#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$repo_root"

if find pkg -type f \( -name '*.pb.go' -o -name '*.proto' \) -print -quit | grep -q .; then
  echo "protobuf artifacts must stay outside the stdlib-only semantic root" >&2
  exit 1
fi

if find pkg -type f -name '*.go' -exec grep -nHE 'google\.golang\.org/(grpc|protobuf)|github\.com/golang/protobuf' {} +; then
  echo "protobuf/gRPC dependency leaked into the semantic root" >&2
  exit 1
fi

if find pkg/runtime/delegationv1 pkg/runtime/identityv1 pkg/runtime/federatedloginv1 -type f -name '*.go' ! -name '*_test.go' \
  -exec grep -nHE 'database/sql|net/http|google\.golang\.org/grpc|github\.com/golang-jwt|os\.|io/fs|crypto/(rand|tls|x509)' {} +; then
  echo "authority state, key IO, or transport runtime leaked into a neutral Runtime contract" >&2
  exit 1
fi

unexpected_root_dependencies="$({
  GOWORK=off go list -deps -test -f '{{if not .Standard}}{{.ImportPath}}{{end}}' ./...
} | sed '/^$/d')"
root_wire_dependencies="$(printf '%s\n' "$unexpected_root_dependencies" | grep -E '^github\.com/pingcap-inc/nexuscrm-contract/wire-go($|/)' || true)"
if [[ -n "$root_wire_dependencies" ]]; then
  echo "stdlib-only root reached the separately released wire module:" >&2
  echo "$root_wire_dependencies" >&2
  exit 1
fi
unexpected_root_dependencies="$(printf '%s\n' "$unexpected_root_dependencies" | grep -v '^github.com/pingcap-inc/nexuscrm-contract\($\|/\)' || true)"
if [[ -n "$unexpected_root_dependencies" ]]; then
  echo "stdlib-only root has external production or test dependencies:" >&2
  echo "$unexpected_root_dependencies" >&2
  exit 1
fi

catalog_publication_v2_dependencies="$({
  GOWORK=off go list -deps -test -f '{{if not .Standard}}{{.ImportPath}}{{end}}' ./pkg/catalogpublicationv2
} | sed '/^$/d' \
  | grep -v '^github\.com/pingcap-inc/nexuscrm-contract/pkg/catalogpublicationv2$' \
  | grep -v '^github\.com/pingcap-inc/nexuscrm-contract/pkg/catalogpublicationv2 \[github\.com/pingcap-inc/nexuscrm-contract/pkg/catalogpublicationv2\.test\]$' \
  | grep -v '^github\.com/pingcap-inc/nexuscrm-contract/pkg/catalogpublicationv2\.test$' || true)"
if [[ -n "$catalog_publication_v2_dependencies" ]]; then
  echo "Catalog publication v2 must remain stdlib-only:" >&2
  echo "$catalog_publication_v2_dependencies" >&2
  exit 1
fi

wire_dependencies="$(cd wire-go && GOWORK=off go list -deps -test -f '{{.ImportPath}}' ./...)"
forbidden_wire_dependencies="$(printf '%s\n' "$wire_dependencies" | grep -E '^database/sql$|^github.com/nexuscrm(/|$)|^github.com/pingcap-inc/nexuscrm-(app-packs|api-host|connectors|controlplane)(/|$)' || true)"
if [[ -n "$forbidden_wire_dependencies" ]]; then
  echo "wire production or test closure reaches a Runtime, L1, database, or sibling L0 implementation:" >&2
  echo "$forbidden_wire_dependencies" >&2
  exit 1
fi

