package runtimegrpc

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	navigationsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/applicationnavigationv1"
	"io"
	"net"
	"reflect"
	"slices"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"github.com/pingcap-inc/nexuscrm-contract/pkg/appauthority"
	catalogsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/catalog/consumerv1"
	applicationresultsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/applicationresultv1"
	approvalnotificationsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/approvalnotificationflowv1"
	approvalsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/approvalv1"
	auditsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/auditlogv1"
	bulkingestsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/bulkingestv1"
	commandsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/commandv1"
	commonsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/commonv1"
	permissionsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/effectivepermissionsv1"
	externaleffectsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/externaleffectv1"
	filessemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/filesv1"
	flowcommandsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/flowcommandv1"
	flowsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/flowv1"
	identitysemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/identityv1"
	layoutauthoringsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/layoutauthoringv1"
	layoutauthoringv2semantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/layoutauthoringv2"
	listviewsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/listviewv1"
	mailboxauthorizationsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/mailboxauthorizationv1"
	metadataadminsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/metadataadminreadv1"
	outboundintentsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/outboundintentv1"
	pagelayoutsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/pagelayoutresolutionv1"
	permissionadminsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionadminv1"
	permissionauthoringsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionauthoringv1"
	accesssemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordaccessv1"
	recordsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordsv1"
	viewsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordviewv1"
	reportsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/reportv1"
	searchsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/searchv1"
	sessionsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/sessionv1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/envelope"
	catalogv1 "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/catalog/v1"
	runtimev1 "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/mapping"
	"google.golang.org/grpc"
	"google.golang.org/grpc/credentials"
	"google.golang.org/grpc/metadata"
)

func TestRuntimePlatformClientBindsSessionAppInstallation(t *testing.T) {
	var createCalls, readCalls, revokeCalls atomic.Uint64
	sessions, err := NewSessionLifecycleClient(
		func(_ context.Context, request *runtimev1.CreateSessionRequest, _ ...grpc.CallOption) (*runtimev1.CreateSessionResponse, error) {
			createCalls.Add(1)
			if request.GetAppInstallationId() != "installation-1" {
				t.Fatalf("create app installation = %q", request.GetAppInstallationId())
			}
			return nil, errors.New("stop after request capture")
		},
		func(_ context.Context, request *runtimev1.ReadSessionRequest, _ ...grpc.CallOption) (*runtimev1.ReadSessionResponse, error) {
			readCalls.Add(1)
			if request.GetAppInstallationId() != "installation-1" {
				t.Fatalf("read app installation = %q", request.GetAppInstallationId())
			}
			return nil, errors.New("stop after request capture")
		},
		func(_ context.Context, request *runtimev1.RevokeSessionRequest, _ ...grpc.CallOption) (*runtimev1.RevokeSessionResponse, error) {
			revokeCalls.Add(1)
			if request.GetAppInstallationId() != "installation-1" {
				t.Fatalf("revoke app installation = %q", request.GetAppInstallationId())
			}
			return nil, errors.New("stop after request capture")
		},
	)
	if err != nil {
		t.Fatal(err)
	}
	client := &RuntimePlatformClient{
		connection: &grpc.ClientConn{}, sessions: sessions,
		appInstallationID: "installation-1", attemptTimeout: time.Second,
	}
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()

	_, _, _ = client.CreateSession(ctx, SessionCreateCredentials{Identity: "user@example.test", Secret: "password"}, sessionsemantic.CreateRequest{
		Method: sessionsemantic.AuthenticationMethodPassword, ApplicationClientID: "client-1",
	})
	_, _, _ = client.ReadSession(ctx, SessionPresentedCredentials{AccessToken: "access-token"}, sessionsemantic.ReadRequest{})
	_ = client.RevokeSession(ctx, SessionPresentedCredentials{AccessToken: "access-token"}, sessionsemantic.RevokeRequest{})
	if createCalls.Load() != 1 || readCalls.Load() != 1 || revokeCalls.Load() != 1 {
		t.Fatalf("session calls create=%d read=%d revoke=%d", createCalls.Load(), readCalls.Load(), revokeCalls.Load())
	}

	for _, call := range []func() error{
		func() error {
			_, _, err := client.CreateSession(ctx, SessionCreateCredentials{Identity: "user@example.test", Secret: "password"}, sessionsemantic.CreateRequest{
				AppInstallationID: "other-installation", Method: sessionsemantic.AuthenticationMethodPassword, ApplicationClientID: "client-1",
			})
			return err
		},
		func() error {
			_, _, err := client.ReadSession(ctx, SessionPresentedCredentials{AccessToken: "access-token"}, sessionsemantic.ReadRequest{AppInstallationID: "other-installation"})
			return err
		},
		func() error {
			return client.RevokeSession(ctx, SessionPresentedCredentials{AccessToken: "access-token"}, sessionsemantic.RevokeRequest{AppInstallationID: "other-installation"})
		},
	} {
		err := call()
		var failure *sessionsemantic.Failure
		if !errors.As(err, &failure) || failure.Category != sessionsemantic.FailureInvalidRequest ||
			failure.InvalidComponent != sessionsemantic.InvalidComponentAppInstallationID {
			t.Fatalf("conflicting app installation = %#v", err)
		}
	}
	if createCalls.Load() != 1 || readCalls.Load() != 1 || revokeCalls.Load() != 1 {
		t.Fatalf("conflicting scope reached session transport: create=%d read=%d revoke=%d", createCalls.Load(), readCalls.Load(), revokeCalls.Load())
	}
}

type platformRuntimeTestServer struct {
	runtimev1.UnimplementedIdentityContextServiceServer
	catalogv1.UnimplementedConsumerViewServiceServer
	catalogv1.UnimplementedAppMetadataViewV3ServiceServer
	runtimev1.UnimplementedRecordSearchServiceServer
	runtimev1.UnimplementedFlowExecutionServiceServer
	runtimev1.UnimplementedReportReadServiceServer
	runtimev1.UnimplementedAuditLogReadServiceServer
	runtimev1.UnimplementedPrivateListViewServiceServer
	runtimev1.UnimplementedMetadataAdminReadServiceServer
	runtimev1.UnimplementedApprovalNotificationFlowReadServiceServer
	runtimev1.UnimplementedConnectedMailboxAuthorizationServiceServer
	runtimev1.UnimplementedAuthorizedFilesServiceServer
	runtimev1.UnimplementedBulkIngestServiceServer
	runtimev1.UnimplementedCommandAcceptanceServiceServer
	runtimev1.UnimplementedApplicationResultServiceServer
	runtimev1.UnimplementedExternalEffectDispatchServiceServer
	runtimev1.UnimplementedOutboundIntentServiceServer
	runtimev1.UnimplementedEffectivePermissionServiceServer
	runtimev1.UnimplementedPermissionAdministrationServiceServer
	runtimev1.UnimplementedPermissionAuthoringServiceServer
	runtimev1.UnimplementedApprovalServiceServer
	runtimev1.UnimplementedPageLayoutResolutionServiceServer

	t                          *testing.T
	identityCalls              atomic.Uint64
	catalogCalls               atomic.Uint64
	searchCalls                atomic.Uint64
	scopeCalls                 atomic.Uint64
	flowCalls                  atomic.Uint64
	flowMu                     sync.Mutex
	flowRequest                flowsemantic.Request
	flowAction                 flowsemantic.CatalogActionRequest
	flowPreview                flowsemantic.CatalogActionPreviewRequest
	flowResponseV2             *flowsemantic.ResponseV2
	reportCalls                atomic.Uint64
	auditLogCalls              atomic.Uint64
	listViewReadCalls          atomic.Uint64
	listViewMutateCalls        atomic.Uint64
	objectAdminIndexCalls      atomic.Uint64
	layoutWorkspaceCalls       atomic.Uint64
	storedLayoutCalls          atomic.Uint64
	validationRuleCalls        atomic.Uint64
	approvalFlowReadCalls      atomic.Uint64
	mailboxAuthorizeCalls      atomic.Uint64
	mailboxReauthorizeCalls    atomic.Uint64
	identityBearerByPolicy     bool
	deleteCalls                atomic.Uint64
	bulkCreateCalls            atomic.Uint64
	bulkReadCalls              atomic.Uint64
	bulkCloseCalls             atomic.Uint64
	bulkUploadCalls            atomic.Uint64
	bulkRejectSecurityOnce     atomic.Bool
	bulkRejectRelease          chan struct{}
	bulkUploadBody             []byte
	commandCalls               atomic.Uint64
	resultCalls                atomic.Uint64
	externalClaimCalls         atomic.Uint64
	externalCompleteCalls      atomic.Uint64
	externalMu                 sync.Mutex
	externalClaim              externaleffectsemantic.ClaimResponse
	outboundGenerationCalls    atomic.Uint64
	outboundListCalls          atomic.Uint64
	outboundAckCalls           atomic.Uint64
	outboundAttachmentCalls    atomic.Uint64
	outboundCommitCalls        atomic.Uint64
	permissionCalls            atomic.Uint64
	permissionAdminReads       atomic.Uint64
	permissionAdminMutates     atomic.Uint64
	permissionSnapshots        atomic.Uint64
	permissionSaves            atomic.Uint64
	permissionStatuses         atomic.Uint64
	permissionWrongTerminal    atomic.Bool
	layoutAuthoringSubmits     atomic.Uint64
	layoutAuthoringStatuses    atomic.Uint64
	layoutRejectSecurityOnce   atomic.Bool
	layoutAuthoringWorkspaces  atomic.Uint64
	layoutAuthoringStoredReads atomic.Uint64
	layoutV2WorkspaceReads     atomic.Uint64
	layoutV2StoredReads        atomic.Uint64
	layoutV2Mutations          atomic.Uint64
	approvalExecCalls          atomic.Uint64
	approvalReadCalls          atomic.Uint64
	pageLayoutCalls            atomic.Uint64
	listFieldsCalls            atomic.Uint64
	identityDelay              atomic.Int64
	identityLease              atomic.Int64
	searchLease                atomic.Int64
	fileCompleted              atomic.Bool
	fileStartOnce              sync.Once
	fileStarted                chan struct{}
	fileCancelOnce             sync.Once
	fileCanceled               chan struct{}
}

func (s *platformRuntimeTestServer) ReadOutboundIntentGeneration(
	ctx context.Context,
	request *runtimev1.ReadOutboundIntentGenerationRequest,
) (*runtimev1.ReadOutboundIntentGenerationResponse, error) {
	s.outboundGenerationCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireReadOutboundIntentGenerationRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	return mapping.ToWireReadOutboundIntentGenerationResponse(
		semanticRequest,
		outboundintentsemantic.GenerationResponse{
			Generation: 7,
			Receipts:   platformRuntimeTestReceipts(outboundintentsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) Exchange(ctx context.Context, request *runtimev1.ExchangeRequest) (*runtimev1.ExchangeResponse, error) {
	s.identityCalls.Add(1)
	s.requireWorkload(ctx)
	values, _ := metadata.FromIncomingContext(ctx)
	if got := values.Get(envelope.RuntimeDelegationMetadataKey); len(got) != 0 {
		s.t.Fatalf("Identity inherited delegation = %#v", got)
	}
	if s.identityBearerByPolicy {
		if bearer, ok := EndUserBearer(ctx); !ok || bearer != "user-secret" {
			s.t.Fatalf("Identity policy bearer = %q, %t", bearer, ok)
		}
		if got := values.Get(EndUserAuthorizationMetadataKey); len(got) != 0 {
			s.t.Fatalf("Identity retained bearer metadata = %#v", got)
		}
	} else if got := values.Get(EndUserAuthorizationMetadataKey); len(got) != 1 || got[0] != "Bearer user-secret" {
		s.t.Fatalf("Identity bearer metadata = %#v", got)
	}
	if deadline, ok := ctx.Deadline(); ok {
		s.identityLease.Store(int64(time.Until(deadline)))
	}
	if delay := time.Duration(s.identityDelay.Load()); delay > 0 {
		time.Sleep(delay)
	}
	semanticRequest, err := mapping.FromWireIdentityExchangeRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToIdentityStatusError(err)
	}
	flowClosure := len(semanticRequest.RequestedCapabilities) == 2 &&
		(semanticRequest.RequestedCapabilities[0] == catalogsemantic.AppMetadataV2CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == catalogsemantic.AppMetadataV3CapabilityName) &&
		semanticRequest.RequestedCapabilities[1] == flowsemantic.CapabilityName
	singleCapability := len(semanticRequest.RequestedCapabilities) == 1 &&
		(semanticRequest.RequestedCapabilities[0] == searchsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == approvalnotificationsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == listviewsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == metadataadminsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == reportsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == auditsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == mailboxauthorizationsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == filessemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == bulkingestsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == permissionsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == permissionadminsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == permissionauthoringsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == layoutauthoringsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == layoutauthoringv2semantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == navigationsemantic.CapabilityName ||
			semanticRequest.RequestedCapabilities[0] == approvalsemantic.ExecuteCapabilityName ||
			semanticRequest.RequestedCapabilities[0] == approvalsemantic.ReadCapabilityName ||
			semanticRequest.RequestedCapabilities[0] == pagelayoutsemantic.CapabilityName)
	recordUIClosure := slices.Equal(semanticRequest.RequestedCapabilities, []string{
		permissionsemantic.CapabilityName,
		accesssemantic.CapabilityName,
		viewsemantic.CapabilityName,
	})
	if !flowClosure && !singleCapability && !recordUIClosure {
		s.t.Fatalf("Identity capabilities = %#v", semanticRequest.RequestedCapabilities)
	}
	return mapping.ToWireIdentityExchangeResponse(identitysemantic.Response{
		OpaqueDelegation:    "header.payload.signature",
		ExpiresAtUnixSecond: time.Now().Add(time.Minute).Unix(),
	})
}

func TestPlatformRuntimeAuthorizesOneRequestScopedCapabilityUnion(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	authorized, err := client.AuthorizeCapabilities(ctx, "user-secret", []string{
		permissionsemantic.CapabilityName,
		accesssemantic.CapabilityName,
		viewsemantic.CapabilityName,
	})
	if err != nil {
		t.Fatal(err)
	}
	response, err := client.ReadEffectivePermissions(
		authorized, "must-not-be-exchanged-again", permissionsemantic.Request{TargetPrincipalID: "user-2"},
	)
	if err != nil || len(response.ObjectPermissions) != 1 {
		t.Fatalf("response=%#v err=%v", response, err)
	}
	if server.identityCalls.Load() != 1 || server.permissionCalls.Load() != 1 {
		t.Fatalf("identity/permission calls = %d/%d, want 1/1", server.identityCalls.Load(), server.permissionCalls.Load())
	}
}

func (s *platformRuntimeTestServer) GetAppMetadataView(
	ctx context.Context,
	request *catalogv1.GetAppMetadataViewRequest,
) (*catalogv1.GetAppMetadataViewResponse, error) {
	s.catalogCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	if _, err := mapping.FromWireCatalogGetRequest(ctx, request); err != nil {
		return nil, mapping.ToPlatformStatusError(err, catalogsemantic.AppMetadataCapabilityName)
	}
	return mapping.ToWireGetAppMetadataViewResponse(platformRuntimeTestAppView(s.t))
}

func (s *platformRuntimeTestServer) WatchAppMetadataView(
	request *catalogv1.WatchAppMetadataViewRequest,
	stream grpc.ServerStreamingServer[catalogv1.WatchAppMetadataViewResponse],
) error {
	s.requireWorkloadOnly(stream.Context())
	if _, err := mapping.FromWireAppMetadataWatchRequest(stream.Context(), request); err != nil {
		return mapping.ToPlatformStatusError(err, catalogsemantic.AppMetadataCapabilityName)
	}
	response, err := mapping.ToWireWatchAppMetadataViewResponse(platformRuntimeTestAppView(s.t))
	if err != nil {
		return err
	}
	if err := stream.Send(response); err != nil {
		return err
	}
	return stream.Send(response)
}

