<?php
declare(strict_types=1);
function requireContract(bool $condition, string $message): void { if (!$condition) { throw new RuntimeException($message); } }
$root = dirname(__DIR__);
$routes = file_get_contents($root . '/app/adminapi/route/app.php');
$controller = file_get_contents($root . '/app/adminapi/controller/IamV2Controller.php');
$source = file_get_contents($root . '/app/adminapi/service/iam/v2/IamV2Source.php');
$client = file_get_contents($root . '/app/adminapi/service/iam/v2/IamV2Client.php');
$config = file_get_contents($root . '/config/iam.php');
foreach (['proofs/introspect','sessions/check','events/revocation','operations','batch/preflight','batch','launch/start','self-link/start','password-setup'] as $route) {
    requireContract(str_contains($routes,"Route::post('iam/v2/".$route."'"), 'POST registration ' . $route);
}
requireContract(str_contains($controller, "METHOD_NOT_ALLOWED"), 'default auto-route verbs checked');
requireContract(str_contains($controller,"hash_equals('Bearer ' . \$expected"), 'source service secret constant-time');
requireContract(str_contains($controller,'INVALID_ORIGIN'), 'browser mutation origin');
requireContract(str_contains($source,"self::check(\$p['sessionId']"), 'proof checks live session');
requireContract(str_contains($source,"self::authorize(\$session, substr(\$cap, 4)"), 'proof rechecks live permission');
requireContract(str_contains($source,"self::scope((int) \$session['admin_id'], \$targets)"), 'target data scope');
requireContract(str_contains($client,'CURLOPT_FOLLOWLOCATION => false') && str_contains($client,'CURLOPT_SSL_VERIFYPEER => true'), 'TLS fixed host no redirect');
requireContract(str_contains($config,"'v2_enabled' => env('iam.v2_enabled', false)"), 'default OFF');
requireContract(!str_contains($controller,"'token' =>"), 'no business token callback');
requireContract(str_contains($controller,"verifiedIdToken()") && str_contains($controller,"'oidcNonce' =>"), 'self-link independently verifiable OIDC token and nonce');
requireContract(!str_contains($controller,"request->post('employeeId'"), 'no browser chosen personal employee');
echo "PASS IamV2RouteContractTest: fixed POST callbacks, auto-route method gate, origin/service authentication, live proof authorization, target scope, dedicated TLS client, default-off, personal OIDC proof\n";