if find wire-go -type f ! -name '*_test.go' ! -path 'wire-go/gen/*' \
  -exec grep -nHE 'grpc\.(ServerOption|DialOption|UnaryServerInterceptor|StatsHandler|NewServer|Dial)|google\.golang\.org/grpc/(metadata|stats|credentials)' {} +; then
  echo "transport-host runtime leaked into the generated wire release boundary" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/records.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/records.proto)" != "2" ]] ||
   ! grep -qE '^  rpc ReadSelectedRoot\(' proto/runtime/v1/records.proto ||
   ! grep -qE '^  rpc EvaluateRecordAccess\(' proto/runtime/v1/records.proto; then
  echo "Runtime records wire must expose exactly the two reviewed coarse RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/record_defaults.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/record_defaults.proto)" != "1" ]] ||
   ! grep -qE '^  rpc PreviewCreateDefaults\(PreviewCreateDefaultsRequest\) returns \(PreviewCreateDefaultsResponse\);$' proto/runtime/v1/record_defaults.proto; then
  echo "Runtime create-default preview wire must expose exactly the reviewed bounded RPC" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/federated_login.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/federated_login.proto)" != "2" ]] ||
   ! grep -qE '^  rpc BeginFederatedLogin\(BeginFederatedLoginRequest\) returns \(BeginFederatedLoginResponse\);$' proto/runtime/v1/federated_login.proto ||
   ! grep -qE '^  rpc ConsumeFederatedLogin\(ConsumeFederatedLoginRequest\) returns \(ConsumeFederatedLoginResponse\);$' proto/runtime/v1/federated_login.proto; then
  echo "Runtime federated-login wire must expose exactly the reviewed begin and consume RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/mutations.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/mutations.proto)" != "2" ]] ||
   ! grep -qE '^  rpc MutateRecords\(stream MutateRecordsRequest\)' proto/runtime/v1/mutations.proto ||
   ! grep -qE '^  rpc GetMutationStatus\(GetMutationStatusRequest\)' proto/runtime/v1/mutations.proto; then
  echo "Runtime mutation wire must expose exactly the reviewed command and reconciliation RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/query.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/query.proto)" != "2" ]] ||
   ! grep -qE '^  rpc QueryRecords\(' proto/runtime/v1/query.proto ||
   ! grep -qE '^  rpc QueryHistory\(' proto/runtime/v1/query.proto; then
  echo "Runtime query wire must expose exactly the two reviewed coarse operations" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/related_counts.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/related_counts.proto)" != "1" ]] ||
   ! grep -qE '^  rpc CountRelatedRecords\(' proto/runtime/v1/related_counts.proto; then
  echo "Runtime related-count wire must expose exactly the reviewed bounded batch RPC" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/recycle_bin.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/recycle_bin.proto)" != "1" ]] ||
   ! grep -qE '^  rpc ListRecycleBin\(' proto/runtime/v1/recycle_bin.proto; then
  echo "Runtime recycle-bin wire must expose exactly the reviewed bounded list RPC" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/recycle_bin_mutation.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/recycle_bin_mutation.proto)" != "2" ]] ||
   ! grep -qE '^  rpc RestoreRecycleBin\(' proto/runtime/v1/recycle_bin_mutation.proto ||
   ! grep -qE '^  rpc PurgeRecycleBin\(' proto/runtime/v1/recycle_bin_mutation.proto; then
  echo "Runtime recycle-bin mutation wire must expose exactly restore and permanent purge" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/record_view.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/record_view.proto)" != "2" ]] ||