func (s *platformRuntimeTestServer) GetAppMetadataViewV2(
	ctx context.Context,
	request *catalogv1.GetAppMetadataViewV2Request,
) (*catalogv1.GetAppMetadataViewV2Response, error) {
	s.catalogCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	if _, err := mapping.FromWireCatalogGetV2Request(ctx, request); err != nil {
		return nil, mapping.ToPlatformStatusError(
			err,
			catalogsemantic.AppMetadataV2CapabilityName,
		)
	}
	return mapping.ToWireGetAppMetadataViewV2Response(
		platformRuntimeTestAppViewV2(s.t),
	)
}

func (s *platformRuntimeTestServer) WatchAppMetadataViewV2(
	request *catalogv1.WatchAppMetadataViewV2Request,
	stream grpc.ServerStreamingServer[catalogv1.WatchAppMetadataViewV2Response],
) error {
	s.requireWorkloadOnly(stream.Context())
	if _, err := mapping.FromWireAppMetadataV2WatchRequest(
		stream.Context(),
		request,
	); err != nil {
		return mapping.ToPlatformStatusError(
			err,
			catalogsemantic.AppMetadataV2CapabilityName,
		)
	}
	response, err := mapping.ToWireWatchAppMetadataViewV2Response(
		platformRuntimeTestAppViewV2(s.t),
	)
	if err != nil {
		return err
	}
	if err := stream.Send(response); err != nil {
		return err
	}
	return stream.Send(response)
}

func (s *platformRuntimeTestServer) GetIntegrationBindingView(
	ctx context.Context,
	request *catalogv1.GetIntegrationBindingViewRequest,
) (*catalogv1.GetIntegrationBindingViewResponse, error) {
	s.catalogCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	if _, err := mapping.FromWireIntegrationBindingGetRequest(ctx, request); err != nil {
		return nil, mapping.ToPlatformStatusError(err, catalogsemantic.IntegrationBindingCapabilityName)
	}
	return mapping.ToWireGetIntegrationBindingViewResponse(platformRuntimeTestIntegrationView())
}

func (s *platformRuntimeTestServer) WatchIntegrationBindingView(
	request *catalogv1.WatchIntegrationBindingViewRequest,
	stream grpc.ServerStreamingServer[catalogv1.WatchIntegrationBindingViewResponse],
) error {
	s.requireWorkloadOnly(stream.Context())
	if _, err := mapping.FromWireIntegrationBindingWatchRequest(stream.Context(), request); err != nil {
		return mapping.ToPlatformStatusError(err, catalogsemantic.IntegrationBindingCapabilityName)
	}
	response, err := mapping.ToWireWatchIntegrationBindingViewResponse(platformRuntimeTestIntegrationView())
	if err != nil {
		return err
	}
	if err := stream.Send(response); err != nil {
		return err
	}
	return stream.Send(response)
}

func (s *platformRuntimeTestServer) SearchRecords(
	ctx context.Context,
	request *runtimev1.SearchRecordsRequest,
) (*runtimev1.SearchRecordsResponse, error) {
	s.searchCalls.Add(1)
	s.requireWorkload(ctx)
	values, _ := metadata.FromIncomingContext(ctx)
	if got := values.Get(envelope.RuntimeDelegationMetadataKey); len(got) != 1 || got[0] != "header.payload.signature" {
		s.t.Fatalf("Search delegation = %#v", got)
	}
	if got := values.Get(EndUserAuthorizationMetadataKey); len(got) != 0 {
		s.t.Fatalf("Search inherited end-user bearer = %#v", got)
	}
	if deadline, ok := ctx.Deadline(); ok {
		s.searchLease.Store(int64(time.Until(deadline)))
	}
	semanticRequest, err := mapping.FromWireSearchRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, searchsemantic.CapabilityName)
	}
	id := "record-1"
	return mapping.ToWireSearchResponse(semanticRequest, searchsemantic.Response{
		Records: []searchsemantic.Record{{
			ObjectID: semanticRequest.ObjectIDs[0], RecordID: id,
			Fields: []recordsemantic.Field{{
				Name: "Id", Kind: recordsemantic.ValueKindReference, Reference: &id,
			}},
		}},
		Receipts: platformRuntimeTestReceipts(searchsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadSearchScopeOrder(
	ctx context.Context,
	request *runtimev1.ReadSearchScopeOrderRequest,
) (*runtimev1.ReadSearchScopeOrderResponse, error) {
	s.scopeCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireSearchScopeOrderRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(
			err, searchsemantic.CapabilityName,
		)
	}
	return mapping.ToWireSearchScopeOrderResponse(
		semanticRequest,
		searchsemantic.ScopeOrderResponse{
			ObjectIDs: []string{semanticRequest.ObjectIDs[len(semanticRequest.ObjectIDs)-1]},
			Receipts:  platformRuntimeTestReceipts(searchsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ReadPrivateListViews(ctx context.Context, request *runtimev1.ReadPrivateListViewsRequest) (*runtimev1.ReadPrivateListViewsResponse, error) {
	s.listViewReadCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadPrivateListViewsRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, listviewsemantic.CapabilityName)
	}
	return mapping.ToWireReadPrivateListViewsResponse(semanticRequest, listviewsemantic.ReadResponse{
		Views: []listviewsemantic.View{{
			ViewID: "view-1", ObjectID: semanticRequest.ObjectID, Label: "My Issues",
			FieldIDs: []string{"Id"}, StableName: "My_Issues",
		}},
		Receipts: platformRuntimeTestReceipts(listviewsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) MutatePrivateListView(ctx context.Context, request *runtimev1.MutatePrivateListViewRequest) (*runtimev1.MutatePrivateListViewResponse, error) {
	s.listViewMutateCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireMutatePrivateListViewRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, listviewsemantic.CapabilityName)
	}
	label, stableName := "My Issues", "My_Issues"
	if semanticRequest.Patch != nil {
		if semanticRequest.Patch.Label != nil {
			label = *semanticRequest.Patch.Label
		}
		if semanticRequest.Patch.StableName != nil {
			stableName = *semanticRequest.Patch.StableName
		}
	}
	response := listviewsemantic.MutateResponse{Receipts: platformRuntimeTestReceipts(listviewsemantic.CapabilityName)}
	if semanticRequest.Operation != listviewsemantic.MutationDelete {
		viewID := semanticRequest.ViewID
		if viewID == "" {
			viewID = "view-1"
		}
		response.View = &listviewsemantic.View{
			ViewID: viewID, ObjectID: semanticRequest.ObjectID, Label: label,
			FieldIDs: []string{"Id"}, StableName: stableName,
		}
	}
	return mapping.ToWireMutatePrivateListViewResponse(semanticRequest, response)
}

func (s *platformRuntimeTestServer) ReadObjectAdminIndex(
	ctx context.Context,
	request *runtimev1.ReadObjectAdminIndexRequest,
) (*runtimev1.ReadObjectAdminIndexResponse, error) {
	s.objectAdminIndexCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadObjectAdminIndexRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, metadataadminsemantic.CapabilityName)
	}
	description := "Customer accounts"
	return mapping.ToWireReadObjectAdminIndexResponse(
		semanticRequest,
		metadataadminsemantic.ObjectAdminIndexResponse{
			Objects: []metadataadminsemantic.ObjectAdminMetadata{{
				ObjectID: "Account", Description: &description, DeleteMode: "soft",
			}},
			Receipts: platformRuntimeTestReceipts(metadataadminsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ReadLayoutAdminWorkspace(
	ctx context.Context,
	request *runtimev1.ReadLayoutAdminWorkspaceRequest,
) (*runtimev1.ReadLayoutAdminWorkspaceResponse, error) {
	s.layoutWorkspaceCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadLayoutAdminWorkspaceRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, metadataadminsemantic.CapabilityName)
	}
	return mapping.ToWireReadLayoutAdminWorkspaceResponse(
		semanticRequest,
		metadataadminsemantic.LayoutAdminWorkspaceResponse{
			ObjectID: semanticRequest.ObjectID,
			Layouts: []metadataadminsemantic.LayoutSummary{{
				LayoutID: "layout-1", ObjectID: semanticRequest.ObjectID,
				Name: "Account Layout", Type: "record", IsDefault: true,
			}},
			Assignments: []metadataadminsemantic.LayoutAssignment{{
				AssignmentID: "assignment-1", ObjectID: semanticRequest.ObjectID,
				LayoutID: "layout-1",
			}},
			Receipts: platformRuntimeTestReceipts(metadataadminsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ReadStoredLayout(
	ctx context.Context,
	request *runtimev1.ReadStoredLayoutRequest,
) (*runtimev1.ReadStoredLayoutResponse, error) {
	s.storedLayoutCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadStoredLayoutRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, metadataadminsemantic.CapabilityName)
	}
	return mapping.ToWireReadStoredLayoutResponse(
		semanticRequest,
		metadataadminsemantic.StoredLayoutResponse{
			LayoutID: semanticRequest.LayoutID, ObjectID: "Account",
			StoredDocument: []byte(`{"id":"layout-1","objectApiName":"Account","sections":[]}`),
			Receipts:       platformRuntimeTestReceipts(metadataadminsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ReadValidationRuleAdminIndex(
	ctx context.Context,
	request *runtimev1.ReadValidationRuleAdminIndexRequest,
) (*runtimev1.ReadValidationRuleAdminIndexResponse, error) {
	s.validationRuleCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadValidationRuleAdminIndexRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, metadataadminsemantic.CapabilityName)
	}
	return mapping.ToWireReadValidationRuleAdminIndexResponse(
		semanticRequest,
		metadataadminsemantic.ValidationRuleAdminIndexResponse{
			ObjectID: semanticRequest.ObjectID,
			Rules: []metadataadminsemantic.ValidationRuleMetadata{{
				RuleID: "rule-1", ObjectID: semanticRequest.ObjectID, Name: "RequiredName",
				Active: true, Condition: "ISBLANK(Name)", ErrorMessage: "Name is required",
			}},
			Receipts: platformRuntimeTestReceipts(metadataadminsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ReadApprovalNotificationFlows(
	ctx context.Context,
	request *runtimev1.ReadApprovalNotificationFlowsRequest,
) (*runtimev1.ReadApprovalNotificationFlowsResponse, error) {
	s.approvalFlowReadCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadApprovalNotificationFlowsRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, approvalnotificationsemantic.CapabilityName)
	}
	return mapping.ToWireReadApprovalNotificationFlowsResponse(
		semanticRequest,
		approvalnotificationsemantic.Response{
			Flows: []approvalnotificationsemantic.FlowDescriptor{{
				Name: "Notify_Approver", Label: "Notify Approver", Description: "Sends the notification.",
			}},
			Receipts: platformRuntimeTestReceipts(approvalnotificationsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ResolvePageLayout(
	ctx context.Context,
	request *runtimev1.ResolvePageLayoutRequest,
) (*runtimev1.ResolvePageLayoutResponse, error) {
	s.pageLayoutCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireResolvePageLayoutRequest(ctx, request)
	if err != nil {
		return nil, err
	}
	document := []byte(`{"id":"layout-enterprise","objectApiName":"Opportunity","layoutName":"Enterprise","sections":[],"relatedLists":[],"headerActions":[],"quickActions":[]}`)
	selections := []pagelayoutsemantic.Selection{{LayoutID: "layout-enterprise"}}
	if len(semanticRequest.RecordTypeIDs) != 0 {
		selections = make([]pagelayoutsemantic.Selection, 0, len(semanticRequest.RecordTypeIDs))
		for index := range semanticRequest.RecordTypeIDs {
			recordTypeID := semanticRequest.RecordTypeIDs[index]
			selections = append(selections, pagelayoutsemantic.Selection{
				RecordTypeID: &recordTypeID, LayoutID: "layout-enterprise",
			})
		}
	}
	return mapping.ToWireResolvePageLayoutResponse(semanticRequest, pagelayoutsemantic.Response{
		ObjectID: semanticRequest.ObjectID, Selections: selections,
		Layouts: []pagelayoutsemantic.ResolvedLayout{{
			LayoutID: "layout-enterprise", DocumentKind: pagelayoutsemantic.PageLayoutDocumentKind,
			DocumentFormatVersion: pagelayoutsemantic.PageLayoutDocumentFormatVersion,
			LayoutDocument:        document,
		}},
		Receipts: platformRuntimeTestReceipts(pagelayoutsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadObjectListFields(
	ctx context.Context,
	request *runtimev1.ReadObjectListFieldsRequest,
) (*runtimev1.ReadObjectListFieldsResponse, error) {
	s.listFieldsCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadObjectListFieldsRequest(ctx, request)
	if err != nil {
		return nil, err
	}
	objects := make([]pagelayoutsemantic.ObjectListFields, 0, len(semanticRequest.ObjectIDs))
	for _, objectID := range semanticRequest.ObjectIDs {
		fields := []string{}
		if objectID == "Account" {
			fields = []string{"Name", "OwnerId"}
		}
		objects = append(objects, pagelayoutsemantic.ObjectListFields{
			ObjectID: objectID, OrderedFieldIDs: fields,
		})
	}
	return mapping.ToWireReadObjectListFieldsResponse(
		semanticRequest,
		pagelayoutsemantic.ObjectListFieldsResponse{
			Objects:  objects,
			Receipts: platformRuntimeTestReceipts(pagelayoutsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ExecuteFlow(
	ctx context.Context,
	request *runtimev1.ExecuteFlowRequest,
) (*runtimev1.ExecuteFlowResponse, error) {
	s.flowCalls.Add(1)
	s.requireDelegation(ctx)
	if request.GetCatalogAction() != nil {
		semanticRequest, err := mapping.FromWireExecuteCatalogActionRequest(ctx, request)
		if err != nil {
			return nil, mapping.ToPlatformStatusError(err, flowsemantic.CapabilityName)
		}
		s.flowMu.Lock()
		s.flowAction = semanticRequest
		s.flowMu.Unlock()
	} else {
		semanticRequest, err := mapping.FromWireExecuteFlowRequest(ctx, request)
		if err != nil {
			return nil, mapping.ToPlatformStatusError(err, flowsemantic.CapabilityName)
		}
		s.flowMu.Lock()
		s.flowRequest = semanticRequest
		s.flowMu.Unlock()
	}
	s.flowMu.Lock()
	flowResponseV2 := s.flowResponseV2
	s.flowMu.Unlock()
	if flowResponseV2 != nil {
		return mapping.ToWireExecuteFlowResponseV2(*flowResponseV2)
	}
	return mapping.ToWireExecuteFlowResponse(flowsemantic.Response{
		ExecutionID: "execution-1", CanonicalOutputs: []byte(`{}`),
		Receipts: platformRuntimeTestReceipts(flowsemantic.CapabilityName),
	})
}

func TestPlatformRuntimeFlowV2PreservesApprovedCallerVisibleErrors(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	expected := flowsemantic.ResponseV2{
		ExecutionID: "execution-errors-1",
		Errors: []flowsemantic.ExecutionError{
			{Code: "POLICY_VALIDATION_ERROR", Message: "Correct RequestedValue before retrying.", Fields: []string{"RequestedValue"}},
			{Code: "RELATED_VALUE_REJECTED", Message: "Correct RelatedValue before retrying.", Fields: []string{"RelatedValue"}},
		},
		Receipts: platformRuntimeTestReceipts(flowsemantic.CapabilityName),
	}
	server.flowMu.Lock()
	server.flowResponseV2 = &expected
	server.flowMu.Unlock()

