#!/usr/bin/env bash
# Non-custody tripwire: the codebase must never contain key material or signing code.
# Fails the build if any source file references private keys, mnemonics, or transaction signing.
set -euo pipefail
cd "$(dirname "$0")/.."

PATTERN='privateKey|private_key|mnemonic|signTransaction|secretKey|seed[Pp]hrase'
DIRS="apps packages plugins deploy scripts"

MATCHES=$(grep -rInE "$PATTERN" $DIRS \
  --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git \
  --exclude=check-no-custody.sh 2>/dev/null || true)

if [ -n "$MATCHES" ]; then
  echo "NON-CUSTODY TRIPWIRE FAILED — key/signing references found in source:"
  echo "$MATCHES"
  exit 1
fi
echo "non-custody check passed: no key material or signing code in source."