   ! grep -qE '^  rpc ReadRecordView\(' proto/runtime/v1/record_view.proto ||
   ! grep -qE '^  rpc ResolveRecordAttachmentSources\(' proto/runtime/v1/record_view.proto; then
  echo "Runtime record-view wire must expose exactly the reviewed read and bounded source-resolution RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/record_attachment_sources.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/record_attachment_sources.proto)" != "1" ]] ||
   ! grep -qE '^  rpc ResolveAttachmentSources\(' proto/runtime/v1/record_attachment_sources.proto; then
  echo "Runtime attachment-source wire must expose exactly the reviewed proof-bound batch RPC" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/list_views.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/list_views.proto)" != "2" ]] ||
   ! grep -qE '^  rpc ReadPrivateListViews\(' proto/runtime/v1/list_views.proto ||
   ! grep -qE '^  rpc MutatePrivateListView\(' proto/runtime/v1/list_views.proto; then
  echo "Runtime private-list-view wire must expose exactly the reviewed read and mutation RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/mailbox_authorization.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/mailbox_authorization.proto)" != "2" ]] ||
   ! grep -qE '^  rpc AuthorizeConnectedMailbox\(AuthorizeConnectedMailboxRequest\) returns \(AuthorizeConnectedMailboxResponse\);$' proto/runtime/v1/mailbox_authorization.proto ||
   ! grep -qE '^  rpc ReauthorizeConnectedMailbox\(ReauthorizeConnectedMailboxRequest\) returns \(ReauthorizeConnectedMailboxResponse\);$' proto/runtime/v1/mailbox_authorization.proto; then
  echo "Runtime connected-mailbox authorization wire must expose exactly the reviewed authorize and reauthorize RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/layout_authoring.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/layout_authoring.proto)" != "4" ]] ||
   ! grep -qE '^  rpc Submit\(LayoutAuthoringServiceSubmitRequest\) returns \(LayoutAuthoringServiceSubmitResponse\);$' proto/runtime/v1/layout_authoring.proto ||
   ! grep -qE '^  rpc GetCommand\(LayoutAuthoringServiceGetCommandRequest\) returns \(LayoutAuthoringServiceGetCommandResponse\);$' proto/runtime/v1/layout_authoring.proto ||
   ! grep -qE '^  rpc ReadWorkspace\(LayoutAuthoringServiceReadWorkspaceRequest\) returns \(LayoutAuthoringServiceReadWorkspaceResponse\);$' proto/runtime/v1/layout_authoring.proto ||
   ! grep -qE '^  rpc ReadStoredLayout\(LayoutAuthoringServiceReadStoredLayoutRequest\) returns \(LayoutAuthoringServiceReadStoredLayoutResponse\);$' proto/runtime/v1/layout_authoring.proto; then
  echo "Runtime Layout authoring wire must expose exactly the reviewed four unary RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/permission_authoring.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/permission_authoring.proto)" != "3" ]] ||
   ! grep -qE '^  rpc ReadPermissionAuthoringSnapshot\(ReadPermissionAuthoringSnapshotRequest\) returns \(ReadPermissionAuthoringSnapshotResponse\);$' proto/runtime/v1/permission_authoring.proto ||
   ! grep -qE '^  rpc SavePermissionAuthoring\(SavePermissionAuthoringRequest\) returns \(SavePermissionAuthoringResponse\);$' proto/runtime/v1/permission_authoring.proto ||
   ! grep -qE '^  rpc GetPermissionAuthoringStatus\(GetPermissionAuthoringStatusRequest\) returns \(GetPermissionAuthoringStatusResponse\);$' proto/runtime/v1/permission_authoring.proto; then
  echo "Runtime Permission authoring wire must expose exactly the reviewed snapshot, save, and status RPCs" >&2
  exit 1
fi