	flow, err := client.ExecuteFlowV2WithAppMetadataV3(ctx, "user-secret", flowsemantic.Request{
		DefinitionRef: "flow-1", DefinitionVersion: "1", IdempotencyKey: "flow-v2-attempt-1",
		CanonicalInputs: []byte(`{}`),
	})
	if err != nil || len(flow.Errors) != 2 || flow.Errors[0].Code != expected.Errors[0].Code ||
		flow.Errors[1].Message != expected.Errors[1].Message || flow.Errors[1].Fields[0] != "RelatedValue" {
		t.Fatalf("Flow V2 response = %#v, %v", flow, err)
	}

	action, err := client.ExecuteCatalogActionV2WithAppMetadataV3(ctx, "user-secret", flowsemantic.CatalogActionRequest{
		IdempotencyKey: "action-v2-attempt-1", CanonicalInputs: []byte(`{}`),
		CatalogAction: flowsemantic.CatalogActionBinding{
			ComponentRef: "component-sha256-v1:action-component", ActionRef: "action-1",
		},
	})
	if err != nil || len(action.Errors) != 2 || action.Errors[0].Fields[0] != "RequestedValue" {
		t.Fatalf("Catalog action V2 response = %#v, %v", action, err)
	}

	flow, err = client.ExecuteFlowV2(ctx, "user-secret", flowsemantic.Request{
		DefinitionRef: "flow-1", DefinitionVersion: "1", IdempotencyKey: "flow-v2-metadata-v2-attempt-1",
		CanonicalInputs: []byte(`{}`),
	})
	if err != nil || len(flow.Errors) != 2 || flow.Errors[0].Code != expected.Errors[0].Code {
		t.Fatalf("Flow V2 with metadata V2 authority = %#v, %v", flow, err)
	}

	action, err = client.ExecuteCatalogActionV2(ctx, "user-secret", flowsemantic.CatalogActionRequest{
		IdempotencyKey: "action-v2-metadata-v2-attempt-1", CanonicalInputs: []byte(`{}`),
		CatalogAction: flowsemantic.CatalogActionBinding{
			ComponentRef: "component-sha256-v1:action-component", ActionRef: "action-1",
		},
	})
	if err != nil || len(action.Errors) != 2 || action.Errors[1].Code != expected.Errors[1].Code {
		t.Fatalf("Catalog action V2 with metadata V2 authority = %#v, %v", action, err)
	}
}

func (s *platformRuntimeTestServer) PreviewCatalogAction(
	ctx context.Context,
	request *runtimev1.PreviewCatalogActionRequest,
) (*runtimev1.PreviewCatalogActionResponse, error) {
	s.flowCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWirePreviewCatalogActionRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, flowsemantic.CapabilityName)
	}
	s.flowMu.Lock()
	s.flowPreview = semanticRequest
	s.flowMu.Unlock()
	return mapping.ToWirePreviewCatalogActionResponse(
		semanticRequest,
		flowsemantic.CatalogActionPreviewResponse{
			CanonicalResult: []byte(`{"isSuccess":true}`),
			Receipts:        platformRuntimeTestReceipts(flowsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) ReadReport(
	ctx context.Context,
	request *runtimev1.ReadReportRequest,
) (*runtimev1.ReadReportResponse, error) {
	s.reportCalls.Add(1)
	s.requireDelegation(ctx)
	if _, err := mapping.FromWireReadReportRequest(ctx, request); err != nil {
		return nil, mapping.ToPlatformStatusError(err, reportsemantic.CapabilityName)
	}
	return mapping.ToWireReadReportResponse(reportsemantic.Response{
		CanonicalResult: []byte(`[]`),
		Receipts:        platformRuntimeTestReceipts(reportsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadAuditLog(
	ctx context.Context,
	request *runtimev1.ReadAuditLogRequest,
) (*runtimev1.ReadAuditLogResponse, error) {
	s.auditLogCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadAuditLogRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, auditsemantic.CapabilityName)
	}
	return mapping.ToWireReadAuditLogResponse(semanticRequest, auditsemantic.Response{
		Rows: []auditsemantic.Row{{
			ID: "audit-1", ObjectID: semanticRequest.ObjectID, RecordID: semanticRequest.RecordID,
			FieldID: "Name", ChangedByID: "user-1", ChangedAt: "2026-08-14T12:00:00Z",
		}},
		Receipts: platformRuntimeTestReceipts(auditsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ExecuteApproval(
	ctx context.Context,
	request *runtimev1.ExecuteApprovalRequest,
) (*runtimev1.ExecuteApprovalResponse, error) {
	s.approvalExecCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireExecuteApprovalRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, approvalsemantic.ExecuteCapabilityName)
	}
	return mapping.ToWireExecuteApprovalResponse(
		semanticRequest,
		approvalsemantic.ExecuteResponse{
			ExecutionID: "approval-execution-1", InstanceID: "approval-instance-1",
			TargetRecordID: semanticRequest.TargetRecordID,
			State:          approvalsemantic.InstanceStatePending,
			PendingWorkItems: []approvalsemantic.WorkItemAssignment{{
				WorkItemID: "approval-work-1", ActorID: "user-2",
			}},
			ActionFailures: []approvalsemantic.ActionFailure{},
			Receipts: platformRuntimeTestReceipts(
				approvalsemantic.ExecuteCapabilityName,
			),
		},
	)
}

func (s *platformRuntimeTestServer) ReadApproval(
	ctx context.Context,
	request *runtimev1.ReadApprovalRequest,
) (*runtimev1.ReadApprovalResponse, error) {
	s.approvalReadCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadApprovalRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, approvalsemantic.ReadCapabilityName)
	}
	return mapping.ToWireReadApprovalResponse(
		semanticRequest,
		approvalsemantic.ReadResponse{
			Pending: []approvalsemantic.PendingItem{},
			Steps:   []approvalsemantic.StepDisplay{},
			Receipts: platformRuntimeTestReceipts(
				approvalsemantic.ReadCapabilityName,
			),
		},
	)
}

func (s *platformRuntimeTestServer) CreateFile(
	stream grpc.ClientStreamingServer[runtimev1.CreateFileRequest, runtimev1.CreateFileResponse],
) error {
	s.requireWorkload(stream.Context())
	state, err := filessemantic.NewCreateStreamState(stream.Context())
	if err != nil {
		return mapping.ToPlatformStatusError(err, filessemantic.CapabilityName)
	}
	for {
		request, recvErr := stream.Recv()
		if errors.Is(recvErr, io.EOF) {
			if err := state.Complete(); err != nil {
				return mapping.ToPlatformStatusError(err, filessemantic.CapabilityName)
			}
			s.fileCompleted.Store(true)
			response, err := mapping.ToWireCreateFileResponse(filessemantic.CreateResponse{
				FileID: "file-1", FileName: "file.txt", ContentType: "text/plain", Size: 1,
				Receipts: platformRuntimeTestReceipts(filessemantic.CapabilityName),
			})
			if err != nil {
				return err
			}
			return stream.SendAndClose(response)
		}
		if recvErr != nil {
			if stream.Context().Err() != nil {
				s.fileCancelOnce.Do(func() { close(s.fileCanceled) })
			}
			return recvErr
		}
		chunk, err := mapping.FromWireCreateFileChunk(request)
		if err != nil {
			return mapping.ToPlatformStatusError(err, filessemantic.CapabilityName)
		}
		if err := state.Observe(chunk); err != nil {
			return mapping.ToPlatformStatusError(err, filessemantic.CapabilityName)
		}
		s.fileStartOnce.Do(func() { close(s.fileStarted) })
	}
}

func (s *platformRuntimeTestServer) OpenFile(
	request *runtimev1.OpenFileRequest,
	stream grpc.ServerStreamingServer[runtimev1.OpenFileResponse],
) error {
	s.requireWorkload(stream.Context())
	if _, err := mapping.FromWireOpenFileRequest(stream.Context(), request); err != nil {
		return mapping.ToPlatformStatusError(err, filessemantic.CapabilityName)
	}
	receipts := platformRuntimeTestReceipts(filessemantic.CapabilityName)
	response, err := mapping.ToWireOpenFileChunk(filessemantic.OpenChunk{
		FileName: "file.txt", ContentType: "text/plain", TotalSize: 2, Data: []byte("a"),
		Receipts: &receipts,
	})
	if err != nil {
		return err
	}
	return stream.Send(response)
}

func (s *platformRuntimeTestServer) DeleteFile(
	ctx context.Context,
	request *runtimev1.DeleteFileRequest,
) (*runtimev1.DeleteFileResponse, error) {
	s.deleteCalls.Add(1)
	s.requireDelegation(ctx)
	if _, err := mapping.FromWireDeleteFileRequest(ctx, request); err != nil {
		return nil, mapping.ToPlatformStatusError(err, filessemantic.CapabilityName)
	}
	return mapping.ToWireDeleteFileResponse(filessemantic.DeleteResponse{
		Receipts: platformRuntimeTestReceipts(filessemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) CreateBulkIngestJob(ctx context.Context, request *runtimev1.CreateBulkIngestJobRequest) (*runtimev1.CreateBulkIngestJobResponse, error) {
	s.bulkCreateCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireCreateBulkIngestJobRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
	}
	job := bulkRuntimeTestJob(semanticRequest.ObjectID, semanticRequest.Operation, bulkingestsemantic.StateOpen)
	job.ExternalIDFieldName = semanticRequest.ExternalIDFieldName
	return mapping.ToWireCreateBulkIngestJobResponse(semanticRequest, bulkingestsemantic.CreateResponse{
		Job:      job,
		Receipts: platformRuntimeTestReceipts(bulkingestsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadBulkIngestJob(ctx context.Context, request *runtimev1.ReadBulkIngestJobRequest) (*runtimev1.ReadBulkIngestJobResponse, error) {
	s.bulkReadCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadBulkIngestJobRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
	}
	return mapping.ToWireReadBulkIngestJobResponse(semanticRequest, bulkingestsemantic.ReadResponse{
		Job:      bulkRuntimeTestJob("Account", bulkingestsemantic.OperationInsert, bulkingestsemantic.StateOpen),
		Receipts: platformRuntimeTestReceipts(bulkingestsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) CloseBulkIngestJob(ctx context.Context, request *runtimev1.CloseBulkIngestJobRequest) (*runtimev1.CloseBulkIngestJobResponse, error) {
	s.bulkCloseCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireCloseBulkIngestJobRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
	}
	return mapping.ToWireCloseBulkIngestJobResponse(semanticRequest, bulkingestsemantic.CloseResponse{
		Job:      bulkRuntimeTestJob("Account", bulkingestsemantic.OperationInsert, semanticRequest.State),
		Receipts: platformRuntimeTestReceipts(bulkingestsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) UploadBulkIngestData(stream grpc.ClientStreamingServer[runtimev1.UploadBulkIngestDataRequest, runtimev1.UploadBulkIngestDataResponse]) error {
	s.bulkUploadCalls.Add(1)
	if s.bulkRejectSecurityOnce.Swap(false) {
		select {
		case <-s.bulkRejectRelease:
		case <-stream.Context().Done():
			return stream.Context().Err()
		}
		return mapping.ToPlatformStatusError(&commonsemantic.Failure{Category: commonsemantic.FailureStaleState, StaleAxis: commonsemantic.StaleAxisSecurity, RequiredRevision: 2, ServedRevision: 1}, bulkingestsemantic.CapabilityName)
	}
	s.requireDelegation(stream.Context())
	state, err := bulkingestsemantic.NewUploadStreamState(stream.Context())
	if err != nil {
		return mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
	}
	s.bulkUploadBody = nil
	var header *bulkingestsemantic.UploadHeader
	for {
		wireChunk, recvErr := stream.Recv()
		if recvErr == io.EOF {
			if err := state.Complete(); err != nil {
				return mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
			}
			if header == nil {
				return errors.New("bulk upload header was not received")
			}
			response, err := mapping.ToWireUploadBulkIngestResponse(*header, bulkingestsemantic.UploadResponse{JobID: header.JobID, Receipts: platformRuntimeTestReceipts(bulkingestsemantic.CapabilityName)})
			if err != nil {
				return err
			}
			return stream.SendAndClose(response)
		}
		if recvErr != nil {
			return recvErr
		}
		chunk, err := mapping.FromWireUploadBulkIngestChunk(wireChunk)
		if err != nil {
			return mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
		}
		if err := state.Observe(chunk); err != nil {
			return mapping.ToPlatformStatusError(err, bulkingestsemantic.CapabilityName)
		}
		if chunk.Header != nil {
			copy := *chunk.Header
			header = &copy
		}
		s.bulkUploadBody = append(s.bulkUploadBody, chunk.Data...)
	}
}

func bulkRuntimeTestJob(objectID string, operation bulkingestsemantic.Operation, state bulkingestsemantic.State) bulkingestsemantic.Job {
	return bulkingestsemantic.Job{
		ID: "job-1", ObjectID: objectID, Operation: operation, State: state,
		CreatedByID: "user-1", CreatedAt: "2026-08-27T10:00:00Z", ModifiedAt: "2026-08-27T10:00:00Z",
	}
}

func (s *platformRuntimeTestServer) AcceptCommand(
	ctx context.Context,
	request *runtimev1.AcceptCommandRequest,
) (*runtimev1.AcceptCommandResponse, error) {
	s.commandCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireAcceptCommandRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, commandsemantic.CapabilityName)
	}
	return mapping.ToWireAcceptCommandResponse(semanticRequest, commandsemantic.Response{
		CommandID: semanticRequest.CommandID,
		Receipts:  platformRuntimeTestReceipts(commandsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) GetApplicationResult(
	ctx context.Context,
	request *runtimev1.GetApplicationResultRequest,
) (*runtimev1.GetApplicationResultResponse, error) {
	s.resultCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireGetApplicationResultRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, applicationresultsemantic.CapabilityName)
	}
	result := applicationresultsemantic.ApplicationResult{
		CommandID:          semanticRequest.CommandID,
		ExecutionRefDigest: semanticRequest.ExecutionRefDigest,
		Outcome:            applicationresultsemantic.OutcomeApplied,
		ResultDigest:       "sha256:" + strings.Repeat("b", 64),
	}
	result.RuntimeCommitReceipt, err = applicationresultsemantic.ComputeRuntimeCommitReceipt(result)
	if err != nil {
		s.t.Fatal(err)
	}
	return mapping.ToWireGetApplicationResultResponse(
		semanticRequest,
		applicationresultsemantic.GetResultResponse{
			CommandID: semanticRequest.CommandID, ExecutionRefDigest: semanticRequest.ExecutionRefDigest,
			State: applicationresultsemantic.ResultTerminal, Result: &result,
		},
	)
}

