excludes_fixture "app-blind backend including ordinary test dependencies" \
  env GOWORK=off go -C "$REPO_ROOT/backend" list -deps -test ./...
assert_closure_excludes_fixture "app-blind setup" \
  env GOWORK=off go -C "$REPO_ROOT/backend/distributions" list -deps ./cmd/setup

distribution_mod="$(mktemp "$REPO_ROOT/backend/distributions/.sealed-fixture-boundary.XXXXXX.mod")"
distribution_sum="${distribution_mod%.mod}.sum"
cleanup() {
  rm -f "$distribution_mod" "$distribution_sum"
}
trap cleanup EXIT
cp "$REPO_ROOT/backend/distributions/go.mod" "$distribution_mod"
if [[ -f "$REPO_ROOT/backend/distributions/go.sum" ]]; then
  cp "$REPO_ROOT/backend/distributions/go.sum" "$distribution_sum"
fi
(
  cd "$REPO_ROOT/backend/distributions"
  go mod edit -modfile="$distribution_mod" \
    -replace="github.com/nexuscrm/dialect-sf-crm=$APP_PACKS_ROOT/dialects/dialect-sf-crm" \
    -replace="github.com/nexuscrm/dialect-sf-crm-soql=$APP_PACKS_ROOT/dialects/dialect-sf-crm-soql"
)
assert_closure_excludes_fixture "CRM distribution" \
  env GOWORK=off GOFLAGS="-modfile=$distribution_mod -mod=mod" \
    go -C "$REPO_ROOT/backend/distributions" list -tags crm -deps ./cmd/setup
assert_closure_excludes_fixture "CRM distribution including ordinary test dependencies" \
  env GOWORK=off GOFLAGS="-modfile=$distribution_mod -mod=mod" \
    go -C "$REPO_ROOT/backend/distributions" list -tags crm -deps -test ./...

for file in "$REPO_ROOT/infra/runtime.Dockerfile"; do
  if grep -Eiq 'issue[-_]?tracker|issuetracker|dialect-issue-tracker|app-packs-conformance/issue-tracker' "$file"; then
    fail "production image definition contains issue-tracker fixture or retired release vocabulary: $file"
  fi
done

# Historical builds could persist the removed product-shaped pack as active.
# The distribution-specific appsource bridge retains exactly one negative name
# tombstone so startup/setup reject that stale row. It is not L0 engine
# vocabulary and must never grow into a source, route, dialect, or fixture
# dependency. Every other non-test production Go source remains vocabulary-free.
[[ "$(grep -Fo '"issue-tracker-standard"' "$RETIRED_PACK_TOMBSTONE" | wc -l | tr -d ' ')" == "1" ]] \
  || fail "retired pack identity tombstone must occur exactly once: $RETIRED_PACK_TOMBSTONE"
grep -Fq 'RetiredIssueTrackerStandardPackName = "issue-tracker-standard"' "$RETIRED_PACK_TOMBSTONE" \
  || fail "retired pack identity tombstone is missing: $RETIRED_PACK_TOMBSTONE"
if grep -Eiq 'dialect-issue-tracker|app-packs-conformance/issue-tracker' "$RETIRED_PACK_TOMBSTONE"; then
  fail "retired pack tombstone acquired a dialect or fixture dependency: $RETIRED_PACK_TOMBSTONE"
fi

while IFS= read -r file; do
  if grep -Eiq 'issue[-_]?tracker|issuetracker|dialect-issue-tracker|app-packs-conformance/issue-tracker' "$file"; then
    fail "L0 production source contains L1 issue-tracker vocabulary: $file"
  fi
done < <(
  find \
    "$REPO_ROOT/backend" \
    "$REPO_ROOT/shared" \
    "$REPO_ROOT/nexuscrm-analytics" \
    "$REPO_ROOT/nexuscrm-audit" \
    "$REPO_ROOT/nexuscrm-auth" \
    "$REPO_ROOT/nexuscrm-automation" \
    "$REPO_ROOT/nexuscrm-db" \
    "$REPO_ROOT/nexuscrm-events" \
    "$REPO_ROOT/nexuscrm-files" \
    "$REPO_ROOT/nexuscrm-kernel" \
    "$REPO_ROOT/nexuscrm-metadata" \
    "$REPO_ROOT/nexuscrm-outbound" \
    "$REPO_ROOT/nexuscrm-permissions" \
    "$REPO_ROOT/nexuscrm-persistence" \
    "$REPO_ROOT/nexuscrm-records" \
    "$REPO_ROOT/nexuscrm-storage" \
    "$REPO_ROOT/nexuscrm-worker" \
    -type f -name '*.go' ! -name '*_test.go' ! -path "$RETIRED_PACK_TOMBSTONE" -print
)

echo "sealed non-CRM conformance fixture boundary: OK"