if [[ "$(grep -cE '^service ' proto/runtime/v1/application_navigation.proto)" != "1" ]] ||
   [[ "$(grep -cE '^  rpc ' proto/runtime/v1/application_navigation.proto)" != "3" ]] ||
   ! grep -qE '^  rpc Read\(ApplicationNavigationServiceReadRequest\) returns \(ApplicationNavigationServiceReadResponse\);$' proto/runtime/v1/application_navigation.proto ||
   ! grep -qE '^  rpc Resolve\(ApplicationNavigationServiceResolveRequest\) returns \(ApplicationNavigationServiceResolveResponse\);$' proto/runtime/v1/application_navigation.proto ||
   ! grep -qE '^  rpc Save\(ApplicationNavigationServiceSaveRequest\) returns \(ApplicationNavigationServiceSaveResponse\);$' proto/runtime/v1/application_navigation.proto; then
  echo "Runtime navigation wire must expose exactly the reviewed synchronous read, resolve, and save RPCs" >&2
  exit 1
fi

platform_proto_files=(
  proto/runtime/v1/application_navigation.proto
  proto/catalog/v1/consumer_views.proto
  proto/runtime/v1/search.proto
  proto/runtime/v1/flow.proto
  proto/runtime/v1/report.proto
  proto/runtime/v1/files.proto
	proto/runtime/v1/bulk_ingest.proto
  proto/runtime/v1/application_results.proto
  proto/runtime/v1/outbound_intents.proto
  proto/runtime/v1/mailbox_authorization.proto
  proto/runtime/v1/commands.proto
  proto/runtime/v1/effective_permissions.proto
  proto/runtime/v1/approvals.proto
  proto/runtime/v1/approval_notification_flows.proto
  proto/runtime/v1/page_layout_resolution.proto
  proto/runtime/v1/list_views.proto
	proto/runtime/v1/metadata_admin_read.proto
  proto/runtime/v1/permission_admin.proto
  proto/runtime/v1/permission_authoring.proto
  proto/runtime/v1/analytics_authoring.proto
  proto/runtime/v1/resource_access.proto
  proto/runtime/v1/layout_authoring.proto
  proto/runtime/v1/layout_authoring_v2.proto
)
if [[ "$(grep -hEc '^service ' "${platform_proto_files[@]}" | awk '{sum += $1} END {print sum}')" != "25" ]] ||
   [[ "$(grep -hEc '^  rpc ' "${platform_proto_files[@]}" | awk '{sum += $1} END {print sum}')" != "59" ]] ||
   ! grep -qE '^  rpc GetAppMetadataView\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc WatchAppMetadataView\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc GetAppMetadataViewV2\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc WatchAppMetadataViewV2\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc GetAppMetadataViewV3\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc WatchAppMetadataViewV3\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc GetIntegrationBindingView\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc WatchIntegrationBindingView\(' proto/catalog/v1/consumer_views.proto ||
   ! grep -qE '^  rpc SearchRecords\(' proto/runtime/v1/search.proto ||
   ! grep -qE '^  rpc ReadSearchScopeOrder\(' proto/runtime/v1/search.proto ||
   ! grep -qE '^  rpc ExecuteFlow\(' proto/runtime/v1/flow.proto ||
   ! grep -qE '^  rpc PreviewCatalogAction\(' proto/runtime/v1/flow.proto ||
   ! grep -qE '^  rpc ReadReport\(' proto/runtime/v1/report.proto ||
   ! grep -qE '^  rpc CreateFile\(stream CreateFileRequest\)' proto/runtime/v1/files.proto ||
   ! grep -qE '^  rpc OpenFile\(OpenFileRequest\) returns \(stream OpenFileResponse\)' proto/runtime/v1/files.proto ||
   ! grep -qE '^  rpc DeleteFile\(' proto/runtime/v1/files.proto ||
   ! grep -qE '^  rpc CreateBulkIngestJob\(' proto/runtime/v1/bulk_ingest.proto ||
   ! grep -qE '^  rpc ReadBulkIngestJob\(' proto/runtime/v1/bulk_ingest.proto ||
   ! grep -qE '^  rpc CloseBulkIngestJob\(' proto/runtime/v1/bulk_ingest.proto ||
   ! grep -qE '^  rpc UploadBulkIngestData\(stream UploadBulkIngestDataRequest\)' proto/runtime/v1/bulk_ingest.proto ||
   ! grep -qE '^  rpc GetApplicationResult\(GetApplicationResultRequest\) returns \(GetApplicationResultResponse\);$' proto/runtime/v1/application_results.proto ||
   ! grep -qE '^  rpc ReadOutboundIntentGeneration\(ReadOutboundIntentGenerationRequest\) returns \(ReadOutboundIntentGenerationResponse\);$' proto/runtime/v1/outbound_intents.proto ||