func (s *platformRuntimeTestServer) ClaimExternalEffects(
	ctx context.Context,
	request *runtimev1.ClaimExternalEffectsRequest,
) (*runtimev1.ClaimExternalEffectsResponse, error) {
	s.externalClaimCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireClaimExternalEffectsRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, externaleffectsemantic.CapabilityName)
	}
	operation := externaleffectsemantic.Operation{
		OperationID: "primary", Method: "POST", RelativePath: "/objects/contacts",
		Headers: []externaleffectsemantic.Header{{Name: "content-type", Values: []string{"application/json"}}},
		Body:    []byte(`{"properties":{"name":"Ada"}}`), CredentialRef: "provider-main",
		EndpointClass: "objects.write",
		RetryPolicy:   externaleffectsemantic.RetryPolicy{MaxAttempts: 1},
	}
	operation.RequestDigest = externaleffectsemantic.ComputeRequestDigest(operation)
	response := externaleffectsemantic.ClaimResponse{
		Effects: []externaleffectsemantic.Effect{{
			EffectID: "effect-1", ClaimToken: "claim-1",
			LeaseExpiresAtUnixMillis: time.Now().Add(time.Minute).UnixMilli(),
			Operations:               []externaleffectsemantic.Operation{operation},
		}},
		Receipts: platformRuntimeTestReceipts(externaleffectsemantic.CapabilityName),
	}
	s.externalMu.Lock()
	s.externalClaim = response
	s.externalMu.Unlock()
	return mapping.ToWireClaimExternalEffectsResponse(semanticRequest, response)
}

func (s *platformRuntimeTestServer) CompleteExternalEffect(
	ctx context.Context,
	request *runtimev1.CompleteExternalEffectRequest,
) (*runtimev1.CompleteExternalEffectResponse, error) {
	s.externalCompleteCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireCompleteExternalEffectRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, externaleffectsemantic.CapabilityName)
	}
	s.externalMu.Lock()
	claim := s.externalClaim
	s.externalMu.Unlock()
	if err := externaleffectsemantic.ValidateCompleteRequestForClaim(ctx, claim, semanticRequest); err != nil {
		return nil, mapping.ToPlatformStatusError(err, externaleffectsemantic.CapabilityName)
	}
	return mapping.ToWireCompleteExternalEffectResponse(semanticRequest, externaleffectsemantic.CompleteResponse{
		EffectID: semanticRequest.EffectID, State: externaleffectsemantic.CompletionFinalized,
		Receipts: platformRuntimeTestReceipts(externaleffectsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ListPendingOutboundIntents(
	ctx context.Context,
	request *runtimev1.ListPendingOutboundIntentsRequest,
) (*runtimev1.ListPendingOutboundIntentsResponse, error) {
	s.outboundListCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireListPendingOutboundIntentsRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	payload := []byte(`{"version":1,"mappedFields":{"Name":"Ada"},"targetObject":"contacts"}`)
	sum := sha256.Sum256(payload)
	effectRootID := "effect-root-1"
	effectGenerationID := "effect-generation-1"
	intentID, idempotencyKey, err := outboundintentsemantic.LogicalEffectIdentity(
		outboundintentsemantic.LogicalEffectScope{
			OrgID:                "org-1",
			AppInstallationID:    "01900000-0000-7000-8000-000000000001",
			AuthorizedWorkloadID: "integration-1",
		},
		effectRootID,
		"slot-1",
		effectGenerationID,
	)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	response := outboundintentsemantic.ListResponse{
		Intents: []outboundintentsemantic.Intent{{
			IntentID: intentID, IdempotencyKey: idempotencyKey,
			EffectRootID: effectRootID, EffectGenerationID: effectGenerationID,
			PayloadFormatVersion: 1, PayloadDigest: "sha256:" + hex.EncodeToString(sum[:]),
			CatalogRevision: 1, Operation: outboundintentsemantic.OperationUpsert,
			SourceObject: "Contact", SourceRecordID: "003-1",
			ConnectorOwnerKey: "connector-owner", FlowDeveloperName: "OutboundContact",
			FlowActionName: "push", ActionSlotID: "slot-1", DestinationSlotID: "destination-1",
			Bindings: []outboundintentsemantic.BindingReference{{
				Kind: catalogsemantic.BindingConnectorCalloutProfile, OwnerPack: "connector-owner",
				PackInstallationID: "installation-1",
				PackPayloadDigest:  "nexus-pack-sha256-v1:" + strings.Repeat("a", 64),
				BusinessKey:        "profile-1", DefinitionVersion: 1,
			}},
			CanonicalPayload: payload,
		}},
		Receipts: platformRuntimeTestReceipts(outboundintentsemantic.CapabilityName),
	}
	return mapping.ToWireListPendingOutboundIntentsResponse(semanticRequest, response)
}

func (s *platformRuntimeTestServer) AcknowledgeOutboundIntent(
	ctx context.Context,
	request *runtimev1.AcknowledgeOutboundIntentRequest,
) (*runtimev1.AcknowledgeOutboundIntentResponse, error) {
	s.outboundAckCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireAcknowledgeOutboundIntentRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	return mapping.ToWireAcknowledgeOutboundIntentResponse(semanticRequest, outboundintentsemantic.AcknowledgeResponse{
		IntentID: semanticRequest.IntentID, Outcome: semanticRequest.Outcome,
		Receipts: platformRuntimeTestReceipts(outboundintentsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) OpenOutboundMailAttachment(
	request *runtimev1.OpenOutboundMailAttachmentRequest,
	stream runtimev1.OutboundIntentService_OpenOutboundMailAttachmentServer,
) error {
	s.outboundAttachmentCalls.Add(1)
	s.requireWorkloadOnly(stream.Context())
	if _, err := mapping.FromWireOpenOutboundMailAttachmentRequest(stream.Context(), request); err != nil {
		return mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	data := []byte("attachment")
	sum := sha256.Sum256(data)
	receipts := platformRuntimeTestReceipts(outboundintentsemantic.CapabilityName)
	wire, err := mapping.ToWireOpenOutboundMailAttachmentChunk(outboundintentsemantic.MailAttachmentChunk{
		FileName: "attachment.pdf", ContentType: "application/pdf",
		ContentLength: uint64(len(data)), ContentDigest: "sha256:" + hex.EncodeToString(sum[:]),
		Data: data, Receipts: &receipts,
	})
	if err != nil {
		return mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	return stream.Send(wire)
}

func (s *platformRuntimeTestServer) CommitOutboundResult(
	ctx context.Context,
	request *runtimev1.CommitOutboundResultRequest,
) (*runtimev1.CommitOutboundResultResponse, error) {
	s.outboundCommitCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireCommitOutboundResultRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, outboundintentsemantic.CapabilityName)
	}
	return mapping.ToWireCommitOutboundResultResponse(semanticRequest, outboundintentsemantic.CommitResultResponse{
		IntentID: semanticRequest.IntentID,
		Receipts: platformRuntimeTestReceipts(outboundintentsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadEffectivePermissions(
	ctx context.Context,
	request *runtimev1.ReadEffectivePermissionsRequest,
) (*runtimev1.ReadEffectivePermissionsResponse, error) {
	s.permissionCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadEffectivePermissionsRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, permissionsemantic.CapabilityName)
	}
	return mapping.ToWireReadEffectivePermissionsResponseForRequest(semanticRequest, permissionsemantic.Response{
		SystemPermissions: []permissionsemantic.PermissionGrant{{
			PermissionID: "ViewSetup", Granted: true,
		}},
		ObjectPermissions: []permissionsemantic.ObjectPermission{{
			ResourceType: "Issue", CanRead: true,
		}},
		Receipts: platformRuntimeTestReceipts(permissionsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadPermissionAdministration(
	ctx context.Context,
	request *runtimev1.ReadPermissionAdministrationRequest,
) (*runtimev1.ReadPermissionAdministrationResponse, error) {
	s.permissionAdminReads.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadPermissionAdministrationRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, permissionadminsemantic.CapabilityName)
	}
	return mapping.ToWireReadPermissionAdministrationResponse(semanticRequest, permissionadminsemantic.ReadResponse{
		SystemCatalog: []permissionadminsemantic.SystemPermission{{
			PermissionID: "ManageProfilesPermSets", Label: "Manage Profiles", Category: "Setup",
		}},
		Receipts: platformRuntimeTestReceipts(permissionadminsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) MutatePermissionAdministration(
	ctx context.Context,
	request *runtimev1.MutatePermissionAdministrationRequest,
) (*runtimev1.MutatePermissionAdministrationResponse, error) {
	s.permissionAdminMutates.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireMutatePermissionAdministrationRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, permissionadminsemantic.CapabilityName)
	}
	return mapping.ToWireMutatePermissionAdministrationResponse(semanticRequest, permissionadminsemantic.MutateResponse{
		Receipts: platformRuntimeTestReceipts(permissionadminsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) ReadPermissionAuthoringSnapshot(
	ctx context.Context,
	request *runtimev1.ReadPermissionAuthoringSnapshotRequest,
) (*runtimev1.ReadPermissionAuthoringSnapshotResponse, error) {
	s.permissionSnapshots.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireReadPermissionAuthoringSnapshotRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, permissionauthoringsemantic.CapabilityName)
	}
	token, err := permissionauthoringsemantic.NewAuthoringToken("permission-set-1", 1)
	if err != nil {
		s.t.Fatal(err)
	}
	return mapping.ToWireReadPermissionAuthoringSnapshotResponse(semanticRequest, permissionauthoringsemantic.SnapshotResponse{
		CanonicalPermissionSetID: "permission-set-1",
		AuthoringToken:           token,
		Catalog: permissionauthoringsemantic.SnapshotCatalog{
			System: []permissionauthoringsemantic.SystemPermission{{
				PermissionID: "ManageUsers", Label: "Manage Users", Category: "Setup",
			}},
		},
		Grants: permissionauthoringsemantic.StoredGrants{
			System: []permissionauthoringsemantic.CapabilityGrant{{CapabilityID: "ManageUsers", Enabled: false}},
		},
		Receipts: platformRuntimeTestReceipts(permissionauthoringsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) SavePermissionAuthoring(
	ctx context.Context,
	request *runtimev1.SavePermissionAuthoringRequest,
) (*runtimev1.SavePermissionAuthoringResponse, error) {
	s.permissionSaves.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireSavePermissionAuthoringRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, permissionauthoringsemantic.CapabilityName)
	}
	return mapping.ToWireSavePermissionAuthoringResponse(
		semanticRequest,
		permissionAuthoringTestTerminal(s.t, semanticRequest, "permission-set-1"),
	)
}

func (s *platformRuntimeTestServer) GetPermissionAuthoringStatus(
	ctx context.Context,
	request *runtimev1.GetPermissionAuthoringStatusRequest,
) (*runtimev1.GetPermissionAuthoringStatusResponse, error) {
	s.permissionStatuses.Add(1)
	s.requireDelegation(ctx)
	statusRequest, err := mapping.FromWireGetPermissionAuthoringStatusRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, permissionauthoringsemantic.CapabilityName)
	}
	original := permissionAuthoringTestRequest(s.t)
	canonicalID := "permission-set-1"
	if s.permissionWrongTerminal.Load() {
		canonicalID = "permission-set-2"
	}
	terminal := permissionAuthoringTestTerminal(s.t, original, canonicalID)
	response := permissionauthoringsemantic.StatusResponse{
		CommandID: statusRequest.CommandID, CommandDigest: statusRequest.CommandDigest,
		State:  permissionauthoringsemantic.CommandCompleted,
		Result: &terminal,
	}
	return mapping.ToWireGetPermissionAuthoringStatusResponse(statusRequest, response)
}

func permissionAuthoringTestRequest(t *testing.T) permissionauthoringsemantic.Request {
	t.Helper()
	revision := uint64(1)
	token, err := permissionauthoringsemantic.NewAuthoringToken("permission-set-1", 1)
	if err != nil {
		t.Fatal(err)
	}
	return permissionauthoringsemantic.Request{
		CommandID:              "permission-save-1",
		Target:                 permissionauthoringsemantic.Target{Kind: permissionauthoringsemantic.TargetProfile, ID: "profile-1"},
		ExpectedAuthoringToken: token,
		Changes: permissionauthoringsemantic.Changes{
			System: []permissionauthoringsemantic.CapabilityGrantChange{{CapabilityID: "ManageUsers", Enabled: true}},
		},
		MinCatalogRevision: &revision,
	}
}

func permissionAuthoringTestTerminal(
	t *testing.T,
	request permissionauthoringsemantic.Request,
	canonicalID string,
) permissionauthoringsemantic.Response {
	t.Helper()
	digest, err := permissionauthoringsemantic.CommandDigest(request)
	if err != nil {
		t.Fatal(err)
	}
	token, err := permissionauthoringsemantic.NewAuthoringToken(canonicalID, 2)
	if err != nil {
		t.Fatal(err)
	}
	return permissionauthoringsemantic.Response{
		CommandID: request.CommandID, CommandDigest: digest,
		Outcome:                  permissionauthoringsemantic.OutcomeApplied,
		CanonicalPermissionSetID: canonicalID, AuthoringToken: token,
		Receipts:            platformRuntimeTestReceipts(permissionauthoringsemantic.CapabilityName),
		OutcomeExpiresAtUTC: "2030-01-01T00:00:00Z",
	}
}

type layoutAuthoringTestServer struct {
	runtimev1.UnimplementedLayoutAuthoringServiceServer
	parent *platformRuntimeTestServer
}

func (s *layoutAuthoringTestServer) Submit(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringServiceSubmitRequest,
) (*runtimev1.LayoutAuthoringServiceSubmitResponse, error) {
	s.parent.layoutAuthoringSubmits.Add(1)
	s.parent.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireLayoutAuthoringSubmitRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringsemantic.CapabilityName)
	}
	digest, err := layoutauthoringsemantic.RequestDigest(semanticRequest)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringsemantic.CapabilityName)
	}
	return mapping.ToWireLayoutAuthoringSubmitResponse(semanticRequest, layoutauthoringsemantic.SubmitResponse{
		Command: layoutauthoringsemantic.CommandStatus{
			CommandID: semanticRequest.CommandID, RequestDigest: digest,
			State:    layoutauthoringsemantic.StateAccepted,
			Receipts: platformRuntimeTestReceipts(layoutauthoringsemantic.CapabilityName),
		},
	})
}

func (s *layoutAuthoringTestServer) GetCommand(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringServiceGetCommandRequest,
) (*runtimev1.LayoutAuthoringServiceGetCommandResponse, error) {
	s.parent.layoutAuthoringStatuses.Add(1)
	s.parent.requireDelegation(ctx)
	if s.parent.layoutRejectSecurityOnce.Swap(false) {
		return nil, mapping.ToPlatformStatusError(&commonsemantic.Failure{
			Category: commonsemantic.FailureStaleState, StaleAxis: commonsemantic.StaleAxisSecurity,
			RequiredRevision: 2, ServedRevision: 1,
		}, layoutauthoringsemantic.CapabilityName)
	}
	semanticRequest, err := mapping.FromWireLayoutAuthoringGetCommandRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringsemantic.CapabilityName)
	}
	return mapping.ToWireLayoutAuthoringCommandStatus(semanticRequest, layoutauthoringsemantic.CommandStatus{
		CommandID: semanticRequest.CommandID, RequestDigest: semanticRequest.RequestDigest,
		State:    layoutauthoringsemantic.StateAccepted,
		Receipts: platformRuntimeTestReceipts(layoutauthoringsemantic.CapabilityName),
	})
}

func (s *layoutAuthoringTestServer) ReadWorkspace(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringServiceReadWorkspaceRequest,
) (*runtimev1.LayoutAuthoringServiceReadWorkspaceResponse, error) {
	s.parent.layoutAuthoringWorkspaces.Add(1)
	s.parent.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireLayoutAuthoringWorkspaceRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringsemantic.CapabilityName)
	}
	ref := layoutAuthoringTestViewRef()
	if semanticRequest.ViewRef != nil {
		ref = *semanticRequest.ViewRef
	}
	return mapping.ToWireLayoutAuthoringWorkspace(semanticRequest, layoutauthoringsemantic.Workspace{
		ObjectID: semanticRequest.ObjectID, WorkspaceVersion: "workspace-v1",
		Layouts: []layoutauthoringsemantic.LayoutSummary{}, Assignments: []layoutauthoringsemantic.LayoutAssignmentSummary{},
		ViewRef: ref, Receipts: platformRuntimeTestReceipts(layoutauthoringsemantic.CapabilityName),
	})
}