   ! grep -qE '^  rpc ListPendingOutboundIntents\(ListPendingOutboundIntentsRequest\) returns \(ListPendingOutboundIntentsResponse\);$' proto/runtime/v1/outbound_intents.proto ||
   ! grep -qE '^  rpc AcknowledgeOutboundIntent\(AcknowledgeOutboundIntentRequest\) returns \(AcknowledgeOutboundIntentResponse\);$' proto/runtime/v1/outbound_intents.proto ||
   ! grep -qE '^  rpc CommitOutboundResult\(CommitOutboundResultRequest\) returns \(CommitOutboundResultResponse\);$' proto/runtime/v1/outbound_intents.proto ||
   ! grep -qE '^  rpc CommitOutboundNoEffect\(CommitOutboundNoEffectRequest\) returns \(CommitOutboundNoEffectResponse\);$' proto/runtime/v1/outbound_intents.proto ||
   ! grep -qE '^  rpc OpenOutboundMailAttachment\(OpenOutboundMailAttachmentRequest\) returns \(stream OpenOutboundMailAttachmentResponse\);$' proto/runtime/v1/outbound_intents.proto ||
   ! grep -qE '^  rpc AuthorizeConnectedMailbox\(AuthorizeConnectedMailboxRequest\) returns \(AuthorizeConnectedMailboxResponse\);$' proto/runtime/v1/mailbox_authorization.proto ||
   ! grep -qE '^  rpc ReauthorizeConnectedMailbox\(ReauthorizeConnectedMailboxRequest\) returns \(ReauthorizeConnectedMailboxResponse\);$' proto/runtime/v1/mailbox_authorization.proto ||
   ! grep -qE '^  rpc AcceptCommand\(' proto/runtime/v1/commands.proto ||
   ! grep -qE '^  rpc ReadEffectivePermissions\(' proto/runtime/v1/effective_permissions.proto ||
   ! grep -qE '^  rpc ExecuteApproval\(' proto/runtime/v1/approvals.proto ||
   ! grep -qE '^  rpc ReadApproval\(' proto/runtime/v1/approvals.proto ||
   ! grep -qE '^  rpc ReadApprovalNotificationFlows\(ReadApprovalNotificationFlowsRequest\) returns \(ReadApprovalNotificationFlowsResponse\);$' proto/runtime/v1/approval_notification_flows.proto ||
   ! grep -qE '^  rpc MutateAnalyticsDefinition\(MutateAnalyticsDefinitionRequest\) returns \(MutateAnalyticsDefinitionResponse\);$' proto/runtime/v1/analytics_authoring.proto ||
   ! grep -qE '^  rpc AccessResource\(AccessResourceRequest\) returns \(AccessResourceResponse\);$' proto/runtime/v1/resource_access.proto ||
   ! grep -qE '^  rpc ResolvePageLayout\(ResolvePageLayoutRequest\) returns \(ResolvePageLayoutResponse\);$' proto/runtime/v1/page_layout_resolution.proto ||
   ! grep -qE '^  rpc ReadObjectListFields\(ReadObjectListFieldsRequest\) returns \(ReadObjectListFieldsResponse\);$' proto/runtime/v1/page_layout_resolution.proto ||
   ! grep -qE '^  rpc ReadPrivateListViews\(' proto/runtime/v1/list_views.proto ||
   ! grep -qE '^  rpc MutatePrivateListView\(' proto/runtime/v1/list_views.proto ||
   ! grep -qE '^  rpc ReadObjectAdminIndex\(' proto/runtime/v1/metadata_admin_read.proto ||
   ! grep -qE '^  rpc ReadLayoutAdminWorkspace\(' proto/runtime/v1/metadata_admin_read.proto ||
   ! grep -qE '^  rpc ReadStoredLayout\(' proto/runtime/v1/metadata_admin_read.proto ||
   ! grep -qE '^  rpc ReadValidationRuleAdminIndex\(' proto/runtime/v1/metadata_admin_read.proto ||
   ! grep -qE '^  rpc ReadPermissionAdministration\(' proto/runtime/v1/permission_admin.proto ||
   ! grep -qE '^  rpc MutatePermissionAdministration\(' proto/runtime/v1/permission_admin.proto ||
   ! grep -qE '^  rpc ReadPermissionAuthoringSnapshot\(' proto/runtime/v1/permission_authoring.proto ||
   ! grep -qE '^  rpc SavePermissionAuthoring\(' proto/runtime/v1/permission_authoring.proto ||
   ! grep -qE '^  rpc GetPermissionAuthoringStatus\(' proto/runtime/v1/permission_authoring.proto ||
   ! grep -qE '^  rpc ReadWorkspace\(LayoutAuthoringV2ServiceReadWorkspaceRequest\) returns \(LayoutAuthoringV2ServiceReadWorkspaceResponse\);$' proto/runtime/v1/layout_authoring_v2.proto ||
   ! grep -qE '^  rpc ReadStoredLayout\(LayoutAuthoringV2ServiceReadStoredLayoutRequest\) returns \(LayoutAuthoringV2ServiceReadStoredLayoutResponse\);$' proto/runtime/v1/layout_authoring_v2.proto ||
   ! grep -qE '^  rpc Mutate\(LayoutAuthoringV2ServiceMutateRequest\) returns \(LayoutAuthoringV2ServiceMutateResponse\);$' proto/runtime/v1/layout_authoring_v2.proto; then
  echo "Catalog and Runtime wire owners must expose exactly the reviewed coarse private operations" >&2
  exit 1
fi

if find proto wire-go -type f ! -name '*_test.go' ! -name 'go.sum' \
  -exec grep -nHiE 'salesforce|sfcrm|sobject|soql|issue[-_ ]tracker' {} +; then
  echo "App-specific vocabulary leaked into the neutral wire" >&2
  exit 1
fi

if find pkg/catalog/consumerv1 pkg/runtime/delegationv1 pkg/runtime/identityv1 pkg/runtime/federatedloginv1 pkg/runtime/commonv1 pkg/runtime/recordaccessv1 pkg/runtime/recordmutationv1 pkg/runtime/queryv1 pkg/runtime/relatedcountsv1 pkg/runtime/recorddefaultsv1 pkg/runtime/recyclebinv1 pkg/runtime/recordviewv1 pkg/runtime/recordattachmentsv1 pkg/runtime/searchv1 pkg/runtime/flowv1 pkg/runtime/reportv1 pkg/runtime/filesv1 pkg/runtime/bulkingestv1 pkg/runtime/commandv1 pkg/runtime/applicationresultv1 pkg/runtime/outboundintentv1 pkg/runtime/mailboxauthorizationv1 pkg/runtime/effectivepermissionsv1 pkg/runtime/listviewv1 pkg/runtime/metadataadminreadv1 pkg/runtime/approvalnotificationflowv1 pkg/runtime/pagelayoutresolutionv1 pkg/runtime/servingbindingv1 pkg/runtime/permissionadminv1 pkg/runtime/permissionauthoringv1 pkg/runtime/analyticsauthoringv1 pkg/runtime/resourceaccessv1 pkg/runtime/layoutauthoringv1 pkg/runtime/layoutauthoringv2 -type f ! -name '*_test.go' -exec grep -nHiE 'salesforce|sfcrm|sobject|soql|issue[-_ ]tracker' {} + ||
   grep -nHiE 'salesforce|sfcrm|sobject|soql|issue[-_ ]tracker' RUNTIME_DELEGATION_V1.md; then
  echo "App-specific vocabulary leaked into the neutral delegation contract or immutable vector" >&2
  exit 1
fi

mutation_command_shape="$(sed -n '/^message MutationCommand {/,/^}/p' proto/runtime/v1/mutations.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$mutation_command_shape"; then
  echo "caller-selected authority leaked into MutationCommand" >&2
  exit 1
fi

query_request_shape="$(sed -n '/^message QueryRecordsRequest {/,/^}/p' proto/runtime/v1/query.proto)"
history_request_shape="$(sed -n '/^message QueryHistoryRequest {/,/^}/p' proto/runtime/v1/query.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$query_request_shape$history_request_shape"; then
  echo "caller-selected authority leaked into RecordQueryService requests" >&2
  exit 1
fi

related_count_spec_shape="$(sed -n '/^message RelatedRecordCountSpec {/,/^}/p' proto/runtime/v1/related_counts.proto)"
related_count_request_shape="$(sed -n '/^message CountRelatedRecordsRequest {/,/^}/p' proto/runtime/v1/related_counts.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$related_count_spec_shape$related_count_request_shape"; then
  echo "caller-selected authority leaked into RelatedRecordCountService requests" >&2
  exit 1
fi

create_default_request_shape="$(sed -n '/^message PreviewCreateDefaultsRequest {/,/^}/p' proto/runtime/v1/record_defaults.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$create_default_request_shape"; then
  echo "caller-selected authority leaked into RecordCreateDefaultPreviewService request" >&2
  exit 1
fi

recycle_bin_request_shape="$(sed -n '/^message ListRecycleBinRequest {/,/^}/p' proto/runtime/v1/recycle_bin.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$recycle_bin_request_shape"; then
  echo "caller-selected authority leaked into RecycleBinReadService request" >&2
  exit 1
fi

recycle_bin_mutation_request_shape="$(
  sed -n \
    -e '/^message RestoreRecycleBinRequest {/,/^}/p' \
    -e '/^message PurgeRecycleBinRequest {/,/^}/p' \
    proto/runtime/v1/recycle_bin_mutation.proto
)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority|operation' <<<"$recycle_bin_mutation_request_shape"; then
  echo "caller-selected authority or duplicate operation leaked into RecycleBinMutationService requests" >&2
  exit 1
fi