func (s *layoutAuthoringTestServer) ReadStoredLayout(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringServiceReadStoredLayoutRequest,
) (*runtimev1.LayoutAuthoringServiceReadStoredLayoutResponse, error) {
	s.parent.layoutAuthoringStoredReads.Add(1)
	s.parent.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireLayoutAuthoringStoredLayoutRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringsemantic.CapabilityName)
	}
	ref := layoutAuthoringTestViewRef()
	if semanticRequest.ViewRef != nil {
		ref = *semanticRequest.ViewRef
	}
	document := layoutAuthoringTestDocument()
	document.LayoutID = semanticRequest.LayoutID
	return mapping.ToWireLayoutAuthoringStoredLayout(semanticRequest, layoutauthoringsemantic.StoredLayout{
		Document: document, OrderedListFields: []string{},
		Lifecycle:       layoutauthoringsemantic.LayoutLifecycleState{ProvenanceKind: "tenant"},
		ResourceVersion: "resource-v1", AggregateVersion: "aggregate-v1", WorkspaceVersion: "workspace-v1",
		ViewRef: ref, Receipts: platformRuntimeTestReceipts(layoutauthoringsemantic.CapabilityName),
	})
}

func (s *platformRuntimeTestServer) AuthorizeConnectedMailbox(
	ctx context.Context,
	request *runtimev1.AuthorizeConnectedMailboxRequest,
) (*runtimev1.AuthorizeConnectedMailboxResponse, error) {
	s.mailboxAuthorizeCalls.Add(1)
	s.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireAuthorizeConnectedMailboxRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, mailboxauthorizationsemantic.CapabilityName)
	}
	response := mailboxauthorizationsemantic.Response{
		AuthorizedSubjectID: "user-1",
		Receipts:            platformRuntimeTestReceipts(mailboxauthorizationsemantic.CapabilityName),
	}
	if semanticRequest.Operation == mailboxauthorizationsemantic.OperationBegin {
		response.ReauthorizationHandle = "reauthorization-handle-1"
	}
	return mapping.ToWireAuthorizeConnectedMailboxResponse(semanticRequest, response)
}

func (s *platformRuntimeTestServer) ReauthorizeConnectedMailbox(
	ctx context.Context,
	request *runtimev1.ReauthorizeConnectedMailboxRequest,
) (*runtimev1.ReauthorizeConnectedMailboxResponse, error) {
	s.mailboxReauthorizeCalls.Add(1)
	s.requireWorkloadOnly(ctx)
	semanticRequest, err := mapping.FromWireReauthorizeConnectedMailboxRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, mailboxauthorizationsemantic.CapabilityName)
	}
	return mapping.ToWireReauthorizeConnectedMailboxResponse(
		semanticRequest,
		mailboxauthorizationsemantic.Response{
			AuthorizedSubjectID: "user-1",
			Receipts:            platformRuntimeTestReceipts(mailboxauthorizationsemantic.CapabilityName),
		},
	)
}

func (s *platformRuntimeTestServer) requireWorkload(ctx context.Context) {
	s.t.Helper()
	values, _ := metadata.FromIncomingContext(ctx)
	if got := values.Get("authorization"); len(got) != 1 || got[0] != "Bearer workload-secret" {
		s.t.Fatalf("workload authorization = %#v", got)
	}
}

func (s *platformRuntimeTestServer) requireDelegation(ctx context.Context) {
	s.t.Helper()
	s.requireWorkload(ctx)
	values, _ := metadata.FromIncomingContext(ctx)
	if got := values.Get(envelope.RuntimeDelegationMetadataKey); len(got) != 1 || got[0] != "header.payload.signature" {
		s.t.Fatalf("delegation = %#v", got)
	}
	if got := values.Get(EndUserAuthorizationMetadataKey); len(got) != 0 {
		s.t.Fatalf("delegated method inherited end-user bearer = %#v", got)
	}
}

func (s *platformRuntimeTestServer) requireWorkloadOnly(ctx context.Context) {
	s.t.Helper()
	s.requireWorkload(ctx)
	values, _ := metadata.FromIncomingContext(ctx)
	if got := values.Get(envelope.RuntimeDelegationMetadataKey); len(got) != 0 {
		s.t.Fatalf("workload-only method received delegation = %#v", got)
	}
	if got := values.Get(EndUserAuthorizationMetadataKey); len(got) != 0 {
		s.t.Fatalf("workload-only method received end-user bearer = %#v", got)
	}
}

func TestPlatformRuntimePreservesMethodClassesOnOneTarget(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	ctx = metadata.NewOutgoingContext(ctx, metadata.Pairs(
		EndUserAuthorizationMetadataKey, "Bearer stale-user",
		envelope.RuntimeDelegationMetadataKey, "stale-delegation",
	))
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	appView, err := client.GetAppMetadataView(ctx, catalogsemantic.GetRequest{})
	if err != nil || appView.AppInstallationID != "01900000-0000-7000-8000-000000000001" {
		t.Fatalf("App metadata view = %#v, %v", appView, err)
	}
	appViewV2, err := client.GetAppMetadataViewV2(
		ctx,
		catalogsemantic.GetRequest{},
	)
	if err != nil ||
		appViewV2.AppInstallationID !=
			"01900000-0000-7000-8000-000000000001" ||
		len(appViewV2.EffectiveComponents) != 1 {
		t.Fatalf("App metadata v2 view = %#v, %v", appViewV2, err)
	}
	bindingView, err := client.GetIntegrationBindingView(ctx, catalogsemantic.GetRequest{})
	if err != nil || bindingView.AuthorizedWorkloadID != "integration-1" ||
		len(bindingView.Bindings) != 1 ||
		bindingView.Bindings[0].RuntimeCommand == nil ||
		bindingView.Bindings[0].RuntimeCommand.DefinitionVersion != "flow-7" {
		t.Fatalf("Integration binding view = %#v, %v", bindingView, err)
	}
	search, err := client.Search(ctx, "user-secret", searchsemantic.Request{
		ObjectIDs: []string{"Issue"}, Term: "test", SearchFields: []string{"Name"},
		SelectedFields: []string{"Id"}, Limit: 1,
	})
	if err != nil || len(search.Records) != 1 || search.Records[0].ObjectID != "Issue" {
		t.Fatalf("Search = %#v, %v", search, err)
	}
	scopeOrder, err := client.ReadSearchScopeOrder(
		ctx,
		"user-secret",
		searchsemantic.ScopeOrderRequest{ObjectIDs: []string{"Issue", "Account"}},
	)
	if err != nil || len(scopeOrder.ObjectIDs) != 1 ||
		scopeOrder.ObjectIDs[0] != "Account" {
		t.Fatalf("ReadSearchScopeOrder = %#v, %v", scopeOrder, err)
	}
	flow, err := client.ExecuteFlow(ctx, "user-secret", flowsemantic.Request{
		DefinitionRef: "flow-1", DefinitionVersion: "1", IdempotencyKey: "flow-attempt-1",
		CanonicalInputs: []byte(`{}`),
	})
	if err != nil || flow.ExecutionID != "execution-1" {
		t.Fatalf("Flow = %#v, %v", flow, err)
	}
	server.flowMu.Lock()
	gotFlowRequest := server.flowRequest
	server.flowMu.Unlock()
	if gotFlowRequest.DefinitionRef != "flow-1" || gotFlowRequest.DefinitionVersion != "1" {
		t.Fatalf("ordinary Flow request = %#v", gotFlowRequest)
	}
	action, err := client.ExecuteCatalogAction(ctx, "user-secret", flowsemantic.CatalogActionRequest{
		IdempotencyKey: "action-attempt-1", CanonicalInputs: []byte(`{}`),
		CatalogAction: flowsemantic.CatalogActionBinding{
			ComponentRef: "component-sha256-v1:action-component",
			ActionRef:    "action-1",
		},
	})
	if err != nil || action.ExecutionID != "execution-1" {
		t.Fatalf("Catalog action = %#v, %v", action, err)
	}
	server.flowMu.Lock()
	gotFlowAction := server.flowAction
	server.flowMu.Unlock()
	if gotFlowAction.CatalogAction.ComponentRef != "component-sha256-v1:action-component" ||
		gotFlowAction.CatalogAction.ActionRef != "action-1" {
		t.Fatalf("Flow Catalog action binding = %#v", gotFlowAction.CatalogAction)
	}
	revision := uint64(1)
	preview, err := client.PreviewCatalogAction(
		ctx,
		"user-secret",
		flowsemantic.CatalogActionPreviewRequest{
			Mode:     flowsemantic.CatalogActionPreviewOutputs,
			RecordID: "record-1", MinCatalogRevision: &revision,
			CatalogAction: flowsemantic.CatalogActionBinding{
				ComponentRef: "component-sha256-v1:action-component",
				ActionRef:    "action-1",
			},
		},
	)
	if err != nil || string(preview.CanonicalResult) != `{"isSuccess":true}` {
		t.Fatalf("Catalog action preview = %#v, %v", preview, err)
	}
	server.flowMu.Lock()
	gotFlowPreview := server.flowPreview
	server.flowMu.Unlock()
	if gotFlowPreview.Mode != flowsemantic.CatalogActionPreviewOutputs ||
		gotFlowPreview.RecordID != "record-1" ||
		gotFlowPreview.CatalogAction.ActionRef != "action-1" {
		t.Fatalf("Flow Catalog action preview = %#v", gotFlowPreview)
	}
	report, err := client.ReadReport(ctx, "user-secret", reportsemantic.Request{
		ReportID: "report-1", CanonicalFilters: []byte(`{}`), Limit: 1,
	})
	if err != nil || string(report.CanonicalResult) != "[]" {
		t.Fatalf("Report = %#v, %v", report, err)
	}
	auditLog, err := client.ReadAuditLog(ctx, "user-secret", auditsemantic.Request{
		ObjectID: "Account", RecordID: "001", Limit: 100,
	})
	if err != nil || len(auditLog.Rows) != 1 || auditLog.Rows[0].FieldID != "Name" {
		t.Fatalf("Audit log = %#v, %v", auditLog, err)
	}
	approval, err := client.ExecuteApproval(
		ctx,
		"user-secret",
		approvalsemantic.ExecuteRequest{
			Operation: approvalsemantic.OperationSubmit, IdempotencyKey: "approval-attempt-1",
			ObjectID: "Issue", TargetRecordID: "record-1",
		},
	)
	if err != nil || approval.ExecutionID != "approval-execution-1" ||
		len(approval.PendingWorkItems) != 1 {
		t.Fatalf("ExecuteApproval = %#v, %v", approval, err)
	}
	approvalRead, err := client.ReadApproval(
		ctx,
		"user-secret",
		approvalsemantic.ReadRequest{Kind: approvalsemantic.ReadPendingForCaller},
	)
	if err != nil || len(approvalRead.Pending) != 0 || approvalRead.Latest != nil {
		t.Fatalf("ReadApproval = %#v, %v", approvalRead, err)
	}
	deleted, err := client.DeleteFile(ctx, "user-secret", filessemantic.DeleteRequest{FileID: "file-1"})
	if err != nil || deleted.Receipts.CapabilityVersion != filessemantic.CapabilityName {
		t.Fatalf("Delete file = %#v, %v", deleted, err)
	}
	payload := []byte(`{"event":"created"}`)
	command, err := client.AcceptCommand(ctx, commandsemantic.Request{
		CommandID: "command-1", IdempotencyKey: "attempt-1", CommandKind: "connector.event",
		PartitionKey: "record-1", PayloadFormatVersion: 1, Payload: payload,
		PayloadDigest: commandsemantic.ComputePayloadDigest(payload),
	})
	if err != nil || command.CommandID != "command-1" {
		t.Fatalf("AcceptCommand = %#v, %v", command, err)
	}
	applicationResult, err := client.GetApplicationResult(
		ctx,
		applicationresultsemantic.GetResultRequest{
			CommandID:          "command-1",
			ExecutionRefDigest: "sha256:" + strings.Repeat("a", 64),
		},
	)
	if err != nil || applicationResult.State != applicationresultsemantic.ResultTerminal ||
		applicationResult.Result == nil ||
		applicationResult.Result.Outcome != applicationresultsemantic.OutcomeApplied ||
		applicationresultsemantic.ValidateApplicationResult(*applicationResult.Result) != nil {
		t.Fatalf("GetApplicationResult = %#v, %v", applicationResult, err)
	}
	effective, err := client.ReadEffectivePermissions(
		ctx, "user-secret", permissionsemantic.Request{TargetPrincipalID: "user-2"},
	)
	if err != nil || len(effective.ObjectPermissions) != 1 ||
		effective.ObjectPermissions[0].ResourceType != "Issue" {
		t.Fatalf("ReadEffectivePermissions = %#v, %v", effective, err)
	}
	permissionCatalog, err := client.ReadPermissionAdministration(
		ctx, "user-secret", permissionadminsemantic.ReadRequest{Selector: permissionadminsemantic.ReadSystemCatalog},
	)
	if err != nil || len(permissionCatalog.SystemCatalog) != 1 ||
		permissionCatalog.SystemCatalog[0].PermissionID != "ManageProfilesPermSets" {
		t.Fatalf("ReadPermissionAdministration = %#v, %v", permissionCatalog, err)
	}
	permissionMutation, err := client.MutatePermissionAdministration(
		ctx, "user-secret", permissionadminsemantic.MutateRequest{
			Selector: permissionadminsemantic.MutateSystemGrants, PermissionSetID: "permset-1",
			Grants: []permissionadminsemantic.Grant{{PermissionID: "ViewSetup", Enabled: true}},
		},
	)
	if err != nil || permissionMutation.Receipts.CapabilityVersion != permissionadminsemantic.CapabilityName {
		t.Fatalf("MutatePermissionAdministration = %#v, %v", permissionMutation, err)
	}
	// Delegated data calls require nine distinct capability sets. Calls
	// sharing one bearer and one capability set reuse the bounded page burst;
	// workload-only methods remain outside Identity Exchange.
	if server.identityCalls.Load() != 9 || server.catalogCalls.Load() != 3 ||
		server.searchCalls.Load() != 1 || server.scopeCalls.Load() != 1 ||
		server.flowCalls.Load() != 3 ||
		server.reportCalls.Load() != 1 || server.auditLogCalls.Load() != 1 || server.deleteCalls.Load() != 1 ||
		server.commandCalls.Load() != 1 || server.resultCalls.Load() != 1 ||
		server.permissionCalls.Load() != 1 || server.permissionAdminReads.Load() != 1 ||
		server.permissionAdminMutates.Load() != 1 ||
		server.approvalExecCalls.Load() != 1 || server.approvalReadCalls.Load() != 1 {
		t.Fatalf("calls identity/catalog/search/scope/flow/report/audit/delete/command/result/permission/permission-admin-read/permission-admin-mutate/approval-exec/approval-read = %d/%d/%d/%d/%d/%d/%d/%d/%d/%d/%d/%d/%d/%d/%d",
			server.identityCalls.Load(), server.catalogCalls.Load(), server.searchCalls.Load(),
			server.scopeCalls.Load(),
			server.flowCalls.Load(), server.reportCalls.Load(), server.auditLogCalls.Load(), server.deleteCalls.Load(),
			server.commandCalls.Load(), server.resultCalls.Load(), server.permissionCalls.Load(),
			server.permissionAdminReads.Load(), server.permissionAdminMutates.Load(),
			server.approvalExecCalls.Load(), server.approvalReadCalls.Load())
	}
}

func TestPlatformRuntimeBulkIngestUsesOneAuthorizedLifecycleAndBoundedStream(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: time.Second,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	created, err := client.CreateBulkIngestJob(ctx, "user-secret", bulkingestsemantic.CreateRequest{ObjectID: "Account", Operation: bulkingestsemantic.OperationInsert})
	if err != nil || created.Job.ID != "job-1" {
		t.Fatalf("CreateBulkIngestJob = %#v, %v", created, err)
	}
	read, err := client.ReadBulkIngestJob(ctx, "user-secret", bulkingestsemantic.ReadRequest{JobID: created.Job.ID})
	if err != nil || read.Job.State != bulkingestsemantic.StateOpen {
		t.Fatalf("ReadBulkIngestJob = %#v, %v", read, err)
	}
	body := []byte("Name\nAcme\n")
	upload, err := client.BeginBulkIngestUpload(ctx, "user-secret", bulkingestsemantic.UploadHeader{JobID: created.Job.ID, ContentLength: uint64(len(body)), ContentLengthKnown: true})
	if err != nil {
		t.Fatal(err)
	}
	if err := upload.Send(body[:4]); err != nil {
		t.Fatal(err)
	}
	if err := upload.Send(body[4:]); err != nil {
		t.Fatal(err)
	}
	if response, err := upload.CloseAndRecv(); err != nil || response.Receipts.CapabilityVersion != bulkingestsemantic.CapabilityName {
		t.Fatalf("UploadBulkIngestData = %#v, %v", response, err)
	}
	closed, err := client.CloseBulkIngestJob(ctx, "user-secret", bulkingestsemantic.CloseRequest{JobID: created.Job.ID, State: bulkingestsemantic.StateUploadComplete})
	if err != nil || closed.Job.State != bulkingestsemantic.StateUploadComplete {
		t.Fatalf("CloseBulkIngestJob = %#v, %v", closed, err)
	}
	if server.bulkCreateCalls.Load() != 1 || server.bulkReadCalls.Load() != 1 || server.bulkUploadCalls.Load() != 1 || server.bulkCloseCalls.Load() != 1 || string(server.bulkUploadBody) != string(body) {
		t.Fatalf("bulk calls/body = %d/%d/%d/%d %q", server.bulkCreateCalls.Load(), server.bulkReadCalls.Load(), server.bulkUploadCalls.Load(), server.bulkCloseCalls.Load(), server.bulkUploadBody)
	}
}

func TestPlatformRuntimeBulkIngestCancelsStreamAfterLocalSendRejection(t *testing.T) {
	target, _, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: time.Second,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	upload, err := client.BeginBulkIngestUpload(ctx, "user-secret", bulkingestsemantic.UploadHeader{
		JobID: "job-1", ContentLength: 1, ContentLengthKnown: true,
	})
	if err != nil {
		t.Fatal(err)
	}
	originalCancel := upload.streamLifecycle.cancel
	var canceled atomic.Bool
	upload.streamLifecycle.cancel = func() {
		canceled.Store(true)
		originalCancel()
	}
	if err := upload.Send([]byte("too long")); err == nil {
		t.Fatal("oversized local chunk unexpectedly succeeded")
	}
	if !upload.closed {
		t.Fatal("rejected upload remained open")
	}
	if !canceled.Load() {
		t.Fatal("rejected upload did not cancel its client stream lifecycle")
	}
}

func TestPlatformRuntimeDerivesFreshDeadlinePerIdentityAndDataRPC(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	server.identityDelay.Store(int64(80 * time.Millisecond))
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: 200 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	_, err = client.Search(ctx, "user-secret", searchsemantic.Request{
		ObjectIDs: []string{"Issue"}, Term: "test", SearchFields: []string{"Name"},
		SelectedFields: []string{"Id"}, Limit: 1,
	})
	if err != nil {
		t.Fatal(err)
	}
	if identityLease := time.Duration(server.identityLease.Load()); identityLease < 150*time.Millisecond {
		t.Fatalf("identity lease = %s, want a fresh 200ms attempt", identityLease)
	}
	if searchLease := time.Duration(server.searchLease.Load()); searchLease < 150*time.Millisecond {
		t.Fatalf("data lease = %s, identity work consumed the data attempt", searchLease)
	}
}

func TestPlatformRuntimeWatchRejectsRepeatedCatalogRevisionBeforeConsumption(t *testing.T) {
	target, _, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	watch, err := client.WatchAppMetadataView(ctx, catalogsemantic.WatchRequest{})
	if err != nil {
		t.Fatal(err)
	}
	defer watch.Cancel()
	if _, err := watch.Recv(); err != nil {
		t.Fatalf("first watch revision = %v", err)
	}
	_, err = watch.Recv()
	var failure *commonsemantic.Failure
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInternal {
		t.Fatalf("repeated watch revision = %#v", err)
	}

	watchV2, err := client.WatchAppMetadataViewV2(
		ctx,
		catalogsemantic.WatchRequest{},
	)
	if err != nil {
		t.Fatal(err)
	}
	defer watchV2.Cancel()
	if _, err := watchV2.Recv(); err != nil {
		t.Fatalf("first v2 watch revision = %v", err)
	}
	_, err = watchV2.Recv()
	failure = nil
	if !errors.As(err, &failure) ||
		failure.Category != commonsemantic.FailureInternal {
		t.Fatalf("repeated v2 watch revision = %#v", err)
	}

	bindingWatch, err := client.WatchIntegrationBindingView(ctx, catalogsemantic.WatchRequest{})
	if err != nil {
		t.Fatal(err)
	}
	defer bindingWatch.Cancel()
	if _, err := bindingWatch.Recv(); err != nil {
		t.Fatalf("first Integration binding revision = %v", err)
	}
	_, err = bindingWatch.Recv()
	failure = nil
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInternal {
		t.Fatalf("repeated Integration binding revision = %#v", err)
	}
}

func TestPlatformRuntimeFilesEnforceCompleteSemanticStreams(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	upload, err := client.BeginCreateFile(ctx, "user-secret", filessemantic.CreateHeader{
		IdempotencyKey: "upload-1", ParentObjectID: "Issue", ParentRecordID: "record-1",
		FileName: "file.txt", ContentType: "text/plain", ContentLength: 2,
	})
	if err != nil {
		t.Fatal(err)
	}
	defer upload.Cancel()
	if err := upload.Send([]byte("a")); err != nil {
		t.Fatal(err)
	}
	_, err = upload.CloseAndRecv()
	var failure *commonsemantic.Failure
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInvalidRequest ||
		server.fileCompleted.Load() {
		t.Fatalf("short upload = %#v, completed=%v", err, server.fileCompleted.Load())
	}

	successfulUpload, err := client.BeginCreateFile(ctx, "user-secret", filessemantic.CreateHeader{
		IdempotencyKey: "upload-2", ParentObjectID: "Issue", ParentRecordID: "record-1",
		FileName: "file.txt", ContentType: "text/plain", ContentLength: 1,
	})
	if err != nil {
		t.Fatal(err)
	}
	defer successfulUpload.Cancel()
	if err := successfulUpload.Send([]byte("a")); err != nil {
		t.Fatal(err)
	}
	created, err := successfulUpload.CloseAndRecv()
	if err != nil || created.FileID != "file-1" || created.Size != 1 || !server.fileCompleted.Load() {
		t.Fatalf("complete upload = %#v, %v, completed=%v", created, err, server.fileCompleted.Load())
	}

	download, err := client.OpenFile(ctx, "user-secret", filessemantic.OpenRequest{FileID: "file-1"})
	if err != nil {
		t.Fatal(err)
	}
	defer download.Cancel()
	if _, err := download.Recv(); err != nil {
		t.Fatalf("first file chunk = %v", err)
	}
	_, err = download.Recv()
	failure = nil
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInternal {
		t.Fatalf("partial download = %#v", err)
	}
}

func TestPlatformRuntimeStreamZeroValuesFailClosed(t *testing.T) {
	assertUnavailable := func(name string, err error) {
		t.Helper()
		var failure *commonsemantic.Failure
		if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureUnavailable {
			t.Fatalf("%s = %#v", name, err)
		}
	}
	var appWatch AppMetadataWatch
	_, err := appWatch.Recv()
	assertUnavailable("zero AppMetadata watch", err)
	var bindingWatch IntegrationBindingWatch
	_, err = bindingWatch.Recv()
	assertUnavailable("zero Integration binding watch", err)
	var upload RuntimeFileUpload
	assertUnavailable("zero upload Send", upload.Send([]byte("a")))
	_, err = upload.CloseAndRecv()
	assertUnavailable("zero upload CloseAndRecv", err)
	var download RuntimeFileDownload
	_, err = download.Recv()
	assertUnavailable("zero download", err)
}

func TestPlatformRuntimeUploadCancellationIsOwnedByTheStream(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	startupCtx, cancelStartup := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancelStartup()
	client, err := dialPlatformRuntimeWithCredentials(startupCtx, RuntimeClientConfig{
		Target: target, AppInstallationID: "01900000-0000-7000-8000-000000000001",
		WorkloadToken: "workload-secret", AttemptTimeout: time.Second,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	callCtx, cancelCall := context.WithCancel(context.Background())
	upload, err := client.BeginCreateFile(callCtx, "user-secret", filessemantic.CreateHeader{
		IdempotencyKey: "upload-cancel", ParentObjectID: "Issue", ParentRecordID: "record-1",
		FileName: "file.txt", ContentType: "text/plain", ContentLength: 1,
	})
	if err != nil {
		t.Fatal(err)
	}
	defer upload.Cancel()
	select {
	case <-server.fileStarted:
	case <-time.After(time.Second):
		t.Fatal("server did not observe the upload header")
	}
	cancelCall()
	select {
	case <-server.fileCanceled:
	case <-time.After(time.Second):
		t.Fatal("upload cancellation did not reach the server stream")
	}
	_, err = upload.CloseAndRecv()
	var failure *commonsemantic.Failure
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureCanceled {
		t.Fatalf("canceled upload = %#v", err)
	}
}

func TestPlatformRuntimeWorkloadMethodsNeedNoProcessLocalInstallation(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	if _, err := client.GetAppMetadataView(ctx, catalogsemantic.GetRequest{}); err != nil {
		t.Fatalf("workload-only Catalog call = %v", err)
	}
	if _, err := client.GetAppMetadataViewV2(
		ctx,
		catalogsemantic.GetRequest{},
	); err != nil {
		t.Fatalf("workload-only Catalog v2 call = %v", err)
	}
	payload := []byte(`{"event":"created"}`)
	if _, err := client.AcceptCommand(ctx, commandsemantic.Request{
		CommandID: "command-1", IdempotencyKey: "attempt-1", CommandKind: "connector.event",
		PartitionKey: "record-1", PayloadFormatVersion: 1, Payload: payload,
		PayloadDigest: commandsemantic.ComputePayloadDigest(payload),
	}); err != nil {
		t.Fatalf("workload-only Command call = %v", err)
	}
	if _, err := client.GetApplicationResult(ctx, applicationresultsemantic.GetResultRequest{
		CommandID:          "command-1",
		ExecutionRefDigest: "sha256:" + strings.Repeat("a", 64),
	}); err != nil {
		t.Fatalf("workload-only ApplicationResult call = %v", err)
	}

	_, err = client.Search(ctx, "user-secret", searchsemantic.Request{
		ObjectIDs: []string{"Issue"}, Term: "test", SearchFields: []string{"Name"},
		SelectedFields: []string{"Id"}, Limit: 1,
	})
	var failure *commonsemantic.Failure
	if !errors.As(err, &failure) || failure.Category != commonsemantic.FailureInvalidRequest ||
		failure.InvalidComponent != commonsemantic.InvalidComponentAppInstallationID {
		t.Fatalf("delegated call without AppInstallation = %#v", err)
	}
	if server.identityCalls.Load() != 0 || server.catalogCalls.Load() != 2 ||
		server.searchCalls.Load() != 0 || server.commandCalls.Load() != 1 ||
		server.resultCalls.Load() != 1 {
		t.Fatalf("calls identity/catalog/search/command/result = %d/%d/%d/%d/%d",
			server.identityCalls.Load(), server.catalogCalls.Load(),
			server.searchCalls.Load(), server.commandCalls.Load(), server.resultCalls.Load())
	}
}

func TestPlatformRuntimeNMinusOneExternalEffectClientRemainsSourceAndWireCompatible(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()
	claim, err := client.ClaimExternalEffects(ctx, externaleffectsemantic.ClaimRequest{WorkerID: "integration-1", Limit: 1})
	if err != nil || len(claim.Effects) != 1 {
		t.Fatalf("claim = %#v, %v", claim, err)
	}
	effect := claim.Effects[0]
	request := externaleffectsemantic.CompleteRequest{
		EffectID: effect.EffectID, ClaimToken: effect.ClaimToken,
		CatalogRevision: claim.Receipts.CatalogRevision,
		Results: []externaleffectsemantic.OperationResult{{
			OperationID: effect.Operations[0].OperationID, RequestDigest: effect.Operations[0].RequestDigest,
			Outcome: externaleffectsemantic.OutcomeResponseReceived, StatusCode: 200,
		}},
	}
	response, err := client.CompleteExternalEffect(ctx, claim, request)
	if err != nil || response.State != externaleffectsemantic.CompletionFinalized {
		t.Fatalf("complete = %#v, %v", response, err)
	}
	if server.externalClaimCalls.Load() != 1 || server.externalCompleteCalls.Load() != 1 {
		t.Fatalf("external calls claim/complete = %d/%d", server.externalClaimCalls.Load(), server.externalCompleteCalls.Load())
	}
}

func TestPlatformRuntimeOutboundIntentHandoffIsWorkloadOnly(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()
	generation, err := client.ReadOutboundIntentGeneration(
		ctx,
		outboundintentsemantic.GenerationRequest{AfterGeneration: 6},
	)
	if err != nil || generation.Generation != 7 {
		t.Fatalf("generation = %#v, %v", generation, err)
	}
	listed, err := client.ListPendingOutboundIntents(ctx, outboundintentsemantic.ListRequest{Limit: 1})
	if err != nil || len(listed.Intents) != 1 {
		t.Fatalf("list = %#v, %v", listed, err)
	}
	intent := listed.Intents[0]
	request := outboundintentsemantic.AcknowledgeRequest{
		IntentID: intent.IntentID, PayloadDigest: intent.PayloadDigest,
		CatalogRevision:      intent.CatalogRevision,
		Outcome:              outboundintentsemantic.AdmissionAccepted,
		IntegrationCommandID: "integration-command-1",
	}
	response, err := client.AcknowledgeOutboundIntent(ctx, request)
	if err != nil || response.Outcome != outboundintentsemantic.AdmissionAccepted {
		t.Fatalf("acknowledge = %#v, %v", response, err)
	}
	attachmentData := []byte("attachment")
	attachmentSum := sha256.Sum256(attachmentData)
	expectedAttachment := outboundintentsemantic.MailAttachmentV1{
		FileID: "file-1", FileName: "attachment.pdf", ContentType: "application/pdf",
		ContentLength: uint64(len(attachmentData)), ContentDigest: "sha256:" + hex.EncodeToString(attachmentSum[:]),
	}
	opened, err := client.OpenOutboundMailAttachment(ctx, outboundintentsemantic.OpenMailAttachmentRequest{
		IntentID: "intent-mail-1", PayloadDigest: "sha256:" + strings.Repeat("a", 64),
		CatalogRevision: 1, IntegrationCommandID: "integration-command-1", AttachmentIndex: 0,
	}, expectedAttachment)
	if err != nil || !bytes.Equal(opened.Data, attachmentData) {
		t.Fatalf("attachment = %#v, %v", opened, err)
	}
	committed, err := client.CommitOutboundResult(ctx, outboundintentsemantic.CommitResultRequest{
		IntentID: intent.IntentID, PayloadDigest: intent.PayloadDigest,
		CatalogRevision:      intent.CatalogRevision,
		IntegrationCommandID: "integration-command-1", RemoteID: "remote-1",
	})
	if err != nil || committed.IntentID != intent.IntentID {
		t.Fatalf("commit result = %#v, %v", committed, err)
	}
	request.IntegrationCommandID = ""
	if _, err := client.AcknowledgeOutboundIntent(ctx, request); err == nil {
		t.Fatal("invalid durable acceptance reached transport")
	}
	if server.outboundGenerationCalls.Load() != 1 || server.outboundListCalls.Load() != 1 ||
		server.outboundAckCalls.Load() != 1 || server.outboundAttachmentCalls.Load() != 1 ||
		server.outboundCommitCalls.Load() != 1 {
		t.Fatalf("outbound calls generation/list/ack/attachment/commit = %d/%d/%d/%d/%d",
			server.outboundGenerationCalls.Load(), server.outboundListCalls.Load(), server.outboundAckCalls.Load(),
			server.outboundAttachmentCalls.Load(), server.outboundCommitCalls.Load())
	}
}