record_view_read_request_shape="$(sed -n '/^message ReadRecordViewRequest {/,/^}/p' proto/runtime/v1/record_view.proto)"
record_view_resolve_request_shape="$(sed -n '/^message ResolveRecordAttachmentSourcesRequest {/,/^}/p' proto/runtime/v1/record_view.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$record_view_read_request_shape$record_view_resolve_request_shape"; then
  echo "caller-selected authority leaked into RecordViewReadService requests" >&2
  exit 1
fi

attachment_source_request_shape="$(sed -n '/^message ResolveAttachmentSourcesRequest {/,/^}/p' proto/runtime/v1/record_attachment_sources.proto)"
attachment_source_proof_shape="$(sed -n '/^message AttachmentSourceProof {/,/^}/p' proto/runtime/v1/record_attachment_sources.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$attachment_source_request_shape$attachment_source_proof_shape"; then
  echo "caller-selected authority leaked into RecordAttachmentSourceResolutionService request" >&2
  exit 1
fi

catalog_request_shape="$(
  sed -n \
    -e '/^message GetAppMetadataViewRequest {/,/^}/p' \
    -e '/^message WatchAppMetadataViewRequest {/,/^}/p' \
    -e '/^message GetAppMetadataViewV2Request {/,/^}/p' \
    -e '/^message WatchAppMetadataViewV2Request {/,/^}/p' \
    -e '/^message GetAppMetadataViewV3Request {/,/^}/p' \
    -e '/^message WatchAppMetadataViewV3Request {/,/^}/p' \
    -e '/^message GetIntegrationBindingViewRequest {/,/^}/p' \
    -e '/^message WatchIntegrationBindingViewRequest {/,/^}/p' \
    proto/catalog/v1/consumer_views.proto
)"
platform_request_shape="$(
  sed -n \
    -e '/^message SearchRecordsRequest {/,/^}/p' \
    -e '/^message ReadSearchScopeOrderRequest {/,/^}/p' \
    -e '/^message ExecuteFlowRequest {/,/^}/p' \
    -e '/^message PreviewCatalogActionRequest {/,/^}/p' \
    -e '/^message ReadReportRequest {/,/^}/p' \
    -e '/^message CreateFileHeader {/,/^}/p' \
    -e '/^message OpenFileRequest {/,/^}/p' \
    -e '/^message DeleteFileRequest {/,/^}/p' \
    -e '/^message GetApplicationResultRequest {/,/^}/p' \
    -e '/^message ReadOutboundIntentGenerationRequest {/,/^}/p' \
    -e '/^message ListPendingOutboundIntentsRequest {/,/^}/p' \
    -e '/^message AcknowledgeOutboundIntentRequest {/,/^}/p' \
    -e '/^message CommitOutboundResultRequest {/,/^}/p' \
    -e '/^message AuthorizeConnectedMailboxRequest {/,/^}/p' \
    -e '/^message ReauthorizeConnectedMailboxRequest {/,/^}/p' \
    -e '/^message AcceptCommandRequest {/,/^}/p' \
    -e '/^message ExecuteApprovalRequest {/,/^}/p' \
    -e '/^message ReadApprovalRequest {/,/^}/p' \
    -e '/^message ReadApprovalNotificationFlowsRequest {/,/^}/p' \
    -e '/^message ResolvePageLayoutRequest {/,/^}/p' \
    -e '/^message ReadPrivateListViewsRequest {/,/^}/p' \
    -e '/^message MutatePrivateListViewRequest {/,/^}/p' \
    -e '/^message ReadObjectAdminIndexRequest {/,/^}/p' \
    -e '/^message ReadLayoutAdminWorkspaceRequest {/,/^}/p' \
    -e '/^message ReadStoredLayoutRequest {/,/^}/p' \
    -e '/^message ReadValidationRuleAdminIndexRequest {/,/^}/p' \
    -e '/^message LayoutAuthoringV2ServiceReadWorkspaceRequest {/,/^}/p' \
    -e '/^message LayoutAuthoringV2ServiceReadStoredLayoutRequest {/,/^}/p' \
    -e '/^message LayoutAuthoringV2ServiceMutateRequest {/,/^}/p' \
    -e '/^message CreateBulkIngestJobRequest {/,/^}/p' \
    -e '/^message ReadBulkIngestJobRequest {/,/^}/p' \
    -e '/^message CloseBulkIngestJobRequest {/,/^}/p' \
    -e '/^message UploadBulkIngestDataHeader {/,/^}/p' \
    proto/runtime/v1/search.proto proto/runtime/v1/flow.proto proto/runtime/v1/report.proto \
    proto/runtime/v1/files.proto proto/runtime/v1/application_results.proto \
    proto/runtime/v1/outbound_intents.proto proto/runtime/v1/mailbox_authorization.proto proto/runtime/v1/commands.proto \
    proto/runtime/v1/approvals.proto proto/runtime/v1/approval_notification_flows.proto \
    proto/runtime/v1/page_layout_resolution.proto \
    proto/runtime/v1/list_views.proto proto/runtime/v1/metadata_admin_read.proto \
    proto/runtime/v1/bulk_ingest.proto proto/runtime/v1/layout_authoring_v2.proto
)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$catalog_request_shape$platform_request_shape"; then
  echo "caller-selected authority leaked into Platform API requests" >&2
  exit 1
fi

analytics_authoring_request_shape="$(sed -n '/^message MutateAnalyticsDefinitionRequest {/,/^}/p' proto/runtime/v1/analytics_authoring.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$analytics_authoring_request_shape"; then
  echo "caller-selected authority leaked into AnalyticsAuthoringService request" >&2
  exit 1
fi

permission_admin_request_shape="$(
  sed -n \
    -e '/^message ReadPermissionAdministrationRequest {/,/^}/p' \
    -e '/^message MutatePermissionAdministrationRequest {/,/^}/p' \
    proto/runtime/v1/permission_admin.proto
)"
if grep -Eiq 'org|principal|user|rls|fls|security|bearer|token|app_installation|authority' <<<"$permission_admin_request_shape"; then
  echo "caller-selected authority leaked into PermissionAdministrationService requests" >&2
  exit 1
fi

permission_authoring_request_shape="$(
  sed -n \
    -e '/^message ReadPermissionAuthoringSnapshotRequest {/,/^}/p' \
    -e '/^message SavePermissionAuthoringRequest {/,/^}/p' \
    -e '/^message GetPermissionAuthoringStatusRequest {/,/^}/p' \
    proto/runtime/v1/permission_authoring.proto
)"
if grep -Eiq 'org|principal|user|rls|fls|security|bearer|app_installation|authority|viewer|caller' <<<"$permission_authoring_request_shape"; then
  echo "caller-selected authority leaked into PermissionAuthoringService requests" >&2
  exit 1
fi

resource_access_request_shape="$(sed -n '/^message AccessResourceRequest {/,/^}/p' proto/runtime/v1/resource_access.proto)"
if grep -Eiq 'org|user|permission|rls|fls|security|bearer|token|app_installation|authority|viewer|caller' <<<"$resource_access_request_shape"; then
  echo "caller-selected authority leaked into ResourceAccessService request" >&2
  exit 1
fi

effective_permission_request_shape="$(
  sed -n '/^message ReadEffectivePermissionsRequest {/,/^}/p' \
    proto/runtime/v1/effective_permissions.proto
)"
if ! grep -qE '^  string target_principal_id = 1;$' <<<"$effective_permission_request_shape" ||
   grep -Eiq 'org|viewer|caller|user|bearer|token|app_installation|authority' <<<"$effective_permission_request_shape"; then
  echo "effective-permission request must carry only an authorized target subject and revision fence" >&2
  exit 1
fi

request_shape="$(sed -n '/^message ReadSelectedRootRequest {/,/^}/p' proto/runtime/v1/records.proto)"
if grep -Eiq 'org|principal|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$request_shape"; then
  echo "caller-selected authority leaked into ReadSelectedRootRequest" >&2
  exit 1
fi

record_access_request_shape="$(sed -n '/^message EvaluateRecordAccessRequest {/,/^}/p' proto/runtime/v1/records.proto)"
if grep -Eiq 'org|principal|user|permission|rls|fls|security|bearer|token|app_installation|authority' <<<"$record_access_request_shape"; then
  echo "caller-selected authority leaked into EvaluateRecordAccessRequest" >&2
  exit 1
fi

echo "semantic/wire dependency boundary: OK"