func TestPlatformRuntimePrivateListViewsUseDelegatedPrincipal(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()
	listed, err := client.ReadPrivateListViews(ctx, "user-secret", listviewsemantic.ReadRequest{
		Selector: listviewsemantic.ReadList, ObjectID: "Issue",
	})
	if err != nil || len(listed.Views) != 1 || listed.Views[0].ViewID != "view-1" {
		t.Fatalf("list = %#v, %v", listed, err)
	}
	label, stableName := "My Issues", "My_Issues"
	created, err := client.MutatePrivateListView(ctx, "user-secret", listviewsemantic.MutateRequest{
		Operation: listviewsemantic.MutationCreate, ObjectID: "Issue",
		Patch: &listviewsemantic.Patch{
			Label: &label, StableName: &stableName,
			Fields: &listviewsemantic.FieldSelection{FieldIDs: []string{"Id"}},
		},
	})
	if err != nil || created.View == nil || created.View.ViewID != "view-1" {
		t.Fatalf("create = %#v, %v", created, err)
	}
	if server.listViewReadCalls.Load() != 1 || server.listViewMutateCalls.Load() != 1 || server.identityCalls.Load() != 1 {
		t.Fatalf("calls read/mutate/identity = %d/%d/%d", server.listViewReadCalls.Load(), server.listViewMutateCalls.Load(), server.identityCalls.Load())
	}
}

func TestPlatformRuntimeMetadataAdminReadsUseDelegatedPrincipalAndCoarseRPCs(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	index, err := client.ReadObjectAdminIndex(ctx, "user-secret", metadataadminsemantic.ObjectAdminIndexRequest{})
	if err != nil || len(index.Objects) != 1 || index.Objects[0].ObjectID != "Account" ||
		index.Objects[0].Description == nil || *index.Objects[0].Description != "Customer accounts" {
		t.Fatalf("object admin index = %#v, %v", index, err)
	}
	workspace, err := client.ReadLayoutAdminWorkspace(ctx, "user-secret", metadataadminsemantic.LayoutAdminWorkspaceRequest{ObjectID: "Account"})
	if err != nil || len(workspace.Layouts) != 1 || !workspace.Layouts[0].IsDefault ||
		len(workspace.Assignments) != 1 || workspace.Assignments[0].LayoutID != "layout-1" {
		t.Fatalf("layout admin workspace = %#v, %v", workspace, err)
	}
	stored, err := client.ReadStoredLayout(ctx, "user-secret", metadataadminsemantic.StoredLayoutRequest{LayoutID: "layout-1"})
	if err != nil || stored.LayoutID != "layout-1" || stored.ObjectID != "Account" || len(stored.StoredDocument) == 0 {
		t.Fatalf("stored layout = %#v, %v", stored, err)
	}
	rules, err := client.ReadValidationRuleAdminIndex(ctx, "user-secret", metadataadminsemantic.ValidationRuleAdminIndexRequest{ObjectID: "Account"})
	if err != nil || len(rules.Rules) != 1 || rules.Rules[0].RuleID != "rule-1" || rules.Rules[0].ObjectID != "Account" {
		t.Fatalf("validation-rule admin index = %#v, %v", rules, err)
	}
	if server.objectAdminIndexCalls.Load() != 1 || server.layoutWorkspaceCalls.Load() != 1 ||
		server.storedLayoutCalls.Load() != 1 || server.validationRuleCalls.Load() != 1 || server.identityCalls.Load() != 1 {
		t.Fatalf("calls object/workspace/stored/rules/identity = %d/%d/%d/%d/%d", server.objectAdminIndexCalls.Load(),
			server.layoutWorkspaceCalls.Load(), server.storedLayoutCalls.Load(), server.validationRuleCalls.Load(), server.identityCalls.Load())
	}
}

func TestPlatformRuntimeApprovalNotificationFlowsUsesDelegatedPrincipalAndCoarseRPC(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	response, err := client.ReadApprovalNotificationFlows(
		ctx,
		"user-secret",
		approvalnotificationsemantic.Request{},
	)
	if err != nil || len(response.Flows) != 1 || response.Flows[0].Name != "Notify_Approver" ||
		response.Flows[0].Label != "Notify Approver" {
		t.Fatalf("approval notification Flows = %#v, %v", response, err)
	}
	if server.approvalFlowReadCalls.Load() != 1 || server.identityCalls.Load() != 1 {
		t.Fatalf("calls notification-flow/identity = %d/%d", server.approvalFlowReadCalls.Load(), server.identityCalls.Load())
	}
}

func TestPlatformRuntimePageLayoutResolutionUsesDelegatedPrincipal(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	recordTypeID := "rt-enterprise"
	response, err := client.ResolvePageLayout(
		ctx, "user-secret", pagelayoutsemantic.Request{
			ObjectID: "Opportunity", RecordTypeIDs: []string{recordTypeID},
		},
	)
	if err != nil || len(response.Selections) != 1 || response.Selections[0].LayoutID != "layout-enterprise" ||
		response.Selections[0].RecordTypeID == nil || *response.Selections[0].RecordTypeID != recordTypeID {
		t.Fatalf("page-layout response = %#v, %v", response, err)
	}
	if server.pageLayoutCalls.Load() != 1 || server.identityCalls.Load() != 1 {
		t.Fatalf("calls page-layout/identity = %d/%d", server.pageLayoutCalls.Load(), server.identityCalls.Load())
	}
}

func TestPlatformRuntimeCurrentListFieldsUsesDelegatedPrincipal(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	response, err := client.ReadObjectListFields(
		ctx, "user-secret", pagelayoutsemantic.ObjectListFieldsRequest{
			ObjectIDs: []string{"Account", "Contact"},
		},
	)
	if err != nil || len(response.Objects) != 2 ||
		!reflect.DeepEqual(response.Objects[0].OrderedFieldIDs, []string{"Name", "OwnerId"}) ||
		response.Objects[1].OrderedFieldIDs == nil || len(response.Objects[1].OrderedFieldIDs) != 0 {
		t.Fatalf("list fields response = %#v, %v", response, err)
	}
	if server.listFieldsCalls.Load() != 1 || server.identityCalls.Load() != 1 {
		t.Fatalf("calls list-fields/identity = %d/%d", server.listFieldsCalls.Load(), server.identityCalls.Load())
	}
}

func TestPlatformRuntimePermissionAuthoringUsesOneRequestBoundDelegatedCapability(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	revision := uint64(1)
	snapshot, err := client.ReadPermissionAuthoringSnapshot(ctx, "user-secret", permissionauthoringsemantic.SnapshotRequest{
		Target:             permissionauthoringsemantic.Target{Kind: permissionauthoringsemantic.TargetProfile, ID: "profile-1"},
		MinCatalogRevision: &revision,
	})
	if err != nil || snapshot.CanonicalPermissionSetID != "permission-set-1" || len(snapshot.Catalog.System) != 1 {
		t.Fatalf("ReadPermissionAuthoringSnapshot = %#v, %v", snapshot, err)
	}

	request := permissionAuthoringTestRequest(t)
	saved, err := client.SavePermissionAuthoring(ctx, "user-secret", request)
	if err != nil || saved.Outcome != permissionauthoringsemantic.OutcomeApplied || saved.CanonicalPermissionSetID != "permission-set-1" {
		t.Fatalf("SavePermissionAuthoring = %#v, %v", saved, err)
	}
	statusResponse, err := client.GetPermissionAuthoringStatus(ctx, "user-secret", request)
	if err != nil || statusResponse.State != permissionauthoringsemantic.CommandCompleted || statusResponse.Result == nil ||
		statusResponse.Result.CanonicalPermissionSetID != "permission-set-1" {
		t.Fatalf("GetPermissionAuthoringStatus = %#v, %v", statusResponse, err)
	}
	if server.identityCalls.Load() != 1 || server.permissionSnapshots.Load() != 1 ||
		server.permissionSaves.Load() != 1 || server.permissionStatuses.Load() != 1 {
		t.Fatalf(
			"calls identity/snapshot/save/status = %d/%d/%d/%d",
			server.identityCalls.Load(), server.permissionSnapshots.Load(), server.permissionSaves.Load(), server.permissionStatuses.Load(),
		)
	}

	// A status response can be valid in isolation while naming another
	// PermissionSet. The public client must keep the original Save intent and
	// reject that terminal instead of returning it to L1 as success.
	server.permissionWrongTerminal.Store(true)
	if _, err := client.GetPermissionAuthoringStatus(ctx, "user-secret", request); err == nil {
		t.Fatal("GetPermissionAuthoringStatus accepted a terminal for another PermissionSet")
	}
}

func TestPlatformRuntimeLayoutAuthoringUsesOneTypedDelegatedCapability(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	submitRequest := layoutauthoringsemantic.SubmitRequest{
		CommandID: "layout-command-1", IdempotencyKey: "layout-request-1", BaseCatalogRevision: 1,
		WaitMode: layoutauthoringsemantic.ReturnAfterAcceptance,
		Operation: layoutauthoringsemantic.CommandOperation{SetDefault: &layoutauthoringsemantic.SetDefaultLayout{
			ObjectID: "Account", LayoutID: "layout-main", ExpectedWorkspaceVersion: "workspace-v0",
		}},
	}
	submitted, err := client.SubmitLayoutAuthoring(ctx, "user-secret", submitRequest)
	if err != nil || submitted.Command.State != layoutauthoringsemantic.StateAccepted {
		t.Fatalf("SubmitLayoutAuthoring = %#v, %v", submitted, err)
	}
	status, err := client.GetLayoutAuthoringCommand(ctx, "user-secret", layoutauthoringsemantic.GetCommandRequest{
		CommandID: submitted.Command.CommandID, RequestDigest: submitted.Command.RequestDigest,
	})
	if err != nil || status.State != layoutauthoringsemantic.StateAccepted {
		t.Fatalf("GetLayoutAuthoringCommand = %#v, %v", status, err)
	}
	viewRef := layoutAuthoringTestViewRef()
	workspace, err := client.ReadLayoutAuthoringWorkspace(ctx, "user-secret", layoutauthoringsemantic.WorkspaceRequest{
		ObjectID: "Account", ViewRef: &viewRef,
	})
	if err != nil || workspace.ObjectID != "Account" || workspace.ViewRef != viewRef {
		t.Fatalf("ReadLayoutAuthoringWorkspace = %#v, %v", workspace, err)
	}
	stored, err := client.ReadLayoutAuthoringStoredLayout(ctx, "user-secret", layoutauthoringsemantic.StoredLayoutRequest{
		LayoutID: "layout-main", ViewRef: &viewRef,
	})
	if err != nil || stored.Document.LayoutID != "layout-main" || stored.ViewRef != viewRef {
		t.Fatalf("ReadLayoutAuthoringStoredLayout = %#v, %v", stored, err)
	}
	if server.identityCalls.Load() != 1 || server.layoutAuthoringSubmits.Load() != 1 ||
		server.layoutAuthoringStatuses.Load() != 1 || server.layoutAuthoringWorkspaces.Load() != 1 ||
		server.layoutAuthoringStoredReads.Load() != 1 {
		t.Fatalf(
			"calls identity/submit/status/workspace/stored = %d/%d/%d/%d/%d",
			server.identityCalls.Load(), server.layoutAuthoringSubmits.Load(), server.layoutAuthoringStatuses.Load(),
			server.layoutAuthoringWorkspaces.Load(), server.layoutAuthoringStoredReads.Load(),
		)
	}
}

func TestPlatformRuntimeLayoutAuthoringV2UsesSynchronousDelegatedCalls(t *testing.T) {
	target, server, transport, cleanup := startPlatformRuntimeTestServer(t)
	defer cleanup()
	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
	defer cancel()
	client, err := dialPlatformRuntimeWithCredentials(ctx, RuntimeClientConfig{
		Target: target, AppInstallationID: "installation-1", WorkloadToken: "workload-secret", AttemptTimeout: 500 * time.Millisecond,
	}, transport)
	if err != nil {
		t.Fatal(err)
	}
	defer client.Close()

	const before = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	workspace, err := client.ReadLayoutAuthoringV2Workspace(ctx, "user-secret", layoutauthoringv2semantic.WorkspaceRequest{ObjectID: "Account"})
	if err != nil || workspace.ObjectID != "Account" || workspace.LayoutRevision != before {
		t.Fatalf("workspace = %#v, %v", workspace, err)
	}
	stored, err := client.ReadLayoutAuthoringV2StoredLayout(ctx, "user-secret", layoutauthoringv2semantic.StoredLayoutRequest{ObjectID: "Account", LayoutID: "layout-main"})
	if err != nil || stored.Document.LayoutID != "layout-main" || !slices.Equal(stored.RequiredCreateFields, []string{"Name"}) {
		t.Fatalf("stored = %#v, %v", stored, err)
	}
	response, err := client.MutateLayoutAuthoringV2(ctx, "user-secret", layoutauthoringv2semantic.Request{
		ObjectID: "Account", ExpectedLayoutRevision: before,
		Operation: layoutauthoringv2semantic.Operation{SetDefault: &layoutauthoringv2semantic.SetDefaultLayout{LayoutID: "layout-main"}},
	})
	if err != nil || !response.Changed || response.LayoutID == nil || *response.LayoutID != "layout-main" || response.LayoutRevision == before {
		t.Fatalf("mutate = %#v, %v", response, err)
	}
	if server.identityCalls.Load() != 1 || server.layoutV2WorkspaceReads.Load() != 1 || server.layoutV2StoredReads.Load() != 1 || server.layoutV2Mutations.Load() != 1 {
		t.Fatalf("calls identity/workspace/stored/mutate = %d/%d/%d/%d", server.identityCalls.Load(), server.layoutV2WorkspaceReads.Load(), server.layoutV2StoredReads.Load(), server.layoutV2Mutations.Load())
	}
}

type layoutAuthoringV2TestServer struct {
	runtimev1.UnimplementedLayoutAuthoringV2ServiceServer
	parent *platformRuntimeTestServer
}

func (s *layoutAuthoringV2TestServer) ReadWorkspace(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringV2ServiceReadWorkspaceRequest,
) (*runtimev1.LayoutAuthoringV2ServiceReadWorkspaceResponse, error) {
	s.parent.layoutV2WorkspaceReads.Add(1)
	s.parent.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireLayoutAuthoringV2ReadWorkspaceRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringv2semantic.CapabilityName)
	}
	return mapping.ToWireLayoutAuthoringV2ReadWorkspaceResponse(semanticRequest, layoutauthoringv2semantic.WorkspaceResponse{
		ObjectID: semanticRequest.ObjectID, LayoutRevision: "sha256:" + strings.Repeat("a", 64),
		Receipts: platformRuntimeTestReceipts(layoutauthoringv2semantic.CapabilityName),
	})
}

func (s *layoutAuthoringV2TestServer) ReadStoredLayout(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringV2ServiceReadStoredLayoutRequest,
) (*runtimev1.LayoutAuthoringV2ServiceReadStoredLayoutResponse, error) {
	s.parent.layoutV2StoredReads.Add(1)
	s.parent.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireLayoutAuthoringV2ReadStoredLayoutRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringv2semantic.CapabilityName)
	}
	document := layoutAuthoringTestDocument()
	document.LayoutID, document.ObjectID = semanticRequest.LayoutID, semanticRequest.ObjectID
	return mapping.ToWireLayoutAuthoringV2ReadStoredLayoutResponse(semanticRequest, layoutauthoringv2semantic.StoredLayoutResponse{
		LayoutID: semanticRequest.LayoutID, ObjectID: semanticRequest.ObjectID,
		LayoutRevision: "sha256:" + strings.Repeat("a", 64), Document: document,
		OrderedListFields: []string{"Name"}, RequiredCreateFields: []string{"Name"},
		Receipts: platformRuntimeTestReceipts(layoutauthoringv2semantic.CapabilityName),
	})
}

func (s *layoutAuthoringV2TestServer) Mutate(
	ctx context.Context,
	request *runtimev1.LayoutAuthoringV2ServiceMutateRequest,
) (*runtimev1.LayoutAuthoringV2ServiceMutateResponse, error) {
	s.parent.layoutV2Mutations.Add(1)
	s.parent.requireDelegation(ctx)
	semanticRequest, err := mapping.FromWireLayoutAuthoringV2MutateRequest(ctx, request)
	if err != nil {
		return nil, mapping.ToPlatformStatusError(err, layoutauthoringv2semantic.CapabilityName)
	}
	layoutID := semanticRequest.Operation.SetDefault.LayoutID
	return mapping.ToWireLayoutAuthoringV2MutateResponse(semanticRequest, layoutauthoringv2semantic.Response{
		Changed: true, LayoutRevision: "sha256:" + strings.Repeat("b", 64), LayoutID: &layoutID,
		Receipts: platformRuntimeTestReceipts(layoutauthoringv2semantic.CapabilityName),
	})
}

func layoutAuthoringTestViewRef() layoutauthoringsemantic.CatalogViewRef {
	return layoutauthoringsemantic.CatalogViewRef{
		CatalogRevision: 1, AuthoringViewDigest: "sha256:" + strings.Repeat("a", 64),
	}
}

func layoutAuthoringTestDocument() layoutauthoringsemantic.LayoutDocument {
	return layoutauthoringsemantic.LayoutDocument{
		LayoutID: "layout-main", ObjectID: "Account", Name: "Main Layout", Kind: "Detail", LayoutVersion: 1,
		CompactFields: []string{}, Tabs: []string{}, Sections: []layoutauthoringsemantic.LayoutSection{},
		RelatedLists: []layoutauthoringsemantic.RelatedList{}, RecordPanels: []layoutauthoringsemantic.RecordPanel{},
		HeaderActions: layoutauthoringsemantic.ActionPlacement{Actions: []layoutauthoringsemantic.LayoutAction{}},
		QuickActions:  layoutauthoringsemantic.ActionPlacement{Actions: []layoutauthoringsemantic.LayoutAction{}},
		RecordStates:  []layoutauthoringsemantic.RecordStateRule{}, PrimaryHeaderActions: []string{},
	}
}

type applicationResultServiceClientProbe struct {
	calls    atomic.Uint64
	response *runtimev1.GetApplicationResultResponse
}

func (p *applicationResultServiceClientProbe) GetApplicationResult(
	context.Context,
	*runtimev1.GetApplicationResultRequest,
	...grpc.CallOption,
) (*runtimev1.GetApplicationResultResponse, error) {
	p.calls.Add(1)
	return p.response, nil
}

func TestPlatformRuntimeApplicationResultFailsClosedBeforeAndAfterTransport(t *testing.T) {
	probe := &applicationResultServiceClientProbe{}
	client := &RuntimePlatformClient{
		connection: new(grpc.ClientConn), results: probe,
		workloadToken: "workload-secret", attemptTimeout: time.Second,
	}
	request := applicationresultsemantic.GetResultRequest{
		CommandID:          "command-1",
		ExecutionRefDigest: "not-a-digest",
	}
	if response, err := client.GetApplicationResult(t.Context(), request); err == nil ||
		response != (applicationresultsemantic.GetResultResponse{}) || probe.calls.Load() != 0 {
		t.Fatalf("invalid request = %#v, %v; calls=%d", response, err, probe.calls.Load())
	}

	request.ExecutionRefDigest = "sha256:" + strings.Repeat("a", 64)
	probe.response = &runtimev1.GetApplicationResultResponse{
		CommandId:          "foreign-command",
		ExecutionRefDigest: request.ExecutionRefDigest,
		State:              runtimev1.ApplicationResultState_APPLICATION_RESULT_STATE_PENDING,
	}
	response, err := client.GetApplicationResult(t.Context(), request)
	var failure *commonsemantic.Failure
	if response != (applicationresultsemantic.GetResultResponse{}) ||
		!errors.As(err, &failure) || failure.Category != commonsemantic.FailureInternal ||
		probe.calls.Load() != 1 {
		t.Fatalf("foreign response = %#v, %#v; calls=%d", response, err, probe.calls.Load())
	}
}

func startPlatformRuntimeTestServer(t *testing.T) (string, *platformRuntimeTestServer, credentials.TransportCredentials, func()) {
	return startPlatformRuntimeTestServerWithOptions(t, false)
}

func startPlatformRuntimePolicyTestServer(t *testing.T, policy *Policy) (string, *platformRuntimeTestServer, credentials.TransportCredentials, func()) {
	t.Helper()
	return startPlatformRuntimeTestServerWithOptions(t, true, policy.ServerOptions()...)
}

func startPlatformRuntimeTestServerWithOptions(t *testing.T, identityBearerByPolicy bool, options ...grpc.ServerOption) (string, *platformRuntimeTestServer, credentials.TransportCredentials, func()) {
	t.Helper()
	listener, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	serverCredentials, clientCredentials := runtimeClientTestCredentials(t)
	server := grpc.NewServer(append([]grpc.ServerOption{grpc.Creds(serverCredentials)}, options...)...)
	implementation := &platformRuntimeTestServer{
		t:                      t,
		identityBearerByPolicy: identityBearerByPolicy,
		fileStarted:            make(chan struct{}),
		fileCanceled:           make(chan struct{}),
	}
	runtimev1.RegisterIdentityContextServiceServer(server, implementation)
	catalogv1.RegisterConsumerViewServiceServer(server, implementation)
	catalogv1.RegisterAppMetadataViewV3ServiceServer(server, implementation)
	runtimev1.RegisterRecordSearchServiceServer(server, implementation)
	runtimev1.RegisterFlowExecutionServiceServer(server, implementation)
	runtimev1.RegisterReportReadServiceServer(server, implementation)
	runtimev1.RegisterAuditLogReadServiceServer(server, implementation)
	runtimev1.RegisterPrivateListViewServiceServer(server, implementation)
	runtimev1.RegisterMetadataAdminReadServiceServer(server, implementation)
	runtimev1.RegisterApprovalNotificationFlowReadServiceServer(server, implementation)
	runtimev1.RegisterConnectedMailboxAuthorizationServiceServer(server, implementation)
	runtimev1.RegisterAuthorizedFilesServiceServer(server, implementation)
	runtimev1.RegisterBulkIngestServiceServer(server, implementation)
	runtimev1.RegisterCommandAcceptanceServiceServer(server, implementation)
	runtimev1.RegisterApplicationResultServiceServer(server, implementation)
	runtimev1.RegisterExternalEffectDispatchServiceServer(server, implementation)
	runtimev1.RegisterOutboundIntentServiceServer(server, implementation)
	runtimev1.RegisterEffectivePermissionServiceServer(server, implementation)
	runtimev1.RegisterPermissionAdministrationServiceServer(server, implementation)
	runtimev1.RegisterPermissionAuthoringServiceServer(server, implementation)
	runtimev1.RegisterLayoutAuthoringServiceServer(server, &layoutAuthoringTestServer{parent: implementation})
	runtimev1.RegisterLayoutAuthoringV2ServiceServer(server, &layoutAuthoringV2TestServer{parent: implementation})
	runtimev1.RegisterApplicationNavigationServiceServer(server, &navigationTestServer{parent: implementation})
	runtimev1.RegisterApprovalServiceServer(server, implementation)
	runtimev1.RegisterPageLayoutResolutionServiceServer(server, implementation)
	go func() { _ = server.Serve(listener) }()
	return "passthrough:///" + listener.Addr().String(), implementation, clientCredentials, func() {
		server.GracefulStop()
		_ = listener.Close()
	}
}

func platformRuntimeTestAppView(t *testing.T) catalogsemantic.AppMetadataView {
	t.Helper()
	behavior := []byte("opaque-behavior")
	component := catalogsemantic.AppMetadataComponent{
		ComponentKind: "metadata.app.neutral.v1", ComponentFormatVersion: 1,
		NamespaceID: "io.nexuscrm.neutral", BusinessKey: "component",
		DefinitionVersion: "1", CanonicalBehavior: behavior,
	}
	component.ComponentID = appauthority.ComponentID(component.NamespaceID, component.ComponentKind, component.BusinessKey)
	var err error
	component.ContentDigest, err = appauthority.ComponentDigest(
		component.ComponentKind,
		component.ComponentFormatVersion,
		behavior,
	)
	if err != nil {
		t.Fatal(err)
	}
	view := catalogsemantic.AppMetadataView{
		OrgID: "org-1", AppInstallationID: "01900000-0000-7000-8000-000000000001", AppID: "io.nexuscrm.neutral",
		AppReleaseDigest: "sha256:" + strings.Repeat("d", 64),
		Lineage: catalogsemantic.ViewLineage{
			CatalogRevision: 1, SchemaGeneration: 1, EngineGeneration: 1,
			SourceSnapshotDigest: "sha256:" + strings.Repeat("b", 64),
		},
		Components: []catalogsemantic.AppMetadataComponent{component},
		Receipts:   platformRuntimeTestReceipts(catalogsemantic.AppMetadataCapabilityName),
	}
	view.Lineage.ViewDigest = catalogsemantic.ComputeAppMetadataViewDigest(view)
	return view
}

func platformRuntimeTestAppViewV2(
	t *testing.T,
) catalogsemantic.AppMetadataViewV2 {
	t.Helper()
	v1 := platformRuntimeTestAppView(t)
	behavior := []byte(`{"objects":[]}`)
	component := catalogsemantic.EffectiveMetadataComponent{
		ComponentKind:          catalogsemantic.EffectiveObjectSearchComponentKind,
		ComponentFormatVersion: 1,
		BusinessKey:            catalogsemantic.EffectiveObjectSearchComponentBusinessKey,
		CanonicalBehavior:      behavior,
	}
	component.ContentDigest =
		catalogsemantic.ComputeEffectiveMetadataComponentDigest(behavior)
	view := catalogsemantic.AppMetadataViewV2{
		OrgID: v1.OrgID, AppInstallationID: v1.AppInstallationID,
		AppID: v1.AppID, AppReleaseDigest: v1.AppReleaseDigest,
		Lineage: v1.Lineage, AppComponents: v1.Components,
		EffectiveComponents: []catalogsemantic.EffectiveMetadataComponent{
			component,
		},
		Receipts: platformRuntimeTestReceipts(
			catalogsemantic.AppMetadataV2CapabilityName,
		),
	}
	view.Lineage.ViewDigest =
		catalogsemantic.ComputeAppMetadataViewV2Digest(view)
	return view
}

func platformRuntimeTestIntegrationView() catalogsemantic.IntegrationBindingView {
	view := catalogsemantic.IntegrationBindingView{
		OrgID:                "org-1",
		AppInstallationID:    "01900000-0000-7000-8000-000000000001",
		AuthorizedWorkloadID: "integration-1",
		Lineage: catalogsemantic.ViewLineage{
			CatalogRevision:      1,
			SchemaGeneration:     1,
			EngineGeneration:     1,
			SourceSnapshotDigest: "sha256:" + strings.Repeat("b", 64),
		},
		Bindings: []catalogsemantic.IntegrationBinding{{
			Kind:               catalogsemantic.BindingConnectorInboundRoute,
			OwnerPack:          "connector-pack",
			PackInstallationID: "pack-installation-1",
			PackPayloadDigest:  "nexus-pack-sha256-v1:" + strings.Repeat("c", 64),
			BusinessKey:        "route-1",
			DefinitionVersion:  1,
			CredentialRefs:     []string{"credential-1"},
			RuntimeCommand: &catalogsemantic.RuntimeCommandBinding{
				CommandKind:          flowcommandsemantic.CommandKind,
				PayloadFormatVersion: flowcommandsemantic.PayloadFormatVersion,
				DefinitionRef:        "Flow_A", DefinitionVersion: "flow-7",
			},
		}},
		Receipts: platformRuntimeTestReceipts(catalogsemantic.IntegrationBindingCapabilityName),
	}
	view.Lineage.ViewDigest = catalogsemantic.ComputeIntegrationBindingViewDigest(view)
	return view
}

func platformRuntimeTestReceipts(capability string) commonsemantic.Receipts {
	return commonsemantic.Receipts{
		ProtocolVersion: "1.0", CapabilityVersion: capability,
		CatalogRevision: 1, SchemaGeneration: 1, EngineGeneration: 1, SecurityEpoch: 1,
	}
}
func TestRequestScopedRuntimeDelegationIsBoundToIssuingAuthority(t *testing.T) {
	config := RuntimeClientConfig{
		Target: "runtime-a", AppInstallationID: "installation-a", WorkloadToken: "workload-a",
	}
	issuer := newIdentityExchangeCoordinator(config)
	ctx := withRequestScopedRuntimeDelegation(
		context.Background(), "header.payload.signature", issuer, config.AppInstallationID,
	)
	if delegation, ok := outgoingRuntimeDelegation(ctx, issuer, config.AppInstallationID); !ok || delegation != "header.payload.signature" {
		t.Fatalf("issuing authority delegation = %q/%v", delegation, ok)
	}
	otherTarget := newIdentityExchangeCoordinator(RuntimeClientConfig{
		Target: "runtime-b", AppInstallationID: config.AppInstallationID, WorkloadToken: config.WorkloadToken,
	})
	if _, ok := outgoingRuntimeDelegation(ctx, otherTarget, config.AppInstallationID); ok {
		t.Fatal("request-scoped delegation crossed its issuing Runtime authority")
	}
	if _, ok := outgoingRuntimeDelegation(ctx, issuer, "installation-b"); ok {
		t.Fatal("request-scoped delegation crossed its AppInstallation authority")
	}
}